@nuxt-customer-portal/timesheets 0.3.0

package/migrations/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1786258239902,
+      "tag": "0000_baseline",
+      "breakpoints": true
+    }
+  ]
+}

package/nuxt.config.ts

@@ -0,0 +1,20 @@
+import { fileURLToPath } from 'node:url'
+
+export default defineNuxtConfig({
+  $meta: { name: 'nuxt-customer-portal-timesheets' },
+  compatibilityDate: '2025-10-24',
+  modules: ['@nuxtjs/i18n'],
+  css: [fileURLToPath(new URL('./app/assets/timesheets.css', import.meta.url))],
+  components: [
+    {
+      path: fileURLToPath(new URL('./app/components', import.meta.url)),
+      global: true
+    }
+  ],
+  i18n: {
+    locales: [
+      { code: 'en', iso: 'en-US', name: 'English', file: 'en.json' },
+      { code: 'nl', iso: 'nl-NL', name: 'Nederlands', file: 'nl.json' }
+    ]
+  }
+})

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@nuxt-customer-portal/timesheets",
+  "version": "0.3.0",
+  "license": "MIT",
+  "homepage": "https://nuxt-customer-portal.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ludulicious/nuxt-customer-portal.git"
+  },
+  "type": "module",
+  "main": "./nuxt.config.ts",
+  "files": [
+    "LICENSE",
+    "CHANGELOG.md",
+    "app",
+    "i18n",
+    "migrations",
+    "server",
+    "shared",
+    "tokens.css",
+    "nuxt.config.ts",
+    "portal.manifest.mjs",
+    "README.md"
+  ],
+  "exports": {
+    ".": "./nuxt.config.ts",
+    "./feature": "./shared/feature.ts",
+    "./types": "./shared/types/timesheet.ts",
+    "./schema": "./server/db/schema/timesheets.ts",
+    "./portal-manifest": "./portal.manifest.mjs",
+    "./app/*": "./app/*.ts",
+    "./server/*": "./server/*.ts",
+    "./shared/*": "./shared/*.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@nuxtjs/i18n": "^10.6.0",
+    "@types/pg": "8.15.5",
+    "date-fns": "^4.4.0",
+    "drizzle-orm": "^0.45.2",
+    "nanoid": "^5.1.6",
+    "pdf-lib": "^1.17.1",
+    "pg": "^8.22.0",
+    "resend": "^6.18.1",
+    "zod": "^4.4.3",
+    "@nuxt-customer-portal/core": "^0.3.0",
+    "@nuxt-customer-portal/ui": "^0.3.0",
+    "@nuxt-customer-portal/clients": "^0.3.0",
+    "@nuxt-customer-portal/organizations": "^0.3.0"
+  },
+  "peerDependencies": {
+    "nuxt": "^4.5.1",
+    "vue": "^3.5.0"
+  },
+  "devDependencies": {
+    "nuxt": "^4.5.1",
+    "vue": "^3.5.0"
+  }
+}

package/portal.manifest.mjs

@@ -0,0 +1,10 @@
+export default {
+  id: 'timesheets',
+  version: '0.3.0',
+  source: '@nuxt-customer-portal/timesheets',
+  clientModuleId: 'timesheets',
+  dependsOn: ['core', 'ui', 'organizations', 'clients'],
+  schema: './server/db/schema/timesheets.ts',
+  migrations: './migrations',
+  migrationSearchPath: ['timesheets', 'public']
+}

package/server/api/timesheets/admin/activities/[id]/deletion.get.ts

@@ -0,0 +1,18 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { getActivityDeletionEligibility } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminActivitiesByIdDeletionGet',
+    summary: 'Check activity deletion eligibility',
+    description:
+      'Check activity deletion eligibility. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return getActivityDeletionEligibility(organizationId, getRouterParam(event, 'id')!)
+})

package/server/api/timesheets/admin/activities/[id].delete.ts

@@ -0,0 +1,20 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { deleteActivity } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { activityDeleteSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminActivitiesByIdDelete',
+    summary: 'Delete a timesheet activity',
+    description:
+      'Delete a timesheet activity. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const input = activityDeleteSchema.parse(await readBody(event))
+  return deleteActivity(organizationId, getRouterParam(event, 'id')!, input.activityName)
+})

package/server/api/timesheets/admin/activities/[id].patch.ts

@@ -0,0 +1,19 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { updateActivity } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { activityUpdateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminActivitiesByIdPatch',
+    summary: 'Update a timesheet activity',
+    description:
+      'Update a timesheet activity. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return updateActivity(organizationId, getRouterParam(event, 'id')!, activityUpdateSchema.parse(await readBody(event)))
+})

package/server/api/timesheets/admin/activities/index.get.ts

@@ -0,0 +1,19 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { activityListQuerySchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+import { listActivitiesPage } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-admin-listing'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminActivitiesGet',
+    summary: 'List timesheet activities',
+    description:
+      'List timesheet activities. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return listActivitiesPage(organizationId, activityListQuerySchema.parse(getQuery(event)))
+})

package/server/api/timesheets/admin/activities/index.post.ts

@@ -0,0 +1,19 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { createActivity } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { activityCreateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminActivitiesPost',
+    summary: 'Create a timesheet activity',
+    description:
+      'Create a timesheet activity. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return createActivity(organizationId, activityCreateSchema.parse(await readBody(event)))
+})

package/server/api/timesheets/admin/approvals/[id].post.ts

@@ -0,0 +1,19 @@
+import { requireActiveOrganizationRole } from '@nuxt-customer-portal/core/server/portal'
+import { reviewSubmission } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { reviewSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminApprovalsByIdPost',
+    summary: 'Review a submitted timesheet',
+    description:
+      'Review a submitted timesheet. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { session, organizationId } = await requireActiveOrganizationRole(event)
+  const input = reviewSchema.parse(await readBody(event))
+  return reviewSubmission(organizationId, session.user.id, getRouterParam(event, 'id')!, input.action, input.comment)
+})

package/server/api/timesheets/admin/bootstrap.get.ts

@@ -0,0 +1,73 @@
+import { db, requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { organization } from '@nuxt-customer-portal/core/schema'
+import { eq } from 'drizzle-orm'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import {
+  ensureSettings,
+  listActivities,
+  listAvailableClientOrganizations,
+  listClients,
+  getTimesheetsSetupStatus,
+  listProjects,
+  listTeam
+} from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminBootstrapGet',
+    summary: 'Get timesheets administration data',
+    description:
+      'Get timesheets administration data. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId, session } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const section = String(getQuery(event).section ?? '')
+  const settings = await ensureSettings(organizationId)
+  const [
+    providerOrganizations,
+    clients,
+    availableClientOrganizations,
+    projects,
+    activities,
+    team,
+    approvals,
+    setupStatus
+  ] = await Promise.all([
+    db
+      .select({ organizationId: organization.id, name: organization.name })
+      .from(organization)
+      .where(eq(organization.id, organizationId))
+      .limit(1),
+    section === 'clients' ? Promise.resolve([]) : listClients(organizationId),
+    listAvailableClientOrganizations(organizationId, session.user.id, session.user.role === 'admin'),
+    section === 'projects' ? Promise.resolve([]) : listProjects(organizationId),
+    section === 'activities' ? Promise.resolve([]) : listActivities(organizationId),
+    listTeam(organizationId),
+    Promise.resolve([]),
+    getTimesheetsSetupStatus(organizationId)
+  ])
+  const providerOrganization = providerOrganizations[0]
+  if (!providerOrganization) {
+    throw createError({ statusCode: 404, message: 'Provider organization not found' })
+  }
+  return {
+    providerOrganization,
+    settings: {
+      currency: settings.currency,
+      timezone: settings.timezone,
+      timerRoundingMinutes: settings.timerRoundingMinutes,
+      weekStartsOn: settings.weekStartsOn,
+      internalApprovalsEnabled: settings.internalApprovalsEnabled
+    },
+    clients,
+    availableClientOrganizations,
+    projects,
+    activities,
+    team,
+    approvals,
+    setupStatus
+  }
+})

package/server/api/timesheets/admin/client-settings/[clientId]/index.get.ts

@@ -0,0 +1,25 @@
+import { and, eq } from 'drizzle-orm'
+import { requireFeatureAccess, db } from '@nuxt-customer-portal/core/server/portal'
+import { requireClientModuleEnabled } from '@nuxt-customer-portal/clients/server/utils/client-repository'
+import { workspaceClient } from '@nuxt-customer-portal/timesheets/server/db/schema/timesheets'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+
+export default defineEventHandler(async (event) => {
+  const { organizationId, organizationType } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  if (organizationType !== 'PROVIDER') {
+    throw createError({ statusCode: 403, message: 'PROVIDER organization required' })
+  }
+  const clientOrganizationId = getRouterParam(event, 'clientId')!
+  await requireClientModuleEnabled(clientOrganizationId, 'timesheets')
+  const [settings] = await db
+    .select()
+    .from(workspaceClient)
+    .where(
+      and(
+        eq(workspaceClient.workspaceOrganizationId, organizationId),
+        eq(workspaceClient.clientOrganizationId, clientOrganizationId)
+      )
+    )
+    .limit(1)
+  return settings ?? { clientOrganizationId, accessMode: 'DISABLED' }
+})

package/server/api/timesheets/admin/client-settings/[clientId]/index.put.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod'
+import { and, eq } from 'drizzle-orm'
+import { requireFeatureAccess, db } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { workspaceClient } from '@nuxt-customer-portal/timesheets/server/db/schema/timesheets'
+import { ensureTimesheetClientSettings } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+const schema = z.object({ accessMode: z.enum(['DISABLED', 'VIEW', 'REVIEW']) })
+
+export default defineEventHandler(async (event) => {
+  const { organizationId, organizationType } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  if (organizationType !== 'PROVIDER') {
+    throw createError({ statusCode: 403, message: 'PROVIDER organization required' })
+  }
+  const clientOrganizationId = getRouterParam(event, 'clientId')!
+  await ensureTimesheetClientSettings(organizationId, clientOrganizationId)
+  const [updated] = await db
+    .update(workspaceClient)
+    .set({ ...schema.parse(await readBody(event)), updatedAt: new Date() })
+    .where(
+      and(
+        eq(workspaceClient.workspaceOrganizationId, organizationId),
+        eq(workspaceClient.clientOrganizationId, clientOrganizationId)
+      )
+    )
+    .returning()
+  return updated
+})

package/server/api/timesheets/admin/clients/[id]/deletion.get.ts

@@ -0,0 +1,18 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { getClientDeletionEligibility } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminClientsByIdDeletionGet',
+    summary: 'Check client deletion eligibility',
+    description:
+      'Check client deletion eligibility. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return getClientDeletionEligibility(organizationId, getRouterParam(event, 'id')!)
+})

package/server/api/timesheets/admin/clients/[id].delete.ts

@@ -0,0 +1,20 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { deleteClient } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { clientDeleteSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminClientsByIdDelete',
+    summary: 'Remove a timesheet client',
+    description:
+      'Remove a timesheet client. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const input = clientDeleteSchema.parse(await readBody(event))
+  return deleteClient(organizationId, getRouterParam(event, 'id')!, input.clientName)
+})

package/server/api/timesheets/admin/clients/[id].patch.ts

@@ -0,0 +1,14 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { updateClientAccess } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { clientAccessUpdateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const body = await readBody(event)
+  return updateClientAccess(
+    organizationId,
+    getRouterParam(event, 'id')!,
+    clientAccessUpdateSchema.parse(body).accessMode
+  )
+})

package/server/api/timesheets/admin/clients/index.get.ts

@@ -0,0 +1,18 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { clientListQuerySchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+import { listClientsPage } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-admin-listing'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminClientsGet',
+    summary: 'List timesheet clients',
+    description: 'List timesheet clients. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return listClientsPage(organizationId, clientListQuerySchema.parse(getQuery(event)))
+})

package/server/api/timesheets/admin/clients/index.post.ts

@@ -0,0 +1,25 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { linkClient } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { clientCreateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminClientsPost',
+    summary: 'Link a timesheet client',
+    description: 'Link a timesheet client. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId, session } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const input = clientCreateSchema.parse(await readBody(event))
+  if (input.mode === 'create') {
+    throw createError({
+      statusCode: 410,
+      message: 'Create clients in the Clients module before linking them to Timesheets'
+    })
+  }
+  return linkClient(organizationId, session.user.id, session.user.role === 'admin', input.organizationId)
+})

package/server/api/timesheets/admin/internal-approvals/[userId].put.ts

@@ -0,0 +1,11 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { updateInternalApprovalMember } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { internalApprovalMemberUpdateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+export default defineEventHandler(async (event) => {
+  const { organizationId, session } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const input = internalApprovalMemberUpdateSchema.parse(await readBody(event))
+  await updateInternalApprovalMember(organizationId, session.user.id, getRouterParam(event, 'userId')!, input)
+  return { updated: true }
+})

package/server/api/timesheets/admin/internal-approvals/index.get.ts

@@ -0,0 +1,8 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { getInternalApprovalConfiguration } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return getInternalApprovalConfiguration(organizationId)
+})

package/server/api/timesheets/admin/internal-approvals/index.patch.ts

@@ -0,0 +1,11 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { updateInternalApprovalWorkspace } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { internalApprovalWorkspaceUpdateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const input = internalApprovalWorkspaceUpdateSchema.parse(await readBody(event))
+  await updateInternalApprovalWorkspace(organizationId, input.enabled)
+  return { updated: true }
+})

package/server/api/timesheets/admin/organization-capabilities/[organizationId].get.ts

@@ -0,0 +1,19 @@
+import { getPortalOrganization, requireSession } from '@nuxt-customer-portal/core/server/portal'
+import { getOrganizationTimesheetCapabilities } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  if (session.user.role !== 'admin') {
+    throw createError({ statusCode: 403, message: 'System administrator access required' })
+  }
+  const organizationId = getRouterParam(event, 'organizationId')!
+  const organization = await getPortalOrganization(organizationId)
+  if (!organization) {
+    throw createError({ statusCode: 404, message: 'Organization not found' })
+  }
+  const capabilities = await getOrganizationTimesheetCapabilities(organizationId)
+  return {
+    ...capabilities,
+    workspaceEnabled: organization.organizationType === 'PROVIDER' && capabilities.workspaceEnabled
+  }
+})

package/server/api/timesheets/admin/organization-capabilities/[organizationId].patch.ts

@@ -0,0 +1,23 @@
+import { getPortalOrganization, requireSession } from '@nuxt-customer-portal/core/server/portal'
+import { updateOrganizationTimesheetCapabilities } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { organizationCapabilitiesUpdateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  if (session.user.role !== 'admin') {
+    throw createError({ statusCode: 403, message: 'System administrator access required' })
+  }
+  const organizationId = getRouterParam(event, 'organizationId')!
+  const input = organizationCapabilitiesUpdateSchema.parse(await readBody(event))
+  const organization = await getPortalOrganization(organizationId)
+  if (!organization) {
+    throw createError({ statusCode: 404, message: 'Organization not found' })
+  }
+  if (organization.organizationType !== 'PROVIDER' && input.workspaceEnabled) {
+    throw createError({
+      statusCode: 400,
+      message: 'Timesheets workspaces can only be enabled for provider organizations'
+    })
+  }
+  return updateOrganizationTimesheetCapabilities(organizationId, input)
+})

package/server/api/timesheets/admin/projects/[id]/deletion.get.ts

@@ -0,0 +1,18 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { getProjectDeletionEligibility } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminProjectsByIdDeletionGet',
+    summary: 'Check project deletion eligibility',
+    description:
+      'Check project deletion eligibility. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return getProjectDeletionEligibility(organizationId, getRouterParam(event, 'id')!)
+})

package/server/api/timesheets/admin/projects/[id].delete.ts

@@ -0,0 +1,20 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { deleteProject } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { projectDeleteSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminProjectsByIdDelete',
+    summary: 'Delete a timesheet project',
+    description:
+      'Delete a timesheet project. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const input = projectDeleteSchema.parse(await readBody(event))
+  return deleteProject(organizationId, getRouterParam(event, 'id')!, input.projectName)
+})

package/server/api/timesheets/admin/projects/[id].get.ts

@@ -0,0 +1,22 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { getProject } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminProjectsByIdGet',
+    summary: 'Get a timesheet project',
+    description:
+      'Get one timesheet project. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  const selected = await getProject(organizationId, getRouterParam(event, 'id')!)
+  if (!selected) {
+    throw createError({ statusCode: 404, message: 'Project not found' })
+  }
+  return selected
+})

package/server/api/timesheets/admin/projects/[id].patch.ts

@@ -0,0 +1,19 @@
+import { requireFeatureAccess } from '@nuxt-customer-portal/core/server/portal'
+import { timesheetsFeature } from '@nuxt-customer-portal/timesheets/shared/feature'
+import { updateProject } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-repository'
+import { projectUpdateSchema } from '@nuxt-customer-portal/timesheets/server/utils/timesheet-validation'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Timesheets'],
+    operationId: 'timesheetsAdminProjectsByIdPatch',
+    summary: 'Update a timesheet project',
+    description:
+      'Update a timesheet project. Scoped to the active organization and the applicable Timesheets permission.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const { organizationId } = await requireFeatureAccess(event, timesheetsFeature.policy, 'manage')
+  return updateProject(organizationId, getRouterParam(event, 'id')!, projectUpdateSchema.parse(await readBody(event)))
+})