OpenSparrow v4.6 adds per-table write permissions and "Last change" diff in the Record History tab

OpenSparrow v4.6 adds per-table write permissions (create / edit / delete), a "Last change" diff in the Record History tab, and route-bound API authorization — plus click statistics in demo mode.

Per-table write permissions

Users → Access already decided where an account may go (tables, views, boards, workflows). Now it also decides what: on top of the table allow-list, each user entry can carry a perms map that narrows writes per table — {"orders": ["create","edit"], "clients": []}. The tables list stays the read grant; a missing mask keeps full CRUD (no account loses anything on upgrade), an empty mask means read-only, and the full set is never stored — it collapses back to "absent".

The Access tab shows a Create / Edit / Delete checkbox group per ticked table, and the mask is enforced server-side everywhere: grid routes are gated once in the front controller, the create/edit forms render disabled and refuse POSTs, mass edit, find-and-replace and mass duplicate/delete map each action to its own operation, and workflow procedure steps require edit on every step table. Denied operations answer a translated 403 in all 20 bundled languages.

Record History: a "Last change" diff

The Record History tab gains a column / before / after table with the change date, answering "what did the last edit change" without opening the audit log. It diffs the two most recent spw_record_snapshots server-side, filters out viewer-masked columns, and renders fully escaped.

The section appears when snapshots are enabled (Settings → Audit & Snapshots, off by default).

Route-bound authorization

Fixed a bypass where a hand-crafted conflicting body could be authorized for one operation and executed as another. matchWriteRoute() now pairs every route with its handler and its operation — one match, one gate, one dispatch. Pinned by a route-matrix test plus an HTTP regression asserting 403 and zero database mutations.

Also in this release

• Click statistics in demo mode — and a clarified DEMO_MODE scope: it blocks admin-panel writes only; frontend record edits stay enabled for visitors.
• Demo seeding — the CRM demo installs a ready access entry (demo.marek with a read-only deals mask), so the feature is visible right after install.
• No migration, no removals — perms lives in the existing user_table_access config key.

Following this series?

OpenSparrow v4.5 adds a chat shortcut on user tooltips

Websites

https://opensparrow.org