@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4239.1.4a264a5828

package/src/modules/staff/api/timesheets/time-entries/[id]/timer-stop/route.ts

@@ -0,0 +1,191 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'
+import { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../../guards'
+import { emitStaffEvent } from '../../../../../events'
+
+function extractEntryIdFromUrl(request?: Request): string | null {
+  if (!request?.url) return null
+  try {
+    const url = new URL(request.url)
+    const match = url.pathname.match(/\/time-entries\/([^/]+)\/timer-stop/)
+    return match?.[1] ?? null
+  } catch {
+    return null
+  }
+}
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(req)
+    const { translate } = await resolveTranslations()
+    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
+    }
+
+    const em = (container.resolve('em') as EntityManager).fork()
+    const scopeCtx = { tenantId, organizationId }
+
+    const entryId = extractEntryIdFromUrl(req)
+    if (!entryId) {
+      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })
+    }
+
+    const entry = await findOneWithDecryption(
+      em,
+      StaffTimeEntry,
+      { id: entryId, tenantId, organizationId, deletedAt: null },
+      {},
+      scopeCtx,
+    )
+    if (!entry) {
+      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })
+    }
+
+    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)
+    if (!staffMember || entry.staffMemberId !== staffMember.id) {
+      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })
+    }
+
+    const segments = await findWithDecryption(
+      em,
+      StaffTimeEntrySegment,
+      { timeEntryId: entry.id, tenantId, organizationId, deletedAt: null },
+      {},
+      scopeCtx,
+    )
+
+    const activeSegment = segments.find((segment) => !segment.endedAt)
+    if (!activeSegment) {
+      return NextResponse.json(
+        { error: translate('staff.timesheets.errors.noActiveSegment', 'No active timer segment found for this entry.') },
+        { status: 409 },
+      )
+    }
+
+    const guardResult = await runStaffMutationGuards(
+      container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry',
+        resourceId: entry.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
+    const now = new Date()
+    activeSegment.endedAt = now
+    entry.endedAt = now
+
+    const allSegments = segments.map((segment) => {
+      if (segment.id === activeSegment.id) {
+        return { ...segment, endedAt: now }
+      }
+      return segment
+    })
+
+    const totalWorkMinutes = allSegments
+      .filter((segment) => segment.segmentType === 'work' && segment.startedAt && segment.endedAt)
+      .reduce((sum, segment) => {
+        const startMs = new Date(segment.startedAt).getTime()
+        const endMs = new Date(segment.endedAt!).getTime()
+        return sum + (endMs - startMs)
+      }, 0)
+
+    const durationMinutes = Math.round(totalWorkMinutes / 60000)
+    entry.durationMinutes = durationMinutes
+
+    await em.flush()
+
+    void emitStaffEvent('staff.timesheets.time_entry.timer_stopped', {
+      id: entry.id,
+      staffMemberId: entry.staffMemberId,
+      tenantId: entry.tenantId,
+      organizationId: entry.organizationId,
+      stoppedAt: now.toISOString(),
+      durationMinutes,
+    }, { persistent: true }).catch((err) => {
+      console.error('[staff.timesheets] emit timer_stopped failed', err)
+    })
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry',
+        resourceId: entry.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
+    return NextResponse.json({ ok: true, durationMinutes }, { status: 200 })
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const { translate } = await resolveTranslations()
+    console.error('staff.timesheets.time-entries.timer-stop failed', err)
+    return NextResponse.json(
+      { error: translate('staff.timesheets.errors.timerStop', 'Failed to stop timer.') },
+      { status: 400 },
+    )
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Stop timer for a time entry',
+  methods: {
+    POST: {
+      summary: 'Stop timer for a time entry',
+      description: 'Stops the active timer segment, recalculates total work duration in minutes, and updates the time entry.',
+      responses: [
+        {
+          status: 200,
+          description: 'Timer stopped',
+          schema: z.object({ ok: z.literal(true), durationMinutes: z.number() }),
+        },
+        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },
+        { status: 409, description: 'No active timer segment', schema: z.object({ error: z.string() }) },
+        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/time-entries/bulk/route.ts

@@ -0,0 +1,292 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
+import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { StaffTimeEntry, StaffTeamMember, StaffTimeProject } from '../../../../data/entities'
+import { staffTimeEntryBulkSaveSchema } from '../../../../data/validators'
+import { staffTimeEntryCrudEvents } from '../../../../lib/crud'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../guards'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+}
+
+export async function POST(req: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(req)
+    const { translate } = await resolveTranslations()
+    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
+    }
+
+    const body = await readJsonSafe(req, {})
+    const parsed = staffTimeEntryBulkSaveSchema.safeParse(body)
+    if (!parsed.success) {
+      const errors = parsed.error.issues.map((issue) => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      }))
+      return NextResponse.json({ ok: false, errors }, { status: 422 })
+    }
+
+    const { entries } = parsed.data
+
+    const em = (container.resolve('em') as EntityManager).fork()
+    const scopeCtx = { tenantId, organizationId }
+
+    const staffMember = await findOneWithDecryption(
+      em,
+      StaffTeamMember,
+      { userId: auth.sub, tenantId, organizationId, deletedAt: null },
+      {},
+      scopeCtx,
+    )
+    if (!staffMember) {
+      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })
+    }
+    const staffMemberId = staffMember.id
+
+    // Validate that all referenced timeProjectIds exist and are in-scope
+    const referencedProjectIds = [
+      ...new Set(
+        entries
+          .map((e) => e.timeProjectId)
+          .filter((id): id is string => typeof id === 'string' && id.length > 0),
+      ),
+    ]
+    if (referencedProjectIds.length > 0) {
+      const validProjects = await em.find(StaffTimeProject, {
+        id: { $in: referencedProjectIds },
+        tenantId,
+        organizationId,
+        deletedAt: null,
+      }, { fields: ['id'] })
+      const validIds = new Set(validProjects.map((p) => p.id))
+      const invalidIds = referencedProjectIds.filter((id) => !validIds.has(id))
+      if (invalidIds.length > 0) {
+        return NextResponse.json(
+          {
+            ok: false,
+            errors: invalidIds.map((id) => ({
+              path: 'entries[].timeProjectId',
+              message: translate('staff.timesheets.errors.projectNotFound', 'Time project not found or not accessible.'),
+              value: id,
+            })),
+          },
+          { status: 422 },
+        )
+      }
+    }
+
+    const guardInput = {
+      tenantId,
+      organizationId,
+      userId: auth.sub ?? '',
+      resourceKind: 'staff.timesheets.time_entry',
+      resourceId: staffMemberId,
+      operation: 'update' as const,
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data as unknown as Record<string, unknown>,
+    }
+    const guardResult = await runStaffMutationGuards(container, guardInput, resolveUserFeatures(auth))
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
+    const existingIds = entries
+      .map((entry) => entry.id)
+      .filter((id): id is string => typeof id === 'string' && id.length > 0)
+
+    // Validate referenced entry IDs upfront: a stale or foreign UUID would
+    // otherwise fall through to the create branch in the loop below and insert
+    // a duplicate row with that ID-less new identity. Reject as 422 instead.
+    if (existingIds.length > 0) {
+      const resolvedExisting = await em.find(
+        StaffTimeEntry,
+        { id: { $in: existingIds }, tenantId, organizationId, staffMemberId, deletedAt: null },
+        { fields: ['id'] },
+      )
+      const resolvedIdSet = new Set(resolvedExisting.map((entry) => entry.id))
+      const invalidIds = existingIds.filter((id) => !resolvedIdSet.has(id))
+      if (invalidIds.length > 0) {
+        return NextResponse.json(
+          {
+            ok: false,
+            errors: invalidIds.map((id) => ({
+              path: 'entries[].id',
+              message: translate(
+                'staff.timesheets.errors.entryNotFound',
+                'Time entry not found, deleted, or not owned by you.',
+              ),
+              value: id,
+            })),
+          },
+          { status: 422 },
+        )
+      }
+    }
+
+    type PendingChange = {
+      action: 'created' | 'updated' | 'deleted'
+      entity: StaffTimeEntry
+    }
+
+    const { counts, pendingChanges } = await em.transactional(async (trx) => {
+      let created = 0
+      let updated = 0
+      let deleted = 0
+      const changes: PendingChange[] = []
+
+      const existingEntries = existingIds.length > 0
+        ? await findWithDecryption(
+            trx,
+            StaffTimeEntry,
+            { id: { $in: existingIds }, tenantId, organizationId, staffMemberId, deletedAt: null },
+            {},
+            scopeCtx,
+          )
+        : []
+
+      const existingMap = new Map(existingEntries.map((entry) => [entry.id, entry]))
+
+      for (const entry of entries) {
+        if (entry.id && existingMap.has(entry.id)) {
+          const existing = existingMap.get(entry.id)!
+          if (entry.durationMinutes === 0) {
+            existing.deletedAt = new Date()
+            deleted++
+            changes.push({ action: 'deleted', entity: existing })
+          } else {
+            existing.date = entry.date
+            existing.timeProjectId = entry.timeProjectId
+            existing.durationMinutes = entry.durationMinutes
+            existing.notes = entry.notes ?? existing.notes
+            existing.updatedAt = new Date()
+            updated++
+            changes.push({ action: 'updated', entity: existing })
+          }
+        } else {
+          const now = new Date()
+          const newEntry = trx.create(StaffTimeEntry, {
+            tenantId,
+            organizationId,
+            staffMemberId,
+            date: entry.date,
+            timeProjectId: entry.timeProjectId,
+            durationMinutes: entry.durationMinutes,
+            notes: entry.notes ?? null,
+            source: 'manual',
+            createdAt: now,
+            updatedAt: now,
+          })
+          created++
+          changes.push({ action: 'created', entity: newEntry })
+        }
+      }
+
+      await trx.flush()
+      return { counts: { created, updated, deleted }, pendingChanges: changes }
+    })
+
+    const dataEngine = container.resolve<DataEngine>('dataEngine')
+    for (const change of pendingChanges) {
+      await emitCrudSideEffects({
+        dataEngine,
+        action: change.action,
+        entity: change.entity,
+        identifiers: {
+          id: change.entity.id,
+          organizationId: change.entity.organizationId,
+          tenantId: change.entity.tenantId,
+        },
+        events: staffTimeEntryCrudEvents,
+      })
+    }
+    await flushCrudSideEffects(dataEngine)
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth.sub ?? '',
+        resourceKind: 'staff.timesheets.time_entry',
+        resourceId: staffMemberId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
+    return NextResponse.json({ ok: true, ...counts }, { status: 200 })
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const { translate } = await resolveTranslations()
+    console.error('staff.timesheets.time-entries.bulk failed', err)
+    return NextResponse.json(
+      { error: translate('staff.timesheets.errors.bulkSave', 'Failed to bulk save time entries.') },
+      { status: 400 },
+    )
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Bulk save time entries',
+  methods: {
+    POST: {
+      summary: 'Bulk save time entries',
+      description: 'Creates, updates, or soft-deletes multiple time entries in a single request. Entries with durationMinutes=0 and an existing id are soft-deleted.',
+      requestBody: {
+        contentType: 'application/json',
+        schema: staffTimeEntryBulkSaveSchema,
+      },
+      responses: [
+        {
+          status: 200,
+          description: 'Bulk save completed',
+          schema: z.object({
+            ok: z.literal(true),
+            created: z.number(),
+            updated: z.number(),
+            deleted: z.number(),
+          }),
+        },
+        {
+          status: 422,
+          description: 'Validation error',
+          schema: z.object({
+            ok: z.literal(false),
+            errors: z.array(z.object({ path: z.string(), message: z.string() })),
+          }),
+        },
+        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/time-entries/route.ts

@@ -0,0 +1,193 @@
+import { z } from 'zod'
+import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
+import { StaffTimeEntry } from '../../../data/entities'
+import { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from '../../../data/validators'
+import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'
+
+const F = {
+  id: 'id',
+  tenant_id: 'tenant_id',
+  organization_id: 'organization_id',
+  staff_member_id: 'staff_member_id',
+  date: 'date',
+  duration_minutes: 'duration_minutes',
+  started_at: 'started_at',
+  ended_at: 'ended_at',
+  notes: 'notes',
+  time_project_id: 'time_project_id',
+  customer_id: 'customer_id',
+  deal_id: 'deal_id',
+  order_id: 'order_id',
+  source: 'source',
+  created_at: 'created_at',
+  updated_at: 'updated_at',
+  deleted_at: 'deleted_at',
+} as const
+
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },
+}
+
+export const metadata = routeMetadata
+
+const rawBodySchema = z.object({}).passthrough()
+
+const listSchema = z
+  .object({
+    page: z.coerce.number().min(1).default(1),
+    pageSize: z.coerce.number().min(1).max(100).default(50),
+    staffMemberId: z.string().uuid().optional(),
+    from: z.string().optional(),
+    to: z.string().optional(),
+    projectId: z.string().uuid().optional(),
+    ids: z.string().optional(),
+    sortField: z.string().optional(),
+    sortDir: z.enum(['asc', 'desc']).optional(),
+  })
+  .passthrough()
+
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: StaffTimeEntry,
+    idField: 'id',
+    orgField: 'organizationId',
+    tenantField: 'tenantId',
+    softDeleteField: 'deletedAt',
+  },
+  indexer: { entityType: 'staff:staff_time_entry' },
+  list: {
+    schema: listSchema,
+    entityId: 'staff:staff_time_entry',
+    fields: [
+      F.id,
+      F.organization_id,
+      F.tenant_id,
+      F.staff_member_id,
+      F.date,
+      F.duration_minutes,
+      F.started_at,
+      F.ended_at,
+      F.notes,
+      F.time_project_id,
+      F.customer_id,
+      F.deal_id,
+      F.order_id,
+      F.source,
+      F.created_at,
+      F.updated_at,
+    ],
+    sortFieldMap: {
+      date: F.date,
+      createdAt: F.created_at,
+      updatedAt: F.updated_at,
+      durationMinutes: F.duration_minutes,
+    },
+    buildFilters: async (query) => {
+      const filters: Record<string, unknown> = {}
+      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {
+        const ids = query.ids
+          .split(',')
+          .map((value) => value.trim())
+          .filter((value) => value.length > 0)
+        if (ids.length > 0) {
+          filters[F.id] = { $in: ids }
+        }
+      }
+      if (typeof query.staffMemberId === 'string' && query.staffMemberId.length > 0) {
+        filters[F.staff_member_id] = query.staffMemberId
+      }
+      if (typeof query.from === 'string' && query.from.length > 0) {
+        filters[F.date] = { ...((filters[F.date] as Record<string, unknown>) ?? {}), $gte: query.from }
+      }
+      if (typeof query.to === 'string' && query.to.length > 0) {
+        filters[F.date] = { ...((filters[F.date] as Record<string, unknown>) ?? {}), $lte: query.to }
+      }
+      if (typeof query.projectId === 'string' && query.projectId.length > 0) {
+        filters[F.time_project_id] = query.projectId
+      }
+      return filters
+    },
+  },
+  actions: {
+    create: {
+      commandId: 'staff.timesheets.time_entries.create',
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations()
+        return parseScopedCommandInput(staffTimeEntryCreateSchema, raw ?? {}, ctx, translate)
+      },
+      response: ({ result }) => ({ id: result?.timeEntryId ?? null }),
+      status: 201,
+    },
+    update: {
+      commandId: 'staff.timesheets.time_entries.update',
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations()
+        return parseScopedCommandInput(staffTimeEntryUpdateSchema, raw ?? {}, ctx, translate)
+      },
+      response: () => ({ ok: true }),
+    },
+    delete: {
+      commandId: 'staff.timesheets.time_entries.delete',
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations()
+        const id = resolveCrudRecordId(parsed, ctx, translate)
+        return { id }
+      },
+      response: () => ({ ok: true }),
+    },
+  },
+})
+
+export const GET = crud.GET
+export const POST = crud.POST
+export const PUT = crud.PUT
+export const DELETE = crud.DELETE
+
+const timeEntryListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  staff_member_id: z.string().uuid().nullable().optional(),
+  date: z.string().nullable().optional(),
+  duration_minutes: z.number().nullable().optional(),
+  started_at: z.string().nullable().optional(),
+  ended_at: z.string().nullable().optional(),
+  notes: z.string().nullable().optional(),
+  time_project_id: z.string().uuid().nullable().optional(),
+  customer_id: z.string().uuid().nullable().optional(),
+  deal_id: z.string().uuid().nullable().optional(),
+  order_id: z.string().uuid().nullable().optional(),
+  source: z.string().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional(),
+})
+
+export const openApi = createStaffCrudOpenApi({
+  resourceName: 'TimeEntry',
+  pluralName: 'TimeEntries',
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(timeEntryListItemSchema),
+  create: {
+    schema: staffTimeEntryCreateSchema,
+    description: 'Creates a time entry for a staff member.',
+  },
+  update: {
+    schema: staffTimeEntryUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: 'Updates a time entry by id.',
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: 'Deletes a time entry by id.',
+  },
+})