thatcher 1.0.72 → 1.0.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.72",
+  "version": "1.0.74",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -231,10 +231,32 @@ function withInventoryDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const TIME_ENTRY_ENTITY_DEFAULT = {
+  label: 'Time Entry',
+  label_plural: 'Time Entries',
+  system_entity: true,
+  fields: {
+    task_id: { type: 'ref', ref: 'task', required: true, label: 'Task' },
+    user_id: { type: 'ref', ref: 'user', required: true, label: 'User' },
+    date: { type: 'date', required: true, label: 'Date' },
+    hours: { type: 'number', required: true, min: 0, max: 24, label: 'Hours' },
+    billable: { type: 'bool', default: true, label: 'Billable' },
+    rate: { type: 'currency', label: 'Rate' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+function withTimeTrackingDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.time_entry) { entities.time_entry = TIME_ENTRY_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))));
+    this.masterConfig = deepFreeze(withTimeTrackingDefaults(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)))))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/validation/entity-validators.js

@@ -152,6 +152,22 @@ function resolveEnumOptions(fieldDef, entityName) {
   return [];
 }
 
+// A non-privileged user may only log time against their own user_id -- a
+// clerk POSTing another user's id must be rejected the same way it would be
+// UI-side, but server-side is the authoritative check per this session's SEC
+// pattern. Privileged roles (partner/manager) may log time for anyone, e.g.
+// entering a team member's hours on their behalf.
+function checkTimeEntryOwnership(entityName, data, options) {
+  if (entityName !== 'time_entry') return null;
+  const actingUser = options?.actingUser;
+  if (!actingUser) return null;
+  if (['partner', 'admin', 'manager'].includes(actingUser.role)) return null;
+  if (data.user_id !== undefined && data.user_id !== actingUser.id) {
+    return `Cannot log time for another user`;
+  }
+  return null;
+}
+
 // Stock movements are immutable history (checked at creation only, never on
 // edit -- there is no update path for them). An outbound movement (negative
 // quantity) that would drive the running balance below zero is invalid: the
@@ -174,7 +190,7 @@ async function checkStockBalance(entityName, data) {
   return null;
 }
 
-export async function validateEntity(entityName, data, existingRecord = null) {
+export async function validateEntity(entityName, data, existingRecord = null, options = {}) {
   const spec = getSpec(entityName);
   const errors = {};
 
@@ -201,6 +217,9 @@ export async function validateEntity(entityName, data, existingRecord = null) {
   const stockErr = await checkStockBalance(entityName, data);
   if (stockErr) errors.quantity = stockErr;
 
+  const ownershipErr = checkTimeEntryOwnership(entityName, data, options);
+  if (ownershipErr) errors.user_id = ownershipErr;
+
   return errors;
 }
 

package/src/server/server.js

@@ -417,7 +417,7 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
           // existence and entity-specific rules (e.g. stock-movement balance
           // enforcement below) were silently skipped for a hand-crafted create.
           const { validateEntity, hasErrors } = await import('../lib/validation/entity-validators.js');
-          const createErrors = await validateEntity(entity, body, null);
+          const createErrors = await validateEntity(entity, body, null, { actingUser: user });
           if (hasErrors(createErrors)) {
             res.writeHead(400);
             res.end(JSON.stringify({ error: 'Validation failed', errors: createErrors }));

package/src/ui/entity-renderer.js

@@ -138,9 +138,17 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
       })()
     : ''
 
+  // total_hours/billable_amount are computed (page-handler.js sums time_entry
+  // rows, directly for a task or joined through task for a project), same
+  // not-a-spec-field treatment as current_stock above.
+  const timeTrackingRows = (entityName === 'task' || entityName === 'project') && typeof item.total_hours === 'number'
+    ? `<div class="detail-row"><span class="detail-row-label">Total Hours</span><span class="detail-row-value">${esc(String(item.total_hours))}</span></div>
+       <div class="detail-row"><span class="detail-row-label">Billable Amount</span><span class="detail-row-value">${esc('$' + (item.billable_amount / 100).toFixed(2))}</span></div>`
+    : ''
+
   const visibleFields = Object.entries(fields).filter(([k]) => k !== 'id' && !HIDDEN_FIELDS.has(k) && item[k] !== undefined)
 
-  const fieldRows = stockRow + visibleFields.map(([k, f]) =>
+  const fieldRows = stockRow + timeTrackingRows + visibleFields.map(([k, f]) =>
     `<div class="detail-row">
       <span class="detail-row-label">${esc(f.label || k)}</span>
       <span class="detail-row-value">${formatFieldValue(k, item[k], entityName, f)}</span>

package/src/ui/page-handler.js

@@ -9,7 +9,7 @@ import { renderEngagementGrid } from '@/ui/engagement-grid-renderer.js';
 import { renderBoardView } from '@/ui/board-view-renderer.js';
 import { renderGridView } from '@/ui/grid-view-renderer.js';
 import { renderCalendarView, renderTimelineView } from '@/ui/calendar-view-renderer.js';
-import { renderCountByFieldReport, renderCountOverTimeReport } from '@/ui/report-renderer.js';
+import { renderCountByFieldReport, renderCountOverTimeReport, renderSumByFieldReport, renderRollupReport } from '@/ui/report-renderer.js';
 import { renderClientProgress } from '@/ui/client-progress-renderer.js';
 import { renderLetterWorkflow } from '@/ui/letter-workflow-renderer.js';
 import { renderAdvancedSearch } from '@/ui/advanced-search-renderer.js';
@@ -125,6 +125,30 @@ async function handleGenericEntityView(user, entityName, id, req) {
       resolvedItem = { ...resolvedItem, current_stock: currentStock };
     } catch { resolvedItem = { ...resolvedItem, current_stock: 0 }; }
   }
+  if (entityName === 'task') {
+    // total_hours/billable_amount are derived from time_entry history, same
+    // never-a-stored-counter discipline as product.current_stock above.
+    try {
+      const entries = await list('time_entry', { task_id: id });
+      const totalHours = entries.reduce((sum, e) => sum + (Number(e.hours) || 0), 0);
+      const billableAmount = entries.filter(e => e.billable).reduce((sum, e) => sum + (Number(e.hours) || 0) * (Number(e.rate) || 0), 0);
+      resolvedItem = { ...resolvedItem, total_hours: totalHours, billable_amount: billableAmount };
+    } catch { resolvedItem = { ...resolvedItem, total_hours: 0, billable_amount: 0 }; }
+  }
+  if (entityName === 'project') {
+    // Project-level rollup joins through task the same way the rollup report
+    // added last pass joins entity A through a ref field to entity B -- no
+    // new join logic, just the same id-lookup-then-aggregate shape.
+    try {
+      const tasks = await list('task', { project_id: id });
+      const taskIds = new Set(tasks.map(t => t.id));
+      const allEntries = await list('time_entry', {});
+      const projectEntries = allEntries.filter(e => taskIds.has(e.task_id));
+      const totalHours = projectEntries.reduce((sum, e) => sum + (Number(e.hours) || 0), 0);
+      const billableAmount = projectEntries.filter(e => e.billable).reduce((sum, e) => sum + (Number(e.hours) || 0) * (Number(e.rate) || 0), 0);
+      resolvedItem = { ...resolvedItem, total_hours: totalHours, billable_amount: billableAmount };
+    } catch { resolvedItem = { ...resolvedItem, total_hours: 0, billable_amount: 0 }; }
+  }
   // get(...,{user}) above already enforced row/org access for this exact
   // record (a denied/absent record returns null before this point), so
   // fetching its audit trail here is scoped by construction -- there is no
@@ -303,6 +327,27 @@ export async function handlePage(pathname, req, res) {
       const granularity = params.get('granularity') || 'month';
       return renderCountOverTimeReport(user, entityName, spec, items, dateField, granularity);
     }
+    if (report === 'sum-by-field') {
+      const field = params.get('field') || '';
+      const groupBy = params.get('group_by') || '';
+      return renderSumByFieldReport(user, entityName, spec, items, field, groupBy);
+    }
+    if (report === 'rollup') {
+      const refField = params.get('ref_field') || '';
+      const rollupField = params.get('rollup_field') || '';
+      // The rollup groups by a field on the RELATED entity (refField.ref), so
+      // that entity's list access must be checked the same way viewing it
+      // directly would be -- a cross-entity report must not become a side
+      // channel for reading data the user couldn't otherwise view.
+      const refFieldDef = spec.fields?.[refField];
+      const relatedEntity = refFieldDef?.ref;
+      if (!relatedEntity || !canList(user, relatedEntity)) {
+        return renderAccessDenied(user, relatedEntity || entityName, 'view');
+      }
+      const relatedSpec = getSpec(relatedEntity);
+      const relatedRecords = await list(relatedEntity, {}, { user });
+      return renderRollupReport(user, entityName, spec, items, refField, relatedEntity, relatedSpec, relatedRecords, rollupField);
+    }
     const view = params.get('view');
     if (view === 'board') return renderBoardView(user, entityName, spec, items);
     if (view === 'grid') return renderGridView(user, entityName, spec, items);

package/src/ui/report-renderer.js

@@ -89,6 +89,101 @@ export function renderCountByFieldReport(user, entityName, spec, records, field)
   return page(user, `${label} Report | Thatcher`, null, content);
 }
 
+export function sumByField(records, spec, field, groupBy) {
+  const sums = new Map();
+  for (const r of records) {
+    const raw = r[field];
+    const num = typeof raw === 'string' ? Number(raw) : raw;
+    if (typeof num !== 'number' || isNaN(num)) continue;
+    const label = bucketLabel(spec, groupBy, r[groupBy]);
+    sums.set(label, (sums.get(label) || 0) + num);
+  }
+  const sorted = [...sums.entries()].sort((a, b) => b[1] - a[1]);
+  if (sorted.length <= MAX_BUCKETS) return sorted;
+  const top = sorted.slice(0, MAX_BUCKETS - 1);
+  const otherSum = sorted.slice(MAX_BUCKETS - 1).reduce((sum, [, v]) => sum + v, 0);
+  return [...top, ['(other)', otherSum]];
+}
+
+function formatSumValue(value, fieldDef) {
+  if (fieldDef?.type === 'currency') return (fieldDef.currency_symbol || '$') + (value / 100).toFixed(2);
+  return String(Math.round(value * 100) / 100);
+}
+
+function sumBarChart(buckets, fieldDef) {
+  if (!buckets.length) return emptyState('No data to report on', 'bar-chart');
+  const max = Math.max(...buckets.map(([, v]) => Math.abs(v)), 1);
+  const rows = buckets.map(([label, value]) => {
+    const pct = Math.round((Math.abs(value) / max) * 100);
+    return `<div class="report-bar-row" style="display:flex;align-items:center;gap:12px;margin-bottom:8px">
+      <div style="min-width:140px;max-width:220px;font-size:13px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="${esc(label)}">${esc(label)}</div>
+      <div style="flex:1;height:20px;background:var(--color-border,#eee);border-radius:4px;overflow:hidden">
+        <div style="height:100%;width:${pct}%;background:var(--color-primary,#3b82f6);border-radius:4px"></div>
+      </div>
+      <div style="min-width:80px;text-align:right;font-size:13px;font-weight:600">${esc(formatSumValue(value, fieldDef))}</div>
+    </div>`;
+  }).join('');
+  return `<div class="report-bar-chart">${rows}</div>`;
+}
+
+export function renderSumByFieldReport(user, entityName, spec, records, field, groupBy) {
+  const label = getEntityLabel(spec, true) || entityName;
+  const fieldDef = spec.fields?.[field];
+  const groupByDef = spec.fields?.[groupBy];
+  if (!fieldDef || !groupByDef) {
+    return page(user, `${label} | Report`, null,
+      `<div class="page-header"><h1 class="page-title">${esc(label)}</h1></div>
+      <div class="report-empty-state">Unknown field "${esc(!fieldDef ? field : groupBy)}" for this entity.</div>`);
+  }
+  const buckets = sumByField(records, spec, field, groupBy);
+  const content = `<div class="page-header">
+      <div><h1 class="page-title">${esc(label)}: ${esc(fieldDef.label || field)} by ${esc(groupByDef.label || groupBy)}</h1><p class="page-subtitle">${records.length} total records</p></div>
+    </div>
+    ${sumBarChart(buckets, fieldDef)}`;
+  return page(user, `${label} Report | Thatcher`, null, content);
+}
+
+// Cross-entity rollup: entity A's records are grouped by a field on related
+// entity B, joined through A's ref field. relatedRecords must already be the
+// CALLER's row/org-scoped list() result for B -- this function only joins
+// and counts, it enforces no access itself (the access decision -- can this
+// user list B at all -- is made by the caller before relatedRecords exists).
+export function rollupByRelatedField(records, refField, relatedRecords, relatedSpec, rollupField) {
+  const relatedById = new Map(relatedRecords.map(r => [String(r.id), r]));
+  const counts = new Map();
+  let unmatched = 0;
+  for (const r of records) {
+    const refId = r[refField];
+    const related = refId != null ? relatedById.get(String(refId)) : null;
+    if (!related) { unmatched++; continue; }
+    const label = bucketLabel(relatedSpec, rollupField, related[rollupField]);
+    counts.set(label, (counts.get(label) || 0) + 1);
+  }
+  const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+  return { buckets: sorted.length > MAX_BUCKETS ? sorted.slice(0, MAX_BUCKETS) : sorted, unmatched };
+}
+
+export function renderRollupReport(user, entityName, spec, records, refField, relatedEntity, relatedSpec, relatedRecords, rollupField) {
+  const label = getEntityLabel(spec, true) || entityName;
+  const relatedLabel = getEntityLabel(relatedSpec, true) || relatedEntity;
+  const rollupFieldDef = relatedSpec?.fields?.[rollupField];
+  if (!spec.fields?.[refField] || !rollupFieldDef) {
+    return page(user, `${label} | Report`, null,
+      `<div class="page-header"><h1 class="page-title">${esc(label)}</h1></div>
+      <div class="report-empty-state">Unknown field for this rollup.</div>`);
+  }
+  const { buckets, unmatched } = rollupByRelatedField(records, refField, relatedRecords, relatedSpec, rollupField);
+  const notice = unmatched
+    ? `<div class="report-notice">${unmatched} record${unmatched === 1 ? '' : 's'} without a resolvable ${esc(relatedLabel)} excluded</div>`
+    : '';
+  const content = `<div class="page-header">
+      <div><h1 class="page-title">${esc(label)} by ${esc(relatedLabel)}.${esc(rollupFieldDef.label || rollupField)}</h1><p class="page-subtitle">${records.length} total records</p></div>
+    </div>
+    ${notice}
+    ${barChart(buckets)}`;
+  return page(user, `${label} Report | Thatcher`, null, content);
+}
+
 export function renderCountOverTimeReport(user, entityName, spec, records, dateField, granularity) {
   const label = getEntityLabel(spec, true) || entityName;
   const fieldDef = spec.fields?.[dateField];