thatcher 1.0.68 → 1.0.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.68",
+  "version": "1.0.70",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/index.js

@@ -305,9 +305,9 @@ export class Thatcher {
     return list(entity, where, opts);
   }
 
-  async get(entity, id) {
+  async get(entity, id, opts = {}) {
     const { get } = await import(resolveModule('./lib/busybase/store.js'));
-    return get(entity, id);
+    return get(entity, id, opts);
   }
 
   async create(entity, data, user) {

package/src/lib/config-generator-engine.js

@@ -513,6 +513,21 @@ export class ConfigGeneratorEngine {
       };
     }
 
+    // Field-level RBAC: a field's visible_to/editable_by (already present on
+    // spec.fields[key] via the `...field` spread above) is compiled into
+    // spec.fieldPermissions, the shape permission.service.js's checkFieldAccess
+    // already reads. A field with neither key contributes no entry here, so
+    // checkFieldAccess's `if (!perm) return true` keeps every role's access
+    // exactly as it was before this feature existed -- no regression for the
+    // overwhelming majority of fields that never set either key.
+    for (const [key, field] of Object.entries(spec.fields)) {
+      if (!field.visible_to && !field.editable_by) continue;
+      spec.fieldPermissions = spec.fieldPermissions || {};
+      spec.fieldPermissions[key] = {};
+      if (field.visible_to) spec.fieldPermissions[key].view = field.visible_to;
+      if (field.editable_by) spec.fieldPermissions[key].edit = field.editable_by;
+    }
+
     if (entityDef.permission_template) {
       const matrix = this.getPermissionTemplate(entityDef.permission_template);
       const access = {};

package/src/server/server.js

@@ -382,45 +382,86 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     let result;
     let status = 200;
 
+    const { permissionService } = await import('../services/permission.service.js');
+
     switch (req.method) {
       case 'GET':
         if (id) {
-          result = await thatcher.get(entity, id);
+          // get(...,{user}) applies the same row/org-access scoping every other
+          // read path in the codebase uses -- this generic-CRUD GET-by-id had
+          // none at all, so any authenticated user could read any record by id
+          // across organizations. filterFields then strips any field the
+          // caller's role isn't visible_to, the field-level half of this pass.
+          result = await thatcher.get(entity, id, { user });
           if (!result) {
             res.writeHead(404);
             res.end(JSON.stringify({ error: 'Not found' }));
             return;
           }
+          result = permissionService.filterFields(user, spec, result);
         } else {
           result = await thatcher.list(entity, {}, { user });
+          result = result.map(r => permissionService.filterFields(user, spec, r));
         }
         break;
 
-      case 'POST':
+      case 'POST': {
+        // enforceEditPermissions is the authoritative field-level write check --
+        // it throws if the payload touches a field the caller's role isn't
+        // editable_by, so a hand-crafted request bypassing the rendered form
+        // cannot smuggle a restricted field in.
+        permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.create(entity, body, user);
+        const { logAction } = await import('../lib/busybase/audit.js');
+        logAction(entity, result.id, 'create', user.id, null, result);
+        result = permissionService.filterFields(user, spec, result);
         status = 201;
         break;
+      }
 
       case 'PUT':
-      case 'PATCH':
+      case 'PATCH': {
         if (!id) {
           res.writeHead(400);
           res.end(JSON.stringify({ error: 'ID required' }));
           return;
         }
+        // Same row/org-access gap the GET path had: an update by id must be
+        // scoped the same way a read is, or a user could edit a record
+        // outside their org purely because PUT was never checked.
+        const existingForUpdate = await thatcher.get(entity, id, { user });
+        if (!existingForUpdate) {
+          res.writeHead(404);
+          res.end(JSON.stringify({ error: 'Not found' }));
+          return;
+        }
+        permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.update(entity, id, body, user);
+        const { logAction: logUpdate } = await import('../lib/busybase/audit.js');
+        logUpdate(entity, id, 'update', user.id, existingForUpdate, result);
+        result = permissionService.filterFields(user, spec, result);
         break;
+      }
 
-      case 'DELETE':
+      case 'DELETE': {
         if (!id) {
           res.writeHead(400);
           res.end(JSON.stringify({ error: 'ID required' }));
           return;
         }
+        const existingForDelete = await thatcher.get(entity, id, { user });
+        if (!existingForDelete) {
+          res.writeHead(404);
+          res.end(JSON.stringify({ error: 'Not found' }));
+          return;
+        }
         await thatcher.delete(entity, id);
+        const { logAction: logDelete } = await import('../lib/busybase/audit.js');
+        logDelete(entity, id, 'delete', user.id, existingForDelete, null);
         res.writeHead(204);
         res.end();
         return;
+      }
 
       default:
         res.writeHead(405);

package/src/ui/dashboard-renderer.js

@@ -100,12 +100,20 @@ export function renderAuditDashboard(user, auditData = {}) {
 
   const statsHtml = `<div class="stats-row">${[
     { label: 'Total Actions (30d)', value: summary.total_actions || 0 },
-    { label: 'Permission Grants',   value: summary.grants || 0 },
-    { label: 'Permission Revokes',  value: summary.revokes || 0 },
-    { label: 'Role Changes',        value: summary.role_changes || 0 },
+    { label: 'Creates',             value: summary.creates || 0 },
+    { label: 'Updates',             value: summary.updates || 0 },
+    { label: 'Deletes',             value: summary.deletes || 0 },
   ].map(s => `<div class="stat-card"><div class="stat-card-value">${s.value}</div><div class="stat-card-label">${s.label}</div></div>`).join('')}</div>`;
 
   const content = `<div class="page-header"><h1 class="page-title">Audit Dashboard</h1><a href="/permission_audit" class="btn-ghost-clean">View All Records</a></div>
+    <form method="GET" style="display:flex;gap:8px;margin-bottom:16px;flex-wrap:wrap">
+      <input type="text" name="entity_type" placeholder="Entity type" class="form-input" style="width:160px">
+      <input type="text" name="user_id" placeholder="User ID" class="form-input" style="width:160px">
+      <input type="date" name="from_date" class="form-input">
+      <input type="date" name="to_date" class="form-input">
+      <button type="submit" class="btn-primary-clean">Filter</button>
+      <a href="/admin/audit" class="btn-ghost-clean">Clear</a>
+    </form>
     ${statsHtml}
     <div class="table-wrap">
       <div class="table-toolbar">

package/src/ui/entity-renderer.js

@@ -1,6 +1,7 @@
 import { page, dataTable } from '@/ui/layout.js'
 import { fmtVal, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { canCreate, canEdit, canDelete } from '@/ui/permissions-ui.js'
+import { permissionService } from '@/services/permission.service.js'
 
 export function renderEntityList(entityName, items, spec, user, options = {}) {
   const label = spec?.labelPlural || spec?.label || entityName
@@ -83,9 +84,39 @@ function formatFieldValue(k, v, entityName, f) {
   return fmtVal(v, k)
 }
 
-export function renderEntityDetail(entityName, item, spec, user) {
+function formatHistoryDiff(before, after) {
+  const keys = new Set([...Object.keys(before || {}), ...Object.keys(after || {})])
+  const changed = [...keys].filter(k => JSON.stringify(before?.[k]) !== JSON.stringify(after?.[k]) && !['updated_at', '_version'].includes(k))
+  if (!changed.length) return ''
+  return changed.map(k => {
+    const from = before?.[k] !== undefined ? esc(String(before[k])) : '<em>none</em>'
+    const to = after?.[k] !== undefined ? esc(String(after[k])) : '<em>none</em>'
+    return `<div class="history-field-change"><strong>${esc(k)}</strong>: ${from} &rarr; ${to}</div>`
+  }).join('')
+}
+
+function renderHistorySection(history) {
+  if (!history || !history.length) return ''
+  const rows = history.map(h => {
+    const when = esc(new Date((h.createdAt || 0) * 1000).toLocaleString('en-ZA'))
+    const diff = h.action === 'update' ? formatHistoryDiff(h.beforeState, h.afterState) : ''
+    return `<div class="history-entry">
+      <div class="history-entry-header"><span class="pill pill-info">${esc(h.action || '-')}</span><span class="history-entry-time">${when}</span><span class="history-entry-user">${esc(h.userId || '-')}</span></div>
+      ${diff ? `<div class="history-entry-diff">${diff}</div>` : ''}
+    </div>`
+  }).join('')
+  return `<div class="card-clean" style="margin-top:1.5rem"><div class="card-clean-body">
+    <h3 style="margin-bottom:12px">History</h3>
+    <div class="history-list">${rows}</div>
+  </div></div>`
+}
+
+export function renderEntityDetail(entityName, item, spec, user, history = []) {
   const label = spec?.label || entityName
-  const fields = spec?.fields || {}
+  // A field the caller's role isn't visible_to must never reach rendered HTML,
+  // not just be CSS-hidden -- filterFields drops it from `fields` entirely so
+  // it can't appear in visibleFields below however this function evolves.
+  const fields = permissionService.filterFields(user, spec || {}, spec?.fields || {})
   const userCanEdit = canEdit(user, entityName)
   const userCanDelete = canDelete(user, entityName)
 
@@ -131,6 +162,7 @@ export function renderEntityDetail(entityName, item, spec, user) {
     <div class="card-clean">
       <div class="card-clean-body"><div class="detail-grid">${fieldRows || '<p style="color:var(--color-text-muted);font-size:0.875rem;grid-column:1/-1">No details available</p>'}</div></div>
     </div>
+    ${renderHistorySection(history)}
     `
 
   // Canonical gmConfirm (session-13): showDeleteConfirm runs the styled confirm then DELETEs; no bespoke dialog markup/show-hide.
@@ -141,7 +173,15 @@ export function renderEntityDetail(entityName, item, spec, user) {
 
 export function renderEntityForm(entityName, item, spec, user, isNew = false, refOptions = {}, templates = []) {
   const label = spec?.label || entityName
-  const fields = spec?.fields || {}
+  // A field the caller's role isn't editable_by must not be offered in the
+  // form at all -- omitting it here is UX (a clean form), the real
+  // enforcement is enforceEditPermissions rejecting the field server-side if
+  // a raw request includes it anyway.
+  const allFields = spec?.fields || {}
+  const fields = {}
+  for (const [k, f] of Object.entries(allFields)) {
+    if (permissionService.checkFieldAccess(user, spec || {}, k, 'edit')) fields[k] = f
+  }
   const lbl = (k, f, req) => `<label class="form-label" for="field-${k}">${esc(f.label||k)}${req ? '<span class="req">*</span>' : ''}</label>`
   const formFields = Object.entries(fields).filter(([k, f]) => k !== 'id' && !f.auto && !f.readOnly && !f.auto_generate && k !== 'password_hash').map(([k, f]) => {
     let val = item?.[k] ?? f.default ?? ''

package/src/ui/page-handler-admin.js

@@ -21,10 +21,16 @@ async function lazyRenderer(name) {
   return import(`file://${__dirname_adm}${name}?t=${t}`);
 }
 
-export async function handleAdminPage(normalized, segments, user) {
+export async function handleAdminPage(normalized, segments, user, req) {
   if (normalized === '/admin/audit') {
     if (!isPartner(user) && !isManager(user)) return renderAccessDenied(user, 'admin', 'view');
-    const auditData = await getAuditData();
+    const params = req ? new URL(req.url, `http://${req.headers.host}`).searchParams : new URLSearchParams();
+    const filters = {};
+    if (params.get('entity_type')) filters.entityType = params.get('entity_type');
+    if (params.get('user_id')) filters.userId = params.get('user_id');
+    if (params.get('from_date')) filters.fromDate = Math.floor(new Date(params.get('from_date')).getTime() / 1000);
+    if (params.get('to_date')) filters.toDate = Math.floor(new Date(params.get('to_date')).getTime() / 1000) + 86400;
+    const auditData = await getAuditData(filters);
     return renderAuditDashboard(user, auditData);
   }
   if (!isPartner(user)) return renderAccessDenied(user, 'admin', 'view');

package/src/ui/page-handler-helpers.js

@@ -76,12 +76,32 @@ export async function getSystemConfig() {
   } catch { return {}; }
 }
 
-export async function getAuditData() {
+export async function getAuditData(filters = {}) {
   try {
-    const audits = await list('permission_audit', {});
+    // audit_logs is the real record-change trail logAction() writes (create/
+    // update/delete/transition on every entity); permission_audit is a
+    // separate, narrower RBAC grant/revoke/role_change log. This dashboard's
+    // own column headers (Entity Type, Entity ID) describe the former, so it
+    // reads audit_logs -- the same table entity-renderer.js's per-record
+    // History section now reads, giving one consistent audit surface.
+    const where = {};
+    if (filters.entityType) where.entity_type = filters.entityType;
+    if (filters.userId) where.user_id = filters.userId;
+    let audits = await list('audit_logs', where);
+    if (filters.fromDate) audits = audits.filter(a => (a.timestamp || a.created_at) >= filters.fromDate);
+    if (filters.toDate) audits = audits.filter(a => (a.timestamp || a.created_at) <= filters.toDate);
+    audits.sort((a, b) => (b.timestamp || b.created_at || 0) - (a.timestamp || a.created_at || 0));
     const cutoff = Math.floor(Date.now() / 1000) - 30 * 86400;
     const recent = audits.filter(a => (a.timestamp || a.created_at) > cutoff);
-    return { summary: { total_actions: recent.length, grants: recent.filter(a => a.action === 'grant').length, revokes: recent.filter(a => a.action === 'revoke').length, role_changes: recent.filter(a => a.action === 'role_change').length }, recentActivity: audits.slice(0, 50) };
+    return {
+      summary: {
+        total_actions: recent.length,
+        creates: recent.filter(a => a.action === 'create').length,
+        updates: recent.filter(a => a.action === 'update').length,
+        deletes: recent.filter(a => a.action === 'delete').length,
+      },
+      recentActivity: audits.slice(0, 200),
+    };
   } catch { return { summary: {}, recentActivity: [] }; }
 }
 

package/src/ui/page-handler.js

@@ -115,8 +115,26 @@ async function handleGenericEntityView(user, entityName, id, req) {
   if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'view');
   if (isClientUser(user) && user.client_id && item.client_id && item.client_id !== user.client_id) return renderAccessDenied(user, entityName, 'view');
   const [resolvedItem] = resolveRefFields([item], spec);
+  // get(...,{user}) above already enforced row/org access for this exact
+  // record (a denied/absent record returns null before this point), so
+  // fetching its audit trail here is scoped by construction -- there is no
+  // separate access check to duplicate for the history view.
+  let history = [];
+  try {
+    const { getEntityAuditTrail } = await import('@/lib/busybase/audit-reads.js');
+    const { permissionService } = await import('@/services/permission.service.js');
+    const rawHistory = await getEntityAuditTrail(entityName, id);
+    // Field-level RBAC must hold for audit diffs too -- a viewer who can't see
+    // a restricted field on the live record must not see it in a before/after
+    // snapshot either, or field-level RBAC would be trivially bypassed via history.
+    history = rawHistory.map(h => ({
+      ...h,
+      beforeState: h.beforeState ? permissionService.filterFields(user, spec, h.beforeState) : null,
+      afterState: h.afterState ? permissionService.filterFields(user, spec, h.afterState) : null,
+    }));
+  } catch {}
   const { renderEntityDetail: lazyEntityDetail } = await lazyRenderer('entity-renderer.js');
-  return lazyEntityDetail(entityName, resolvedItem, spec, user);
+  return lazyEntityDetail(entityName, resolvedItem, spec, user, history);
 }
 async function handleClientSubRoute(user, clientId, subRoute) {
   if (!canView(user, 'client')) return renderAccessDenied(user, 'client', 'view');
@@ -162,7 +180,7 @@ export async function handlePage(pathname, req, res) {
   if (normalized === '/unauthorized') return renderAccessDenied(user, 'system', 'access');
   if (normalized === '/notifications') { let notifs=[]; try{notifs=await list('notification',{user_id:user.id},{sort:{field:'created_at',dir:'DESC'},limit:100,user})}catch{} const{renderNotificationsPage}=await lazyRenderer('notifications-renderer.js'); return renderNotificationsPage(user,notifs); }
   if (normalized === '/' || normalized === '/dashboard') return renderDashboard(user, await getDashboardStats(user));
-  if (normalized.startsWith('/admin/') || normalized === '/admin/jobs') return handleAdminPage(normalized, segments, user);
+  if (normalized.startsWith('/admin/') || normalized === '/admin/jobs') return handleAdminPage(normalized, segments, user, req);
   if (segments[0] === 'client' && segments.length === 3 && ['dashboard', 'users', 'progress'].includes(segments[2])) return handleClientSubRoute(user, segments[1], segments[2]);
   if (isClerk(user) && segments.length >= 1 && ['user', 'team'].includes(segments[0])) return renderAccessDenied(user, segments[0], 'list');
   if (normalized === '/mwr' || normalized === '/mwr/home') {