Last Updated: 14 July 2026 Benchmark: Frappe/ERPNext, Odoo, NocoBase Engine Version: 0.1.0
| Metric | Count |
|---|---|
| Total Features Tracked | 76 |
| ✅ Implemented | 48 |
| 3 | |
| ❌ Not Yet | 25 |
| Completion | 63.2% (effective ~65.1% counting partials as 0.5) |
| # | Category | ✅ | ❌ | Total | Score | |
|---|---|---|---|---|---|---|
| 1 | Core Framework & Data Modeling | 5 | 2 | 0 | 7 | 86% |
| 2 | Permission & Access Control | 6 | 1 | 1 | 8 | 81% |
| 3 | Audit Log & Monitoring | 5 | 0 | 1 | 6 | 83% |
| 4 | Workflow & Automation | 4 | 1 | 3 | 8 | 56% |
| 5 | Form & UI Builder | 4 | 1 | 3 | 8 | 56% |
| 6 | Reporting & Analytics | 1 | 2 | 3 | 6 | 33% |
| 7 | Integration & API | 1 | 1 | 4 | 6 | 25% |
| 8 | Configuration & Customization | 4 | 1 | 2 | 7 | 64% |
| 9 | Security & Infrastructure | 7 | 1 | 0 | 8 | 94% |
| 10 | Collaboration & Communication | 0 | 1 | 4 | 5 | 10% |
Score = (✅ +
⚠️ ×0.5) / Total × 100%
| Symbol | Meaning |
|---|---|
| ✅ | Implemented and functional |
| Partially implemented — foundation exists but incomplete | |
| ❌ | Not yet implemented |
Effort Estimates:
- S = Small (1–2 days, 1 file/module)
- M = Medium (3–5 days, multiple files)
- L = Large (1–2 weeks, new feature)
- XL = Extra Large (2–4 weeks, new subsystem)
Before the gap list — what's already production-solid:
- JSON-driven development — Models, APIs, processes, views, workflows — all defined in JSON. Go engine interprets at runtime.
- Module system (Odoo-style) — Dependency resolution (topological sort), data seeding, cross-module views, 3-layer FS (project → global → embedded).
- Security stack — JWT auth + RBAC permissions + Record Rules (row-level security) + audit logging. Full middleware chain.
- Process engine — 14 step types: validate, query, create, update, delete, if, switch, loop, emit, call, script, http, assign, log. DAG executor for parallel steps.
- Workflow engine — State machines with permission-gated transitions, initial state on create, process linking.
- Plugin system — Multi-runtime (TypeScript, Python, goja, quickjs, yaegi), JSON-RPC over stdin/stdout, health monitoring, auto-restart. Runtime engines extracted to
packages/go-json-runtimes/(separate go.mod). go-json programs can call external scripts viascript:imports. - View system — 6 view types (list, form, kanban, calendar, chart, custom) with SSR rendering + layout system.
- Web Components — 122 Stencil.js components across 11 groups: 36 field types, layout, views, 26 charts (23 ECharts + 3 pure CSS), dialogs, widgets (incl. 8 media viewers/players), search, social, print. Component registry with dependency graph, include/exclude selector. Per-group/per-component CSS exports. Theme system (light/dark/system). RTL support.
- Multi-database — SQLite (zero-config default), PostgreSQL, MySQL, MongoDB. Auto-migration from JSON definitions. Per-module table prefix, Postgres schema support. Comprehensive query builder with JSON DSL, OQL (Object Query Language — 3 syntax styles), JOINs, OR/AND/NOT groups, HAVING, DISTINCT, aggregates (COUNT/SUM/AVG/MIN/MAX), subqueries, UNION, raw expressions, scopes, eager loading (WITH/preload), locking, soft delete scopes, transactions.
- Real-time — WebSocket hub broadcasting domain events to connected clients.
- File Storage — Local + S3 storage with attachments table, path/name formatting, thumbnails, versioning, duplicate detection.
- Native Shell (Tauri) — Tauri 2.0 wraps Stencil components for desktop (Win/Mac/Linux) and mobile (iOS/Android).
bc-native.tsbridge abstracts native capabilities (SQLite, camera, GPS, barcode, biometrics) with Web API fallback. One toggle (mode:"offline") enables offline-first with auto-generated sync infrastructure. - Flutter Adapter (ADR-011) — Full Mitosis↔Flutter parity: 130 hand-written Dart widgets across 11 groups (primitives, layout, forms, overlays, navigation, data-display, feedback, views, charts, media, social, print). Pure-Dart reactive engine, Material Design 3 token bridge, UiSchema types with freezed/json_serializable. 1158 tests, 297/297 validation assertions passed. Enables native iOS/Android/desktop apps sharing the same JSON definitions as the web engine.
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 1 | Schema Builder | ✅ | L | JSON-based model definitions (models/*.json), parsed by compiler/parser/model.go. Admin UI at /admin/models/:name shows fields & rules. Schema tab with visual field table + JSON editor + save/validate API. ADR-014 Phase 4: BcSchemaBuilder visual builder (field list, type picker, relation config, property panel, JSON preview). Validates via POST /api/v1/admin/models/validate (ModelValidator service). Flutter parity bc_schema_builder.dart. i18n (11 locales). |
— |
| 2 | Field Types | ✅ | — | 16+ types: string, text, integer, decimal, boolean, date, datetime, selection, email, many2one, one2many, many2many, json, file, computed. Stencil components cover 30+ field types. | — |
| 3 | Model Relationships | ✅ | — | many2one (FK column), one2many (reverse FK), many2many (auto junction table), morph_to (polymorphic belongs-to), morph_one (polymorphic has-one), morph_many (polymorphic has-many), morph_to_many (polymorphic M2M parent), morph_by_many (polymorphic M2M inverse). Morph map for type aliasing. MigrateModel() handles DDL. |
— |
| 4 | Child Table / Inline Table | ✅ | — | one2many field + form view tabs embedding child views. bc-child-table Stencil component. |
— |
| 5 | Computed / Formula Fields | ✅ | — | computed type defined in parser. Runtime expression evaluator (engine/internal/runtime/expression/) evaluates scalar formulas (quantity * unit_price) and aggregate expressions (sum(lines.subtotal)) at query time. Hydrated in repository FindByID/FindAll and view renderer. Supports: arithmetic, comparisons, boolean logic, functions (sum/count/avg/min/max/abs/round/ceil/floor/if), dot-path field access, one2many child collection aggregates. 17 tests. |
— |
| 6 | Data Versioning | ✅ | — | data_revisions table stores full before/after snapshots on every create/update/delete via GenericRepository hooks. Monotonic per-record versioning. Admin API: GET /admin/api/data/:model/:id/revisions, GET .../revisions/:version, POST .../restore/:version. Restore creates new head revision. Change diff computed automatically. Cleanup support. 7 tests. |
— |
| 7 | Multi-Source Data | L | 3 database drivers (SQLite/Postgres/MySQL) via DB_DRIVER. |
Only 1 database per instance. No simultaneous connections to multiple external databases. | |
| 68 | Model Lifecycle Events | ✅ | — | events field in model JSON. 16 event types: before/after validate, create, update, delete, save, soft_delete, hard_delete, restore + on_change. Handlers can be process or script. Supports: condition expressions, sync/async, on_error (fail/log/ignore), retry with backoff, timeout, priority ordering, bulk_mode (each/batch/skip). Data modification via return-value merge. Cascade on_change with depth limit. Inherited model event merge. Auto-publish to event bus (model.{name}.created/updated/deleted/restored). Repository-layer injection (fires for API, process, script). Client-side onchange API: POST /api/{model}/onchange. Design doc: docs/plans/2026-04-26-model-events-validation-design.md. |
— |
| 69 | Field Validation | ✅ | — | validation field in model JSON. 40+ built-in validators: required, email, url, phone, ip, uuid, json, alpha, alpha_num, alpha_dash, numeric, regex, starts_with, ends_with, contains, min/max, min_length/max_length, between, in/not_in, confirmed, different, gt/gte/lt/lte, date_before/after, unique (scoped, case-insensitive), exists/exists_where, min_items/max_items, file_size/file_type, immutable/immutable_after. Conditional: required_if/unless, required_with/without, exclude_if/unless, when condition, on (create/update/always). Custom validators (process/script). Model-level cross-field validators. i18n messages. Smart short-circuit per field. Partial update merge strategy. Auto-maps existing required/max/min fields. 422 error response with per-field errors. DB-backed unique check (scoped, case-insensitive, soft-delete aware), exists/exists_where, relation count for min_items/max_items. |
— |
| 70 | Field Sanitization | ✅ | — | sanitize field in model JSON (per-field or model-level _all_strings). 14 built-in sanitizers: trim, trim_left/right, lowercase, uppercase, title_case, strip_tags, strip_whitespace, slugify, normalize_email, normalize_phone, truncate:N, escape_html. Runs before validation. Skips password fields for model-level sanitizers. |
— |
| 71 | Data Migration System | ✅ | — | Laravel-style data migration/seeder. Multi-format (JSON, CSV, XLSX, XML). migrations/ folder per module, timestamped files, ir_migration tracking table, batch support, up/down rollback, custom processors (script/process), field mapping, defaults, upsert/skip/error conflict modes, composite unique keys, noupdate (Odoo-style), field_types override, transaction-wrapped, tracked inserted IDs for clean rollback. MongoDB full parity via MigrationStore interface. Legacy data/ seeder coordination. CLI: bitcode seed run/rollback/status/fresh/create with dependency-ordered execution. Auto-runs on module install. 26 tests. |
— |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 8 | Group-Based Permission (Odoo-style) | ✅ | — | Single Group concept replaces Role+Permission. ModelAccess table with 12 ERPNext-style permissions (select/read/write/create/delete/print/email/report/export/import/mask/clone). Additive across groups, default-deny. Superuser bypass. securities/*.json per module. Admin UI with 7-tab group form. Bi-directional JSON↔DB sync. |
— |
| 9 | Permission Matrix (12 permissions) | ✅ | — | model_access table: 12 boolean columns per model per group. PermissionService resolves via group chain (implied groups, recursive BFS). Middleware enforcement. Auto-derived for auto_crud. |
— |
| 10 | Record Rules (RLS) | ✅ | — | record_rules with m2m groups. Domain filter with operators + {{user.id}} interpolation. Odoo-compatible composition: global rules INTERSECT, group rules UNION. RecordRuleService injects WHERE clauses. |
— |
| 11 | Field-Level Permission | ✅ | — | groups field property: field hidden from users not in listed groups (server-side strip). mask/mask_length field property: value masked server-side for users without can_mask permission. Both enforced in CRUD handler before response. |
— |
| 12 | Menu Access Control | ✅ | — | Menu items have groups field for per-group visibility. group_menus table. Admin UI tab. |
— |
| 13 | UI Visibility Rules | ✅ | — | View actions have "visible": "status == 'draft'". Form fields have "readonly": true. Component compiler evaluates conditions. |
— |
| 14 | IP Whitelist / Session Policy | ✅ | — | IP whitelist middleware (exact IP + CIDR support, admin-only or global). Session policy: configurable JWT duration (security.session_duration), cookie Secure/SameSite flags. All via security.* config. |
— |
| 15 | Plugin Permission | S | Permission per module exists. Plugin scripts run in module context. | No granular per-plugin/script permission. Extend pattern to module.plugin.script_name. |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 16 | Audit Log | ✅ | — | audit_log model with user_id, action, model_name, record_id, changes, ip_address, user_agent, request_method, request_path, status_code, duration_ms. PersistentAuditMiddleware writes ALL write requests to DB. AuditLogRepository with async writes. |
— |
| 17 | Record Activity Timeline | ✅ | — | GET /admin/api/data/:model/:id/timeline combines data_revisions + audit_log entries. Admin model data page has "History" button per record with modal timeline showing changes with field-level diffs. |
— |
| 18 | Login History | ✅ | — | Login/logout/register persisted to audit_log from both API auth handler and app HTML login. POST /auth/logout endpoint added. Admin page at /admin/audit/login-history with User-Agent, IP. |
— |
| 19 | API Request Log | ✅ | — | PersistentAuditMiddleware persists all write requests to audit_logs table with method, path, status, duration, user, IP. Admin page at /admin/audit/request-log with method filtering. |
— |
| 20 | Data Change Diff | ✅ | — | data_revisions stores structured {field: {old, new}} changes. Timeline modal renders field-level before/after diff with color-coded old (red strikethrough) → new (green). |
— |
| 21 | Export/Import Log | ❌ | S* | — | No export/import feature exists yet (see #41, #47), so no log either. *Trivial once export/import is built. |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 22 | Workflow Builder (Visual) | ✅ | L | Full workflow engine via JSON: states, transitions, permissions, process linking. Runtime in runtime/workflow/. ADR-014 Phase 4: BcWorkflowBuilder visual builder (drag-drop node canvas, step palette, transition arrows, property panel, JSON preview). Validates via POST /api/v1/admin/processes/validate (ProcessValidator service). Flutter parity bc_workflow_builder.dart. i18n (11 locales). |
— |
| 23 | Approval Chain | ✅ | — | Workflow transitions with permission field. Multi-level via chained transitions. |
— |
| 24 | Trigger & Action Rules | ✅ | — | Agent system with event triggers + process emit step. Documented in docs/features/agents.md. |
— |
| 25 | Scheduled Tasks / Cron | ✅ | — | Agent cron with standard cron format. Runtime in runtime/agent/. Retry + backoff. |
— |
| 26 | Email / Notification | ✅ | L | SMTP sender (pkg/email), HTML templates, configurable via smtp.*. ADR-014 Phase 3: Notification model + NotificationService + REST endpoints + WebSocket push + @mention integration + BcNotificationCenter/BcNotificationItem + Flutter parity + i18n (11 locales). |
— |
| 27 | Assignment Rules | ❌ | M | — | No auto-assignment based on rules. Need assignment rule JSON definition + evaluator on record create/update. |
| 28 | Webhook | ❌ | M | Process engine has http step for outbound calls, but not a configurable webhook system. |
Need webhook definition (URL, events, headers) + dispatcher listening to event bus. |
| 29 | Server Script / Business Logic | ✅ | — | Plugin system (TS + Python) via JSON-RPC. Process script step. Documented in docs/features/plugins.md. |
— |
| 76 | go-json Core Language Engine | ✅ | — | Standalone JSON/JSONC programming language engine (packages/go-json/). 15 step types (let, set, if/elif/else, switch, for, while, break, continue, return, call, try/catch/finally, error, log, comment). Gradual type system (infer + strict-after-assignment + nullable + any). Function system with scope isolation and recursion. expr-lang/expr for expression evaluation (~68 built-in functions). Layer 2 stdlib (19 functions: math, strings, arrays, types). Resource limits (steps, depth, iterations, timeout). Debugger interface + execution trace. Compile-once-run-many with program cache. 75 tests. Design doc: docs/plans/2026-07-14-runtime-engine-phase-4.5a-go-json-core-language.md. |
Phase 4.5b (structs, imports, modules) and Phase 4.5c (I/O integration with BitCode engine) not yet implemented. |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 30 | Form Builder (Visual) | ✅ | L | JSON-based form layout (rows, fields, widths, tabs). SSR rendering. 122 Stencil.js components. POST /api/v1/admin/views/validate endpoint (ADR-014 Phase 4) validates view.json structure + field refs against model registry. ViewValidator service (runtime/builder). i18n keys (11 locales). ADR-014 Phase 4: BcFormBuilder visual builder (drag-drop canvas, property panel, JSON preview, live preview). Outputs valid view.json. Validates via admin endpoint. Flutter parity bc_form_builder.dart. |
— |
| 31 | Conditional Field Logic | ✅ | — | "visible": "expression", "readonly": true. Component compiler evaluates conditions. Stencil components support behavior.dependsOn, readonlyIf, mandatoryIf. Client-side: BcSetup.reactivity() for imperative cross-field logic, depend-on prop for declarative cascading. |
— |
| 32 | Custom Validation Rules | ✅ | — | Process validate step with eq, neq, required operators. Client-side: 3-level validation (built-in props, custom JS validators, server-side validation). BcSetup.registerValidator() for named validators. |
— |
| 33 | Multi-Step Form / Wizard | ✅ | M | ADR-014 Phase 1: Wizard view type (type: "wizard") in parser + renderer. Multi-step wizard with process-driven transitions. BcWizard Mitosis component (upgraded: steps from view JSON, process transitions, validation per step). Flutter parity bc_wizard.dart. i18n (11 locales). Engine tests. |
— |
| 34 | Print Format / PDF | ❌ | L | Template engine exists (Go html/template) but HTML only. No PDF generation. | Need print template JSON definition + PDF renderer (wkhtmltopdf/chromedp/gotenberg). |
| 35 | Web Form (Public) | ❌ | M | — | All forms require auth. Need public form route (bypass auth) + CAPTCHA + rate limiting. |
| 36 | View Types (List/Kanban/Calendar) | ✅ | — | 6 view types: list, form, kanban, calendar, chart, custom. All implemented in view/renderer.go + templates. Stencil has 9 view components (+ gantt, map, tree, report, activity). |
— |
| 37 | Dashboard Builder | ✅ | — | Custom view type with data_sources. Admin dashboard at /admin. |
— |
| 72 | Enterprise Component Infrastructure | ✅ | — | All phases complete. BcSetup (global config + reactivity + theme + RTL runtime), 4-level data fetching, 3-level validation, theming (light/dark/system/custom via setTheme), RTL support (CSS logical properties + setRtl), 122 components across 11 groups, component registry with dependency graph and include/exclude, post-build export generation (151 paths), per-group/per-component CSS, 26 charts with enterprise features (modular ECharts, multi-series, shared chart-utils). All standalone — no BitCode dependency. | — |
| 73 | Theming System | ✅ | — | CSS custom properties (--bc-*), light/dark themes, prefers-color-scheme auto-detect, data-bc-theme attribute for scoped themes, size tokens (sm/md/lg), BcSetup.configure({ theme }) for programmatic switching. |
— |
| 74 | Offline Mode | ✅ | XL | Phase 1-5 ✅ COMPLETE. Engine understands mode:"offline" with resolution chain. Auto-generates _off_* columns. 4 client + 4 server infrastructure tables. PK validation. Tauri 2.0 native shell. bc-native.ts bridge (16 methods). offline-store.ts with SQL injection prevention, transactional CRUD, outbox with device_id/envelope_id. Sync engine: device registration, push with idempotency + batch size + gzip compression, pull with delta sync + pagination, envelope grouping. HLC for deterministic event ordering. Field-level conflict merge with HLC tie-breaking. Device-prefixed receipt numbering. Inventory delta-based tracking with oversell alerts. SQLite encryption at rest (SQLCipher via feature flag). Offline auth with 72h expiry + brute-force lockout. bc-sync-status UI component. Hardened CSP. Cross-platform connectivity detection. |
— |
| 75 | Native Shell (Tauri) | L | Phase 2 ✅. Tauri 2.0 project at packages/tauri/. Stencil components run inside native WebView. Plugins: tauri-plugin-sql (SQLite + optional SQLCipher encryption), tauri-plugin-fs, tauri-plugin-notification. Mobile plugins (barcode-scanner, biometric) behind feature flag. Build pipeline: npm run dev:desktop, build:desktop, dev:android, build:android, dev:ios, build:ios. Icons generated for all platforms. Hardened CSP for production. |
Mobile platform testing (Android/iOS). Camera/GPS plugins (less mature on mobile). App Store submission. |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 38 | Report Builder | L | List view with filters + sort. Custom API endpoints can serve report data. | Dedicated report builder with group-by, aggregation, calculated columns. | |
| 39 | Query / Script Report | M | Process query step + plugin scripts can execute custom logic. |
Dedicated SQL/script report system runnable from UI. | |
| 40 | Chart Builder | ✅ | — | Chart view type. 26 Stencil chart components (23 ECharts: line, bar, pie, area, scatter, radar, gauge, funnel, heatmap, treemap, sunburst, candlestick, boxplot, mixed, sankey, graph, tree, polar, parallel, themeriver, pictorialbar, custom + 3 pure CSS: pivot, KPI, scorecard, progress). Modular ECharts imports, multi-series support, shared chart-utils, remote data fetching, toolbox, data zoom, theme/renderer switching. | — |
| 41 | Export Data (CSV/Excel/PDF) | ✅ | M | bc-export Stencil component + BcExport Mitosis component (ADR-014 wired). POST /api/v1/{module}/{model}/export endpoint (CSV/XLSX/JSON) with streaming response. ExportService Go layer (encoding/csv, excelize, encoding/json). Filter+sort via query builder. Permission-aware (export permission per group, field-level column sanitization + mask). BcExport contract upgraded (format, columns, onExport, progress). Flutter parity. i18n (11 locales). |
— |
| 42 | Pivot Table | ✅ | L | POST /api/v1/{module}/{model}/pivot endpoint. PivotService Go layer performing OLAP aggregation (GROUP BY rows+cols, sum/count/avg/min/max). Multiple value fields, multiple row/col dimensions, null handling, grand totals. Permission-aware (read + field-level). BcPivot Mitosis component (Pure/Adapt, ADR-006) + Flutter (Material/Cupertino adaptive). BcRenderer part:'pivot'. i18n (11 locales). Engine tests (single agg, multi agg, multi rows, multi cols, null handling, permission). Component tests. |
— |
| 43 | Scheduled Report | ❌ | M* | Cron system exists. | No report + email delivery integration. *Depends on email (#26) + report builder (#38). |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 44 | REST API (Convention-Driven) | ✅ | — | Model "api": true → auto-generates REST CRUD at /api/v1/{module}/{model_plural}. No separate api.json needed. Override via apis/*.json (merge by method+path). Multi-protocol ready (REST/GraphQL/WS config). PermissionService + RecordRuleService enforced per endpoint. Field masking + field groups filtering server-side. Permissions injected in API response metadata. |
— |
| 44b | Auto Swagger/OpenAPI | ✅ | — | Auto-generated OpenAPI 3.0 spec from model definitions + API definitions. Swagger UI at /api/v1/docs. JSON spec at /api/v1/docs/openapi.json. Field types mapped to OpenAPI schemas. |
— |
| 44c | Convention-Driven Pages | ✅ | — | Model "api.auto_pages": true → auto-generates list + form pages. bc-datatable for lists (permission-aware). Override via pages/*.json. Modal mode ("modal": true) for simple models. Cross-module reference via "module" field. |
— |
| 45 | OAuth2 / SSO | ❌ | L | — | Only JWT login (username/password). No OAuth2, SSO, or LDAP. |
| 46 | API Key Management | ❌ | S | — | No API key system for M2M integration. Need api_key model + auth middleware. |
| 47 | Data Import / Export | ❌ | L | Data seeding via data/*.json (module install only, not user-facing). |
CSV/Excel import wizard with field mapping + validation. |
| 48 | Third-Party Connectors | XL | Process http step + plugin scripts for integration. |
No pre-built connectors (Slack, WhatsApp, payment gateways). Need connector framework. | |
| 49 | GraphQL API | ✅ | — | Model "api.protocols.graphql": true → auto-generates GraphQL schema (types, queries, mutations) from model fields. Single endpoint at POST /api/v1/graphql. Resolvers reuse CRUD logic with permission enforcement. Supports: list (paginated), read, create, update, delete. Introspection enabled. |
— |
| 49b | WebSocket CRUD | ✅ | — | Model "api.protocols.websocket": true → enables CRUD over WebSocket at /ws. Request/reply protocol: {type:"crud", model:"contact", action:"list/read/create/update/delete"}. Permission + record rule enforcement. Extends existing event broadcast hub. |
— |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 50 | Custom App / Module | ✅ | — | Full module system. CLI: bitcode module create. Dependency resolution, topological sort. 3-layer FS. |
— |
| 51 | Workspace / Menu Builder | ✅ | — | Menu in module.json with label, icon, children, view links. Sidebar navigation. |
— |
| 52 | Branding / White Label | ❌ | S | — | No UI for logo, colors, app name. Templates hardcoded. Need branding settings + template injection. |
| 53 | Multi-Language / i18n | ✅ | — | Translation files per module (i18n/*.json). Translator with fallback chain. 11 languages in Stencil components. |
— |
| 54 | Multi-Currency | ❌ | L | formatCurrency template helper exists but hardcoded format. bc-field-currency Stencil component. |
No currency model, exchange rates, or automatic conversion. |
| 55 | Multi-Company | L | Multi-tenancy (header/subdomain/path) can serve as multi-company. | No dedicated multi-company with inter-company transactions, consolidated reporting. | |
| 56 | Plugin / Extension System | ✅ | — | TypeScript + Python runtime, JSON-RPC, gRPC proto, health monitoring, auto-restart. | — |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 65 | Auth Module | ✅ | — | Embedded auth module with login, register, forgot password, reset, 2FA verify pages. All templates i18n-ready (11 languages). module.json auth field controls per-module auth requirement (default: true). Settings-driven: register_enabled, otp_enabled, otp_channel, otp_type. menu_visibility: "none" support. ?next= redirect with sanitization. |
— |
| 57 | Two-Factor Auth (2FA) | ✅ | — | Email OTP 2FA: POST /auth/2fa/enable, /auth/2fa/disable, /auth/2fa/validate. Login returns requires_2fa + temp token when 2FA enabled. OTP via SMTP email, cached with TTL, max 3 attempts. |
— |
| 58 | Data Encryption | ✅ | — | Password hashing (bcrypt) + JWT signing + AES-256-GCM field-level encryption. Fields marked "encrypted": true in model JSON get transparent encrypt-on-write / decrypt-on-read. Key versioning (v1: prefix) for future rotation. |
— |
| 59 | Backup & Restore | ✅ | — | bitcode db backup [path] and bitcode db restore [path]. Driver-aware: SQLite file copy, PostgreSQL pg_dump/psql, MySQL mysqldump/mysql. Supports --gzip compression and --force restore. Metadata JSON per backup. |
Scheduled backups (depends on cron + storage). |
| 60 | Rate Limiting | ✅ | — | Fiber limiter middleware. Global rate limit (default 100/min) + stricter auth endpoint limit (5/min). Configurable via rate_limit.* config. Returns 429 with Retry-After header. |
— |
| 61 | CSRF & XSS Protection | S | XSS: Go html/template auto-escapes. API uses JWT (stateless, no CSRF needed). Current SSR forms use HTTPOnly JWT cookie (low risk). | CSRF token needed for future public web forms (job portal, contact forms, website module). Will implement when public web forms feature is built. | |
| 62 | Soft Delete / Recycle Bin | ✅ | — | Model-level soft_deletes: true adds deleted_at column. DELETE sets deleted_at = NOW() + active = false. FindAll/Count/Sum exclude soft-deleted records (deleted_at IS NULL). Active variants (FindAllActive, FindActive, CountActive, SumActive, PaginateActive) filter by active = true. active is a separate business field (inactive ≠ deleted). Optimistic locking via version: true. Conditional timestamps/timestamps_by. |
Recycle bin UI to view and restore deleted records (effort S). |
| 63 | Admin Impersonation | ✅ | — | Token-based impersonation: POST /admin/api/impersonate/:user_id (admin-only, cannot impersonate other admins, 1h TTL). POST /admin/api/stop-impersonate returns admin token. JWT impersonated_by claim. All audit logs include impersonated_by field. |
— |
| 64 | Email Infrastructure | ✅ | — | SMTP email sender (pkg/email). Configurable via smtp.* config (host, port, user, password, from, TLS). HTML email templates. Used by 2FA, reusable for notifications, password reset, scheduled reports. |
— |
| # | Feature | Status | Effort | What Exists | What's Missing |
|---|---|---|---|---|---|
| 63 | Comment & Mention | ✅ | M | Comment service (internal/runtime/comment/) with polymorphic comments (commentable_type + commentable_id), threaded replies (parent_id), @mention parsing & resolution, notification creation on mention, WebSocket broadcast on create. HTTP handler at /api/v1/:module/comments (GET list, POST create, DELETE). Permission + record-rule enforcement (read/write/create/delete). Model-registry morph-type resolution. Wired in app.go. 17 tests (service + handler). |
bc-chatter Stencil component exists but not wired to backend API. |
| 64 | Activity Feed | ✅ | M | ActivityService (internal/runtime/activity/) aggregates audit_log → BcActivityEntry[] with server-side transform (verb, variant, icon, actor name resolution via batch user lookup). GET /api/v1/activity endpoint with query params (model, record_id, user, since, limit, page). Permission-aware (record-scoped queries enforce read permission + record rules; superuser bypass). 22 tests (service transform/aggregation/pagination/filter + handler permission/pagination/edge cases). ViewActivity view type wired in renderer.go + CompileActivity in component compiler emits bc-activity bound to /api/v1/activity. BcActivity contract upgraded (variant, dataSource, onLoadMore, onItemAction) — web + Flutter parity with 15 source tests + 14 widget tests. i18n keys in 11 locales. |
— |
| 65 | Email Inbox Integration | ❌ | XL | — | No email integration at all. Need IMAP client + email parsing + thread linking + SMTP send. |
| 66 | Task / To-Do per Record | ❌ | M | — | No task/todo system. Need todo model + API + UI widget. |
| 67 | In-App Notification | ✅ | M | Notification model (notification.json: user_id m2o, type selection [info|warning|error|success|mention|message], title, body, data json, notifiable morph_to, read_at, created_at). NotificationService Go layer (Create, List unread-first user-scoped, MarkRead, MarkAllRead, UnreadCount, WS push via BroadcastToUser). REST endpoints: GET /api/v1/notifications (user-scoped, unread-first, pagination), POST /:id/read, POST /read-all, GET /unread-count. WebSocket push on new notification. @mention integration (comment service writes notification on @mention). BcNotificationCenter + BcNotificationItem web components (Pure/Adapt, bell + dropdown panel, unread badge, mark-read, infinite scroll). Flutter parity (iOS Cupertino dropdown + Android Material). BcRenderer part:'notification-center' in navbar. i18n (11 locales). Engine tests (16) + handler tests (7) + component tests (21) + Flutter tests (10). |
— |
The @bitcode/components Stencil library (122 components across 11 groups) provides rich UI widgets. Many are built but not yet wired to the engine's SSR rendering:
| Category | Components | Count | Engine Integration |
|---|---|---|---|
| Fields | string, text, richtext, code, date, select, link, file, image, signature, barcode, geo, rating, json, lookup-modal, etc. | 36 | |
| Layout | row, column, section, tabs, sheet, header, separator, button-box, html-block | 10 | |
| Views | list, form, kanban, calendar, gantt, map, tree, report, activity, view-editor | 10 | |
| Charts | line, bar, pie, area, scatter, radar, gauge, funnel, heatmap, treemap, sunburst, candlestick, boxplot, mixed, sankey, graph, tree, polar, parallel, themeriver, pictorialbar, custom, pivot, KPI, scorecard, progress | 26 | ✅ Chart view type uses ECharts (modular imports) |
| Datatable | datatable, child-table, filter-bar, filter-panel, filter-builder, lookup-modal | 5 | ❌ Not wired |
| Dialogs | modal, confirm, alert, prompt, quick-entry, wizard, toast | 7 | ❌ Not wired |
| Search | search, favorites | 2 | ❌ Not wired |
| Widgets | badge, copy, phone, email, url, progress, statusbar, priority, handle, domain, placeholder, sync-status | 12 | |
| Media | pdf, image, document, youtube, instagram, tiktok, video, audio | 8 | ✅ Standalone viewer/player components |
| export, print, report-link | 3 | ✅ Export wired (ADR-014) | |
| Social | activity, chatter, timeline | 3 | |
| Total | 122 |
Export architecture: Post-build generate-exports.mjs creates group barrels in dist/components/{group}/index.js, dist/full.js (defineAll), per-group CSS, per-component CSS, theme CSS. 151 export paths in package.json. Component registry (Registry.select()) with dependency graph and include/exclude selector.
Theme system: BcSetup.setTheme('light'|'dark'|'system') / onThemeChange() / setRtl(). CSS custom properties (80+ tokens). light.css + dark.css theme files.
Key gap: Components are built and the SPA mode foundation is now in place (render: "spa" + JSON envelope). Full SPA coverage of all view types is incremental (Phase 3+).
Low-hanging fruit that immediately improves the platform:
- #14 IP Whitelist / Session Policy — middleware for IP check + JWT expiry config
- #15 Plugin Permission (granular) — extend permission pattern to
module.plugin.script_name - #18 Login History view — extend audit_log fields + dedicated view
- #20 Data Change Diff UI — store old_value/new_value per field + diff component
- #46 API Key Management — api_key model + auth middleware accepting API key header
- #52 Branding / White Label — branding settings (logo, app name, color) + template injection
- #60 Rate Limiting — gofiber/limiter middleware
- #61 CSRF Protection — CSRF middleware for SSR form routes
- #62 Recycle Bin UI — filter
active = falseview + restore endpoint
Features most requested by users and blocking other features:
- #5 Computed Field Evaluator — expression parser + evaluator at query time
- #11 Field-Level Permission — per-field permission config in model JSON + API/form filter
- #17 Record Activity Timeline — API endpoint + timeline UI component
- #27 Assignment Rules — assignment rule JSON definition + evaluator on create/update
- #28 Webhook System — webhook definition (URL, events, headers) + event bus dispatcher
- #33 Multi-Step Form / Wizard — wizard view type + process-driven transitions + BcWizard upgrade + Flutter parity + i18n (11 locales)
- #35 Web Form (Public) — public form route (bypass auth) + CAPTCHA + rate limiting
- #41 Export Data (CSV/Excel/JSON) —
POST /api/v1/{module}/{model}/exportendpoint with streaming CSV/XLSX/JSON, query builder filter/sort, export permission check, field-level column sanitization + masking - #57 2FA (TOTP) — TOTP library + setup flow + verification middleware
- #59 Backup & Restore — db dump/restore commands + optional scheduling
- #63 Comment & Mention — comment model + API + mention parsing/resolution + permission checks + threading + WebSocket broadcast.
bc-chattercomponent wiring still pending. - #67 In-App Notification — notification model + NotificationService (Create, List unread-first, MarkRead, MarkAllRead, UnreadCount) + REST endpoints + WebSocket push (BroadcastToUser) + @mention integration + BcNotificationCenter/BcNotificationItem (Pure/Adapt) + Flutter parity + i18n (11 locales) + engine/handler/component tests
The gap between "JSON-code" and true "low-code":
- #1 Visual Schema Builder — BcSchemaBuilder visual field list + type picker + relation config + ModelValidator endpoint + Flutter parity + i18n (11 locales)
- #22 Visual Workflow Builder — BcWorkflowBuilder drag-drop node canvas (step palette + transitions + property panel + JSON preview) + ProcessValidator endpoint + Flutter parity + i18n (11 locales)
- #30 Visual Form Builder — BcFormBuilder drag-drop canvas (property panel + JSON preview + live preview) + ViewValidator endpoint + Flutter parity + i18n (11 locales)
- #34 Print Format / PDF — print template JSON + PDF renderer (wkhtmltopdf/chromedp/gotenberg)
- #38 Report Builder — report JSON definition (columns, filters, group_by, aggregations) + renderer
- #47 Data Import / Export Wizard — upload → map columns → validate → insert
JSON/JSONC programming language engine replacing process engine scripting:
- #76 go-json Core Language (Phase 4.5a) — standalone
packages/go-json/with 15 step types, gradual types, functions, stdlib, resource limits, debugger, 75 tests - Phase 4.5b go-json Modularity — structs, imports, module system, codegen
- Phase 4.5c go-json I/O Integration — I/O modules, BitCode engine integration, process engine routing
Enterprise-grade capabilities:
- #7 Multi-Source Data — connection pool manager for multiple datasources
- #26 Email / Notification — SMTP sender (pkg/email) + HTML templates + notification model + NotificationService + REST endpoints + WebSocket push + BcNotificationCenter + Flutter parity + i18n (11 locales)
- #42 Pivot Table — PivotService OLAP engine +
POST /pivotendpoint + BcPivot Mitosis + Flutter component - #45 OAuth2 / SSO — OAuth2 client (Google, Microsoft, GitHub) + LDAP connector
- #49 GraphQL API — schema generator from model definitions + resolver layer
- #54 Multi-Currency — currency model + exchange rate table + conversion logic
- #55 Multi-Company — company model + company-level settings + inter-company transactions
- #64 Activity Feed —
GET /api/v1/activityaggregatesaudit_log→BcActivityEntry[](ActivityService transform with verb/variant/icon/actor). Permission-aware (record-scoped read checks). Pagination (limit/page).bc-activityweb + Flutter wired.ViewActivityrenderer +CompileActivity. i18n (11 locales). - #66 Task / To-Do per Record — todo model + API + UI widget
- #43 Scheduled Reports — depends on email (#26) + report builder (#38)
- #48 Third-Party Connectors — connector framework + individual implementations
- #65 Email Inbox Integration — IMAP client + email parsing + thread linking
- AGENTS.md Redis cache wiring — wire into permission checker and query result cache
- AGENTS.md NATS event bus — replace in-process bus for distributed deployments
- AGENTS.md Marketplace — community module sharing
- SPA Mode (Phase 2 — Foundation) —
view.json { "render": "spa" }returns a JSON envelope{ view, data, meta }instead of HTML; client runtimes inpackages/ui(web/Mitosis) andpackages/ui-flutter(Flutter) fetch the envelope and render via the existing BcRenderer + ReactiveStore. SSR is the default and stays fully backwards compatible. Seeengine/docs/features/spa-mode.md. 11 engine tests, 13 web tests, 28 Flutter tests, 100% passing.
Known limitations in the Bridge API (engine/internal/runtime/bridge/) that will be addressed in subsequent phases:
| # | Item | Current State | Target | Phase |
|---|---|---|---|---|
| 1 | Storage + AttachmentRepository | storage_bridge.go wraps StorageDriver only |
Integrate AttachmentRepository for metadata tracking, thumbnails, versioning |
1 (iteration 2) |
| 2 | Email template rendering | email.go sends raw HTML body only |
Support template + data fields via Go html/template engine |
1 (iteration 2) |
| 3 | Notify user targeting | ✅ BroadcastToUser(userID, channel, data) on Hub filters by Client.UserID — used by NotificationService |
Done in Phase 3 | 0 |
| 4 | Execution log cleanup cron | execution.go has config but no cleanup goroutine |
Add cron-based cleanup using max_age + max_records from ExecutionLogConfig |
1 (iteration 2) |
| 5 | Execution retry | execution.Retry() returns "not yet implemented" |
Re-run process with same input, link via parent_id |
1 (iteration 2) |
| 6 | Executor integration | executor.go not yet wrapped with execution log recording |
Wrap Execute() to auto-record process_execution + per-step logging |
1 (iteration 2) |
| 7 | BulkUpdate hooks | BulkUpdate skips before/after hooks for performance |
Add opt-in hook dispatch for bulk operations | 6B |
| 8 | BulkDelete hooks | BulkDelete skips before/after hooks for performance |
Same as above | 6B |
| 9 | QuickJS unit tests | Only compile check, no VM execution tests | Add VM execution tests | 4 (iteration 2) |
| 10 | yaegi go.mod per module | Not implemented | bitcode module extract-deps CLI + yaegi extract pipeline |
5 (iteration 2) |
Detailed per-feature documentation lives in engine/docs/features/:
| Feature | Doc | Status |
|---|---|---|
| Models | models.md | ✅ |
| APIs | apis.md | ✅ |
| Processes | processes.md | ✅ |
| Views & Templates | views.md | ✅ |
| Modules | modules.md | ✅ |
| Security | security.md | ✅ |
| Workflows | workflows.md | ✅ |
| Agents & Cron | agents.md | ✅ |
| Plugins | plugins.md | ✅ |
| i18n | i18n.md | ✅ |
| Configuration | configuration.md | ✅ |
| WebSocket | websocket.md | ✅ |
| Multi-tenancy | multitenancy.md | ✅ |
| Admin UI | admin.md | ✅ |
| File Storage | storage.md | ✅ |
| Offline Mode | offline-mode.md | ✅ Phase 1-5 Complete |
540 Go tests across 31 packages + 131 Stencil component tests (7 suites). All passing. See engine/docs/codebase.md for the full breakdown.
cd engine && go test ./... -v