@lilaquadrat/studio 13.0.0 → 13.1.0

package/lib/src/services/tracker.service.js

@@ -0,0 +1,732 @@
+import dayjs from 'dayjs';
+import { ObjectId } from 'mongodb';
+import Immutable from '../Immutable.class.js';
+import ImmutableError from '../classes/errors/Immutable.error.js';
+import handleError from '../functions/handleError.js';
+import respondCode from '../functions/respondCode.js';
+import escapeRegExp from '../helpers/escapeRegExp.js';
+import lookupUserAggregation from '../aggegations/user.aggregation.js';
+import CustomersModel from '../models/customers.model.js';
+import MeModel from '../models/me.model.js';
+import ShiftModel from '../models/shift.model.js';
+import TimeTrackingProjectAllocationModel from '../models/timeTrackingProjectAllocation.model.js';
+import TrackerModel from '../models/tracker.model.js';
+import { MeService } from './me.service.js';
+import TimeTrackingProjectsService from './timeTrackingProjects.service.js';
+const MILLISECONDS_PER_HOUR = 3600000;
+const DEFAULT_MAXIMUM_HOURS_PER_DAY = 24;
+/** the `user` query value that lists every person's entries; `filterAdmin` removes `user` for anyone without the admin scope */
+export const TRACKER_ALL_USERS = 'all';
+/** a plan view shows a month or a week, so a longer range is a mistake and would load an unbounded list */
+const MAXIMUM_BOOKING_RANGE_DAYS = 62;
+const MAXIMUM_BOOKINGS = 2000;
+export class TrackerService extends Immutable {
+    constructor() {
+        super(...arguments);
+        this.model = TrackerModel;
+    }
+    /** writes are pinned to the company and project, so an id from another tenant never matches */
+    scopeFilter(id, options) {
+        return { _id: id, company: options.company, project: options.project };
+    }
+    /** the stored entry of this company and project; it carries the owner and plan, which a change payload does not */
+    scopedBooking(id, options) {
+        return this.model.db.findOne(this.scopeFilter(id, options));
+    }
+    /**
+     * Turns the request entries into bookings of the caller and runs every guard before anything is stored.
+     * Only an admin books for another person, so everybody else loses the `customer` the body names.
+     */
+    async prepareBookings(input, options) {
+        const entries = input.map((single) => ({
+            ...single,
+            startTime: single.startTime ? new Date(single.startTime) : undefined,
+            endTime: single.endTime ? new Date(single.endTime) : undefined,
+            company: options.company,
+            project: options.project,
+            user: options.user,
+        }));
+        const admin = await this.bookingAdmin(entries, options);
+        const bookings = admin ? entries : entries.map((entry) => this.withoutCustomer(entry));
+        await this.assertShiftAssignment(bookings, options, admin);
+        await this.assertPlanGrouping(bookings, options);
+        await this.assertDailyLimit(bookings, options);
+        return bookings;
+    }
+    async createBooking(input, options) {
+        const [booking] = await this.prepareBookings([input], options);
+        return this.create(booking, options.user, options.app);
+    }
+    async createBookings(input, options) {
+        const bookings = await this.prepareBookings(input || [], options);
+        return this.createMultiple(bookings, options.user, options.app);
+    }
+    /** the change payload with real dates, without the keys the model keeps as booked */
+    changeOf(input) {
+        const { startTime, endTime, ...fields } = input;
+        const change = { ...fields };
+        // immutable() drops them too, removing them here keeps the checks on the stored person and plan
+        this.model.immutable.forEach((key) => delete change[key]);
+        if (startTime)
+            change.startTime = new Date(startTime);
+        if (endTime)
+            change.endTime = new Date(endTime);
+        if (startTime && endTime)
+            change.currentTime = new Date(endTime).getTime() - new Date(startTime).getTime();
+        return change;
+    }
+    /**
+     * Changes a booking of this company and project. Access is decided by `ownBookingOrAdmin` before.
+     * The shift assignment is only checked when the shift or the person changes, so entries whose
+     * assignment was removed later can still get their time or description corrected.
+     */
+    async changeBooking(id, input, options) {
+        const stored = await this.scopedBooking(id, options);
+        if (!stored)
+            throw new ImmutableError('DOCUMENT_FOR_UPDATE_MISSING');
+        const requested = this.changeOf(input);
+        const admin = await this.bookingAdmin([requested], options);
+        const change = admin ? requested : this.withoutCustomer(requested);
+        // the booking's own person, also when an admin changes it
+        const owner = { ...options, user: this.ownerOf(stored) || options.user };
+        const merged = { ...stored, ...change };
+        if (merged.shift !== stored.shift || merged.customer !== stored.customer) {
+            await this.assertShiftAssignment([merged], owner, admin);
+        }
+        // the stored record may still carry the category older shift bookings were saved with
+        await this.assertPlanGrouping([merged], options, 'change');
+        await this.assertDailyLimit([merged], owner, id);
+        return this.immutable(this.scopeFilter(id, options), change, options.user, 'change', options.app);
+    }
+    async changeDescription(id, input, options) {
+        const stored = await this.scopedBooking(id, options);
+        if (!stored)
+            throw new ImmutableError('DOCUMENT_FOR_UPDATE_MISSING');
+        return this.immutable(this.scopeFilter(id, options), input, options.user, 'change', options.app, undefined, undefined, 'updateDescription');
+    }
+    async removeBooking(id, options) {
+        const stored = await this.scopedBooking(id, options);
+        if (!stored)
+            throw new ImmutableError('PARENT_DOCUMENT_NOT_FOUND');
+        // the scoped lookup above already proved the id belongs to this company and project
+        return this.delete(id, options.user, options.app);
+    }
+    /** Uses the tracked span when both ends are present, mirroring the duration stored by changeBooking(). */
+    dailyLimitDuration(entry) {
+        if (entry.startTime && entry.endTime) {
+            const duration = new Date(entry.endTime).getTime() - new Date(entry.startTime).getTime();
+            if (!Number.isNaN(duration))
+                return Math.max(duration, 0);
+        }
+        return entry.currentTime || 0;
+    }
+    /**
+     * The entries that count as one person's time: the ones booked for that customer, which an admin
+     * stores under their own account, and the ones the person's own accounts booked. Counting by the
+     * booking account alone charges everything an admin books for others to the admin.
+     */
+    async personFilter(customer, options) {
+        const byCustomer = { customer };
+        if (!ObjectId.isValid(customer))
+            return byCustomer;
+        const person = await CustomersModel.db.findOne({
+            _id: new ObjectId(customer), company: options.company,
+        }, { projection: { accounts: 1 } });
+        const accounts = person && 'accounts' in person
+            ? (person.accounts || []).filter((single) => single.project === options.project).map((single) => single.account)
+            : [];
+        return accounts.length ? { $or: [byCustomer, { user: { $in: accounts } }] } : byCustomer;
+    }
+    /**
+     * Rejects entries that would push a user's tracked time for one plan and calendar day above the
+     * plan's maximumHoursPerDay. Missing plans, plans without the option and entries without a plan
+     * fall back to the 24 hour ceiling so existing trackers keep working.
+     */
+    async assertDailyLimit(entries, options, excludeId) {
+        const groups = new Map();
+        entries.forEach((entry) => {
+            if (!entry.startTime)
+                return;
+            const startTime = new Date(entry.startTime);
+            if (Number.isNaN(startTime.getTime()))
+                return;
+            const key = `${entry.timeTrackingProject || ''}|${entry.customer || ''}|${dayjs(startTime).format('YYYY-MM-DD')}`;
+            const group = groups.get(key);
+            if (group) {
+                group.duration += this.dailyLimitDuration(entry);
+                return;
+            }
+            groups.set(key, {
+                timeTrackingProject: entry.timeTrackingProject,
+                customer: entry.customer,
+                startTime,
+                duration: this.dailyLimitDuration(entry),
+            });
+        });
+        for (const group of groups.values()) {
+            const plan = group.timeTrackingProject
+                ? await TimeTrackingProjectsService.singleTimeTrackingProject(group.timeTrackingProject, options)
+                : null;
+            const maximumHoursPerDay = plan?.maximumHoursPerDay || DEFAULT_MAXIMUM_HOURS_PER_DAY;
+            const query = {
+                company: options.company,
+                project: options.project,
+                ...(group.customer ? await this.personFilter(group.customer, options) : { user: options.user }),
+                startTime: {
+                    $gte: dayjs(group.startTime).startOf('day').toDate(),
+                    $lte: dayjs(group.startTime).endOf('day').toDate(),
+                },
+            };
+            if (group.timeTrackingProject)
+                query.timeTrackingProject = group.timeTrackingProject;
+            if (excludeId)
+                query._id = { $ne: excludeId };
+            const [usage] = await this.model.db.aggregate([
+                { $match: query },
+                { $group: { _id: null, time: { $sum: '$currentTime' } } },
+            ]).toArray();
+            const used = usage?.time || 0;
+            if (used + group.duration > maximumHoursPerDay * MILLISECONDS_PER_HOUR) {
+                throw new ImmutableError('TRACKER_DAILY_LIMIT_EXCEEDED');
+            }
+        }
+    }
+    /**
+     * The caller's own customer in this project, used to check the shifts the caller is assigned to.
+     * App is intentionally not pinned: the tracker client reaches the same flow with different
+     * `studio-app` ids (entry save uses the editor app, shift and allocation lookups use the tracker
+     * app), and the customer connection is what carries the assignment, not the app that asked.
+     */
+    callerCustomer(options) {
+        return CustomersModel.db.findOne({
+            company: options.company, type: 'person', emailConfirmed: true,
+            accounts: { $elemMatch: { account: options.user, project: options.project } },
+        }, { projection: { _id: 1 } });
+    }
+    /**
+     * Rejects entries referencing a shift the caller may not book on. A member only books their own
+     * customer, so every shift entry has to carry that customer in `assignments.customer`. A project
+     * admin books for the person on the shift, so the entry's own `customer` is what gets checked
+     * (an admin entry without one still falls back to their own customer, the "record time" screen).
+     * Entries without a shift are ignored, so every other tracking mode is unaffected.
+     */
+    async assertShiftAssignment(entries, options, admin = false) {
+        const shiftEntries = entries
+            .filter((entry) => typeof entry.shift === 'string' && entry.shift.length > 0);
+        if (!shiftEntries.length)
+            return;
+        const uniqueShiftIds = [...new Set(shiftEntries.map((entry) => entry.shift))];
+        if (uniqueShiftIds.some((shift) => !ObjectId.isValid(shift))) {
+            throw new ImmutableError('TRACKER_SHIFT_NOT_ASSIGNED');
+        }
+        // an admin who names the person on every entry needs no customer record of their own
+        const ownCustomer = (!admin || shiftEntries.some((entry) => !entry.customer))
+            ? await this.callerCustomer(options)
+            : null;
+        if (!admin && !ownCustomer)
+            throw new ImmutableError('TRACKER_SHIFT_NOT_ASSIGNED');
+        const shifts = await ShiftModel.db.find({
+            _id: { $in: uniqueShiftIds.map((shift) => new ObjectId(shift)) },
+            company: options.company,
+            project: options.project,
+        }, { projection: { assignments: 1 } }).toArray();
+        const assignmentsByShift = new Map(shifts.map((shift) => [shift._id.toHexString(), shift.assignments || []]));
+        for (const entry of shiftEntries) {
+            const assignments = assignmentsByShift.get(entry.shift) || [];
+            const customer = admin && entry.customer ? entry.customer : ownCustomer?._id?.toHexString();
+            if (!customer || !assignments.some((assignment) => String(assignment.customer) === customer)) {
+                throw new ImmutableError('TRACKER_SHIFT_NOT_ASSIGNED');
+            }
+        }
+    }
+    /**
+     * Rejects entries whose grouping does not match their plan. A shift-based plan books on shifts
+     * and must not carry a category; every other plan, and an entry without a plan, groups by
+     * category. Entries are checked against one plan lookup per distinct plan.
+     *
+     * A change is lenient: entries created before shift bookings existed carry a category next to
+     * their shift, so it only requires the result to still be grouped at all.
+     */
+    async assertPlanGrouping(entries, options, assertion = 'create') {
+        const shiftBasedPlans = new Map();
+        for (const entry of entries) {
+            // a change only has to leave the entry grouped, so a stored grouping skips the plan lookup
+            if (assertion === 'change' && (entry.shift || entry.category))
+                continue;
+            const timeTrackingProject = entry.timeTrackingProject;
+            let shiftBased = false;
+            if (timeTrackingProject) {
+                const known = shiftBasedPlans.get(timeTrackingProject);
+                if (known === undefined) {
+                    const plan = await TimeTrackingProjectsService.singleTimeTrackingProject(timeTrackingProject, options);
+                    shiftBased = plan?.modes === 'shifts' && !!plan.shiftPlan;
+                    shiftBasedPlans.set(timeTrackingProject, shiftBased);
+                }
+                else {
+                    shiftBased = known;
+                }
+            }
+            if (assertion === 'change') {
+                throw new ImmutableError(shiftBased ? 'TRACKER_SHIFT_REQUIRED' : 'TRACKER_CATEGORY_REQUIRED');
+            }
+            if (shiftBased) {
+                if (!entry.shift)
+                    throw new ImmutableError('TRACKER_SHIFT_REQUIRED');
+                if (entry.category)
+                    throw new ImmutableError('TRACKER_CATEGORY_NOT_ALLOWED');
+            }
+            else if (!entry.category) {
+                throw new ImmutableError('TRACKER_CATEGORY_REQUIRED');
+            }
+        }
+    }
+    /** the owner of an entry, the id when the user is not resolved to a profile */
+    ownerOf(tracker) {
+        return typeof tracker.user === 'string' ? tracker.user : tracker.user?.id;
+    }
+    /** `tracker:admin` reads and changes the entries of everybody, not just the caller's own */
+    async isTrackerAdmin(options) {
+        const permission = await MeService.getSinglePermission(options.user, options.company, options.project);
+        return Boolean(permission?.scope?.includes('tracker:admin'));
+    }
+    /**
+     * Changing or removing a booking needs the route's scope and, on top of it, the booking has to be the caller's
+     * own or the caller has `tracker:admin`. The scope guard runs first, so owning a booking never replaces it.
+     * A booking that does not exist is not decided here, the service answers it as missing.
+     */
+    async mayChangeBooking(stored, options) {
+        if (!stored)
+            return true;
+        if (this.ownerOf(stored) === options.user)
+            return true;
+        return this.isTrackerAdmin(options);
+    }
+    /** preHandler for the routes that change or remove one booking, see mayChangeBooking() */
+    ownBookingOrAdmin() {
+        return async (request, reply) => {
+            if (!request.auth)
+                return respondCode('UNAUTHORIZED', reply);
+            try {
+                const options = { user: request.auth.sub, company: request.params.company, project: request.params.project };
+                const stored = await this.scopedBooking(new ObjectId(request.params.id), options);
+                if (!await this.mayChangeBooking(stored, options))
+                    return respondCode('FORBIDDEN', reply);
+            }
+            catch (error) {
+                return handleError(error, reply);
+            }
+            return undefined;
+        };
+    }
+    /**
+     * An admin may book for another person: on a shift for the person assigned to it, or anywhere by
+     * naming their customer. Only asked when an entry carries a shift or a customer, so the ordinary
+     * tracking modes cost no permission lookup.
+     */
+    async bookingAdmin(entries, options) {
+        if (!entries.some((entry) => entry.shift || entry.customer))
+            return false;
+        return this.isTrackerAdmin(options);
+    }
+    withoutCustomer(entry) {
+        const booking = { ...entry };
+        delete booking.customer;
+        return booking;
+    }
+    /**
+     * ISO-normalized booking window; the same overlap convention the shift planning filters use.
+     * Both ends are required, the tracker only works with windows it can bound.
+     */
+    bookingInterval(from, to) {
+        const instant = (value, path) => {
+            if (!value) {
+                throw new ImmutableError('VALIDATION_FAILED', [{
+                        instancePath: path, schemaPath: '#/bookingInterval', keyword: 'bookingInterval', params: {}, message: 'is required',
+                    }]);
+            }
+            const parsed = Date.parse(value);
+            if (!Number.isFinite(parsed)) {
+                throw new ImmutableError('VALIDATION_FAILED', [{
+                        instancePath: path, schemaPath: '#/bookingInterval', keyword: 'bookingInterval', params: {}, message: 'must be a valid instant',
+                    }]);
+            }
+            return new Date(parsed).toISOString();
+        };
+        const interval = { from: instant(from, '/query/from'), to: instant(to, '/query/to') };
+        if (interval.to <= interval.from) {
+            throw new ImmutableError('VALIDATION_FAILED', [{
+                    instancePath: '/query/to', schemaPath: '#/bookingInterval', keyword: 'bookingInterval', params: {}, message: 'must be after from',
+                }]);
+        }
+        return interval;
+    }
+    /**
+     * The shifts the caller may book tracked time on: the shifts of the plan that carry the caller's
+     * own customer in `assignments.customer` and overlap the booking window. The narrow projection
+     * lets the tracker app offer them without `shifts:read`.
+     */
+    async bookableShifts(timeTrackingProject, from, to, options) {
+        const interval = this.bookingInterval(from, to);
+        const plan = await TimeTrackingProjectsService.singleTimeTrackingProject(timeTrackingProject, options);
+        if (plan?.modes !== 'shifts' || !plan.shiftPlan)
+            return [];
+        const customer = await this.callerCustomer(options);
+        // a caller without a connected customer is assigned to no shift at all
+        if (!customer)
+            return [];
+        const query = {
+            company: options.company,
+            project: options.project,
+            plan: new ObjectId(plan.shiftPlan),
+            assignments: { $elemMatch: { customer: customer._id } },
+            end: { $gt: interval.from },
+            start: { $lt: interval.to },
+        };
+        const shifts = await ShiftModel.db.find(query, { projection: { title: 1, start: 1, end: 1 } })
+            .sort({ start: 1 })
+            .toArray();
+        return shifts.map((shift) => ({
+            _id: shift._id.toHexString(),
+            title: shift.title,
+            start: shift.start,
+            end: shift.end,
+        }));
+    }
+    /**
+     * Every time entry booked on a shift of a time tracking project, so each booking can be edited
+     * or removed on its own. An entry names its person in `customer` only when an admin booked it;
+     * a member's own entry carries just the account, so that account is resolved to its connected
+     * customer.
+     */
+    async shiftBookings(timeTrackingProject, options) {
+        const entries = await this.model.db.find({
+            company: options.company,
+            project: options.project,
+            timeTrackingProject,
+            shift: { $type: 'string', $ne: '' },
+        }, { projection: { shift: 1, customer: 1, user: 1, startTime: 1, endTime: 1, currentTime: 1 } })
+            .sort({ startTime: 1 })
+            .toArray();
+        const accounts = [...new Set(entries
+                .filter((entry) => !entry.customer && typeof entry.user === 'string')
+                .map((entry) => entry.user))];
+        const customersByAccount = new Map();
+        if (accounts.length) {
+            const customers = await CustomersModel.db.find({
+                company: options.company,
+                type: 'person',
+                accounts: { $elemMatch: { account: { $in: accounts }, project: options.project } },
+            }, { projection: { _id: 1, accounts: 1 } }).toArray();
+            customers.forEach((customer) => {
+                if (!('accounts' in customer))
+                    return;
+                customer.accounts?.forEach((single) => {
+                    if (single.project === options.project)
+                        customersByAccount.set(single.account, customer._id.toHexString());
+                });
+            });
+        }
+        return entries.map((entry) => {
+            const customer = entry.customer || (typeof entry.user === 'string' ? customersByAccount.get(entry.user) : undefined);
+            return {
+                id: entry._id.toHexString(),
+                shift: entry.shift,
+                ...(customer ? { customer } : {}),
+                startTime: entry.startTime ? new Date(entry.startTime).toISOString() : undefined,
+                endTime: entry.endTime ? new Date(entry.endTime).toISOString() : undefined,
+                currentTime: entry.currentTime || 0,
+            };
+        });
+    }
+    single(internalId, options) {
+        return this.model.db.aggregate([
+            {
+                $match: { _id: internalId, company: options.company, project: options.project },
+            },
+            ...lookupUserAggregation,
+        ])
+            .toArray()
+            .then((tracker) => {
+            if (!tracker.length)
+                return null;
+            return tracker[0];
+        });
+    }
+    /**
+     * The entries of one plan inside a range, newest last, each with the name of the person who booked it.
+     * `user` is the person to list, or TRACKER_ALL_USERS; the caller decides who may ask for more than their own.
+     */
+    async bookings(timeTrackingProject, range, user, options) {
+        const interval = this.bookingInterval(range.from, range.to);
+        const from = new Date(interval.from);
+        const to = new Date(interval.to);
+        if ((to.getTime() - from.getTime()) / (24 * MILLISECONDS_PER_HOUR) > MAXIMUM_BOOKING_RANGE_DAYS) {
+            throw new ImmutableError('VALIDATION_FAILED', [{
+                    instancePath: '/query/to', schemaPath: '#/bookingRange', keyword: 'bookingRange', params: { limit: MAXIMUM_BOOKING_RANGE_DAYS }, message: `must be at most ${MAXIMUM_BOOKING_RANGE_DAYS} days after from`,
+                }]);
+        }
+        const query = {
+            company: options.company,
+            project: options.project,
+            timeTrackingProject,
+            startTime: { $gte: from, $lt: to },
+        };
+        if (user !== TRACKER_ALL_USERS)
+            query.user = user;
+        const entries = await this.model.db.find(query, { projection: { history: 0 } })
+            .sort({ startTime: 1 })
+            .limit(MAXIMUM_BOOKINGS)
+            .toArray();
+        const accounts = [...new Set(entries.filter((entry) => typeof entry.user === 'string').map((entry) => entry.user))];
+        const people = accounts.length
+            ? await MeModel.db.find({ id: { $in: accounts } }, { projection: { id: 1, prename: 1, lastname: 1 } }).toArray()
+            : [];
+        const peopleById = new Map(people.map((person) => [person.id, person]));
+        return entries.map((entry) => {
+            const account = typeof entry.user === 'string' ? entry.user : entry.user?.id;
+            const person = peopleById.get(account);
+            return {
+                id: entry._id.toHexString(),
+                ...(entry.category ? { category: entry.category } : {}),
+                ...(entry.shift ? { shift: entry.shift } : {}),
+                ...(entry.description ? { description: entry.description } : {}),
+                user: { id: account, ...(person?.prename ? { prename: person.prename } : {}), ...(person?.lastname ? { lastname: person.lastname } : {}) },
+                startTime: entry.startTime ? new Date(entry.startTime).toISOString() : undefined,
+                endTime: entry.endTime ? new Date(entry.endTime).toISOString() : undefined,
+                currentTime: entry.currentTime || 0,
+            };
+        });
+    }
+    /**
+     * Hours a person was allocated per category against everything they booked on the plan so far.
+     * One aggregation sums all categories, so the cost does not grow with the number of allocations.
+     */
+    async allocationUsage(timeTrackingProject, user, options) {
+        const scope = {
+            company: options.company, project: options.project, timeTrackingProject, user,
+        };
+        const allocations = await TimeTrackingProjectAllocationModel.db
+            .find(scope)
+            .toArray();
+        if (!allocations.length)
+            return [];
+        const sums = await this.model.db.aggregate([
+            { $match: { ...scope, category: { $in: allocations.map((allocation) => allocation.category) } } },
+            { $group: { _id: '$category', bookedTime: { $sum: '$currentTime' } } },
+        ]).toArray();
+        const bookedByCategory = new Map(sums.map((sum) => [sum._id, sum.bookedTime]));
+        return allocations
+            .map((allocation) => ({
+            category: allocation.category,
+            hours: allocation.hours,
+            bookedTime: bookedByCategory.get(allocation.category) || 0,
+        }))
+            .sort((first, second) => (first.category < second.category ? -1 : Number(first.category > second.category)));
+    }
+    async statistics(user, company, project, timeTrackingProject, dateRange) {
+        const useMonth = dateRange?.month ? dateRange.month - 1 : dayjs().get('month');
+        const useYear = dateRange?.year ? dateRange.year : dayjs().get('year');
+        const start = dayjs().set('month', useMonth).set('year', useYear).startOf('month').toDate();
+        const end = dayjs().set('month', useMonth).set('year', useYear).endOf('month').toDate();
+        const query = { company, project };
+        // the whole plan ignores the month, so its statistics do not change with the shown period
+        if (!dateRange?.wholePlan)
+            query.startTime = { $gte: start, $lte: end };
+        if (user !== TRACKER_ALL_USERS)
+            query.user = user;
+        if (timeTrackingProject)
+            query.timeTrackingProject = timeTrackingProject;
+        const buckets = await this.model.db.aggregate([
+            { $match: query },
+            {
+                $group: {
+                    _id: {
+                        // the server's zone, the same day boundary the month filter above uses
+                        day: { $dateToString: { format: '%Y-%m-%d', date: '$startTime', timezone: Intl.DateTimeFormat().resolvedOptions().timeZone } },
+                        // a shift booking groups by its shift, every other entry by its category
+                        group: { $ifNull: ['$shift', '$category'] },
+                    },
+                    count: { $sum: 1 },
+                    time: { $sum: '$currentTime' },
+                    first: { $min: '$startTime' },
+                    last: { $max: '$startTime' },
+                },
+            },
+        ]).toArray();
+        const statistics = this.statisticsOf(buckets);
+        if (dateRange?.wholePlan) {
+            // an entry without a start has no place on the timeline, so it cannot widen the range
+            const firsts = buckets.flatMap((bucket) => (bucket.first ? [new Date(bucket.first).getTime()] : []));
+            const lasts = buckets.flatMap((bucket) => (bucket.last ? [new Date(bucket.last).getTime()] : []));
+            return {
+                ...statistics,
+                start: firsts.length ? new Date(Math.min(...firsts)) : start,
+                end: lasts.length ? new Date(Math.max(...lasts)) : end,
+            };
+        }
+        return {
+            ...statistics,
+            start,
+            end,
+        };
+    }
+    async day(day, options) {
+        const query = { ...options };
+        delete query.app;
+        if (query.user === TRACKER_ALL_USERS)
+            delete query.user;
+        const dayStart = dayjs(day).startOf('day').toDate();
+        const dayEnd = dayjs(day).endOf('day').toDate();
+        query.startTime = { $gte: dayStart, $lte: dayEnd };
+        const data = await this.model.db.find(query, { projection: { history: 0 } })
+            .limit(100)
+            .sort({ startTime: 1 })
+            .toArray();
+        return { data, count: data.length, statistics: this.createStatistics(data, 'day', day), date: dayStart };
+    }
+    /** the categories used in this company and project; the search matches literally, it is no pattern */
+    async categories(search, options) {
+        const match = {
+            company: options.company,
+            project: options.project,
+            // shift bookings carry no category, so the set only collects real ones
+            category: search ? { $regex: new RegExp(escapeRegExp(search)) } : { $type: 'string' },
+        };
+        const categories = (await this.model.db.distinct('category', match)).map(String);
+        // matchSortArray would read the search as a pattern again, so the earliest literal hit sorts first here
+        return categories.sort((first, second) => first.indexOf(search) - second.indexOf(search));
+    }
+    /**
+     * Turns the day and group buckets of the statistics aggregation into the summary. Entries without a
+     * group count towards `count` only, the same as entries the tracker cannot place in any bucket.
+     */
+    statisticsOf(buckets) {
+        const categories = {};
+        const byMonth = {};
+        const byDay = {};
+        const all = { count: 0, time: 0 };
+        let count = 0;
+        const add = (target, key, bucket) => {
+            const data = target[key] || { count: 0, time: 0 };
+            data.count += bucket.count;
+            data.time += bucket.time || 0;
+            target[key] = data;
+        };
+        buckets.forEach((bucket) => {
+            const { day, group } = bucket._id;
+            const month = day?.slice(0, 7);
+            count += bucket.count;
+            if (day && month) {
+                byDay[day] = byDay[day] || {};
+                byMonth[month] = byMonth[month] || {};
+            }
+            if (!group)
+                return;
+            add(categories, group, bucket);
+            all.count += bucket.count;
+            all.time += bucket.time || 0;
+            if (day && month) {
+                add(byDay[day], group, bucket);
+                add(byDay[day], 'all', bucket);
+                add(byMonth[month], group, bucket);
+                add(byMonth[month], 'all', bucket);
+            }
+        });
+        return {
+            count,
+            all,
+            categories: { all: categories, byMonth, byDay },
+        };
+    }
+    // the caller adds the range bounds, so the summary is only partial here
+    createStatistics(data, range, rangeIdentifier) {
+        const categoryObject = {};
+        const monthObject = {};
+        const daysObject = {};
+        const allObject = { count: 0, time: 0 };
+        data.forEach((single) => {
+            const singleStartMonth = dayjs(single.startTime).format('YYYY-MM');
+            const singleStartDay = dayjs(single.startTime).format('YYYY-MM-DD');
+            // a shift booking groups by its shift, every other entry by its category
+            const group = single.shift || single.category;
+            if (!monthObject[singleStartMonth])
+                monthObject[singleStartMonth] = {};
+            if (!daysObject[singleStartDay])
+                daysObject[singleStartDay] = {};
+            // creates a alias for the object annotation for better readability
+            let singleMonth = monthObject[singleStartMonth];
+            // creates a alias for the object annotation for better readability
+            let singleDay = daysObject[singleStartDay];
+            if (group) {
+                if (!singleDay.all)
+                    singleDay.all = { count: 0, time: 0 };
+                if (!singleMonth.all)
+                    singleMonth.all = { count: 0, time: 0 };
+                if (!singleMonth[group])
+                    singleMonth[group] = { count: 0, time: 0 };
+                // creates a alias for the object annotation for better readability
+                const monthCategory = singleMonth[group];
+                if (!singleDay[group])
+                    singleDay[group] = { count: 0, time: 0 };
+                // creates a alias for the object annotation for better readability
+                const dayCategory = singleDay[group];
+                if (!categoryObject[group])
+                    categoryObject[group] = { count: 0, time: 0 };
+                // creates a alias for the object annotation for better readability
+                const mainCategory = categoryObject[group];
+                mainCategory.count++;
+                monthCategory.count++;
+                dayCategory.count++;
+                singleDay.all.count++;
+                singleMonth.all.count++;
+                allObject.count++;
+                if (single.currentTime) {
+                    mainCategory.time += single.currentTime;
+                    monthCategory.time += single.currentTime;
+                    dayCategory.time += single.currentTime;
+                    singleDay.all.time += single.currentTime;
+                    singleMonth.all.time += single.currentTime;
+                    allObject.time += single.currentTime;
+                }
+            }
+        });
+        if (range === 'day' && rangeIdentifier) {
+            return daysObject[rangeIdentifier];
+        }
+        if (range === 'month' && rangeIdentifier) {
+            return monthObject[rangeIdentifier];
+        }
+        return {
+            count: data.length,
+            all: allObject,
+            categories: {
+                all: categoryObject,
+                byMonth: monthObject,
+                byDay: daysObject,
+            },
+        };
+    }
+    /** preHandler that removes the `user` query for anybody without the given scopes, so they only see their own entries */
+    filterAdmin(scope) {
+        return async (request, reply) => {
+            if (!request.auth)
+                return respondCode('UNAUTHORIZED', reply);
+            try {
+                const permission = await MeService.getSinglePermission(request.auth.sub, request.params.company, request.params.project);
+                if (!permission)
+                    throw new Error('NO_PERMISSIONS_FOUND');
+                const foundScope = permission.scope?.filter((single) => scope.includes(single)) || [];
+                if (foundScope.length !== scope.length) {
+                    delete request.query.user;
+                }
+            }
+            catch (error) {
+                console.error(error, scope, request.auth.sub, request.params.company, request.params.project);
+                return respondCode('FORBIDDEN', reply);
+            }
+            return undefined;
+        };
+    }
+}
+export default new TrackerService();
+//# sourceMappingURL=tracker.service.js.map