@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4239.1.4a264a5828

package/src/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.ts

@@ -0,0 +1,187 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'
+import { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'
+import { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../../../guards'
+
+const routeMetadata = {
+  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+}
+
+export const metadata = routeMetadata
+
+function extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {
+  if (!request?.url) return null
+  try {
+    const url = new URL(request.url)
+    const match = url.pathname.match(/\/time-entries\/([^/]+)\/segments\/([^/]+)/)
+    if (!match?.[1] || !match?.[2]) return null
+    return { entryId: match[1], segmentId: match[2] }
+  } catch {
+    return null
+  }
+}
+
+export async function PATCH(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const ids = extractIdsFromUrl(req)
+  if (!ids) {
+    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })
+  }
+
+  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)
+  if (!rawBody) {
+    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
+  }
+
+  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...rawBody, id: ids.segmentId })
+  if (!parsed.success) {
+    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })
+  }
+
+  const container = await createRequestContainer()
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  if (!tenantId || !organizationId) {
+    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })
+  }
+
+  const em = (container.resolve('em') as EntityManager).fork()
+  const scopeCtx = { tenantId, organizationId }
+
+  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)
+  if (!entry) {
+    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })
+  }
+
+  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)
+  if (!staffMember || entry.staffMemberId !== staffMember.id) {
+    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })
+  }
+
+  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {
+    id: ids.segmentId,
+    timeEntryId: ids.entryId,
+    tenantId,
+    organizationId,
+    deletedAt: null,
+  }, {}, scopeCtx)
+
+  if (!segment) {
+    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })
+  }
+
+  const guardResult = await runStaffMutationGuards(
+    container,
+    {
+      tenantId,
+      organizationId,
+      userId: auth.sub ?? '',
+      resourceKind: 'staff.timesheets.time_entry_segment',
+      resourceId: segment.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data as unknown as Record<string, unknown>,
+    },
+    resolveUserFeatures(auth),
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(
+      guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+      { status: guardResult.errorStatus ?? 422 },
+    )
+  }
+
+  if (parsed.data.startedAt !== undefined) {
+    segment.startedAt = parsed.data.startedAt
+  }
+  if (parsed.data.endedAt !== undefined) {
+    segment.endedAt = parsed.data.endedAt ?? null
+  }
+  if (parsed.data.segmentType !== undefined) {
+    segment.segmentType = parsed.data.segmentType
+  }
+
+  await em.flush()
+
+  if (guardResult.afterSuccessCallbacks.length) {
+    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId,
+      organizationId,
+      userId: auth.sub ?? '',
+      resourceKind: 'staff.timesheets.time_entry_segment',
+      resourceId: segment.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
+  }
+
+  return NextResponse.json({
+    ok: true,
+    item: {
+      id: segment.id,
+      timeEntryId: segment.timeEntryId,
+      startedAt: segment.startedAt,
+      endedAt: segment.endedAt,
+      segmentType: segment.segmentType,
+      createdAt: segment.createdAt,
+      updatedAt: segment.updatedAt,
+    },
+  })
+}
+
+const errorSchema = z.object({ error: z.string() })
+const segmentResponseSchema = z.object({
+  ok: z.literal(true),
+  item: z.object({
+    id: z.string(),
+    timeEntryId: z.string(),
+    startedAt: z.string(),
+    endedAt: z.string().nullable(),
+    segmentType: z.enum(['work', 'break']),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+  }),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Time entry segment management',
+  methods: {
+    PATCH: {
+      summary: 'Update a time entry segment',
+      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',
+      requestBody: {
+        contentType: 'application/json',
+        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),
+      },
+      responses: [
+        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 404, description: 'Segment not found', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/time-entries/[id]/segments/route.ts

@@ -0,0 +1,191 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'
+import { staffTimeEntrySegmentCreateSchema } from '../../../../../data/validators'
+import { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../../guards'
+
+function extractEntryIdFromUrl(request?: Request): string | null {
+  if (!request?.url) return null
+  try {
+    const url = new URL(request.url)
+    const match = url.pathname.match(/\/time-entries\/([^/]+)\/segments/)
+    return match?.[1] ?? null
+  } catch {
+    return null
+  }
+}
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(req)
+    const { translate } = await resolveTranslations()
+    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
+    }
+
+    const em = (container.resolve('em') as EntityManager).fork()
+    const scopeCtx = { tenantId, organizationId }
+
+    const entryId = extractEntryIdFromUrl(req)
+    if (!entryId) {
+      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })
+    }
+
+    const entry = await findOneWithDecryption(
+      em,
+      StaffTimeEntry,
+      { id: entryId, tenantId, organizationId, deletedAt: null },
+      {},
+      scopeCtx,
+    )
+    if (!entry) {
+      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })
+    }
+
+    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)
+    if (!staffMember || entry.staffMemberId !== staffMember.id) {
+      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })
+    }
+
+    const body = await readJsonSafe(req, {})
+    const input = parseScopedCommandInput(
+      staffTimeEntrySegmentCreateSchema,
+      { ...body, timeEntryId: entryId },
+      {
+        container,
+        auth,
+        organizationScope: scope,
+        selectedOrganizationId: organizationId,
+        organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+        request: req,
+      },
+      translate,
+    )
+
+    const guardResult = await runStaffMutationGuards(
+      container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry_segment',
+        resourceId: entry.id,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        mutationPayload: input as unknown as Record<string, unknown>,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
+    const segmentData = {
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      timeEntryId: input.timeEntryId,
+      startedAt: input.startedAt,
+      endedAt: input.endedAt ?? null,
+      segmentType: input.segmentType,
+    }
+    const segment = em.create(StaffTimeEntrySegment, segmentData as never)
+
+    await em.flush()
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry_segment',
+        resourceId: segment.id,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
+    return NextResponse.json(
+      {
+        id: segment.id,
+        timeEntryId: segment.timeEntryId,
+        startedAt: segment.startedAt,
+        endedAt: segment.endedAt ?? null,
+        segmentType: segment.segmentType,
+        createdAt: segment.createdAt,
+      },
+      { status: 201 },
+    )
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const { translate } = await resolveTranslations()
+    console.error('staff.timesheets.time-entries.segments.create failed', err)
+    return NextResponse.json(
+      { error: translate('staff.timesheets.errors.segmentCreate', 'Failed to create time entry segment.') },
+      { status: 400 },
+    )
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Add a segment to a time entry',
+  methods: {
+    POST: {
+      summary: 'Add a segment to a time entry',
+      description: 'Creates a new work or break segment for the specified time entry.',
+      requestBody: {
+        contentType: 'application/json',
+        schema: staffTimeEntrySegmentCreateSchema,
+      },
+      responses: [
+        {
+          status: 201,
+          description: 'Segment created',
+          schema: z.object({
+            id: z.string().uuid(),
+            timeEntryId: z.string().uuid(),
+            startedAt: z.string(),
+            endedAt: z.string().nullable(),
+            segmentType: z.enum(['work', 'break']),
+            createdAt: z.string(),
+          }),
+        },
+        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },
+        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },
+        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/time-entries/[id]/timer-start/route.ts

@@ -0,0 +1,168 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'
+import { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../../guards'
+import { emitStaffEvent } from '../../../../../events'
+
+function extractEntryIdFromUrl(request?: Request): string | null {
+  if (!request?.url) return null
+  try {
+    const url = new URL(request.url)
+    const match = url.pathname.match(/\/time-entries\/([^/]+)\/timer-start/)
+    return match?.[1] ?? null
+  } catch {
+    return null
+  }
+}
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(req)
+    const { translate } = await resolveTranslations()
+    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
+    }
+
+    const em = (container.resolve('em') as EntityManager).fork()
+    const scopeCtx = { tenantId, organizationId }
+
+    const entryId = extractEntryIdFromUrl(req)
+    if (!entryId) {
+      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })
+    }
+
+    const entry = await findOneWithDecryption(
+      em,
+      StaffTimeEntry,
+      { id: entryId, tenantId, organizationId, deletedAt: null },
+      {},
+      scopeCtx,
+    )
+    if (!entry) {
+      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })
+    }
+
+    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)
+    if (!staffMember || entry.staffMemberId !== staffMember.id) {
+      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })
+    }
+
+    if (entry.startedAt) {
+      return NextResponse.json(
+        { error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.') },
+        { status: 409 },
+      )
+    }
+
+    const guardResult = await runStaffMutationGuards(
+      container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry',
+        resourceId: entry.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
+    const now = new Date()
+    entry.startedAt = now
+    entry.source = 'timer'
+
+    const segmentData = {
+      tenantId,
+      organizationId,
+      timeEntryId: entry.id,
+      startedAt: now,
+      segmentType: 'work' as const,
+    }
+    em.create(StaffTimeEntrySegment, segmentData as never)
+
+    await em.flush()
+
+    void emitStaffEvent('staff.timesheets.time_entry.timer_started', {
+      id: entry.id,
+      staffMemberId: entry.staffMemberId,
+      tenantId: entry.tenantId,
+      organizationId: entry.organizationId,
+      startedAt: now.toISOString(),
+    }, { persistent: true }).catch((err) => {
+      console.error('[staff.timesheets] emit timer_started failed', err)
+    })
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry',
+        resourceId: entry.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
+    return NextResponse.json({ ok: true }, { status: 200 })
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const { translate } = await resolveTranslations()
+    console.error('staff.timesheets.time-entries.timer-start failed', err)
+    return NextResponse.json(
+      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },
+      { status: 400 },
+    )
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Start timer for a time entry',
+  methods: {
+    POST: {
+      summary: 'Start timer for a time entry',
+      description: 'Starts the timer on a time entry by setting startedAt and creating an initial work segment.',
+      responses: [
+        { status: 200, description: 'Timer started', schema: z.object({ ok: z.literal(true) }) },
+        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },
+        { status: 409, description: 'Timer already started', schema: z.object({ error: z.string() }) },
+        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}