thatcher 1.0.73 → 1.0.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.73",
+  "version": "1.0.75",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/config-generator-engine.js

@@ -231,10 +231,71 @@ function withInventoryDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const TIME_ENTRY_ENTITY_DEFAULT = {
+  label: 'Time Entry',
+  label_plural: 'Time Entries',
+  system_entity: true,
+  fields: {
+    task_id: { type: 'ref', ref: 'task', required: true, label: 'Task' },
+    user_id: { type: 'ref', ref: 'user', required: true, label: 'User' },
+    date: { type: 'date', required: true, label: 'Date' },
+    hours: { type: 'number', required: true, min: 0, max: 24, label: 'Hours' },
+    billable: { type: 'bool', default: true, label: 'Billable' },
+    rate: { type: 'currency', label: 'Rate' },
+    notes: { type: 'textarea', label: 'Notes' },
+  },
+};
+
+function withTimeTrackingDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.time_entry) { entities.time_entry = TIME_ENTRY_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
+const CONTRACT_LIFECYCLE_WORKFLOW = {
+  state_field: 'status',
+  stages: [
+    { name: 'draft', label: 'Draft', forward: ['active'], backward: [] },
+    { name: 'active', label: 'Active', forward: ['expired', 'renewed', 'terminated'], backward: [] },
+    { name: 'expired', label: 'Expired', forward: ['renewed'], backward: [] },
+    { name: 'terminated', label: 'Terminated', forward: [], backward: [] },
+    { name: 'renewed', label: 'Renewed', forward: [], backward: [] },
+  ],
+};
+
+const CONTRACT_ENTITY_DEFAULT = {
+  label: 'Contract',
+  label_plural: 'Contracts',
+  system_entity: true,
+  workflow: 'contract_lifecycle',
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    organization_id: { type: 'ref', ref: 'organization', label: 'Organization' },
+    opportunity_id: { type: 'ref', ref: 'opportunity', label: 'Opportunity' },
+    value: { type: 'currency', label: 'Value' },
+    start_date: { type: 'date', required: true, label: 'Start Date' },
+    end_date: { type: 'date', required: true, label: 'End Date' },
+    status: { type: 'enum', options: ['draft', 'active', 'expired', 'terminated', 'renewed'], default: 'draft', label: 'Status' },
+    auto_renew: { type: 'bool', default: false, label: 'Auto Renew' },
+    notice_period_days: { type: 'number', min: 0, default: 30, label: 'Notice Period (days)' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+  },
+};
+
+function withContractDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  const workflows = { ...(masterConfig.workflows || {}) };
+  let changed = false;
+  if (!entities.contract) { entities.contract = CONTRACT_ENTITY_DEFAULT; changed = true; }
+  if (!workflows.contract_lifecycle) { workflows.contract_lifecycle = CONTRACT_LIFECYCLE_WORKFLOW; changed = true; }
+  return changed ? { ...masterConfig, entities, workflows } : masterConfig;
+}
+
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))));
+    this.masterConfig = deepFreeze(withContractDefaults(withTimeTrackingDefaults(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/validation/entity-validators.js

@@ -152,6 +152,22 @@ function resolveEnumOptions(fieldDef, entityName) {
   return [];
 }
 
+// A non-privileged user may only log time against their own user_id -- a
+// clerk POSTing another user's id must be rejected the same way it would be
+// UI-side, but server-side is the authoritative check per this session's SEC
+// pattern. Privileged roles (partner/manager) may log time for anyone, e.g.
+// entering a team member's hours on their behalf.
+function checkTimeEntryOwnership(entityName, data, options) {
+  if (entityName !== 'time_entry') return null;
+  const actingUser = options?.actingUser;
+  if (!actingUser) return null;
+  if (['partner', 'admin', 'manager'].includes(actingUser.role)) return null;
+  if (data.user_id !== undefined && data.user_id !== actingUser.id) {
+    return `Cannot log time for another user`;
+  }
+  return null;
+}
+
 // Stock movements are immutable history (checked at creation only, never on
 // edit -- there is no update path for them). An outbound movement (negative
 // quantity) that would drive the running balance below zero is invalid: the
@@ -174,7 +190,22 @@ async function checkStockBalance(entityName, data) {
   return null;
 }
 
-export async function validateEntity(entityName, data, existingRecord = null) {
+// A contract whose end_date is not strictly after its start_date is invalid
+// regardless of what the form happened to allow -- checked wherever either
+// date is present in the payload so it also catches a create that only sets
+// one of the two dates against an existing record's other date on update.
+function checkContractDateOrder(entityName, data, existingRecord) {
+  if (entityName !== 'contract') return null;
+  const startDate = data.start_date !== undefined ? data.start_date : existingRecord?.start_date;
+  const endDate = data.end_date !== undefined ? data.end_date : existingRecord?.end_date;
+  if (startDate == null || endDate == null) return null;
+  if (Number(endDate) <= Number(startDate)) {
+    return `end_date must be after start_date`;
+  }
+  return null;
+}
+
+export async function validateEntity(entityName, data, existingRecord = null, options = {}) {
   const spec = getSpec(entityName);
   const errors = {};
 
@@ -201,6 +232,12 @@ export async function validateEntity(entityName, data, existingRecord = null) {
   const stockErr = await checkStockBalance(entityName, data);
   if (stockErr) errors.quantity = stockErr;
 
+  const ownershipErr = checkTimeEntryOwnership(entityName, data, options);
+  if (ownershipErr) errors.user_id = ownershipErr;
+
+  const dateOrderErr = checkContractDateOrder(entityName, data, existingRecord);
+  if (dateOrderErr) errors.end_date = dateOrderErr;
+
   return errors;
 }
 
@@ -276,6 +313,9 @@ export async function validateUpdate(entityName, changes, existingRecord) {
   const depErr = await checkTaskDependencies(entityName, changes, existingRecord);
   if (depErr) errors.status = depErr;
 
+  const dateOrderErr = checkContractDateOrder(entityName, changes, existingRecord);
+  if (dateOrderErr) errors.end_date = dateOrderErr;
+
   return errors;
 }
 

package/src/server/server.js

@@ -417,7 +417,7 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
           // existence and entity-specific rules (e.g. stock-movement balance
           // enforcement below) were silently skipped for a hand-crafted create.
           const { validateEntity, hasErrors } = await import('../lib/validation/entity-validators.js');
-          const createErrors = await validateEntity(entity, body, null);
+          const createErrors = await validateEntity(entity, body, null, { actingUser: user });
           if (hasErrors(createErrors)) {
             res.writeHead(400);
             res.end(JSON.stringify({ error: 'Validation failed', errors: createErrors }));

package/src/ui/entity-renderer.js

@@ -138,9 +138,31 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
       })()
     : ''
 
+  // total_hours/billable_amount are computed (page-handler.js sums time_entry
+  // rows, directly for a task or joined through task for a project), same
+  // not-a-spec-field treatment as current_stock above.
+  const timeTrackingRows = (entityName === 'task' || entityName === 'project') && typeof item.total_hours === 'number'
+    ? `<div class="detail-row"><span class="detail-row-label">Total Hours</span><span class="detail-row-value">${esc(String(item.total_hours))}</span></div>
+       <div class="detail-row"><span class="detail-row-label">Billable Amount</span><span class="detail-row-value">${esc('$' + (item.billable_amount / 100).toFixed(2))}</span></div>`
+    : ''
+
+  // days_until_expiry is computed (page-handler.js diffs end_date against
+  // now), never a spec.fields entry, same treatment as current_stock above.
+  const expiryRow = entityName === 'contract' && typeof item.days_until_expiry === 'number'
+    ? (() => {
+        const warn = item.status === 'active' && item.days_until_expiry <= (item.notice_period_days ?? 30)
+        const pillCls = item.days_until_expiry < 0 ? 'pill-danger' : (warn ? 'pill-warning' : 'pill-success')
+        const label = item.days_until_expiry < 0 ? `Expired ${Math.abs(item.days_until_expiry)} days ago` : `${item.days_until_expiry} days`
+        return `<div class="detail-row">
+          <span class="detail-row-label">Days Until Expiry</span>
+          <span class="detail-row-value"><span class="pill ${pillCls}">${esc(label)}${warn ? ' (Renewal Notice)' : ''}</span></span>
+        </div>`
+      })()
+    : ''
+
   const visibleFields = Object.entries(fields).filter(([k]) => k !== 'id' && !HIDDEN_FIELDS.has(k) && item[k] !== undefined)
 
-  const fieldRows = stockRow + visibleFields.map(([k, f]) =>
+  const fieldRows = stockRow + timeTrackingRows + expiryRow + visibleFields.map(([k, f]) =>
     `<div class="detail-row">
       <span class="detail-row-label">${esc(f.label || k)}</span>
       <span class="detail-row-value">${formatFieldValue(k, item[k], entityName, f)}</span>

package/src/ui/page-handler.js

@@ -125,6 +125,40 @@ async function handleGenericEntityView(user, entityName, id, req) {
       resolvedItem = { ...resolvedItem, current_stock: currentStock };
     } catch { resolvedItem = { ...resolvedItem, current_stock: 0 }; }
   }
+  if (entityName === 'task') {
+    // total_hours/billable_amount are derived from time_entry history, same
+    // never-a-stored-counter discipline as product.current_stock above.
+    try {
+      const entries = await list('time_entry', { task_id: id });
+      const totalHours = entries.reduce((sum, e) => sum + (Number(e.hours) || 0), 0);
+      const billableAmount = entries.filter(e => e.billable).reduce((sum, e) => sum + (Number(e.hours) || 0) * (Number(e.rate) || 0), 0);
+      resolvedItem = { ...resolvedItem, total_hours: totalHours, billable_amount: billableAmount };
+    } catch { resolvedItem = { ...resolvedItem, total_hours: 0, billable_amount: 0 }; }
+  }
+  if (entityName === 'project') {
+    // Project-level rollup joins through task the same way the rollup report
+    // added last pass joins entity A through a ref field to entity B -- no
+    // new join logic, just the same id-lookup-then-aggregate shape.
+    try {
+      const tasks = await list('task', { project_id: id });
+      const taskIds = new Set(tasks.map(t => t.id));
+      const allEntries = await list('time_entry', {});
+      const projectEntries = allEntries.filter(e => taskIds.has(e.task_id));
+      const totalHours = projectEntries.reduce((sum, e) => sum + (Number(e.hours) || 0), 0);
+      const billableAmount = projectEntries.filter(e => e.billable).reduce((sum, e) => sum + (Number(e.hours) || 0) * (Number(e.rate) || 0), 0);
+      resolvedItem = { ...resolvedItem, total_hours: totalHours, billable_amount: billableAmount };
+    } catch { resolvedItem = { ...resolvedItem, total_hours: 0, billable_amount: 0 }; }
+  }
+  if (entityName === 'contract' && resolvedItem.end_date != null) {
+    // days_until_expiry is computed from the already-access-checked record
+    // (get(...,{user}) above already returned null for a denied/absent
+    // contract before this line is ever reached), never a separate query
+    // that could leak the value to a caller who never proved they can view
+    // this specific contract.
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const daysUntilExpiry = Math.floor((Number(resolvedItem.end_date) - nowSeconds) / 86400);
+    resolvedItem = { ...resolvedItem, days_until_expiry: daysUntilExpiry };
+  }
   // get(...,{user}) above already enforced row/org access for this exact
   // record (a denied/absent record returns null before this point), so
   // fetching its audit trail here is scoped by construction -- there is no