OpenSparrow v3.2 is a security‑focused and consistency‑focused release that strengthens access boundaries, improves AI‑driven aggregate queries, and unifies the entire admin and frontend experience under one design system.
This update introduces per‑user access control across all major scopes, brings materialized‑view support to RAG aggregate queries, and delivers a full visual refresh that aligns every UI surface with the new Business design language.
Below is a detailed breakdown of the changes, including how they work, why they matter, and what they unlock for real deployments.
Per-user access control
New Users → Access tab. Each user gets independent allow‑lists across five scopes — tables, views, printouts, boards, workflows — stored as user_table_access in config.
The default is unrestricted: an absent or empty list means “no restriction”, not “no access”. To fully cut a user off, deactivate the account instead.
- Enforced at the API boundary by default, not just hidden in the UI —
os_api_action()/os_api_dispatch()gate table, view, print, board, and workflow endpoints, and FK/file/comment/mass‑edit/data‑cleanup endpoints were extended to respect the same restrictions - Granting a board or workflow does not implicitly grant the tables it touches — a board whose table isn’t granted won’t show up, and a workflow drops if any step targets a table the user can’t reach
- Hidden tables (no menu entry, no grid) can’t be ticked and are granted automatically
- Delegated FK lookups and the schema endpoint are now scoped to what the requesting user can actually access, and the file listing is filtered by record ownership
RAG: materialized views as aggregate views
The aggregate‑view feature from 3.1 (attach a PostgreSQL view to a table so the AI assistant can answer exact “total/how many” questions) now also accepts materialized views, flagged as such in the admin UI — useful when the aggregate query is expensive enough that you’d rather refresh it on a schedule than recompute it on every chat message.
Views sync also discovers materialized views alongside regular ones.
A unified “Business” look
The admin panel, setup wizard, and frontend were unified onto a single Business 4+1 color palette and one system‑ui font stack, replacing a mix of ad-hoc colors and font declarations across dozens of JS/CSS files.
Every front‑end button now shares one height, weight, border radius, and font size instead of drifting per page.
Also in this release
- CRM demo: richer install description, plus optional demo‑user and audit‑history install toggles
- Release packaging excludes
creator/,dist-local/, andstorage/tmp/from image and release archives - Admin docs updated to match actual current module behavior across several sections
Websites
Discussion
I encourage a substantive discussion, and I'll do my best to answer any questions regarding implementation and configuration.
