WIP - manage tenant users from central

backend/migrations/tenant/20250126000003_create_custom_migrations.js

@@ -1,29 +0,0 @@
-exports.up = function (knex) {
-  return knex.schema.createTable('custom_migrations', (table) => {
-    table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
-    table.uuid('tenantId').notNullable();
-    table.string('name', 255).notNullable();
-    table.text('description');
-    table.enum('type', [
-      'create_table',
-      'add_column',
-      'alter_column',
-      'add_index',
-      'drop_table',
-      'custom',
-    ]).notNullable();
-    table.text('sql').notNullable();
-    table.enum('status', ['pending', 'executed', 'failed']).defaultTo('pending');
-    table.timestamp('executedAt').nullable();
-    table.text('error').nullable();
-    table.timestamps(true, true);
-
-    table.index(['tenantId']);
-    table.index(['status']);
-    table.index(['created_at']);
-  });
-};
-
-exports.down = function (knex) {
-  return knex.schema.dropTableIfExists('custom_migrations');
-};

backend/migrations/tenant/20250129000001_add_authorization_system.js

@@ -1,103 +0,0 @@
-exports.up = function (knex) {
-  return knex.schema
-    // Add orgWideDefault to object_definitions
-    .alterTable('object_definitions', (table) => {
-      table
-        .enum('orgWideDefault', ['private', 'public_read', 'public_read_write'])
-        .defaultTo('private')
-        .notNullable();
-    })
-    // Create role_object_permissions table
-    .createTable('role_object_permissions', (table) => {
-      table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
-      table.uuid('roleId').notNullable();
-      table.uuid('objectDefinitionId').notNullable();
-      table.boolean('canCreate').defaultTo(false);
-      table.boolean('canRead').defaultTo(false);
-      table.boolean('canEdit').defaultTo(false);
-      table.boolean('canDelete').defaultTo(false);
-      table.boolean('canViewAll').defaultTo(false);
-      table.boolean('canModifyAll').defaultTo(false);
-      table.timestamps(true, true);
-
-      table
-        .foreign('roleId')
-        .references('id')
-        .inTable('roles')
-        .onDelete('CASCADE');
-      table
-        .foreign('objectDefinitionId')
-        .references('id')
-        .inTable('object_definitions')
-        .onDelete('CASCADE');
-      table.unique(['roleId', 'objectDefinitionId']);
-      table.index(['roleId']);
-      table.index(['objectDefinitionId']);
-    })
-    // Create role_field_permissions table
-    .createTable('role_field_permissions', (table) => {
-      table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
-      table.uuid('roleId').notNullable();
-      table.uuid('fieldDefinitionId').notNullable();
-      table.boolean('canRead').defaultTo(true);
-      table.boolean('canEdit').defaultTo(true);
-      table.timestamps(true, true);
-
-      table
-        .foreign('roleId')
-        .references('id')
-        .inTable('roles')
-        .onDelete('CASCADE');
-      table
-        .foreign('fieldDefinitionId')
-        .references('id')
-        .inTable('field_definitions')
-        .onDelete('CASCADE');
-      table.unique(['roleId', 'fieldDefinitionId']);
-      table.index(['roleId']);
-      table.index(['fieldDefinitionId']);
-    })
-    // Create record_shares table for sharing specific records
-    .createTable('record_shares', (table) => {
-      table.uuid('id').primary().defaultTo(knex.raw('(UUID())'));
-      table.uuid('objectDefinitionId').notNullable();
-      table.uuid('recordId').notNullable();
-      table.uuid('granteeUserId').notNullable();
-      table.uuid('grantedByUserId').notNullable();
-      table.json('accessLevel').notNullable(); // { canRead, canEdit, canDelete }
-      table.timestamp('expiresAt').nullable();
-      table.timestamp('revokedAt').nullable();
-      table.timestamp('createdAt').defaultTo(knex.fn.now());
-      table.timestamp('updatedAt').defaultTo(knex.fn.now());
-
-      table
-        .foreign('objectDefinitionId')
-        .references('id')
-        .inTable('object_definitions')
-        .onDelete('CASCADE');
-      table
-        .foreign('granteeUserId')
-        .references('id')
-        .inTable('users')
-        .onDelete('CASCADE');
-      table
-        .foreign('grantedByUserId')
-        .references('id')
-        .inTable('users')
-        .onDelete('CASCADE');
-      table.index(['objectDefinitionId', 'recordId']);
-      table.index(['granteeUserId']);
-      table.index(['expiresAt']);
-      table.index(['revokedAt']);
-    });
-};
-
-exports.down = function (knex) {
-  return knex.schema
-    .dropTableIfExists('record_shares')
-    .dropTableIfExists('role_field_permissions')
-    .dropTableIfExists('role_object_permissions')
-    .alterTable('object_definitions', (table) => {
-      table.dropColumn('orgWideDefault');
-    });
-};

backend/migrations/tenant/20250130000001_add_updated_at_to_record_shares.js

@@ -1,13 +0,0 @@
-exports.up = function (knex) {
-  return knex.schema
-    .table('record_shares', (table) => {
-      table.timestamp('updatedAt').defaultTo(knex.fn.now());
-    });
-};
-
-exports.down = function (knex) {
-  return knex.schema
-    .table('record_shares', (table) => {
-      table.dropColumn('updatedAt');
-    });
-};

backend/package-lock.json

@@ -9,7 +9,6 @@
       "version": "0.0.1",
       "license": "MIT",
       "dependencies": {
-        "@casl/ability": "^6.7.5",
         "@nestjs/bullmq": "^10.1.0",
         "@nestjs/common": "^10.3.0",
         "@nestjs/config": "^3.1.1",
@@ -742,18 +741,6 @@
         "url": "https://github.com/sponsors/Borewit"
       }
     },
-    "node_modules/@casl/ability": {
-      "version": "6.7.5",
-      "resolved": "https://registry.npmjs.org/@casl/ability/-/ability-6.7.5.tgz",
-      "integrity": "sha512-NaOHPi9JMn8Kesh+GRkjNKAYkl4q8qMFAlqw7w2yrE+cBQZSbV9GkBGKvgzs3CdzEc5Yl1cn3JwDxxbBN5gjog==",
-      "license": "MIT",
-      "dependencies": {
-        "@ucast/mongo2js": "^1.3.0"
-      },
-      "funding": {
-        "url": "https://github.com/stalniy/casl/blob/master/BACKERS.md"
-      }
-    },
     "node_modules/@colors/colors": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz",
@@ -2895,41 +2882,6 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
-    "node_modules/@ucast/core": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/@ucast/core/-/core-1.10.2.tgz",
-      "integrity": "sha512-ons5CwXZ/51wrUPfoduC+cO7AS1/wRb0ybpQJ9RrssossDxVy4t49QxWoWgfBDvVKsz9VXzBk9z0wqTdZ+Cq8g==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/@ucast/js": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@ucast/js/-/js-3.0.4.tgz",
-      "integrity": "sha512-TgG1aIaCMdcaEyckOZKQozn1hazE0w90SVdlpIJ/er8xVumE11gYAtSbw/LBeUnA4fFnFWTcw3t6reqseeH/4Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@ucast/core": "^1.0.0"
-      }
-    },
-    "node_modules/@ucast/mongo": {
-      "version": "2.4.3",
-      "resolved": "https://registry.npmjs.org/@ucast/mongo/-/mongo-2.4.3.tgz",
-      "integrity": "sha512-XcI8LclrHWP83H+7H2anGCEeDq0n+12FU2mXCTz6/Tva9/9ddK/iacvvhCyW6cijAAOILmt0tWplRyRhVyZLsA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@ucast/core": "^1.4.1"
-      }
-    },
-    "node_modules/@ucast/mongo2js": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@ucast/mongo2js/-/mongo2js-1.4.0.tgz",
-      "integrity": "sha512-vR9RJ3BHlkI3RfKJIZFdVktxWvBCQRiSTeJSWN9NPxP5YJkpfXvcBWAMLwvyJx4HbB+qib5/AlSDEmQiuQyx2w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@ucast/core": "^1.6.1",
-        "@ucast/js": "^3.0.0",
-        "@ucast/mongo": "^2.4.0"
-      }
-    },
     "node_modules/@ungap/structured-clone": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",

backend/package.json

@@ -26,7 +26,6 @@
     "migrate:all-tenants": "ts-node -r tsconfig-paths/register scripts/migrate-all-tenants.ts"
   },
   "dependencies": {
-    "@casl/ability": "^6.7.5",
     "@nestjs/bullmq": "^10.1.0",
     "@nestjs/common": "^10.3.0",
     "@nestjs/config": "^3.1.1",

backend/prisma/schema.prisma

@@ -125,7 +125,6 @@ model FieldDefinition {
   isSystem             Boolean  @default(false)
   isCustom             Boolean  @default(true)
   displayOrder         Int      @default(0)
-  uiMetadata           Json?    @map("ui_metadata")
   createdAt            DateTime @default(now()) @map("created_at")
   updatedAt            DateTime @updatedAt @map("updated_at")
 

backend/scripts/migrate-all-tenants.ts

@@ -43,9 +43,8 @@ function decryptPassword(encryptedPassword: string): string {
 function createTenantKnexConnection(tenant: any): Knex {
   const decryptedPassword = decryptPassword(tenant.dbPassword);
 
-  // Use Docker hostname 'db' when running inside container
-  // The dbHost will be 'db' for Docker connections or 'localhost' for local development
-  const dbHost = tenant.dbHost;
+  // Replace 'db' hostname with 'localhost' when running outside Docker
+  const dbHost = tenant.dbHost === 'db' ? 'localhost' : tenant.dbHost;
 
   return knex({
     client: 'mysql2',
@@ -83,7 +82,7 @@ async function migrateTenant(tenant: any): Promise<void> {
       });
     }
   } catch (error) {
-    console.error(`❌ ${tenant.name}: Migration failed:`, error);
+    console.error(`❌ ${tenant.name}: Migration failed:`, error.message);
     throw error;
   } finally {
     await tenantKnex.destroy();

backend/scripts/seed-default-roles.ts

@@ -1,181 +0,0 @@
-import { Knex } from 'knex';
-import * as knexLib from 'knex';
-
-/**
- * Create a Knex connection for tenant database
- */
-function createKnexConnection(database: string): Knex {
-  return knexLib.default({
-    client: 'mysql2',
-    connection: {
-      host: process.env.DB_HOST || 'db',
-      port: parseInt(process.env.DB_PORT || '3306'),
-      user: 'root',
-      password: 'asjdnfqTash37faggT',
-      database: database,
-    },
-  });
-}
-
-interface RoleWithPermissions {
-  name: string;
-  description: string;
-  objectPermissions: {
-    [objectApiName: string]: {
-      canCreate: boolean;
-      canRead: boolean;
-      canEdit: boolean;
-      canDelete: boolean;
-      canViewAll: boolean;
-      canModifyAll: boolean;
-    };
-  };
-}
-
-const DEFAULT_ROLES: RoleWithPermissions[] = [
-  {
-    name: 'System Administrator',
-    description: 'Full access to all objects and records. Can view and modify all data.',
-    objectPermissions: {
-      '*': {
-        canCreate: true,
-        canRead: true,
-        canEdit: true,
-        canDelete: true,
-        canViewAll: true,
-        canModifyAll: true,
-      },
-    },
-  },
-  {
-    name: 'Standard User',
-    description: 'Can create, read, edit, and delete own records. Respects OWD settings.',
-    objectPermissions: {
-      '*': {
-        canCreate: true,
-        canRead: true,
-        canEdit: true,
-        canDelete: true,
-        canViewAll: false,
-        canModifyAll: false,
-      },
-    },
-  },
-  {
-    name: 'Read Only',
-    description: 'Can only read records based on OWD settings. No create, edit, or delete.',
-    objectPermissions: {
-      '*': {
-        canCreate: false,
-        canRead: true,
-        canEdit: false,
-        canDelete: false,
-        canViewAll: false,
-        canModifyAll: false,
-      },
-    },
-  },
-];
-
-async function seedRolesForTenant(knex: Knex, tenantName: string) {
-  console.log(`\n🌱 Seeding roles for tenant: ${tenantName}`);
-
-  // Get all object definitions
-  const objectDefinitions = await knex('object_definitions').select('id', 'apiName');
-
-  for (const roleData of DEFAULT_ROLES) {
-    // Check if role already exists
-    const existingRole = await knex('roles')
-      .where({ name: roleData.name })
-      .first();
-
-    let roleId: string;
-
-    if (existingRole) {
-      console.log(`   ℹ️  Role "${roleData.name}" already exists, skipping...`);
-      roleId = existingRole.id;
-    } else {
-      // Create role
-      await knex('roles').insert({
-        name: roleData.name,
-        guardName: 'api',
-        description: roleData.description,
-      });
-
-      // Get the inserted role
-      const newRole = await knex('roles')
-        .where({ name: roleData.name })
-        .first();
-
-      roleId = newRole.id;
-      console.log(`   ✅ Created role: ${roleData.name}`);
-    }
-
-    // Create object permissions for all objects
-    const wildcardPermissions = roleData.objectPermissions['*'];
-    
-    for (const objectDef of objectDefinitions) {
-      // Check if permission already exists
-      const existingPermission = await knex('role_object_permissions')
-        .where({
-          roleId: roleId,
-          objectDefinitionId: objectDef.id,
-        })
-        .first();
-
-      if (!existingPermission) {
-        await knex('role_object_permissions').insert({
-          roleId: roleId,
-          objectDefinitionId: objectDef.id,
-          canCreate: wildcardPermissions.canCreate,
-          canRead: wildcardPermissions.canRead,
-          canEdit: wildcardPermissions.canEdit,
-          canDelete: wildcardPermissions.canDelete,
-          canViewAll: wildcardPermissions.canViewAll,
-          canModifyAll: wildcardPermissions.canModifyAll,
-        });
-      }
-    }
-
-    console.log(`   📋 Set permissions for ${objectDefinitions.length} objects`);
-  }
-}
-
-async function seedAllTenants() {
-  console.log('🚀 Starting role seeding for all tenants...\n');
-
-  // For now, seed the main tenant database
-  const databases = ['tenant_tenant1'];
-
-  let successCount = 0;
-  let errorCount = 0;
-
-  for (const database of databases) {
-    try {
-      const knex = createKnexConnection(database);
-      await seedRolesForTenant(knex, database);
-      await knex.destroy();
-      successCount++;
-    } catch (error) {
-      console.error(`❌ ${database}: Seeding failed:`, error.message);
-      errorCount++;
-    }
-  }
-
-  console.log('\n============================================================');
-  console.log('📊 Seeding Summary');
-  console.log('============================================================');
-  console.log(`✅ Successful: ${successCount}`);
-  console.log(`❌ Failed: ${errorCount}`);
-
-  if (errorCount === 0) {
-    console.log('\n🎉 All tenant roles seeded successfully!');
-  }
-}
-
-seedAllTenants()
-  .then(() => process.exit(0))
-  .catch((error) => {
-    console.error('Unhandled error:', error);
-    process.exit(1);
-  });

backend/src/migration/custom-migration.service.ts

@@ -1,306 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { Knex } from 'knex';
-
-export interface CustomMigrationRecord {
-  id: string;
-  tenantId: string;
-  name: string;
-  description: string;
-  type: 'create_table' | 'add_column' | 'alter_column' | 'add_index' | 'drop_table' | 'custom';
-  sql: string;
-  status: 'pending' | 'executed' | 'failed';
-  executedAt?: Date;
-  error?: string;
-  createdAt: Date;
-  updatedAt: Date;
-}
-
-@Injectable()
-export class CustomMigrationService {
-  private readonly logger = new Logger(CustomMigrationService.name);
-
-  /**
-   * Generate SQL to create a table with standard fields
-   */
-  generateCreateTableSQL(
-    tableName: string,
-    fields: {
-      apiName: string;
-      type: string;
-      isRequired?: boolean;
-      isUnique?: boolean;
-      defaultValue?: string;
-    }[] = [],
-  ): string {
-    // Start with standard fields
-    const columns: string[] = [
-      '`id` VARCHAR(36) PRIMARY KEY',
-      '`ownerId` VARCHAR(36)',
-      '`name` VARCHAR(255)',
-      '`created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP',
-      '`updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP',
-    ];
-
-    // Add custom fields
-    for (const field of fields) {
-      const column = this.fieldToColumn(field);
-      columns.push(column);
-    }
-
-    // Add foreign key and index for ownerId
-    columns.push('INDEX `idx_owner` (`ownerId`)');
-
-    return `CREATE TABLE IF NOT EXISTS \`${tableName}\` (
-  ${columns.join(',\n  ')}
-)`;
-  }
-
-  /**
-   * Convert field definition to SQL column definition
-   */
-  private fieldToColumn(field: {
-    apiName: string;
-    type: string;
-    isRequired?: boolean;
-    isUnique?: boolean;
-    defaultValue?: string;
-  }): string {
-    const columnName = field.apiName;
-    let columnDef = `\`${columnName}\``;
-
-    // Map field types to SQL types
-    switch (field.type.toUpperCase()) {
-      case 'TEXT':
-      case 'STRING':
-        columnDef += ' VARCHAR(255)';
-        break;
-      case 'LONG_TEXT':
-        columnDef += ' LONGTEXT';
-        break;
-      case 'NUMBER':
-      case 'DECIMAL':
-        columnDef += ' DECIMAL(18, 2)';
-        break;
-      case 'INTEGER':
-        columnDef += ' INT';
-        break;
-      case 'BOOLEAN':
-        columnDef += ' BOOLEAN DEFAULT FALSE';
-        break;
-      case 'DATE':
-        columnDef += ' DATE';
-        break;
-      case 'DATE_TIME':
-        columnDef += ' DATETIME';
-        break;
-      case 'EMAIL':
-        columnDef += ' VARCHAR(255)';
-        break;
-      case 'URL':
-        columnDef += ' VARCHAR(2048)';
-        break;
-      case 'PHONE':
-        columnDef += ' VARCHAR(20)';
-        break;
-      case 'CURRENCY':
-        columnDef += ' DECIMAL(18, 2)';
-        break;
-      case 'PERCENT':
-        columnDef += ' DECIMAL(5, 2)';
-        break;
-      case 'PICKLIST':
-      case 'MULTI_PICKLIST':
-        columnDef += ' VARCHAR(255)';
-        break;
-      case 'LOOKUP':
-      case 'BELONGS_TO':
-        columnDef += ' VARCHAR(36)';
-        break;
-      default:
-        columnDef += ' VARCHAR(255)';
-    }
-
-    // Add constraints
-    if (field.isRequired) {
-      columnDef += ' NOT NULL';
-    } else {
-      columnDef += ' NULL';
-    }
-
-    if (field.isUnique) {
-      columnDef += ' UNIQUE';
-    }
-
-    if (field.defaultValue !== undefined && field.defaultValue !== null) {
-      columnDef += ` DEFAULT '${field.defaultValue}'`;
-    }
-
-    return columnDef;
-  }
-
-  /**
-   * Create a custom migration record in the database
-   */
-  async createMigrationRecord(
-    tenantKnex: Knex,
-    data: {
-      tenantId: string;
-      name: string;
-      description: string;
-      type: 'create_table' | 'add_column' | 'alter_column' | 'add_index' | 'drop_table' | 'custom';
-      sql: string;
-    },
-  ): Promise<CustomMigrationRecord> {
-    // Ensure custom_migrations table exists
-    await this.ensureMigrationsTable(tenantKnex);
-
-    const id = require('crypto').randomUUID();
-    const now = new Date();
-
-    await tenantKnex('custom_migrations').insert({
-      id,
-      tenantId: data.tenantId,
-      name: data.name,
-      description: data.description,
-      type: data.type,
-      sql: data.sql,
-      status: 'pending',
-      created_at: now,
-      updated_at: now,
-    });
-
-    return tenantKnex('custom_migrations').where({ id }).first();
-  }
-
-  /**
-   * Execute a pending migration and update its status
-   */
-  async executeMigration(
-    tenantKnex: Knex,
-    migrationId: string,
-  ): Promise<CustomMigrationRecord> {
-    try {
-      // Get the migration record
-      const migration = await tenantKnex('custom_migrations')
-        .where({ id: migrationId })
-        .first();
-
-      if (!migration) {
-        throw new Error(`Migration ${migrationId} not found`);
-      }
-
-      if (migration.status === 'executed') {
-        this.logger.log(`Migration ${migrationId} already executed`);
-        return migration;
-      }
-
-      // Execute the SQL
-      this.logger.log(`Executing migration: ${migration.name}`);
-      await tenantKnex.raw(migration.sql);
-
-      // Update status
-      const now = new Date();
-      await tenantKnex('custom_migrations')
-        .where({ id: migrationId })
-        .update({
-          status: 'executed',
-          executedAt: now,
-          updated_at: now,
-        });
-
-      this.logger.log(`Migration ${migration.name} executed successfully`);
-      return tenantKnex('custom_migrations').where({ id: migrationId }).first();
-    } catch (error) {
-      this.logger.error(`Failed to execute migration ${migrationId}:`, error);
-
-      // Update status with error
-      const now = new Date();
-      await tenantKnex('custom_migrations')
-        .where({ id: migrationId })
-        .update({
-          status: 'failed',
-          error: error.message,
-          updated_at: now,
-        });
-
-      throw error;
-    }
-  }
-
-  /**
-   * Create and execute a migration in one step
-   */
-  async createAndExecuteMigration(
-    tenantKnex: Knex,
-    tenantId: string,
-    data: {
-      name: string;
-      description: string;
-      type: 'create_table' | 'add_column' | 'alter_column' | 'add_index' | 'drop_table' | 'custom';
-      sql: string;
-    },
-  ): Promise<CustomMigrationRecord> {
-    // Create the migration record
-    const migration = await this.createMigrationRecord(tenantKnex, {
-      tenantId,
-      ...data,
-    });
-
-    // Execute it immediately
-    return this.executeMigration(tenantKnex, migration.id);
-  }
-
-  /**
-   * Ensure the custom_migrations table exists in the tenant database
-   */
-  private async ensureMigrationsTable(tenantKnex: Knex): Promise<void> {
-    const hasTable = await tenantKnex.schema.hasTable('custom_migrations');
-
-    if (!hasTable) {
-      await tenantKnex.schema.createTable('custom_migrations', (table) => {
-        table.uuid('id').primary();
-        table.uuid('tenantId').notNullable();
-        table.string('name', 255).notNullable();
-        table.text('description');
-        table.enum('type', ['create_table', 'add_column', 'alter_column', 'add_index', 'drop_table', 'custom']).notNullable();
-        table.text('sql').notNullable();
-        table.enum('status', ['pending', 'executed', 'failed']).defaultTo('pending');
-        table.timestamp('executedAt').nullable();
-        table.text('error').nullable();
-        table.timestamps(true, true);
-
-        table.index(['tenantId']);
-        table.index(['status']);
-        table.index(['created_at']);
-      });
-
-      this.logger.log('Created custom_migrations table');
-    }
-  }
-
-  /**
-   * Get all migrations for a tenant
-   */
-  async getMigrations(
-    tenantKnex: Knex,
-    tenantId: string,
-    filter?: {
-      status?: 'pending' | 'executed' | 'failed';
-      type?: string;
-    },
-  ): Promise<CustomMigrationRecord[]> {
-    await this.ensureMigrationsTable(tenantKnex);
-
-    let query = tenantKnex('custom_migrations').where({ tenantId });
-
-    if (filter?.status) {
-      query = query.where({ status: filter.status });
-    }
-
-    if (filter?.type) {
-      query = query.where({ type: filter.type });
-    }
-
-    return query.orderBy('created_at', 'asc');
-  }
-}

backend/src/migration/migration.module.ts

@@ -1,10 +0,0 @@
-import { Module } from '@nestjs/common';
-import { CustomMigrationService } from './custom-migration.service';
-import { TenantModule } from '../tenant/tenant.module';
-
-@Module({
-  imports: [TenantModule],
-  providers: [CustomMigrationService],
-  exports: [CustomMigrationService],
-})
-export class MigrationModule {}

backend/src/models/field-definition.model.ts

@@ -74,13 +74,5 @@ export class FieldDefinition extends BaseModel {
         to: 'object_definitions.id',
       },
     },
-    rolePermissions: {
-      relation: BaseModel.HasManyRelation,
-      modelClass: () => require('./role-field-permission.model').RoleFieldPermission,
-      join: {
-        from: 'field_definitions.id',
-        to: 'role_field_permissions.fieldDefinitionId',
-      },
-    },
   };
 }

backend/src/models/object-definition.model.ts

@@ -10,11 +10,8 @@ export class ObjectDefinition extends BaseModel {
   description?: string;
   isSystem: boolean;
   isCustom: boolean;
-  orgWideDefault: 'private' | 'public_read' | 'public_read_write';
   createdAt: Date;
   updatedAt: Date;
-  fields?: any[];
-  rolePermissions?: any[];
 
   static get jsonSchema() {
     return {
@@ -28,14 +25,12 @@ export class ObjectDefinition extends BaseModel {
         description: { type: 'string' },
         isSystem: { type: 'boolean' },
         isCustom: { type: 'boolean' },
-        orgWideDefault: { type: 'string', enum: ['private', 'public_read', 'public_read_write'] },
       },
     };
   }
 
   static get relationMappings() {
     const { FieldDefinition } = require('./field-definition.model');
-    const { RoleObjectPermission } = require('./role-object-permission.model');
 
     return {
       fields: {
@@ -46,14 +41,6 @@ export class ObjectDefinition extends BaseModel {
           to: 'field_definitions.objectDefinitionId',
         },
       },
-      rolePermissions: {
-        relation: BaseModel.HasManyRelation,
-        modelClass: RoleObjectPermission,
-        join: {
-          from: 'object_definitions.id',
-          to: 'role_object_permissions.objectDefinitionId',
-        },
-      },
     };
   }
 }

backend/src/models/record-share.model.ts

@@ -1,113 +0,0 @@
-import { BaseModel } from './base.model';
-
-export interface RecordShareAccessLevel {
-  canRead: boolean;
-  canEdit: boolean;
-  canDelete: boolean;
-}
-
-export class RecordShare extends BaseModel {
-  static tableName = 'record_shares';
-
-  // Don't use snake_case mapping since DB columns are already camelCase
-  static get columnNameMappers() {
-    return {
-      parse(obj: any) {
-        return obj;
-      },
-      format(obj: any) {
-        return obj;
-      },
-    };
-  }
-
-  // Don't auto-set timestamps - let DB defaults handle them
-  $beforeInsert() {
-    // Don't call super - skip BaseModel's timestamp logic
-  }
-
-  $beforeUpdate() {
-    // Don't call super - skip BaseModel's timestamp logic
-  }
-
-  id!: string;
-  objectDefinitionId!: string;
-  recordId!: string;
-  granteeUserId!: string;
-  grantedByUserId!: string;
-  accessLevel!: RecordShareAccessLevel;
-  expiresAt?: Date;
-  revokedAt?: Date;
-  createdAt!: Date;
-  updatedAt!: Date;
-
-  static get jsonSchema() {
-    return {
-      type: 'object',
-      required: ['objectDefinitionId', 'recordId', 'granteeUserId', 'grantedByUserId', 'accessLevel'],
-      properties: {
-        id: { type: 'string' },
-        objectDefinitionId: { type: 'string' },
-        recordId: { type: 'string' },
-        granteeUserId: { type: 'string' },
-        grantedByUserId: { type: 'string' },
-        accessLevel: {
-          type: 'object',
-          properties: {
-            canRead: { type: 'boolean' },
-            canEdit: { type: 'boolean' },
-            canDelete: { type: 'boolean' },
-          },
-        },
-        expiresAt: {
-          anyOf: [
-            { type: 'string', format: 'date-time' },
-            { type: 'null' },
-            { type: 'object' } // Allow Date objects
-          ]
-        },
-        revokedAt: {
-          anyOf: [
-            { type: 'string', format: 'date-time' },
-            { type: 'null' },
-            { type: 'object' } // Allow Date objects
-          ]
-        },
-        createdAt: { type: ['string', 'object'], format: 'date-time' },
-        updatedAt: { type: ['string', 'object'], format: 'date-time' },
-      },
-    };
-  }
-
-  static get relationMappings() {
-    const { ObjectDefinition } = require('./object-definition.model');
-    const { User } = require('./user.model');
-
-    return {
-      objectDefinition: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: ObjectDefinition,
-        join: {
-          from: 'record_shares.objectDefinitionId',
-          to: 'object_definitions.id',
-        },
-      },
-      granteeUser: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: User,
-        join: {
-          from: 'record_shares.granteeUserId',
-          to: 'users.id',
-        },
-      },
-      grantedByUser: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: User,
-        join: {
-          from: 'record_shares.grantedByUserId',
-          to: 'users.id',
-        },
-      },
-    };
-  }
-}

backend/src/models/role-field-permission.model.ts

@@ -1,51 +0,0 @@
-import { BaseModel } from './base.model';
-
-export class RoleFieldPermission extends BaseModel {
-  static tableName = 'role_field_permissions';
-
-  id!: string;
-  roleId!: string;
-  fieldDefinitionId!: string;
-  canRead!: boolean;
-  canEdit!: boolean;
-  createdAt!: Date;
-  updatedAt!: Date;
-
-  static get jsonSchema() {
-    return {
-      type: 'object',
-      required: ['roleId', 'fieldDefinitionId'],
-      properties: {
-        id: { type: 'string' },
-        roleId: { type: 'string' },
-        fieldDefinitionId: { type: 'string' },
-        canRead: { type: 'boolean' },
-        canEdit: { type: 'boolean' },
-      },
-    };
-  }
-
-  static get relationMappings() {
-    const { Role } = require('./role.model');
-    const { FieldDefinition } = require('./field-definition.model');
-
-    return {
-      role: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: Role,
-        join: {
-          from: 'role_field_permissions.roleId',
-          to: 'roles.id',
-        },
-      },
-      fieldDefinition: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: FieldDefinition,
-        join: {
-          from: 'role_field_permissions.fieldDefinitionId',
-          to: 'field_definitions.id',
-        },
-      },
-    };
-  }
-}

backend/src/models/role-object-permission.model.ts

@@ -1,59 +0,0 @@
-import { BaseModel } from './base.model';
-
-export class RoleObjectPermission extends BaseModel {
-  static tableName = 'role_object_permissions';
-
-  id!: string;
-  roleId!: string;
-  objectDefinitionId!: string;
-  canCreate!: boolean;
-  canRead!: boolean;
-  canEdit!: boolean;
-  canDelete!: boolean;
-  canViewAll!: boolean;
-  canModifyAll!: boolean;
-  createdAt!: Date;
-  updatedAt!: Date;
-
-  static get jsonSchema() {
-    return {
-      type: 'object',
-      required: ['roleId', 'objectDefinitionId'],
-      properties: {
-        id: { type: 'string' },
-        roleId: { type: 'string' },
-        objectDefinitionId: { type: 'string' },
-        canCreate: { type: 'boolean' },
-        canRead: { type: 'boolean' },
-        canEdit: { type: 'boolean' },
-        canDelete: { type: 'boolean' },
-        canViewAll: { type: 'boolean' },
-        canModifyAll: { type: 'boolean' },
-      },
-    };
-  }
-
-  static get relationMappings() {
-    const { Role } = require('./role.model');
-    const { ObjectDefinition } = require('./object-definition.model');
-
-    return {
-      role: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: Role,
-        join: {
-          from: 'role_object_permissions.roleId',
-          to: 'roles.id',
-        },
-      },
-      objectDefinition: {
-        relation: BaseModel.BelongsToOneRelation,
-        modelClass: ObjectDefinition,
-        join: {
-          from: 'role_object_permissions.objectDefinitionId',
-          to: 'object_definitions.id',
-        },
-      },
-    };
-  }
-}

backend/src/models/role.model.ts

@@ -27,8 +27,6 @@ export class Role extends BaseModel {
     const { RolePermission } = require('./role-permission.model');
     const { Permission } = require('./permission.model');
     const { User } = require('./user.model');
-    const { RoleObjectPermission } = require('./role-object-permission.model');
-    const { RoleFieldPermission } = require('./role-field-permission.model');
 
     return {
       rolePermissions: {
@@ -63,22 +61,6 @@ export class Role extends BaseModel {
           to: 'users.id',
         },
       },
-      objectPermissions: {
-        relation: BaseModel.HasManyRelation,
-        modelClass: RoleObjectPermission,
-        join: {
-          from: 'roles.id',
-          to: 'role_object_permissions.roleId',
-        },
-      },
-      fieldPermissions: {
-        relation: BaseModel.HasManyRelation,
-        modelClass: RoleFieldPermission,
-        join: {
-          from: 'roles.id',
-          to: 'role_field_permissions.roleId',
-        },
-      },
     };
   }
 }

backend/src/object/field-mapper.service.ts

@@ -51,29 +51,13 @@ export class FieldMapperService {
    * Convert a field definition from the database to a frontend-friendly FieldConfig
    */
   mapFieldToDTO(field: any): FieldConfigDTO {
-    // Parse ui_metadata if it's a JSON string or object
-    let uiMetadata: any = {};
-    const metadataField = field.ui_metadata || field.uiMetadata;
-    if (metadataField) {
-      if (typeof metadataField === 'string') {
-        try {
-          uiMetadata = JSON.parse(metadataField);
-        } catch (e) {
-          uiMetadata = {};
-        }
-      } else {
-        uiMetadata = metadataField;
-      }
-    }
-    
-    const frontendType = this.mapFieldType(field.type);
-    const isLookupField = frontendType === 'belongsTo' || field.type.toLowerCase().includes('lookup');
+    const uiMetadata = field.uiMetadata || {};
     
     return {
       id: field.id,
       apiName: field.apiName,
       label: field.label,
-      type: frontendType,
+      type: this.mapFieldType(field.type),
       
       // Display properties
       placeholder: uiMetadata.placeholder || field.description,
@@ -98,10 +82,7 @@ export class FieldMapperService {
       step: uiMetadata.step,
       accept: uiMetadata.accept,
       relationObject: field.referenceObject,
-      // For lookup fields, provide default display field if not specified
-      relationDisplayField: isLookupField 
-        ? (uiMetadata.relationDisplayField || 'name')
-        : uiMetadata.relationDisplayField,
+      relationDisplayField: uiMetadata.relationDisplayField,
       
       // Formatting
       format: uiMetadata.format,

backend/src/object/models/base.model.ts

@@ -1,33 +0,0 @@
-import { Model } from 'objection';
-import { randomUUID } from 'crypto';
-
-/**
- * Base model for all dynamic and system models
- * Provides common functionality for all objects
- */
-export class BaseModel extends Model {
-  // Common fields
-  id?: string;
-  tenantId?: string;
-  ownerId?: string;
-  name?: string;
-  created_at?: string;
-  updated_at?: string;
-
-  // Hook to set system-managed fields
-  async $beforeInsert() {
-    if (!this.id) {
-      this.id = randomUUID();
-    }
-    if (!this.created_at) {
-      this.created_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
-    }
-    if (!this.updated_at) {
-      this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
-    }
-  }
-
-  async $beforeUpdate() {
-    this.updated_at = new Date().toISOString().slice(0, 19).replace('T', ' ');
-  }
-}

backend/src/object/models/dynamic-model.factory.ts

@@ -1,201 +0,0 @@
-import { ModelClass, JSONSchema, RelationMappings, Model } from 'objection';
-import { BaseModel } from './base.model';
-
-export interface FieldDefinition {
-  apiName: string;
-  label: string;
-  type: string;
-  isRequired?: boolean;
-  isUnique?: boolean;
-  referenceObject?: string;
-  defaultValue?: string;
-}
-
-export interface RelationDefinition {
-  name: string;
-  type: 'belongsTo' | 'hasMany' | 'hasManyThrough';
-  targetObjectApiName: string;
-  fromColumn: string;
-  toColumn: string;
-}
-
-export interface ObjectMetadata {
-  apiName: string;
-  tableName: string;
-  fields: FieldDefinition[];
-  relations?: RelationDefinition[];
-}
-
-export class DynamicModelFactory {
-  /**
-   * Get relation name from lookup field API name
-   * Converts "ownerId" -> "owner", "customFieldId" -> "customfield"
-   */
-  static getRelationName(lookupFieldApiName: string): string {
-    return lookupFieldApiName.replace(/Id$/, '').toLowerCase();
-  }
-
-  /**
-   * Create a dynamic model class from object metadata
-   * @param meta Object metadata
-   * @param getModel Function to retrieve model classes from registry
-   */
-  static createModel(
-    meta: ObjectMetadata,
-    getModel?: (apiName: string) => ModelClass<any>,
-  ): ModelClass<any> {
-    const { tableName, fields, apiName, relations = [] } = meta;
-
-    // Build JSON schema properties
-    const properties: Record<string, any> = {
-      id: { type: 'string' },
-      tenantId: { type: 'string' },
-      ownerId: { type: 'string' },
-      name: { type: 'string' },
-      created_at: { type: 'string', format: 'date-time' },
-      updated_at: { type: 'string', format: 'date-time' },
-    };
-
-    // Don't require id or tenantId - they'll be set automatically
-    const required: string[] = [];
-
-    // Add custom fields
-    for (const field of fields) {
-      properties[field.apiName] = this.fieldToJsonSchema(field);
-
-      // Only mark as required if explicitly required AND not a system field
-      const systemFields = ['id', 'tenantId', 'ownerId', 'name', 'created_at', 'updated_at'];
-      if (field.isRequired && !systemFields.includes(field.apiName)) {
-        required.push(field.apiName);
-      }
-    }
-
-    // Build relation mappings from lookup fields
-    const lookupFields = fields.filter(f => f.type === 'LOOKUP' && f.referenceObject);
-
-    // Store lookup fields metadata for later use
-    const lookupFieldsInfo = lookupFields.map(f => ({
-      apiName: f.apiName,
-      relationName: DynamicModelFactory.getRelationName(f.apiName),
-      referenceObject: f.referenceObject,
-      targetTable: this.getTableName(f.referenceObject),
-    }));
-
-    // Create the dynamic model class extending BaseModel
-    class DynamicModel extends BaseModel {
-      static tableName = tableName;
-
-      static objectApiName = apiName;
-      
-      static lookupFields = lookupFieldsInfo;
-
-      static get relationMappings(): RelationMappings {
-        const mappings: RelationMappings = {};
-
-        // Build relation mappings from lookup fields
-        for (const lookupInfo of lookupFieldsInfo) {
-          // Use getModel function if provided, otherwise use string reference
-          let modelClass: any = lookupInfo.referenceObject;
-          
-          if (getModel) {
-            const resolvedModel = getModel(lookupInfo.referenceObject);
-            // Only use resolved model if it exists, otherwise skip this relation
-            // It will be resolved later when the model is registered
-            if (resolvedModel) {
-              modelClass = resolvedModel;
-            } else {
-              // Skip this relation if model not found yet
-              continue;
-            }
-          }
-
-          mappings[lookupInfo.relationName] = {
-            relation: Model.BelongsToOneRelation,
-            modelClass,
-            join: {
-              from: `${tableName}.${lookupInfo.apiName}`,
-              to: `${lookupInfo.targetTable}.id`,
-            },
-          };
-        }
-
-        return mappings;
-      }
-
-      static get jsonSchema() {
-        return {
-          type: 'object',
-          required,
-          properties,
-        };
-      }
-    }
-
-    return DynamicModel as any;
-  }
-
-  /**
-   * Convert a field definition to JSON schema property
-   */
-  private static fieldToJsonSchema(field: FieldDefinition): Record<string, any> {
-    switch (field.type.toUpperCase()) {
-      case 'TEXT':
-      case 'STRING':
-      case 'EMAIL':
-      case 'URL':
-      case 'PHONE':
-      case 'PICKLIST':
-      case 'MULTI_PICKLIST':
-        return {
-          type: 'string',
-          ...(field.isUnique && { uniqueItems: true }),
-        };
-
-      case 'LONG_TEXT':
-        return { type: 'string' };
-
-      case 'NUMBER':
-      case 'DECIMAL':
-      case 'CURRENCY':
-      case 'PERCENT':
-        return {
-          type: 'number',
-          ...(field.isUnique && { uniqueItems: true }),
-        };
-
-      case 'INTEGER':
-        return {
-          type: 'integer',
-          ...(field.isUnique && { uniqueItems: true }),
-        };
-
-      case 'BOOLEAN':
-        return { type: 'boolean', default: false };
-
-      case 'DATE':
-        return { type: 'string', format: 'date' };
-
-      case 'DATE_TIME':
-        return { type: 'string', format: 'date-time' };
-
-      case 'LOOKUP':
-      case 'BELONGS_TO':
-        return { type: 'string' };
-
-      default:
-        return { type: 'string' };
-    }
-  }
-
-  /**
-   * Get table name from object API name
-   */
-  private static getTableName(objectApiName: string): string {
-    // Convert PascalCase/camelCase to snake_case and pluralize
-    const snakeCase = objectApiName
-      .replace(/([A-Z])/g, '_$1')
-      .toLowerCase()
-      .replace(/^_/, '');
-    return snakeCase.endsWith('s') ? snakeCase : `${snakeCase}s`;
-  }
-}

backend/src/object/models/model.registry.ts

@@ -1,68 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { ModelClass } from 'objection';
-import { BaseModel } from './base.model';
-import { DynamicModelFactory, ObjectMetadata } from './dynamic-model.factory';
-
-/**
- * Registry to store and retrieve dynamic models
- * One registry per tenant
- */
-@Injectable()
-export class ModelRegistry {
-  private registry = new Map<string, ModelClass<BaseModel>>();
-
-  /**
-   * Register a model in the registry
-   */
-  registerModel(apiName: string, modelClass: ModelClass<BaseModel>): void {
-    this.registry.set(apiName, modelClass);
-  }
-
-  /**
-   * Get a model from the registry
-   */
-  getModel(apiName: string): ModelClass<BaseModel> {
-    const model = this.registry.get(apiName);
-    if (!model) {
-      throw new Error(`Model for ${apiName} not found in registry`);
-    }
-    return model;
-  }
-
-  /**
-   * Check if a model exists in the registry
-   */
-  hasModel(apiName: string): boolean {
-    return this.registry.has(apiName);
-  }
-
-  /**
-   * Create and register a model from metadata
-   */
-  createAndRegisterModel(
-    metadata: ObjectMetadata,
-  ): ModelClass<BaseModel> {
-    // Create model with a getModel function that resolves from this registry
-    // Returns undefined if model not found (for models not yet registered)
-    const model = DynamicModelFactory.createModel(
-      metadata,
-      (apiName: string) => this.registry.get(apiName),
-    );
-    this.registerModel(metadata.apiName, model);
-    return model;
-  }
-
-  /**
-   * Get all registered model names
-   */
-  getAllModelNames(): string[] {
-    return Array.from(this.registry.keys());
-  }
-
-  /**
-   * Clear the registry (useful for testing)
-   */
-  clear(): void {
-    this.registry.clear();
-  }
-}

backend/src/object/models/model.service.ts

@@ -1,184 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { Knex } from 'knex';
-import { ModelClass } from 'objection';
-import { BaseModel } from './base.model';
-import { ModelRegistry } from './model.registry';
-import { ObjectMetadata } from './dynamic-model.factory';
-import { TenantDatabaseService } from '../../tenant/tenant-database.service';
-import { UserModel, RoleModel, PermissionModel } from './system-models';
-
-/**
- * Service to manage dynamic models for a specific tenant
- */
-@Injectable()
-export class ModelService {
-  private readonly logger = new Logger(ModelService.name);
-  private tenantRegistries = new Map<string, ModelRegistry>();
-
-  constructor(private tenantDbService: TenantDatabaseService) {}
-
-  /**
-   * Get or create a registry for a tenant
-   */
-  getTenantRegistry(tenantId: string): ModelRegistry {
-    if (!this.tenantRegistries.has(tenantId)) {
-      const registry = new ModelRegistry();
-      
-      // Register system models that are defined as static Objection models
-      this.registerSystemModels(registry);
-      
-      this.tenantRegistries.set(tenantId, registry);
-    }
-    return this.tenantRegistries.get(tenantId)!;
-  }
-
-  /**
-   * Register static system models in the registry
-   * Uses simplified models without complex relationMappings to avoid modelPath issues
-   */
-  private registerSystemModels(registry: ModelRegistry): void {
-    // Register system models by their API name (used in referenceObject fields)
-    // These are simplified versions without relationMappings to avoid dependency issues
-    registry.registerModel('User', UserModel as any);
-    registry.registerModel('Role', RoleModel as any);
-    registry.registerModel('Permission', PermissionModel as any);
-    
-    this.logger.debug('Registered system models: User, Role, Permission');
-  }
-
-  /**
-   * Create and register a model for a tenant
-   */
-  async createModelForObject(
-    tenantId: string,
-    objectMetadata: ObjectMetadata,
-  ): Promise<ModelClass<BaseModel>> {
-    const registry = this.getTenantRegistry(tenantId);
-    const model = registry.createAndRegisterModel(objectMetadata);
-
-    this.logger.log(
-      `Registered model for ${objectMetadata.apiName} in tenant ${tenantId}`,
-    );
-
-    return model;
-  }
-
-  /**
-   * Get a model for a tenant and object
-   */
-  getModel(tenantId: string, objectApiName: string): ModelClass<BaseModel> {
-    const registry = this.getTenantRegistry(tenantId);
-    return registry.getModel(objectApiName);
-  }
-
-  /**
-   * Get a bound model (with knex connection) for a tenant and object
-   */
-  async getBoundModel(
-    tenantId: string,
-    objectApiName: string,
-  ): Promise<ModelClass<BaseModel>> {
-    const knex = await this.tenantDbService.getTenantKnexById(tenantId);
-    const model = this.getModel(tenantId, objectApiName);
-    
-    // Bind knex to the model and also to all models in the registry
-    // This ensures system models also have knex bound when they're used in relations
-    const registry = this.getTenantRegistry(tenantId);
-    const allModels = registry.getAllModelNames();
-    
-    // Bind knex to all models to ensure relations work
-    for (const modelName of allModels) {
-      try {
-        const m = registry.getModel(modelName);
-        if (m && !m.knex()) {
-          m.knex(knex);
-        }
-      } catch (error) {
-        // Ignore errors for models that don't need binding
-      }
-    }
-    
-    return model.bindKnex(knex);
-  }
-
-  /**
-   * Check if a model exists for a tenant
-   */
-  hasModel(tenantId: string, objectApiName: string): boolean {
-    const registry = this.getTenantRegistry(tenantId);
-    return registry.hasModel(objectApiName);
-  }
-
-  /**
-   * Get all model names for a tenant
-   */
-  getAllModelNames(tenantId: string): string[] {
-    const registry = this.getTenantRegistry(tenantId);
-    return registry.getAllModelNames();
-  }
-
-  /**
-   * Ensure a model is registered with all its dependencies.
-   * This method handles recursive model creation for related objects.
-   * 
-   * @param tenantId - The tenant ID
-   * @param objectApiName - The object API name to ensure registration for
-   * @param fetchMetadata - Callback function to fetch object metadata (provided by ObjectService)
-   * @param visited - Set to track visited models and prevent infinite loops
-   */
-  async ensureModelWithDependencies(
-    tenantId: string,
-    objectApiName: string,
-    fetchMetadata: (apiName: string) => Promise<ObjectMetadata>,
-    visited: Set<string> = new Set(),
-  ): Promise<void> {
-    // Prevent infinite recursion
-    if (visited.has(objectApiName)) {
-      return;
-    }
-    visited.add(objectApiName);
-
-    // Check if model already exists
-    if (this.hasModel(tenantId, objectApiName)) {
-      return;
-    }
-
-    try {
-      // Fetch the object metadata
-      const objectMetadata = await fetchMetadata(objectApiName);
-
-      // Extract lookup fields to find dependencies
-      const lookupFields = objectMetadata.fields.filter(
-        f => f.type === 'LOOKUP' && f.referenceObject
-      );
-
-      // Recursively ensure all dependent models are registered first
-      for (const field of lookupFields) {
-        if (field.referenceObject) {
-          try {
-            await this.ensureModelWithDependencies(
-              tenantId,
-              field.referenceObject,
-              fetchMetadata,
-              visited,
-            );
-          } catch (error) {
-            // If related object doesn't exist (e.g., system tables), skip it
-            this.logger.debug(
-              `Skipping registration of related model ${field.referenceObject}: ${error.message}`
-            );
-          }
-        }
-      }
-
-      // Now create and register this model (all dependencies are ready)
-      await this.createModelForObject(tenantId, objectMetadata);
-      this.logger.log(`Registered model for ${objectApiName} in tenant ${tenantId}`);
-    } catch (error) {
-      this.logger.warn(
-        `Failed to ensure model for ${objectApiName}: ${error.message}`
-      );
-      throw error;
-    }
-  }
-}

backend/src/object/models/system-models.ts

@@ -1,85 +0,0 @@
-import { Model } from 'objection';
-
-/**
- * Simplified User model for use in dynamic object relations
- * This version doesn't include complex relationMappings to avoid modelPath issues
- */
-export class UserModel extends Model {
-  static tableName = 'users';
-  static objectApiName = 'User';
-
-  id!: string;
-  email!: string;
-  firstName?: string;
-  lastName?: string;
-  name?: string;
-  isActive!: boolean;
-  createdAt!: Date;
-  updatedAt!: Date;
-
-  static get jsonSchema() {
-    return {
-      type: 'object',
-      required: ['email'],
-      properties: {
-        id: { type: 'string' },
-        email: { type: 'string', format: 'email' },
-        firstName: { type: 'string' },
-        lastName: { type: 'string' },
-        name: { type: 'string' },
-        isActive: { type: 'boolean' },
-      },
-    };
-  }
-
-  // No relationMappings to avoid modelPath resolution issues
-  // These simplified models are only used for lookup relations from dynamic models
-}
-
-/**
- * Simplified Role model for use in dynamic object relations
- */
-export class RoleModel extends Model {
-  static tableName = 'roles';
-  static objectApiName = 'Role';
-
-  id!: string;
-  name!: string;
-  description?: string;
-
-  static get jsonSchema() {
-    return {
-      type: 'object',
-      required: ['name'],
-      properties: {
-        id: { type: 'string' },
-        name: { type: 'string' },
-        description: { type: 'string' },
-      },
-    };
-  }
-}
-
-/**
- * Simplified Permission model for use in dynamic object relations
- */
-export class PermissionModel extends Model {
-  static tableName = 'permissions';
-  static objectApiName = 'Permission';
-
-  id!: string;
-  name!: string;
-  description?: string;
-
-  static get jsonSchema() {
-    return {
-      type: 'object',
-      required: ['name'],
-      properties: {
-        id: { type: 'string' },
-        name: { type: 'string' },
-        description: { type: 'string' },
-      },
-    };
-  }
-}

backend/src/object/object.module.ts

@@ -5,21 +5,11 @@ import { SetupObjectController } from './setup-object.controller';
 import { SchemaManagementService } from './schema-management.service';
 import { FieldMapperService } from './field-mapper.service';
 import { TenantModule } from '../tenant/tenant.module';
-import { MigrationModule } from '../migration/migration.module';
-import { RbacModule } from '../rbac/rbac.module';
-import { ModelRegistry } from './models/model.registry';
-import { ModelService } from './models/model.service';
 
 @Module({
-  imports: [TenantModule, MigrationModule, RbacModule],
-  providers: [
-    ObjectService,
-    SchemaManagementService,
-    FieldMapperService,
-    ModelRegistry,
-    ModelService,
-  ],
+  imports: [TenantModule],
+  providers: [ObjectService, SchemaManagementService, FieldMapperService],
   controllers: [RuntimeObjectController, SetupObjectController],
-  exports: [ObjectService, SchemaManagementService, FieldMapperService, ModelService],
+  exports: [ObjectService, SchemaManagementService, FieldMapperService],
 })
 export class ObjectModule {}

backend/src/object/object.service.ts

@@ -1,28 +1,13 @@
-import { Injectable, NotFoundException, Logger } from '@nestjs/common';
+import { Injectable, NotFoundException } from '@nestjs/common';
 import { TenantDatabaseService } from '../tenant/tenant-database.service';
-import { CustomMigrationService } from '../migration/custom-migration.service';
-import { ModelService } from './models/model.service';
-import { AuthorizationService } from '../rbac/authorization.service';
-import { ObjectDefinition } from '../models/object-definition.model';
-import { FieldDefinition } from '../models/field-definition.model';
-import { User } from '../models/user.model';
-import { ObjectMetadata } from './models/dynamic-model.factory';
 
 @Injectable()
 export class ObjectService {
-  private readonly logger = new Logger(ObjectService.name);
-  
-  constructor(
-    private tenantDbService: TenantDatabaseService,
-    private customMigrationService: CustomMigrationService,
-    private modelService: ModelService,
-    private authService: AuthorizationService,
-  ) {}
+  constructor(private tenantDbService: TenantDatabaseService) {}
 
   // Setup endpoints - Object metadata management
   async getObjectDefinitions(tenantId: string) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
     const objects = await knex('object_definitions')
       .select('object_definitions.*')
@@ -43,8 +28,7 @@ export class ObjectService {
   }
 
   async getObjectDefinition(tenantId: string, apiName: string) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
     const obj = await knex('object_definitions')
       .where({ apiName })
@@ -59,9 +43,6 @@ export class ObjectService {
       .where({ objectDefinitionId: obj.id })
       .orderBy('label', 'asc');
 
-    // Normalize all fields to ensure system fields are properly marked
-    const normalizedFields = fields.map((field: any) => this.normalizeField(field));
-
     // Get app information if object belongs to an app
     let app = null;
     if (obj.app_id) {
@@ -73,7 +54,7 @@ export class ObjectService {
 
     return {
       ...obj,
-      fields: normalizedFields,
+      fields,
       app,
     };
   }
@@ -88,172 +69,15 @@ export class ObjectService {
       isSystem?: boolean;
     },
   ) {
-    // Resolve tenant ID in case a slug was passed
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Generate UUID for the new object
-    const objectId = require('crypto').randomUUID();
-    
-    // Create the object definition record
-    await knex('object_definitions').insert({
-      id: objectId,
-      ...data,
-      created_at: knex.fn.now(),
-      updated_at: knex.fn.now(),
-    });
-    
-    const objectDef = await knex('object_definitions').where({ id: objectId }).first();
-    
-    // Create standard field definitions (only if they don't already exist)
-    const standardFields = [
-      {
-        apiName: 'ownerId',
-        label: 'Owner',
-        type: 'LOOKUP',
-        description: 'The user who owns this record',
-        isRequired: false,  // Auto-set by system
-        isUnique: false,
-        referenceObject: 'User',
-        isSystem: true,
-        isCustom: false,
-      },
-      {
-        apiName: 'name',
-        label: 'Name',
-        type: 'STRING',
-        description: 'The primary name field for this record',
-        isRequired: false,  // Optional field
-        isUnique: false,
-        referenceObject: null,
-        isSystem: false,
-        isCustom: false,
-      },
-      {
-        apiName: 'created_at',
-        label: 'Created At',
-        type: 'DATE_TIME',
-        description: 'The timestamp when this record was created',
-        isRequired: false,  // Auto-set by system
-        isUnique: false,
-        referenceObject: null,
-        isSystem: true,
-        isCustom: false,
-      },
-      {
-        apiName: 'updated_at',
-        label: 'Updated At',
-        type: 'DATE_TIME',
-        description: 'The timestamp when this record was last updated',
-        isRequired: false,  // Auto-set by system
-        isUnique: false,
-        referenceObject: null,
-        isSystem: true,
-        isCustom: false,
-      },
-    ];
-
-    // Insert standard field definitions that don't already exist
-    for (const field of standardFields) {
-      const existingField = await knex('field_definitions')
-        .where({
-          objectDefinitionId: objectDef.id,
-          apiName: field.apiName,
-        })
-        .first();
-
-      if (!existingField) {
-        const fieldData: any = {
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
+    const [id] = await knex('object_definitions').insert({
       id: knex.raw('(UUID())'),
-          objectDefinitionId: objectDef.id,
-          ...field,
+      ...data,
       created_at: knex.fn.now(),
       updated_at: knex.fn.now(),
-        };
-        
-        // For lookup fields, set ui_metadata with relationDisplayField
-        if (field.type === 'LOOKUP') {
-          fieldData.ui_metadata = JSON.stringify({
-            relationDisplayField: 'name',
-          });
-        }
-        
-        await knex('field_definitions').insert(fieldData);
-      }
-    }
-    
-    // Create a migration to create the table
-    const tableName = this.getTableName(data.apiName);
-    const createTableSQL = this.customMigrationService.generateCreateTableSQL(tableName);
-    
-    try {
-      await this.customMigrationService.createAndExecuteMigration(
-        knex,
-        resolvedTenantId,
-        {
-          name: `create_${tableName}_table`,
-          description: `Create table for ${data.label} object`,
-          type: 'create_table',
-          sql: createTableSQL,
-        },
-      );
-    } catch (error) {
-      // Log the error but don't fail - migration is recorded for future retry
-      console.error(`Failed to execute table creation migration: ${error.message}`);
-    }
-
-    // Create and register the Objection model for this object
-    try {
-      const allFields = await knex('field_definitions')
-        .where({ objectDefinitionId: objectDef.id })
-        .select('apiName', 'label', 'type', 'isRequired', 'isUnique', 'referenceObject');
-
-      const objectMetadata: ObjectMetadata = {
-        apiName: data.apiName,
-        tableName,
-        fields: allFields.map((f: any) => ({
-          apiName: f.apiName,
-          label: f.label,
-          type: f.type,
-          isRequired: f.isRequired,
-          isUnique: f.isUnique,
-          referenceObject: f.referenceObject,
-        })),
-        relations: [],
-      };
-
-      await this.modelService.createModelForObject(resolvedTenantId, objectMetadata);
-    } catch (error) {
-      console.error(`Failed to create model for object ${data.apiName}:`, error.message);
-    }
-    
-    return objectDef;
-  }
-
-  async updateObjectDefinition(
-    tenantId: string,
-    objectApiName: string,
-    data: Partial<{
-      label: string;
-      pluralLabel: string;
-      description: string;
-      orgWideDefault: 'private' | 'public_read' | 'public_read_write';
-    }>,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Update the object definition
-    await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName })
-      .patch({
-        ...data,
-        updatedAt: new Date(),
     });
     
-    // Return updated object
-    return await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
+    return knex('object_definitions').where({ id }).first();
   }
 
   async createFieldDefinition(
@@ -267,44 +91,19 @@ export class ObjectService {
       isRequired?: boolean;
       isUnique?: boolean;
       referenceObject?: string;
-      relationObject?: string;
-      relationDisplayField?: string;
       defaultValue?: string;
     },
   ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     const obj = await this.getObjectDefinition(tenantId, objectApiName);
 
-    // Convert frontend type to database type
-    const dbFieldType = this.convertFrontendFieldType(data.type);
-    
-    // Use relationObject if provided (alias for referenceObject)
-    const referenceObject = data.referenceObject || data.relationObject;
-
-    const fieldData: any = {
+    const [id] = await knex('field_definitions').insert({
       id: knex.raw('(UUID())'),
       objectDefinitionId: obj.id,
-      apiName: data.apiName,
-      label: data.label,
-      type: dbFieldType,
-      description: data.description,
-      isRequired: data.isRequired ?? false,
-      isUnique: data.isUnique ?? false,
-      referenceObject: referenceObject,
-      defaultValue: data.defaultValue,
+      ...data,
       created_at: knex.fn.now(),
       updated_at: knex.fn.now(),
-    };
-    
-    // Store relationDisplayField in UI metadata if provided
-    if (data.relationDisplayField) {
-      fieldData.ui_metadata = JSON.stringify({
-        relationDisplayField: data.relationDisplayField,
     });
-    }
-    
-    const [id] = await knex('field_definitions').insert(fieldData);
     
     return knex('field_definitions').where({ id }).first();
   }
@@ -328,116 +127,6 @@ export class ObjectService {
     }
   }
 
-  /**
-   * Normalize field definition to ensure system fields are properly marked
-   */
-  private normalizeField(field: any): any {
-    const systemFieldNames = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt'];
-    const isSystemField = systemFieldNames.includes(field.apiName);
-    
-    return {
-      ...field,
-      // Ensure system fields are marked correctly
-      isSystem: isSystemField ? true : field.isSystem,
-      isRequired: isSystemField ? false : field.isRequired,
-      isCustom: isSystemField ? false : field.isCustom ?? true,
-    };
-  }
-
-  /**
-   * Convert frontend field type to database field type
-   */
-  private convertFrontendFieldType(frontendType: string): string {
-    const typeMap: Record<string, string> = {
-      'text': 'TEXT',
-      'textarea': 'LONG_TEXT',
-      'password': 'TEXT',
-      'email': 'EMAIL',
-      'number': 'NUMBER',
-      'currency': 'CURRENCY',
-      'percent': 'PERCENT',
-      'select': 'PICKLIST',
-      'multiSelect': 'MULTI_PICKLIST',
-      'boolean': 'BOOLEAN',
-      'date': 'DATE',
-      'datetime': 'DATE_TIME',
-      'time': 'TIME',
-      'url': 'URL',
-      'color': 'TEXT',
-      'json': 'JSON',
-      'belongsTo': 'LOOKUP',
-      'hasMany': 'LOOKUP',
-      'manyToMany': 'LOOKUP',
-      'markdown': 'LONG_TEXT',
-      'code': 'LONG_TEXT',
-      'file': 'FILE',
-      'image': 'IMAGE',
-    };
-    
-    return typeMap[frontendType] || 'TEXT';
-  }
-
-  /**
-   * Ensure a model is registered for the given object.
-   * Delegates to ModelService which handles creating the model and all its dependencies.
-   */
-  private async ensureModelRegistered(
-    tenantId: string,
-    objectApiName: string,
-  ): Promise<void> {
-    // Provide a metadata fetcher function that the ModelService can use
-    const fetchMetadata = async (apiName: string): Promise<ObjectMetadata> => {
-      const objectDef = await this.getObjectDefinition(tenantId, apiName);
-      const tableName = this.getTableName(apiName);
-
-      // Build relations from lookup fields, but only for models that exist
-      const lookupFields = objectDef.fields.filter((f: any) => 
-        f.type === 'LOOKUP' && f.referenceObject
-      );
-      
-      // Filter to only include relations where we can successfully resolve the target
-      const validRelations: any[] = [];
-      for (const field of lookupFields) {
-        // Check if the referenced object will be available
-        // We'll let the recursive registration attempt it, but won't include failed ones
-        validRelations.push({
-          name: field.apiName.replace(/Id$/, '').toLowerCase(),
-          type: 'belongsTo' as const,
-          targetObjectApiName: field.referenceObject,
-          fromColumn: field.apiName,
-          toColumn: 'id',
-        });
-      }
-
-      return {
-        apiName,
-        tableName,
-        fields: objectDef.fields.map((f: any) => ({
-          apiName: f.apiName,
-          label: f.label,
-          type: f.type,
-          isRequired: f.isRequired,
-          isUnique: f.isUnique,
-          referenceObject: f.referenceObject,
-        })),
-        relations: validRelations,
-      };
-    };
-
-    // Let the ModelService handle recursive model creation
-    try {
-      await this.modelService.ensureModelWithDependencies(
-        tenantId,
-        objectApiName,
-        fetchMetadata,
-      );
-    } catch (error) {
-      this.logger.warn(
-        `Failed to ensure model for ${objectApiName}: ${error.message}. Will fall back to manual hydration.`,
-      );
-    }
-  }
-
   // Runtime endpoints - CRUD operations
   async getRecords(
     tenantId: string,
@@ -445,60 +134,19 @@ export class ObjectService {
     userId: string,
     filters?: any,
   ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
-    // Get user with roles and permissions
-    const user = await User.query(knex)
-      .findById(userId)
-      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
-    
-    if (!user) {
-      throw new NotFoundException('User not found');
-    }
-    
-    // Get object definition with authorization settings
-    const objectDefModel = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName })
-      .withGraphFetched('fields');
-    
-    if (!objectDefModel) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
+    // Verify object exists
+    await this.getObjectDefinition(tenantId, objectApiName);
     
     const tableName = this.getTableName(objectApiName);
     
-    // Ensure model is registered
-    await this.ensureModelRegistered(resolvedTenantId, objectApiName);
+    let query = knex(tableName);
     
-    // Use Objection model
-    const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
-    let query = boundModel.query();
-    
-    // Apply authorization scope (modifies query in place)
-    await this.authService.applyScopeToQuery(
-      query,
-      objectDefModel,
-      user,
-      'read',
-      knex,
-    );
-    
-    // Build graph expression for lookup fields
-    const lookupFields = objectDefModel.fields?.filter(f => 
-      f.type === 'LOOKUP' && f.referenceObject
-    ) || [];
-    
-    if (lookupFields.length > 0) {
-      // Build relation expression - use singular lowercase for relation name
-      const relationExpression = lookupFields
-        .map(f => f.apiName.replace(/Id$/, '').toLowerCase())
-        .filter(Boolean)
-        .join(', ');
-      
-      if (relationExpression) {
-        query = query.withGraphFetched(`[${relationExpression}]`);
-      }
+    // Add ownership filter if ownerId field exists
+    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
+    if (hasOwner) {
+      query = query.where({ ownerId: userId });
     }
     
     // Apply additional filters
@@ -506,16 +154,7 @@ export class ObjectService {
       query = query.where(filters);
     }
     
-    const records = await query.select('*');
-    
-    // Filter fields based on field-level permissions
-    const filteredRecords = await Promise.all(
-      records.map(record => 
-        this.authService.filterReadableFields(record, objectDefModel.fields, user)
-      )
-    );
-    
-    return filteredRecords;
+    return query.select('*');
   }
 
   async getRecord(
@@ -524,69 +163,28 @@ export class ObjectService {
     recordId: string,
     userId: string,
   ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
-    // Get user with roles and permissions
-    const user = await User.query(knex)
-      .findById(userId)
-      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+    // Verify object exists
+    await this.getObjectDefinition(tenantId, objectApiName);
     
-    if (!user) {
-      throw new NotFoundException('User not found');
-    }
+    const tableName = this.getTableName(objectApiName);
     
-    // Get object definition with authorization settings
-    const objectDefModel = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName })
-      .withGraphFetched('fields');
+    let query = knex(tableName).where({ id: recordId });
     
-    if (!objectDefModel) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
-    
-    // Ensure model is registered
-    await this.ensureModelRegistered(resolvedTenantId, objectApiName);
-    
-    // Use Objection model
-    const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
-    let query = boundModel.query().where({ id: recordId });
-    
-    // Apply authorization scope (modifies query in place)
-    await this.authService.applyScopeToQuery(
-      query,
-      objectDefModel,
-      user,
-      'read',
-      knex,
-    );
-    
-    // Build graph expression for lookup fields
-    const lookupFields = objectDefModel.fields?.filter(f => 
-      f.type === 'LOOKUP' && f.referenceObject
-    ) || [];
-    
-    if (lookupFields.length > 0) {
-      // Build relation expression - use singular lowercase for relation name
-      const relationExpression = lookupFields
-        .map(f => f.apiName.replace(/Id$/, '').toLowerCase())
-        .filter(Boolean)
-        .join(', ');
-      
-      if (relationExpression) {
-        query = query.withGraphFetched(`[${relationExpression}]`);
-      }
+    // Add ownership filter if ownerId field exists
+    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
+    if (hasOwner) {
+      query = query.where({ ownerId: userId });
     }
     
     const record = await query.first();
+
     if (!record) {
       throw new NotFoundException('Record not found');
     }
 
-    // Filter fields based on field-level permissions
-    const filteredRecord = await this.authService.filterReadableFields(record, objectDefModel.fields, user);
-    
-    return filteredRecord;
+    return record;
   }
 
   async createRecord(
@@ -595,47 +193,30 @@ export class ObjectService {
     data: any,
     userId: string,
   ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
-    // Get user with roles and permissions
-    const user = await User.query(knex)
-      .findById(userId)
-      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
+    // Verify object exists
+    await this.getObjectDefinition(tenantId, objectApiName);
     
-    if (!user) {
-      throw new NotFoundException('User not found');
-    }
+    const tableName = this.getTableName(objectApiName);
     
-    // Get object definition with authorization settings
-    const objectDefModel = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName })
-      .withGraphFetched('fields');
+    // Check if table has ownerId column
+    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
     
-    if (!objectDefModel) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
-    
-    // Check if user has create permission
-    const canCreate = await this.authService.canCreate(objectDefModel, user);
-    if (!canCreate) {
-      throw new NotFoundException('You do not have permission to create records of this object');
-    }
-    
-    // Filter data to only editable fields
-    const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
-    
-    // Ensure model is registered
-    await this.ensureModelRegistered(resolvedTenantId, objectApiName);
-    
-    // Use Objection model
-    const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
-    const recordData = {
-      ...editableData,
-      ownerId: userId, // Auto-set owner
+    const recordData: any = {
+      id: knex.raw('(UUID())'),
+      ...data,
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now(),
     };
-    const record = await boundModel.query().insert(recordData);
-    return record;
+    
+    if (hasOwner) {
+      recordData.ownerId = userId;
+    }
+    
+    const [id] = await knex(tableName).insert(recordData);
+    
+    return knex(tableName).where({ id }).first();
   }
 
   async updateRecord(
@@ -645,54 +226,18 @@ export class ObjectService {
     data: any,
     userId: string,
   ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
-    // Get user with roles and permissions
-    const user = await User.query(knex)
-      .findById(userId)
-      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
-    
-    if (!user) {
-      throw new NotFoundException('User not found');
-    }
-    
-    // Get object definition with authorization settings
-    const objectDefModel = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName })
-      .withGraphFetched('fields');
-    
-    if (!objectDefModel) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
+    // Verify object exists and user has access
+    await this.getRecord(tenantId, objectApiName, recordId, userId);
     
     const tableName = this.getTableName(objectApiName);
 
-    // Get existing record
-    const existingRecord = await knex(tableName).where({ id: recordId }).first();
-    if (!existingRecord) {
-      throw new NotFoundException('Record not found');
-    }
+    await knex(tableName)
+      .where({ id: recordId })
+      .update({ ...data, updated_at: knex.fn.now() });
     
-    // Check if user can update this record
-    await this.authService.assertCanPerformAction('update', objectDefModel, existingRecord, user, knex);
-    
-    // Filter data to only editable fields
-    const editableData = await this.authService.filterEditableFields(data, objectDefModel.fields, user);
-    
-    // Remove system fields
-    delete editableData.id;
-    delete editableData.ownerId;
-    delete editableData.created_at;
-    delete editableData.tenantId;
-
-    // Ensure model is registered
-    await this.ensureModelRegistered(resolvedTenantId, objectApiName);
-
-    // Use Objection model
-    const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
-    await boundModel.query().where({ id: recordId }).update(editableData);
-    return boundModel.query().where({ id: recordId }).first();
+    return knex(tableName).where({ id: recordId }).first();
   }
 
   async deleteRecord(
@@ -701,201 +246,14 @@ export class ObjectService {
     recordId: string,
     userId: string,
   ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
+    const knex = await this.tenantDbService.getTenantKnex(tenantId);
     
-    // Get user with roles and permissions
-    const user = await User.query(knex)
-      .findById(userId)
-      .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
-    
-    if (!user) {
-      throw new NotFoundException('User not found');
-    }
-    
-    // Get object definition with authorization settings
-    const objectDefModel = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
-    
-    if (!objectDefModel) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
+    // Verify object exists and user has access
+    await this.getRecord(tenantId, objectApiName, recordId, userId);
     
     const tableName = this.getTableName(objectApiName);
 
-    // Get existing record
-    const existingRecord = await knex(tableName).where({ id: recordId }).first();
-    if (!existingRecord) {
-      throw new NotFoundException('Record not found');
-    }
-    
-    // Check if user can delete this record
-    await this.authService.assertCanPerformAction('delete', objectDefModel, existingRecord, user, knex);
-
-    // Ensure model is registered
-    await this.ensureModelRegistered(resolvedTenantId, objectApiName);
-
-    // Use Objection model
-    const boundModel = await this.modelService.getBoundModel(resolvedTenantId, objectApiName);
-    await boundModel.query().where({ id: recordId }).delete();
-    
-    return { success: true };
-  }
-
-  async getFieldPermissions(tenantId: string, objectId: string) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Get all field permissions for this object's fields
-    const permissions = await knex('role_field_permissions as rfp')
-      .join('field_definitions as fd', 'fd.id', 'rfp.fieldDefinitionId')
-      .where('fd.objectDefinitionId', objectId)
-      .select('rfp.*');
-    
-    return permissions;
-  }
-
-  async updateFieldPermission(
-    tenantId: string,
-    roleId: string,
-    fieldDefinitionId: string,
-    canRead: boolean,
-    canEdit: boolean,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Check if permission already exists
-    const existing = await knex('role_field_permissions')
-      .where({ roleId, fieldDefinitionId })
-      .first();
-    
-    if (existing) {
-      // Update existing permission
-      await knex('role_field_permissions')
-        .where({ roleId, fieldDefinitionId })
-        .update({
-          canRead,
-          canEdit,
-          updated_at: knex.fn.now(),
-        });
-    } else {
-      // Create new permission
-      await knex('role_field_permissions').insert({
-        id: knex.raw('(UUID())'),
-        roleId,
-        fieldDefinitionId,
-        canRead,
-        canEdit,
-        created_at: knex.fn.now(),
-        updated_at: knex.fn.now(),
-      });
-    }
-    
-    return { success: true };
-  }
-
-  async getObjectPermissions(
-    tenantId: string,
-    objectApiName: string,
-    roleId: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Get object definition
-    const objectDef = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
-    
-    if (!objectDef) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
-    
-    // Get role object permissions
-    const permission = await knex('role_object_permissions')
-      .where({ roleId, objectDefinitionId: objectDef.id })
-      .first();
-    
-    if (!permission) {
-      // Return default permissions (all false)
-      return {
-        canCreate: false,
-        canRead: false,
-        canEdit: false,
-        canDelete: false,
-        canViewAll: false,
-        canModifyAll: false,
-      };
-    }
-    
-    return {
-      canCreate: Boolean(permission.canCreate),
-      canRead: Boolean(permission.canRead),
-      canEdit: Boolean(permission.canEdit),
-      canDelete: Boolean(permission.canDelete),
-      canViewAll: Boolean(permission.canViewAll),
-      canModifyAll: Boolean(permission.canModifyAll),
-    };
-  }
-
-  async updateObjectPermissions(
-    tenantId: string,
-    objectApiName: string,
-    data: {
-      roleId: string;
-      canCreate: boolean;
-      canRead: boolean;
-      canEdit: boolean;
-      canDelete: boolean;
-      canViewAll: boolean;
-      canModifyAll: boolean;
-    },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Get object definition
-    const objectDef = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
-    
-    if (!objectDef) {
-      throw new NotFoundException(`Object ${objectApiName} not found`);
-    }
-    
-    // Check if permission already exists
-    const existing = await knex('role_object_permissions')
-      .where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
-      .first();
-    
-    if (existing) {
-      // Update existing permission
-      await knex('role_object_permissions')
-        .where({ roleId: data.roleId, objectDefinitionId: objectDef.id })
-        .update({
-          canCreate: data.canCreate,
-          canRead: data.canRead,
-          canEdit: data.canEdit,
-          canDelete: data.canDelete,
-          canViewAll: data.canViewAll,
-          canModifyAll: data.canModifyAll,
-          updated_at: knex.fn.now(),
-        });
-    } else {
-      // Create new permission
-      await knex('role_object_permissions').insert({
-        id: knex.raw('(UUID())'),
-        roleId: data.roleId,
-        objectDefinitionId: objectDef.id,
-        canCreate: data.canCreate,
-        canRead: data.canRead,
-        canEdit: data.canEdit,
-        canDelete: data.canDelete,
-        canViewAll: data.canViewAll,
-        canModifyAll: data.canModifyAll,
-        created_at: knex.fn.now(),
-        updated_at: knex.fn.now(),
-      });
-    }
+    await knex(tableName).where({ id: recordId }).delete();
     
     return { success: true };
   }

backend/src/object/setup-object.controller.ts

@@ -2,8 +2,6 @@ import {
   Controller,
   Get,
   Post,
-  Patch,
-  Put,
   Param,
   Body,
   UseGuards,
@@ -12,7 +10,6 @@ import { ObjectService } from './object.service';
 import { FieldMapperService } from './field-mapper.service';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 import { TenantId } from '../tenant/tenant.decorator';
-import { TenantDatabaseService } from '../tenant/tenant-database.service';
 
 @Controller('setup/objects')
 @UseGuards(JwtAuthGuard)
@@ -20,7 +17,6 @@ export class SetupObjectController {
   constructor(
     private objectService: ObjectService,
     private fieldMapperService: FieldMapperService,
-    private tenantDbService: TenantDatabaseService,
   ) {}
 
   @Get()
@@ -33,8 +29,7 @@ export class SetupObjectController {
     @TenantId() tenantId: string,
     @Param('objectApiName') objectApiName: string,
   ) {
-    const objectDef = await this.objectService.getObjectDefinition(tenantId, objectApiName);
-    return this.fieldMapperService.mapObjectDefinitionToDTO(objectDef);
+    return this.objectService.getObjectDefinition(tenantId, objectApiName);
   }
 
   @Get(':objectApiName/ui-config')
@@ -63,64 +58,10 @@ export class SetupObjectController {
     @Param('objectApiName') objectApiName: string,
     @Body() data: any,
   ) {
-    const field = await this.objectService.createFieldDefinition(
+    return this.objectService.createFieldDefinition(
       tenantId,
       objectApiName,
       data,
     );
-    // Map the created field to frontend format
-    return this.fieldMapperService.mapFieldToDTO(field);
-  }
-
-  @Patch(':objectApiName')
-  async updateObjectDefinition(
-    @TenantId() tenantId: string,
-    @Param('objectApiName') objectApiName: string,
-    @Body() data: any,
-  ) {
-    return this.objectService.updateObjectDefinition(tenantId, objectApiName, data);
-  }
-
-  @Get(':objectId/field-permissions')
-  async getFieldPermissions(
-    @TenantId() tenantId: string,
-    @Param('objectId') objectId: string,
-  ) {
-    return this.objectService.getFieldPermissions(tenantId, objectId);
-  }
-
-  @Put(':objectId/field-permissions')
-  async updateFieldPermission(
-    @TenantId() tenantId: string,
-    @Param('objectId') objectId: string,
-    @Body() data: { roleId: string; fieldDefinitionId: string; canRead: boolean; canEdit: boolean },
-  ) {
-    return this.objectService.updateFieldPermission(tenantId, data.roleId, data.fieldDefinitionId, data.canRead, data.canEdit);
-  }
-
-  @Get(':objectApiName/permissions/:roleId')
-  async getObjectPermissions(
-    @TenantId() tenantId: string,
-    @Param('objectApiName') objectApiName: string,
-    @Param('roleId') roleId: string,
-  ) {
-    return this.objectService.getObjectPermissions(tenantId, objectApiName, roleId);
-  }
-
-  @Put(':objectApiName/permissions')
-  async updateObjectPermissions(
-    @TenantId() tenantId: string,
-    @Param('objectApiName') objectApiName: string,
-    @Body() data: { 
-      roleId: string;
-      canCreate: boolean;
-      canRead: boolean;
-      canEdit: boolean;
-      canDelete: boolean;
-      canViewAll: boolean;
-      canModifyAll: boolean;
-    },
-  ) {
-    return this.objectService.updateObjectPermissions(tenantId, objectApiName, data);
   }
 }

backend/src/rbac/ability.factory.ts

@@ -1,198 +0,0 @@
-import { AbilityBuilder, PureAbility, AbilityClass } from '@casl/ability';
-import { Injectable } from '@nestjs/common';
-import { User } from '../models/user.model';
-import { RoleObjectPermission } from '../models/role-object-permission.model';
-import { RoleFieldPermission } from '../models/role-field-permission.model';
-import { RecordShare } from '../models/record-share.model';
-
-// Define action types
-export type Action = 'create' | 'read' | 'update' | 'delete' | 'view_all' | 'modify_all';
-
-// Define subject types - can be string (object API name) or actual object with fields
-export type Subject = string | { objectApiName: string; ownerId?: string; id?: string; [key: string]: any };
-
-// Define field actions
-export type FieldAction = 'read' | 'edit';
-
-export type AppAbility = PureAbility<[Action, Subject], { field?: string }>;
-
-@Injectable()
-export class AbilityFactory {
-  /**
-   * Build CASL ability for a user based on their roles and permissions
-   * This aggregates permissions from all roles the user has
-   */
-  async defineAbilityFor(
-    user: User & { roles?: Array<{ objectPermissions?: RoleObjectPermission[]; fieldPermissions?: RoleFieldPermission[] }> },
-    recordShares?: RecordShare[],
-  ): Promise<AppAbility> {
-    const { can, cannot, build } = new AbilityBuilder<AppAbility>(PureAbility as AbilityClass<AppAbility>);
-
-    if (!user.roles || user.roles.length === 0) {
-      // No roles = no permissions
-      return build();
-    }
-
-    // Aggregate object permissions from all roles
-    const objectPermissionsMap = new Map<string, {
-      canCreate: boolean;
-      canRead: boolean;
-      canEdit: boolean;
-      canDelete: boolean;
-      canViewAll: boolean;
-      canModifyAll: boolean;
-    }>();
-
-    // Aggregate field permissions from all roles
-    const fieldPermissionsMap = new Map<string, {
-      canRead: boolean;
-      canEdit: boolean;
-    }>();
-
-    // Process all roles
-    for (const role of user.roles) {
-      // Aggregate object permissions
-      if (role.objectPermissions) {
-        for (const perm of role.objectPermissions) {
-          const existing = objectPermissionsMap.get(perm.objectDefinitionId) || {
-            canCreate: false,
-            canRead: false,
-            canEdit: false,
-            canDelete: false,
-            canViewAll: false,
-            canModifyAll: false,
-          };
-
-          // Union of permissions (if any role grants it, user has it)
-          objectPermissionsMap.set(perm.objectDefinitionId, {
-            canCreate: existing.canCreate || perm.canCreate,
-            canRead: existing.canRead || perm.canRead,
-            canEdit: existing.canEdit || perm.canEdit,
-            canDelete: existing.canDelete || perm.canDelete,
-            canViewAll: existing.canViewAll || perm.canViewAll,
-            canModifyAll: existing.canModifyAll || perm.canModifyAll,
-          });
-        }
-      }
-
-      // Aggregate field permissions
-      if (role.fieldPermissions) {
-        for (const perm of role.fieldPermissions) {
-          const existing = fieldPermissionsMap.get(perm.fieldDefinitionId) || {
-            canRead: false,
-            canEdit: false,
-          };
-
-          fieldPermissionsMap.set(perm.fieldDefinitionId, {
-            canRead: existing.canRead || perm.canRead,
-            canEdit: existing.canEdit || perm.canEdit,
-          });
-        }
-      }
-    }
-
-    // Convert aggregated permissions to CASL rules
-    for (const [objectId, perms] of objectPermissionsMap) {
-      // Create permission
-      if (perms.canCreate) {
-        can('create', objectId);
-      }
-
-      // Read permission
-      if (perms.canRead) {
-        can('read', objectId);
-      }
-
-      // View all permission (can see all records regardless of ownership)
-      if (perms.canViewAll) {
-        can('view_all', objectId);
-      }
-
-      // Edit permission
-      if (perms.canEdit) {
-        can('update', objectId);
-      }
-
-      // Modify all permission (can edit all records regardless of ownership)
-      if (perms.canModifyAll) {
-        can('modify_all', objectId);
-      }
-
-      // Delete permission
-      if (perms.canDelete) {
-        can('delete', objectId);
-      }
-    }
-
-    // Add record sharing permissions
-    if (recordShares) {
-      for (const share of recordShares) {
-        // Only add if share is active (not expired, not revoked)
-        const now = new Date();
-        const isExpired = share.expiresAt && share.expiresAt < now;
-        const isRevoked = share.revokedAt !== null;
-
-        if (!isExpired && !isRevoked) {
-          // Note: Record-level sharing will be checked in authorization service
-          // CASL abilities are primarily for object-level permissions
-          // Individual record access is validated in applyScopeToQuery
-        }
-      }
-    }
-
-    return build();
-  }
-
-  /**
-   * Check if user can access a specific field
-   * Returns true if user has permission or if no restriction exists
-   */
-  canAccessField(
-    fieldDefinitionId: string,
-    action: FieldAction,
-    user: User & { roles?: Array<{ fieldPermissions?: RoleFieldPermission[] }> },
-  ): boolean {
-    if (!user.roles || user.roles.length === 0) {
-      return false;
-    }
-
-    // Collect all field permissions from all roles
-    const allFieldPermissions: RoleFieldPermission[] = [];
-    for (const role of user.roles) {
-      if (role.fieldPermissions) {
-        allFieldPermissions.push(...role.fieldPermissions);
-      }
-    }
-
-    // If there are NO field permissions configured at all, allow by default
-    if (allFieldPermissions.length === 0) {
-      return true;
-    }
-
-    // If field permissions exist, check for explicit grants (union of all roles)
-    for (const role of user.roles) {
-      if (role.fieldPermissions) {
-        const fieldPerm = role.fieldPermissions.find(fp => fp.fieldDefinitionId === fieldDefinitionId);
-        if (fieldPerm) {
-          if (action === 'read' && fieldPerm.canRead) return true;
-          if (action === 'edit' && fieldPerm.canEdit) return true;
-        }
-      }
-    }
-
-    // Field permissions exist but this field is not explicitly granted → deny
-    return false;
-  }
-
-  /**
-   * Filter fields based on user permissions
-   * Returns array of field IDs the user can access with the specified action
-   */
-  filterFields(
-    fieldDefinitionIds: string[],
-    action: FieldAction,
-    user: User & { roles?: Array<{ fieldPermissions?: RoleFieldPermission[] }> },
-  ): string[] {
-    return fieldDefinitionIds.filter(fieldId => this.canAccessField(fieldId, action, user));
-  }
-}

backend/src/rbac/authorization.service.ts

@@ -1,282 +0,0 @@
-import { Injectable, ForbiddenException } from '@nestjs/common';
-import { Knex } from 'knex';
-import { User } from '../models/user.model';
-import { ObjectDefinition } from '../models/object-definition.model';
-import { FieldDefinition } from '../models/field-definition.model';
-import { RecordShare } from '../models/record-share.model';
-import { AbilityFactory, AppAbility, Action } from './ability.factory';
-import { DynamicModelFactory } from '../object/models/dynamic-model.factory';
-import { subject } from '@casl/ability';
-
-@Injectable()
-export class AuthorizationService {
-  constructor(private abilityFactory: AbilityFactory) {}
-
-  /**
-   * Apply authorization scope to a query based on OWD and user permissions
-   * This determines which records the user can see
-   * Modifies the query in place and returns void
-   */
-  async applyScopeToQuery<T = any>(
-    query: any, // Accept both Knex and Objection query builders
-    objectDef: ObjectDefinition,
-    user: User & { roles?: any[] },
-    action: Action,
-    knex: Knex,
-  ): Promise<void> {
-    // Get user's ability
-    const recordShares = await this.getActiveRecordShares(objectDef.id, user.id, knex);
-    const ability = await this.abilityFactory.defineAbilityFor(user, recordShares);
-
-    // Check if user has the base permission for this action
-    // Use object ID, not API name, since permissions are stored by object ID
-    if (!ability.can(action, objectDef.id)) {
-      // No permission at all - return empty result
-      query.where(knex.raw('1 = 0'));
-      return;
-    }
-
-    // Check special permissions
-    const hasViewAll = ability.can('view_all', objectDef.id);
-    const hasModifyAll = ability.can('modify_all', objectDef.id);
-
-    // If user has view_all or modify_all, they can see all records
-    if (hasViewAll || hasModifyAll) {
-      // No filtering needed
-      return;
-    }
-
-    // Apply OWD (Org-Wide Default) restrictions
-    switch (objectDef.orgWideDefault) {
-      case 'public_read_write':
-        // Everyone can see all records
-        return;
-
-      case 'public_read':
-        // Everyone can see all records (write operations checked separately)
-        return;
-
-      case 'private':
-      default:
-        // Only owner and explicitly shared records
-        await this.applyPrivateScope(query, objectDef, user, recordShares, knex);
-        return;
-    }
-  }
-
-  /**
-   * Apply private scope: owner + shared records
-   */
-  private async applyPrivateScope<T = any>(
-    query: any, // Accept both Knex and Objection query builders
-    objectDef: ObjectDefinition,
-    user: User,
-    recordShares: RecordShare[],
-    knex: Knex,
-  ): Promise<void> {
-    const tableName = this.getTableName(objectDef.apiName);
-    
-    // Check if table has ownerId column
-    const hasOwner = await knex.schema.hasColumn(tableName, 'ownerId');
-
-    if (!hasOwner && recordShares.length === 0) {
-      // No ownership and no shares - user can't see anything
-      query.where(knex.raw('1 = 0'));
-      return;
-    }
-
-    // Build conditions: ownerId = user OR record shared with user
-    query.where((builder) => {
-      if (hasOwner) {
-        builder.orWhere(`${tableName}.ownerId`, user.id);
-      }
-
-      if (recordShares.length > 0) {
-        const sharedRecordIds = recordShares.map(share => share.recordId);
-        builder.orWhereIn(`${tableName}.id`, sharedRecordIds);
-      }
-    });
-  }
-
-  /**
-   * Check if user can perform action on a specific record
-   */
-  async canPerformAction(
-    action: Action,
-    objectDef: ObjectDefinition,
-    record: any,
-    user: User & { roles?: any[] },
-    knex: Knex,
-  ): Promise<boolean> {
-    const recordShares = await this.getActiveRecordShares(objectDef.id, user.id, knex);
-    const ability = await this.abilityFactory.defineAbilityFor(user, recordShares);
-
-    // Check base permission - use object ID not API name
-    if (!ability.can(action, objectDef.id)) {
-      return false;
-    }
-
-    // Check special permissions - use object ID not API name
-    const hasViewAll = ability.can('view_all', objectDef.id);
-    const hasModifyAll = ability.can('modify_all', objectDef.id);
-
-    // canViewAll only grants read access to all records
-    if (action === 'read' && hasViewAll) {
-      return true;
-    }
-
-    // canModifyAll grants edit/delete access to all records
-    if ((action === 'update' || action === 'delete') && hasModifyAll) {
-      return true;
-    }
-
-    // Check OWD
-    switch (objectDef.orgWideDefault) {
-      case 'public_read_write':
-        return true;
-
-      case 'public_read':
-        if (action === 'read') return true;
-        // For write actions, check ownership
-        return record.ownerId === user.id;
-
-      case 'private':
-      default:
-        // Check ownership
-        if (record.ownerId === user.id) return true;
-
-        // Check if record is shared with user
-        const share = recordShares.find(s => s.recordId === record.id);
-        if (share) {
-          if (action === 'read' && share.accessLevel.canRead) return true;
-          if (action === 'update' && share.accessLevel.canEdit) return true;
-          if (action === 'delete' && share.accessLevel.canDelete) return true;
-        }
-
-        return false;
-    }
-  }
-
-  /**
-   * Filter data based on field-level permissions
-   * Removes fields the user cannot read
-   */
-  async filterReadableFields(
-    data: any,
-    fields: FieldDefinition[],
-    user: User & { roles?: any[] },
-  ): Promise<any> {
-    const filtered: any = {};
-
-    // Always include id - it's required for navigation and record identification
-    if (data.id !== undefined) {
-      filtered.id = data.id;
-    }
-
-    for (const field of fields) {
-      if (this.abilityFactory.canAccessField(field.id, 'read', user)) {
-        if (data[field.apiName] !== undefined) {
-          filtered[field.apiName] = data[field.apiName];
-        }
-        
-        // For lookup fields, also include the related object (e.g., ownerId -> owner)
-        if (field.type === 'LOOKUP') {
-          const relationName = DynamicModelFactory.getRelationName(field.apiName);
-          if (data[relationName] !== undefined) {
-            filtered[relationName] = data[relationName];
-          }
-        }
-      }
-    }
-
-    return filtered;
-  }
-
-  /**
-   * Filter data based on field-level permissions
-   * Removes fields the user cannot edit
-   */
-  async filterEditableFields(
-    data: any,
-    fields: FieldDefinition[],
-    user: User & { roles?: any[] },
-  ): Promise<any> {
-    const filtered: any = {};
-
-    for (const field of fields) {
-      if (this.abilityFactory.canAccessField(field.id, 'edit', user)) {
-        if (data[field.apiName] !== undefined) {
-          filtered[field.apiName] = data[field.apiName];
-        }
-      }
-    }
-
-    return filtered;
-  }
-
-  /**
-   * Get active record shares for a user on an object
-   */
-  private async getActiveRecordShares(
-    objectDefinitionId: string,
-    userId: string,
-    knex: Knex,
-  ): Promise<RecordShare[]> {
-    const now = new Date();
-
-    return await RecordShare.query(knex)
-      .where('objectDefinitionId', objectDefinitionId)
-      .where('granteeUserId', userId)
-      .whereNull('revokedAt')
-      .where((builder) => {
-        builder.whereNull('expiresAt').orWhere('expiresAt', '>', now);
-      });
-  }
-
-  /**
-   * Check if user has permission to create records
-   */
-  async canCreate(
-    objectDef: ObjectDefinition,
-    user: User & { roles?: any[] },
-  ): Promise<boolean> {
-    const ability = await this.abilityFactory.defineAbilityFor(user, []);
-    return ability.can('create', objectDef.id);
-  }
-
-  /**
-   * Throw exception if user cannot perform action
-   */
-  async assertCanPerformAction(
-    action: Action,
-    objectDef: ObjectDefinition,
-    record: any,
-    user: User & { roles?: any[] },
-    knex: Knex,
-  ): Promise<void> {
-    const can = await this.canPerformAction(action, objectDef, record, user, knex);
-    if (!can) {
-      throw new ForbiddenException(`You do not have permission to ${action} this record`);
-    }
-  }
-
-  /**
-   * Get table name from API name
-   */
-  private getTableName(apiName: string): string {
-    // Convert CamelCase to snake_case and pluralize
-    const snakeCase = apiName
-      .replace(/([A-Z])/g, '_$1')
-      .toLowerCase()
-      .replace(/^_/, '');
-    
-    // Simple pluralization
-    if (snakeCase.endsWith('y')) {
-      return snakeCase.slice(0, -1) + 'ies';
-    } else if (snakeCase.endsWith('s')) {
-      return snakeCase;
-    } else {
-      return snakeCase + 's';
-    }
-  }
-}

backend/src/rbac/dto/create-record-share.dto.ts

@@ -1,19 +0,0 @@
-import { IsString, IsBoolean, IsOptional, IsDateString } from 'class-validator';
-
-export class CreateRecordShareDto {
-  @IsString()
-  granteeUserId: string;
-
-  @IsBoolean()
-  canRead: boolean;
-
-  @IsBoolean()
-  canEdit: boolean;
-
-  @IsBoolean()
-  canDelete: boolean;
-
-  @IsOptional()
-  @IsDateString()
-  expiresAt?: string;
-}

backend/src/rbac/rbac.module.ts

@@ -1,16 +1,8 @@
 import { Module } from '@nestjs/common';
 import { RbacService } from './rbac.service';
-import { AbilityFactory } from './ability.factory';
-import { AuthorizationService } from './authorization.service';
-import { SetupRolesController } from './setup-roles.controller';
-import { SetupUsersController } from './setup-users.controller';
-import { RecordSharingController } from './record-sharing.controller';
-import { TenantModule } from '../tenant/tenant.module';
 
 @Module({
-  imports: [TenantModule],
-  controllers: [SetupRolesController, SetupUsersController, RecordSharingController],
-  providers: [RbacService, AbilityFactory, AuthorizationService],
-  exports: [RbacService, AbilityFactory, AuthorizationService],
+  providers: [RbacService],
+  exports: [RbacService],
 })
 export class RbacModule {}

backend/src/rbac/record-sharing.controller.ts

@@ -1,324 +0,0 @@
-import {
-  Controller,
-  Get,
-  Post,
-  Delete,
-  Param,
-  Body,
-  UseGuards,
-  ForbiddenException,
-} from '@nestjs/common';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { TenantId } from '../tenant/tenant.decorator';
-import { CurrentUser } from '../auth/current-user.decorator';
-import { TenantDatabaseService } from '../tenant/tenant-database.service';
-import { RecordShare } from '../models/record-share.model';
-import { ObjectDefinition } from '../models/object-definition.model';
-import { User } from '../models/user.model';
-import { AuthorizationService } from './authorization.service';
-import { CreateRecordShareDto } from './dto/create-record-share.dto';
-
-@Controller('runtime/objects/:objectApiName/records/:recordId/shares')
-@UseGuards(JwtAuthGuard)
-export class RecordSharingController {
-  constructor(
-    private tenantDbService: TenantDatabaseService,
-    private authService: AuthorizationService,
-  ) {}
-
-  @Get()
-  async getRecordShares(
-    @TenantId() tenantId: string,
-    @Param('objectApiName') objectApiName: string,
-    @Param('recordId') recordId: string,
-    @CurrentUser() currentUser: any,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-
-    // Get object definition
-    const objectDef = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
-
-    if (!objectDef) {
-      throw new Error('Object not found');
-    }
-
-    // Get the record to check ownership
-    const tableName = this.getTableName(objectDef.apiName);
-    const record = await knex(tableName)
-      .where({ id: recordId })
-      .first();
-
-    if (!record) {
-      throw new Error('Record not found');
-    }
-
-    // Only owner can view shares
-    if (record.ownerId !== currentUser.userId) {
-      // Check if user has modify all permission
-      const user: any = await User.query(knex)
-        .findById(currentUser.userId)
-        .withGraphFetched('roles.objectPermissions');
-
-      if (!user) {
-        throw new ForbiddenException('User not found');
-      }
-
-      const hasModifyAll = user.roles?.some(role =>
-        role.objectPermissions?.some(
-          perm => perm.objectDefinitionId === objectDef.id && perm.canModifyAll
-        )
-      );
-
-      if (!hasModifyAll) {
-        throw new ForbiddenException('Only the record owner or users with Modify All permission can view shares');
-      }
-    }
-
-    // Get all active shares for this record
-    const shares = await RecordShare.query(knex)
-      .where({ objectDefinitionId: objectDef.id, recordId })
-      .whereNull('revokedAt')
-      .where(builder => {
-        builder.whereNull('expiresAt').orWhere('expiresAt', '>', new Date());
-      })
-      .withGraphFetched('[granteeUser]')
-      .orderBy('createdAt', 'desc');
-
-    return shares;
-  }
-
-  @Post()
-  async createRecordShare(
-    @TenantId() tenantId: string,
-    @Param('objectApiName') objectApiName: string,
-    @Param('recordId') recordId: string,
-    @CurrentUser() currentUser: any,
-    @Body() data: CreateRecordShareDto,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-
-    // Get object definition
-    const objectDef = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
-
-    if (!objectDef) {
-      throw new Error('Object not found');
-    }
-
-    // Get the record to check ownership
-    const tableName = this.getTableName(objectDef.apiName);
-    const record = await knex(tableName)
-      .where({ id: recordId })
-      .first();
-
-    if (!record) {
-      throw new Error('Record not found');
-    }
-
-    // Check if user can share - either owner or has modify permissions
-    const canShare = await this.canUserShareRecord(
-      currentUser.userId,
-      record,
-      objectDef,
-      knex,
-    );
-
-    if (!canShare) {
-      throw new ForbiddenException('You do not have permission to share this record');
-    }
-
-    // Cannot share with self
-    if (data.granteeUserId === currentUser.userId) {
-      throw new Error('Cannot share record with yourself');
-    }
-
-    // Check if share already exists
-    const existingShare = await RecordShare.query(knex)
-      .where({
-        objectDefinitionId: objectDef.id,
-        recordId,
-        granteeUserId: data.granteeUserId,
-      })
-      .whereNull('revokedAt')
-      .first();
-
-    if (existingShare) {
-      // Update existing share
-      const updated = await RecordShare.query(knex)
-        .patchAndFetchById(existingShare.id, {
-          accessLevel: {
-            canRead: data.canRead,
-            canEdit: data.canEdit,
-            canDelete: data.canDelete,
-          },
-          // Convert ISO string to MySQL datetime format
-          expiresAt: data.expiresAt 
-            ? knex.raw('?', [new Date(data.expiresAt).toISOString().slice(0, 19).replace('T', ' ')]) 
-            : null,
-        } as any);
-
-      return RecordShare.query(knex)
-        .findById(updated.id)
-        .withGraphFetched('[granteeUser]');
-    }
-
-    // Create new share
-    const share = await RecordShare.query(knex).insertAndFetch({
-      objectDefinitionId: objectDef.id,
-      recordId,
-      granteeUserId: data.granteeUserId,
-      grantedByUserId: currentUser.userId,
-      accessLevel: {
-        canRead: data.canRead,
-        canEdit: data.canEdit,
-        canDelete: data.canDelete,
-      },
-      // Convert ISO string to MySQL datetime format: YYYY-MM-DD HH:MM:SS
-      expiresAt: data.expiresAt 
-        ? knex.raw('?', [new Date(data.expiresAt).toISOString().slice(0, 19).replace('T', ' ')]) 
-        : null,
-    } as any);
-
-    return RecordShare.query(knex)
-      .findById(share.id)
-      .withGraphFetched('[granteeUser]');
-  }
-
-  @Delete(':shareId')
-  async deleteRecordShare(
-    @TenantId() tenantId: string,
-    @Param('objectApiName') objectApiName: string,
-    @Param('recordId') recordId: string,
-    @Param('shareId') shareId: string,
-    @CurrentUser() currentUser: any,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-
-    // Get object definition
-    const objectDef = await ObjectDefinition.query(knex)
-      .findOne({ apiName: objectApiName });
-
-    if (!objectDef) {
-      throw new Error('Object not found');
-    }
-
-    // Get the record to check ownership
-    const tableName = this.getTableName(objectDef.apiName);
-    const record = await knex(tableName)
-      .where({ id: recordId })
-      .first();
-
-    if (!record) {
-      throw new Error('Record not found');
-    }
-
-    // Only owner can revoke shares
-    if (record.ownerId !== currentUser.userId) {
-      // Check if user has modify all permission
-      const user: any = await User.query(knex)
-        .findById(currentUser.userId)
-        .withGraphFetched('roles.objectPermissions');
-
-      if (!user) {
-        throw new ForbiddenException('User not found');
-      }
-
-      const hasModifyAll = user.roles?.some(role =>
-        role.objectPermissions?.some(
-          perm => perm.objectDefinitionId === objectDef.id && perm.canModifyAll
-        )
-      );
-
-      if (!hasModifyAll) {
-        throw new ForbiddenException('Only the record owner or users with Modify All permission can revoke shares');
-      }
-    }
-
-    // Revoke the share (soft delete)
-    await RecordShare.query(knex)
-      .patchAndFetchById(shareId, {
-        revokedAt: knex.fn.now() as any,
-      });
-
-    return { success: true };
-  }
-
-  private async canUserShareRecord(
-    userId: string,
-    record: any,
-    objectDef: ObjectDefinition,
-    knex: any,
-  ): Promise<boolean> {
-    // Owner can always share
-    if (record.ownerId === userId) {
-      return true;
-    }
-
-    // Check if user has modify all or edit permissions
-    const user: any = await User.query(knex)
-      .findById(userId)
-      .withGraphFetched('roles.objectPermissions');
-
-    if (!user) {
-      return false;
-    }
-
-    // Check for canModifyAll permission
-    const hasModifyAll = user.roles?.some(role =>
-      role.objectPermissions?.some(
-        perm => perm.objectDefinitionId === objectDef.id && perm.canModifyAll
-      )
-    );
-
-    if (hasModifyAll) {
-      return true;
-    }
-
-    // Check for canEdit permission (user needs edit to share)
-    const hasEdit = user.roles?.some(role =>
-      role.objectPermissions?.some(
-        perm => perm.objectDefinitionId === objectDef.id && perm.canEdit
-      )
-    );
-
-    // If user has edit permission, check if they can actually edit this record
-    // by using the authorization service
-    if (hasEdit) {
-      try {
-        await this.authService.assertCanPerformAction(
-          'update',
-          objectDef,
-          record,
-          user,
-          knex,
-        );
-        return true;
-      } catch {
-        return false;
-      }
-    }
-
-    return false;
-  }
-
-  private getTableName(apiName: string): string {
-    // Convert CamelCase to snake_case and pluralize
-    const snakeCase = apiName
-      .replace(/([A-Z])/g, '_$1')
-      .toLowerCase()
-      .replace(/^_/, '');
-    
-    // Simple pluralization
-    if (snakeCase.endsWith('y')) {
-      return snakeCase.slice(0, -1) + 'ies';
-    } else if (snakeCase.endsWith('s')) {
-      return snakeCase + 'es';
-    } else {
-      return snakeCase + 's';
-    }
-  }
-}

backend/src/rbac/setup-roles.controller.ts

@@ -1,141 +0,0 @@
-import {
-  Controller,
-  Get,
-  Post,
-  Patch,
-  Delete,
-  Param,
-  Body,
-  UseGuards,
-} from '@nestjs/common';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { TenantId } from '../tenant/tenant.decorator';
-import { TenantDatabaseService } from '../tenant/tenant-database.service';
-import { Role } from '../models/role.model';
-
-@Controller('setup/roles')
-@UseGuards(JwtAuthGuard)
-export class SetupRolesController {
-  constructor(private tenantDbService: TenantDatabaseService) {}
-
-  @Get()
-  async getRoles(@TenantId() tenantId: string) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    return await Role.query(knex).select('*').orderBy('name', 'asc');
-  }
-
-  @Get(':id')
-  async getRole(
-    @TenantId() tenantId: string,
-    @Param('id') id: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    return await Role.query(knex).findById(id).withGraphFetched('users');
-  }
-
-  @Post()
-  async createRole(
-    @TenantId() tenantId: string,
-    @Body() data: { name: string; description?: string; guardName?: string },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    const role = await Role.query(knex).insert({
-      name: data.name,
-      description: data.description,
-      guardName: data.guardName || 'tenant',
-    });
-    
-    return role;
-  }
-
-  @Patch(':id')
-  async updateRole(
-    @TenantId() tenantId: string,
-    @Param('id') id: string,
-    @Body() data: { name?: string; description?: string; guardName?: string },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    const updateData: any = {};
-    
-    if (data.name) updateData.name = data.name;
-    if (data.description !== undefined) updateData.description = data.description;
-    if (data.guardName) updateData.guardName = data.guardName;
-    
-    const role = await Role.query(knex).patchAndFetchById(id, updateData);
-    return role;
-  }
-
-  @Delete(':id')
-  async deleteRole(
-    @TenantId() tenantId: string,
-    @Param('id') id: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Delete role user assignments first
-    await knex('user_roles').where({ roleId: id }).delete();
-    
-    // Delete role permissions
-    await knex('role_permissions').where({ roleId: id }).delete();
-    await knex('role_object_permissions').where({ roleId: id }).delete();
-    
-    // Delete the role
-    await Role.query(knex).deleteById(id);
-    
-    return { success: true };
-  }
-
-  @Post(':roleId/users')
-  async addUserToRole(
-    @TenantId() tenantId: string,
-    @Param('roleId') roleId: string,
-    @Body() data: { userId: string },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Check if assignment already exists
-    const existing = await knex('user_roles')
-      .where({ userId: data.userId, roleId })
-      .first();
-    
-    if (existing) {
-      return { success: true, message: 'User already assigned' };
-    }
-    
-    await knex('user_roles').insert({
-      id: knex.raw('(UUID())'),
-      userId: data.userId,
-      roleId,
-      created_at: knex.fn.now(),
-      updated_at: knex.fn.now(),
-    });
-    
-    return { success: true };
-  }
-
-  @Delete(':roleId/users/:userId')
-  async removeUserFromRole(
-    @TenantId() tenantId: string,
-    @Param('roleId') roleId: string,
-    @Param('userId') userId: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    await knex('user_roles')
-      .where({ userId, roleId })
-      .delete();
-    
-    return { success: true };
-  }
-}

backend/src/rbac/setup-users.controller.ts

@@ -1,146 +0,0 @@
-import {
-  Controller,
-  Get,
-  Post,
-  Patch,
-  Delete,
-  Param,
-  Body,
-  UseGuards,
-} from '@nestjs/common';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
-import { TenantId } from '../tenant/tenant.decorator';
-import { TenantDatabaseService } from '../tenant/tenant-database.service';
-import { User } from '../models/user.model';
-import * as bcrypt from 'bcrypt';
-
-@Controller('setup/users')
-@UseGuards(JwtAuthGuard)
-export class SetupUsersController {
-  constructor(private tenantDbService: TenantDatabaseService) {}
-
-  @Get()
-  async getUsers(@TenantId() tenantId: string) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    return await User.query(knex).withGraphFetched('roles');
-  }
-
-  @Get(':id')
-  async getUser(
-    @TenantId() tenantId: string,
-    @Param('id') id: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    return await User.query(knex).findById(id).withGraphFetched('roles');
-  }
-
-  @Post()
-  async createUser(
-    @TenantId() tenantId: string,
-    @Body() data: { email: string; password: string; firstName?: string; lastName?: string },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Hash password
-    const hashedPassword = await bcrypt.hash(data.password, 10);
-    
-    const user = await User.query(knex).insert({
-      email: data.email,
-      password: hashedPassword,
-      firstName: data.firstName,
-      lastName: data.lastName,
-      isActive: true,
-    });
-    
-    return user;
-  }
-
-  @Patch(':id')
-  async updateUser(
-    @TenantId() tenantId: string,
-    @Param('id') id: string,
-    @Body() data: { email?: string; password?: string; firstName?: string; lastName?: string },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    const updateData: any = {};
-    
-    if (data.email) updateData.email = data.email;
-    if (data.firstName !== undefined) updateData.firstName = data.firstName;
-    if (data.lastName !== undefined) updateData.lastName = data.lastName;
-    
-    // Hash password if provided
-    if (data.password) {
-      updateData.password = await bcrypt.hash(data.password, 10);
-    }
-    
-    const user = await User.query(knex).patchAndFetchById(id, updateData);
-    return user;
-  }
-
-  @Delete(':id')
-  async deleteUser(
-    @TenantId() tenantId: string,
-    @Param('id') id: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Delete user role assignments first
-    await knex('user_roles').where({ userId: id }).delete();
-    
-    // Delete the user
-    await User.query(knex).deleteById(id);
-    
-    return { success: true };
-  }
-
-  @Post(':userId/roles')
-  async addRoleToUser(
-    @TenantId() tenantId: string,
-    @Param('userId') userId: string,
-    @Body() data: { roleId: string },
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    // Check if assignment already exists
-    const existing = await knex('user_roles')
-      .where({ userId, roleId: data.roleId })
-      .first();
-    
-    if (existing) {
-      return { success: true, message: 'Role already assigned' };
-    }
-    
-    await knex('user_roles').insert({
-      id: knex.raw('(UUID())'),
-      userId,
-      roleId: data.roleId,
-      created_at: knex.fn.now(),
-      updated_at: knex.fn.now(),
-    });
-    
-    return { success: true };
-  }
-
-  @Delete(':userId/roles/:roleId')
-  async removeRoleFromUser(
-    @TenantId() tenantId: string,
-    @Param('userId') userId: string,
-    @Param('roleId') roleId: string,
-  ) {
-    const resolvedTenantId = await this.tenantDbService.resolveTenantId(tenantId);
-    const knex = await this.tenantDbService.getTenantKnexById(resolvedTenantId);
-    
-    await knex('user_roles')
-      .where({ userId, roleId })
-      .delete();
-    
-    return { success: true };
-  }
-}

backend/src/tenant/tenant-database.service.ts

@@ -169,36 +169,6 @@ export class TenantDatabaseService {
     return domainRecord.tenant;
   }
 
-  /**
-   * Resolve tenant by ID or slug
-   * Tries ID first, then falls back to slug
-   */
-  async resolveTenantId(idOrSlug: string): Promise<string> {
-    const centralPrisma = getCentralPrisma();
-    
-    // Try by ID first
-    let tenant = await centralPrisma.tenant.findUnique({
-      where: { id: idOrSlug },
-    });
-
-    // If not found, try by slug
-    if (!tenant) {
-      tenant = await centralPrisma.tenant.findUnique({
-        where: { slug: idOrSlug },
-      });
-    }
-
-    if (!tenant) {
-      throw new Error(`Tenant ${idOrSlug} not found`);
-    }
-
-    if (tenant.status !== 'active') {
-      throw new Error(`Tenant ${tenant.name} is not active`);
-    }
-
-    return tenant.id;
-  }
-
   async disconnectTenant(tenantId: string) {
     const connection = this.tenantConnections.get(tenantId);
     if (connection) {

docs/CUSTOM_MIGRATIONS_IMPLEMENTATION.md

@@ -1,324 +0,0 @@
-# Custom Migrations Implementation
-
-## Overview
-
-This implementation adds a database-stored migration system for dynamically created objects. Migrations are recorded in a `custom_migrations` table in each tenant database, allowing them to be replayed or used for environment replication in the future.
-
-## Architecture
-
-### Components
-
-#### 1. CustomMigrationService
-**Location:** `backend/src/migration/custom-migration.service.ts`
-
-Handles all migration-related operations:
-
-- **`generateCreateTableSQL(tableName, fields)`** - Generates SQL for creating object tables with standard fields
-- **`createMigrationRecord()`** - Stores migration metadata in the database
-- **`executeMigration()`** - Executes a pending migration and updates its status
-- **`createAndExecuteMigration()`** - Creates and immediately executes a migration
-- **`getMigrations()`** - Retrieves migration history with filtering
-- **`ensureMigrationsTable()`** - Ensures the `custom_migrations` table exists
-
-#### 2. MigrationModule
-**Location:** `backend/src/migration/migration.module.ts`
-
-Provides the CustomMigrationService to other modules.
-
-#### 3. Updated ObjectService
-**Location:** `backend/src/object/object.service.ts`
-
-- Injects CustomMigrationService
-- Calls `createAndExecuteMigration()` when a new object is created
-- Generates table creation migrations with standard fields
-
-### Database Schema
-
-#### custom_migrations Table
-
-```sql
-CREATE TABLE custom_migrations (
-  id UUID PRIMARY KEY,
-  tenantId UUID NOT NULL,
-  name VARCHAR(255) NOT NULL,
-  description TEXT,
-  type ENUM('create_table', 'add_column', 'alter_column', 'add_index', 'drop_table', 'custom'),
-  sql TEXT NOT NULL,
-  status ENUM('pending', 'executed', 'failed') DEFAULT 'pending',
-  executedAt TIMESTAMP NULL,
-  error TEXT,
-  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  INDEX idx_tenantId (tenantId),
-  INDEX idx_status (status),
-  INDEX idx_created_at (created_at)
-)
-```
-
-#### Generated Object Tables
-
-When a new object is created (e.g., "Account"), a table is automatically created with:
-
-```sql
-CREATE TABLE accounts (
-  id VARCHAR(36) PRIMARY KEY,
-  ownerId VARCHAR(36),
-  name VARCHAR(255),
-  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  -- Custom fields added here
-)
-```
-
-**Standard Fields:**
-- `id` - UUID primary key
-- `ownerId` - User who owns the record
-- `name` - Primary name field
-- `created_at` - Record creation timestamp
-- `updated_at` - Record update timestamp
-
-### Field Type Mapping
-
-Custom fields are mapped to SQL column types:
-
-| Field Type | SQL Type | Notes |
-|---|---|---|
-| TEXT, STRING | VARCHAR(255) | |
-| LONG_TEXT | TEXT | Large text content |
-| NUMBER, DECIMAL | DECIMAL(18, 2) | |
-| INTEGER | INT | |
-| BOOLEAN | BOOLEAN | Defaults to FALSE |
-| DATE | DATE | |
-| DATE_TIME | DATETIME | |
-| EMAIL | VARCHAR(255) | |
-| URL | VARCHAR(2048) | |
-| PHONE | VARCHAR(20) | |
-| CURRENCY | DECIMAL(18, 2) | |
-| PERCENT | DECIMAL(5, 2) | |
-| PICKLIST, MULTI_PICKLIST | VARCHAR(255) | |
-| LOOKUP, BELONGS_TO | VARCHAR(36) | References foreign record ID |
-
-## Usage Flow
-
-### Creating a New Object
-
-1. **User creates object definition:**
-   ```
-   POST /api/objects
-   {
-     "apiName": "Account",
-     "label": "Account",
-     "description": "Customer account records"
-   }
-   ```
-
-2. **ObjectService.createObjectDefinition() executes:**
-   - Inserts object metadata into `object_definitions` table
-   - Generates create table SQL
-   - Creates migration record with status "pending"
-   - Executes migration immediately
-   - Updates migration status to "executed"
-   - Returns object definition
-
-3. **Result:**
-   - Object is now ready to use
-   - Table exists in database
-   - Migration history is recorded for future replication
-
-### Migration Execution Flow
-
-```
-createAndExecuteMigration()
-├── createMigrationRecord()
-│   └── Insert into custom_migrations (status: pending)
-└── executeMigration()
-    ├── Fetch migration record
-    ├── Execute SQL
-    ├── Update status: executed
-    └── Return migration record
-```
-
-## Error Handling
-
-Migrations track execution status and errors:
-
-- **Status: pending** - Not yet executed
-- **Status: executed** - Successfully completed
-- **Status: failed** - Error during execution
-
-Failed migrations are logged and stored with error details for debugging and retry:
-
-```typescript
-{
-  id: "uuid",
-  status: "failed",
-  error: "Syntax error in SQL...",
-  executedAt: null,
-  updated_at: "2025-12-24T11:00:00Z"
-}
-```
-
-## Future Functionality
-
-### Sandbox Environment Replication
-
-Stored migrations enable:
-
-1. **Cloning production environments** - Replay all migrations in new database
-2. **Data structure export/import** - Export migrations as SQL files
-3. **Audit trail** - Complete history of schema changes
-4. **Rollback capability** - Add down migrations for reverting changes
-5. **Dependency tracking** - Identify object dependencies from migrations
-
-### Planned Enhancements
-
-1. **Add down migrations** - Support undoing schema changes
-2. **Migration dependencies** - Track which migrations depend on others
-3. **Batch execution** - Run pending migrations together
-4. **Version control** - Track migration versions and changes
-5. **Manual migration creation** - API to create custom migrations
-6. **Migration status dashboard** - UI to view migration history
-
-## Integration Points
-
-### ObjectService
-
-- Uses `getTenantKnexById()` for tenant database connections
-- Calls CustomMigrationService after creating object definitions
-- Handles migration execution errors gracefully (logs but doesn't fail)
-
-### TenantDatabaseService
-
-- Provides database connections via `getTenantKnexById()`
-- Connections are cached with prefix `id:${tenantId}`
-
-### Module Dependencies
-
-```
-ObjectModule
-├── imports: [TenantModule, MigrationModule]
-└── providers: [ObjectService, CustomMigrationService, ...]
-
-MigrationModule
-├── imports: [TenantModule]
-└── providers: [CustomMigrationService]
-```
-
-## API Endpoints (Future)
-
-While not yet exposed via API, these operations could be added:
-
-```typescript
-// Get migration history
-GET /api/migrations?tenantId=xxx&status=executed
-
-// Get migration details
-GET /api/migrations/:id
-
-// Retry failed migration
-POST /api/migrations/:id/retry
-
-// Export migrations as SQL
-GET /api/migrations/export?tenantId=xxx
-
-// Create custom migration
-POST /api/migrations
-{
-  name: "add_field_to_accounts",
-  description: "Add phone_number field",
-  sql: "ALTER TABLE accounts ADD phone_number VARCHAR(20)"
-}
-```
-
-## Testing
-
-### Manual Testing Steps
-
-1. **Create a new object:**
-   ```bash
-   curl -X POST http://localhost:3000/api/objects \
-     -H "Authorization: Bearer <token>" \
-     -H "Content-Type: application/json" \
-     -d '{
-       "apiName": "TestObject",
-       "label": "Test Object",
-       "description": "Test object creation"
-     }'
-   ```
-
-2. **Verify table was created:**
-   ```bash
-   # In tenant database
-   SHOW TABLES LIKE 'test_objects';
-   DESCRIBE test_objects;
-   ```
-
-3. **Check migration record:**
-   ```bash
-   # In tenant database
-   SELECT * FROM custom_migrations WHERE name LIKE '%test_objects%';
-   ```
-
-4. **Create a record in the new object:**
-   ```bash
-   curl -X POST http://localhost:3000/api/test-objects \
-     -H "Authorization: Bearer <token>" \
-     -H "Content-Type: application/json" \
-     -d '{
-       "name": "My Test Record"
-     }'
-   ```
-
-## Troubleshooting
-
-### Migration Fails with SQL Error
-
-1. Check `custom_migrations` table for error details:
-   ```sql
-   SELECT id, name, error, status FROM custom_migrations 
-   WHERE status = 'failed';
-   ```
-
-2. Review the generated SQL in the `sql` column
-
-3. Common issues:
-   - Duplicate table names
-   - Invalid field names (reserved SQL keywords)
-   - Unsupported field types
-
-### Table Not Created
-
-1. Verify `custom_migrations` table exists:
-   ```sql
-   SHOW TABLES LIKE 'custom_migrations';
-   ```
-
-2. Check object service logs for migration execution errors
-
-3. Manually retry migration:
-   ```typescript
-   const migration = await tenantKnex('custom_migrations')
-     .where({ status: 'failed' })
-     .first();
-   await customMigrationService.executeMigration(tenantKnex, migration.id);
-   ```
-
-## Performance Considerations
-
-- **Table creation** is synchronous and happens immediately
-- **Migrations are cached** in custom_migrations table per tenant
-- **No file I/O** - all operations use database
-- **Index creation** optimized with proper indexes on common columns (tenantId, status, created_at)
-
-## Security
-
-- **Per-tenant isolation** - Each tenant's migrations stored separately
-- **No SQL injection** - Using Knex query builder for all operations
-- **Access control** - Migrations only created/executed by backend service
-- **Audit trail** - Complete history of all schema changes
-
-## Related Files
-
-- [backend/src/object/object.service.ts](backend/src/object/object.service.ts)
-- [backend/src/migration/custom-migration.service.ts](backend/src/migration/custom-migration.service.ts)
-- [backend/src/migration/migration.module.ts](backend/src/migration/migration.module.ts)

docs/OBJECTION_ARCHITECTURE.md

@@ -1,414 +0,0 @@
-# Objection.js Model System Architecture
-
-## System Overview
-
-```
-┌─────────────────────────────────────────────────────────────────┐
-│                     HTTP Request Flow                           │
-└────────────────────────────┬────────────────────────────────────┘
-                             │
-                             ▼
-           ┌─────────────────────────────────┐
-           │      Record Controller          │
-           │  (e.g. ObjectController)        │
-           │                                 │
-           │  - createRecord(data)           │
-           │  - getRecord(id)                │
-           │  - updateRecord(id, data)       │
-           │  - deleteRecord(id)             │
-           └──────────────┬──────────────────┘
-                          │
-                          ▼
-        ┌──────────────────────────────────────┐
-        │        ObjectService                 │
-        │  (CRUD with Model/Knex Fallback)    │
-        │                                      │
-        │  - createRecord()  ┐                │
-        │  - getRecords()    ├─→ Try Model    │
-        │  - getRecord()     │   Else Knex    │
-        │  - updateRecord()  │                │
-        │  - deleteRecord()  ┘                │
-        └────────────┬─────────────┬──────────┘
-                     │             │
-         ┌───────────▼──┐   ┌──────▼─────────┐
-         │ ModelService │   │  TenantDB      │
-         │              │   │  Service       │
-         │ - getModel   │   │                │
-         │ - getBound   │   │ - getTenantKnex│
-         │   Model      │   │                │
-         │ - Registry   │   │ - resolveTenant│
-         └───────────┬──┘   │   ID           │
-                     │       └────────────────┘
-                     ▼
-         ┌────────────────────────────┐
-         │    ModelRegistry           │
-         │  (Per-Tenant)              │
-         │                            │
-         │  Map<apiName, ModelClass>  │
-         │  - getModel(apiName)       │
-         │  - registerModel(api, cls) │
-         │  - getAllModelNames()      │
-         └────────────────────────────┘
-                     │
-                     ▼
-    ┌────────────────────────────────────┐
-    │   DynamicModelFactory              │
-    │                                    │
-    │   createModel(ObjectMetadata)      │
-    │   Returns: ModelClass<any>         │
-    │                                    │
-    │   ┌──────────────────────────────┐ │
-    │   │   DynamicModel extends Model │ │
-    │   │   (Created Class)            │ │
-    │   │                              │ │
-    │   │  tableName: "accounts"       │ │
-    │   │  jsonSchema: { ... }         │ │
-    │   │                              │ │
-    │   │  $beforeInsert() {           │ │
-    │   │    - Generate id (UUID)      │ │
-    │   │    - Set created_at          │ │
-    │   │    - Set updated_at          │ │
-    │   │  }                           │ │
-    │   │                              │ │
-    │   │  $beforeUpdate() {           │ │
-    │   │    - Set updated_at          │ │
-    │   │  }                           │ │
-    │   └──────────────────────────────┘ │
-    └────────────────────────────────────┘
-                     │
-      ┌──────────────┴──────────────┐
-      │                             │
-      ▼                             ▼
-┌───────────────┐          ┌─────────────────┐
-│ Model Class   │          │  Knex (Fallback)│
-│ (Objection)   │          │                 │
-│               │          │ - query()       │
-│ - query()     │          │ - insert()      │
-│ - insert()    │          │ - update()      │
-│ - update()    │          │ - delete()      │
-│ - delete()    │          │ - select()      │
-│               │          │                 │
-│ Hooks:        │          └─────────────────┘
-│ - Before ops  │               │
-│ - Timestamps  │               │
-│ - Validation  │               │
-└───────────────┘               │
-      │                         │
-      └──────────────┬──────────┘
-                     │
-                     ▼
-          ┌────────────────────┐
-          │  Database (MySQL)  │
-          │                    │
-          │  - Read/Write      │
-          │  - Transactions    │
-          │  - Constraints     │
-          └────────────────────┘
-```
-
-## Data Flow: Create Record
-
-```
-┌────────────────────────────────────────────────────────────────┐
-│ User sends: POST /api/records/Account                          │
-│ Body: { "name": "Acme", "revenue": 1000000 }                   │
-└────────────────────────────────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   ObjectService.createRecord()     │
-         │   - Resolve tenantId               │
-         │   - Get Knex connection            │
-         │   - Verify object exists           │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Try to use Objection Model       │
-         │                                    │
-         │   Model = modelService.getModel(   │
-         │     tenantId,                      │
-         │     "Account"                      │
-         │   )                                │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Get Bound Model (with Knex)      │
-         │                                    │
-         │   boundModel = await modelService  │
-         │     .getBoundModel(tenantId, api)  │
-         │                                    │
-         │   Model now has database context   │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Set system field: ownerId        │
-         │                                    │
-         │   recordData = {                   │
-         │     ...userProvidedData,           │
-         │     ownerId: currentUserId         │
-         │   }                                │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Call Model Insert                │
-         │                                    │
-         │   record = await boundModel        │
-         │     .query()                       │
-         │     .insert(recordData)            │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Model Hook: $beforeInsert()      │
-         │   (Runs before DB insert)          │
-         │                                    │
-         │   $beforeInsert() {                │
-         │     if (!this.id) {                │
-         │       this.id = UUID()             │
-         │     }                              │
-         │     if (!this.created_at) {        │
-         │       this.created_at = now()      │
-         │     }                              │
-         │     if (!this.updated_at) {        │
-         │       this.updated_at = now()      │
-         │     }                              │
-         │   }                                │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Database INSERT                  │
-         │                                    │
-         │   INSERT INTO accounts (           │
-         │     id,                            │
-         │     name,                          │
-         │     revenue,                       │
-         │     ownerId,                       │
-         │     created_at,                    │
-         │     updated_at,                    │
-         │     tenantId                       │
-         │   ) VALUES (...)                   │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Database returns inserted record │
-         │                                    │
-         │   {                                │
-         │     id: "uuid...",                 │
-         │     name: "Acme",                  │
-         │     revenue: 1000000,              │
-         │     ownerId: "user-uuid",          │
-         │     created_at: "2025-01-26...",   │
-         │     updated_at: "2025-01-26...",   │
-         │     tenantId: "tenant-uuid"        │
-         │   }                                │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Return to HTTP Response          │
-         │   (All fields populated)           │
-         └────────────────────────────────────┘
-```
-
-## Data Flow: Update Record
-
-```
-┌────────────────────────────────────────────────────────────────┐
-│ User sends: PATCH /api/records/Account/account-id              │
-│ Body: { "revenue": 1500000 }                                   │
-└────────────────────────────────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   ObjectService.updateRecord()     │
-         │   - Verify user owns record        │
-         │   - Filter system fields:          │
-         │     - Delete allowedData.ownerId   │
-         │     - Delete allowedData.id        │
-         │     - Delete allowedData.created_at│
-         │     - Delete allowedData.tenantId  │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   allowedData = {                  │
-         │     revenue: 1500000               │
-         │   }                                │
-         │                                    │
-         │   (ownerId, id, created_at,        │
-         │    tenantId removed)               │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Get Bound Model                  │
-         │   Call Model Update                │
-         │                                    │
-         │   await boundModel                 │
-         │     .query()                       │
-         │     .where({ id: recordId })       │
-         │     .update(allowedData)           │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Model Hook: $beforeUpdate()      │
-         │   (Runs before DB update)          │
-         │                                    │
-         │   $beforeUpdate() {                │
-         │     this.updated_at = now()        │
-         │   }                                │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Database UPDATE                  │
-         │                                    │
-         │   UPDATE accounts SET              │
-         │     revenue = 1500000,             │
-         │     updated_at = now()             │
-         │   WHERE id = account-id            │
-         └────────────────────────────────────┘
-                             │
-                             ▼
-         ┌────────────────────────────────────┐
-         │   Fetch Updated Record             │
-         │   Return to HTTP Response          │
-         │                                    │
-         │   {                                │
-         │     id: "uuid...",                 │
-         │     name: "Acme",                  │
-         │     revenue: 1500000,  ← CHANGED   │
-         │     ownerId: "user-uuid",          │
-         │     created_at: "2025-01-26...",   │
-         │     updated_at: "2025-01-26...",   │
-         │       ↑ UPDATED to newer time      │
-         │     tenantId: "tenant-uuid"        │
-         │   }                                │
-         └────────────────────────────────────┘
-```
-
-## Per-Tenant Model Isolation
-
-```
-    Central System
-    ┌───────────────────────────────────────────────────────┐
-    │                  ModelService                         │
-    │  tenantRegistries = Map<tenantId, ModelRegistry>      │
-    └───────────────────────────────────────────────────────┘
-             │              │              │
-    ┌────────▼──────┐ ┌─────▼──────┐ ┌────▼───────┐
-    │Tenant UUID: t1│ │Tenant UUID: │ │Tenant UUID:│
-    │               │ │    t2       │ │    t3      │
-    │ ModelRegistry │ │ModelRegistry│ │ModelRegistry│
-    │               │ │             │ │             │
-    │Account Model  │ │Deal Model   │ │Account Model│
-    │Contact Model  │ │Case Model   │ │Product Model│
-    │Product Model  │ │Product Model│ │Seller Model │
-    │               │ │             │ │             │
-    │Isolated from  │ │Isolated from│ │Isolated from│
-    │t2, t3         │ │t1, t3       │ │t1, t2       │
-    └───────────────┘ └─────────────┘ └─────────────┘
-```
-
-When tenant1 creates Account:
-- Account model registered in tenant1's ModelRegistry
-- Account model NOT visible to tenant2 or tenant3
-- Each tenant's models use their own Knex connection
-
-## Field Type to JSON Schema Mapping
-
-```
-DynamicModelFactory.fieldToJsonSchema():
-
-TEXT, EMAIL, URL, PHONE        →  { type: 'string' }
-LONG_TEXT                      →  { type: 'string' }
-BOOLEAN                        →  { type: 'boolean', default: false }
-NUMBER, DECIMAL, CURRENCY      →  { type: 'number' }
-INTEGER                        →  { type: 'integer' }
-DATE                           →  { type: 'string', format: 'date' }
-DATE_TIME                      →  { type: 'string', format: 'date-time' }
-LOOKUP, BELONGS_TO             →  { type: 'string' }
-PICKLIST, MULTI_PICKLIST      →  { type: 'string' }
-```
-
-System fields (always in JSON schema):
-```
-id               → { type: 'string' }
-tenantId         → { type: 'string' }
-ownerId          → { type: 'string' }
-name             → { type: 'string' }
-created_at       → { type: 'string', format: 'date-time' }
-updated_at       → { type: 'string', format: 'date-time' }
-
-Note: System fields NOT in "required" array
-      So users can create records without providing them
-```
-
-## Fallback to Knex
-
-```
-try {
-  const model = modelService.getModel(tenantId, apiName);
-  if (model) {
-    boundModel = await modelService.getBoundModel(...);
-    return await boundModel.query().insert(data);
-  }
-} catch (error) {
-  logger.warn(`Model unavailable, using Knex fallback`);
-}
-
-// Fallback: Direct Knex
-const tableName = getTableName(apiName);
-return await knex(tableName).insert({
-  id: knex.raw('(UUID())'),
-  ...data,
-  created_at: knex.fn.now(),
-  updated_at: knex.fn.now()
-});
-```
-
-Why fallback?
-- Model might not be created yet (old objects)
-- Model creation might have failed (logged with warning)
-- Ensures system remains functional even if model layer broken
-- Zero data loss - data written same way to database
-
-## Performance Characteristics
-
-```
-Operation                    Overhead          When?
-─────────────────────────────────────────────────────
-Model creation               ~10-50ms          Once per object definition
-Model caching lookup         ~0ms              Every request
-Model binding to Knex        ~1-2ms            Every CRUD operation
-$beforeInsert hook           <1ms              Every insert
-$beforeUpdate hook           <1ms              Every update
-JSON schema validation       ~1-2ms            If validation enabled
-Database round trip          10-100ms          Always
-
-Total per CRUD:
-- First request after model creation: 20-55ms
-- Subsequent requests: 11-102ms (same as Knex fallback)
-```
-
-Memory usage:
-```
-Per Model Class:
-- Model definition: ~2-5KB
-- JSON schema: ~1-2KB
-- Hooks and methods: ~3-5KB
-─────────────────────────────
-Total per model: ~6-12KB
-
-For 100 objects: ~600KB-1.2MB
-For 1000 objects: ~6-12MB
-
-Memory efficient compared to database size
-```

docs/OBJECTION_MODEL_SYSTEM.md

@@ -1,241 +0,0 @@
-# Objection.js Model System Implementation - Complete
-
-## Summary
-
-Successfully implemented a complete Objection.js-based model system to handle system-managed fields automatically. System fields (ownerId, created_at, updated_at, id) are now auto-populated and managed transparently, eliminating user input requirements.
-
-## Problem Solved
-
-**Previous Issue**: When users created records, they had to provide ownerId, created_at, and updated_at fields, but these should be managed automatically by the system.
-
-**Solution**: Implemented Objection.js models with hooks that:
-1. Auto-generate UUID for `id` field
-2. Auto-set `ownerId` from the current user
-3. Auto-set `created_at` on insert
-4. Auto-set `updated_at` on insert and update
-5. Prevent users from manually setting these system fields
-
-## Architecture
-
-### Model Files Created
-
-**1. `/root/neo/backend/src/object/models/base.model.ts`**
-- Removed static jsonSchema (was causing TypeScript conflicts)
-- Extends Objection's Model class
-- Provides base for all dynamic models
-- Implements $beforeInsert and $beforeUpdate hooks (can be overridden)
-
-**2. `/root/neo/backend/src/object/models/dynamic-model.factory.ts`** ⭐ REFACTORED
-- `DynamicModelFactory.createModel(ObjectMetadata)` - Creates model classes on-the-fly
-- Features:
-  - Generates dynamic model class extending Objection.Model
-  - Auto-generates JSON schema with properties from field definitions
-  - Implements $beforeInsert hook: generates UUID, sets timestamps
-  - Implements $beforeUpdate hook: updates timestamp
-  - Field-to-JSON-schema type mapping for all 12+ field types
-  - System fields (ownerId, id, created_at, updated_at) excluded from required validation
-
-**3. `/root/neo/backend/src/object/models/model.registry.ts`**
-- `ModelRegistry` - Stores and retrieves models for a single tenant
-- Methods:
-  - `registerModel(apiName, modelClass)` - Register model
-  - `getModel(apiName)` - Retrieve model
-  - `hasModel(apiName)` - Check existence
-  - `createAndRegisterModel(ObjectMetadata)` - One-shot create and register
-  - `getAllModelNames()` - Get all registered models
-
-**4. `/root/neo/backend/src/object/models/model.service.ts`**
-- `ModelService` - Manages model registries per tenant
-- Methods:
-  - `getTenantRegistry(tenantId)` - Get or create registry for tenant
-  - `createModelForObject(tenantId, ObjectMetadata)` - Create and register model
-  - `getModel(tenantId, apiName)` - Get model for tenant
-  - `getBoundModel(tenantId, apiName)` - Get model bound to tenant's Knex instance
-  - `hasModel(tenantId, apiName)` - Check existence
-  - `getAllModelNames(tenantId)` - Get all model names
-
-### Files Updated
-
-**1. `/root/neo/backend/src/object/object.module.ts`**
-- Added `MigrationModule` import
-- Added `ModelRegistry` and `ModelService` to providers/exports
-- Wired model system into object module
-
-**2. `/root/neo/backend/src/object/object.service.ts`** ⭐ REFACTORED
-- `createObjectDefinition()`: Now creates and registers Objection model after migration
-- `createRecord()`: Uses model.query().insert() when available, auto-sets ownerId and timestamps
-- `getRecords()`: Uses model.query() when available
-- `getRecord()`: Uses model.query() when available
-- `updateRecord()`: Uses model.query().update(), filters out system field updates
-- `deleteRecord()`: Uses model.query().delete()
-- All CRUD methods have fallback to raw Knex if model unavailable
-
-## Key Features
-
-### Auto-Managed Fields
-```typescript
-// User provides:
-{
-  "name": "John Doe",
-  "email": "john@example.com"
-}
-
-// System auto-sets before insert:
-{
-  "id": "550e8400-e29b-41d4-a716-446655440000",  // Generated UUID
-  "name": "John Doe",
-  "email": "john@example.com",
-  "ownerId": "user-uuid",                          // From auth context
-  "created_at": "2025-01-26T10:30:45Z",           // Current timestamp
-  "updated_at": "2025-01-26T10:30:45Z"            // Current timestamp
-}
-```
-
-### Protection Against System Field Modifications
-```typescript
-// In updateRecord, system fields are filtered out:
-const allowedData = { ...data };
-delete allowedData.ownerId;    // Can't change owner
-delete allowedData.id;          // Can't change ID
-delete allowedData.created_at;  // Can't change creation time
-delete allowedData.tenantId;    // Can't change tenant
-```
-
-### Per-Tenant Model Isolation
-- Each tenant gets its own ModelRegistry
-- Models are isolated per tenant via ModelService.tenantRegistries Map
-- No risk of model leakage between tenants
-
-### Fallback to Knex
-- All CRUD operations have try-catch around model usage
-- If model unavailable, gracefully fall back to raw Knex
-- Ensures backward compatibility
-
-## Integration Points
-
-### When Object is Created
-1. Object definition stored in `object_definitions` table
-2. Standard fields created (ownerId, name, created_at, updated_at)
-3. Table migration generated and executed
-4. Objection model created with `DynamicModelFactory.createModel()`
-5. Model registered with `ModelService.createModelForObject()`
-
-### When Record is Created
-1. `createRecord()` called with user data (no system fields)
-2. Fetch bound model from ModelService
-3. Call `boundModel.query().insert(data)`
-4. Model's `$beforeInsert()` hook:
-   - Generates UUID for id
-   - Sets created_at to now
-   - Sets updated_at to now
-   - ownerId set by controller before insert
-5. Return created record with all fields populated
-
-### When Record is Updated
-1. `updateRecord()` called with partial data
-2. Filter out system fields (ownerId, id, created_at, tenantId)
-3. Fetch bound model from ModelService
-4. Call `boundModel.query().update(allowedData)`
-5. Model's `$beforeUpdate()` hook:
-   - Sets updated_at to now
-6. Return updated record
-
-## Type Compatibility Resolution
-
-### Problem
-DynamicModel couldn't extend BaseModel due to TypeScript static property constraint:
-```
-Class static side 'typeof DynamicModel' incorrectly extends base class static side 'typeof BaseModel'.
-  The types of 'jsonSchema.properties' are incompatible between these types.
-```
-
-### Solution
-1. Removed static `jsonSchema` getter from BaseModel
-2. Have DynamicModel directly define jsonSchema properties
-3. DynamicModel extends plain Objection.Model (not BaseModel)
-4. Implements hooks for system field management
-5. Return type `ModelClass<any>` instead of `ModelClass<BaseModel>`
-
-This approach:
-- ✅ Compiles successfully
-- ✅ Still manages system fields via hooks
-- ✅ Maintains per-tenant isolation
-- ✅ Preserves type safety for instance properties (id?, created_at?, etc.)
-
-## Testing
-
-See [TEST_OBJECT_CREATION.md](TEST_OBJECT_CREATION.md) for comprehensive test sequence.
-
-Quick validation:
-```bash
-# 1. Create object (will auto-register model)
-curl -X POST http://localhost:3001/api/objects \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer JWT" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{"apiName": "TestObj", "label": "Test Object"}'
-
-# 2. Create record WITHOUT system fields
-curl -X POST http://localhost:3001/api/records/TestObj \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer JWT" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{"name": "Test Record"}'
-
-# 3. Verify response includes auto-set fields
-# Should have: id, ownerId, created_at, updated_at (auto-generated)
-```
-
-## Performance Considerations
-
-1. **Model Caching**: Models cached per-tenant in memory (ModelRegistry)
-   - First request creates model, subsequent requests use cached version
-   - No performance penalty after initial creation
-
-2. **Knex Binding**: Each CRUD operation rebinds model to knex instance
-   - Ensures correct database connection context
-   - Minor overhead (~1ms per operation)
-
-3. **Hook Execution**: $beforeInsert and $beforeUpdate are very fast
-   - Just set a few properties
-   - No database queries
-
-## Future Enhancements
-
-1. **Relation Mappings**: Add relationMappings for LOOKUP fields
-2. **Validation**: Use Objection's `$validate()` hook for field validation
-3. **Hooks**: Extend hooks for custom business logic
-4. **Eager Loading**: Use `.withGraphFetched()` for related record fetching
-5. **Transactions**: Use `$transaction()` for multi-record operations
-6. **Soft Deletes**: Add deleted_at field for soft delete support
-
-## Files Modified Summary
-
-| File | Changes | Status |
-|------|---------|--------|
-| base.model.ts | Created new | ✅ |
-| dynamic-model.factory.ts | Created new | ✅ |
-| model.registry.ts | Created new | ✅ |
-| model.service.ts | Created new | ✅ |
-| object.module.ts | Added ModelRegistry, ModelService | ✅ |
-| object.service.ts | All CRUD use models + fallback to Knex | ✅ |
-
-## Verification
-
-All files compile without errors:
-```
-✅ base.model.ts - No errors
-✅ dynamic-model.factory.ts - No errors  
-✅ model.registry.ts - No errors
-✅ model.service.ts - No errors
-✅ object.module.ts - No errors
-✅ object.service.ts - No errors
-```
-
-## Next Steps (Optional)
-
-1. **Run Full CRUD Test** - Execute test sequence from TEST_OBJECT_CREATION.md
-2. **Add Relation Mappings** - Enable LOOKUP field relationships in models
-3. **Field Validation** - Add field-level validation in JSON schema
-4. **Performance Testing** - Benchmark with many objects/records
-5. **Error Handling** - Add detailed error messages for model failures

docs/OBJECTION_QUICK_REFERENCE.md

@@ -1,256 +0,0 @@
-# Objection.js Model System - Quick Reference
-
-## What Was Implemented
-
-A complete Objection.js-based ORM system for managing dynamic data models per tenant, with automatic system field management.
-
-## Problem Solved
-
-❌ **Before**: Users had to provide system fields (ownerId, created_at, updated_at) when creating records  
-✅ **After**: System fields are auto-managed by model hooks - users just provide business data
-
-## Key Components
-
-### 1. Dynamic Model Factory
-**File**: `backend/src/object/models/dynamic-model.factory.ts`
-
-Creates Objection.Model subclasses on-the-fly from field definitions:
-- Auto-generates JSON schema for validation
-- Implements `$beforeInsert` hook to set id, ownerId, timestamps
-- Implements `$beforeUpdate` hook to update timestamps
-- Maps 12+ field types to JSON schema types
-
-```typescript
-// Creates a model class for "Account" object
-const AccountModel = DynamicModelFactory.createModel({
-  apiName: 'Account',
-  tableName: 'accounts',
-  fields: [
-    { apiName: 'name', label: 'Name', type: 'TEXT', isRequired: true },
-    { apiName: 'revenue', label: 'Revenue', type: 'CURRENCY' }
-  ]
-});
-```
-
-### 2. Model Registry
-**File**: `backend/src/object/models/model.registry.ts`
-
-Stores and retrieves models for a single tenant:
-- `getModel(apiName)` - Get model by object name
-- `registerModel(apiName, modelClass)` - Register new model
-- `createAndRegisterModel(metadata)` - One-shot create + register
-
-### 3. Model Service
-**File**: `backend/src/object/models/model.service.ts`
-
-Manages model registries per tenant:
-- `getModel(tenantId, apiName)` - Get model synchronously
-- `getBoundModel(tenantId, apiName)` - Get model bound to tenant's database
-- Per-tenant isolation via `Map<tenantId, ModelRegistry>`
-
-### 4. Updated Object Service
-**File**: `backend/src/object/object.service.ts`
-
-CRUD methods now use Objection models:
-- **createRecord()**: Model.query().insert() with auto-set fields
-- **getRecord()**: Model.query().where().first()
-- **getRecords()**: Model.query().where()
-- **updateRecord()**: Model.query().update() with system field filtering
-- **deleteRecord()**: Model.query().delete()
-
-All methods fallback to raw Knex if model unavailable.
-
-## How It Works
-
-### Creating a Record
-
-```typescript
-// User sends:
-POST /api/records/Account
-{
-  "name": "Acme Corp",
-  "revenue": 1000000
-}
-
-// ObjectService.createRecord():
-// 1. Gets bound Objection model for Account
-// 2. Calls: boundModel.query().insert({
-//     name: "Acme Corp",
-//     revenue: 1000000,
-//     ownerId: userId  // Set from auth context
-//   })
-// 3. Model's $beforeInsert() hook:
-//    - Sets id to UUID
-//    - Sets created_at to now
-//    - Sets updated_at to now
-// 4. Database receives complete record with all system fields
-
-// Response:
-{
-  "id": "550e8400-e29b-41d4-a716-446655440000",
-  "name": "Acme Corp",
-  "revenue": 1000000,
-  "ownerId": "user-uuid",
-  "created_at": "2025-01-26T10:30:45Z",
-  "updated_at": "2025-01-26T10:30:45Z",
-  "tenantId": "tenant-uuid"
-}
-```
-
-### Updating a Record
-
-```typescript
-// User sends:
-PATCH /api/records/Account/account-id
-{
-  "revenue": 1500000
-}
-
-// ObjectService.updateRecord():
-// 1. Filters out system fields:
-//    - Removes ownerId (can't change owner)
-//    - Removes id (can't change ID)
-//    - Removes created_at (immutable)
-//    - Removes tenantId (can't change tenant)
-// 2. Calls: boundModel.query().update({ revenue: 1500000 })
-// 3. Model's $beforeUpdate() hook:
-//    - Sets updated_at to now
-// 4. Database receives update with new updated_at timestamp
-
-// Response:
-{
-  "id": "550e8400-e29b-41d4-a716-446655440000",
-  "name": "Acme Corp",
-  "revenue": 1500000,  // Updated
-  "ownerId": "user-uuid",  // Unchanged
-  "created_at": "2025-01-26T10:30:45Z",  // Unchanged
-  "updated_at": "2025-01-26T10:35:20Z",  // Updated
-  "tenantId": "tenant-uuid"
-}
-```
-
-## Per-Tenant Isolation
-
-Each tenant has its own model registry:
-```
-tenant1 → ModelRegistry → Model(Account), Model(Contact), ...
-tenant2 → ModelRegistry → Model(Deal), Model(Case), ...
-tenant3 → ModelRegistry → Model(Account), Model(Product), ...
-```
-
-No model leakage between tenants.
-
-## Type Safety
-
-Despite dynamic model generation, TypeScript type checking:
-- ✅ Validates model class creation
-- ✅ Enforces Knex connection binding
-- ✅ Checks query methods (insert, update, delete)
-- ✅ No TypeScript static property conflicts
-
-## Backward Compatibility
-
-All CRUD methods have fallback to raw Knex:
-```typescript
-try {
-  const model = this.modelService.getModel(tenantId, apiName);
-  if (model) {
-    // Use model for CRUD
-    return await boundModel.query().insert(data);
-  }
-} catch (error) {
-  console.warn(`Model unavailable, falling back to Knex`);
-}
-
-// Fallback to raw Knex
-return await knex(tableName).insert(data);
-```
-
-## Database Schema
-
-Models work with existing schema (no changes needed):
-- MySQL/MariaDB with standard field names (snake_case)
-- UUID for primary keys
-- Timestamp fields (created_at, updated_at)
-- Optional ownerId for multi-user tenants
-
-## Performance
-
-- **Model Caching**: ~0ms after first creation
-- **Binding Overhead**: ~1ms per request (rebinding to tenant's knex)
-- **Hook Execution**: <1ms (just property assignments)
-- **Memory**: ~10KB per model class (small even with 100+ objects)
-
-## Error Handling
-
-Models handle errors gracefully:
-- If model creation fails: Log warning, use Knex fallback
-- If model binding fails: Fall back to Knex immediately
-- Database errors: Propagate through query() methods as usual
-
-## Next Steps to Consider
-
-1. **Add Validation**: Use JSON schema validation for field types
-2. **Add Relations**: Map LOOKUP fields to belongsTo/hasMany relationships
-3. **Add Custom Hooks**: Allow business logic in $validate, $afterInsert, etc.
-4. **Add Eager Loading**: Use .withGraphFetched() for related records
-5. **Add Soft Deletes**: Add deleted_at field support
-6. **Add Transactions**: Wrap multi-record operations in transaction
-
-## Files at a Glance
-
-| File | Purpose | Lines |
-|------|---------|-------|
-| base.model.ts | Base Model class | ~40 |
-| dynamic-model.factory.ts | Factory for creating models | ~150 |
-| model.registry.ts | Per-tenant model storage | ~60 |
-| model.service.ts | Manage registries per tenant | ~80 |
-| object.service.ts | CRUD with model fallback | ~500 |
-| object.module.ts | Wire services together | ~30 |
-
-## Testing the Implementation
-
-See [TEST_OBJECT_CREATION.md](TEST_OBJECT_CREATION.md) for full test sequence.
-
-Quick smoke test:
-```bash
-# Create object (auto-registers model)
-curl -X POST http://localhost:3001/api/objects \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer JWT_TOKEN" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{"apiName": "TestObj", "label": "Test Object"}'
-
-# Create record (system fields auto-set)
-curl -X POST http://localhost:3001/api/records/TestObj \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer JWT_TOKEN" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{"name": "Test Record"}'
-
-# Should return with id, ownerId, created_at, updated_at auto-populated
-```
-
-## Troubleshooting
-
-### Models not being used
-- Check logs for "Registered model" messages
-- Verify model.registry.ts `.getModel()` returns non-null
-- Check `.getBoundModel()` doesn't throw
-
-### System fields not set
-- Verify $beforeInsert hook in dynamic-model.factory.ts is defined
-- Check database logs for INSERT statements (should have all fields)
-- Verify Objection version in package.json (^3.0.0 required)
-
-### Type errors with models
-- Ensure Model/ModelClass imports from 'objection'
-- Check DynamicModel extends Model (not BaseModel)
-- Return type should be `ModelClass<any>` not `ModelClass<BaseModel>`
-
-## Related Documentation
-
-- [OBJECTION_MODEL_SYSTEM.md](OBJECTION_MODEL_SYSTEM.md) - Full technical details
-- [TEST_OBJECT_CREATION.md](TEST_OBJECT_CREATION.md) - Test procedures
-- [FIELD_TYPES_ARCHITECTURE.md](FIELD_TYPES_ARCHITECTURE.md) - Field type system
-- [CUSTOM_MIGRATIONS_IMPLEMENTATION.md](CUSTOM_MIGRATIONS_IMPLEMENTATION.md) - Migration system

docs/OWNER_FIELD_VALIDATION_FIX.md

@@ -1,255 +0,0 @@
-# Owner Field Validation Fix - Complete Solution
-
-## Problem
-When creating a record for a newly created object definition, users saw:
-- "Owner is required"
-
-Even though `ownerId` should be auto-managed by the system and never required from users.
-
-## Root Cause Analysis
-
-The issue had two layers:
-
-### Layer 1: Existing Objects (Before Latest Fix)
-Objects created BEFORE the system fields fix had:
-- `ownerId` with `isRequired: true` and `isSystem: null`
-- Frontend couldn't identify this as a system field
-- Field was shown on edit form and validated as required
-
-### Layer 2: Incomplete Field Name Coverage
-The frontend's system field list was missing `ownerId` and `tenantId`:
-```javascript
-// BEFORE
-['id', 'createdAt', 'updatedAt', 'created_at', 'updated_at', 'createdBy', 'updatedBy']
-// Missing: ownerId, tenantId
-```
-
-## Complete Fix Applied
-
-### 1. Backend - Normalize All Field Definitions
-
-**File**: [backend/src/object/object.service.ts](backend/src/object/object.service.ts)
-
-Added `normalizeField()` helper function:
-```typescript
-private normalizeField(field: any): any {
-  const systemFieldNames = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt'];
-  const isSystemField = systemFieldNames.includes(field.apiName);
-  
-  return {
-    ...field,
-    // Ensure system fields are marked correctly
-    isSystem: isSystemField ? true : field.isSystem,
-    isRequired: isSystemField ? false : field.isRequired,
-    isCustom: isSystemField ? false : field.isCustom ?? true,
-  };
-}
-```
-
-This ensures that:
-- Any field with a system field name is automatically marked `isSystem: true`
-- System fields are always `isRequired: false`
-- System fields are always `isCustom: false`
-- Works for both new and old objects (backward compatible)
-
-Updated `getObjectDefinition()` to normalize fields before returning:
-```typescript
-// Get fields and normalize them
-const fields = await knex('field_definitions')...
-const normalizedFields = fields.map((field: any) => this.normalizeField(field));
-
-return {
-  ...obj,
-  fields: normalizedFields,  // Return normalized fields
-  app,
-};
-```
-
-### 2. Frontend - Complete System Field Coverage
-
-**File**: [frontend/composables/useFieldViews.ts](frontend/composables/useFieldViews.ts#L12-L20)
-
-Updated field mapping to include all system fields:
-```typescript
-// Define all system/auto-generated field names
-const systemFieldNames = ['id', 'createdAt', 'updatedAt', 'created_at', 'updated_at', 'createdBy', 'updatedBy', 'tenantId', 'ownerId']
-const isAutoGeneratedField = systemFieldNames.includes(fieldDef.apiName)
-
-// Hide system fields and auto-generated fields on edit
-const shouldHideOnEdit = isSystemField || isAutoGeneratedField
-```
-
-**File**: [frontend/components/views/EditViewEnhanced.vue](frontend/components/views/EditViewEnhanced.vue#L162-L170)
-
-Updated save handler system fields list:
-```typescript
-const systemFields = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy']
-```
-
-## How It Works Now
-
-### For New Objects (Created After Backend Fix)
-```
-1. Backend creates standard fields with:
-   - ownerId: isRequired: false, isSystem: true ✓
-   - created_at: isRequired: false, isSystem: true ✓
-   - updated_at: isRequired: false, isSystem: true ✓
-
-2. Backend's getObjectDefinition normalizes them (redundant but safe)
-
-3. Frontend receives normalized fields
-   - Recognizes them as system fields
-   - Hides from edit form ✓
-
-4. User creates record without "Owner is required" error ✓
-```
-
-### For Existing Objects (Created Before Backend Fix)
-```
-1. Legacy data has:
-   - ownerId: isRequired: true, isSystem: null
-
-2. Backend's getObjectDefinition normalizes on-the-fly:
-   - Detects apiName === 'ownerId'
-   - Forces: isSystem: true, isRequired: false ✓
-
-3. Frontend receives normalized fields
-   - Recognizes as system field (by name + isSystem flag)
-   - Hides from edit form ✓
-
-4. User creates record without "Owner is required" error ✓
-```
-
-## System Field Handling
-
-### Complete System Field List
-```
-Field Name      | Type      | Required | Hidden on Edit | Notes
-────────────────┼───────────┼──────────┼────────────────┼──────────────────
-id              | UUID      | No       | Yes            | Auto-generated
-tenantId        | UUID      | No       | Yes            | Set by system
-ownerId         | LOOKUP    | No       | Yes            | Set by userId
-created_at      | DATETIME  | No       | Yes            | Auto-set
-updated_at      | DATETIME  | No       | Yes            | Auto-set on update
-createdAt       | DATETIME  | No       | Yes            | Alias for created_at
-updatedAt       | DATETIME  | No       | Yes            | Alias for updated_at
-createdBy       | LOOKUP    | No       | Yes            | Future use
-updatedBy       | LOOKUP    | No       | Yes            | Future use
-```
-
-## Backward Compatibility
-
-✅ **Fully backward compatible** - Works with both:
-- **New objects**: Fields created with correct isSystem flags
-- **Old objects**: Fields normalized on-the-fly by backend
-
-No migration needed. Existing objects automatically get normalized when fetched.
-
-## Validation Flow
-
-```
-User creates record:
-  { customField: "value" }
-        ↓
-Frontend renders form:
-  - Hides: id, tenantId, ownerId, created_at, updated_at (system fields)
-  - Shows: customField (user-defined)
-        ↓
-Frontend validation:
-  - Checks only visible fields
-  - Skips validation for hidden system fields ✓
-        ↓
-Frontend filters before save:
-  - Removes all system fields
-  - Sends: { customField: "value" } ✓
-        ↓
-Backend receives clean data:
-  - Validates against Objection model
-  - Sets system fields via hooks
-        ↓
-Record created with all fields populated ✓
-```
-
-## Files Modified
-
-| File | Changes | Status |
-|------|---------|--------|
-| [backend/src/object/object.service.ts](backend/src/object/object.service.ts) | Added normalizeField() helper, updated getObjectDefinition() | ✅ |
-| [frontend/composables/useFieldViews.ts](frontend/composables/useFieldViews.ts) | Added complete system field names list including ownerId, tenantId | ✅ |
-| [frontend/components/views/EditViewEnhanced.vue](frontend/components/views/EditViewEnhanced.vue) | Updated system fields list in handleSave() | ✅ |
-
-## Testing
-
-### Test 1: Create New Object
-```bash
-POST /api/objects
-{
-  "apiName": "TestObject",
-  "label": "Test Object"
-}
-```
-✅ Should create with standard fields
-
-### Test 2: Create Record for New Object
-```
-Open UI for newly created TestObject
-Click "Create Record"
-```
-✅ Should NOT show "Owner is required" error
-✅ Should NOT show "Created At is required" error
-✅ Should NOT show "Updated At is required" error
-
-### Test 3: Create Record for Old Object
-```
-Use an object created before the fix
-Click "Create Record"
-```
-✅ Should NOT show validation errors for system fields
-✅ Should auto-normalize on fetch
-
-### Test 4: Verify Field Hidden
-```
-In create form, inspect HTML/Console
-```
-✅ Should NOT find input fields for: id, tenantId, ownerId, created_at, updated_at
-
-### Test 5: Verify Data Filtering
-```
-In browser console:
-- Set breakpoint in handleSave()
-- Check saveData before emit()
-```
-✅ Should NOT contain: id, tenantId, ownerId, created_at, updated_at
-
-## Edge Cases Handled
-
-1. **Null/Undefined isSystem flag** ✓
-   - Backend normalizes: isSystem = null becomes true for system fields
-   - Frontend checks both: field name AND isSystem flag
-
-2. **Snake_case vs camelCase** ✓
-   - Both created_at and createdAt handled
-   - Both updated_at and updatedAt handled
-
-3. **Old objects without isCustom flag** ✓
-   - Backend normalizes: isCustom = false for system fields, true for others
-
-4. **Field retrieval from different endpoints** ⚠️
-   - Only getObjectDefinition normalizes fields
-   - Other endpoints return raw data (acceptable for internal use)
-
-## Performance Impact
-
-- **Backend**: Minimal - Single array map per getObjectDefinition call
-- **Frontend**: None - Logic was already there, just enhanced
-- **Network**: No change - Same response size
-
-## Summary
-
-The fix ensures **100% coverage** of system fields:
-1. **Backend**: Normalizes all field definitions on-the-fly
-2. **Frontend**: Checks both field names AND isSystem flag
-3. **Backward compatible**: Works with both new and old objects
-4. **No migration needed**: All normalization happens in code
-
-Users will never see validation errors for system-managed fields again.

docs/SALESFORCE_AUTHORIZATION.md

@@ -1,211 +0,0 @@
-# Salesforce-Style Authorization System
-
-## Overview
-Implemented a comprehensive authorization system based on Salesforce's model with:
-- **Org-Wide Defaults (OWD)** for record visibility
-- **Role-based permissions** for object and field access
-- **Record sharing** for granular access control
-- **CASL** for flexible permission evaluation
-
-## Architecture
-
-### 1. Org-Wide Defaults (OWD)
-Controls baseline record visibility for each object:
-- `private`: Only owner can see records
-- `public_read`: Everyone can see, only owner can edit/delete
-- `public_read_write`: Everyone can see and modify all records
-
-### 2. Role-Based Object Permissions
-Table: `role_object_permissions`
-- `canCreate`: Can create new records
-- `canRead`: Can read records (subject to OWD)
-- `canEdit`: Can edit records (subject to OWD)
-- `canDelete`: Can delete records (subject to OWD)
-- `canViewAll`: Override OWD to see ALL records
-- `canModifyAll`: Override OWD to edit ALL records
-
-### 3. Field-Level Security
-Table: `role_field_permissions`
-- `canRead`: Can view field value
-- `canEdit`: Can modify field value
-
-### 4. Record Sharing
-Table: `record_shares`
-Grants specific users access to individual records with:
-```json
-{
-  "canRead": boolean,
-  "canEdit": boolean,
-  "canDelete": boolean
-}
-```
-
-## Permission Evaluation Flow
-
-```
-1. Check role_object_permissions
-   ├─ Does user have canCreate/Read/Edit/Delete?
-   │  └─ NO → Deny
-   │  └─ YES → Continue
-   │
-2. Check canViewAll / canModifyAll
-   ├─ Does user have special "all" permissions?
-   │  └─ YES → Grant access
-   │  └─ NO → Continue
-   │
-3. Check OWD (orgWideDefault)
-   ├─ public_read_write → Grant access
-   ├─ public_read → Grant read, check ownership for write
-   └─ private → Check ownership or sharing
-   
-4. Check Ownership
-   ├─ Is user the record owner?
-   │  └─ YES → Grant access
-   │  └─ NO → Continue
-   │
-5. Check Record Shares
-   └─ Is record explicitly shared with user?
-      └─ Check accessLevel permissions
-```
-
-## Field-Level Security
-
-Fields are filtered after record access is granted:
-1. User queries records → Apply record-level scope
-2. System filters readable fields based on `role_field_permissions`
-3. User updates records → System filters editable fields
-
-## Key Features
-
-### Multiple Role Support
-- Users can have multiple roles
-- Permissions are **unioned** (any role grants = user has it)
-- More flexible than Salesforce's single profile model
-
-### Active Share Detection
-- Shares can expire (`expiresAt`)
-- Shares can be revoked (`revokedAt`)
-- Only active shares are evaluated
-
-### CASL Integration
-- Dynamic ability building per request
-- Condition-based rules
-- Field-level permission support
-
-## Usage Example
-
-```typescript
-// In a controller/service
-constructor(
-  private authService: AuthorizationService,
-  private tenantDbService: TenantDatabaseService,
-) {}
-
-async getRecords(tenantId: string, objectApiName: string, userId: string) {
-  const knex = await this.tenantDbService.getTenantKnex(tenantId);
-  
-  // Get user with roles
-  const user = await User.query(knex)
-    .findById(userId)
-    .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
-  
-  // Get object definition
-  const objectDef = await ObjectDefinition.query(knex)
-    .findOne({ apiName: objectApiName });
-  
-  // Build query with authorization scope
-  let query = knex(objectApiName.toLowerCase());
-  query = await this.authService.applyScopeToQuery(
-    query,
-    objectDef,
-    user,
-    'read',
-    knex,
-  );
-  
-  const records = await query;
-  
-  // Get field definitions
-  const fields = await FieldDefinition.query(knex)
-    .where('objectDefinitionId', objectDef.id);
-  
-  // Filter fields user can read
-  const filteredRecords = await Promise.all(
-    records.map(record => 
-      this.authService.filterReadableFields(record, fields, user)
-    )
-  );
-  
-  return filteredRecords;
-}
-
-async updateRecord(tenantId: string, objectApiName: string, recordId: string, data: any, userId: string) {
-  const knex = await this.tenantDbService.getTenantKnex(tenantId);
-  
-  const user = await User.query(knex)
-    .findById(userId)
-    .withGraphFetched('[roles.[objectPermissions, fieldPermissions]]');
-  
-  const objectDef = await ObjectDefinition.query(knex)
-    .findOne({ apiName: objectApiName });
-  
-  // Get existing record
-  const record = await knex(objectApiName.toLowerCase())
-    .where({ id: recordId })
-    .first();
-  
-  if (!record) {
-    throw new NotFoundException('Record not found');
-  }
-  
-  // Check if user can update this record
-  await this.authService.assertCanPerformAction(
-    'update',
-    objectDef,
-    record,
-    user,
-    knex,
-  );
-  
-  // Get field definitions
-  const fields = await FieldDefinition.query(knex)
-    .where('objectDefinitionId', objectDef.id);
-  
-  // Filter to only editable fields
-  const editableData = await this.authService.filterEditableFields(
-    data,
-    fields,
-    user,
-  );
-  
-  // Perform update
-  await knex(objectApiName.toLowerCase())
-    .where({ id: recordId })
-    .update(editableData);
-  
-  return knex(objectApiName.toLowerCase())
-    .where({ id: recordId })
-    .first();
-}
-```
-
-## Migration
-
-Run the migration to add authorization tables:
-```bash
-npm run knex migrate:latest
-```
-
-The migration creates:
-- `orgWideDefault` column in `object_definitions`
-- `role_object_permissions` table
-- `role_field_permissions` table
-- `record_shares` table
-
-## Next Steps
-
-1. **Migrate existing data**: Set default `orgWideDefault` values for existing objects
-2. **Create default roles**: Create Admin, Standard User, etc. with appropriate permissions
-3. **Update API endpoints**: Integrate authorization service into all CRUD operations
-4. **UI for permission management**: Build admin interface to manage role permissions
-5. **Sharing UI**: Build interface for users to share records with others

docs/SYSTEM_FIELDS_FIX.md

@@ -1,314 +0,0 @@
-# System Fields Validation Fix - Checklist
-
-## Problem
-When creating or updating records, frontend validation was showing:
-- "Created At is required"
-- "Updated At is required"
-
-This happened because system-managed fields were marked with `isRequired: true` in the database and frontend was trying to validate them.
-
-## Root Causes Identified
-
-1. **Backend Issue**: Standard field definitions were created with `isRequired: true`
-   - `ownerId` - marked required but auto-set by system
-   - `created_at` - marked required but auto-set by system  
-   - `updated_at` - marked required but auto-set by system
-   - `name` - marked required but should be optional
-
-2. **Backend Issue**: System fields not marked with `isSystem: true`
-   - Missing flag that identifies auto-managed fields
-   - Frontend couldn't distinguish system fields from user fields
-
-3. **Frontend Issue**: Field hiding logic didn't fully account for system fields
-   - Only checked against hardcoded list of field names
-   - Didn't check `isSystem` flag from backend
-
-4. **Frontend Issue**: Form data wasn't filtered before saving
-   - System fields might be included in submission
-   - Could cause validation errors on backend
-
-## Fixes Applied
-
-### Backend Changes
-
-**File**: [backend/src/object/object.service.ts](backend/src/object/object.service.ts#L100-L142)
-
-Changed standard field definitions:
-```typescript
-// BEFORE (lines 100-132)
-ownerId:      isRequired: true
-name:         isRequired: true
-created_at:   isRequired: true
-updated_at:   isRequired: true
-
-// AFTER 
-ownerId:      isRequired: false, isSystem: true
-name:         isRequired: false, isSystem: false
-created_at:   isRequired: false, isSystem: true
-updated_at:   isRequired: false, isSystem: true
-```
-
-Changes made:
-- ✅ Set `isRequired: false` for all system fields (they're auto-managed)
-- ✅ Added `isSystem: true` flag for ownerId, created_at, updated_at
-- ✅ Set `isCustom: false` for all standard fields
-- ✅ Set `name` as optional field (`isRequired: false`)
-
-### Frontend Changes
-
-**File**: [frontend/composables/useFieldViews.ts](frontend/composables/useFieldViews.ts#L12-L40)
-
-Enhanced field mapping logic:
-```typescript
-// BEFORE
-const isAutoGeneratedField = ['id', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy']
-
-// AFTER
-const isSystemField = Boolean(fieldDef.isSystem)  // Check backend flag
-const isAutoGeneratedField = ['id', 'createdAt', 'updatedAt', 'created_at', 'updated_at', 'createdBy', 'updatedBy']
-const shouldHideOnEdit = isSystemField || isAutoGeneratedField  // Check both
-
-showOnEdit: fieldDef.uiMetadata?.showOnEdit ?? !shouldHideOnEdit  // Hide system fields
-```
-
-Changes made:
-- ✅ Added check for backend `isSystem` flag
-- ✅ Added snake_case field names (created_at, updated_at)
-- ✅ Combined both checks to hide system fields on edit
-- ✅ System fields still visible on list and detail views (read-only)
-
-**File**: [frontend/components/views/EditViewEnhanced.vue](frontend/components/views/EditViewEnhanced.vue#L160-L169)
-
-Added data filtering before save:
-```typescript
-// BEFORE
-const handleSave = () => {
-  if (validateForm()) {
-    emit('save', formData.value)
-  }
-}
-
-// AFTER
-const handleSave = () => {
-  if (validateForm()) {
-    // Filter out system fields from save data
-    const saveData = { ...formData.value }
-    const systemFields = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', 'createdAt', 'updatedAt']
-    for (const field of systemFields) {
-      delete saveData[field]
-    }
-    emit('save', saveData)
-  }
-}
-```
-
-Changes made:
-- ✅ Strip system fields before sending to API
-- ✅ Prevents accidental submission of read-only fields
-- ✅ Ensures API receives only user-provided data
-
-## How It Works Now
-
-### Create Record Flow
-```
-User fills form with business data:
-  { name: "Acme", revenue: 1000000 }
-         ↓
-Frontend validation skips system fields:
-  - created_at (showOnEdit: false, filtered)
-  - updated_at (showOnEdit: false, filtered)
-  - ownerId (showOnEdit: false, filtered)
-         ↓
-Frontend filters system fields before save:
-  deleteProperty(saveData, 'created_at')
-  deleteProperty(saveData, 'updated_at')
-  deleteProperty(saveData, 'ownerId')
-         ↓
-API receives clean data:
-  { name: "Acme", revenue: 1000000 }
-         ↓
-Backend's Objection model auto-manages:
-  $beforeInsert() hook:
-    - Sets id (UUID)
-    - Sets ownerId (from userId)
-    - Sets created_at (now)
-    - Sets updated_at (now)
-         ↓
-Database receives complete record with all fields
-```
-
-### Update Record Flow
-```
-User edits record, changes revenue:
-  { revenue: 1500000 }
-         ↓
-Frontend validation skips system fields
-Frontend filters before save:
-  - Removes ownerId (read-only)
-  - Removes created_at (immutable)
-  - Removes updated_at (will be set by system)
-         ↓
-API receives:
-  { revenue: 1500000 }
-         ↓
-Backend filters out protected fields (double-check):
-  delete allowedData.ownerId
-  delete allowedData.created_at
-  delete allowedData.tenantId
-         ↓
-Backend's Objection model:
-  $beforeUpdate() hook:
-    - Sets updated_at (now)
-         ↓
-Database receives update with timestamp updated
-```
-
-## Field Visibility Rules
-
-System fields now properly hidden:
-
-| Field | Create | Detail | List | Edit | Notes |
-|-------|--------|--------|------|------|-------|
-| id | No | Yes | No | No | Auto-generated UUID |
-| ownerId | No | Yes | No | No | Auto-set from auth |
-| created_at | No | Yes | Yes | No | Auto-set on insert |
-| updated_at | No | Yes | No | No | Auto-set on insert/update |
-| name | No | Yes | Yes | **Yes** | Optional user field |
-| custom fields | No | Yes | Yes | Yes | User-defined fields |
-
-Legend:
-- No = Field not visible to users
-- Yes = Field visible (read-only or editable)
-
-## Backend System Field Management
-
-Standard fields auto-created for every new object:
-
-```
-ownerId (type: LOOKUP)
-  ├─ isRequired: false
-  ├─ isSystem: true
-  ├─ isCustom: false
-  └─ Auto-set by ObjectService.createRecord()
-
-name (type: TEXT)
-  ├─ isRequired: false
-  ├─ isSystem: false
-  ├─ isCustom: false
-  └─ Optional user field
-
-created_at (type: DATE_TIME)
-  ├─ isRequired: false
-  ├─ isSystem: true
-  ├─ isCustom: false
-  └─ Auto-set by DynamicModel.$beforeInsert()
-
-updated_at (type: DATE_TIME)
-  ├─ isRequired: false
-  ├─ isSystem: true
-  ├─ isCustom: false
-  └─ Auto-set by DynamicModel.$beforeInsert/Update()
-```
-
-## Validation Logic
-
-### Frontend Validation (EditViewEnhanced.vue)
-
-1. Skip fields with `showOnEdit === false`
-   - System fields automatically excluded
-   - Created At, Updated At, ownerId won't be validated
-
-2. Validate only remaining fields:
-   - Check required fields have values
-   - Apply custom validation rules
-   - Show errors inline
-
-3. Filter data before save:
-   - Remove system fields
-   - Send clean data to API
-
-### Backend Validation (ObjectService)
-
-1. Check object definition exists
-2. Get bound Objection model
-3. Model validates field types (JSON schema)
-4. Model auto-manages system fields via hooks
-5. Insert/Update data in database
-
-## Testing the Fix
-
-### Test 1: Create Record
-```bash
-# In Nuxt app, create new record
-POST /api/records/Account
-Body: { 
-  name: "Test Account",
-  revenue: 1000000
-}
-
-# Should NOT show validation error for Created At or Updated At
-# Should create record with auto-populated system fields
-```
-
-### Test 2: Check System Fields Are Hidden
-```
-Look at create form:
-- ✅ ownerId field - NOT visible
-- ✅ created_at field - NOT visible
-- ✅ updated_at field - NOT visible
-- ✅ name field - VISIBLE (optional)
-- ✅ custom fields - VISIBLE
-```
-
-### Test 3: Update Record
-```bash
-# Edit existing record
-PATCH /api/records/Account/record-id
-Body: {
-  revenue: 1500000
-}
-
-# Should NOT show validation error
-# Should NOT allow changing ownerId
-# Should auto-update timestamp
-```
-
-### Test 4: Verify Frontend Filtering
-```
-Open browser console:
-- Check form data before save
-- Should NOT include id, ownerId, created_at, updated_at
-- Should include user-provided fields only
-```
-
-## Files Modified
-
-| File | Changes | Status |
-|------|---------|--------|
-| [backend/src/object/object.service.ts](backend/src/object/object.service.ts) | Standard fields: isRequired→false, added isSystem, isCustom | ✅ |
-| [frontend/composables/useFieldViews.ts](frontend/composables/useFieldViews.ts) | Field hiding logic: check isSystem flag + snake_case names | ✅ |
-| [frontend/components/views/EditViewEnhanced.vue](frontend/components/views/EditViewEnhanced.vue) | handleSave: filter system fields before emit | ✅ |
-
-## Verification
-
-✅ Backend compiles: `npm run build` successful
-✅ System fields marked with isSystem: true
-✅ System fields marked with isRequired: false
-✅ Frontend filtering implemented
-✅ Frontend hiding logic enhanced
-
-## Related Documentation
-
-- [OBJECTION_MODEL_SYSTEM.md](OBJECTION_MODEL_SYSTEM.md) - Model system details
-- [OBJECTION_QUICK_REFERENCE.md](OBJECTION_QUICK_REFERENCE.md) - Quick guide
-- [TEST_OBJECT_CREATION.md](TEST_OBJECT_CREATION.md) - Test procedures
-
-## Summary
-
-The fix ensures that system-managed fields (id, ownerId, created_at, updated_at) are:
-1. **Never required from users** - Marked `isRequired: false`
-2. **Clearly marked as system** - Have `isSystem: true` flag
-3. **Hidden from edit forms** - Via `showOnEdit: false`
-4. **Filtered before submission** - Not sent to API
-5. **Auto-managed by backend** - Set by model hooks
-6. **Protected from modification** - Backend filters out in updates

docs/SYSTEM_FIELDS_REFERENCE.md

@@ -1,195 +0,0 @@
-# System Fields - Quick Reference
-
-## What Are System Fields?
-
-Fields that are automatically managed by the system and should never require user input:
-- `id` - Unique record identifier (UUID)
-- `tenantId` - Tenant ownership
-- `ownerId` - User who owns the record
-- `created_at` - Record creation timestamp
-- `updated_at` - Last modification timestamp
-
-## Frontend Treatment
-
-### Hidden from Edit Forms
-System fields are automatically hidden from create/edit forms:
-```
-❌ Not visible to users
-❌ Not validated
-❌ Not submitted to API
-```
-
-### Visible on Detail/List Views (Read-Only)
-System fields appear on detail and list views as read-only information:
-```
-✅ Visible to users (informational)
-✅ Not editable
-✅ Shows metadata about records
-```
-
-## Backend Treatment
-
-### Auto-Set on Insert
-When creating a record, Objection model hooks auto-set:
-```javascript
-{
-  $beforeInsert() {
-    if (!this.id) this.id = randomUUID();
-    if (!this.created_at) this.created_at = now();
-    if (!this.updated_at) this.updated_at = now();
-  }
-}
-```
-
-### Auto-Set on Update
-When updating a record:
-```javascript
-{
-  $beforeUpdate() {
-    this.updated_at = now();  // Always update timestamp
-  }
-}
-```
-
-### Protected from Updates
-Backend filters out system fields in update requests:
-```typescript
-delete allowedData.ownerId;      // Can't change owner
-delete allowedData.id;            // Can't change ID
-delete allowedData.created_at;   // Can't change creation time
-delete allowedData.tenantId;     // Can't change tenant
-```
-
-## Field Status Matrix
-
-| Field | Value | Source | Immutable | User Editable |
-|-------|-------|--------|-----------|---------------|
-| id | UUID | System | ✓ Yes | ✗ No |
-| tenantId | UUID | System | ✓ Yes | ✗ No |
-| ownerId | UUID | Auth context | ✓ Yes* | ✗ No |
-| created_at | Timestamp | Database | ✓ Yes | ✗ No |
-| updated_at | Timestamp | Database | ✗ No** | ✗ No |
-
-*ownerId: Set once on creation, immutable after
-**updated_at: Changes on every update (automatic)
-
-## How It Works
-
-### Create Record
-```
-User form input:
-┌─────────────────────┐
-│ Name: "Acme Corp"   │
-│ Revenue: 1000000    │
-└─────────────────────┘
-          ↓
-Backend Objection Model:
-┌──────────────────────────────────────┐
-│ INSERT INTO accounts (               │
-│   id,            ← Generated UUID    │
-│   name,          ← User input        │
-│   revenue,       ← User input        │
-│   ownerId,       ← From auth         │
-│   created_at,    ← Current timestamp │
-│   updated_at,    ← Current timestamp │
-│   tenantId       ← From context      │
-│ ) VALUES (...)                       │
-└──────────────────────────────────────┘
-```
-
-### Update Record
-```
-User form input:
-┌─────────────────────┐
-│ Revenue: 1500000    │
-└─────────────────────┘
-          ↓
-Backend filters:
-┌──────────────────────────────────┐
-│ UPDATE accounts SET              │
-│   revenue = 1500000,  ← Allowed  │
-│   updated_at = now()  ← Auto     │
-│ WHERE id = abc123                │
-│                                  │
-│ ownerId, created_at stay same    │
-└──────────────────────────────────┘
-```
-
-## Validation Errors - Solved
-
-### Before Fix
-```
-"Owner is required"
-"Created At is required"
-"Updated At is required"
-```
-
-### After Fix
-```
-✓ No system field validation errors
-✓ System fields hidden from forms
-✓ System fields auto-managed by backend
-```
-
-## Field Detection Logic
-
-Frontend identifies system fields by:
-1. **Field name** - Known system field names
-2. **isSystem flag** - Backend marker (`isSystem: true`)
-
-Either condition causes field to be hidden from edit:
-```typescript
-const systemFieldNames = ['id', 'tenantId', 'ownerId', 'created_at', 'updated_at', ...]
-const isSystemField = Boolean(fieldDef.isSystem)
-const isAutoGeneratedField = systemFieldNames.includes(fieldDef.apiName)
-
-if (isSystemField || isAutoGeneratedField) {
-  showOnEdit = false  // Hide from edit form
-}
-```
-
-## Backward Compatibility
-
-✅ Works with:
-- **New objects** - Created with proper flags
-- **Old objects** - Flags added on-the-fly during retrieval
-- **Mixed environments** - Both types work simultaneously
-
-## Common Tasks
-
-### Create a New Record
-```
-1. Click "Create [Object]"
-2. See form with user-editable fields only
-3. Fill in required fields
-4. Click "Save"
-5. System auto-sets: id, ownerId, created_at, updated_at ✓
-```
-
-### View Record Details
-```
-1. Click record name
-2. See all fields including system fields
-3. System fields shown read-only:
-   - Created: [date] (when created)
-   - Modified: [date] (when last updated)
-   - Owner: [user name] (who owns it) ✓
-```
-
-### Update Record
-```
-1. Click "Edit [Record]"
-2. See form with user-editable fields only
-3. Change values
-4. Click "Save"
-5. System auto-updates: updated_at ✓
-6. ownerId and created_at unchanged ✓
-```
-
-## Related Files
-
-- [SYSTEM_FIELDS_FIX.md](SYSTEM_FIELDS_FIX.md) - Detailed fix documentation
-- [OWNER_FIELD_VALIDATION_FIX.md](OWNER_FIELD_VALIDATION_FIX.md) - Owner field specific fix
-- [OBJECTION_MODEL_SYSTEM.md](OBJECTION_MODEL_SYSTEM.md) - Model system architecture
-- [backend/src/object/object.service.ts](backend/src/object/object.service.ts#L278-L291) - Normalization code
-- [frontend/composables/useFieldViews.ts](frontend/composables/useFieldViews.ts#L12-L20) - Frontend field detection

docs/TEST_OBJECT_CREATION.md

@@ -1,124 +0,0 @@
-# Object and Record Creation Test
-
-## Goal
-Test that the Objection.js model system properly handles system-managed fields:
-- ownerId (should be auto-set from userId)
-- created_at (should be auto-set to current timestamp)
-- updated_at (should be auto-set to current timestamp)
-- id (should be auto-generated UUID)
-
-Users should NOT need to provide these fields when creating records.
-
-## Test Sequence
-
-### 1. Create an Object (if not exists)
-
-```bash
-curl -X POST http://localhost:3001/api/objects \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{
-    "apiName": "TestContact",
-    "label": "Test Contact",
-    "pluralLabel": "Test Contacts",
-    "description": "Test object for model validation"
-  }'
-```
-
-Expected response:
-```json
-{
-  "id": "uuid...",
-  "apiName": "TestContact",
-  "label": "Test Contact",
-  "tableName": "test_contacts",
-  "...": "..."
-}
-```
-
-### 2. Create a Record WITHOUT System Fields
-
-This should succeed and system fields should be auto-populated:
-
-```bash
-curl -X POST http://localhost:3001/api/records/TestContact \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{
-    "name": "John Doe",
-    "email": "john@example.com"
-  }'
-```
-
-Expected response:
-```json
-{
-  "id": "uuid-auto-generated",
-  "name": "John Doe",
-  "email": "john@example.com",
-  "ownerId": "current-user-id",
-  "created_at": "2025-01-26T...",
-  "updated_at": "2025-01-26T...",
-  "tenantId": "tenant-uuid"
-}
-```
-
-### 3. Verify Fields Were Set Automatically
-
-```bash
-curl -X GET http://localhost:3001/api/records/TestContact/RECORD_ID \
-  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
-  -H "X-Tenant-ID: tenant1"
-```
-
-Verify response includes:
-- ✅ id (UUID)
-- ✅ ownerId (matches current user ID)
-- ✅ created_at (timestamp)
-- ✅ updated_at (timestamp)
-- ✅ name, email (provided fields)
-
-### 4. Update Record and Verify updated_at Changes
-
-Get the created_at value, wait a second, then update:
-
-```bash
-curl -X PATCH http://localhost:3001/api/records/TestContact/RECORD_ID \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
-  -H "X-Tenant-ID: tenant1" \
-  -d '{
-    "name": "Jane Doe"
-  }'
-```
-
-Verify in response:
-- ✅ name is updated to "Jane Doe"
-- ✅ updated_at is newer than original created_at
-- ✅ created_at is unchanged
-- ✅ ownerId is unchanged (not overwritable)
-
-## Key Points to Verify
-
-1. **System Fields Not Required**: Record creation succeeds without ownerId, created_at, updated_at
-2. **Auto-Population**: System fields are populated automatically by model hooks
-3. **Immutable Owner**: ownerId cannot be changed via update (filtered out in ObjectService.updateRecord)
-4. **Timestamp Management**: created_at stays same, updated_at changes on update
-5. **Model Used**: Debug logs should show model is being used (look for "Registered model" logs)
-
-## Troubleshooting
-
-If tests fail, check:
-
-1. **Model Registration**: Verify model appears in logs after object creation
-2. **Hook Execution**: Add debug logs to DynamicModel.$beforeInsert and $beforeUpdate
-3. **Model Binding**: Verify getBoundModel returns properly bound model with correct knex instance
-4. **Field Validation**: Check if JSON schema validation is preventing record creation
-
-## Related Files
-
-- [backend/src/object/models/dynamic-model.factory.ts](backend/src/object/models/dynamic-model.factory.ts) - Model creation with hooks
-- [backend/src/object/models/model.service.ts](backend/src/object/models/model.service.ts) - Model lifecycle management
-- [backend/src/object/object.service.ts](backend/src/object/object.service.ts) - Updated CRUD to use models

frontend/components/AppSidebar.vue

@@ -105,16 +105,6 @@ const staticMenuItems = [
         url: '/setup/objects',
         icon: Boxes,
       },
-      {
-        title: 'Users',
-        url: '/setup/users',
-        icon: Users,
-      },
-      {
-        title: 'Roles',
-        url: '/setup/roles',
-        icon: Layers,
-      },
     ],
   },
 ]

frontend/components/FieldLevelSecurity.vue

@@ -1,344 +0,0 @@
-<template>
-  <Card>
-    <CardHeader>
-      <CardTitle>Field-Level Security</CardTitle>
-      <CardDescription>
-        Control which fields each role can read and edit
-      </CardDescription>
-    </CardHeader>
-    <CardContent>
-      <div v-if="loading" class="flex items-center justify-center py-8">
-        <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
-      </div>
-
-      <div v-else-if="roles.length === 0" class="text-sm text-muted-foreground py-4">
-        No roles available. Create roles first to manage field-level permissions.
-      </div>
-
-      <div v-else class="space-y-6">
-        <!-- Role Selector -->
-        <div class="space-y-2">
-          <Label>Select Role</Label>
-          <Select v-model="selectedRoleId" @update:model-value="(value) => selectedRoleId = value">
-            <SelectTrigger class="w-full">
-              <SelectValue placeholder="Choose a role to configure permissions" />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem v-for="role in roles" :key="role.id" :value="role.id">
-                {{ role.name }}
-              </SelectItem>
-            </SelectContent>
-          </Select>
-        </div>
-
-        <!-- Object-Level Permissions -->
-        <div v-if="selectedRoleId" class="space-y-2">
-          <h3 class="text-sm font-medium">Object-Level Permissions</h3>
-          <div class="rounded-md border">
-            <table class="w-full">
-              <thead>
-                <tr class="border-b bg-muted/50">
-                  <th class="p-3 text-left font-medium">Permission</th>
-                  <th class="p-3 text-center font-medium">Enabled</th>
-                </tr>
-              </thead>
-              <tbody>
-                <tr class="border-b hover:bg-muted/30">
-                  <td class="p-3">Create</td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="objectPermissions.canCreate"
-                      @update:model-value="(checked: boolean) => updateObjectPermission('canCreate', checked)"
-                    />
-                  </td>
-                </tr>
-                <tr class="border-b hover:bg-muted/30">
-                  <td class="p-3">Read</td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="objectPermissions.canRead"
-                      @update:model-value="(checked: boolean) => updateObjectPermission('canRead', checked)"
-                    />
-                  </td>
-                </tr>
-                <tr class="border-b hover:bg-muted/30">
-                  <td class="p-3">Edit</td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="objectPermissions.canEdit"
-                      @update:model-value="(checked: boolean) => updateObjectPermission('canEdit', checked)"
-                    />
-                  </td>
-                </tr>
-                <tr class="border-b hover:bg-muted/30">
-                  <td class="p-3">Delete</td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="objectPermissions.canDelete"
-                      @update:model-value="(checked: boolean) => updateObjectPermission('canDelete', checked)"
-                    />
-                  </td>
-                </tr>
-                <tr class="border-b hover:bg-muted/30">
-                  <td class="p-3">View All</td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="objectPermissions.canViewAll"
-                      @update:model-value="(checked: boolean) => updateObjectPermission('canViewAll', checked)"
-                    />
-                  </td>
-                </tr>
-                <tr class="hover:bg-muted/30">
-                  <td class="p-3">Modify All</td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="objectPermissions.canModifyAll"
-                      @update:model-value="(checked: boolean) => updateObjectPermission('canModifyAll', checked)"
-                    />
-                  </td>
-                </tr>
-              </tbody>
-            </table>
-          </div>
-        </div>
-
-        <!-- Field-Level Permissions -->
-        <div v-if="selectedRoleId" class="space-y-2">
-          <h3 class="text-sm font-medium">Field-Level Permissions</h3>
-          <div class="rounded-md border">
-            <table class="w-full">
-              <thead>
-                <tr class="border-b bg-muted/50">
-                  <th class="p-3 text-left font-medium">Field</th>
-                  <th class="p-3 text-center font-medium">Read</th>
-                  <th class="p-3 text-center font-medium">Edit</th>
-                </tr>
-              </thead>
-              <tbody>
-                <tr 
-                  v-for="field in fields" 
-                  :key="field.id"
-                  class="border-b hover:bg-muted/30"
-                >
-                  <td class="p-3">
-                    <div>
-                      <div class="font-medium">{{ field.label }}</div>
-                      <div class="text-xs text-muted-foreground">{{ field.apiName }}</div>
-                    </div>
-                  </td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="hasPermission(field.id, selectedRoleId, 'read')"
-                      @update:model-value="(checked: boolean) => updatePermission(field.id, selectedRoleId, 'read', checked)"
-                      :disabled="field.isSystem"
-                    />
-                  </td>
-                  <td class="p-3 text-center">
-                    <Checkbox
-                      :model-value="hasPermission(field.id, selectedRoleId, 'edit')"
-                      @update:model-value="(checked: boolean) => updatePermission(field.id, selectedRoleId, 'edit', checked)"
-                      :disabled="field.isSystem || !hasPermission(field.id, selectedRoleId, 'read')"
-                    />
-                  </td>
-                </tr>
-              </tbody>
-            </table>
-          </div>
-        </div>
-
-        <div class="flex items-center gap-2 text-sm text-muted-foreground">
-          <Info class="h-4 w-4" />
-          <span>System fields are always readable. Edit permissions require read permission first. Changes save automatically.</span>
-        </div>
-        
-        <div v-if="saving" class="flex items-center gap-2 text-sm text-primary">
-          <div class="animate-spin rounded-full h-4 w-4 border-b-2 border-primary"></div>
-          <span>Saving...</span>
-        </div>
-      </div>
-    </CardContent>
-  </Card>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted, computed, watch } from 'vue';
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
-import { Checkbox } from '~/components/ui/checkbox';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
-import { Label } from '~/components/ui/label';
-import { Info } from 'lucide-vue-next';
-
-const props = defineProps<{
-  objectId: string;
-  objectApiName: string;
-  fields: any[];
-}>();
-
-const { api } = useApi();
-const { toast } = useToast();
-
-const loading = ref(true);
-const saving = ref(false);
-const roles = ref<any[]>([]);
-const selectedRoleId = ref<string>('');
-const permissions = ref<Map<string, Map<string, { canRead: boolean; canEdit: boolean }>>>(new Map());
-const objectPermissions = ref({
-  canCreate: false,
-  canRead: false,
-  canEdit: false,
-  canDelete: false,
-  canViewAll: false,
-  canModifyAll: false,
-});
-
-// Load roles and permissions
-onMounted(async () => {
-  try {
-    loading.value = true;
-    
-    // Load roles
-    const rolesResponse = await api.get('/setup/roles');
-    roles.value = rolesResponse || [];
-    
-    // Load existing permissions for this object
-    const permsResponse = await api.get(`/setup/objects/${props.objectId}/field-permissions`);
-    
-    // Build permissions map: fieldId -> roleId -> {canRead, canEdit}
-    const permsMap = new Map();
-    if (permsResponse && Array.isArray(permsResponse)) {
-      for (const perm of permsResponse) {
-        if (!permsMap.has(perm.fieldDefinitionId)) {
-          permsMap.set(perm.fieldDefinitionId, new Map());
-        }
-        permsMap.get(perm.fieldDefinitionId).set(perm.roleId, {
-          canRead: Boolean(perm.canRead),
-          canEdit: Boolean(perm.canEdit),
-        });
-      }
-    }
-    permissions.value = permsMap;
-    
-  } catch (error: any) {
-    console.error('Failed to load field permissions:', error);
-    toast.error('Failed to load field permissions');
-  } finally {
-    loading.value = false;
-  }
-});
-
-const hasPermission = (fieldId: string, roleId: string, type: 'read' | 'edit'): boolean => {
-  const fieldPerms = permissions.value.get(fieldId);
-  if (!fieldPerms) return true; // Default to true if no permissions set
-  const rolePerm = fieldPerms.get(roleId);
-  if (!rolePerm) return true; // Default to true if no permissions set
-  const value = type === 'read' ? rolePerm.canRead : rolePerm.canEdit;
-  return Boolean(value); // Convert 1/0 to true/false
-};
-
-const updatePermission = async (fieldId: string, roleId: string, type: 'read' | 'edit', checked: boolean) => {
-  try {
-    saving.value = true;
-    
-    // Get current permissions
-    if (!permissions.value.has(fieldId)) {
-      permissions.value.set(fieldId, new Map());
-    }
-    const fieldPerms = permissions.value.get(fieldId)!;
-    
-    if (!fieldPerms.has(roleId)) {
-      fieldPerms.set(roleId, { canRead: true, canEdit: true });
-    }
-    const perm = fieldPerms.get(roleId)!;
-    
-    // Update permission
-    if (type === 'read') {
-      perm.canRead = checked;
-      // If disabling read, also disable edit
-      if (!checked) {
-        perm.canEdit = false;
-      }
-    } else {
-      perm.canEdit = checked;
-      // If enabling edit, also enable read
-      if (checked) {
-        perm.canRead = true;
-      }
-    }
-    
-    // Save to backend
-    await api.put(`/setup/objects/${props.objectId}/field-permissions`, {
-      roleId,
-      fieldDefinitionId: fieldId,
-      canRead: perm.canRead,
-      canEdit: perm.canEdit,
-    });
-    
-    toast.success('Permission updated');
-    
-  } catch (error: any) {
-    console.error('Failed to update field permission:', error);
-    toast.error(error.message || 'Failed to update permission');
-    
-    // Revert change
-    if (!permissions.value.has(fieldId)) return;
-    const fieldPerms = permissions.value.get(fieldId)!;
-    if (!fieldPerms.has(roleId)) return;
-    const perm = fieldPerms.get(roleId)!;
-    if (type === 'read') {
-      perm.canRead = !checked;
-    } else {
-      perm.canEdit = !checked;
-    }
-  } finally {
-    saving.value = false;
-  }
-};
-
-const updateObjectPermission = async (permission: string, checked: boolean) => {
-  if (!selectedRoleId.value) return;
-  
-  try {
-    saving.value = true;
-    
-    // Update local state
-    (objectPermissions.value as any)[permission] = checked;
-    
-    // Save to backend
-    await api.put(`/setup/objects/${props.objectApiName}/permissions`, {
-      roleId: selectedRoleId.value,
-      ...objectPermissions.value,
-    });
-    
-    toast.success('Object permission updated');
-  } catch (error: any) {
-    console.error('Failed to update object permission:', error);
-    toast.error(error.message || 'Failed to update permission');
-    
-    // Revert change
-    (objectPermissions.value as any)[permission] = !checked;
-  } finally {
-    saving.value = false;
-  }
-};
-
-// Load object permissions when role changes
-watch(selectedRoleId, async (roleId) => {
-  if (!roleId) return;
-  
-  try {
-    const response = await api.get(`/setup/objects/${props.objectApiName}/permissions/${roleId}`);
-    if (response) {
-      objectPermissions.value = {
-        canCreate: Boolean(response.canCreate),
-        canRead: Boolean(response.canRead),
-        canEdit: Boolean(response.canEdit),
-        canDelete: Boolean(response.canDelete),
-        canViewAll: Boolean(response.canViewAll),
-        canModifyAll: Boolean(response.canModifyAll),
-      };
-    }
-  } catch (error: any) {
-    console.error('Failed to load object permissions:', error);
-  }
-});
-</script>

frontend/components/ObjectAccessSettings.vue

@@ -1,119 +0,0 @@
-<template>
-  <div class="space-y-6">
-    <Card>
-      <CardHeader>
-        <CardTitle>Org-Wide Default</CardTitle>
-        <CardDescription>
-          Control the baseline visibility for records of this object
-        </CardDescription>
-      </CardHeader>
-      <CardContent class="space-y-4">
-        <div class="space-y-2">
-          <Label for="orgWideDefault">Record Visibility</Label>
-          <Select v-model="localOrgWideDefault" @update:model-value="handleOrgWideDefaultChange">
-            <SelectTrigger id="orgWideDefault">
-              <SelectValue placeholder="Select visibility level" />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem value="private">
-                <div>
-                  <div class="font-semibold">Private</div>
-                  <div class="text-xs text-muted-foreground">Only record owner can see</div>
-                </div>
-              </SelectItem>
-              <SelectItem value="public_read">
-                <div>
-                  <div class="font-semibold">Public Read Only</div>
-                  <div class="text-xs text-muted-foreground">Everyone can read, only owner can edit/delete</div>
-                </div>
-              </SelectItem>
-              <SelectItem value="public_read_write">
-                <div>
-                  <div class="font-semibold">Public Read/Write</div>
-                  <div class="text-xs text-muted-foreground">Everyone can read, edit, and delete all records</div>
-                </div>
-              </SelectItem>
-            </SelectContent>
-          </Select>
-          <p class="text-sm text-muted-foreground">
-            This setting controls who can see records by default. Individual user permissions are granted through roles.
-          </p>
-        </div>
-
-      </CardContent>
-    </Card>
-
-    <FieldLevelSecurity 
-      v-if="objectId && objectApiName && fields && fields.length > 0"
-      :object-id="objectId"
-      :object-api-name="objectApiName"
-      :fields="fields"
-    />
-    
-    <div v-else-if="!objectId" class="text-sm text-muted-foreground">
-      Object ID not available
-    </div>
-    
-    <div v-else-if="!fields || fields.length === 0" class="text-sm text-muted-foreground">
-      No fields available
-    </div>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref, watch } from 'vue';
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
-import { Label } from '~/components/ui/label';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
-import FieldLevelSecurity from '~/components/FieldLevelSecurity.vue';
-
-const props = defineProps<{
-  objectApiName: string;
-  objectId?: string;
-  orgWideDefault?: string;
-  fields?: any[];
-}>();
-
-const emit = defineEmits<{
-  update: [orgWideDefault: string];
-}>();
-
-const { $api } = useNuxtApp();
-const { showToast } = useToast();
-
-const localOrgWideDefault = ref(props.orgWideDefault || 'private');
-
-// Watch for prop changes
-watch(() => props.orgWideDefault, (newValue) => {
-  if (newValue) {
-    localOrgWideDefault.value = newValue;
-  }
-});
-
-const handleOrgWideDefaultChange = async (value: string) => {
-  try {
-    // Update object definition
-    await $api(`/api/setup/objects/${props.objectApiName}`, {
-      method: 'PATCH',
-      body: {
-        orgWideDefault: value
-      }
-    });
-
-    showToast({
-      title: 'Success',
-      description: 'Org-Wide Default saved successfully',
-      variant: 'default'
-    });
-
-    emit('update', value);
-  } catch (error: any) {
-    console.error('Failed to update org-wide default:', error);
-    showToast({
-      title: 'Error',
-      description: error.data?.message || 'Failed to save changes',
-      variant: 'destructive'
-    });
-  }
-};
-</script>

frontend/components/PageLayoutRenderer.vue

@@ -14,7 +14,6 @@
           v-if="fieldItem.field"
           :field="fieldItem.field"
           :model-value="modelValue?.[fieldItem.field.apiName]"
-          :record-data="modelValue"
           :mode="readonly ? VM.DETAIL : VM.EDIT"
           @update:model-value="handleFieldUpdate(fieldItem.field.apiName, $event)"
         />
@@ -31,7 +30,6 @@
         <FieldRenderer
           :field="field"
           :model-value="modelValue?.[field.apiName]"
-          :record-data="modelValue"
           :mode="readonly ? VM.DETAIL : VM.EDIT"
           @update:model-value="handleFieldUpdate(field.apiName, $event)"
         />

frontend/components/RecordSharing.vue

@@ -1,348 +0,0 @@
-<template>
-  <div class="record-sharing space-y-4">
-    <div class="flex items-center justify-between">
-      <div>
-        <h3 class="text-lg font-semibold">Sharing</h3>
-        <p class="text-sm text-muted-foreground">
-          Grant access to specific users for this record
-        </p>
-      </div>
-      <Button @click="showShareDialog = true" size="sm">
-        <UserPlus class="h-4 w-4 mr-2" />
-        Share
-      </Button>
-    </div>
-
-    <!-- Loading State -->
-    <div v-if="loading" class="flex items-center justify-center py-8">
-      <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
-    </div>
-
-    <!-- Error State -->
-    <div v-else-if="error" class="text-sm text-destructive">
-      {{ error }}
-    </div>
-
-    <!-- Shares List -->
-    <div v-else-if="shares.length > 0" class="border rounded-lg">
-      <Table>
-        <TableHeader>
-          <TableRow>
-            <TableHead>User</TableHead>
-            <TableHead>Email</TableHead>
-            <TableHead>Access</TableHead>
-            <TableHead>Shared</TableHead>
-            <TableHead class="text-right">Actions</TableHead>
-          </TableRow>
-        </TableHeader>
-        <TableBody>
-          <TableRow v-for="share in shares" :key="share.id">
-            <TableCell class="font-medium">
-              {{ getUserName(share.granteeUser) }}
-            </TableCell>
-            <TableCell>{{ share.granteeUser.email }}</TableCell>
-            <TableCell>
-              <div class="flex gap-1">
-                <Badge v-if="share.accessLevel.canRead" variant="secondary">Read</Badge>
-                <Badge v-if="share.accessLevel.canEdit" variant="secondary">Edit</Badge>
-                <Badge v-if="share.accessLevel.canDelete" variant="secondary">Delete</Badge>
-              </div>
-            </TableCell>
-            <TableCell>{{ formatDate(share.createdAt) }}</TableCell>
-            <TableCell class="text-right">
-              <Button
-                variant="ghost"
-                size="icon"
-                @click="removeShare(share.id)"
-                :disabled="removing === share.id"
-              >
-                <Trash2 class="h-4 w-4" />
-              </Button>
-            </TableCell>
-          </TableRow>
-        </TableBody>
-      </Table>
-    </div>
-
-    <!-- Empty State -->
-    <div v-else class="text-center py-8 text-muted-foreground border rounded-lg">
-      <Users class="h-12 w-12 mx-auto mb-2 opacity-50" />
-      <p>This record is not shared with anyone</p>
-      <p class="text-sm">Click "Share" to grant access to other users</p>
-    </div>
-
-    <!-- Share Dialog -->
-    <Dialog v-model:open="showShareDialog">
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Share Record</DialogTitle>
-          <DialogDescription>
-            Grant access to this record to specific users
-          </DialogDescription>
-        </DialogHeader>
-        <div class="space-y-4">
-          <div class="space-y-2">
-            <Label for="user">User</Label>
-            <Select v-model="newShare.userId" @update:model-value="(value) => newShare.userId = value">
-              <SelectTrigger>
-                <SelectValue placeholder="Select user" />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem
-                  v-for="user in availableUsers"
-                  :key="user.id"
-                  :value="user.id"
-                >
-                  {{ getUserName(user) }} ({{ user.email }})
-                </SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
-
-          <div class="space-y-3">
-            <Label>Permissions</Label>
-            <div class="space-y-2">
-              <div class="flex items-center space-x-2">
-                <Checkbox
-                  id="canRead"
-                  v-model:checked="newShare.canRead"
-                  @update:checked="(value) => newShare.canRead = value"
-                />
-                <label
-                  for="canRead"
-                  class="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
-                >
-                  Can Read
-                </label>
-              </div>
-              <div class="flex items-center space-x-2">
-                <Checkbox
-                  id="canEdit"
-                  v-model:checked="newShare.canEdit"
-                  @update:checked="(value) => newShare.canEdit = value"
-                />
-                <label
-                  for="canEdit"
-                  class="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
-                >
-                  Can Edit
-                </label>
-              </div>
-              <div class="flex items-center space-x-2">
-                <Checkbox
-                  id="canDelete"
-                  v-model:checked="newShare.canDelete"
-                  @update:checked="(value) => newShare.canDelete = value"
-                />
-                <label
-                  for="canDelete"
-                  class="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
-                >
-                  Can Delete
-                </label>
-              </div>
-            </div>
-          </div>
-
-          <div class="space-y-2">
-            <Label for="expiresAt">Expires At (Optional)</Label>
-            <div class="flex gap-2">
-              <DatePicker
-                v-model="expiresDate"
-                placeholder="Select date"
-                class="flex-1"
-              />
-            </div>
-          </div>
-        </div>
-        <DialogFooter>
-          <Button variant="outline" @click="showShareDialog = false">Cancel</Button>
-          <Button
-            @click="createShare"
-            :disabled="!newShare.userId || (!newShare.canRead && !newShare.canEdit && !newShare.canDelete) || sharing"
-          >
-            {{ sharing ? 'Sharing...' : 'Share' }}
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted, computed } from 'vue';
-import { Button } from '~/components/ui/button';
-import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '~/components/ui/table';
-import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
-import { Input } from '~/components/ui/input';
-import { Label } from '~/components/ui/label';
-import { Badge } from '~/components/ui/badge';
-import Checkbox from '~/components/ui/checkbox.vue';
-import DatePicker from '~/components/ui/date-picker/DatePicker.vue';
-import { UserPlus, Trash2, Users } from 'lucide-vue-next';
-
-interface Props {
-  objectApiName: string;
-  recordId: string;
-  ownerId?: string;
-}
-
-const props = defineProps<Props>();
-
-const { api } = useApi();
-const { toast } = useToast();
-
-const loading = ref(true);
-const sharing = ref(false);
-const removing = ref<string | null>(null);
-const error = ref<string | null>(null);
-const shares = ref<any[]>([]);
-const allUsers = ref<any[]>([]);
-const showShareDialog = ref(false);
-const newShare = ref({
-  userId: '',
-  canRead: true,
-  canEdit: false,
-  canDelete: false,
-  expiresAt: '',
-});
-
-const expiresDate = ref<Date | null>(null);
-const expiresTime = ref('');
-
-// Computed property to combine date and time into ISO string
-const combinedExpiresAt = computed(() => {
-  if (!expiresDate.value) return '';
-  
-  const date = new Date(expiresDate.value);
-  if (expiresTime.value) {
-    const [hours, minutes] = expiresTime.value.split(':');
-    date.setHours(parseInt(hours), parseInt(minutes), 0, 0);
-  } else {
-    date.setHours(23, 59, 59, 999); // Default to end of day
-  }
-  
-  return date.toISOString();
-});
-
-// Filter out users who already have shares
-const availableUsers = computed(() => {
-  const sharedUserIds = new Set(shares.value.map(s => s.granteeUserId));
-  return allUsers.value.filter(u => !sharedUserIds.has(u.id));
-});
-
-const loadShares = async () => {
-  try {
-    loading.value = true;
-    error.value = null;
-    const response = await api.get(
-      `/runtime/objects/${props.objectApiName}/records/${props.recordId}/shares`
-    );
-    shares.value = response || [];
-  } catch (e: any) {
-    console.error('Failed to load shares:', e);
-    error.value = e.message || 'Failed to load shares';
-    // If user is not owner, they can't see shares
-    if (e.message?.includes('owner')) {
-      error.value = 'Only the record owner can manage sharing';
-    }
-  } finally {
-    loading.value = false;
-  }
-};
-
-const loadUsers = async () => {
-  try {
-    const response = await api.get('/setup/users');
-    allUsers.value = response || [];
-  } catch (e: any) {
-    console.error('Failed to load users:', e);
-  }
-};
-
-const createShare = async () => {
-  try {
-    sharing.value = true;
-    
-    const expiresAtValue = combinedExpiresAt.value;
-    console.log('Creating share, expiresAt value:', expiresAtValue);
-    
-    const payload: any = {
-      granteeUserId: newShare.value.userId,
-      canRead: newShare.value.canRead,
-      canEdit: newShare.value.canEdit,
-      canDelete: newShare.value.canDelete,
-    };
-    
-    // Only include expiresAt if it has a value
-    if (expiresAtValue) {
-      payload.expiresAt = expiresAtValue;
-      console.log('Including expiresAt in payload:', payload.expiresAt);
-    } else {
-      console.log('Skipping expiresAt - no date selected');
-    }
-    
-    console.log('Final payload:', payload);
-    
-    await api.post(
-      `/runtime/objects/${props.objectApiName}/records/${props.recordId}/shares`,
-      payload
-    );
-    toast.success('Record shared successfully');
-    showShareDialog.value = false;
-    newShare.value = {
-      userId: '',
-      canRead: true,
-      canEdit: false,
-      canDelete: false,
-      expiresAt: '',
-    };
-    expiresDate.value = null;
-    expiresTime.value = '';
-    await loadShares();
-  } catch (e: any) {
-    console.error('Failed to share record:', e);
-    toast.error(e.message || 'Failed to share record');
-  } finally {
-    sharing.value = false;
-  }
-};
-
-const removeShare = async (shareId: string) => {
-  try {
-    removing.value = shareId;
-    await api.delete(
-      `/runtime/objects/${props.objectApiName}/records/${props.recordId}/shares/${shareId}`
-    );
-    toast.success('Share removed successfully');
-    await loadShares();
-  } catch (e: any) {
-    console.error('Failed to remove share:', e);
-    toast.error(e.message || 'Failed to remove share');
-  } finally {
-    removing.value = null;
-  }
-};
-
-const getUserName = (user: any) => {
-  if (!user) return 'Unknown';
-  if (user.firstName || user.lastName) {
-    return [user.firstName, user.lastName].filter(Boolean).join(' ');
-  }
-  return user.email;
-};
-
-const formatDate = (date: string) => {
-  if (!date) return 'N/A';
-  return new Date(date).toLocaleDateString();
-};
-
-onMounted(async () => {
-  await Promise.all([loadShares(), loadUsers()]);
-});
-
-definePageMeta({
-  layout: 'default',
-});
-</script>

frontend/components/fields/FieldRenderer.vue

@@ -30,6 +30,10 @@ const emit = defineEmits<{
 
 const { api } = useApi()
 
+// For relationship fields, store the related record for display
+const relatedRecord = ref<any | null>(null)
+const loadingRelated = ref(false)
+
 const value = computed({
   get: () => props.modelValue,
   set: (val) => emit('update:modelValue', val),
@@ -45,11 +49,30 @@ const isRelationshipField = computed(() => {
   return [FieldType.BELONGS_TO].includes(props.field.type)
 })
 
-// Get relation object name from field apiName (e.g., 'ownerId' -> 'owner')
+// Get relation object name (e.g., 'tenants' -> singular 'tenant')
 const getRelationPropertyName = () => {
-  // Backend attaches related object using field apiName without 'Id' suffix, lowercase
-  // e.g., ownerId -> owner, accountId -> account
-  return props.field.apiName.replace(/Id$/, '').toLowerCase()
+  const relationObject = props.field.relationObject || props.field.apiName.replace('Id', '')
+  // Convert plural to singular for property name (e.g., 'tenants' -> 'tenant')
+  return relationObject.endsWith('s') ? relationObject.slice(0, -1) : relationObject
+}
+
+// Fetch related record for display
+const fetchRelatedRecord = async () => {
+  if (!isRelationshipField.value || !props.modelValue) return
+  
+  const relationObject = props.field.relationObject || props.field.apiName.replace('Id', '')
+  const displayField = props.field.relationDisplayField || 'name'
+  
+  loadingRelated.value = true
+  try {
+    const record = await api.get(`${props.baseUrl}/${relationObject}/${props.modelValue}`)
+    relatedRecord.value = record
+  } catch (err) {
+    console.error('Error fetching related record:', err)
+    relatedRecord.value = null
+  } finally {
+    loadingRelated.value = false
+  }
 }
 
 // Display value for relationship fields
@@ -68,13 +91,38 @@ const relationshipDisplayValue = computed(() => {
     }
   }
   
-  // If no related object found in recordData, just show the ID
-  // (The fetch mechanism is removed to avoid N+1 queries)
+  // Otherwise use the fetched related record
+  if (relatedRecord.value) {
+    const displayField = props.field.relationDisplayField || 'name'
+    return relatedRecord.value[displayField] || relatedRecord.value.id
+  }
+  
+  // Show loading state
+  if (loadingRelated.value) {
+    return 'Loading...'
+  }
+  
+  // Fallback to ID
   return props.modelValue || '-'
 })
 
+// Watch for changes in modelValue for relationship fields
+watch(() => props.modelValue, () => {
+  if (isRelationshipField.value && (isDetailMode.value || isListMode.value)) {
+    fetchRelatedRecord()
+  }
+})
+
+// Load related record on mount if needed
+onMounted(() => {
+  if (isRelationshipField.value && props.modelValue && (isDetailMode.value || isListMode.value)) {
+    fetchRelatedRecord()
+  }
+})
+
 const formatValue = (val: any): string => {
   if (val === null || val === undefined) return '-'
+  
   switch (props.field.type) {
     case FieldType.BELONGS_TO:
       return relationshipDisplayValue.value
@@ -120,7 +168,6 @@ const formatValue = (val: any): string => {
         {{ formatValue(value) }}
       </Badge>
       <template v-else>
-
         {{ formatValue(value) }}
       </template>
     </div>

frontend/components/fields/LookupField.vue

@@ -56,8 +56,7 @@ const filteredRecords = computed(() => {
 const fetchRecords = async () => {
   loading.value = true
   try {
-    const endpoint = `${props.baseUrl}/${relationObject.value}/records`
-    const response = await api.get(endpoint)
+    const response = await api.get(`${props.baseUrl}/${relationObject.value}`)
     records.value = response || []
     
     // If we have a modelValue, find the selected record

frontend/components/ui/checkbox.vue

@@ -1,33 +0,0 @@
-<script setup lang="ts">
-import { Check } from 'lucide-vue-next'
-import {  CheckboxIndicator, CheckboxRoot, type CheckboxRootEmits, type CheckboxRootProps, useForwardPropsEmits } from 'radix-vue'
-import { computed, type HTMLAttributes } from 'vue'
-import { cn } from '@/lib/utils'
-
-const props = defineProps<CheckboxRootProps & { class?: HTMLAttributes['class'] }>()
-const emits = defineEmits<CheckboxRootEmits>()
-
-const delegatedProps = computed(() => {
-  const { class: _, ...delegated } = props
-
-  return delegated
-})
-
-const forwarded = useForwardPropsEmits(delegatedProps, emits)
-</script>
-
-<template>
-  <CheckboxRoot
-    v-bind="forwarded"
-    :class="
-      cn(
-        'peer h-4 w-4 shrink-0 rounded-sm border border-primary shadow focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground',
-        props.class,
-      )
-    "
-  >
-    <CheckboxIndicator class="flex h-full w-full items-center justify-center text-current">
-      <Check class="h-4 w-4" />
-    </CheckboxIndicator>
-  </CheckboxRoot>
-</template>

frontend/components/views/DetailViewEnhanced.vue

@@ -2,11 +2,9 @@
 import { computed, ref, onMounted } from 'vue'
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import FieldRenderer from '@/components/fields/FieldRenderer.vue'
 import PageLayoutRenderer from '@/components/PageLayoutRenderer.vue'
 import RelatedList from '@/components/RelatedList.vue'
-import RecordSharing from '@/components/RecordSharing.vue'
 import { DetailViewConfig, ViewMode, FieldSection, FieldConfig, RelatedListConfig } from '@/types/field-types'
 import { Edit, Trash2, ArrowLeft } from 'lucide-vue-next'
 import {
@@ -21,14 +19,10 @@ interface Props {
   data: any
   loading?: boolean
   objectId?: string // For fetching page layout
-  baseUrl?: string
-  showSharing?: boolean
 }
 
 const props = withDefaults(defineProps<Props>(), {
   loading: false,
-  baseUrl: '/runtime/objects',
-  showSharing: true,
 })
 
 const emit = defineEmits<{
@@ -134,22 +128,8 @@ const usePageLayout = computed(() => {
       <div class="animate-spin rounded-full h-12 w-12 border-b-2 border-primary"></div>
     </div>
 
-    <!-- Tabs for Details, Related, and Sharing -->
-    <Tabs v-else default-value="details" class="space-y-6">
-      <TabsList>
-        <TabsTrigger value="details">Details</TabsTrigger>
-        <TabsTrigger v-if="config.relatedLists && config.relatedLists.length > 0" value="related">
-          Related
-        </TabsTrigger>
-        <TabsTrigger v-if="showSharing && data.id" value="sharing">
-          Sharing
-        </TabsTrigger>
-      </TabsList>
-
-      <!-- Details Tab -->
-      <TabsContent value="details" class="space-y-6">
     <!-- Content with Page Layout -->
-        <Card v-if="usePageLayout">
+    <Card v-else-if="usePageLayout">
       <CardHeader>
         <CardTitle>Details</CardTitle>
       </CardHeader>
@@ -190,7 +170,6 @@ const usePageLayout = computed(() => {
                   :model-value="data[field.apiName]"
                   :record-data="data"
                   :mode="ViewMode.DETAIL"
-                      :base-url="baseUrl"
                 />
               </div>
             </CardContent>
@@ -213,18 +192,15 @@ const usePageLayout = computed(() => {
                 :model-value="data[field.apiName]"
                 :record-data="data"
                 :mode="ViewMode.DETAIL"
-                    :base-url="baseUrl"
               />
             </div>
           </CardContent>
         </template>
       </Card>
     </div>
-      </TabsContent>
 
-      <!-- Related Lists Tab -->
-      <TabsContent value="related" class="space-y-6">
-        <div v-if="config.relatedLists && config.relatedLists.length > 0">
+    <!-- Related Lists -->
+    <div v-if="config.relatedLists && config.relatedLists.length > 0" class="space-y-6">
       <RelatedList
         v-for="relatedList in config.relatedLists"
         :key="relatedList.relationName"
@@ -235,22 +211,6 @@ const usePageLayout = computed(() => {
         @create="(objectApiName, parentId) => emit('createRelated', objectApiName, parentId)"
       />
     </div>
-      </TabsContent>
-
-      <!-- Sharing Tab -->
-      <TabsContent value="sharing">
-        <Card>
-          <CardContent class="pt-6">
-            <RecordSharing
-              v-if="data.id && config.objectApiName"
-              :object-api-name="config.objectApiName"
-              :record-id="data.id"
-              :owner-id="data.ownerId"
-            />
-          </CardContent>
-        </Card>
-      </TabsContent>
-    </Tabs>
   </div>
 </template>
 

frontend/components/views/EditView.vue

@@ -137,12 +137,7 @@ const validateForm = (): boolean => {
 
 const handleSave = () => {
   if (validateForm()) {
-    // Start with props.data to preserve system fields like id, then override with user edits
-    const dataToSave = { 
-      ...props.data,
-      ...formData.value,
-    }
-    emit('save', dataToSave)
+    emit('save', { ...formData.value })
   }
 }
 

frontend/components/views/EditViewEnhanced.vue

@@ -19,14 +19,12 @@ interface Props {
   loading?: boolean
   saving?: boolean
   objectId?: string // For fetching page layout
-  baseUrl?: string
 }
 
 const props = withDefaults(defineProps<Props>(), {
   data: () => ({}),
   loading: false,
   saving: false,
-  baseUrl: '/runtime/objects',
 })
 
 const emit = defineEmits<{
@@ -160,12 +158,7 @@ const validateForm = (): boolean => {
 
 const handleSave = () => {
   if (validateForm()) {
-    // Start with props.data to preserve system fields like id, then override with user edits
-    const saveData = { 
-      ...props.data,
-      ...formData.value,
-    }
-    emit('save', saveData)
+    emit('save', formData.value)
   }
 }
 
@@ -261,7 +254,6 @@ const handleFieldUpdate = (fieldName: string, value: any) => {
                     :model-value="formData[field.apiName]"
                     :mode="ViewMode.EDIT"
                     :error="errors[field.apiName]"
-                    :base-url="baseUrl"
                     @update:model-value="handleFieldUpdate(field.apiName, $event)"
                   />
                 </div>
@@ -285,7 +277,6 @@ const handleFieldUpdate = (fieldName: string, value: any) => {
                   :model-value="formData[field.apiName]"
                   :mode="ViewMode.EDIT"
                   :error="errors[field.apiName]"
-                  :base-url="baseUrl"
                   @update:model-value="handleFieldUpdate(field.apiName, $event)"
                 />
               </div>

frontend/components/views/ListView.vue

@@ -21,14 +21,12 @@ interface Props {
   data?: any[]
   loading?: boolean
   selectable?: boolean
-  baseUrl?: string
 }
 
 const props = withDefaults(defineProps<Props>(), {
   data: () => [],
   loading: false,
   selectable: false,
-  baseUrl: '/runtime/objects',
 })
 
 const emit = defineEmits<{
@@ -209,7 +207,6 @@ const handleAction = (actionId: string) => {
                 :model-value="row[field.apiName]"
                 :record-data="row"
                 :mode="ViewMode.LIST"
-                :base-url="baseUrl"
               />
             </TableCell>
             <TableCell @click.stop>

frontend/composables/useFieldViews.ts

@@ -13,12 +13,8 @@ export const useFields = () => {
     // Convert isSystem to boolean (handle 0/1 from database)
     const isSystemField = Boolean(fieldDef.isSystem)
     
-    // Define all system/auto-generated field names
-    const systemFieldNames = ['id', 'createdAt', 'updatedAt', 'created_at', 'updated_at', 'createdBy', 'updatedBy', 'tenantId', 'ownerId']
-    const isAutoGeneratedField = systemFieldNames.includes(fieldDef.apiName)
-    
-    // Hide system fields and auto-generated fields on edit
-    const shouldHideOnEdit = isSystemField || isAutoGeneratedField
+    // Only truly system fields (id, createdAt, updatedAt, etc.) should be hidden on edit
+    const isAutoGeneratedField = ['id', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'].includes(fieldDef.apiName)
     
     return {
       id: fieldDef.id,
@@ -27,35 +23,35 @@ export const useFields = () => {
       type: fieldDef.type,
       
       // Default values
-      placeholder: fieldDef.placeholder || fieldDef.description,
-      helpText: fieldDef.helpText || fieldDef.description,
+      placeholder: fieldDef.uiMetadata?.placeholder || fieldDef.description,
+      helpText: fieldDef.uiMetadata?.helpText || fieldDef.description,
       defaultValue: fieldDef.defaultValue,
       
       // Validation
       isRequired: fieldDef.isRequired,
-      isReadOnly: isAutoGeneratedField || fieldDef.isReadOnly,
-      validationRules: fieldDef.validationRules || [],
+      isReadOnly: isAutoGeneratedField || fieldDef.uiMetadata?.isReadOnly,
+      validationRules: fieldDef.uiMetadata?.validationRules || [],
       
-      // View options - only hide system and auto-generated fields by default
-      showOnList: fieldDef.showOnList ?? true,
-      showOnDetail: fieldDef.showOnDetail ?? true,
-      showOnEdit: fieldDef.showOnEdit ?? !shouldHideOnEdit,
-      sortable: fieldDef.sortable ?? true,
+      // View options - only hide auto-generated fields by default
+      showOnList: fieldDef.uiMetadata?.showOnList ?? true,
+      showOnDetail: fieldDef.uiMetadata?.showOnDetail ?? true,
+      showOnEdit: fieldDef.uiMetadata?.showOnEdit ?? !isAutoGeneratedField,
+      sortable: fieldDef.uiMetadata?.sortable ?? true,
       
       // Field type specific
-      options: fieldDef.options,
-      rows: fieldDef.rows,
-      min: fieldDef.min,
-      max: fieldDef.max,
-      step: fieldDef.step,
-      accept: fieldDef.accept,
-      relationObject: fieldDef.relationObject,
-      relationDisplayField: fieldDef.relationDisplayField,
+      options: fieldDef.uiMetadata?.options,
+      rows: fieldDef.uiMetadata?.rows,
+      min: fieldDef.uiMetadata?.min,
+      max: fieldDef.uiMetadata?.max,
+      step: fieldDef.uiMetadata?.step,
+      accept: fieldDef.uiMetadata?.accept,
+      relationObject: fieldDef.referenceObject,
+      relationDisplayField: fieldDef.uiMetadata?.relationDisplayField,
       
       // Formatting
-      format: fieldDef.format,
-      prefix: fieldDef.prefix,
-      suffix: fieldDef.suffix,
+      format: fieldDef.uiMetadata?.format,
+      prefix: fieldDef.uiMetadata?.prefix,
+      suffix: fieldDef.uiMetadata?.suffix,
       
       // Advanced
       dependsOn: fieldDef.uiMetadata?.dependsOn,

frontend/pages/[objectName]/[[recordId]]/[[view]].vue

@@ -260,7 +260,6 @@ onMounted(async () => {
         :config="listConfig"
         :data="records"
         :loading="dataLoading"
-        :base-url="`/runtime/objects`"
         selectable
         @row-click="handleRowClick"
         @create="handleCreate"
@@ -275,7 +274,6 @@ onMounted(async () => {
         :data="currentRecord"
         :loading="dataLoading"
         :object-id="objectDefinition?.id"
-        :base-url="`/runtime/objects`"
         @edit="handleEdit"
         @delete="() => handleDelete([currentRecord])"
         @back="handleBack"
@@ -289,7 +287,6 @@ onMounted(async () => {
         :loading="dataLoading"
         :saving="saving"
         :object-id="objectDefinition?.id"
-        :base-url="`/runtime/objects`"
         @save="handleSaveRecord"
         @cancel="handleCancel"
         @back="handleBack"

frontend/pages/setup/objects/[apiName].vue

@@ -16,9 +16,8 @@
           <!-- Tabs -->
           <div class="mb-8">
             <Tabs v-model="activeTab" default-value="fields" class="w-full">
-              <TabsList class="grid w-full grid-cols-3 max-w-2xl">
+              <TabsList class="grid w-full grid-cols-2 max-w-md">
                 <TabsTrigger value="fields">Fields</TabsTrigger>
-                <TabsTrigger value="access">Access</TabsTrigger>
                 <TabsTrigger value="layouts">Page Layouts</TabsTrigger>
               </TabsList>
 
@@ -56,17 +55,6 @@
                 </div>
               </TabsContent>
 
-              <!-- Access Tab -->
-              <TabsContent value="access" class="mt-6">
-                <ObjectAccessSettings
-                  :object-api-name="object.apiName"
-                  :object-id="object.id"
-                  :org-wide-default="object.orgWideDefault"
-                  :fields="object.fields"
-                  @update="handleAccessUpdate"
-                />
-              </TabsContent>
-
               <!-- Page Layouts Tab -->
               <TabsContent value="layouts" class="mt-6">
                 <div v-if="!selectedLayout" class="space-y-4">
@@ -150,7 +138,6 @@ import { Plus, Trash2, ArrowLeft } from 'lucide-vue-next'
 import { Button } from '@/components/ui/button'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import PageLayoutEditor from '@/components/PageLayoutEditor.vue'
-import ObjectAccessSettings from '@/components/ObjectAccessSettings.vue'
 import type { PageLayout, FieldLayoutItem } from '~/types/page-layout'
 
 const route = useRoute()
@@ -260,11 +247,7 @@ watch(activeTab, (newTab) => {
     fetchLayouts()
   }
 })
-const handleAccessUpdate = (orgWideDefault: string) => {
-  if (object.value) {
-    object.value.orgWideDefault = orgWideDefault
-  }
-}
+
 onMounted(async () => {
   await fetchObject()
   // If we start on layouts tab, load them

frontend/pages/setup/roles/[id].vue

@@ -1,231 +0,0 @@
-<template>
-  <div class="min-h-screen bg-background">
-    <NuxtLayout name="default">
-      <main class="container mx-auto px-4 py-8">
-        <div class="flex items-center justify-between">
-          <div>
-            <Button variant="ghost" size="sm" @click="navigateTo('/setup/roles')" class="mb-2">
-              ← Back to Roles
-            </Button>
-        <h1 class="text-3xl font-bold">{{ role?.name || 'Role' }}</h1>
-        <p class="text-muted-foreground">{{ role?.description || 'No description' }}</p>
-      </div>
-    </div>
-
-    <div v-if="loading" class="flex items-center justify-center py-12">
-      <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
-    </div>
-
-    <Tabs v-else default-value="details" class="w-full">
-      <TabsList>
-        <TabsTrigger value="details">Details</TabsTrigger>
-        <TabsTrigger value="users">Users</TabsTrigger>
-      </TabsList>
-
-      <TabsContent value="details" class="mt-6">
-        <Card>
-          <CardHeader>
-            <CardTitle>Role Information</CardTitle>
-          </CardHeader>
-          <CardContent class="space-y-4">
-            <div class="grid grid-cols-2 gap-4">
-              <div>
-                <Label class="text-muted-foreground">Name</Label>
-                <p class="font-medium">{{ role?.name }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">Guard</Label>
-                <Badge variant="outline">{{ role?.guardName || 'tenant' }}</Badge>
-              </div>
-              <div class="col-span-2">
-                <Label class="text-muted-foreground">Description</Label>
-                <p class="font-medium">{{ role?.description || 'No description' }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">Created At</Label>
-                <p class="font-medium">{{ formatDate(role?.createdAt) }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">Updated At</Label>
-                <p class="font-medium">{{ formatDate(role?.updatedAt) }}</p>
-              </div>
-            </div>
-          </CardContent>
-        </Card>
-      </TabsContent>
-
-      <TabsContent value="users" class="mt-6">
-        <Card>
-          <CardHeader>
-            <div class="flex items-center justify-between">
-              <div>
-                <CardTitle>Assigned Users</CardTitle>
-                <CardDescription>Manage user assignments for this role</CardDescription>
-              </div>
-              <Button @click="showAddUserDialog = true" size="sm">
-                <Plus class="mr-2 h-4 w-4" />
-                Add User
-              </Button>
-            </div>
-          </CardHeader>
-          <CardContent>
-            <div v-if="roleUsers.length === 0" class="text-center py-8 text-muted-foreground">
-              No users assigned. Add users to grant them this role.
-            </div>
-            <div v-else class="space-y-2">
-              <div 
-                v-for="user in roleUsers" 
-                :key="user.id"
-                class="flex items-center justify-between p-3 border rounded-lg"
-              >
-                <div>
-                  <p class="font-medium">{{ getUserName(user) }}</p>
-                  <p class="text-sm text-muted-foreground">{{ user.email }}</p>
-                </div>
-                <Button variant="ghost" size="sm" @click="removeUser(user.id)">
-                  <X class="h-4 w-4" />
-                </Button>
-              </div>
-            </div>
-          </CardContent>
-        </Card>
-      </TabsContent>
-    </Tabs>
-
-    <!-- Add User Dialog -->
-    <Dialog v-model:open="showAddUserDialog">
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Add User</DialogTitle>
-          <DialogDescription>
-            Select a user to assign this role
-          </DialogDescription>
-        </DialogHeader>
-        <div class="space-y-4">
-          <div class="space-y-2">
-            <Label>Available Users</Label>
-            <Select v-model="selectedUserId" @update:model-value="(value) => selectedUserId = value">
-              <SelectTrigger>
-                <SelectValue placeholder="Choose a user" />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem v-for="user in availableUsers" :key="user.id" :value="user.id">
-                  {{ getUserName(user) }} ({{ user.email }})
-                </SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-        <DialogFooter>
-          <Button variant="outline" @click="showAddUserDialog = false">Cancel</Button>
-          <Button @click="addUser" :disabled="!selectedUserId">
-            Add User
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-      </main>
-    </NuxtLayout>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted, computed } from 'vue';
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
-import { Button } from '~/components/ui/button';
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
-import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
-import { Label } from '~/components/ui/label';
-import { Badge } from '~/components/ui/badge';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
-import { Plus, X } from 'lucide-vue-next';
-
-definePageMeta({
-  layout: 'default',
-});
-
-const route = useRoute();
-const { api } = useApi();
-const { toast } = useToast();
-
-const loading = ref(true);
-const role = ref<any>(null);
-const roleUsers = ref<any[]>([]);
-const allUsers = ref<any[]>([]);
-const showAddUserDialog = ref(false);
-const selectedUserId = ref('');
-
-const availableUsers = computed(() => {
-  const assignedIds = new Set(roleUsers.value.map(u => u.id));
-  return allUsers.value.filter(u => !assignedIds.has(u.id));
-});
-
-const loadRole = async () => {
-  try {
-    loading.value = true;
-    const roleId = route.params.id;
-    const response = await api.get(`/setup/roles/${roleId}`);
-    role.value = response;
-    roleUsers.value = response.users || [];
-  } catch (error: any) {
-    console.error('Failed to load role:', error);
-    toast.error('Failed to load role');
-  } finally {
-    loading.value = false;
-  }
-};
-
-const loadAllUsers = async () => {
-  try {
-    const response = await api.get('/setup/users');
-    allUsers.value = response || [];
-  } catch (error: any) {
-    console.error('Failed to load users:', error);
-  }
-};
-
-const addUser = async () => {
-  if (!selectedUserId.value) return;
-  
-  try {
-    await api.post(`/setup/roles/${route.params.id}/users`, {
-      userId: selectedUserId.value,
-    });
-    toast.success('User added successfully');
-    showAddUserDialog.value = false;
-    selectedUserId.value = '';
-    await loadRole();
-  } catch (error: any) {
-    console.error('Failed to add user:', error);
-    toast.error(error.message || 'Failed to add user');
-  }
-};
-
-const removeUser = async (userId: string) => {
-  try {
-    await api.delete(`/setup/roles/${route.params.id}/users/${userId}`);
-    toast.success('User removed successfully');
-    await loadRole();
-  } catch (error: any) {
-    console.error('Failed to remove user:', error);
-    toast.error(error.message || 'Failed to remove user');
-  }
-};
-
-const getUserName = (user: any) => {
-  if (!user) return 'Unknown';
-  if (user.firstName || user.lastName) {
-    return [user.firstName, user.lastName].filter(Boolean).join(' ');
-  }
-  return user.email || 'Unknown';
-};
-
-const formatDate = (date: string) => {
-  if (!date) return 'N/A';
-  return new Date(date).toLocaleDateString();
-};
-
-onMounted(async () => {
-  await Promise.all([loadRole(), loadAllUsers()]);
-});
-</script>

frontend/pages/setup/roles/index.vue

@@ -1,285 +0,0 @@
-<template>
-  <div class="min-h-screen bg-background">
-    <NuxtLayout name="default">
-      <main class="container mx-auto px-4 py-8">
-        <div class="flex items-center justify-between">
-          <div>
-            <h1 class="text-3xl font-bold">Roles</h1>
-            <p class="text-muted-foreground">Manage roles and permissions</p>
-          </div>
-      <Button @click="showCreateDialog = true">
-        <Plus class="mr-2 h-4 w-4" />
-        New Role
-      </Button>
-    </div>
-
-    <div class="border rounded-lg">
-      <Table>
-        <TableHeader>
-          <TableRow>
-            <TableHead>Name</TableHead>
-            <TableHead>Description</TableHead>
-            <TableHead>Guard</TableHead>
-            <TableHead>Users</TableHead>
-            <TableHead>Created</TableHead>
-            <TableHead class="text-right">Actions</TableHead>
-          </TableRow>
-        </TableHeader>
-        <TableBody>
-          <TableRow v-if="loading">
-            <TableCell :colspan="6" class="text-center py-8">
-              <div class="flex items-center justify-center">
-                <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
-              </div>
-            </TableCell>
-          </TableRow>
-          <TableRow v-else-if="roles.length === 0">
-            <TableCell :colspan="6" class="text-center py-8 text-muted-foreground">
-              No roles found. Create your first role to get started.
-            </TableCell>
-          </TableRow>
-          <TableRow v-else v-for="role in roles" :key="role.id" class="cursor-pointer hover:bg-muted/50" @click="navigateTo(`/setup/roles/${role.id}`)">
-            <TableCell class="font-medium">{{ role.name }}</TableCell>
-            <TableCell>{{ role.description || 'No description' }}</TableCell>
-            <TableCell>
-              <Badge variant="outline">{{ role.guardName || 'tenant' }}</Badge>
-            </TableCell>
-            <TableCell>
-              {{ role.userCount || 0 }} users
-            </TableCell>
-            <TableCell>{{ formatDate(role.createdAt) }}</TableCell>
-            <TableCell class="text-right" @click.stop>
-              <div class="flex items-center justify-end gap-1">
-                <Button variant="ghost" size="icon" @click="navigateTo(`/setup/roles/${role.id}`)">
-                  <Eye class="h-4 w-4" />
-                </Button>
-                <Button variant="ghost" size="icon" @click="openEditDialog(role)">
-                  <Edit class="h-4 w-4" />
-                </Button>
-                <Button variant="ghost" size="icon" @click="openDeleteDialog(role)">
-                  <Trash2 class="h-4 w-4" />
-                </Button>
-              </div>
-            </TableCell>
-          </TableRow>
-        </TableBody>
-      </Table>
-    </div>
-
-    <!-- Create Role Dialog -->
-    <Dialog v-model:open="showCreateDialog">
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Create New Role</DialogTitle>
-          <DialogDescription>
-            Add a new role to the system
-          </DialogDescription>
-        </DialogHeader>
-        <div class="space-y-4">
-          <div class="space-y-2">
-            <Label for="name">Name</Label>
-            <Input id="name" v-model="newRole.name" placeholder="Sales Manager" />
-          </div>
-          <div class="space-y-2">
-            <Label for="description">Description (Optional)</Label>
-            <Input id="description" v-model="newRole.description" placeholder="Manages sales team and deals" />
-          </div>
-          <div class="space-y-2">
-            <Label for="guardName">Guard Name</Label>
-            <Select v-model="newRole.guardName" @update:model-value="(value) => newRole.guardName = value">
-              <SelectTrigger>
-                <SelectValue placeholder="Select guard" />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value="tenant">Tenant</SelectItem>
-                <SelectItem value="central">Central</SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-        <DialogFooter>
-          <Button variant="outline" @click="showCreateDialog = false">Cancel</Button>
-          <Button @click="createRole" :disabled="!newRole.name">
-            Create Role
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-
-    <!-- Edit Role Dialog -->
-    <Dialog v-model:open="showEditDialog">
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Edit Role</DialogTitle>
-          <DialogDescription>
-            Update role information
-          </DialogDescription>
-        </DialogHeader>
-        <div class="space-y-4">
-          <div class="space-y-2">
-            <Label for="edit-name">Name</Label>
-            <Input id="edit-name" v-model="editRole.name" placeholder="Role name" />
-          </div>
-          <div class="space-y-2">
-            <Label for="edit-description">Description</Label>
-            <Input id="edit-description" v-model="editRole.description" placeholder="Role description" />
-          </div>
-          <div class="space-y-2">
-            <Label for="edit-guardName">Guard Name</Label>
-            <Select v-model="editRole.guardName" @update:model-value="(value) => editRole.guardName = value">
-              <SelectTrigger>
-                <SelectValue placeholder="Select guard" />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value="tenant">Tenant</SelectItem>
-                <SelectItem value="central">Central</SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-        <DialogFooter>
-          <Button variant="outline" @click="showEditDialog = false">Cancel</Button>
-          <Button @click="updateRole" :disabled="!editRole.name">
-            Update Role
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-
-    <!-- Delete Confirmation Dialog -->
-    <Dialog v-model:open="showDeleteDialog">
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Delete Role</DialogTitle>
-          <DialogDescription>
-            Are you sure you want to delete this role? This action cannot be undone.
-          </DialogDescription>
-        </DialogHeader>
-        <DialogFooter>
-          <Button variant="outline" @click="showDeleteDialog = false">Cancel</Button>
-          <Button variant="destructive" @click="deleteRole">
-            Delete Role
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-      </main>
-    </NuxtLayout>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted } from 'vue';
-import { Button } from '~/components/ui/button';
-import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '~/components/ui/table';
-import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
-import { Input } from '~/components/ui/input';
-import { Label } from '~/components/ui/label';
-import { Badge } from '~/components/ui/badge';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
-import { Plus, Eye, Edit, Trash2 } from 'lucide-vue-next';
-
-definePageMeta({
-  layout: 'default',
-});
-
-const { api } = useApi();
-const { toast } = useToast();
-
-const loading = ref(true);
-const roles = ref<any[]>([]);
-const showCreateDialog = ref(false);
-const showEditDialog = ref(false);
-const showDeleteDialog = ref(false);
-const newRole = ref({
-  name: '',
-  description: '',
-  guardName: 'tenant',
-});
-const editRole = ref({
-  id: '',
-  name: '',
-  description: '',
-  guardName: 'tenant',
-});
-const roleToDelete = ref<any>(null);
-
-const loadRoles = async () => {
-  try {
-    loading.value = true;
-    const response = await api.get('/setup/roles');
-    roles.value = response || [];
-  } catch (error: any) {
-    console.error('Failed to load roles:', error);
-    toast.error('Failed to load roles');
-  } finally {
-    loading.value = false;
-  }
-};
-
-const createRole = async () => {
-  try {
-    await api.post('/setup/roles', newRole.value);
-    toast.success('Role created successfully');
-    showCreateDialog.value = false;
-    newRole.value = { name: '', description: '', guardName: 'tenant' };
-    await loadRoles();
-  } catch (error: any) {
-    console.error('Failed to create role:', error);
-    toast.error(error.message || 'Failed to create role');
-  }
-};
-
-const openEditDialog = (role: any) => {
-  editRole.value = {
-    id: role.id,
-    name: role.name,
-    description: role.description || '',
-    guardName: role.guardName || 'tenant',
-  };
-  showEditDialog.value = true;
-};
-
-const updateRole = async () => {
-  try {
-    await api.patch(`/setup/roles/${editRole.value.id}`, {
-      name: editRole.value.name,
-      description: editRole.value.description,
-      guardName: editRole.value.guardName,
-    });
-    toast.success('Role updated successfully');
-    showEditDialog.value = false;
-    await loadRoles();
-  } catch (error: any) {
-    console.error('Failed to update role:', error);
-    toast.error(error.message || 'Failed to update role');
-  }
-};
-
-const openDeleteDialog = (role: any) => {
-  roleToDelete.value = role;
-  showDeleteDialog.value = true;
-};
-
-const deleteRole = async () => {
-  try {
-    await api.delete(`/setup/roles/${roleToDelete.value.id}`);
-    toast.success('Role deleted successfully');
-    showDeleteDialog.value = false;
-    roleToDelete.value = null;
-    await loadRoles();
-  } catch (error: any) {
-    console.error('Failed to delete role:', error);
-    toast.error(error.message || 'Failed to delete role');
-  }
-};
-
-const formatDate = (date: string) => {
-  if (!date) return 'N/A';
-  return new Date(date).toLocaleDateString();
-};
-
-onMounted(() => {
-  loadRoles();
-});
-</script>

frontend/pages/setup/users/[id].vue

@@ -1,227 +0,0 @@
-<template>
-  <div class="min-h-screen bg-background">
-    <NuxtLayout name="default">
-        <main class="container mx-auto px-4 py-8">
-    <div class="flex items-center justify-between">
-      <div>
-        <Button variant="ghost" size="sm" @click="navigateTo('/setup/users')" class="mb-2">
-          ← Back to Users
-        </Button>
-        <h1 class="text-3xl font-bold">{{ getUserName(user) }}</h1>
-        <p class="text-muted-foreground">{{ user?.email }}</p>
-      </div>
-    </div>
-
-    <div v-if="loading" class="flex items-center justify-center py-12">
-      <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
-    </div>
-
-    <Tabs v-else default-value="details" class="w-full">
-      <TabsList>
-        <TabsTrigger value="details">Details</TabsTrigger>
-        <TabsTrigger value="roles">Roles</TabsTrigger>
-      </TabsList>
-
-      <TabsContent value="details" class="mt-6">
-        <Card>
-          <CardHeader>
-            <CardTitle>User Information</CardTitle>
-          </CardHeader>
-          <CardContent class="space-y-4">
-            <div class="grid grid-cols-2 gap-4">
-              <div>
-                <Label class="text-muted-foreground">Email</Label>
-                <p class="font-medium">{{ user?.email }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">First Name</Label>
-                <p class="font-medium">{{ user?.firstName || 'N/A' }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">Last Name</Label>
-                <p class="font-medium">{{ user?.lastName || 'N/A' }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">Created At</Label>
-                <p class="font-medium">{{ formatDate(user?.createdAt) }}</p>
-              </div>
-              <div>
-                <Label class="text-muted-foreground">Updated At</Label>
-                <p class="font-medium">{{ formatDate(user?.updatedAt) }}</p>
-              </div>
-            </div>
-          </CardContent>
-        </Card>
-      </TabsContent>
-
-      <TabsContent value="roles" class="mt-6">
-        <Card>
-          <CardHeader>
-            <div class="flex items-center justify-between">
-              <div>
-                <CardTitle>Assigned Roles</CardTitle>
-                <CardDescription>Manage role assignments for this user</CardDescription>
-              </div>
-              <Button @click="showAddRoleDialog = true" size="sm">
-                <Plus class="mr-2 h-4 w-4" />
-                Add Role
-              </Button>
-            </div>
-          </CardHeader>
-          <CardContent>
-            <div v-if="userRoles.length === 0" class="text-center py-8 text-muted-foreground">
-              No roles assigned. Add roles to grant permissions.
-            </div>
-            <div v-else class="space-y-2">
-              <div 
-                v-for="role in userRoles" 
-                :key="role.id"
-                class="flex items-center justify-between p-3 border rounded-lg"
-              >
-                <div>
-                  <p class="font-medium">{{ role.name }}</p>
-                  <p class="text-sm text-muted-foreground">{{ role.description || 'No description' }}</p>
-                </div>
-                <Button variant="ghost" size="sm" @click="removeRole(role.id)">
-                  <X class="h-4 w-4" />
-                </Button>
-              </div>
-            </div>
-          </CardContent>
-        </Card>
-      </TabsContent>
-    </Tabs>
-
-    <!-- Add Role Dialog -->
-    <Dialog v-model:open="showAddRoleDialog">
-      <DialogContent>
-        <DialogHeader>
-          <DialogTitle>Add Role</DialogTitle>
-          <DialogDescription>
-            Select a role to assign to this user
-          </DialogDescription>
-        </DialogHeader>
-        <div class="space-y-4">
-          <div class="space-y-2">
-            <Label>Available Roles</Label>
-            <Select v-model="selectedRoleId" @update:model-value="(value) => selectedRoleId = value">
-              <SelectTrigger>
-                <SelectValue placeholder="Choose a role" />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem v-for="role in availableRoles" :key="role.id" :value="role.id">
-                  {{ role.name }}
-                </SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-        <DialogFooter>
-          <Button variant="outline" @click="showAddRoleDialog = false">Cancel</Button>
-          <Button @click="addRole" :disabled="!selectedRoleId">
-            Add Role
-          </Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
-  </main>
-    </NuxtLayout>
-    </div>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted, computed } from 'vue';
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
-import { Button } from '~/components/ui/button';
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '~/components/ui/tabs';
-import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
-import { Label } from '~/components/ui/label';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '~/components/ui/select';
-import { Plus, X } from 'lucide-vue-next';
-
-
-const route = useRoute();
-const { api } = useApi();
-const { toast } = useToast();
-
-const loading = ref(true);
-const user = ref<any>(null);
-const userRoles = ref<any[]>([]);
-const allRoles = ref<any[]>([]);
-const showAddRoleDialog = ref(false);
-const selectedRoleId = ref('');
-
-const availableRoles = computed(() => {
-  const assignedIds = new Set(userRoles.value.map(r => r.id));
-  return allRoles.value.filter(r => !assignedIds.has(r.id));
-});
-
-const loadUser = async () => {
-  try {
-    loading.value = true;
-    const userId = route.params.id;
-    const response = await api.get(`/setup/users/${userId}`);
-    user.value = response;
-    userRoles.value = response.roles || [];
-  } catch (error: any) {
-    console.error('Failed to load user:', error);
-    toast.error('Failed to load user');
-  } finally {
-    loading.value = false;
-  }
-};
-
-const loadAllRoles = async () => {
-  try {
-    const response = await api.get('/setup/roles');
-    allRoles.value = response || [];
-  } catch (error: any) {
-    console.error('Failed to load roles:', error);
-  }
-};
-
-const addRole = async () => {
-  if (!selectedRoleId.value) return;
-  
-  try {
-    await api.post(`/setup/users/${route.params.id}/roles`, {
-      roleId: selectedRoleId.value,
-    });
-    toast.success('Role added successfully');
-    showAddRoleDialog.value = false;
-    selectedRoleId.value = '';
-    await loadUser();
-  } catch (error: any) {
-    console.error('Failed to add role:', error);
-    toast.error(error.message || 'Failed to add role');
-  }
-};
-
-const removeRole = async (roleId: string) => {
-  try {
-    await api.delete(`/setup/users/${route.params.id}/roles/${roleId}`);
-    toast.success('Role removed successfully');
-    await loadUser();
-  } catch (error: any) {
-    console.error('Failed to remove role:', error);
-    toast.error(error.message || 'Failed to remove role');
-  }
-};
-
-const getUserName = (user: any) => {
-  if (!user) return 'User';
-  if (user.firstName || user.lastName) {
-    return [user.firstName, user.lastName].filter(Boolean).join(' ');
-  }
-  return user.email || 'User';
-};
-
-const formatDate = (date: string) => {
-  if (!date) return 'N/A';
-  return new Date(date).toLocaleDateString();
-};
-
-onMounted(async () => {
-  await Promise.all([loadUser(), loadAllRoles()]);
-});
-</script>

frontend/pages/setup/users/index.vue

@@ -1,290 +0,0 @@
-<template>
-    <div class="min-h-screen bg-background">
-    <NuxtLayout name="default">
-        <main class="container mx-auto px-4 py-8">
-            <div class="flex items-center justify-between">
-            <div>
-                <h1 class="text-3xl font-bold">Users</h1>
-                <p class="text-muted-foreground">Manage user accounts and access</p>
-            </div>
-            <Button @click="showCreateDialog = true">
-                <UserPlus class="mr-2 h-4 w-4" />
-                New User
-            </Button>
-            </div>
-
-            <div class="border rounded-lg">
-              <Table>
-                <TableHeader>
-                  <TableRow>
-                    <TableHead>Name</TableHead>
-                    <TableHead>Email</TableHead>
-                    <TableHead>Roles</TableHead>
-                    <TableHead>Created</TableHead>
-                    <TableHead class="text-right">Actions</TableHead>
-                  </TableRow>
-                </TableHeader>
-                <TableBody>
-                  <TableRow v-if="loading">
-                    <TableCell :colspan="5" class="text-center py-8">
-                      <div class="flex items-center justify-center">
-                        <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-primary"></div>
-                      </div>
-                    </TableCell>
-                  </TableRow>
-                  <TableRow v-else-if="users.length === 0">
-                    <TableCell :colspan="5" class="text-center py-8 text-muted-foreground">
-                      No users found. Create your first user to get started.
-                    </TableCell>
-                  </TableRow>
-                  <TableRow v-else v-for="user in users" :key="user.id" class="cursor-pointer hover:bg-muted/50" @click="navigateTo(`/setup/users/${user.id}`)">
-                    <TableCell class="font-medium">{{ getUserName(user) }}</TableCell>
-                    <TableCell>{{ user.email }}</TableCell>
-                    <TableCell>
-                        <div class="flex gap-1 flex-wrap">
-                        <Badge v-for="role in user.roles" :key="role.id" variant="secondary">
-                            {{ role.name }}
-                        </Badge>
-                        <span v-if="!user.roles || user.roles.length === 0" class="text-muted-foreground text-sm">
-                            No roles
-                        </span>
-                        </div>
-                    </TableCell>
-                    <TableCell>{{ formatDate(user.createdAt) }}</TableCell>
-                    <TableCell class="text-right" @click.stop>
-                        <div class="flex items-center justify-end gap-1">
-                          <Button variant="ghost" size="icon" @click="navigateTo(`/setup/users/${user.id}`)">
-                            <Eye class="h-4 w-4" />
-                          </Button>
-                          <Button variant="ghost" size="icon" @click="openEditDialog(user)">
-                            <Edit class="h-4 w-4" />
-                          </Button>
-                          <Button variant="ghost" size="icon" @click="openDeleteDialog(user)">
-                            <Trash2 class="h-4 w-4" />
-                          </Button>
-                        </div>
-                    </TableCell>
-                    </TableRow>
-                </TableBody>
-              </Table>
-            </div>
-
-            <!-- Create User Dialog -->
-            <Dialog v-model:open="showCreateDialog">
-            <DialogContent>
-                <DialogHeader>
-                <DialogTitle>Create New User</DialogTitle>
-                <DialogDescription>
-                    Add a new user to the system
-                </DialogDescription>
-                </DialogHeader>
-                <div class="space-y-4">
-                <div class="space-y-2">
-                    <Label for="email">Email</Label>
-                    <Input id="email" v-model="newUser.email" type="email" placeholder="user@example.com" />
-                </div>
-                <div class="space-y-2">
-                    <Label for="password">Password</Label>
-                    <Input id="password" v-model="newUser.password" type="password" placeholder="••••••••" />
-                </div>
-                <div class="space-y-2">
-                    <Label for="firstName">First Name (Optional)</Label>
-                    <Input id="firstName" v-model="newUser.firstName" placeholder="John" />
-                </div>
-                <div class="space-y-2">
-                    <Label for="lastName">Last Name (Optional)</Label>
-                    <Input id="lastName" v-model="newUser.lastName" placeholder="Doe" />
-                </div>
-                </div>
-                <DialogFooter>
-                <Button variant="outline" @click="showCreateDialog = false">Cancel</Button>
-                <Button @click="createUser" :disabled="!newUser.email || !newUser.password">
-                    Create User
-                </Button>
-                </DialogFooter>
-            </DialogContent>
-            </Dialog>
-
-            <!-- Edit User Dialog -->
-            <Dialog v-model:open="showEditDialog">
-            <DialogContent>
-                <DialogHeader>
-                <DialogTitle>Edit User</DialogTitle>
-                <DialogDescription>
-                    Update user information
-                </DialogDescription>
-                </DialogHeader>
-                <div class="space-y-4">
-                <div class="space-y-2">
-                    <Label for="edit-email">Email</Label>
-                    <Input id="edit-email" v-model="editUser.email" type="email" placeholder="user@example.com" />
-                </div>
-                <div class="space-y-2">
-                    <Label for="edit-password">Password (leave blank to keep current)</Label>
-                    <Input id="edit-password" v-model="editUser.password" type="password" placeholder="••••••••" />
-                </div>
-                <div class="space-y-2">
-                    <Label for="edit-firstName">First Name</Label>
-                    <Input id="edit-firstName" v-model="editUser.firstName" placeholder="John" />
-                </div>
-                <div class="space-y-2">
-                    <Label for="edit-lastName">Last Name</Label>
-                    <Input id="edit-lastName" v-model="editUser.lastName" placeholder="Doe" />
-                </div>
-                </div>
-                <DialogFooter>
-                <Button variant="outline" @click="showEditDialog = false">Cancel</Button>
-                <Button @click="updateUser" :disabled="!editUser.email">
-                    Update User
-                </Button>
-                </DialogFooter>
-            </DialogContent>
-            </Dialog>
-
-            <!-- Delete Confirmation Dialog -->
-            <Dialog v-model:open="showDeleteDialog">
-            <DialogContent>
-                <DialogHeader>
-                <DialogTitle>Delete User</DialogTitle>
-                <DialogDescription>
-                    Are you sure you want to delete this user? This action cannot be undone.
-                </DialogDescription>
-                </DialogHeader>
-                <DialogFooter>
-                <Button variant="outline" @click="showDeleteDialog = false">Cancel</Button>
-                <Button variant="destructive" @click="deleteUser">
-                    Delete User
-                </Button>
-                </DialogFooter>
-            </DialogContent>
-            </Dialog>
-        </main>
-    </NuxtLayout>
-    </div>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted } from 'vue';
-import { Button } from '~/components/ui/button';
-import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '~/components/ui/table';
-import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '~/components/ui/dialog';
-import { Input } from '~/components/ui/input';
-import { Label } from '~/components/ui/label';
-import { Badge } from '~/components/ui/badge';
-import { UserPlus, Eye, Edit, Trash2 } from 'lucide-vue-next';
-
-
-const { api } = useApi();
-const { toast } = useToast();
-
-const loading = ref(true);
-const users = ref<any[]>([]);
-const showCreateDialog = ref(false);
-const showEditDialog = ref(false);
-const showDeleteDialog = ref(false);
-const newUser = ref({
-  email: '',
-  password: '',
-  firstName: '',
-  lastName: '',
-});
-const editUser = ref({
-  id: '',
-  email: '',
-  password: '',
-  firstName: '',
-  lastName: '',
-});
-const userToDelete = ref<any>(null);
-
-const loadUsers = async () => {
-  try {
-    loading.value = true;
-    const response = await api.get('/setup/users');
-    users.value = response || [];
-  } catch (error: any) {
-    console.error('Failed to load users:', error);
-    toast.error('Failed to load users');
-  } finally {
-    loading.value = false;
-  }
-};
-
-const createUser = async () => {
-  try {
-    await api.post('/setup/users', newUser.value);
-    toast.success('User created successfully');
-    showCreateDialog.value = false;
-    newUser.value = { email: '', password: '', firstName: '', lastName: '' };
-    await loadUsers();
-  } catch (error: any) {
-    console.error('Failed to create user:', error);
-    toast.error(error.message || 'Failed to create user');
-  }
-};
-
-const openEditDialog = (user: any) => {
-  editUser.value = {
-    id: user.id,
-    email: user.email,
-    password: '',
-    firstName: user.firstName || '',
-    lastName: user.lastName || '',
-  };
-  showEditDialog.value = true;
-};
-
-const updateUser = async () => {
-  try {
-    const payload: any = {
-      email: editUser.value.email,
-      firstName: editUser.value.firstName,
-      lastName: editUser.value.lastName,
-    };
-    if (editUser.value.password) {
-      payload.password = editUser.value.password;
-    }
-    await api.patch(`/setup/users/${editUser.value.id}`, payload);
-    toast.success('User updated successfully');
-    showEditDialog.value = false;
-    await loadUsers();
-  } catch (error: any) {
-    console.error('Failed to update user:', error);
-    toast.error(error.message || 'Failed to update user');
-  }
-};
-
-const openDeleteDialog = (user: any) => {
-  userToDelete.value = user;
-  showDeleteDialog.value = true;
-};
-
-const deleteUser = async () => {
-  try {
-    await api.delete(`/setup/users/${userToDelete.value.id}`);
-    toast.success('User deleted successfully');
-    showDeleteDialog.value = false;
-    userToDelete.value = null;
-    await loadUsers();
-  } catch (error: any) {
-    console.error('Failed to delete user:', error);
-    toast.error(error.message || 'Failed to delete user');
-  }
-};
-
-const getUserName = (user: any) => {
-  if (user.firstName || user.lastName) {
-    return [user.firstName, user.lastName].filter(Boolean).join(' ');
-  }
-  return user.email;
-};
-
-const formatDate = (date: string) => {
-  if (!date) return 'N/A';
-  return new Date(date).toLocaleDateString();
-};
-
-onMounted(() => {
-  loadUsers();
-});
-</script>