thatcher 1.0.70 → 1.0.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.70",
+  "version": "1.0.72",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/config/spec-helpers.js

@@ -96,7 +96,7 @@ export function getInitialState(spec) {
       state[key] = false;
     } else if (field.type === 'int' || field.type === 'decimal' || field.type === 'currency') {
       state[key] = 0;
-    } else if (field.type === 'json' || field.type === 'multiselect') {
+    } else if (field.type === 'json' || field.type === 'multiselect' || field.type === 'multiref') {
       state[key] = [];
     } else if (field.type === 'file' || field.type === 'attachment') {
       state[key] = null;

package/src/lib/config-generator-engine.js

@@ -160,10 +160,81 @@ function withCrmDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities, workflows } : masterConfig;
 }
 
+const PROJECT_ENTITY_DEFAULT = {
+  label: 'Project',
+  label_plural: 'Projects',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    description: { type: 'textarea', label: 'Description' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+    status: { type: 'enum', options: ['planning', 'active', 'on_hold', 'completed', 'cancelled'], default: 'planning', label: 'Status' },
+    start_date: { type: 'date', label: 'Start Date' },
+    due_date: { type: 'date', label: 'Due Date' },
+  },
+};
+
+const TASK_ENTITY_DEFAULT = {
+  label: 'Task',
+  label_plural: 'Tasks',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    project_id: { type: 'ref', ref: 'project', label: 'Project' },
+    assignee_id: { type: 'ref', ref: 'user', label: 'Assignee' },
+    status: { type: 'enum', options: ['todo', 'in_progress', 'blocked', 'done'], default: 'todo', label: 'Status' },
+    priority: { type: 'enum', options: ['low', 'medium', 'high', 'urgent'], default: 'medium', label: 'Priority' },
+    due_date: { type: 'date', label: 'Due Date' },
+    depends_on: { type: 'multiref', ref: 'task', label: 'Depends On' },
+  },
+};
+
+function withProjectDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.project) { entities.project = PROJECT_ENTITY_DEFAULT; changed = true; }
+  if (!entities.task) { entities.task = TASK_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
+const PRODUCT_ENTITY_DEFAULT = {
+  label: 'Product',
+  label_plural: 'Products',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    sku: { type: 'text', required: true, unique: true, label: 'SKU' },
+    description: { type: 'textarea', label: 'Description' },
+    unit_price: { type: 'currency', label: 'Unit Price' },
+    reorder_threshold: { type: 'number', min: 0, label: 'Reorder Threshold' },
+  },
+};
+
+const STOCK_MOVEMENT_ENTITY_DEFAULT = {
+  label: 'Stock Movement',
+  label_plural: 'Stock Movements',
+  system_entity: true,
+  fields: {
+    product_id: { type: 'ref', ref: 'product', required: true, label: 'Product' },
+    quantity: { type: 'number', required: true, label: 'Quantity' },
+    movement_type: { type: 'enum', options: ['receipt', 'sale', 'adjustment', 'return'], required: true, label: 'Movement Type' },
+    reference: { type: 'text', label: 'Reference' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+function withInventoryDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.product) { entities.product = PRODUCT_ENTITY_DEFAULT; changed = true; }
+  if (!entities.stock_movement) { entities.stock_movement = STOCK_MOVEMENT_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))));
+    this.masterConfig = deepFreeze(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/crud-handlers.js

@@ -221,6 +221,7 @@ function coerceFieldValue(value, type) {
       return Boolean(value);
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;

package/src/lib/field-registry.js

@@ -11,6 +11,7 @@ export function coerceFieldValue(value, type) {
       return value === true || value === 'true' || value === 1;
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;
@@ -36,12 +37,13 @@ export function deserializeField(value, type) {
   switch (type) {
     case 'json':
     case 'multiselect':
+    case 'multiref':
     case 'file':
     case 'attachment':
       try {
         return typeof value === 'string' ? JSON.parse(value) : value;
       } catch {
-        return type === 'multiselect' ? [] : {};
+        return (type === 'multiselect' || type === 'multiref') ? [] : {};
       }
     case 'bool':
       return Boolean(value);

package/src/lib/validation/entity-validators.js

@@ -76,6 +76,27 @@ export async function validateField(fieldDef, value, options = {}) {
     }
   }
 
+  // Multi-ref: array-of-ids referencing another entity (e.g. task.depends_on
+  // referencing other task ids) -- every id must resolve to a real record,
+  // the same existence guarantee a single 'ref' field already gets.
+  if (fieldDef.type === 'multiref' && fieldDef.ref) {
+    const arr = Array.isArray(value) ? value : (typeof value === 'string' ? JSON.parse(value) : []);
+    try {
+      const { getBy } = await import('@/lib/busybase/store');
+      const refTable = fieldDef.ref === 'user' ? 'users' : fieldDef.ref;
+      for (const refId of arr) {
+        if (!(await getBy(refTable, 'id', refId))) {
+          return {
+            valid: false,
+            error: `${fieldDef.ref.charAt(0).toUpperCase() + fieldDef.ref.slice(1)} with id '${refId}' not found`,
+          };
+        }
+      }
+    } catch {
+      // Reference table might not exist yet
+    }
+  }
+
   return { valid: true };
 }
 
@@ -94,7 +115,7 @@ function validateType(fieldDef, value, fieldName) {
     if (typeof value !== 'boolean') return `Field '${fieldName}' must be a boolean`;
   } else if (type === 'timestamp' || type === 'date') {
     if (isNaN(Number(value))) return `Field '${fieldName}' must be a valid timestamp`;
-  } else if (type === 'multiselect') {
+  } else if (type === 'multiselect' || type === 'multiref') {
     const arr = Array.isArray(value) ? value : (typeof value === 'string' ? (() => { try { return JSON.parse(value); } catch { return null; } })() : null);
     if (!Array.isArray(arr)) return `Field '${fieldName}' must be an array`;
   } else if (type === 'file' || type === 'attachment') {
@@ -131,6 +152,28 @@ function resolveEnumOptions(fieldDef, entityName) {
   return [];
 }
 
+// Stock movements are immutable history (checked at creation only, never on
+// edit -- there is no update path for them). An outbound movement (negative
+// quantity) that would drive the running balance below zero is invalid: the
+// balance is the sum of every OTHER movement for this product plus the new
+// one, computed fresh from stored data, never trusting a client-supplied
+// "current stock" value that doesn't exist as an editable field.
+async function checkStockBalance(entityName, data) {
+  if (entityName !== 'stock_movement') return null;
+  const quantity = Number(data.quantity);
+  if (!Number.isFinite(quantity) || quantity >= 0) return null;
+  if (!data.product_id) return null;
+
+  const { list } = await import('@/lib/busybase/store');
+  const existingMovements = await list('stock_movement', { product_id: data.product_id });
+  const currentBalance = existingMovements.reduce((sum, m) => sum + (Number(m.quantity) || 0), 0);
+  const resultingBalance = currentBalance + quantity;
+  if (resultingBalance < 0) {
+    return `Insufficient stock: current balance is ${currentBalance}, this movement would result in ${resultingBalance}`;
+  }
+  return null;
+}
+
 export async function validateEntity(entityName, data, existingRecord = null) {
   const spec = getSpec(entityName);
   const errors = {};
@@ -155,6 +198,9 @@ export async function validateEntity(entityName, data, existingRecord = null) {
     if (uniqueErr && !errors[fieldName]) errors[fieldName] = uniqueErr;
   }
 
+  const stockErr = await checkStockBalance(entityName, data);
+  if (stockErr) errors.quantity = stockErr;
+
   return errors;
 }
 
@@ -176,6 +222,31 @@ async function checkUnique(fieldDef, value, { fieldName, entityName, existingRec
   return null;
 }
 
+// Task completion cannot be a client-side/UI-only rule -- a raw API PATCH
+// setting status=done must be rejected server-side the same as any other
+// write, or dependency ordering is purely cosmetic. depends_on is checked
+// against the CURRENT stored state of each referenced task (never trusting
+// a value the caller might also be trying to change in the same payload).
+async function checkTaskDependencies(entityName, changes, existingRecord) {
+  if (entityName !== 'task') return null;
+  if (changes.status !== 'done') return null;
+
+  const dependsOn = changes.depends_on !== undefined ? changes.depends_on : existingRecord?.depends_on;
+  const ids = Array.isArray(dependsOn) ? dependsOn : (typeof dependsOn === 'string' && dependsOn ? (() => { try { return JSON.parse(dependsOn); } catch { return []; } })() : []);
+  if (!ids.length) return null;
+
+  const { get } = await import('@/lib/busybase/store');
+  const incomplete = [];
+  for (const depId of ids) {
+    const dep = await get('task', depId);
+    if (!dep || dep.status !== 'done') incomplete.push(depId);
+  }
+  if (incomplete.length) {
+    return `Cannot mark done: depends on incomplete task(s) ${incomplete.join(', ')}`;
+  }
+  return null;
+}
+
 export async function validateUpdate(entityName, changes, existingRecord) {
   const spec = getSpec(entityName);
   const errors = {};
@@ -202,6 +273,9 @@ export async function validateUpdate(entityName, changes, existingRecord) {
     if (uniqueErr && !errors[fieldName]) errors[fieldName] = uniqueErr;
   }
 
+  const depErr = await checkTaskDependencies(entityName, changes, existingRecord);
+  if (depErr) errors.status = depErr;
+
   return errors;
 }
 

package/src/server/server.js

@@ -411,6 +411,19 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
         // editable_by, so a hand-crafted request bypassing the rendered form
         // cannot smuggle a restricted field in.
         permissionService.enforceEditPermissions(user, spec, body);
+        {
+          // Same gap PUT/PATCH had (fixed last pass): this raw-CRUD POST
+          // never called any field validation, so required/min-max/enum/ref-
+          // existence and entity-specific rules (e.g. stock-movement balance
+          // enforcement below) were silently skipped for a hand-crafted create.
+          const { validateEntity, hasErrors } = await import('../lib/validation/entity-validators.js');
+          const createErrors = await validateEntity(entity, body, null);
+          if (hasErrors(createErrors)) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: 'Validation failed', errors: createErrors }));
+            return;
+          }
+        }
         result = await thatcher.create(entity, body, user);
         const { logAction } = await import('../lib/busybase/audit.js');
         logAction(entity, result.id, 'create', user.id, null, result);
@@ -436,6 +449,19 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
           return;
         }
         permissionService.enforceEditPermissions(user, spec, body);
+        {
+          // validateUpdate is the authoritative server-side check for both
+          // generic field-type constraints AND entity-specific business
+          // rules (e.g. task dependency completion) -- this raw-CRUD path
+          // never called it at all, so those rules were UI-only until now.
+          const { validateUpdate, hasErrors } = await import('../lib/validation/entity-validators.js');
+          const updateErrors = await validateUpdate(entity, body, existingForUpdate);
+          if (hasErrors(updateErrors)) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: 'Validation failed', errors: updateErrors }));
+            return;
+          }
+        }
         result = await thatcher.update(entity, id, body, user);
         const { logAction: logUpdate } = await import('../lib/busybase/audit.js');
         logUpdate(entity, id, 'update', user.id, existingForUpdate, result);

package/src/ui/entity-renderer.js

@@ -77,6 +77,10 @@ function formatFieldValue(k, v, entityName, f) {
     const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
     return arr.length ? arr.map(x => `<span class="pill pill-neutral" style="margin-right:4px">${esc(x)}</span>`).join('') : '-'
   }
+  if (f?.type === 'multiref' && f.ref) {
+    const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
+    return arr.length ? arr.map(x => `<a href="/${esc(f.ref)}/${esc(x)}" class="pill pill-neutral" style="margin-right:4px;text-decoration:none">${esc(x)}</a>`).join('') : '-'
+  }
   if (f?.type === 'file' || f?.type === 'attachment') {
     const meta = typeof v === 'object' && v ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return null } })() : null)
     return meta?.url ? `<a href="${esc(meta.url)}" class="text-primary hover:underline" target="_blank" rel="noopener">${esc(meta.filename || 'Download')}</a>` : '-'
@@ -120,9 +124,23 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
   const userCanEdit = canEdit(user, entityName)
   const userCanDelete = canDelete(user, entityName)
 
+  // current_stock is computed (page-handler.js sums stock_movement rows),
+  // never a spec.fields entry -- rendered as its own row rather than folded
+  // into the generic field loop below, which only knows about spec fields.
+  const stockRow = entityName === 'product' && typeof item.current_stock === 'number'
+    ? (() => {
+        const low = item.reorder_threshold != null && item.current_stock <= item.reorder_threshold
+        const pillCls = low ? 'pill-danger' : 'pill-success'
+        return `<div class="detail-row">
+          <span class="detail-row-label">Current Stock</span>
+          <span class="detail-row-value"><span class="pill ${pillCls}">${esc(String(item.current_stock))}${low ? ' (Low Stock)' : ''}</span></span>
+        </div>`
+      })()
+    : ''
+
   const visibleFields = Object.entries(fields).filter(([k]) => k !== 'id' && !HIDDEN_FIELDS.has(k) && item[k] !== undefined)
 
-  const fieldRows = visibleFields.map(([k, f]) =>
+  const fieldRows = stockRow + visibleFields.map(([k, f]) =>
     `<div class="detail-row">
       <span class="detail-row-label">${esc(f.label || k)}</span>
       <span class="detail-row-value">${formatFieldValue(k, item[k], entityName, f)}</span>
@@ -213,6 +231,11 @@ export function renderEntityForm(entityName, item, spec, user, isNew = false, re
       const opts = (Array.isArray(f.options) ? f.options : []).map(o => { const ov = typeof o === 'string' ? o : o.value; const ol = typeof o === 'string' ? o : o.label; return `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(ov)}" class="checkbox checkbox-primary" ${selected.has(ov)?'checked':''}/><span>${esc(ol)}</span></label>` }).join('')
       return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
     }
+    if (f.type === 'multiref' && refOptions[k]) {
+      const selected = new Set(Array.isArray(val) ? val : (typeof val === 'string' && val ? (() => { try { return JSON.parse(val) } catch { return [] } })() : []))
+      const opts = refOptions[k].filter(o => o.value !== item?.id).map(o => `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(o.value)}" class="checkbox checkbox-primary" ${selected.has(o.value)?'checked':''}/><span>${esc(o.label)}</span></label>`).join('') || '<p style="font-size:0.8rem;color:var(--color-text-muted)">No options available</p>'
+      return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
+    }
     if (f.type === 'currency') {
       const symbol = esc(f.currency_symbol || '$')
       const decimalVal = typeof val === 'number' ? (val / 100).toFixed(2) : val

package/src/ui/page-handler-helpers.js

@@ -19,7 +19,7 @@ export function resolveEnumOptions(spec) {
 
 export async function getRefOptions(spec) {
   const refOptions = {};
-  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref)) {
+  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => (f.type === 'ref' || f.type === 'multiref') && f.ref)) {
     try { refOptions[fieldKey] = (await list(field.ref, {})).map(r => ({ value: r.id, label: r.name || r.title || r.label || r.email || r.id })); }
     catch { refOptions[fieldKey] = []; }
   }

package/src/ui/page-handler.js

@@ -114,7 +114,17 @@ async function handleGenericEntityView(user, entityName, id, req) {
   const item = await get(entityName, id, { user }); if (!item) return null;
   if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'view');
   if (isClientUser(user) && user.client_id && item.client_id && item.client_id !== user.client_id) return renderAccessDenied(user, entityName, 'view');
-  const [resolvedItem] = resolveRefFields([item], spec);
+  let [resolvedItem] = resolveRefFields([item], spec);
+  if (entityName === 'product') {
+    // current_stock is derived, never a stored/editable field -- summed fresh
+    // from stock_movement history so it can never drift from the ledger the
+    // way a separately-writable counter could.
+    try {
+      const movements = await list('stock_movement', { product_id: id });
+      const currentStock = movements.reduce((sum, m) => sum + (Number(m.quantity) || 0), 0);
+      resolvedItem = { ...resolvedItem, current_stock: currentStock };
+    } catch { resolvedItem = { ...resolvedItem, current_stock: 0 }; }
+  }
   // get(...,{user}) above already enforced row/org access for this exact
   // record (a denied/absent record returns null before this point), so
   // fetching its audit trail here is scoped by construction -- there is no