thatcher 1.0.71 → 1.0.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.71",
+  "version": "1.0.73",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -197,10 +197,44 @@ function withProjectDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const PRODUCT_ENTITY_DEFAULT = {
+  label: 'Product',
+  label_plural: 'Products',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    sku: { type: 'text', required: true, unique: true, label: 'SKU' },
+    description: { type: 'textarea', label: 'Description' },
+    unit_price: { type: 'currency', label: 'Unit Price' },
+    reorder_threshold: { type: 'number', min: 0, label: 'Reorder Threshold' },
+  },
+};
+
+const STOCK_MOVEMENT_ENTITY_DEFAULT = {
+  label: 'Stock Movement',
+  label_plural: 'Stock Movements',
+  system_entity: true,
+  fields: {
+    product_id: { type: 'ref', ref: 'product', required: true, label: 'Product' },
+    quantity: { type: 'number', required: true, label: 'Quantity' },
+    movement_type: { type: 'enum', options: ['receipt', 'sale', 'adjustment', 'return'], required: true, label: 'Movement Type' },
+    reference: { type: 'text', label: 'Reference' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+function withInventoryDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.product) { entities.product = PRODUCT_ENTITY_DEFAULT; changed = true; }
+  if (!entities.stock_movement) { entities.stock_movement = STOCK_MOVEMENT_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)))));
+    this.masterConfig = deepFreeze(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/validation/entity-validators.js

@@ -152,6 +152,28 @@ function resolveEnumOptions(fieldDef, entityName) {
   return [];
 }
 
+// Stock movements are immutable history (checked at creation only, never on
+// edit -- there is no update path for them). An outbound movement (negative
+// quantity) that would drive the running balance below zero is invalid: the
+// balance is the sum of every OTHER movement for this product plus the new
+// one, computed fresh from stored data, never trusting a client-supplied
+// "current stock" value that doesn't exist as an editable field.
+async function checkStockBalance(entityName, data) {
+  if (entityName !== 'stock_movement') return null;
+  const quantity = Number(data.quantity);
+  if (!Number.isFinite(quantity) || quantity >= 0) return null;
+  if (!data.product_id) return null;
+
+  const { list } = await import('@/lib/busybase/store');
+  const existingMovements = await list('stock_movement', { product_id: data.product_id });
+  const currentBalance = existingMovements.reduce((sum, m) => sum + (Number(m.quantity) || 0), 0);
+  const resultingBalance = currentBalance + quantity;
+  if (resultingBalance < 0) {
+    return `Insufficient stock: current balance is ${currentBalance}, this movement would result in ${resultingBalance}`;
+  }
+  return null;
+}
+
 export async function validateEntity(entityName, data, existingRecord = null) {
   const spec = getSpec(entityName);
   const errors = {};
@@ -176,6 +198,9 @@ export async function validateEntity(entityName, data, existingRecord = null) {
     if (uniqueErr && !errors[fieldName]) errors[fieldName] = uniqueErr;
   }
 
+  const stockErr = await checkStockBalance(entityName, data);
+  if (stockErr) errors.quantity = stockErr;
+
   return errors;
 }
 

package/src/server/server.js

@@ -411,6 +411,19 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
         // editable_by, so a hand-crafted request bypassing the rendered form
         // cannot smuggle a restricted field in.
         permissionService.enforceEditPermissions(user, spec, body);
+        {
+          // Same gap PUT/PATCH had (fixed last pass): this raw-CRUD POST
+          // never called any field validation, so required/min-max/enum/ref-
+          // existence and entity-specific rules (e.g. stock-movement balance
+          // enforcement below) were silently skipped for a hand-crafted create.
+          const { validateEntity, hasErrors } = await import('../lib/validation/entity-validators.js');
+          const createErrors = await validateEntity(entity, body, null);
+          if (hasErrors(createErrors)) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: 'Validation failed', errors: createErrors }));
+            return;
+          }
+        }
         result = await thatcher.create(entity, body, user);
         const { logAction } = await import('../lib/busybase/audit.js');
         logAction(entity, result.id, 'create', user.id, null, result);

package/src/ui/entity-renderer.js

@@ -124,9 +124,23 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
   const userCanEdit = canEdit(user, entityName)
   const userCanDelete = canDelete(user, entityName)
 
+  // current_stock is computed (page-handler.js sums stock_movement rows),
+  // never a spec.fields entry -- rendered as its own row rather than folded
+  // into the generic field loop below, which only knows about spec fields.
+  const stockRow = entityName === 'product' && typeof item.current_stock === 'number'
+    ? (() => {
+        const low = item.reorder_threshold != null && item.current_stock <= item.reorder_threshold
+        const pillCls = low ? 'pill-danger' : 'pill-success'
+        return `<div class="detail-row">
+          <span class="detail-row-label">Current Stock</span>
+          <span class="detail-row-value"><span class="pill ${pillCls}">${esc(String(item.current_stock))}${low ? ' (Low Stock)' : ''}</span></span>
+        </div>`
+      })()
+    : ''
+
   const visibleFields = Object.entries(fields).filter(([k]) => k !== 'id' && !HIDDEN_FIELDS.has(k) && item[k] !== undefined)
 
-  const fieldRows = visibleFields.map(([k, f]) =>
+  const fieldRows = stockRow + visibleFields.map(([k, f]) =>
     `<div class="detail-row">
       <span class="detail-row-label">${esc(f.label || k)}</span>
       <span class="detail-row-value">${formatFieldValue(k, item[k], entityName, f)}</span>

package/src/ui/page-handler.js

@@ -9,7 +9,7 @@ import { renderEngagementGrid } from '@/ui/engagement-grid-renderer.js';
 import { renderBoardView } from '@/ui/board-view-renderer.js';
 import { renderGridView } from '@/ui/grid-view-renderer.js';
 import { renderCalendarView, renderTimelineView } from '@/ui/calendar-view-renderer.js';
-import { renderCountByFieldReport, renderCountOverTimeReport } from '@/ui/report-renderer.js';
+import { renderCountByFieldReport, renderCountOverTimeReport, renderSumByFieldReport, renderRollupReport } from '@/ui/report-renderer.js';
 import { renderClientProgress } from '@/ui/client-progress-renderer.js';
 import { renderLetterWorkflow } from '@/ui/letter-workflow-renderer.js';
 import { renderAdvancedSearch } from '@/ui/advanced-search-renderer.js';
@@ -114,7 +114,17 @@ async function handleGenericEntityView(user, entityName, id, req) {
   const item = await get(entityName, id, { user }); if (!item) return null;
   if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'view');
   if (isClientUser(user) && user.client_id && item.client_id && item.client_id !== user.client_id) return renderAccessDenied(user, entityName, 'view');
-  const [resolvedItem] = resolveRefFields([item], spec);
+  let [resolvedItem] = resolveRefFields([item], spec);
+  if (entityName === 'product') {
+    // current_stock is derived, never a stored/editable field -- summed fresh
+    // from stock_movement history so it can never drift from the ledger the
+    // way a separately-writable counter could.
+    try {
+      const movements = await list('stock_movement', { product_id: id });
+      const currentStock = movements.reduce((sum, m) => sum + (Number(m.quantity) || 0), 0);
+      resolvedItem = { ...resolvedItem, current_stock: currentStock };
+    } catch { resolvedItem = { ...resolvedItem, current_stock: 0 }; }
+  }
   // get(...,{user}) above already enforced row/org access for this exact
   // record (a denied/absent record returns null before this point), so
   // fetching its audit trail here is scoped by construction -- there is no
@@ -293,6 +303,27 @@ export async function handlePage(pathname, req, res) {
       const granularity = params.get('granularity') || 'month';
       return renderCountOverTimeReport(user, entityName, spec, items, dateField, granularity);
     }
+    if (report === 'sum-by-field') {
+      const field = params.get('field') || '';
+      const groupBy = params.get('group_by') || '';
+      return renderSumByFieldReport(user, entityName, spec, items, field, groupBy);
+    }
+    if (report === 'rollup') {
+      const refField = params.get('ref_field') || '';
+      const rollupField = params.get('rollup_field') || '';
+      // The rollup groups by a field on the RELATED entity (refField.ref), so
+      // that entity's list access must be checked the same way viewing it
+      // directly would be -- a cross-entity report must not become a side
+      // channel for reading data the user couldn't otherwise view.
+      const refFieldDef = spec.fields?.[refField];
+      const relatedEntity = refFieldDef?.ref;
+      if (!relatedEntity || !canList(user, relatedEntity)) {
+        return renderAccessDenied(user, relatedEntity || entityName, 'view');
+      }
+      const relatedSpec = getSpec(relatedEntity);
+      const relatedRecords = await list(relatedEntity, {}, { user });
+      return renderRollupReport(user, entityName, spec, items, refField, relatedEntity, relatedSpec, relatedRecords, rollupField);
+    }
     const view = params.get('view');
     if (view === 'board') return renderBoardView(user, entityName, spec, items);
     if (view === 'grid') return renderGridView(user, entityName, spec, items);

package/src/ui/report-renderer.js

@@ -89,6 +89,101 @@ export function renderCountByFieldReport(user, entityName, spec, records, field)
   return page(user, `${label} Report | Thatcher`, null, content);
 }
 
+export function sumByField(records, spec, field, groupBy) {
+  const sums = new Map();
+  for (const r of records) {
+    const raw = r[field];
+    const num = typeof raw === 'string' ? Number(raw) : raw;
+    if (typeof num !== 'number' || isNaN(num)) continue;
+    const label = bucketLabel(spec, groupBy, r[groupBy]);
+    sums.set(label, (sums.get(label) || 0) + num);
+  }
+  const sorted = [...sums.entries()].sort((a, b) => b[1] - a[1]);
+  if (sorted.length <= MAX_BUCKETS) return sorted;
+  const top = sorted.slice(0, MAX_BUCKETS - 1);
+  const otherSum = sorted.slice(MAX_BUCKETS - 1).reduce((sum, [, v]) => sum + v, 0);
+  return [...top, ['(other)', otherSum]];
+}
+
+function formatSumValue(value, fieldDef) {
+  if (fieldDef?.type === 'currency') return (fieldDef.currency_symbol || '$') + (value / 100).toFixed(2);
+  return String(Math.round(value * 100) / 100);
+}
+
+function sumBarChart(buckets, fieldDef) {
+  if (!buckets.length) return emptyState('No data to report on', 'bar-chart');
+  const max = Math.max(...buckets.map(([, v]) => Math.abs(v)), 1);
+  const rows = buckets.map(([label, value]) => {
+    const pct = Math.round((Math.abs(value) / max) * 100);
+    return `<div class="report-bar-row" style="display:flex;align-items:center;gap:12px;margin-bottom:8px">
+      <div style="min-width:140px;max-width:220px;font-size:13px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="${esc(label)}">${esc(label)}</div>
+      <div style="flex:1;height:20px;background:var(--color-border,#eee);border-radius:4px;overflow:hidden">
+        <div style="height:100%;width:${pct}%;background:var(--color-primary,#3b82f6);border-radius:4px"></div>
+      </div>
+      <div style="min-width:80px;text-align:right;font-size:13px;font-weight:600">${esc(formatSumValue(value, fieldDef))}</div>
+    </div>`;
+  }).join('');
+  return `<div class="report-bar-chart">${rows}</div>`;
+}
+
+export function renderSumByFieldReport(user, entityName, spec, records, field, groupBy) {
+  const label = getEntityLabel(spec, true) || entityName;
+  const fieldDef = spec.fields?.[field];
+  const groupByDef = spec.fields?.[groupBy];
+  if (!fieldDef || !groupByDef) {
+    return page(user, `${label} | Report`, null,
+      `<div class="page-header"><h1 class="page-title">${esc(label)}</h1></div>
+      <div class="report-empty-state">Unknown field "${esc(!fieldDef ? field : groupBy)}" for this entity.</div>`);
+  }
+  const buckets = sumByField(records, spec, field, groupBy);
+  const content = `<div class="page-header">
+      <div><h1 class="page-title">${esc(label)}: ${esc(fieldDef.label || field)} by ${esc(groupByDef.label || groupBy)}</h1><p class="page-subtitle">${records.length} total records</p></div>
+    </div>
+    ${sumBarChart(buckets, fieldDef)}`;
+  return page(user, `${label} Report | Thatcher`, null, content);
+}
+
+// Cross-entity rollup: entity A's records are grouped by a field on related
+// entity B, joined through A's ref field. relatedRecords must already be the
+// CALLER's row/org-scoped list() result for B -- this function only joins
+// and counts, it enforces no access itself (the access decision -- can this
+// user list B at all -- is made by the caller before relatedRecords exists).
+export function rollupByRelatedField(records, refField, relatedRecords, relatedSpec, rollupField) {
+  const relatedById = new Map(relatedRecords.map(r => [String(r.id), r]));
+  const counts = new Map();
+  let unmatched = 0;
+  for (const r of records) {
+    const refId = r[refField];
+    const related = refId != null ? relatedById.get(String(refId)) : null;
+    if (!related) { unmatched++; continue; }
+    const label = bucketLabel(relatedSpec, rollupField, related[rollupField]);
+    counts.set(label, (counts.get(label) || 0) + 1);
+  }
+  const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+  return { buckets: sorted.length > MAX_BUCKETS ? sorted.slice(0, MAX_BUCKETS) : sorted, unmatched };
+}
+
+export function renderRollupReport(user, entityName, spec, records, refField, relatedEntity, relatedSpec, relatedRecords, rollupField) {
+  const label = getEntityLabel(spec, true) || entityName;
+  const relatedLabel = getEntityLabel(relatedSpec, true) || relatedEntity;
+  const rollupFieldDef = relatedSpec?.fields?.[rollupField];
+  if (!spec.fields?.[refField] || !rollupFieldDef) {
+    return page(user, `${label} | Report`, null,
+      `<div class="page-header"><h1 class="page-title">${esc(label)}</h1></div>
+      <div class="report-empty-state">Unknown field for this rollup.</div>`);
+  }
+  const { buckets, unmatched } = rollupByRelatedField(records, refField, relatedRecords, relatedSpec, rollupField);
+  const notice = unmatched
+    ? `<div class="report-notice">${unmatched} record${unmatched === 1 ? '' : 's'} without a resolvable ${esc(relatedLabel)} excluded</div>`
+    : '';
+  const content = `<div class="page-header">
+      <div><h1 class="page-title">${esc(label)} by ${esc(relatedLabel)}.${esc(rollupFieldDef.label || rollupField)}</h1><p class="page-subtitle">${records.length} total records</p></div>
+    </div>
+    ${notice}
+    ${barChart(buckets)}`;
+  return page(user, `${label} Report | Thatcher`, null, content);
+}
+
 export function renderCountOverTimeReport(user, entityName, spec, records, dateField, granularity) {
   const label = getEntityLabel(spec, true) || entityName;
   const fieldDef = spec.fields?.[dateField];