thatcher 1.0.69 → 1.0.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.69",
+  "version": "1.0.71",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/config/spec-helpers.js

@@ -96,7 +96,7 @@ export function getInitialState(spec) {
       state[key] = false;
     } else if (field.type === 'int' || field.type === 'decimal' || field.type === 'currency') {
       state[key] = 0;
-    } else if (field.type === 'json' || field.type === 'multiselect') {
+    } else if (field.type === 'json' || field.type === 'multiselect' || field.type === 'multiref') {
       state[key] = [];
     } else if (field.type === 'file' || field.type === 'attachment') {
       state[key] = null;

package/src/lib/config-generator-engine.js

@@ -160,10 +160,47 @@ function withCrmDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities, workflows } : masterConfig;
 }
 
+const PROJECT_ENTITY_DEFAULT = {
+  label: 'Project',
+  label_plural: 'Projects',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    description: { type: 'textarea', label: 'Description' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    status: { type: 'enum', options: ['planning', 'active', 'on_hold', 'completed', 'cancelled'], default: 'planning', label: 'Status' },
+    start_date: { type: 'date', label: 'Start Date' },
+    due_date: { type: 'date', label: 'Due Date' },
+  },
+};
+
+const TASK_ENTITY_DEFAULT = {
+  label: 'Task',
+  label_plural: 'Tasks',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    project_id: { type: 'ref', ref: 'project', label: 'Project' },
+    assignee_id: { type: 'ref', ref: 'user', label: 'Assignee' },
+    status: { type: 'enum', options: ['todo', 'in_progress', 'blocked', 'done'], default: 'todo', label: 'Status' },
+    priority: { type: 'enum', options: ['low', 'medium', 'high', 'urgent'], default: 'medium', label: 'Priority' },
+    due_date: { type: 'date', label: 'Due Date' },
+    depends_on: { type: 'multiref', ref: 'task', label: 'Depends On' },
+  },
+};
+
+function withProjectDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.project) { entities.project = PROJECT_ENTITY_DEFAULT; changed = true; }
+  if (!entities.task) { entities.task = TASK_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))));
+    this.masterConfig = deepFreeze(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/crud-handlers.js

@@ -221,6 +221,7 @@ function coerceFieldValue(value, type) {
       return Boolean(value);
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;

package/src/lib/field-registry.js

@@ -11,6 +11,7 @@ export function coerceFieldValue(value, type) {
       return value === true || value === 'true' || value === 1;
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;
@@ -36,12 +37,13 @@ export function deserializeField(value, type) {
   switch (type) {
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       try {
         return typeof value === 'string' ? JSON.parse(value) : value;
       } catch {
-        return type === 'multiselect' ? [] : {};
+        return (type === 'multiselect' || type === 'multiref') ? [] : {};
       }
     case 'bool':
       return Boolean(value);

package/src/lib/validation/entity-validators.js

@@ -76,6 +76,27 @@ export async function validateField(fieldDef, value, options = {}) {
     }
   }
 
+  // Multi-ref: array-of-ids referencing another entity (e.g. task.depends_on
+  // referencing other task ids) -- every id must resolve to a real record,
+  // the same existence guarantee a single 'ref' field already gets.
+  if (fieldDef.type === 'multiref' && fieldDef.ref) {
+    const arr = Array.isArray(value) ? value : (typeof value === 'string' ? JSON.parse(value) : []);
+    try {
+      const { getBy } = await import('@/lib/busybase/store');
+      const refTable = fieldDef.ref === 'user' ? 'users' : fieldDef.ref;
+      for (const refId of arr) {
+        if (!(await getBy(refTable, 'id', refId))) {
+          return {
+            valid: false,
+            error: `${fieldDef.ref.charAt(0).toUpperCase() + fieldDef.ref.slice(1)} with id '${refId}' not found`,
+          };
+        }
+      }
+    } catch {
+      // Reference table might not exist yet
+    }
+  }
+
   return { valid: true };
 }
 
@@ -94,7 +115,7 @@ function validateType(fieldDef, value, fieldName) {
     if (typeof value !== 'boolean') return `Field '${fieldName}' must be a boolean`;
   } else if (type === 'timestamp' || type === 'date') {
     if (isNaN(Number(value))) return `Field '${fieldName}' must be a valid timestamp`;
-  } else if (type === 'multiselect') {
+  } else if (type === 'multiselect' || type === 'multiref') {
     const arr = Array.isArray(value) ? value : (typeof value === 'string' ? (() => { try { return JSON.parse(value); } catch { return null; } })() : null);
     if (!Array.isArray(arr)) return `Field '${fieldName}' must be an array`;
   } else if (type === 'file' || type === 'attachment') {
@@ -176,6 +197,31 @@ async function checkUnique(fieldDef, value, { fieldName, entityName, existingRec
   return null;
 }
 
+// Task completion cannot be a client-side/UI-only rule -- a raw API PATCH
+// setting status=done must be rejected server-side the same as any other
+// write, or dependency ordering is purely cosmetic. depends_on is checked
+// against the CURRENT stored state of each referenced task (never trusting
+// a value the caller might also be trying to change in the same payload).
+async function checkTaskDependencies(entityName, changes, existingRecord) {
+  if (entityName !== 'task') return null;
+  if (changes.status !== 'done') return null;
+
+  const dependsOn = changes.depends_on !== undefined ? changes.depends_on : existingRecord?.depends_on;
+  const ids = Array.isArray(dependsOn) ? dependsOn : (typeof dependsOn === 'string' && dependsOn ? (() => { try { return JSON.parse(dependsOn); } catch { return []; } })() : []);
+  if (!ids.length) return null;
+
+  const { get } = await import('@/lib/busybase/store');
+  const incomplete = [];
+  for (const depId of ids) {
+    const dep = await get('task', depId);
+    if (!dep || dep.status !== 'done') incomplete.push(depId);
+  }
+  if (incomplete.length) {
+    return `Cannot mark done: depends on incomplete task(s) ${incomplete.join(', ')}`;
+  }
+  return null;
+}
+
 export async function validateUpdate(entityName, changes, existingRecord) {
   const spec = getSpec(entityName);
   const errors = {};
@@ -202,6 +248,9 @@ export async function validateUpdate(entityName, changes, existingRecord) {
     if (uniqueErr && !errors[fieldName]) errors[fieldName] = uniqueErr;
   }
 
+  const depErr = await checkTaskDependencies(entityName, changes, existingRecord);
+  if (depErr) errors.status = depErr;
+
   return errors;
 }
 

package/src/server/server.js

@@ -405,39 +405,76 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
         }
         break;
 
-      case 'POST':
+      case 'POST': {
         // enforceEditPermissions is the authoritative field-level write check --
         // it throws if the payload touches a field the caller's role isn't
         // editable_by, so a hand-crafted request bypassing the rendered form
         // cannot smuggle a restricted field in.
         permissionService.enforceEditPermissions(user, spec, body);
         result = await thatcher.create(entity, body, user);
+        const { logAction } = await import('../lib/busybase/audit.js');
+        logAction(entity, result.id, 'create', user.id, null, result);
         result = permissionService.filterFields(user, spec, result);
         status = 201;
         break;
+      }
 
       case 'PUT':
-      case 'PATCH':
+      case 'PATCH': {
         if (!id) {
           res.writeHead(400);
           res.end(JSON.stringify({ error: 'ID required' }));
           return;
         }
+        // Same row/org-access gap the GET path had: an update by id must be
+        // scoped the same way a read is, or a user could edit a record
+        // outside their org purely because PUT was never checked.
+        const existingForUpdate = await thatcher.get(entity, id, { user });
+        if (!existingForUpdate) {
+          res.writeHead(404);
+          res.end(JSON.stringify({ error: 'Not found' }));
+          return;
+        }
         permissionService.enforceEditPermissions(user, spec, body);
+        {
+          // validateUpdate is the authoritative server-side check for both
+          // generic field-type constraints AND entity-specific business
+          // rules (e.g. task dependency completion) -- this raw-CRUD path
+          // never called it at all, so those rules were UI-only until now.
+          const { validateUpdate, hasErrors } = await import('../lib/validation/entity-validators.js');
+          const updateErrors = await validateUpdate(entity, body, existingForUpdate);
+          if (hasErrors(updateErrors)) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: 'Validation failed', errors: updateErrors }));
+            return;
+          }
+        }
         result = await thatcher.update(entity, id, body, user);
+        const { logAction: logUpdate } = await import('../lib/busybase/audit.js');
+        logUpdate(entity, id, 'update', user.id, existingForUpdate, result);
         result = permissionService.filterFields(user, spec, result);
         break;
+      }
 
-      case 'DELETE':
+      case 'DELETE': {
         if (!id) {
           res.writeHead(400);
           res.end(JSON.stringify({ error: 'ID required' }));
           return;
         }
+        const existingForDelete = await thatcher.get(entity, id, { user });
+        if (!existingForDelete) {
+          res.writeHead(404);
+          res.end(JSON.stringify({ error: 'Not found' }));
+          return;
+        }
         await thatcher.delete(entity, id);
+        const { logAction: logDelete } = await import('../lib/busybase/audit.js');
+        logDelete(entity, id, 'delete', user.id, existingForDelete, null);
         res.writeHead(204);
         res.end();
         return;
+      }
 
       default:
         res.writeHead(405);

package/src/ui/dashboard-renderer.js

@@ -100,12 +100,20 @@ export function renderAuditDashboard(user, auditData = {}) {
 
   const statsHtml = `<div class="stats-row">${[
     { label: 'Total Actions (30d)', value: summary.total_actions || 0 },
-    { label: 'Permission Grants',   value: summary.grants || 0 },
-    { label: 'Permission Revokes',  value: summary.revokes || 0 },
-    { label: 'Role Changes',        value: summary.role_changes || 0 },
+    { label: 'Creates',             value: summary.creates || 0 },
+    { label: 'Updates',             value: summary.updates || 0 },
+    { label: 'Deletes',             value: summary.deletes || 0 },
   ].map(s => `<div class="stat-card"><div class="stat-card-value">${s.value}</div><div class="stat-card-label">${s.label}</div></div>`).join('')}</div>`;
 
   const content = `<div class="page-header"><h1 class="page-title">Audit Dashboard</h1><a href="/permission_audit" class="btn-ghost-clean">View All Records</a></div>
+    <form method="GET" style="display:flex;gap:8px;margin-bottom:16px;flex-wrap:wrap">
+      <input type="text" name="entity_type" placeholder="Entity type" class="form-input" style="width:160px">
+      <input type="text" name="user_id" placeholder="User ID" class="form-input" style="width:160px">
+      <input type="date" name="from_date" class="form-input">
+      <input type="date" name="to_date" class="form-input">
+      <button type="submit" class="btn-primary-clean">Filter</button>
+      <a href="/admin/audit" class="btn-ghost-clean">Clear</a>
+    </form>
     ${statsHtml}
     <div class="table-wrap">
       <div class="table-toolbar">

package/src/ui/entity-renderer.js

@@ -77,6 +77,10 @@ function formatFieldValue(k, v, entityName, f) {
     const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
     return arr.length ? arr.map(x => `<span class="pill pill-neutral" style="margin-right:4px">${esc(x)}</span>`).join('') : '-'
   }
+  if (f?.type === 'multiref' && f.ref) {
+    const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
+    return arr.length ? arr.map(x => `<a href="/${esc(f.ref)}/${esc(x)}" class="pill pill-neutral" style="margin-right:4px;text-decoration:none">${esc(x)}</a>`).join('') : '-'
+  }
   if (f?.type === 'file' || f?.type === 'attachment') {
     const meta = typeof v === 'object' && v ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return null } })() : null)
     return meta?.url ? `<a href="${esc(meta.url)}" class="text-primary hover:underline" target="_blank" rel="noopener">${esc(meta.filename || 'Download')}</a>` : '-'
@@ -84,7 +88,34 @@ function formatFieldValue(k, v, entityName, f) {
   return fmtVal(v, k)
 }
 
-export function renderEntityDetail(entityName, item, spec, user) {
+function formatHistoryDiff(before, after) {
+  const keys = new Set([...Object.keys(before || {}), ...Object.keys(after || {})])
+  const changed = [...keys].filter(k => JSON.stringify(before?.[k]) !== JSON.stringify(after?.[k]) && !['updated_at', '_version'].includes(k))
+  if (!changed.length) return ''
+  return changed.map(k => {
+    const from = before?.[k] !== undefined ? esc(String(before[k])) : '<em>none</em>'
+    const to = after?.[k] !== undefined ? esc(String(after[k])) : '<em>none</em>'
+    return `<div class="history-field-change"><strong>${esc(k)}</strong>: ${from} &rarr; ${to}</div>`
+  }).join('')
+}
+
+function renderHistorySection(history) {
+  if (!history || !history.length) return ''
+  const rows = history.map(h => {
+    const when = esc(new Date((h.createdAt || 0) * 1000).toLocaleString('en-ZA'))
+    const diff = h.action === 'update' ? formatHistoryDiff(h.beforeState, h.afterState) : ''
+    return `<div class="history-entry">
+      <div class="history-entry-header"><span class="pill pill-info">${esc(h.action || '-')}</span><span class="history-entry-time">${when}</span><span class="history-entry-user">${esc(h.userId || '-')}</span></div>
+      ${diff ? `<div class="history-entry-diff">${diff}</div>` : ''}
+    </div>`
+  }).join('')
+  return `<div class="card-clean" style="margin-top:1.5rem"><div class="card-clean-body">
+    <h3 style="margin-bottom:12px">History</h3>
+    <div class="history-list">${rows}</div>
+  </div></div>`
+}
+
+export function renderEntityDetail(entityName, item, spec, user, history = []) {
   const label = spec?.label || entityName
   // A field the caller's role isn't visible_to must never reach rendered HTML,
   // not just be CSS-hidden -- filterFields drops it from `fields` entirely so
@@ -135,6 +166,7 @@ export function renderEntityDetail(entityName, item, spec, user) {
     <div class="card-clean">
       <div class="card-clean-body"><div class="detail-grid">${fieldRows || '<p style="color:var(--color-text-muted);font-size:0.875rem;grid-column:1/-1">No details available</p>'}</div></div>
     </div>
+    ${renderHistorySection(history)}
     `
 
   // Canonical gmConfirm (session-13): showDeleteConfirm runs the styled confirm then DELETEs; no bespoke dialog markup/show-hide.
@@ -185,6 +217,11 @@ export function renderEntityForm(entityName, item, spec, user, isNew = false, re
       const opts = (Array.isArray(f.options) ? f.options : []).map(o => { const ov = typeof o === 'string' ? o : o.value; const ol = typeof o === 'string' ? o : o.label; return `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(ov)}" class="checkbox checkbox-primary" ${selected.has(ov)?'checked':''}/><span>${esc(ol)}</span></label>` }).join('')
       return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
     }
+    if (f.type === 'multiref' && refOptions[k]) {
+      const selected = new Set(Array.isArray(val) ? val : (typeof val === 'string' && val ? (() => { try { return JSON.parse(val) } catch { return [] } })() : []))
+      const opts = refOptions[k].filter(o => o.value !== item?.id).map(o => `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(o.value)}" class="checkbox checkbox-primary" ${selected.has(o.value)?'checked':''}/><span>${esc(o.label)}</span></label>`).join('') || '<p style="font-size:0.8rem;color:var(--color-text-muted)">No options available</p>'
+      return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
+    }
     if (f.type === 'currency') {
       const symbol = esc(f.currency_symbol || '$')
       const decimalVal = typeof val === 'number' ? (val / 100).toFixed(2) : val

package/src/ui/page-handler-admin.js

@@ -21,10 +21,16 @@ async function lazyRenderer(name) {
   return import(`file://${__dirname_adm}${name}?t=${t}`);
 }
 
-export async function handleAdminPage(normalized, segments, user) {
+export async function handleAdminPage(normalized, segments, user, req) {
   if (normalized === '/admin/audit') {
     if (!isPartner(user) && !isManager(user)) return renderAccessDenied(user, 'admin', 'view');
-    const auditData = await getAuditData();
+    const params = req ? new URL(req.url, `http://${req.headers.host}`).searchParams : new URLSearchParams();
+    const filters = {};
+    if (params.get('entity_type')) filters.entityType = params.get('entity_type');
+    if (params.get('user_id')) filters.userId = params.get('user_id');
+    if (params.get('from_date')) filters.fromDate = Math.floor(new Date(params.get('from_date')).getTime() / 1000);
+    if (params.get('to_date')) filters.toDate = Math.floor(new Date(params.get('to_date')).getTime() / 1000) + 86400;
+    const auditData = await getAuditData(filters);
     return renderAuditDashboard(user, auditData);
   }
   if (!isPartner(user)) return renderAccessDenied(user, 'admin', 'view');

package/src/ui/page-handler-helpers.js

@@ -19,7 +19,7 @@ export function resolveEnumOptions(spec) {
 
 export async function getRefOptions(spec) {
   const refOptions = {};
-  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref)) {
+  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => (f.type === 'ref' || f.type === 'multiref') && f.ref)) {
     try { refOptions[fieldKey] = (await list(field.ref, {})).map(r => ({ value: r.id, label: r.name || r.title || r.label || r.email || r.id })); }
     catch { refOptions[fieldKey] = []; }
   }
@@ -76,12 +76,32 @@ export async function getSystemConfig() {
   } catch { return {}; }
 }
 
-export async function getAuditData() {
+export async function getAuditData(filters = {}) {
   try {
-    const audits = await list('permission_audit', {});
+    // audit_logs is the real record-change trail logAction() writes (create/
+    // update/delete/transition on every entity); permission_audit is a
+    // separate, narrower RBAC grant/revoke/role_change log. This dashboard's
+    // own column headers (Entity Type, Entity ID) describe the former, so it
+    // reads audit_logs -- the same table entity-renderer.js's per-record
+    // History section now reads, giving one consistent audit surface.
+    const where = {};
+    if (filters.entityType) where.entity_type = filters.entityType;
+    if (filters.userId) where.user_id = filters.userId;
+    let audits = await list('audit_logs', where);
+    if (filters.fromDate) audits = audits.filter(a => (a.timestamp || a.created_at) >= filters.fromDate);
+    if (filters.toDate) audits = audits.filter(a => (a.timestamp || a.created_at) <= filters.toDate);
+    audits.sort((a, b) => (b.timestamp || b.created_at || 0) - (a.timestamp || a.created_at || 0));
     const cutoff = Math.floor(Date.now() / 1000) - 30 * 86400;
     const recent = audits.filter(a => (a.timestamp || a.created_at) > cutoff);
-    return { summary: { total_actions: recent.length, grants: recent.filter(a => a.action === 'grant').length, revokes: recent.filter(a => a.action === 'revoke').length, role_changes: recent.filter(a => a.action === 'role_change').length }, recentActivity: audits.slice(0, 50) };
+    return {
+      summary: {
+        total_actions: recent.length,
+        creates: recent.filter(a => a.action === 'create').length,
+        updates: recent.filter(a => a.action === 'update').length,
+        deletes: recent.filter(a => a.action === 'delete').length,
+      },
+      recentActivity: audits.slice(0, 200),
+    };
   } catch { return { summary: {}, recentActivity: [] }; }
 }
 

package/src/ui/page-handler.js

@@ -115,8 +115,26 @@ async function handleGenericEntityView(user, entityName, id, req) {
   if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'view');
   if (isClientUser(user) && user.client_id && item.client_id && item.client_id !== user.client_id) return renderAccessDenied(user, entityName, 'view');
   const [resolvedItem] = resolveRefFields([item], spec);
+  // get(...,{user}) above already enforced row/org access for this exact
+  // record (a denied/absent record returns null before this point), so
+  // fetching its audit trail here is scoped by construction -- there is no
+  // separate access check to duplicate for the history view.
+  let history = [];
+  try {
+    const { getEntityAuditTrail } = await import('@/lib/busybase/audit-reads.js');
+    const { permissionService } = await import('@/services/permission.service.js');
+    const rawHistory = await getEntityAuditTrail(entityName, id);
+    // Field-level RBAC must hold for audit diffs too -- a viewer who can't see
+    // a restricted field on the live record must not see it in a before/after
+    // snapshot either, or field-level RBAC would be trivially bypassed via history.
+    history = rawHistory.map(h => ({
+      ...h,
+      beforeState: h.beforeState ? permissionService.filterFields(user, spec, h.beforeState) : null,
+      afterState: h.afterState ? permissionService.filterFields(user, spec, h.afterState) : null,
+    }));
+  } catch {}
   const { renderEntityDetail: lazyEntityDetail } = await lazyRenderer('entity-renderer.js');
-  return lazyEntityDetail(entityName, resolvedItem, spec, user);
+  return lazyEntityDetail(entityName, resolvedItem, spec, user, history);
 }
 async function handleClientSubRoute(user, clientId, subRoute) {
   if (!canView(user, 'client')) return renderAccessDenied(user, 'client', 'view');
@@ -162,7 +180,7 @@ export async function handlePage(pathname, req, res) {
   if (normalized === '/unauthorized') return renderAccessDenied(user, 'system', 'access');
   if (normalized === '/notifications') { let notifs=[]; try{notifs=await list('notification',{user_id:user.id},{sort:{field:'created_at',dir:'DESC'},limit:100,user})}catch{} const{renderNotificationsPage}=await lazyRenderer('notifications-renderer.js'); return renderNotificationsPage(user,notifs); }
   if (normalized === '/' || normalized === '/dashboard') return renderDashboard(user, await getDashboardStats(user));
-  if (normalized.startsWith('/admin/') || normalized === '/admin/jobs') return handleAdminPage(normalized, segments, user);
+  if (normalized.startsWith('/admin/') || normalized === '/admin/jobs') return handleAdminPage(normalized, segments, user, req);
   if (segments[0] === 'client' && segments.length === 3 && ['dashboard', 'users', 'progress'].includes(segments[2])) return handleClientSubRoute(user, segments[1], segments[2]);
   if (isClerk(user) && segments.length >= 1 && ['user', 'team'].includes(segments[0])) return renderAccessDenied(user, segments[0], 'list');
   if (normalized === '/mwr' || normalized === '/mwr/home') {