thatcher 1.0.68 → 1.0.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.68",
+  "version": "1.0.69",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/index.js

@@ -305,9 +305,9 @@ export class Thatcher {
     return list(entity, where, opts);
   }
 
-  async get(entity, id) {
+  async get(entity, id, opts = {}) {
     const { get } = await import(resolveModule('./lib/busybase/store.js'));
-    return get(entity, id);
+    return get(entity, id, opts);
   }
 
   async create(entity, data, user) {

package/src/lib/config-generator-engine.js

@@ -513,6 +513,21 @@ export class ConfigGeneratorEngine {
       };
     }
 
+    // Field-level RBAC: a field's visible_to/editable_by (already present on
+    // spec.fields[key] via the `...field` spread above) is compiled into
+    // spec.fieldPermissions, the shape permission.service.js's checkFieldAccess
+    // already reads. A field with neither key contributes no entry here, so
+    // checkFieldAccess's `if (!perm) return true` keeps every role's access
+    // exactly as it was before this feature existed -- no regression for the
+    // overwhelming majority of fields that never set either key.
+    for (const [key, field] of Object.entries(spec.fields)) {
+      if (!field.visible_to && !field.editable_by) continue;
+      spec.fieldPermissions = spec.fieldPermissions || {};
+      spec.fieldPermissions[key] = {};
+      if (field.visible_to) spec.fieldPermissions[key].view = field.visible_to;
+      if (field.editable_by) spec.fieldPermissions[key].edit = field.editable_by;
+    }
+
     if (entityDef.permission_template) {
       const matrix = this.getPermissionTemplate(entityDef.permission_template);
       const access = {};

package/src/server/server.js

@@ -382,22 +382,37 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     let result;
     let status = 200;
 
+    const { permissionService } = await import('../services/permission.service.js');
+
     switch (req.method) {
       case 'GET':
         if (id) {
-          result = await thatcher.get(entity, id);
+          // get(...,{user}) applies the same row/org-access scoping every other
+          // read path in the codebase uses -- this generic-CRUD GET-by-id had
+          // none at all, so any authenticated user could read any record by id
+          // across organizations. filterFields then strips any field the
+          // caller's role isn't visible_to, the field-level half of this pass.
+          result = await thatcher.get(entity, id, { user });
           if (!result) {
             res.writeHead(404);
             res.end(JSON.stringify({ error: 'Not found' }));
             return;
           }
+          result = permissionService.filterFields(user, spec, result);
         } else {
           result = await thatcher.list(entity, {}, { user });
+          result = result.map(r => permissionService.filterFields(user, spec, r));
         }
         break;
 
       case 'POST':
+        // enforceEditPermissions is the authoritative field-level write check --
+        // it throws if the payload touches a field the caller's role isn't
+        // editable_by, so a hand-crafted request bypassing the rendered form
+        // cannot smuggle a restricted field in.
+        permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.create(entity, body, user);
+        result = permissionService.filterFields(user, spec, result);
         status = 201;
         break;
 
@@ -408,7 +423,9 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
           res.end(JSON.stringify({ error: 'ID required' }));
           return;
         }
+        permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.update(entity, id, body, user);
+        result = permissionService.filterFields(user, spec, result);
         break;
 
       case 'DELETE':

package/src/ui/entity-renderer.js

@@ -1,6 +1,7 @@
 import { page, dataTable } from '@/ui/layout.js'
 import { fmtVal, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { canCreate, canEdit, canDelete } from '@/ui/permissions-ui.js'
+import { permissionService } from '@/services/permission.service.js'
 
 export function renderEntityList(entityName, items, spec, user, options = {}) {
   const label = spec?.labelPlural || spec?.label || entityName
@@ -85,7 +86,10 @@ function formatFieldValue(k, v, entityName, f) {
 
 export function renderEntityDetail(entityName, item, spec, user) {
   const label = spec?.label || entityName
-  const fields = spec?.fields || {}
+  // A field the caller's role isn't visible_to must never reach rendered HTML,
+  // not just be CSS-hidden -- filterFields drops it from `fields` entirely so
+  // it can't appear in visibleFields below however this function evolves.
+  const fields = permissionService.filterFields(user, spec || {}, spec?.fields || {})
   const userCanEdit = canEdit(user, entityName)
   const userCanDelete = canDelete(user, entityName)
 
@@ -141,7 +145,15 @@ export function renderEntityDetail(entityName, item, spec, user) {
 
 export function renderEntityForm(entityName, item, spec, user, isNew = false, refOptions = {}, templates = []) {
   const label = spec?.label || entityName
-  const fields = spec?.fields || {}
+  // A field the caller's role isn't editable_by must not be offered in the
+  // form at all -- omitting it here is UX (a clean form), the real
+  // enforcement is enforceEditPermissions rejecting the field server-side if
+  // a raw request includes it anyway.
+  const allFields = spec?.fields || {}
+  const fields = {}
+  for (const [k, f] of Object.entries(allFields)) {
+    if (permissionService.checkFieldAccess(user, spec || {}, k, 'edit')) fields[k] = f
+  }
   const lbl = (k, f, req) => `<label class="form-label" for="field-${k}">${esc(f.label||k)}${req ? '<span class="req">*</span>' : ''}</label>`
   const formFields = Object.entries(fields).filter(([k, f]) => k !== 'id' && !f.auto && !f.readOnly && !f.auto_generate && k !== 'password_hash').map(([k, f]) => {
     let val = item?.[k] ?? f.default ?? ''