@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7179.1.e8c03264b6

package/dist/modules/staff/api/guards.js

@@ -2,17 +2,50 @@ import {
   bridgeLegacyGuard,
   runMutationGuards
 } from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+import { getAllMutationGuardInstances } from "@open-mercato/shared/lib/crud/mutation-guard-store";
+import { resolveFeatureAccess } from "../lib/time-tracking/featureAccess.js";
 function resolveUserFeatures(auth) {
   const features = auth?.features;
   if (!Array.isArray(features)) return [];
   return features.filter((value) => typeof value === "string");
 }
-async function runStaffMutationGuards(container, input, userFeatures) {
+const STAFF_TIME_TRACKING_RESOURCE_KINDS = {
+  /** `time-entries/{bulk,copy-day,start-timer}`, `time-entries/[id]/{duplicate,timer-start,timer-stop}` */
+  timeEntry: "staff.timesheets.time_entry",
+  /** `time-entries/[id]/segments`, `time-entries/[id]/segments/[segmentId]` */
+  timeEntrySegment: "staff.timesheets.time_entry_segment",
+  /** `tasks/[id]/status` */
+  timeTask: "staff.timesheets.time_task",
+  /** `tasks/[id]/comments` */
+  timeTaskComment: "staff.timesheets.task_comment",
+  /** `time-projects/[id]/change-currency` */
+  timeProject: "staff.timesheets.time_project",
+  /** `my-projects/[projectId]` */
+  timeProjectMember: "staff.timesheets.time_project_member",
+  /** `reports/[id]/close`, `reports/[id]/unlock` */
+  timeReport: "staff.timesheets.time_report",
+  /** `tags/entry-assignments` */
+  entryTag: "staff.timesheets.entry_tag",
+  /** `tags/task-assignments` */
+  taskTag: "staff.timesheets.task_tag",
+  /** `settings`, `settings/reapply-rounding` */
+  settings: "staff.timesheets.settings",
+  /** `access-requests` */
+  accessRequest: "staff.timesheets.access_request"
+};
+async function runStaffMutationGuards(container, input, extraFeatures = []) {
+  const allGuards = [...getAllMutationGuardInstances()];
   const legacyGuard = bridgeLegacyGuard(container);
-  if (!legacyGuard) {
+  if (legacyGuard) allGuards.push(legacyGuard);
+  if (!allGuards.length) {
     return { ok: true, afterSuccessCallbacks: [] };
   }
-  return runMutationGuards([legacyGuard], input, { userFeatures });
+  const { grantedFeatures } = await resolveFeatureAccess(container, input.userId ?? null, [], {
+    tenantId: input.tenantId ?? null,
+    organizationId: input.organizationId ?? null
+  });
+  const userFeatures = Array.from(/* @__PURE__ */ new Set([...grantedFeatures, ...extraFeatures]));
+  return runMutationGuards(allGuards, input, { userFeatures });
 }
 async function runStaffMutationGuardAfterSuccess(callbacks, input) {
   for (const callback of callbacks) {
@@ -24,6 +57,7 @@ async function runStaffMutationGuardAfterSuccess(callbacks, input) {
   }
 }
 export {
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
   resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards

package/dist/modules/staff/api/guards.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/staff/api/guards.ts"],
-  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\n\ntype GuardAfterCallback = {\n  guard: MutationGuard\n  metadata: Record<string, unknown> | null\n}\n\nexport function resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nexport async function runStaffMutationGuards(\n  container: AwilixContainer,\n  input: MutationGuardInput,\n  userFeatures: string[],\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  modifiedPayload?: Record<string, unknown>\n  afterSuccessCallbacks: GuardAfterCallback[]\n}> {\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, { userFeatures })\n}\n\nexport async function runStaffMutationGuardAfterSuccess(\n  callbacks: GuardAfterCallback[],\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n"],
-  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAOA,SAAS,oBAAoB,MAAyB;AAC3D,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAsB,uBACpB,WACA,OACA,cAOC;AACD,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO,EAAE,aAAa,CAAC;AACjE;AAEA,eAAsB,kCACpB,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { getAllMutationGuardInstances } from '@open-mercato/shared/lib/crud/mutation-guard-store'\nimport { resolveFeatureAccess } from '../lib/time-tracking/featureAccess'\n\ntype GuardAfterCallback = {\n  guard: MutationGuard\n  metadata: Record<string, unknown> | null\n}\n\n/**\n * @deprecated `AuthContext` has no `features` field, so this always answered `[]` \u2014\n * which silently filtered out every registered guard declaring `features`, leaving\n * feature-gated guards enforced on the `makeCrudRoute` resources (the factory\n * resolves real grants) and skipped on every hand-rolled write route.\n * `runStaffMutationGuards` now resolves the caller's grants itself through\n * `resolveFeatureAccess`; pass nothing. Kept as an exported symbol for one release.\n */\nexport function resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\n/**\n * The `resourceKind` every hand-rolled time-tracking write route passes into the\n * mutation-guard contract, published as one map so a guard author can target a route\n * without reading it.\n *\n * These strings are what `MutationGuardInput.resourceKind` carries; they are NOT the\n * CRUD factory's cache/audit resource tag, which the factory derives on its own from\n * each route's `events` config. A guard that filters on `resourceKind` matches against\n * the values below on the custom routes and against the factory-derived tag on the\n * eight `makeCrudRoute` resources.\n *\n * `staff.timesheets.time_task` and `staff.timesheets.time_report` are re-exported from\n * the command modules that also feed them to `enforceCommandOptimisticLockWithGuards`\n * (`STAFF_TIME_TASK_RESOURCE_KIND`, `STAFF_TIME_REPORT_RESOURCE_KIND`); the unit test\n * pins both copies to the same string so they cannot drift.\n */\nexport const STAFF_TIME_TRACKING_RESOURCE_KINDS = {\n  /** `time-entries/{bulk,copy-day,start-timer}`, `time-entries/[id]/{duplicate,timer-start,timer-stop}` */\n  timeEntry: 'staff.timesheets.time_entry',\n  /** `time-entries/[id]/segments`, `time-entries/[id]/segments/[segmentId]` */\n  timeEntrySegment: 'staff.timesheets.time_entry_segment',\n  /** `tasks/[id]/status` */\n  timeTask: 'staff.timesheets.time_task',\n  /** `tasks/[id]/comments` */\n  timeTaskComment: 'staff.timesheets.task_comment',\n  /** `time-projects/[id]/change-currency` */\n  timeProject: 'staff.timesheets.time_project',\n  /** `my-projects/[projectId]` */\n  timeProjectMember: 'staff.timesheets.time_project_member',\n  /** `reports/[id]/close`, `reports/[id]/unlock` */\n  timeReport: 'staff.timesheets.time_report',\n  /** `tags/entry-assignments` */\n  entryTag: 'staff.timesheets.entry_tag',\n  /** `tags/task-assignments` */\n  taskTag: 'staff.timesheets.task_tag',\n  /** `settings`, `settings/reapply-rounding` */\n  settings: 'staff.timesheets.settings',\n  /** `access-requests` */\n  accessRequest: 'staff.timesheets.access_request',\n} as const\n\nexport type StaffTimeTrackingResourceKind =\n  typeof STAFF_TIME_TRACKING_RESOURCE_KINDS[keyof typeof STAFF_TIME_TRACKING_RESOURCE_KINDS]\n\n/**\n * Runs the same guard set as `makeCrudRoute`: every guard a module registered through\n * `data/guards.ts` (`getAllMutationGuardInstances()`) plus the bridged legacy DI\n * service. Mirrors `collectAndRunGuards()` in the CRUD factory; bridging only the\n * legacy service \u2014 as this did originally \u2014 left registry guards unenforced on every\n * hand-rolled time-tracking write route.\n *\n * **The grant list is resolved here, not passed in.** `runMutationGuards` drops any\n * guard whose `features` the caller does not hold, so an empty list silently disables\n * every feature-gated guard \u2014 a third-party `record_locks.enforce` guard fired on the\n * `makeCrudRoute` resources (the factory asks RBAC) and was skipped on `/bulk`, the\n * timer transitions, segments, tag assignments and report close/unlock. Callers used\n * to supply `resolveUserFeatures(auth)`, which read a field `AuthContext` does not\n * have and therefore always returned `[]`. The lookup now goes through\n * `resolveFeatureAccess`, the module's one RBAC authority, which fails closed and\n * logs rather than failing silently.\n *\n * `extraFeatures` is additive and exists only for a caller that already holds a\n * resolved grant list; it is never the sole source.\n */\nexport async function runStaffMutationGuards(\n  container: AwilixContainer,\n  input: MutationGuardInput,\n  extraFeatures: readonly string[] = [],\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  modifiedPayload?: Record<string, unknown>\n  afterSuccessCallbacks: GuardAfterCallback[]\n}> {\n  const allGuards: MutationGuard[] = [...getAllMutationGuardInstances()]\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (legacyGuard) allGuards.push(legacyGuard)\n  if (!allGuards.length) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  const { grantedFeatures } = await resolveFeatureAccess(container, input.userId ?? null, [], {\n    tenantId: input.tenantId ?? null,\n    organizationId: input.organizationId ?? null,\n  })\n  const userFeatures = Array.from(new Set([...grantedFeatures, ...extraFeatures]))\n\n  return runMutationGuards(allGuards, input, { userFeatures })\n}\n\nexport async function runStaffMutationGuardAfterSuccess(\n  callbacks: GuardAfterCallback[],\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,oCAAoC;AAC7C,SAAS,4BAA4B;AAe9B,SAAS,oBAAoB,MAAyB;AAC3D,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAkBO,MAAM,qCAAqC;AAAA;AAAA,EAEhD,WAAW;AAAA;AAAA,EAEX,kBAAkB;AAAA;AAAA,EAElB,UAAU;AAAA;AAAA,EAEV,iBAAiB;AAAA;AAAA,EAEjB,aAAa;AAAA;AAAA,EAEb,mBAAmB;AAAA;AAAA,EAEnB,YAAY;AAAA;AAAA,EAEZ,UAAU;AAAA;AAAA,EAEV,SAAS;AAAA;AAAA,EAET,UAAU;AAAA;AAAA,EAEV,eAAe;AACjB;AAyBA,eAAsB,uBACpB,WACA,OACA,gBAAmC,CAAC,GAOnC;AACD,QAAM,YAA6B,CAAC,GAAG,6BAA6B,CAAC;AACrE,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,YAAa,WAAU,KAAK,WAAW;AAC3C,MAAI,CAAC,UAAU,QAAQ;AACrB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,QAAM,EAAE,gBAAgB,IAAI,MAAM,qBAAqB,WAAW,MAAM,UAAU,MAAM,CAAC,GAAG;AAAA,IAC1F,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM,kBAAkB;AAAA,EAC1C,CAAC;AACD,QAAM,eAAe,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,aAAa,CAAC,CAAC;AAE/E,SAAO,kBAAkB,WAAW,OAAO,EAAE,aAAa,CAAC;AAC7D;AAEA,eAAsB,kCACpB,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests/accept/route.js

@@ -9,7 +9,6 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { staffLeaveRequestDecisionSchema } from "../../../data/validators.js";
 import {
-  resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../guards.js";
@@ -55,8 +54,7 @@ async function POST(req) {
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: input
-      },
-      resolveUserFeatures(auth)
+      }
     );
     if (!guardResult.ok) {
       return NextResponse.json(

package/dist/modules/staff/api/leave-requests/accept/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/leave-requests/accept/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.accept',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.accept failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.accept', 'Failed to approve leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Approve leave request',\n  methods: {\n    POST: {\n      summary: 'Approve leave request',\n      description: 'Approves a leave request and adds unavailability rules for the staff member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request approved', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.accept',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.accept failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.accept', 'Failed to approve leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Approve leave request',\n  methods: {\n    POST: {\n      summary: 'Approve leave request',\n      description: 'Approves a leave request and adds unavailability rules for the staff member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request approved', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests/reject/route.js

@@ -9,7 +9,6 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { staffLeaveRequestDecisionSchema } from "../../../data/validators.js";
 import {
-  resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../guards.js";
@@ -55,8 +54,7 @@ async function POST(req) {
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: input
-      },
-      resolveUserFeatures(auth)
+      }
     );
     if (!guardResult.ok) {
       return NextResponse.json(

package/dist/modules/staff/api/leave-requests/reject/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/leave-requests/reject/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.reject',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.reject failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.reject', 'Failed to reject leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reject leave request',\n  methods: {\n    POST: {\n      summary: 'Reject leave request',\n      description: 'Rejects a leave request with an optional comment.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request rejected', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.reject',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.reject failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.reject', 'Failed to reject leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reject leave request',\n  methods: {\n    POST: {\n      summary: 'Reject leave request',\n      description: 'Rejects a leave request with an optional comment.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request rejected', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/portal/time-reports/[id]/route.js

@@ -0,0 +1,131 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { portalOwnedReportClause } from "../../../../lib/time-tracking/portalReports.js";
+import { resolvePortalScope, toIsoDate, toMinutes } from "../route.js";
+const logger = createLogger("staff").child({ component: "api/portal/time-reports/[id]" });
+const metadata = { requireAuth: false };
+const paramsSchema = z.object({ id: z.string().uuid() });
+const errorResponseSchema = z.object({ ok: z.literal(false), error: z.string() });
+const projectLineSchema = z.object({
+  timeProjectId: z.string().nullable(),
+  projectName: z.string().nullable(),
+  billableMinutes: z.number().int(),
+  nonbillableMinutes: z.number().int()
+});
+const detailResponseSchema = z.object({
+  id: z.string().uuid(),
+  reference: z.string(),
+  title: z.string(),
+  periodFrom: z.string(),
+  periodTo: z.string(),
+  closedAt: z.string().nullable(),
+  totalBillableMinutes: z.number().int(),
+  totalNonbillableMinutes: z.number().int(),
+  projects: z.array(projectLineSchema)
+});
+function readReportId(req) {
+  const segments = new URL(req.url).pathname.split("/").filter(Boolean);
+  const last = segments[segments.length - 1];
+  const parsed = paramsSchema.safeParse({ id: last });
+  return parsed.success ? parsed.data.id : null;
+}
+async function GET(req) {
+  try {
+    const scopeOrResponse = await resolvePortalScope(req);
+    if (scopeOrResponse instanceof Response) return scopeOrResponse;
+    const scope = scopeOrResponse;
+    const reportId = readReportId(req);
+    if (!reportId) {
+      return NextResponse.json({ ok: false, error: "staff.errors.invalidInput" }, { status: 400 });
+    }
+    const connection = scope.em.getConnection();
+    const owned = portalOwnedReportClause(scope);
+    const rows = await connection.execute(
+      `
+        SELECT id, reference, title, period_from, period_to, closed_at,
+               total_billable_minutes, total_nonbillable_minutes
+        FROM staff_time_reports
+        WHERE ${owned.sql} AND id = ?
+        LIMIT 1
+      `,
+      [...owned.params, reportId]
+    );
+    const report = rows?.[0];
+    if (!report) {
+      return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+    }
+    const periodFrom = toIsoDate(report.period_from);
+    const periodTo = toIsoDate(report.period_to);
+    if (!periodFrom || !periodTo) {
+      return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+    }
+    const projectRows = await connection.execute(
+      `
+        SELECT entry.time_project_id AS time_project_id,
+               project.name AS project_name,
+               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN line.frozen_rounded_minutes ELSE 0 END), 0) AS billable_minutes,
+               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN 0 ELSE line.frozen_rounded_minutes END), 0) AS nonbillable_minutes
+        FROM staff_time_report_entries line
+        JOIN staff_time_entries entry
+          ON entry.id = line.time_entry_id
+         AND entry.tenant_id = line.tenant_id
+         AND entry.organization_id = line.organization_id
+        LEFT JOIN staff_time_projects project
+          ON project.id = entry.time_project_id
+         AND project.tenant_id = line.tenant_id
+         AND project.organization_id = line.organization_id
+        WHERE line.report_id = ?
+          AND line.tenant_id = ?
+          AND line.organization_id = ?
+        GROUP BY entry.time_project_id, project.name
+        ORDER BY project.name ASC NULLS LAST
+      `,
+      [report.id, scope.tenantId, scope.organizationId]
+    );
+    return NextResponse.json(
+      detailResponseSchema.parse({
+        id: report.id,
+        reference: report.reference,
+        title: report.title,
+        periodFrom,
+        periodTo,
+        closedAt: report.closed_at instanceof Date ? report.closed_at.toISOString() : typeof report.closed_at === "string" && report.closed_at.trim().length > 0 ? report.closed_at : null,
+        totalBillableMinutes: toMinutes(report.total_billable_minutes),
+        totalNonbillableMinutes: toMinutes(report.total_nonbillable_minutes),
+        projects: projectRows.map((row) => ({
+          timeProjectId: row.time_project_id ?? null,
+          projectName: row.project_name ?? null,
+          billableMinutes: toMinutes(row.billable_minutes),
+          nonbillableMinutes: toMinutes(row.nonbillable_minutes)
+        }))
+      })
+    );
+  } catch (err) {
+    logger.error("staff portal time-report detail failed", { err });
+    return NextResponse.json({ ok: false, error: "staff.errors.internal" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "Staff Portal",
+  pathParams: paramsSchema,
+  methods: {
+    GET: {
+      summary: "Read one closed time report belonging to the signed-in customer",
+      description: "Loads the report by id **together with** the tenant, organization, customer and closed-status predicates, so a report belonging to another customer of the same organization answers 404. Returns the frozen minute totals per project; no rate, cost, amount or currency is present in the response.",
+      pathParams: paramsSchema,
+      responses: [{ status: 200, description: "The report", schema: detailResponseSchema }],
+      errors: [
+        { status: 401, description: "Not signed in to the portal", schema: errorResponseSchema },
+        { status: 403, description: "The portal account is not linked to a customer", schema: errorResponseSchema },
+        { status: 404, description: "No closed report with that id belongs to this customer", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/portal/time-reports/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/staff/api/portal/time-reports/%5Bid%5D/route.ts"],
+  "sourcesContent": ["/**\n * `GET /api/staff/portal/time-reports/{id}` \u2014 EP-50.\n *\n * The ownership check is the list route's, unchanged and re-applied here rather\n * than inherited from it: the id in the path is caller-supplied, so the row it\n * names is loaded WITH `tenant_id`, `organization_id`, `customer_id`,\n * `status = 'closed'` and `deleted_at IS NULL` in the same WHERE clause, never\n * loaded first and checked after. A report belonging to another customer of the\n * same organization is a `404`, not a `403` \u2014 the portal must not confirm that\n * somebody else's report exists.\n *\n * The per-project breakdown reads the FROZEN minutes on `staff_time_report_entries`,\n * which is what the close wrote and what the client was told. It carries no\n * `frozen_rate_amount` and no `frozen_amount`; see the list route's header for why\n * money is structurally absent from this surface rather than conditionally hidden.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { portalOwnedReportClause } from '../../../../lib/time-tracking/portalReports'\nimport { resolvePortalScope, toIsoDate, toMinutes } from '../route'\n\nconst logger = createLogger('staff').child({ component: 'api/portal/time-reports/[id]' })\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nconst errorResponseSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst projectLineSchema = z.object({\n  timeProjectId: z.string().nullable(),\n  projectName: z.string().nullable(),\n  billableMinutes: z.number().int(),\n  nonbillableMinutes: z.number().int(),\n})\n\nconst detailResponseSchema = z.object({\n  id: z.string().uuid(),\n  reference: z.string(),\n  title: z.string(),\n  periodFrom: z.string(),\n  periodTo: z.string(),\n  closedAt: z.string().nullable(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n  projects: z.array(projectLineSchema),\n})\n\ntype ReportRow = {\n  id: string\n  reference: string\n  title: string\n  period_from: Date | string\n  period_to: Date | string\n  closed_at: Date | string | null\n  total_billable_minutes: number | string | null\n  total_nonbillable_minutes: number | string | null\n}\n\ntype ProjectRow = {\n  time_project_id: string | null\n  project_name: string | null\n  billable_minutes: number | string | null\n  nonbillable_minutes: number | string | null\n}\n\nfunction readReportId(req: Request): string | null {\n  const segments = new URL(req.url).pathname.split('/').filter(Boolean)\n  const last = segments[segments.length - 1]\n  const parsed = paramsSchema.safeParse({ id: last })\n  return parsed.success ? parsed.data.id : null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const scopeOrResponse = await resolvePortalScope(req)\n    if (scopeOrResponse instanceof Response) return scopeOrResponse\n    const scope = scopeOrResponse\n\n    const reportId = readReportId(req)\n    if (!reportId) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.invalidInput' }, { status: 400 })\n    }\n\n    const connection = scope.em.getConnection()\n    const owned = portalOwnedReportClause(scope)\n    const rows = (await connection.execute(\n      `\n        SELECT id, reference, title, period_from, period_to, closed_at,\n               total_billable_minutes, total_nonbillable_minutes\n        FROM staff_time_reports\n        WHERE ${owned.sql} AND id = ?\n        LIMIT 1\n      `,\n      [...owned.params, reportId],\n    )) as ReportRow[]\n\n    const report = rows?.[0]\n    if (!report) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.notFound' }, { status: 404 })\n    }\n\n    const periodFrom = toIsoDate(report.period_from)\n    const periodTo = toIsoDate(report.period_to)\n    if (!periodFrom || !periodTo) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.notFound' }, { status: 404 })\n    }\n\n    const projectRows = (await connection.execute(\n      `\n        SELECT entry.time_project_id AS time_project_id,\n               project.name AS project_name,\n               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN line.frozen_rounded_minutes ELSE 0 END), 0) AS billable_minutes,\n               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN 0 ELSE line.frozen_rounded_minutes END), 0) AS nonbillable_minutes\n        FROM staff_time_report_entries line\n        JOIN staff_time_entries entry\n          ON entry.id = line.time_entry_id\n         AND entry.tenant_id = line.tenant_id\n         AND entry.organization_id = line.organization_id\n        LEFT JOIN staff_time_projects project\n          ON project.id = entry.time_project_id\n         AND project.tenant_id = line.tenant_id\n         AND project.organization_id = line.organization_id\n        WHERE line.report_id = ?\n          AND line.tenant_id = ?\n          AND line.organization_id = ?\n        GROUP BY entry.time_project_id, project.name\n        ORDER BY project.name ASC NULLS LAST\n      `,\n      [report.id, scope.tenantId, scope.organizationId],\n    )) as ProjectRow[]\n\n    return NextResponse.json(\n      detailResponseSchema.parse({\n        id: report.id,\n        reference: report.reference,\n        title: report.title,\n        periodFrom,\n        periodTo,\n        closedAt:\n          report.closed_at instanceof Date\n            ? report.closed_at.toISOString()\n            : typeof report.closed_at === 'string' && report.closed_at.trim().length > 0\n              ? report.closed_at\n              : null,\n        totalBillableMinutes: toMinutes(report.total_billable_minutes),\n        totalNonbillableMinutes: toMinutes(report.total_nonbillable_minutes),\n        projects: projectRows.map((row) => ({\n          timeProjectId: row.time_project_id ?? null,\n          projectName: row.project_name ?? null,\n          billableMinutes: toMinutes(row.billable_minutes),\n          nonbillableMinutes: toMinutes(row.nonbillable_minutes),\n        })),\n      }),\n    )\n  } catch (err) {\n    logger.error('staff portal time-report detail failed', { err })\n    return NextResponse.json({ ok: false, error: 'staff.errors.internal' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff Portal',\n  pathParams: paramsSchema,\n  methods: {\n    GET: {\n      summary: 'Read one closed time report belonging to the signed-in customer',\n      description:\n        'Loads the report by id **together with** the tenant, organization, customer and closed-status predicates, so a report belonging to another customer of the same organization answers 404. Returns the frozen minute totals per project; no rate, cost, amount or currency is present in the response.',\n      pathParams: paramsSchema,\n      responses: [{ status: 200, description: 'The report', schema: detailResponseSchema }],\n      errors: [\n        { status: 401, description: 'Not signed in to the portal', schema: errorResponseSchema },\n        { status: 403, description: 'The portal account is not linked to a customer', schema: errorResponseSchema },\n        { status: 404, description: 'No closed report with that id belongs to this customer', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAiBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,oBAAoB;AAE7B,SAAS,+BAA+B;AACxC,SAAS,oBAAoB,WAAW,iBAAiB;AAEzD,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAEjF,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEvD,MAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEhF,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AACrC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,EACxC,UAAU,EAAE,MAAM,iBAAiB;AACrC,CAAC;AAoBD,SAAS,aAAa,KAA6B;AACjD,QAAM,WAAW,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpE,QAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAM,SAAS,aAAa,UAAU,EAAE,IAAI,KAAK,CAAC;AAClD,SAAO,OAAO,UAAU,OAAO,KAAK,KAAK;AAC3C;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,kBAAkB,MAAM,mBAAmB,GAAG;AACpD,QAAI,2BAA2B,SAAU,QAAO;AAChD,UAAM,QAAQ;AAEd,UAAM,WAAW,aAAa,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7F;AAEA,UAAM,aAAa,MAAM,GAAG,cAAc;AAC1C,UAAM,QAAQ,wBAAwB,KAAK;AAC3C,UAAM,OAAQ,MAAM,WAAW;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,gBAIU,MAAM,GAAG;AAAA;AAAA;AAAA,MAGnB,CAAC,GAAG,MAAM,QAAQ,QAAQ;AAAA,IAC5B;AAEA,UAAM,SAAS,OAAO,CAAC;AACvB,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzF;AAEA,UAAM,aAAa,UAAU,OAAO,WAAW;AAC/C,UAAM,WAAW,UAAU,OAAO,SAAS;AAC3C,QAAI,CAAC,cAAc,CAAC,UAAU;AAC5B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzF;AAEA,UAAM,cAAe,MAAM,WAAW;AAAA,MACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAoBA,CAAC,OAAO,IAAI,MAAM,UAAU,MAAM,cAAc;AAAA,IAClD;AAEA,WAAO,aAAa;AAAA,MAClB,qBAAqB,MAAM;AAAA,QACzB,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO;AAAA,QACd;AAAA,QACA;AAAA,QACA,UACE,OAAO,qBAAqB,OACxB,OAAO,UAAU,YAAY,IAC7B,OAAO,OAAO,cAAc,YAAY,OAAO,UAAU,KAAK,EAAE,SAAS,IACvE,OAAO,YACP;AAAA,QACR,sBAAsB,UAAU,OAAO,sBAAsB;AAAA,QAC7D,yBAAyB,UAAU,OAAO,yBAAyB;AAAA,QACnE,UAAU,YAAY,IAAI,CAAC,SAAS;AAAA,UAClC,eAAe,IAAI,mBAAmB;AAAA,UACtC,aAAa,IAAI,gBAAgB;AAAA,UACjC,iBAAiB,UAAU,IAAI,gBAAgB;AAAA,UAC/C,oBAAoB,UAAU,IAAI,mBAAmB;AAAA,QACvD,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,YAAY;AAAA,MACZ,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,qBAAqB,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,oBAAoB;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,oBAAoB;AAAA,QAC1G,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,oBAAoB;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/portal/time-reports/route.js

@@ -0,0 +1,179 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  PORTAL_TIME_REPORTS_VIEW_FEATURE,
+  portalOwnedReportClause
+} from "../../../lib/time-tracking/portalReports.js";
+const logger = createLogger("staff").child({ component: "api/portal/time-reports" });
+const metadata = { requireAuth: false };
+const listQuerySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(50).default(20)
+});
+const reportItemSchema = z.object({
+  id: z.string().uuid(),
+  reference: z.string(),
+  title: z.string(),
+  periodFrom: z.string(),
+  periodTo: z.string(),
+  closedAt: z.string().nullable(),
+  totalBillableMinutes: z.number().int(),
+  totalNonbillableMinutes: z.number().int()
+});
+const errorResponseSchema = z.object({ ok: z.literal(false), error: z.string() });
+const listResponseSchema = z.object({
+  items: z.array(reportItemSchema),
+  total: z.number().int(),
+  page: z.number().int(),
+  pageSize: z.number().int(),
+  totalPages: z.number().int()
+});
+function toIsoDate(value) {
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) return null;
+    return value.toISOString().slice(0, 10);
+  }
+  if (typeof value === "string" && value.trim().length > 0) return value.trim().slice(0, 10);
+  return null;
+}
+function toIsoDateTime(value) {
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) return null;
+    return value.toISOString();
+  }
+  if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  return null;
+}
+function toMinutes(value) {
+  const parsed = typeof value === "number" ? value : Number(value ?? 0);
+  return Number.isFinite(parsed) ? Math.trunc(parsed) : 0;
+}
+async function resolvePortalScope(req) {
+  let auth = null;
+  let requireFeature = null;
+  try {
+    const customerAuth = await import("@open-mercato/core/modules/customer_accounts/lib/customerAuth");
+    auth = await customerAuth.getCustomerAuthFromRequest(req);
+    const guard = customerAuth.requireCustomerFeature;
+    requireFeature = typeof guard === "function" ? guard : null;
+  } catch (err) {
+    logger.warn("staff portal time-reports could not resolve customer auth", { err });
+    return NextResponse.json({ ok: false, error: "staff.errors.unauthorized" }, { status: 401 });
+  }
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: "staff.errors.unauthorized" }, { status: 401 });
+  }
+  const customerId = typeof auth.customerEntityId === "string" && auth.customerEntityId.trim().length > 0 ? auth.customerEntityId.trim() : null;
+  if (!customerId) {
+    return NextResponse.json({ ok: false, error: "staff.errors.customerAccountNotLinked" }, { status: 403 });
+  }
+  if (!requireFeature) {
+    logger.error("staff portal time-reports could not resolve requireCustomerFeature; refusing the request", {
+      feature: PORTAL_TIME_REPORTS_VIEW_FEATURE
+    });
+    return NextResponse.json({ ok: false, error: "staff.errors.forbidden" }, { status: 403 });
+  }
+  const container = await createRequestContainer();
+  try {
+    const rbac = container.resolve("customerRbacService");
+    await requireFeature(auth, [PORTAL_TIME_REPORTS_VIEW_FEATURE], rbac);
+  } catch (response) {
+    if (response instanceof Response) return response;
+    logger.warn("staff portal time-reports feature check failed", { err: response });
+    return NextResponse.json({ ok: false, error: "staff.errors.forbidden" }, { status: 403 });
+  }
+  return {
+    auth,
+    customerId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    em: container.resolve("em").fork()
+  };
+}
+async function GET(req) {
+  try {
+    const scopeOrResponse = await resolvePortalScope(req);
+    if (scopeOrResponse instanceof Response) return scopeOrResponse;
+    const scope = scopeOrResponse;
+    const url = new URL(req.url);
+    const parsedQuery = listQuerySchema.safeParse({
+      page: url.searchParams.get("page") ?? void 0,
+      pageSize: url.searchParams.get("pageSize") ?? void 0
+    });
+    if (!parsedQuery.success) {
+      return NextResponse.json({ ok: false, error: "staff.errors.invalidInput" }, { status: 400 });
+    }
+    const { page, pageSize } = parsedQuery.data;
+    const connection = scope.em.getConnection();
+    const owned = portalOwnedReportClause(scope);
+    const countRows = await connection.execute(
+      `SELECT COUNT(*)::bigint AS total FROM staff_time_reports WHERE ${owned.sql}`,
+      owned.params
+    );
+    const total = toMinutes(countRows?.[0]?.total);
+    const rows = await connection.execute(
+      `
+        SELECT id, reference, title, period_from, period_to, closed_at,
+               total_billable_minutes, total_nonbillable_minutes
+        FROM staff_time_reports
+        WHERE ${owned.sql}
+        ORDER BY period_from DESC, reference DESC
+        LIMIT ? OFFSET ?
+      `,
+      [...owned.params, pageSize, (page - 1) * pageSize]
+    );
+    const items = rows.map((row) => {
+      const periodFrom = toIsoDate(row.period_from);
+      const periodTo = toIsoDate(row.period_to);
+      if (!periodFrom || !periodTo) return null;
+      return {
+        id: row.id,
+        reference: row.reference,
+        title: row.title,
+        periodFrom,
+        periodTo,
+        closedAt: toIsoDateTime(row.closed_at),
+        totalBillableMinutes: toMinutes(row.total_billable_minutes),
+        totalNonbillableMinutes: toMinutes(row.total_nonbillable_minutes)
+      };
+    }).filter((item) => item !== null);
+    return NextResponse.json(
+      listResponseSchema.parse({
+        items,
+        total,
+        page,
+        pageSize,
+        totalPages: Math.max(1, Math.ceil(total / pageSize))
+      })
+    );
+  } catch (err) {
+    logger.error("staff portal time-reports list failed", { err });
+    return NextResponse.json({ ok: false, error: "staff.errors.internal" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "Staff Portal",
+  methods: {
+    GET: {
+      summary: "List the signed-in customer\u2019s closed time reports",
+      description: "Returns the closed, non-deleted `staff_time_reports` rows whose `customer_id` matches the portal session\u2019s own customer entity, inside that session\u2019s tenant and organization. Draft reports are never listed. The response carries hours only \u2014 no rate, cost, amount or currency \u2014 because `staff.timesheets.rates.view` is a staff feature a portal identity cannot hold.",
+      query: listQuerySchema,
+      responses: [{ status: 200, description: "Closed reports for the signed-in customer", schema: listResponseSchema }],
+      errors: [
+        { status: 401, description: "Not signed in to the portal", schema: errorResponseSchema },
+        { status: 403, description: "The portal account is not linked to a customer", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi,
+  resolvePortalScope,
+  toIsoDate,
+  toMinutes
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/portal/time-reports/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/portal/time-reports/route.ts"],
+  "sourcesContent": ["/**\n * `GET /api/staff/portal/time-reports` \u2014 EP-50, the customer-facing half of the\n * time-tracking suite.\n *\n * **The ownership check, spelled out, because it is the only thing standing\n * between a client and another client's hours.** Every row this route can return\n * satisfies all four of:\n *\n *   `tenant_id      = auth.tenantId`          (from the customer JWT, never input)\n *   `organization_id= auth.orgId`             (ditto; the portal shell already\n *                                              refuses a URL whose org slug does\n *                                              not resolve to this org)\n *   `customer_id    = auth.customerEntityId`  (the signed-in portal user's own\n *                                              customer entity \u2014 the same id\n *                                              `staff_time_reports.customer_id`\n *                                              holds, see `data/extensions.ts`)\n *   `status         = 'closed' AND deleted_at IS NULL`\n *\n * A portal user with no `customerEntityId` is refused with `403` rather than\n * being shown an unscoped list: an unlinked portal account is not a customer, and\n * a null in that column would otherwise match nothing or \u2014 worse, in a future\n * refactor \u2014 everything.\n *\n * **Money is absent, not blanked.** The response has no rate, cost, amount or\n * currency field in its schema at all. `staff.timesheets.rates.view` is a *staff*\n * feature resolved by `rbacService`; a portal identity is graded by\n * `CustomerRbacService` against the disjoint `portal.*` namespace and can never\n * hold it, so the module's own rule \u2014 money is added for a holder and absent for\n * everyone else \u2014 resolves to \"absent, always\" here. Making that structural\n * rather than conditional means no later edit can accidentally open it.\n *\n * Draft reports are invisible. A draft is working material whose entries are not\n * frozen; only a closed report is a statement the business has stood behind.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CustomerAuthContext } from '@open-mercato/shared/modules/customer-auth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  PORTAL_TIME_REPORTS_VIEW_FEATURE,\n  portalOwnedReportClause,\n} from '../../../lib/time-tracking/portalReports'\n\nconst logger = createLogger('staff').child({ component: 'api/portal/time-reports' })\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(50).default(20),\n})\n\nconst reportItemSchema = z.object({\n  id: z.string().uuid(),\n  reference: z.string(),\n  title: z.string(),\n  periodFrom: z.string(),\n  periodTo: z.string(),\n  closedAt: z.string().nullable(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n})\n\nconst errorResponseSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst listResponseSchema = z.object({\n  items: z.array(reportItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\ntype PortalScope = {\n  auth: CustomerAuthContext\n  customerId: string\n  tenantId: string\n  organizationId: string\n  em: EntityManager\n}\n\ntype ReportRow = {\n  id: string\n  reference: string\n  title: string\n  period_from: Date | string\n  period_to: Date | string\n  closed_at: Date | string | null\n  total_billable_minutes: number | string | null\n  total_nonbillable_minutes: number | string | null\n}\n\nexport function toIsoDate(value: Date | string | null | undefined): string | null {\n  if (value instanceof Date) {\n    if (Number.isNaN(value.getTime())) return null\n    return value.toISOString().slice(0, 10)\n  }\n  if (typeof value === 'string' && value.trim().length > 0) return value.trim().slice(0, 10)\n  return null\n}\n\nfunction toIsoDateTime(value: Date | string | null | undefined): string | null {\n  if (value instanceof Date) {\n    if (Number.isNaN(value.getTime())) return null\n    return value.toISOString()\n  }\n  if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  return null\n}\n\nexport function toMinutes(value: number | string | null | undefined): number {\n  const parsed = typeof value === 'number' ? value : Number(value ?? 0)\n  return Number.isFinite(parsed) ? Math.trunc(parsed) : 0\n}\n\n/**\n * Resolves the portal identity through `customer_accounts` with a dynamic import.\n * Staff must stay extractable into its own package, so the module graph carries no\n * static edge to `customer_accounts`; a deployment without the portal installed\n * answers `401` here instead of failing to load.\n */\ntype CustomerFeatureGuard = (\n  auth: CustomerAuthContext,\n  features: string[],\n  rbac: unknown,\n) => Promise<void>\n\nexport async function resolvePortalScope(req: Request): Promise<PortalScope | Response> {\n  let auth: CustomerAuthContext | null = null\n  let requireFeature: CustomerFeatureGuard | null = null\n  try {\n    const customerAuth = await import('@open-mercato/core/modules/customer_accounts/lib/customerAuth')\n    auth = await customerAuth.getCustomerAuthFromRequest(req)\n    const guard: unknown = (customerAuth as { requireCustomerFeature?: unknown }).requireCustomerFeature\n    requireFeature = typeof guard === 'function' ? (guard as CustomerFeatureGuard) : null\n  } catch (err) {\n    logger.warn('staff portal time-reports could not resolve customer auth', { err })\n    return NextResponse.json({ ok: false, error: 'staff.errors.unauthorized' }, { status: 401 })\n  }\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'staff.errors.unauthorized' }, { status: 401 })\n  }\n  const customerId =\n    typeof auth.customerEntityId === 'string' && auth.customerEntityId.trim().length > 0\n      ? auth.customerEntityId.trim()\n      : null\n  if (!customerId) {\n    return NextResponse.json({ ok: false, error: 'staff.errors.customerAccountNotLinked' }, { status: 403 })\n  }\n\n  // A missing guard is a failed feature check, not an absent one: without it the\n  // tenant loses the ability to REVOKE `portal.time_reports.view`, since a customer\n  // role stripped of the grant would keep reading reports. (Not a disclosure \u2014\n  // `portalOwnedReportClause` still pins tenant, organization, customer and\n  // `status = 'closed'` \u2014 but revocation has to keep working.)\n  if (!requireFeature) {\n    logger.error('staff portal time-reports could not resolve requireCustomerFeature; refusing the request', {\n      feature: PORTAL_TIME_REPORTS_VIEW_FEATURE,\n    })\n    return NextResponse.json({ ok: false, error: 'staff.errors.forbidden' }, { status: 403 })\n  }\n\n  const container = await createRequestContainer()\n  try {\n    const rbac = container.resolve('customerRbacService')\n    await requireFeature(auth, [PORTAL_TIME_REPORTS_VIEW_FEATURE], rbac)\n  } catch (response) {\n    if (response instanceof Response) return response\n    logger.warn('staff portal time-reports feature check failed', { err: response })\n    return NextResponse.json({ ok: false, error: 'staff.errors.forbidden' }, { status: 403 })\n  }\n\n  return {\n    auth,\n    customerId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    em: (container.resolve('em') as EntityManager).fork(),\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const scopeOrResponse = await resolvePortalScope(req)\n    if (scopeOrResponse instanceof Response) return scopeOrResponse\n    const scope = scopeOrResponse\n\n    const url = new URL(req.url)\n    const parsedQuery = listQuerySchema.safeParse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n    if (!parsedQuery.success) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.invalidInput' }, { status: 400 })\n    }\n    const { page, pageSize } = parsedQuery.data\n\n    const connection = scope.em.getConnection()\n    const owned = portalOwnedReportClause(scope)\n    const countRows = (await connection.execute(\n      `SELECT COUNT(*)::bigint AS total FROM staff_time_reports WHERE ${owned.sql}`,\n      owned.params,\n    )) as Array<{ total: string | number | null }>\n    const total = toMinutes(countRows?.[0]?.total)\n\n    const rows = (await connection.execute(\n      `\n        SELECT id, reference, title, period_from, period_to, closed_at,\n               total_billable_minutes, total_nonbillable_minutes\n        FROM staff_time_reports\n        WHERE ${owned.sql}\n        ORDER BY period_from DESC, reference DESC\n        LIMIT ? OFFSET ?\n      `,\n      [...owned.params, pageSize, (page - 1) * pageSize],\n    )) as ReportRow[]\n\n    const items = rows\n      .map((row) => {\n        const periodFrom = toIsoDate(row.period_from)\n        const periodTo = toIsoDate(row.period_to)\n        if (!periodFrom || !periodTo) return null\n        return {\n          id: row.id,\n          reference: row.reference,\n          title: row.title,\n          periodFrom,\n          periodTo,\n          closedAt: toIsoDateTime(row.closed_at),\n          totalBillableMinutes: toMinutes(row.total_billable_minutes),\n          totalNonbillableMinutes: toMinutes(row.total_nonbillable_minutes),\n        }\n      })\n      .filter((item): item is z.infer<typeof reportItemSchema> => item !== null)\n\n    return NextResponse.json(\n      listResponseSchema.parse({\n        items,\n        total,\n        page,\n        pageSize,\n        totalPages: Math.max(1, Math.ceil(total / pageSize)),\n      }),\n    )\n  } catch (err) {\n    logger.error('staff portal time-reports list failed', { err })\n    return NextResponse.json({ ok: false, error: 'staff.errors.internal' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff Portal',\n  methods: {\n    GET: {\n      summary: 'List the signed-in customer\\u2019s closed time reports',\n      description:\n        'Returns the closed, non-deleted `staff_time_reports` rows whose `customer_id` matches the portal session\\u2019s own customer entity, inside that session\\u2019s tenant and organization. Draft reports are never listed. The response carries hours only \\u2014 no rate, cost, amount or currency \\u2014 because `staff.timesheets.rates.view` is a staff feature a portal identity cannot hold.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Closed reports for the signed-in customer', schema: listResponseSchema }],\n      errors: [\n        { status: 401, description: 'Not signed in to the portal', schema: errorResponseSchema },\n        { status: 403, description: 'The portal account is not linked to a customer', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAmCA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,0BAA0B,CAAC;AAE5E,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE;AAC7D,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAC1C,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEhF,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAqBM,SAAS,UAAU,OAAwD;AAChF,MAAI,iBAAiB,MAAM;AACzB,QAAI,OAAO,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC1C,WAAO,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,EACxC;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK,EAAE,MAAM,GAAG,EAAE;AACzF,SAAO;AACT;AAEA,SAAS,cAAc,OAAwD;AAC7E,MAAI,iBAAiB,MAAM;AACzB,QAAI,OAAO,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC1C,WAAO,MAAM,YAAY;AAAA,EAC3B;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAC5E,SAAO;AACT;AAEO,SAAS,UAAU,OAAmD;AAC3E,QAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AACpE,SAAO,OAAO,SAAS,MAAM,IAAI,KAAK,MAAM,MAAM,IAAI;AACxD;AAcA,eAAsB,mBAAmB,KAA+C;AACtF,MAAI,OAAmC;AACvC,MAAI,iBAA8C;AAClD,MAAI;AACF,UAAM,eAAe,MAAM,OAAO,+DAA+D;AACjG,WAAO,MAAM,aAAa,2BAA2B,GAAG;AACxD,UAAM,QAAkB,aAAsD;AAC9E,qBAAiB,OAAO,UAAU,aAAc,QAAiC;AAAA,EACnF,SAAS,KAAK;AACZ,WAAO,KAAK,6DAA6D,EAAE,IAAI,CAAC;AAChF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,aACJ,OAAO,KAAK,qBAAqB,YAAY,KAAK,iBAAiB,KAAK,EAAE,SAAS,IAC/E,KAAK,iBAAiB,KAAK,IAC3B;AACN,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAOA,MAAI,CAAC,gBAAgB;AACnB,WAAO,MAAM,4FAA4F;AAAA,MACvG,SAAS;AAAA,IACX,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,qBAAqB;AACpD,UAAM,eAAe,MAAM,CAAC,gCAAgC,GAAG,IAAI;AAAA,EACrE,SAAS,UAAU;AACjB,QAAI,oBAAoB,SAAU,QAAO;AACzC,WAAO,KAAK,kDAAkD,EAAE,KAAK,SAAS,CAAC;AAC/E,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,IAAK,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,EACtD;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,kBAAkB,MAAM,mBAAmB,GAAG;AACpD,QAAI,2BAA2B,SAAU,QAAO;AAChD,UAAM,QAAQ;AAEd,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,cAAc,gBAAgB,UAAU;AAAA,MAC5C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AACD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,MAAM,SAAS,IAAI,YAAY;AAEvC,UAAM,aAAa,MAAM,GAAG,cAAc;AAC1C,UAAM,QAAQ,wBAAwB,KAAK;AAC3C,UAAM,YAAa,MAAM,WAAW;AAAA,MAClC,kEAAkE,MAAM,GAAG;AAAA,MAC3E,MAAM;AAAA,IACR;AACA,UAAM,QAAQ,UAAU,YAAY,CAAC,GAAG,KAAK;AAE7C,UAAM,OAAQ,MAAM,WAAW;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,gBAIU,MAAM,GAAG;AAAA;AAAA;AAAA;AAAA,MAInB,CAAC,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,QAAQ;AAAA,IACnD;AAEA,UAAM,QAAQ,KACX,IAAI,CAAC,QAAQ;AACZ,YAAM,aAAa,UAAU,IAAI,WAAW;AAC5C,YAAM,WAAW,UAAU,IAAI,SAAS;AACxC,UAAI,CAAC,cAAc,CAAC,SAAU,QAAO;AACrC,aAAO;AAAA,QACL,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX;AAAA,QACA;AAAA,QACA,UAAU,cAAc,IAAI,SAAS;AAAA,QACrC,sBAAsB,UAAU,IAAI,sBAAsB;AAAA,QAC1D,yBAAyB,UAAU,IAAI,yBAAyB;AAAA,MAClE;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAmD,SAAS,IAAI;AAE3E,WAAO,aAAa;AAAA,MAClB,mBAAmB,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,mBAAmB,CAAC;AAAA,MACjH,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,oBAAoB;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,oBAAoB;AAAA,MAC5G;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}