thatcher 1.0.75 → 1.0.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.75",
+  "version": "1.0.77",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/bulk-operations.js

@@ -56,6 +56,33 @@ async function bulkTransitionOne(entityName, id, workflowName, toState, user) {
   return transition(entityName, id, workflowName, toState, user, 'bulk operation');
 }
 
+async function bulkNotifyOne(entityName, spec, id, user, message) {
+  // Same permission/row-access gate every other bulk action already applies
+  // -- 'notify' reads the record to build the notification, so it must not
+  // bypass the checks a plain view of that record would require.
+  await requirePermission(user, spec, 'view');
+  const existing = await get(entityName, id, { user });
+  if (!existing) throw new Error('Not found');
+  if (!permissionService.checkRowAccess(user, spec, existing)) throw new Error('Access denied');
+
+  const recipientId = existing.owner_id;
+  if (!recipientId) throw new Error('Record has no owner_id to notify');
+
+  const { createNotification } = await import('../services/notification-engine.js');
+  // createNotification stores user_id as the sole addressee -- the existing
+  // /notifications route already filters list('notification',{user_id:...})
+  // scoped by {user}, so a notification is only ever visible to the user it
+  // names, the same row-access guarantee every other entity gets.
+  return createNotification({
+    user_id: recipientId,
+    title: message || `${spec.label || entityName} update`,
+    message: message || `${spec.label || entityName} "${existing.name || id}" requires attention`,
+    entity_type: entityName,
+    entity_id: id,
+    created_by: user?.id || 'system',
+  });
+}
+
 export async function runBulkOperation(entityName, spec, ids, action, user) {
   if (!Array.isArray(ids) || !ids.length) return { ok: false, error: 'ids array required and must be non-empty' };
   if (ids.length > MAX_BULK_IDS) return { ok: false, error: `Cannot process more than ${MAX_BULK_IDS} ids in one bulk operation` };
@@ -77,6 +104,9 @@ export async function runBulkOperation(entityName, spec, ids, action, user) {
         if (!action.workflow || !action.toState) throw new Error('action.workflow and action.toState required');
         await bulkTransitionOne(entityName, id, action.workflow, action.toState, user);
         results.push({ id, success: true });
+      } else if (action.type === 'notify') {
+        await bulkNotifyOne(entityName, spec, id, user, action.message);
+        results.push({ id, success: true });
       } else {
         results.push({ id, success: false, error: `Unknown action type "${action.type}"` });
       }

package/src/lib/contract-expiry.js

@@ -0,0 +1,13 @@
+// Single source of truth for contract expiry math, shared between
+// page-handler.js's detail-view computation and scheduler-engine.js's
+// expiry-notification pre-filter -- kept in one place so the two never drift
+// against each other the way a duplicated formula could.
+export function daysUntilExpiry(endDate, nowSeconds = Math.floor(Date.now() / 1000)) {
+  return Math.floor((Number(endDate) - nowSeconds) / 86400);
+}
+
+export function isWithinNoticeWindow(contract, nowSeconds = Math.floor(Date.now() / 1000)) {
+  if (contract.status !== 'active' || contract.end_date == null) return false;
+  const days = daysUntilExpiry(contract.end_date, nowSeconds);
+  return days <= (contract.notice_period_days ?? 30);
+}

package/src/lib/presence-tracker.js

@@ -0,0 +1,52 @@
+// In-memory presence: who is currently viewing entity+id. No persistence --
+// presence is inherently ephemeral, and a restart clearing it is correct
+// behavior, not data loss. Swept on a timer the same way scheduler-engine.js
+// sweeps due jobs, so a closed tab's viewer entry disappears on its own
+// without requiring an explicit "leaving" signal the client might never send.
+const STALE_AFTER_MS = 30 * 1000;
+const SWEEP_INTERVAL_MS = 15 * 1000;
+const presence = new Map();
+
+let sweepHandle = null;
+function ensureSweep() {
+  if (sweepHandle) return;
+  sweepHandle = setInterval(() => {
+    const now = Date.now();
+    for (const [key, viewers] of presence) {
+      for (const [userId, entry] of viewers) {
+        if (now - entry.lastSeenAt > STALE_AFTER_MS) viewers.delete(userId);
+      }
+      if (viewers.size === 0) presence.delete(key);
+    }
+  }, SWEEP_INTERVAL_MS);
+  if (sweepHandle.unref) sweepHandle.unref();
+}
+
+function keyFor(entity, id) {
+  return `${entity}:${id}`;
+}
+
+export function heartbeat(entity, id, userId, userName) {
+  ensureSweep();
+  const key = keyFor(entity, id);
+  let viewers = presence.get(key);
+  if (!viewers) { viewers = new Map(); presence.set(key, viewers); }
+  viewers.set(userId, { userId, userName, lastSeenAt: Date.now() });
+}
+
+// Excludes the requester so a solo viewer never sees themselves listed as
+// "someone else is viewing this record" -- the indicator is meaningless (and
+// mildly alarming) if it counts the person reading it.
+export function getViewers(entity, id, excludeUserId) {
+  const key = keyFor(entity, id);
+  const viewers = presence.get(key);
+  if (!viewers) return [];
+  const now = Date.now();
+  return [...viewers.values()]
+    .filter(v => v.userId !== excludeUserId && now - v.lastSeenAt <= STALE_AFTER_MS)
+    .map(v => ({ userId: v.userId, userName: v.userName }));
+}
+
+export function resetPresence() {
+  presence.clear();
+}

package/src/lib/scheduler-engine.js

@@ -35,7 +35,18 @@ async function runOneJob(job, nowTs) {
     // scoping crud-handlers.js's read path enforces for an interactive
     // request, so a job cannot reach records outside its owner's org just
     // because it runs unattended.
-    const targets = await list(job.entity, filter, { user: owner });
+    let targets = await list(job.entity, filter, { user: owner });
+
+    // job.filter can only express stored-field equality (e.g. status:active);
+    // "expiring within notice_period_days" is a per-record computed
+    // comparison, not a filterable field, so it's checked here in JS against
+    // the SAME shared math the contract detail view uses -- never a second,
+    // divergent formula.
+    if (job.entity === 'contract' && action?.type === 'notify') {
+      const { isWithinNoticeWindow } = await import('./contract-expiry.js');
+      targets = targets.filter(c => isWithinNoticeWindow(c, nowTs));
+    }
+
     const ids = targets.map(r => r.id);
 
     let result = { ok: true, total: 0, succeeded: 0, failed: 0, results: [] };

package/src/server/server.js

@@ -119,6 +119,22 @@ export function createServer(options) {
         const id = parts[1] || null;
         const action = parts[2] || null;
 
+        // presence/changes are meta-routes over an (entity,id) pair, not
+        // themselves entities -- parts[1]/parts[2] here are the TARGET
+        // entity name and record id, distinct from the entity/id/action
+        // parsed above for the generic CRUD routes.
+        if (req.method === 'POST' && entity === 'presence' && parts[1] && parts[2] && parts[3] === 'heartbeat') {
+          return await handlePresenceHeartbeat(req, res, parts[1], parts[2]);
+        }
+
+        if (req.method === 'GET' && entity === 'presence' && parts[1] && parts[2] && !parts[3]) {
+          return await handlePresenceGet(req, res, parts[1], parts[2]);
+        }
+
+        if (req.method === 'GET' && entity === 'changes' && parts[1] && parts[2] && parts[3] === 'since' && parts[4]) {
+          return await handleChangesSince(req, res, parts[1], parts[2], parts[4]);
+        }
+
         if (req.method === 'GET' && entity === 'auth' && id === 'google' && !action) {
           return await handleOAuthGoogleStart(req, res);
         }
@@ -1427,6 +1443,67 @@ async function readMultipartFile(req) {
   throw new Error('No file field found in upload');
 }
 
+async function verifyRecordAccess(req, res, entityName, id) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return null;
+  }
+  const { get } = await import('../lib/busybase/store.js');
+  let record;
+  try {
+    record = await get(entityName, id, { user });
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Not found' }));
+    return null;
+  }
+  if (!record) {
+    // A record the caller cannot access and a record that doesn't exist
+    // resolve identically here on purpose -- distinguishing them would leak
+    // that a specific id exists to someone who isn't allowed to see it.
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Not found' }));
+    return null;
+  }
+  return user;
+}
+
+async function handlePresenceHeartbeat(req, res, entityName, id) {
+  const user = await verifyRecordAccess(req, res, entityName, id);
+  if (!user) return;
+  const { heartbeat } = await import('../lib/presence-tracker.js');
+  heartbeat(entityName, id, user.id, user.name || user.email || user.id);
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ ok: true }));
+}
+
+async function handlePresenceGet(req, res, entityName, id) {
+  const user = await verifyRecordAccess(req, res, entityName, id);
+  if (!user) return;
+  const { getViewers } = await import('../lib/presence-tracker.js');
+  const viewers = getViewers(entityName, id, user.id);
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ viewers }));
+}
+
+async function handleChangesSince(req, res, entityName, id, timestampStr) {
+  const user = await verifyRecordAccess(req, res, entityName, id);
+  if (!user) return;
+  const since = Number(timestampStr);
+  if (!Number.isFinite(since)) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid timestamp' }));
+    return;
+  }
+  const { getEntityAuditTrail } = await import('../lib/busybase/audit-reads.js');
+  const trail = await getEntityAuditTrail(entityName, id);
+  const changed = trail.some(entry => (entry.createdAt || 0) > since);
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ changed }));
+}
+
 async function handleFileUpload(req, res, thatcher, configEngineArg) {
   const user = await resolveRequestUser(req);
   if (!user) {

package/src/ui/entity-renderer.js

@@ -199,6 +199,13 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
       <div style="flex:1">${headerExtra}</div>
       <div style="display:flex;gap:0.5rem;margin-left:1rem">${editBtn}${cloneBtn}${delBtn}</div>
     </div>
+    <div id="stale-data-banner" style="display:none;margin-bottom:12px" class="card-clean">
+      <div class="card-clean-body" style="padding:10px 16px;display:flex;align-items:center;justify-content:space-between">
+        <span style="font-size:13px">This record was updated by someone else -- refresh to see changes.</span>
+        <button type="button" class="btn-ghost-clean" onclick="window.location.reload()">Refresh</button>
+      </div>
+    </div>
+    <div id="presence-indicator" style="display:none;margin-bottom:12px;font-size:13px;color:var(--color-text-muted)"></div>
     <div class="card-clean">
       <div class="card-clean-body"><div class="detail-grid">${fieldRows || '<p style="color:var(--color-text-muted);font-size:0.875rem;grid-column:1/-1">No details available</p>'}</div></div>
     </div>
@@ -207,8 +214,38 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
 
   // Canonical gmConfirm (session-13): showDeleteConfirm runs the styled confirm then DELETEs; no bespoke dialog markup/show-hide.
   const script = `${TOAST_SCRIPT}window.showDeleteConfirm=async()=>{const ok=await window.gmConfirm({title:'Delete ${entityName}',message:'Delete this ${entityName}? This cannot be undone.',confirmLabel:'Delete',danger:true});if(!ok)return;try{const res=await fetch('/api/${entityName}/${item.id}',{method:'DELETE'});if(res.ok){showToast('Deleted successfully','success');setTimeout(()=>{window.location='/${entityName}'},500)}else{const d=await res.json().catch(()=>({}));showToast(d.message||d.error||'Delete failed','error')}}catch(err){showToast('Error: '+err.message,'error')}}`
+  const collabScript = `(function(){
+    var entity='${entityName}',id='${esc(String(item.id))}';
+    var openedAt=Math.floor(Date.now()/1000);
+    function heartbeat(){fetch('/api/presence/'+entity+'/'+id+'/heartbeat',{method:'POST'}).catch(function(){})}
+    function pollPresence(){
+      fetch('/api/presence/'+entity+'/'+id).then(function(r){return r.json()}).then(function(d){
+        var el=document.getElementById('presence-indicator');
+        if(!el)return;
+        var viewers=d.viewers||[];
+        if(viewers.length){
+          el.style.display='block';
+          el.textContent=(viewers.length===1?'1 other person is':viewers.length+' other people are')+' currently viewing this: '+viewers.map(function(v){return v.userName}).join(', ');
+        } else {
+          el.style.display='none';
+        }
+      }).catch(function(){})
+    }
+    function pollChanges(){
+      fetch('/api/changes/'+entity+'/'+id+'/since/'+openedAt).then(function(r){return r.json()}).then(function(d){
+        if(d.changed){
+          var el=document.getElementById('stale-data-banner');
+          if(el)el.style.display='block';
+        }
+      }).catch(function(){})
+    }
+    heartbeat();pollPresence();pollChanges();
+    setInterval(heartbeat,10000);
+    setInterval(pollPresence,10000);
+    setInterval(pollChanges,8000);
+  })();`
   const bc = [{ href: '/', label: 'Dashboard' }, { href: `/${entityName}`, label: spec?.labelPlural || label }, { label: item.name || item.title || `#${item.id}` }]
-  return page(user, `${label} Detail`, bc, content, [script])
+  return page(user, `${label} Detail`, bc, content, [script, collabScript])
 }
 
 export function renderEntityForm(entityName, item, spec, user, isNew = false, refOptions = {}, templates = []) {

package/src/ui/page-handler.js

@@ -155,9 +155,8 @@ async function handleGenericEntityView(user, entityName, id, req) {
     // contract before this line is ever reached), never a separate query
     // that could leak the value to a caller who never proved they can view
     // this specific contract.
-    const nowSeconds = Math.floor(Date.now() / 1000);
-    const daysUntilExpiry = Math.floor((Number(resolvedItem.end_date) - nowSeconds) / 86400);
-    resolvedItem = { ...resolvedItem, days_until_expiry: daysUntilExpiry };
+    const { daysUntilExpiry } = await import('@/lib/contract-expiry.js');
+    resolvedItem = { ...resolvedItem, days_until_expiry: daysUntilExpiry(resolvedItem.end_date) };
   }
   // get(...,{user}) above already enforced row/org access for this exact
   // record (a denied/absent record returns null before this point), so