thatcher 1.0.70 → 1.0.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.70",
+  "version": "1.0.71",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/config/spec-helpers.js

@@ -96,7 +96,7 @@ export function getInitialState(spec) {
       state[key] = false;
     } else if (field.type === 'int' || field.type === 'decimal' || field.type === 'currency') {
       state[key] = 0;
-    } else if (field.type === 'json' || field.type === 'multiselect') {
+    } else if (field.type === 'json' || field.type === 'multiselect' || field.type === 'multiref') {
       state[key] = [];
     } else if (field.type === 'file' || field.type === 'attachment') {
       state[key] = null;

package/src/lib/config-generator-engine.js

@@ -160,10 +160,47 @@ function withCrmDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities, workflows } : masterConfig;
 }
 
+const PROJECT_ENTITY_DEFAULT = {
+  label: 'Project',
+  label_plural: 'Projects',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    description: { type: 'textarea', label: 'Description' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    status: { type: 'enum', options: ['planning', 'active', 'on_hold', 'completed', 'cancelled'], default: 'planning', label: 'Status' },
+    start_date: { type: 'date', label: 'Start Date' },
+    due_date: { type: 'date', label: 'Due Date' },
+  },
+};
+
+const TASK_ENTITY_DEFAULT = {
+  label: 'Task',
+  label_plural: 'Tasks',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    project_id: { type: 'ref', ref: 'project', label: 'Project' },
+    assignee_id: { type: 'ref', ref: 'user', label: 'Assignee' },
+    status: { type: 'enum', options: ['todo', 'in_progress', 'blocked', 'done'], default: 'todo', label: 'Status' },
+    priority: { type: 'enum', options: ['low', 'medium', 'high', 'urgent'], default: 'medium', label: 'Priority' },
+    due_date: { type: 'date', label: 'Due Date' },
+    depends_on: { type: 'multiref', ref: 'task', label: 'Depends On' },
+  },
+};
+
+function withProjectDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.project) { entities.project = PROJECT_ENTITY_DEFAULT; changed = true; }
+  if (!entities.task) { entities.task = TASK_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))));
+    this.masterConfig = deepFreeze(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/crud-handlers.js

@@ -221,6 +221,7 @@ function coerceFieldValue(value, type) {
       return Boolean(value);
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;

package/src/lib/field-registry.js

@@ -11,6 +11,7 @@ export function coerceFieldValue(value, type) {
       return value === true || value === 'true' || value === 1;
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;
@@ -36,12 +37,13 @@ export function deserializeField(value, type) {
   switch (type) {
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       try {
         return typeof value === 'string' ? JSON.parse(value) : value;
       } catch {
-        return type === 'multiselect' ? [] : {};
+        return (type === 'multiselect' || type === 'multiref') ? [] : {};
       }
     case 'bool':
       return Boolean(value);

package/src/lib/validation/entity-validators.js

@@ -76,6 +76,27 @@ export async function validateField(fieldDef, value, options = {}) {
     }
   }
 
+  // Multi-ref: array-of-ids referencing another entity (e.g. task.depends_on
+  // referencing other task ids) -- every id must resolve to a real record,
+  // the same existence guarantee a single 'ref' field already gets.
+  if (fieldDef.type === 'multiref' && fieldDef.ref) {
+    const arr = Array.isArray(value) ? value : (typeof value === 'string' ? JSON.parse(value) : []);
+    try {
+      const { getBy } = await import('@/lib/busybase/store');
+      const refTable = fieldDef.ref === 'user' ? 'users' : fieldDef.ref;
+      for (const refId of arr) {
+        if (!(await getBy(refTable, 'id', refId))) {
+          return {
+            valid: false,
+            error: `${fieldDef.ref.charAt(0).toUpperCase() + fieldDef.ref.slice(1)} with id '${refId}' not found`,
+          };
+        }
+      }
+    } catch {
+      // Reference table might not exist yet
+    }
+  }
+
   return { valid: true };
 }
 
@@ -94,7 +115,7 @@ function validateType(fieldDef, value, fieldName) {
     if (typeof value !== 'boolean') return `Field '${fieldName}' must be a boolean`;
   } else if (type === 'timestamp' || type === 'date') {
     if (isNaN(Number(value))) return `Field '${fieldName}' must be a valid timestamp`;
-  } else if (type === 'multiselect') {
+  } else if (type === 'multiselect' || type === 'multiref') {
     const arr = Array.isArray(value) ? value : (typeof value === 'string' ? (() => { try { return JSON.parse(value); } catch { return null; } })() : null);
     if (!Array.isArray(arr)) return `Field '${fieldName}' must be an array`;
   } else if (type === 'file' || type === 'attachment') {
@@ -176,6 +197,31 @@ async function checkUnique(fieldDef, value, { fieldName, entityName, existingRec
   return null;
 }
 
+// Task completion cannot be a client-side/UI-only rule -- a raw API PATCH
+// setting status=done must be rejected server-side the same as any other
+// write, or dependency ordering is purely cosmetic. depends_on is checked
+// against the CURRENT stored state of each referenced task (never trusting
+// a value the caller might also be trying to change in the same payload).
+async function checkTaskDependencies(entityName, changes, existingRecord) {
+  if (entityName !== 'task') return null;
+  if (changes.status !== 'done') return null;
+
+  const dependsOn = changes.depends_on !== undefined ? changes.depends_on : existingRecord?.depends_on;
+  const ids = Array.isArray(dependsOn) ? dependsOn : (typeof dependsOn === 'string' && dependsOn ? (() => { try { return JSON.parse(dependsOn); } catch { return []; } })() : []);
+  if (!ids.length) return null;
+
+  const { get } = await import('@/lib/busybase/store');
+  const incomplete = [];
+  for (const depId of ids) {
+    const dep = await get('task', depId);
+    if (!dep || dep.status !== 'done') incomplete.push(depId);
+  }
+  if (incomplete.length) {
+    return `Cannot mark done: depends on incomplete task(s) ${incomplete.join(', ')}`;
+  }
+  return null;
+}
+
 export async function validateUpdate(entityName, changes, existingRecord) {
   const spec = getSpec(entityName);
   const errors = {};
@@ -202,6 +248,9 @@ export async function validateUpdate(entityName, changes, existingRecord) {
     if (uniqueErr && !errors[fieldName]) errors[fieldName] = uniqueErr;
   }
 
+  const depErr = await checkTaskDependencies(entityName, changes, existingRecord);
+  if (depErr) errors.status = depErr;
+
   return errors;
 }
 

package/src/server/server.js

@@ -436,6 +436,19 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
           return;
         }
         permissionService.enforceEditPermissions(user, spec, body);
+        {
+          // validateUpdate is the authoritative server-side check for both
+          // generic field-type constraints AND entity-specific business
+          // rules (e.g. task dependency completion) -- this raw-CRUD path
+          // never called it at all, so those rules were UI-only until now.
+          const { validateUpdate, hasErrors } = await import('../lib/validation/entity-validators.js');
+          const updateErrors = await validateUpdate(entity, body, existingForUpdate);
+          if (hasErrors(updateErrors)) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: 'Validation failed', errors: updateErrors }));
+            return;
+          }
+        }
         result = await thatcher.update(entity, id, body, user);
         const { logAction: logUpdate } = await import('../lib/busybase/audit.js');
         logUpdate(entity, id, 'update', user.id, existingForUpdate, result);

package/src/ui/entity-renderer.js

@@ -77,6 +77,10 @@ function formatFieldValue(k, v, entityName, f) {
     const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
     return arr.length ? arr.map(x => `<span class="pill pill-neutral" style="margin-right:4px">${esc(x)}</span>`).join('') : '-'
   }
+  if (f?.type === 'multiref' && f.ref) {
+    const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
+    return arr.length ? arr.map(x => `<a href="/${esc(f.ref)}/${esc(x)}" class="pill pill-neutral" style="margin-right:4px;text-decoration:none">${esc(x)}</a>`).join('') : '-'
+  }
   if (f?.type === 'file' || f?.type === 'attachment') {
     const meta = typeof v === 'object' && v ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return null } })() : null)
     return meta?.url ? `<a href="${esc(meta.url)}" class="text-primary hover:underline" target="_blank" rel="noopener">${esc(meta.filename || 'Download')}</a>` : '-'
@@ -213,6 +217,11 @@ export function renderEntityForm(entityName, item, spec, user, isNew = false, re
       const opts = (Array.isArray(f.options) ? f.options : []).map(o => { const ov = typeof o === 'string' ? o : o.value; const ol = typeof o === 'string' ? o : o.label; return `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(ov)}" class="checkbox checkbox-primary" ${selected.has(ov)?'checked':''}/><span>${esc(ol)}</span></label>` }).join('')
       return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
     }
+    if (f.type === 'multiref' && refOptions[k]) {
+      const selected = new Set(Array.isArray(val) ? val : (typeof val === 'string' && val ? (() => { try { return JSON.parse(val) } catch { return [] } })() : []))
+      const opts = refOptions[k].filter(o => o.value !== item?.id).map(o => `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(o.value)}" class="checkbox checkbox-primary" ${selected.has(o.value)?'checked':''}/><span>${esc(o.label)}</span></label>`).join('') || '<p style="font-size:0.8rem;color:var(--color-text-muted)">No options available</p>'
+      return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
+    }
     if (f.type === 'currency') {
       const symbol = esc(f.currency_symbol || '$')
       const decimalVal = typeof val === 'number' ? (val / 100).toFixed(2) : val

package/src/ui/page-handler-helpers.js

@@ -19,7 +19,7 @@ export function resolveEnumOptions(spec) {
 
 export async function getRefOptions(spec) {
   const refOptions = {};
-  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref)) {
+  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => (f.type === 'ref' || f.type === 'multiref') && f.ref)) {
     try { refOptions[fieldKey] = (await list(field.ref, {})).map(r => ({ value: r.id, label: r.name || r.title || r.label || r.email || r.id })); }
     catch { refOptions[fieldKey] = []; }
   }