v8.1.0 - tighter multi-user access control and a smoother first run.

8.1.0 is the kind of release that does not add a headline feature, it makes the platform safer to run with more than one person on it and easier to stand up for the first time. The biggest piece is a careful pass over access control so that a shared deployment keeps each team inside its own projects. The rest is a set of fixes for setup, exports and validation that take real-world reports and close them properly.

What is new in version 8.1.0

• Tighter multi-user access control. A broad pass across the platform makes sure every account only sees and changes data in the projects it can reach. A list or aggregate that does not name a project is now scoped to the caller's own projects rather than returning everything, while administrators keep the full portfolio view.
• A smoother first run. The init-db and seed commands now discover every module's tables automatically, the same way the server already does on first start, so a brand-new database is always created in full instead of stopping on a foreign-key error.
• A What's new panel in the top bar. A small button opens a short panel that links to the latest release news, the cookie policy and an in-app changelog, so you can see what changed without leaving the app.
• An honest rule-pack coverage report. A read-only view shows, for every installed validation rule pack, how many of the rules it declares are actually implemented and run, so a pack can no longer look like it checks more than it does.
• Sharper validation and exports. DIN 276 cost groups now validate across the full code hierarchy and accept the dotted element codes the CAD classifier produces, and the takeoff CSV export subtracts openings and voids the same way the Excel export and on-screen totals do.
• A quickstart that parses. The quickstart Docker Compose file now parses once you provide the required POSTGRES_PASSWORD and JWT_SECRET, reported in issue #227.

Every account stays inside its own projects

When several teams share one instance, the question that matters is simple: can one person see another team's numbers. 8.1.0 answers it with a broad access-control pass across the platform. The rule is consistent. A request that asks for a single project's data is checked against that project as before. A request that lists records or rolls up a total without naming a project used to be able to reach across everything, and it is now scoped to the projects the caller can actually reach. Administrators are unchanged and keep the full portfolio view they need.

The pass reaches the places where cost and commercial data lives: finance budgets, earned value and the finance dashboard, the chart of accounts, the business-intelligence dashboards, background jobs, approval workflows, the cost catalogue, the lead-capture webhooks, property-development records and the chat assistant. None of this changes what a single user can do inside their own work. It changes what a list or a total returns when it is asked without a project filter, so a shared deployment behaves the way you would expect a multi-tenant system to behave. This is hardening, applied evenly, rather than a new wall around any one screen.

A fresh database that comes up complete

Standing the platform up on an empty database should never be the hard part. The init-db and seed commands used to build their list of tables to create from a hand-maintained list, and over time that list drifted behind the modules, so on a brand-new database the commands could stop on a foreign-key error before the schema was finished. They now discover every module's tables automatically, the same way the running server already does the first time it starts, so the full schema is always created in one go. The normal openconstructionerp start was never affected by this, only the explicit setup commands, and now those match it.

See what changed without leaving the app

A new What's new button sits in the top bar. It opens a short panel that links to the latest release news on openconstructionerp.com, with a note that the site uses anonymised analytics and a link to the cookie policy, plus a link to the in-app changelog. It is a small thing, but it closes the gap between shipping a release and the people running the app noticing it.

Validation that tells the truth

Two changes make validation more honest and more correct. The first is a read-only coverage report: for every installed rule pack it shows how many of the rules the pack declares are actually implemented and run, so a pack can no longer appear to check more than it really does. The second tightens the DIN 276 checks, which now validate across the full code hierarchy, the main group, the group and the sub-group, and accept the dotted element codes the CAD classifier produces, for example 330.10, instead of rejecting them.

On the export side, the takeoff CSV now subtracts openings and voids the same way the Excel export and the on-screen totals already do. Before this, the same takeoff could report a larger area to CSV than it showed on screen or wrote to Excel. Now the three agree, which is what you want when a number leaves the app and lands in a spreadsheet someone else relies on.

By the numbers

Install or upgrade

pip install --upgrade openconstructionerp

The desktop installers for Windows, macOS and Linux carry the same one-installer setup, and the Linux build includes the CAD and BIM converters for AutoCAD, Revit and IFC. You can grab the latest installers from openconstructionerp.com/download. If you run an external PostgreSQL through DATABASE_URL, nothing about that connection changes. Questions or trouble upgrading, write to info@datadrivenconstruction.io.