thatcher 1.0.77 → 1.0.79

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.77",
+  "version": "1.0.79",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/busybase/store.js

@@ -196,7 +196,9 @@ export async function list(entity, where = {}, options = {}) {
     const lim = options.limit ? parseInt(options.limit, 10) : rows.length;
     rows = rows.slice(off, off + lim);
   }
-  return attachRefDisplays(entity, rows);
+  const { decryptFields } = await import('../field-encryption.js');
+  const decryptedRows = rows.map(r => decryptFields(r, spec.fields));
+  return attachRefDisplays(entity, decryptedRows);
 }
 
 export async function count(entity, where = {}, options = {}) {
@@ -227,7 +229,9 @@ export async function get(entity, id, options = {}) {
     const { permissionService } = await import('../services/permission.service.js');
     if (!permissionService.checkRowAccess(options.user, spec, row)) return null;
   }
-  const [withDisplay] = await attachRefDisplays(entity, [row]);
+  const { decryptFields } = await import('../field-encryption.js');
+  const decrypted = decryptFields(row, spec.fields);
+  const [withDisplay] = await attachRefDisplays(entity, [decrypted]);
   return withDisplay;
 }
 
@@ -255,15 +259,23 @@ export async function create(entity, data, user) {
     if (field.auto === 'uuid' && !record[key]) record[key] = genId();
     if (field.auto === 'timestamp' && !record[key]) record[key] = now();
   }
+  // Encrypt any field marked encrypted:true BEFORE the null/undefined
+  // sentinel coercion below, so a real value never reaches the insert as
+  // plaintext -- this is the single choke point every create() call passes
+  // through, so no caller needs to know the field is encrypted at all.
+  const { encryptFields } = await import('../field-encryption.js');
+  const encryptedRecord = encryptFields(record, spec.fields);
   // LanceDB cannot infer a column's type from a null on first insert; coerce any
   // null/undefined to a typed sentinel ('' for strings) so the insert schema is stable.
-  for (const k of Object.keys(record)) {
-    if (record[k] === null || record[k] === undefined) record[k] = '';
+  for (const k of Object.keys(encryptedRecord)) {
+    if (encryptedRecord[k] === null || encryptedRecord[k] === undefined) encryptedRecord[k] = '';
   }
-  unwrap(await client().from(tbl).insert(record), 'create');
+  unwrap(await client().from(tbl).insert(encryptedRecord), 'create');
   // Always return the locally-constructed record: it holds the genId we put in
   // the TEXT id column. The store's insert() may return a rowid/driver shape, so
-  // trusting `created` would hand callers the wrong id.
+  // trusting `created` would hand callers the wrong id. Return the UNENCRYPTED
+  // record -- the caller gets back plaintext, matching what get()/list() will
+  // also return after decrypting the stored ciphertext.
   return record;
 }
 
@@ -284,14 +296,19 @@ export async function create(entity, data, user) {
 // unconditional-write behaviour, unchanged for every existing caller; _version
 // is added as a new column, ignored by every reader that doesn't ask for it.
 export async function update(entity, id, data, opts = {}) {
-  specOf(entity);
+  const spec = specOf(entity);
   const tbl = tableName(entity);
 
   const existing = await get(entity, id);
   if (!existing) throw new Error(`${entity} with id ${id} not found`);
 
   const currentVersion = Number(existing._version) || 0;
-  const patch = { ...data, updated_at: now(), _version: currentVersion + 1 };
+  const { encryptFields } = await import('../field-encryption.js');
+  // Encrypt only the fields actually present in this partial update -- a
+  // caller updating an unrelated field must not force-decrypt/re-encrypt an
+  // encrypted field it never touched (encryptFields already skips fields
+  // absent from the object, so this is naturally a no-op for those).
+  const patch = encryptFields({ ...data, updated_at: now(), _version: currentVersion + 1 }, spec.fields);
   let builder = client().from(tbl).update(patch).eq('id', id);
   if (opts.expectedVersion != null) {
     builder = builder.eq('_version', opts.expectedVersion);

package/src/lib/config-generator-engine.js

@@ -253,6 +253,27 @@ function withTimeTrackingDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const RESOURCE_ALLOCATION_ENTITY_DEFAULT = {
+  label: 'Resource Allocation',
+  label_plural: 'Resource Allocations',
+  system_entity: true,
+  fields: {
+    user_id: { type: 'ref', ref: 'user', required: true, label: 'User' },
+    project_id: { type: 'ref', ref: 'project', required: true, label: 'Project' },
+    allocated_hours_per_week: { type: 'number', required: true, min: 0, max: 168, label: 'Allocated Hours/Week' },
+    start_date: { type: 'date', required: true, label: 'Start Date' },
+    end_date: { type: 'date', required: true, label: 'End Date' },
+    role: { type: 'text', label: 'Role' },
+  },
+};
+
+function withResourceManagementDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.resource_allocation) { entities.resource_allocation = RESOURCE_ALLOCATION_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
 const CONTRACT_LIFECYCLE_WORKFLOW = {
   state_field: 'status',
   stages: [
@@ -295,7 +316,7 @@ function withContractDefaults(masterConfig) {
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withContractDefaults(withTimeTrackingDefaults(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))))));
+    this.masterConfig = deepFreeze(withResourceManagementDefaults(withContractDefaults(withTimeTrackingDefaults(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)))))))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();

package/src/lib/field-encryption.js

@@ -0,0 +1,85 @@
+import crypto from 'crypto';
+
+// AES-256-GCM: authenticated encryption, so a tampered ciphertext fails
+// decryption loudly instead of silently returning corrupted plaintext. A
+// fresh random IV per value (never reused) is required for GCM's security
+// guarantee -- reusing an IV with the same key breaks confidentiality.
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const ENCRYPTED_PREFIX = 'enc:v1:';
+
+let _key = null;
+function getKey() {
+  if (_key) return _key;
+  const raw = process.env.FIELD_ENCRYPTION_KEY;
+  if (!raw) {
+    // Fail loud, never silently store plaintext under an encrypted:true field
+    // just because the operator forgot to configure a key.
+    throw new Error('FIELD_ENCRYPTION_KEY environment variable is not set; cannot encrypt/decrypt a field marked encrypted:true');
+  }
+  // Accept either a 64-char hex string or any string, hashed to a stable
+  // 32-byte key -- never echoed, never logged, this function's return value
+  // is the only place the raw key material appears in memory.
+  const key = /^[0-9a-fA-F]{64}$/.test(raw) ? Buffer.from(raw, 'hex') : crypto.createHash('sha256').update(raw).digest();
+  _key = key;
+  return _key;
+}
+
+export function encryptValue(plaintext) {
+  const key = getKey();
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const serialized = typeof plaintext === 'string' ? plaintext : JSON.stringify(plaintext);
+  const ciphertext = Buffer.concat([cipher.update(serialized, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return ENCRYPTED_PREFIX + Buffer.concat([iv, authTag, ciphertext]).toString('base64');
+}
+
+export function isEncrypted(value) {
+  return typeof value === 'string' && value.startsWith(ENCRYPTED_PREFIX);
+}
+
+export function decryptValue(stored) {
+  if (!isEncrypted(stored)) return stored;
+  const key = getKey();
+  const raw = Buffer.from(stored.slice(ENCRYPTED_PREFIX.length), 'base64');
+  const iv = raw.subarray(0, IV_LENGTH);
+  const authTag = raw.subarray(IV_LENGTH, IV_LENGTH + 16);
+  const ciphertext = raw.subarray(IV_LENGTH + 16);
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+  // setAuthTag + final() throws on any tampering (wrong key, flipped bytes,
+  // truncated ciphertext) -- this is the loud-failure guarantee; there is no
+  // catch here, a decrypt failure must propagate to the caller as an error.
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  try {
+    return JSON.parse(decrypted);
+  } catch {
+    return decrypted;
+  }
+}
+
+// Field-def-driven encrypt of every field marked encrypted:true. Fields not
+// present in `record` or not marked are passed through unchanged.
+export function encryptFields(record, specFields) {
+  if (!specFields) return record;
+  const result = { ...record };
+  for (const [key, fieldDef] of Object.entries(specFields)) {
+    if (!fieldDef.encrypted) continue;
+    if (result[key] === undefined || result[key] === null || result[key] === '') continue;
+    if (isEncrypted(result[key])) continue; // already encrypted, don't double-wrap
+    result[key] = encryptValue(result[key]);
+  }
+  return result;
+}
+
+export function decryptFields(record, specFields) {
+  if (!record || !specFields) return record;
+  const result = { ...record };
+  for (const [key, fieldDef] of Object.entries(specFields)) {
+    if (!fieldDef.encrypted) continue;
+    if (result[key] === undefined || result[key] === null) continue;
+    result[key] = decryptValue(result[key]);
+  }
+  return result;
+}

package/src/lib/validation/entity-validators.js

@@ -157,17 +157,30 @@ function resolveEnumOptions(fieldDef, entityName) {
 // UI-side, but server-side is the authoritative check per this session's SEC
 // pattern. Privileged roles (partner/manager) may log time for anyone, e.g.
 // entering a team member's hours on their behalf.
-function checkTimeEntryOwnership(entityName, data, options) {
-  if (entityName !== 'time_entry') return null;
+// Shared self-only check: a non-privileged actingUser may only write a
+// record whose user_id matches their own id; partner/admin/manager may write
+// for anyone. One function so every self-only entity enforces identically
+// rather than each growing its own slightly-different copy over time.
+function checkSelfOnlyOwnership(data, options, actionDescription) {
   const actingUser = options?.actingUser;
   if (!actingUser) return null;
   if (['partner', 'admin', 'manager'].includes(actingUser.role)) return null;
   if (data.user_id !== undefined && data.user_id !== actingUser.id) {
-    return `Cannot log time for another user`;
+    return `Cannot ${actionDescription} for another user`;
   }
   return null;
 }
 
+function checkTimeEntryOwnership(entityName, data, options) {
+  if (entityName !== 'time_entry') return null;
+  return checkSelfOnlyOwnership(data, options, 'log time');
+}
+
+function checkResourceAllocationOwnership(entityName, data, options) {
+  if (entityName !== 'resource_allocation') return null;
+  return checkSelfOnlyOwnership(data, options, 'create a resource allocation');
+}
+
 // Stock movements are immutable history (checked at creation only, never on
 // edit -- there is no update path for them). An outbound movement (negative
 // quantity) that would drive the running balance below zero is invalid: the
@@ -205,6 +218,40 @@ function checkContractDateOrder(entityName, data, existingRecord) {
   return null;
 }
 
+const WEEKLY_CAPACITY_HOURS = 40;
+
+// Two date ranges overlap unless one entirely precedes the other -- the
+// standard interval-intersection test, not a same-day/exact-match check.
+function rangesOverlap(startA, endA, startB, endB) {
+  return Number(startA) <= Number(endB) && Number(startB) <= Number(endA);
+}
+
+// A user's total weekly allocation across every project they're assigned to,
+// for any date range that overlaps the new/changed allocation, must not
+// exceed a configurable weekly capacity. Checked against EVERY OTHER
+// existing allocation for that user (excluding the record being updated, if
+// any) plus the new one -- never trusting a client-supplied total.
+async function checkResourceCapacity(entityName, data, existingRecord) {
+  if (entityName !== 'resource_allocation') return null;
+  const userId = data.user_id !== undefined ? data.user_id : existingRecord?.user_id;
+  const startDate = data.start_date !== undefined ? data.start_date : existingRecord?.start_date;
+  const endDate = data.end_date !== undefined ? data.end_date : existingRecord?.end_date;
+  const hours = Number(data.allocated_hours_per_week !== undefined ? data.allocated_hours_per_week : existingRecord?.allocated_hours_per_week);
+  if (!userId || startDate == null || endDate == null || !Number.isFinite(hours)) return null;
+
+  const { list } = await import('@/lib/busybase/store');
+  const existingAllocations = await list('resource_allocation', { user_id: userId });
+  const overlapping = existingAllocations.filter(a =>
+    a.id !== existingRecord?.id && rangesOverlap(startDate, endDate, a.start_date, a.end_date)
+  );
+  const overlappingTotal = overlapping.reduce((sum, a) => sum + (Number(a.allocated_hours_per_week) || 0), 0);
+  const resultingTotal = overlappingTotal + hours;
+  if (resultingTotal > WEEKLY_CAPACITY_HOURS) {
+    return `Over-allocated: this would bring the user's weekly total to ${resultingTotal}h against overlapping allocations, exceeding the ${WEEKLY_CAPACITY_HOURS}h capacity`;
+  }
+  return null;
+}
+
 export async function validateEntity(entityName, data, existingRecord = null, options = {}) {
   const spec = getSpec(entityName);
   const errors = {};
@@ -232,12 +279,15 @@ export async function validateEntity(entityName, data, existingRecord = null, op
   const stockErr = await checkStockBalance(entityName, data);
   if (stockErr) errors.quantity = stockErr;
 
-  const ownershipErr = checkTimeEntryOwnership(entityName, data, options);
+  const ownershipErr = checkTimeEntryOwnership(entityName, data, options) || checkResourceAllocationOwnership(entityName, data, options);
   if (ownershipErr) errors.user_id = ownershipErr;
 
   const dateOrderErr = checkContractDateOrder(entityName, data, existingRecord);
   if (dateOrderErr) errors.end_date = dateOrderErr;
 
+  const capacityErr = await checkResourceCapacity(entityName, data, existingRecord);
+  if (capacityErr) errors.allocated_hours_per_week = capacityErr;
+
   return errors;
 }
 
@@ -316,6 +366,9 @@ export async function validateUpdate(entityName, changes, existingRecord) {
   const dateOrderErr = checkContractDateOrder(entityName, changes, existingRecord);
   if (dateOrderErr) errors.end_date = dateOrderErr;
 
+  const capacityErr = await checkResourceCapacity(entityName, changes, existingRecord);
+  if (capacityErr) errors.allocated_hours_per_week = capacityErr;
+
   return errors;
 }
 

package/src/ui/entity-renderer.js

@@ -160,9 +160,23 @@ export function renderEntityDetail(entityName, item, spec, user, history = []) {
       })()
     : ''
 
+  // allocated_hours_per_week/weekly_capacity_hours are computed (page-handler.js
+  // sums resource_allocation rows for this user), same not-a-spec-field
+  // treatment as current_stock/total_hours above.
+  const utilizationRow = entityName === 'user' && typeof item.allocated_hours_per_week === 'number'
+    ? (() => {
+        const over = item.allocated_hours_per_week > item.weekly_capacity_hours
+        const pillCls = over ? 'pill-danger' : 'pill-success'
+        return `<div class="detail-row">
+          <span class="detail-row-label">Resource Utilization</span>
+          <span class="detail-row-value"><span class="pill ${pillCls}">${esc(String(item.allocated_hours_per_week))}h / ${esc(String(item.weekly_capacity_hours))}h${over ? ' (Over-allocated)' : ''}</span></span>
+        </div>`
+      })()
+    : ''
+
   const visibleFields = Object.entries(fields).filter(([k]) => k !== 'id' && !HIDDEN_FIELDS.has(k) && item[k] !== undefined)
 
-  const fieldRows = stockRow + timeTrackingRows + expiryRow + visibleFields.map(([k, f]) =>
+  const fieldRows = stockRow + timeTrackingRows + expiryRow + utilizationRow + visibleFields.map(([k, f]) =>
     `<div class="detail-row">
       <span class="detail-row-label">${esc(f.label || k)}</span>
       <span class="detail-row-value">${formatFieldValue(k, item[k], entityName, f)}</span>

package/src/ui/page-handler.js

@@ -158,6 +158,19 @@ async function handleGenericEntityView(user, entityName, id, req) {
     const { daysUntilExpiry } = await import('@/lib/contract-expiry.js');
     resolvedItem = { ...resolvedItem, days_until_expiry: daysUntilExpiry(resolvedItem.end_date) };
   }
+  if (entityName === 'user') {
+    // Resource utilization reuses the same "sum grouped by owner" rollup
+    // shape as task/project total_hours above, just grouped by allocation
+    // rather than time entry -- no new aggregation logic, only overlapping
+    // (currently-active) allocations count toward the displayed total.
+    try {
+      const allocations = await list('resource_allocation', { user_id: id });
+      const nowTs = Math.floor(Date.now() / 1000);
+      const activeAllocations = allocations.filter(a => Number(a.start_date) <= nowTs && nowTs <= Number(a.end_date));
+      const allocatedHoursPerWeek = activeAllocations.reduce((sum, a) => sum + (Number(a.allocated_hours_per_week) || 0), 0);
+      resolvedItem = { ...resolvedItem, allocated_hours_per_week: allocatedHoursPerWeek, weekly_capacity_hours: 40 };
+    } catch { resolvedItem = { ...resolvedItem, allocated_hours_per_week: 0, weekly_capacity_hours: 40 }; }
+  }
   // get(...,{user}) above already enforced row/org access for this exact
   // record (a denied/absent record returns null before this point), so
   // fetching its audit trail here is scoped by construction -- there is no