@open-mercato/core 0.6.6-develop.6151.1.3028861dfe → 0.6.6-develop.6156.1.5ac693a69a

package/src/modules/staff/commands/timesheets-entries.ts

@@ -7,15 +7,18 @@ import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildChanges, emitCrudSideEffects, emitCrudUndoSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'
 import type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
-import { StaffTimeEntry, StaffTimeProject, type StaffTimeEntrySource } from '../data/entities'
+import { StaffTimeEntry, StaffTimeEntrySegment, StaffTimeProject, type StaffTimeEntrySource } from '../data/entities'
+import { emitStaffEvent } from '../events'
 
 const timeEntryCrudIndexer: CrudIndexerConfig<StaffTimeEntry> = {
   entityType: 'staff:staff_time_entry',
 }
 import {
   staffTimeEntryCreateSchema,
+  staffTimeEntryStartTimerSchema,
   staffTimeEntryUpdateSchema,
   type StaffTimeEntryCreateInput,
+  type StaffTimeEntryStartTimerInput,
   type StaffTimeEntryUpdateInput,
 } from '../data/validators'
 import { staffTimeEntryCrudEvents } from '../lib/crud'
@@ -281,6 +284,167 @@ const createTimeEntryCommand: CommandHandler<StaffTimeEntryCreateInput, { timeEn
   }),
 }
 
+const startTimerCommand: CommandHandler<StaffTimeEntryStartTimerInput, { timeEntryId: string }> = {
+  id: 'staff.timesheets.time_entries.start_timer',
+  async execute(rawInput, ctx) {
+    const parsed = staffTimeEntryStartTimerSchema.parse(rawInput)
+    ensureTenantScope(ctx, parsed.tenantId)
+    ensureOrganizationScope(ctx, parsed.organizationId)
+
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+    // Ownership enforcement mirrors createTimeEntryCommand: callers without
+    // `staff.timesheets.manage_all` can only start their own timer, so the
+    // request body's staffMemberId can't start a timer under a colleague's id.
+    let effectiveStaffMemberId = parsed.staffMemberId
+    if (!(await callerHasManageAll(ctx))) {
+      const callerStaffMemberId = await resolveCallerStaffMemberId(em, ctx)
+      if (!callerStaffMemberId) {
+        const { translate } = await resolveTranslations()
+        throw new CrudHttpError(403, {
+          error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.'),
+        })
+      }
+      effectiveStaffMemberId = callerStaffMemberId
+    }
+
+    await assertTimeProjectInScope(em, parsed.timeProjectId ?? null, parsed.tenantId, parsed.organizationId)
+
+    const scopeCtx = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
+
+    // Create the timer entry AND start it inside a single transaction so a
+    // partial failure can never leave an orphaned, never-started timer entry
+    // (issue #3311 — the legacy two-request create-then-start flow). The
+    // single-active-timer invariant (#2855) is re-checked here so a second
+    // surface cannot create a parallel running timer for the same staff member.
+    const { entry, startedAt } = await em.transactional(async (trx) => {
+      const otherRunningEntry = await findOneWithDecryption(
+        trx,
+        StaffTimeEntry,
+        {
+          tenantId: parsed.tenantId,
+          organizationId: parsed.organizationId,
+          staffMemberId: effectiveStaffMemberId,
+          startedAt: { $ne: null },
+          endedAt: null,
+          deletedAt: null,
+        },
+        {},
+        scopeCtx,
+      )
+      if (otherRunningEntry) {
+        const { translate } = await resolveTranslations()
+        throw new CrudHttpError(409, {
+          error: translate(
+            'staff.timesheets.errors.timerAlreadyRunning',
+            'Another timer is already running. Stop it before starting a new one.',
+          ),
+        })
+      }
+
+      const startedAt = new Date()
+      const entry = trx.create(StaffTimeEntry, {
+        tenantId: parsed.tenantId,
+        organizationId: parsed.organizationId,
+        staffMemberId: effectiveStaffMemberId,
+        date: parsed.date,
+        durationMinutes: 0,
+        startedAt,
+        endedAt: null,
+        notes: parsed.notes ?? null,
+        timeProjectId: parsed.timeProjectId ?? null,
+        customerId: null,
+        dealId: null,
+        orderId: null,
+        source: 'timer',
+        createdAt: startedAt,
+        updatedAt: startedAt,
+        deletedAt: null,
+      })
+      // Flush so the DB-generated id is populated before the work segment
+      // references it; both writes commit together when the transaction closes.
+      await trx.flush()
+
+      const segmentData = {
+        tenantId: parsed.tenantId,
+        organizationId: parsed.organizationId,
+        timeEntryId: entry.id,
+        startedAt,
+        segmentType: 'work' as const,
+      }
+      trx.create(StaffTimeEntrySegment, segmentData as never)
+      await trx.flush()
+
+      return { entry, startedAt }
+    })
+
+    await emitCrudSideEffects({
+      dataEngine: ctx.container.resolve('dataEngine'),
+      action: 'created',
+      entity: entry,
+      identifiers: { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },
+      events: staffTimeEntryCrudEvents,
+      indexer: timeEntryCrudIndexer,
+    })
+
+    void emitStaffEvent('staff.timesheets.time_entry.timer_started', {
+      id: entry.id,
+      staffMemberId: effectiveStaffMemberId,
+      tenantId: parsed.tenantId,
+      organizationId: parsed.organizationId,
+      startedAt: startedAt.toISOString(),
+    }, { persistent: true }).catch((err) => {
+      console.error('[staff.timesheets] emit timer_started failed', err)
+    })
+
+    return { timeEntryId: entry.id }
+  },
+  captureAfter: async (_input, result, ctx) => {
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId)
+    if (!snapshot) return null
+    return { snapshot }
+  },
+  buildLog: async ({ result, ctx }) => {
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId)
+    if (!snapshot) return null
+    const { translate } = await resolveTranslations()
+    return {
+      actionLabel: translate('staff.audit.timesheets.time_entries.startTimer', 'Start timer'),
+      resourceKind: 'staff.timesheets.time_entry',
+      resourceId: snapshot.id,
+      tenantId: snapshot.tenantId,
+      organizationId: snapshot.organizationId,
+      snapshotAfter: snapshot,
+      payload: {
+        undo: {
+          after: snapshot,
+        } satisfies TimeEntryUndoPayload,
+      },
+    }
+  },
+  undo: async ({ logEntry, ctx }) => {
+    const payload = extractUndoPayload<TimeEntryUndoPayload>(logEntry)
+    const after = payload?.after
+    if (!after) return
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const entry = await em.findOne(StaffTimeEntry, { id: after.id })
+    if (entry) {
+      entry.deletedAt = new Date()
+      await em.flush()
+
+      await emitCrudUndoSideEffects({
+        dataEngine: ctx.container.resolve('dataEngine'),
+        action: 'deleted',
+        entity: entry,
+        identifiers: { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },
+        events: staffTimeEntryCrudEvents,
+      })
+    }
+  },
+}
+
 const updateTimeEntryCommand: CommandHandler<StaffTimeEntryUpdateInput, { timeEntryId: string }> = {
   id: 'staff.timesheets.time_entries.update',
   async prepare(rawInput, ctx) {
@@ -531,5 +695,6 @@ const deleteTimeEntryCommand: CommandHandler<{ id?: string }, { timeEntryId: str
 }
 
 registerCommand(createTimeEntryCommand)
+registerCommand(startTimerCommand)
 registerCommand(updateTimeEntryCommand)
 registerCommand(deleteTimeEntryCommand)

package/src/modules/staff/data/validators.ts

@@ -291,6 +291,14 @@ export const staffTimeEntryUpdateSchema = z.object({
   notes: z.string().max(2000).optional().nullable(),
 })
 
+export const staffTimeEntryStartTimerSchema = z.object({
+  ...scopedCreateFields,
+  staffMemberId: z.string().uuid(),
+  date: z.coerce.date(),
+  timeProjectId: z.string().uuid().optional().nullable(),
+  notes: z.string().max(2000).optional().nullable(),
+})
+
 export const staffTimeEntryBulkItemSchema = z.object({
   id: z.string().uuid().optional().nullable(),
   date: z.coerce.date(),
@@ -369,6 +377,7 @@ export const staffMyProjectVisibilityUpdateSchema = z.object({
 
 export type StaffTimeEntryCreateInput = z.infer<typeof staffTimeEntryCreateSchema>
 export type StaffTimeEntryUpdateInput = z.infer<typeof staffTimeEntryUpdateSchema>
+export type StaffTimeEntryStartTimerInput = z.infer<typeof staffTimeEntryStartTimerSchema>
 export type StaffTimeEntryBulkSaveInput = z.infer<typeof staffTimeEntryBulkSaveSchema>
 export type StaffTimeEntrySegmentCreateInput = z.infer<typeof staffTimeEntrySegmentCreateSchema>
 export type StaffTimeEntrySegmentUpdateInput = z.infer<typeof staffTimeEntrySegmentUpdateSchema>

package/src/modules/staff/i18n/de.json

@@ -120,6 +120,7 @@
   "staff.audit.teams.update": "Team aktualisieren",
   "staff.audit.timesheets.time_entries.create": "Zeiteintrag erstellen",
   "staff.audit.timesheets.time_entries.delete": "Zeiteintrag löschen",
+  "staff.audit.timesheets.time_entries.startTimer": "Timer starten",
   "staff.audit.timesheets.time_entries.update": "Zeiteintrag aktualisieren",
   "staff.audit.timesheets.time_project_members.assign": "Zeitprojektmitglied zuweisen",
   "staff.audit.timesheets.time_project_members.unassign": "Zeitprojektmitglied entfernen",

package/src/modules/staff/i18n/en.json

@@ -120,6 +120,7 @@
   "staff.audit.teams.update": "Update team",
   "staff.audit.timesheets.time_entries.create": "Create time entry",
   "staff.audit.timesheets.time_entries.delete": "Delete time entry",
+  "staff.audit.timesheets.time_entries.startTimer": "Start timer",
   "staff.audit.timesheets.time_entries.update": "Update time entry",
   "staff.audit.timesheets.time_project_members.assign": "Assign time project member",
   "staff.audit.timesheets.time_project_members.unassign": "Unassign time project member",

package/src/modules/staff/i18n/es.json

@@ -120,6 +120,7 @@
   "staff.audit.teams.update": "Actualizar equipo",
   "staff.audit.timesheets.time_entries.create": "Crear registro de tiempo",
   "staff.audit.timesheets.time_entries.delete": "Eliminar registro de tiempo",
+  "staff.audit.timesheets.time_entries.startTimer": "Iniciar temporizador",
   "staff.audit.timesheets.time_entries.update": "Actualizar registro de tiempo",
   "staff.audit.timesheets.time_project_members.assign": "Asignar miembro del proyecto de tiempo",
   "staff.audit.timesheets.time_project_members.unassign": "Desasignar miembro del proyecto de tiempo",

package/src/modules/staff/i18n/pl.json

@@ -120,6 +120,7 @@
   "staff.audit.teams.update": "Zaktualizuj zespół",
   "staff.audit.timesheets.time_entries.create": "Utwórz wpis czasu",
   "staff.audit.timesheets.time_entries.delete": "Usuń wpis czasu",
+  "staff.audit.timesheets.time_entries.startTimer": "Uruchom licznik czasu",
   "staff.audit.timesheets.time_entries.update": "Zaktualizuj wpis czasu",
   "staff.audit.timesheets.time_project_members.assign": "Przypisz członka projektu czasu",
   "staff.audit.timesheets.time_project_members.unassign": "Usuń przypisanie członka projektu czasu",

package/src/modules/staff/lib/timesheets-ui/TimerBar.tsx

@@ -8,6 +8,7 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { ProjectColorDot } from './ProjectColorDot'
+import { startTimerEntry } from './startTimer'
 
 type ProjectOption = {
   id: string
@@ -140,31 +141,14 @@ export function TimerBar({ projects, staffMemberId, onTimerStopped }: TimerBarPr
     setIsStarting(true)
     try {
       const today = getToday()
-      const createResponse = await apiCallOrThrow(
-        '/api/staff/timesheets/time-entries',
-        {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            staffMemberId,
-            timeProjectId: selectedProjectId,
-            date: today,
-            durationMinutes: 0,
-            source: 'timer',
-            notes: description || null,
-          }),
-        },
-      )
-
-      const created = createResponse.result as Record<string, unknown> | null
-      const entryId = created?.id as string | undefined
-
-      await apiCallOrThrow(
-        `/api/staff/timesheets/time-entries/${entryId}/timer-start`,
-        { method: 'POST' },
-      )
-
-      setActiveEntryId(entryId ?? null)
+      const { id: entryId } = await startTimerEntry({
+        staffMemberId,
+        timeProjectId: selectedProjectId,
+        date: today,
+        notes: description || null,
+      })
+
+      setActiveEntryId(entryId)
       setActiveProjectId(selectedProjectId)
       startElapsedCounter(new Date().toISOString())
     } catch {

package/src/modules/staff/lib/timesheets-ui/startTimer.ts

@@ -0,0 +1,40 @@
+import { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+
+export type StartTimerEntryInput = {
+  staffMemberId: string
+  timeProjectId: string
+  date: string
+  notes?: string | null
+}
+
+export type StartedTimerEntry = {
+  id: string | null
+}
+
+/**
+ * Starts a timesheet timer through the single atomic server endpoint
+ * (`/api/staff/timesheets/time-entries/start-timer`), which creates the
+ * timer-sourced entry AND starts it in one transaction. This replaces the
+ * legacy create-then-start two-request sequence so a partial failure (a failed
+ * second request, or the browser navigating between the two calls) can no
+ * longer leave an orphaned, never-started timer entry (issue #3311). Both the
+ * TimerBar and the dashboard time-reporting widget call this helper so they
+ * share error handling and refresh semantics.
+ */
+export async function startTimerEntry(input: StartTimerEntryInput): Promise<StartedTimerEntry> {
+  const response = await apiCallOrThrow<Record<string, unknown>>(
+    '/api/staff/timesheets/time-entries/start-timer',
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        staffMemberId: input.staffMemberId,
+        timeProjectId: input.timeProjectId,
+        date: input.date,
+        notes: input.notes ?? null,
+      }),
+    },
+  )
+  const result = response.result as Record<string, unknown> | null
+  return { id: (result?.id as string | undefined) ?? null }
+}

package/src/modules/staff/widgets/dashboard/timesheets-time-reporting/widget.client.tsx

@@ -6,6 +6,7 @@ import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/ap
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Input } from '@open-mercato/ui/primitives/input'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { startTimerEntry } from '../../../lib/timesheets-ui/startTimer'
 import { DEFAULT_SETTINGS, hydrateSettings, type TimeReportingSettings } from './config'
 
 type ProjectOption = { id: string; name: string; code: string | null }
@@ -138,25 +139,15 @@ const TimeReportingWidget: React.FC<DashboardWidgetComponentProps<TimeReportingS
     setActionLoading(true)
     try {
       const today = new Date().toISOString().slice(0, 10)
-      // Create entry + start timer
-      const createRes = await apiCall<Record<string, unknown>>('/api/staff/timesheets/time-entries', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          staffMemberId,
-          date: today,
-          timeProjectId: selectedProjectId,
-          durationMinutes: 0,
-          notes: notes.trim() || null,
-          source: 'timer',
-        }),
+      // Single atomic create+start request (issue #3311): a partial failure can
+      // no longer leave an orphaned, unstarted timer entry, and a rejected start
+      // now surfaces here instead of being silently ignored.
+      await startTimerEntry({
+        staffMemberId,
+        timeProjectId: selectedProjectId,
+        date: today,
+        notes: notes.trim() || null,
       })
-      if (!createRes.ok) throw new Error('Failed to create entry')
-      const body = createRes.result as Record<string, unknown> | null
-      const entryId = String(body?.id ?? (body?.item as Record<string, unknown> | undefined)?.id ?? '')
-      if (!entryId) throw new Error('Failed to extract entry ID')
-
-      await apiCall(`/api/staff/timesheets/time-entries/${entryId}/timer-start`, { method: 'POST' })
 
       onSettingsChange({ ...hydrated, lastProjectId: selectedProjectId })
       await loadState()