pf_app
Paul Trowbridge
b4f579c4b1
An account sees and changes only its own territory: the values live on pf.app_user, the column they name is flagged per source in col_meta, and the predicate is built from the session and ANDed on last where no request can remove it. Fail closed -- an account nobody configured sees nothing. Enforced on both reads, on every operation, and on the value completion endpoint, which reads the source table and would otherwise enumerate the whole business to someone shown none of their rows. Undo and annotation are gated by author, since label and bucket name the pivot's columns for everyone; recode refuses to move a row between territories unless you are an admin. Each entry now records what it ran against and the statement it ran, beside the intent it already recorded -- the three things that cannot be reconstructed afterwards, and the SQL that the intent actually became. |
||
|---|---|---|
| lib | ||
| public | ||
| routes | ||
| setup_sql | ||
| ui | ||
| .env.example | ||
| .gitignore | ||
| CLAUDE.md | ||
| install.sh | ||
| package-lock.json | ||
| package.json | ||
| PERSPECTIVE.md | ||
| pf_perspective_options.md | ||
| pf_spec.md | ||
| pf.sh | ||
| server.js | ||