@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/_shared/withTimesheetInterceptors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/_shared/withTimesheetInterceptors.ts"],
+  "sourcesContent": ["/**\n * API interceptors for the hand-rolled `/api/staff/timesheets/*` routes.\n *\n * The eight `makeCrudRoute` time-tracking resources run `runApiInterceptorsBefore`\n * and `runApiInterceptorsAfter` through the CRUD factory. The ~23 routes written by\n * hand beside them ran neither, so a third party could rewrite the body of a create\n * on `/time-entries` but not on `/time-entries/bulk`, and could not shape the\n * response of a single aggregate. This wraps the two shared runners in the one shape\n * those routes need: one call before the work, one call around the response.\n *\n * `routePath` is derived from the request URL exactly as the factory derives it\n * (`normalizeInterceptorRoutePath`) \u2014 the pathname with the leading `/api/` removed,\n * so an interceptor targets `staff/timesheets/time-entries/bulk`. A route with a\n * dynamic segment carries the CONCRETE id in that path\n * (`staff/timesheets/time-entries/<uuid>/duplicate`), so an interceptor for one of\n * those must use the registry's prefix wildcard \u2014 `staff/timesheets/time-entries/*`\n * \u2014 rather than a literal with a placeholder in it.\n *\n * Scope: the interceptor context carries `tenantId` and `organizationId` and this\n * helper fails closed with a 400 when either is missing, so no interceptor ever runs\n * \u2014 and no route body is ever handed to one \u2014 outside a resolved tenant scope.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type {\n  ApiInterceptorMethod,\n  InterceptorRequest,\n} from '@open-mercato/shared/lib/crud/api-interceptor'\nimport { getApiInterceptorsForRoute } from '@open-mercato/shared/lib/crud/interceptor-registry'\nimport { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { parseExtensionHeaders } from '@open-mercato/shared/lib/umes/extension-headers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\nexport type TimesheetInterceptorScope = {\n  container: AwilixContainer\n  userId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n  /**\n   * The caller's granted features, when the route already resolved them \u2014 through\n   * `resolveFeatureAccess`, which always yields an array. Deliberately not\n   * nullable: a grant list that can be `null` cannot say whether an empty answer\n   * means \"no grants\" or \"could not ask\", and passing that ambiguity on is what\n   * this helper's own fallback exists to avoid.\n   *\n   * Omitted, the helper asks `rbacService.getGrantedFeatures` once \u2014 the same\n   * source the CRUD factory uses \u2014 so a feature-gated interceptor is evaluated\n   * against a real grant set rather than an empty one, and an unreadable set gates\n   * every feature-scoped interceptor off.\n   */\n  userFeatures?: readonly string[]\n  /**\n   * Opt-in for the tenant-global routes (`/settings`, `/settings/reapply-rounding`),\n   * whose records have no organization at all. Without it a request that resolved no\n   * organization is refused rather than interceptor-scoped to an empty organization \u2014\n   * the same fail-closed default every org-scoped route here keeps. With it, the\n   * context carries the empty organization id the CRUD factory also passes for a\n   * tenant-global caller.\n   */\n  tenantGlobal?: boolean\n}\n\nexport type TimesheetInterceptorSession = {\n  /** The request body after the before-pass, or `{}` for a route that sends none. */\n  body: Record<string, unknown>\n  /** The query after the before-pass. */\n  query: Record<string, unknown>\n  /** `query` as `URLSearchParams`, for routes that read their input that way. */\n  searchParams: URLSearchParams\n  /**\n   * Runs the after-pass over a successful JSON response and returns it. An\n   * interceptor that fails or times out replaces the response with its own error.\n   */\n  respond(statusCode: number, body: Record<string, unknown>): Promise<NextResponse>\n  /**\n   * Runs the after-pass over a descriptor for a non-JSON response (a file export).\n   * The interceptors cannot rewrite the bytes, so the descriptor is what they shape;\n   * the caller applies whatever came back. A failed interceptor yields a JSON error\n   * response instead of the file.\n   */\n  respondWithDescriptor(\n    descriptor: Record<string, unknown>,\n  ): Promise<{ ok: true; descriptor: Record<string, unknown> } | { ok: false; response: NextResponse }>\n}\n\nexport type TimesheetInterceptorRun =\n  | { ok: true; session: TimesheetInterceptorSession }\n  | { ok: false; response: NextResponse }\n\n/**\n * Duplicates and repeated keys collapse to arrays so a rewritten query round-trips\n * `?tagIds=a&tagIds=b` unchanged.\n */\nexport function readSearchParamsRecord(url: string): Record<string, unknown> {\n  const record: Record<string, unknown> = {}\n  let params: URLSearchParams\n  try {\n    params = new URL(url).searchParams\n  } catch {\n    return record\n  }\n  params.forEach((value, key) => {\n    const existing = record[key]\n    if (existing === undefined) {\n      record[key] = value\n      return\n    }\n    if (Array.isArray(existing)) {\n      existing.push(value)\n      return\n    }\n    record[key] = [existing, value]\n  })\n  return record\n}\n\nfunction toSearchParams(query: Record<string, unknown>): URLSearchParams {\n  const params = new URLSearchParams()\n  for (const [key, value] of Object.entries(query)) {\n    if (value === null || value === undefined) continue\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        if (item === null || item === undefined) continue\n        params.append(key, String(item))\n      }\n      continue\n    }\n    params.append(key, String(value))\n  }\n  return params\n}\n\nfunction normalizeRoutePath(url: string): string {\n  try {\n    const pathname = new URL(url).pathname\n    if (pathname.startsWith('/api/')) return pathname.slice(5)\n    if (pathname === '/api') return ''\n    return pathname.replace(/^\\/+/, '')\n  } catch {\n    return ''\n  }\n}\n\nfunction toHeaderRecord(headers: Headers): Record<string, string> {\n  const output: Record<string, string> = {}\n  headers.forEach((value, key) => {\n    output[key] = value\n  })\n  return output\n}\n\nasync function resolveUserFeatures(scope: TimesheetInterceptorScope): Promise<string[]> {\n  if (scope.userFeatures) return [...scope.userFeatures]\n  if (!scope.userId) return []\n  try {\n    const rbac = scope.container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return []\n    return await rbac.getGrantedFeatures(scope.userId, {\n      tenantId: scope.tenantId ?? null,\n      organizationId: scope.organizationId ?? null,\n    })\n  } catch {\n    // An unreadable grant set gates every feature-scoped interceptor off rather\n    // than running it unauthorized.\n    return []\n  }\n}\n\nexport async function runTimesheetInterceptors(args: {\n  request: Request\n  method: ApiInterceptorMethod\n  scope: TimesheetInterceptorScope\n  /** `readJsonSafe` returns `null` for an unparseable body; that reaches here as `{}`. */\n  body?: Record<string, unknown> | null\n  query?: Record<string, unknown>\n}): Promise<TimesheetInterceptorRun> {\n  const { request, method, scope } = args\n  const tenantId = scope.tenantId || null\n  const resolvedOrganizationId = scope.organizationId || null\n  const organizationId = resolvedOrganizationId ?? (scope.tenantGlobal ? '' : null)\n  if (!tenantId || organizationId === null) {\n    const { translate } = await resolveTranslations()\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const routePath = normalizeRoutePath(request.url)\n  const headers = toHeaderRecord(request.headers)\n  const requestPayload: InterceptorRequest = {\n    method,\n    url: request.url,\n    body: args.body ?? {},\n    query: args.query ?? {},\n    headers,\n  }\n\n  // No interceptor targets this route and method, so neither pass can observe or\n  // change anything. Skipping here keeps the request off the RBAC grant read and the\n  // `em` resolve that assembling an interceptor context would otherwise cost on every\n  // call to every one of these routes.\n  if (getApiInterceptorsForRoute(routePath, method).length === 0) {\n    const query = requestPayload.query ?? {}\n    return {\n      ok: true,\n      session: {\n        body: requestPayload.body ?? {},\n        query,\n        searchParams: toSearchParams(query),\n        async respond(statusCode, body) {\n          return NextResponse.json(body, { status: statusCode })\n        },\n        async respondWithDescriptor(descriptor) {\n          return { ok: true, descriptor }\n        },\n      },\n    }\n  }\n\n  const context = {\n    userId: scope.userId ?? '',\n    organizationId,\n    tenantId,\n    em: scope.container.resolve('em') as EntityManager,\n    container: scope.container,\n    userFeatures: await resolveUserFeatures(scope),\n    extensionHeaders: parseExtensionHeaders(headers),\n  }\n\n  const before = await runApiInterceptorsBefore({\n    routePath,\n    method,\n    request: requestPayload,\n    context,\n  })\n  if (!before.ok) {\n    return { ok: false, response: NextResponse.json(before.body, { status: before.statusCode }) }\n  }\n\n  const interceptedRequest = before.request\n  const query = interceptedRequest.query ?? {}\n\n  const runAfter = async (body: Record<string, unknown>, statusCode: number) =>\n    runCustomRouteAfterInterceptors({\n      routePath,\n      method,\n      request: interceptedRequest,\n      response: { statusCode, body, headers: {} },\n      context,\n      metadataByInterceptor: before.metadataByInterceptor,\n    })\n\n  return {\n    ok: true,\n    session: {\n      body: interceptedRequest.body ?? {},\n      query,\n      searchParams: toSearchParams(query),\n      async respond(statusCode, body) {\n        const after = await runAfter(body, statusCode)\n        return NextResponse.json(after.body, {\n          status: after.statusCode,\n          ...(Object.keys(after.headers).length ? { headers: after.headers } : {}),\n        })\n      },\n      async respondWithDescriptor(descriptor) {\n        const after = await runAfter(descriptor, 200)\n        if (!after.ok) {\n          return {\n            ok: false,\n            response: NextResponse.json(after.body, { status: after.statusCode }),\n          }\n        }\n        return { ok: true, descriptor: after.body }\n      },\n    },\n  }\n}\n"],
+  "mappings": "AAuBA,SAAS,oBAAoB;AAO7B,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;AACzC,SAAS,uCAAuC;AAChD,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAqE7B,SAAS,uBAAuB,KAAsC;AAC3E,QAAM,SAAkC,CAAC;AACzC,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,CAAC,OAAO,QAAQ;AAC7B,UAAM,WAAW,OAAO,GAAG;AAC3B,QAAI,aAAa,QAAW;AAC1B,aAAO,GAAG,IAAI;AACd;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,eAAS,KAAK,KAAK;AACnB;AAAA,IACF;AACA,WAAO,GAAG,IAAI,CAAC,UAAU,KAAK;AAAA,EAChC,CAAC;AACD,SAAO;AACT;AAEA,SAAS,eAAe,OAAiD;AACvE,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,iBAAW,QAAQ,OAAO;AACxB,YAAI,SAAS,QAAQ,SAAS,OAAW;AACzC,eAAO,OAAO,KAAK,OAAO,IAAI,CAAC;AAAA,MACjC;AACA;AAAA,IACF;AACA,WAAO,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,QAAI,SAAS,WAAW,OAAO,EAAG,QAAO,SAAS,MAAM,CAAC;AACzD,QAAI,aAAa,OAAQ,QAAO;AAChC,WAAO,SAAS,QAAQ,QAAQ,EAAE;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,SAA0C;AAChE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,oBAAoB,OAAqD;AACtF,MAAI,MAAM,aAAc,QAAO,CAAC,GAAG,MAAM,YAAY;AACrD,MAAI,CAAC,MAAM,OAAQ,QAAO,CAAC;AAC3B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,QAAQ,aAAa;AAClD,QAAI,CAAC,MAAM,mBAAoB,QAAO,CAAC;AACvC,WAAO,MAAM,KAAK,mBAAmB,MAAM,QAAQ;AAAA,MACjD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,yBAAyB,MAOV;AACnC,QAAM,EAAE,SAAS,QAAQ,MAAM,IAAI;AACnC,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,yBAAyB,MAAM,kBAAkB;AACvD,QAAM,iBAAiB,2BAA2B,MAAM,eAAe,KAAK;AAC5E,MAAI,CAAC,YAAY,mBAAmB,MAAM;AACxC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE;AAAA,QACzF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,mBAAmB,QAAQ,GAAG;AAChD,QAAM,UAAU,eAAe,QAAQ,OAAO;AAC9C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB;AAAA,EACF;AAMA,MAAI,2BAA2B,WAAW,MAAM,EAAE,WAAW,GAAG;AAC9D,UAAMA,SAAQ,eAAe,SAAS,CAAC;AACvC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM,eAAe,QAAQ,CAAC;AAAA,QAC9B,OAAAA;AAAA,QACA,cAAc,eAAeA,MAAK;AAAA,QAClC,MAAM,QAAQ,YAAY,MAAM;AAC9B,iBAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,WAAW,CAAC;AAAA,QACvD;AAAA,QACA,MAAM,sBAAsB,YAAY;AACtC,iBAAO,EAAE,IAAI,MAAM,WAAW;AAAA,QAChC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,QAAQ,MAAM,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA,IAAI,MAAM,UAAU,QAAQ,IAAI;AAAA,IAChC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM,oBAAoB,KAAK;AAAA,IAC7C,kBAAkB,sBAAsB,OAAO;AAAA,EACjD;AAEA,QAAM,SAAS,MAAM,yBAAyB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,WAAW,CAAC,EAAE;AAAA,EAC9F;AAEA,QAAM,qBAAqB,OAAO;AAClC,QAAM,QAAQ,mBAAmB,SAAS,CAAC;AAE3C,QAAM,WAAW,OAAO,MAA+B,eACrD,gCAAgC;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU,EAAE,YAAY,MAAM,SAAS,CAAC,EAAE;AAAA,IAC1C;AAAA,IACA,uBAAuB,OAAO;AAAA,EAChC,CAAC;AAEH,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,MACP,MAAM,mBAAmB,QAAQ,CAAC;AAAA,MAClC;AAAA,MACA,cAAc,eAAe,KAAK;AAAA,MAClC,MAAM,QAAQ,YAAY,MAAM;AAC9B,cAAM,QAAQ,MAAM,SAAS,MAAM,UAAU;AAC7C,eAAO,aAAa,KAAK,MAAM,MAAM;AAAA,UACnC,QAAQ,MAAM;AAAA,UACd,GAAI,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,QACxE,CAAC;AAAA,MACH;AAAA,MACA,MAAM,sBAAsB,YAAY;AACtC,cAAM,QAAQ,MAAM,SAAS,YAAY,GAAG;AAC5C,YAAI,CAAC,MAAM,IAAI;AACb,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,UAAU,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,WAAW,CAAC;AAAA,UACtE;AAAA,QACF;AACA,eAAO,EAAE,IAAI,MAAM,YAAY,MAAM,KAAK;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["query"]
+}

package/dist/modules/staff/api/timesheets/access-requests/route.js

@@ -0,0 +1,226 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { StaffTeamMember, StaffTimeProject } from "../../../data/entities.js";
+import { emitStaffEvent } from "../../../events.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../guards.js";
+import { runTimesheetInterceptors } from "../_shared/withTimesheetInterceptors.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/access-requests" });
+const VIEW_FEATURE = "staff.timesheets.view";
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.accessRequest;
+const ACCESS_REQUEST_DEDUPE_WINDOW_MS = 24 * 60 * 60 * 1e3;
+const GENERAL_REQUEST_SCOPE = "general";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] }
+};
+const accessRequestSchema = z.object({
+  timeProjectId: z.string().uuid().nullish()
+});
+const accessRequestResponseSchema = z.object({
+  ok: z.literal(true),
+  deduplicated: z.boolean()
+});
+async function resolveAccessRequestContext(req) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(req);
+  const { translate } = await resolveTranslations();
+  if (!auth || !auth.tenantId) {
+    throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+  }
+  const requesterUserId = typeof auth.sub === "string" && auth.sub.trim().length > 0 && auth.sub || typeof auth.userId === "string" && auth.userId.trim().length > 0 && auth.userId || null;
+  if (!requesterUserId) {
+    throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+  }
+  if (!auth.orgId) {
+    throw new CrudHttpError(400, {
+      error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+    });
+  }
+  return {
+    container,
+    em: container.resolve("em").fork(),
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    requesterUserId,
+    requesterEmail: typeof auth.email === "string" && auth.email.trim().length > 0 ? auth.email : null,
+    translate
+  };
+}
+function resolveDedupeCache(context) {
+  try {
+    const cache = context.container.resolve("cache");
+    if (typeof cache?.get !== "function" || typeof cache?.set !== "function") return null;
+    return cache;
+  } catch {
+    return null;
+  }
+}
+function buildAccessRequestDedupeKey(input) {
+  const scope = input.timeProjectId ?? GENERAL_REQUEST_SCOPE;
+  return `staff:timesheets:access-request:${input.tenantId}:${input.organizationId}:${input.requesterUserId}:${scope}`;
+}
+async function resolveRequestedProject(context, timeProjectId) {
+  if (!timeProjectId) return null;
+  const scope = { tenantId: context.tenantId, organizationId: context.organizationId };
+  const project = await findOneWithDecryption(
+    context.em,
+    StaffTimeProject,
+    { id: timeProjectId, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },
+    {},
+    scope
+  );
+  if (!project) return null;
+  return { id: project.id, name: project.name };
+}
+async function resolveRequesterName(context) {
+  const scope = { tenantId: context.tenantId, organizationId: context.organizationId };
+  const staffMember = await findOneWithDecryption(
+    context.em,
+    StaffTeamMember,
+    {
+      userId: context.requesterUserId,
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      deletedAt: null
+    },
+    {},
+    scope
+  );
+  const displayName = staffMember?.displayName;
+  if (typeof displayName === "string" && displayName.trim().length > 0) return displayName;
+  return context.requesterEmail ?? context.requesterUserId;
+}
+async function POST(req) {
+  try {
+    const context = await resolveAccessRequestContext(req);
+    const grantedFeatures = (await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId
+    })).grantedFeatures;
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "POST",
+      scope: {
+        container: context.container,
+        userId: context.requesterUserId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userFeatures: grantedFeatures
+      },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const parsed = accessRequestSchema.parse(session.body);
+    const guardResult = await runRouteMutationGuards({
+      container: context.container,
+      req,
+      auth: {
+        userId: context.requesterUserId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userFeatures: grantedFeatures
+      },
+      input: {
+        resourceKind: RESOURCE_KIND,
+        resourceId: parsed.timeProjectId ?? GENERAL_REQUEST_SCOPE,
+        operation: "create",
+        mutationPayload: { timeProjectId: parsed.timeProjectId ?? null }
+      }
+    });
+    if (!guardResult.ok) return guardResult.response;
+    const effective = guardResult.modifiedPayload ? accessRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload }) : parsed;
+    const project = await resolveRequestedProject(context, effective.timeProjectId ?? null);
+    const dedupeKey = buildAccessRequestDedupeKey({
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      requesterUserId: context.requesterUserId,
+      timeProjectId: project?.id ?? null
+    });
+    const cache = resolveDedupeCache(context);
+    if (cache) {
+      const pending = await cache.get(dedupeKey).catch(() => null);
+      if (pending != null) {
+        await guardResult.runAfterSuccess();
+        return session.respond(200, { ok: true, deduplicated: true });
+      }
+    }
+    const requesterName = await resolveRequesterName(context);
+    await emitStaffEvent("staff.timesheets.project_access.requested", {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      requesterUserId: context.requesterUserId,
+      requesterName,
+      timeProjectId: project?.id ?? null,
+      timeProjectName: project?.name ?? null,
+      requestedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (cache) {
+      await cache.set(dedupeKey, { requestedAt: Date.now() }, { ttl: ACCESS_REQUEST_DEDUPE_WINDOW_MS }).catch((err) => {
+        logger.warn("Failed to record the access-request dedupe window", { err });
+      });
+    }
+    await guardResult.runAfterSuccess();
+    return session.respond(200, { ok: true, deduplicated: false });
+  } catch (err) {
+    return errorResponse(err, "staff.timesheets.access-requests.POST failed");
+  }
+}
+async function errorResponse(err, message) {
+  if (isCrudHttpError(err)) {
+    return NextResponse.json(err.body, { status: err.status });
+  }
+  const { translate } = await resolveTranslations();
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: translate("staff.errors.invalid_request", "Invalid request"), details: err.issues },
+      { status: 400 }
+    );
+  }
+  logger.error(message, { err });
+  return NextResponse.json(
+    { error: translate("staff.errors.internal", "Internal server error") },
+    { status: 500 }
+  );
+}
+const postDoc = {
+  summary: "Request time tracking project access",
+  description: "Notifies every holder of staff.timesheets.projects.manage in the caller scope that a team member asked for project access. Omitting timeProjectId sends a general request from the no-assignments empty state.",
+  tags: ["Staff"],
+  requestBody: { schema: accessRequestSchema },
+  responses: [
+    {
+      status: 200,
+      description: "Access request accepted (deduplicated when an identical request is still pending)",
+      schema: accessRequestResponseSchema
+    }
+  ],
+  errors: [
+    { status: 400, description: "Invalid request body or missing organization scope" },
+    { status: 401, description: "Unauthorized" },
+    { status: 403, description: "Missing staff.timesheets.view" }
+  ]
+};
+const openApi = {
+  tag: "Staff",
+  summary: "Time tracking project access requests",
+  methods: {
+    POST: postDoc
+  }
+};
+export {
+  ACCESS_REQUEST_DEDUPE_WINDOW_MS,
+  POST,
+  buildAccessRequestDedupeKey,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/access-requests/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/access-requests/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTeamMember, StaffTimeProject } from '../../../data/entities'\nimport { emitStaffEvent } from '../../../events'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../guards'\nimport { runTimesheetInterceptors } from '../_shared/withTimesheetInterceptors'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/access-requests' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.accessRequest\n\n/**\n * Spec D-6: one pending request per user per project (or per user for the\n * general, project-less request) per 24h. The window is held in the shared\n * cache rather than a table \u2014 the notification itself carries a `groupKey`, so\n * even if the cache is cold the manager still sees a single refreshed\n * notification instead of a duplicate row.\n */\nexport const ACCESS_REQUEST_DEDUPE_WINDOW_MS = 24 * 60 * 60 * 1000\n\nconst GENERAL_REQUEST_SCOPE = 'general'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst accessRequestSchema = z.object({\n  timeProjectId: z.string().uuid().nullish(),\n})\n\nconst accessRequestResponseSchema = z.object({\n  ok: z.literal(true),\n  deduplicated: z.boolean(),\n})\n\ntype DedupeCacheLike = {\n  get: (key: string) => Promise<unknown>\n  set: (key: string, value: unknown, options?: { ttl?: number }) => Promise<void>\n}\n\ntype AccessRequestContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n  requesterUserId: string\n  requesterEmail: string | null\n  translate: (key: string, fallback?: string) => string\n}\n\nasync function resolveAccessRequestContext(req: Request): Promise<AccessRequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n  const requesterUserId =\n    (typeof auth.sub === 'string' && auth.sub.trim().length > 0 && auth.sub) ||\n    (typeof auth.userId === 'string' && auth.userId.trim().length > 0 && auth.userId) ||\n    null\n  if (!requesterUserId) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n  if (!auth.orgId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return {\n    container,\n    em: (container.resolve('em') as EntityManager).fork(),\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    requesterUserId,\n    requesterEmail: typeof auth.email === 'string' && auth.email.trim().length > 0 ? auth.email : null,\n    translate,\n  }\n}\n\nfunction resolveDedupeCache(context: AccessRequestContext): DedupeCacheLike | null {\n  try {\n    const cache = context.container.resolve('cache') as Partial<DedupeCacheLike> | undefined\n    if (typeof cache?.get !== 'function' || typeof cache?.set !== 'function') return null\n    return cache as DedupeCacheLike\n  } catch {\n    return null\n  }\n}\n\nexport function buildAccessRequestDedupeKey(input: {\n  tenantId: string\n  organizationId: string\n  requesterUserId: string\n  timeProjectId: string | null\n}): string {\n  const scope = input.timeProjectId ?? GENERAL_REQUEST_SCOPE\n  return `staff:timesheets:access-request:${input.tenantId}:${input.organizationId}:${input.requesterUserId}:${scope}`\n}\n\n/**\n * Resolves the requested project inside the caller's scope. A project the\n * caller's tenant/organization does not own resolves to `null` and the request\n * degrades to a general one \u2014 the response never differentiates, so the route\n * cannot be used to probe which project ids exist (screen 17 note 1).\n */\nasync function resolveRequestedProject(\n  context: AccessRequestContext,\n  timeProjectId: string | null,\n): Promise<{ id: string; name: string } | null> {\n  if (!timeProjectId) return null\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const project = await findOneWithDecryption(\n    context.em,\n    StaffTimeProject,\n    { id: timeProjectId, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!project) return null\n  return { id: project.id, name: project.name }\n}\n\nasync function resolveRequesterName(context: AccessRequestContext): Promise<string> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const staffMember = await findOneWithDecryption(\n    context.em,\n    StaffTeamMember,\n    {\n      userId: context.requesterUserId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const displayName = staffMember?.displayName\n  if (typeof displayName === 'string' && displayName.trim().length > 0) return displayName\n  return context.requesterEmail ?? context.requesterUserId\n}\n\nasync function POST(req: Request) {\n  try {\n    const context = await resolveAccessRequestContext(req)\n    // The grant list the interceptors and the mutation-guard registry gate on\n    // comes from the module's single RBAC authority, so it is always an array:\n    // the nullable read it replaces could not say whether an empty answer meant\n    // \"no grants\" or \"could not ask\". Authorization itself stays with the\n    // declarative `requireFeatures` guard in `metadata`.\n    const grantedFeatures = (\n      await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n      })\n    ).grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: {\n        container: context.container,\n        userId: context.requesterUserId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userFeatures: grantedFeatures,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = accessRequestSchema.parse(session.body)\n\n    const guardResult = await runRouteMutationGuards({\n      container: context.container,\n      req,\n      auth: {\n        userId: context.requesterUserId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: parsed.timeProjectId ?? GENERAL_REQUEST_SCOPE,\n        operation: 'create',\n        mutationPayload: { timeProjectId: parsed.timeProjectId ?? null },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? accessRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const project = await resolveRequestedProject(context, effective.timeProjectId ?? null)\n    const dedupeKey = buildAccessRequestDedupeKey({\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      requesterUserId: context.requesterUserId,\n      timeProjectId: project?.id ?? null,\n    })\n\n    const cache = resolveDedupeCache(context)\n    if (cache) {\n      const pending = await cache.get(dedupeKey).catch(() => null)\n      if (pending != null) {\n        await guardResult.runAfterSuccess()\n        return session.respond(200, { ok: true, deduplicated: true })\n      }\n    }\n\n    const requesterName = await resolveRequesterName(context)\n    await emitStaffEvent('staff.timesheets.project_access.requested', {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      requesterUserId: context.requesterUserId,\n      requesterName,\n      timeProjectId: project?.id ?? null,\n      timeProjectName: project?.name ?? null,\n      requestedAt: new Date().toISOString(),\n    })\n\n    if (cache) {\n      await cache\n        .set(dedupeKey, { requestedAt: Date.now() }, { ttl: ACCESS_REQUEST_DEDUPE_WINDOW_MS })\n        .catch((err: unknown) => {\n          logger.warn('Failed to record the access-request dedupe window', { err })\n        })\n    }\n\n    await guardResult.runAfterSuccess()\n\n    return session.respond(200, { ok: true, deduplicated: false })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.access-requests.POST failed')\n  }\n}\n\nasync function errorResponse(err: unknown, message: string) {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json(\n    { error: translate('staff.errors.internal', 'Internal server error') },\n    { status: 500 },\n  )\n}\n\nconst postDoc: OpenApiMethodDoc = {\n  summary: 'Request time tracking project access',\n  description:\n    'Notifies every holder of staff.timesheets.projects.manage in the caller scope that a team member asked for project access. Omitting timeProjectId sends a general request from the no-assignments empty state.',\n  tags: ['Staff'],\n  requestBody: { schema: accessRequestSchema },\n  responses: [\n    {\n      status: 200,\n      description: 'Access request accepted (deduplicated when an identical request is still pending)',\n      schema: accessRequestResponseSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid request body or missing organization scope' },\n    { status: 401, description: 'Unauthorized' },\n    { status: 403, description: 'Missing staff.timesheets.view' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time tracking project access requests',\n  methods: {\n    POST: postDoc,\n  },\n}\n\nexport { POST }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AAEtC,SAAS,iBAAiB,wBAAwB;AAClD,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AAErC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,iCAAiC,CAAC;AAE1F,MAAM,eAAe;AACrB,MAAM,gBAAgB,mCAAmC;AASlD,MAAM,kCAAkC,KAAK,KAAK,KAAK;AAE9D,MAAM,wBAAwB;AAEvB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ;AAC3C,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,cAAc,EAAE,QAAQ;AAC1B,CAAC;AAiBD,eAAe,4BAA4B,KAA6C;AACtF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AACA,QAAM,kBACH,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,KAAK,KAAK,OACnE,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,KAAK,KAAK,UAC1E;AACF,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,KAAK,OAAO;AACf,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL;AAAA,IACA,IAAK,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACpD,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA,gBAAgB,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,IAAI,KAAK,QAAQ;AAAA,IAC9F;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,SAAuD;AACjF,MAAI;AACF,UAAM,QAAQ,QAAQ,UAAU,QAAQ,OAAO;AAC/C,QAAI,OAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,QAAQ,WAAY,QAAO;AACjF,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,4BAA4B,OAKjC;AACT,QAAM,QAAQ,MAAM,iBAAiB;AACrC,SAAO,mCAAmC,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,MAAM,eAAe,IAAI,KAAK;AACpH;AAQA,eAAe,wBACb,SACA,eAC8C;AAC9C,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,UAAU,MAAM;AAAA,IACpB,QAAQ;AAAA,IACR;AAAA,IACA,EAAE,IAAI,eAAe,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,IACzG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,EAAE,IAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK;AAC9C;AAEA,eAAe,qBAAqB,SAAgD;AAClF,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,cAAc,MAAM;AAAA,IACxB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,cAAc,aAAa;AACjC,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,EAAG,QAAO;AAC7E,SAAO,QAAQ,kBAAkB,QAAQ;AAC3C;AAEA,eAAe,KAAK,KAAc;AAChC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,GAAG;AAMrD,UAAM,mBACJ,MAAM,qBAAqB,QAAQ,WAAW,QAAQ,iBAAiB,CAAC,YAAY,GAAG;AAAA,MACrF,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC,GACD;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,oBAAoB,MAAM,QAAQ,IAAI;AAErD,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY,OAAO,iBAAiB;AAAA,QACpC,WAAW;AAAA,QACX,iBAAiB,EAAE,eAAe,OAAO,iBAAiB,KAAK;AAAA,MACjE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,oBAAoB,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IACvE;AAEJ,UAAM,UAAU,MAAM,wBAAwB,SAAS,UAAU,iBAAiB,IAAI;AACtF,UAAM,YAAY,4BAA4B;AAAA,MAC5C,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,SAAS,MAAM;AAAA,IAChC,CAAC;AAED,UAAM,QAAQ,mBAAmB,OAAO;AACxC,QAAI,OAAO;AACT,YAAM,UAAU,MAAM,MAAM,IAAI,SAAS,EAAE,MAAM,MAAM,IAAI;AAC3D,UAAI,WAAW,MAAM;AACnB,cAAM,YAAY,gBAAgB;AAClC,eAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,cAAc,KAAK,CAAC;AAAA,MAC9D;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAM,qBAAqB,OAAO;AACxD,UAAM,eAAe,6CAA6C;AAAA,MAChE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB;AAAA,MACA,eAAe,SAAS,MAAM;AAAA,MAC9B,iBAAiB,SAAS,QAAQ;AAAA,MAClC,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC,CAAC;AAED,QAAI,OAAO;AACT,YAAM,MACH,IAAI,WAAW,EAAE,aAAa,KAAK,IAAI,EAAE,GAAG,EAAE,KAAK,gCAAgC,CAAC,EACpF,MAAM,CAAC,QAAiB;AACvB,eAAO,KAAK,qDAAqD,EAAE,IAAI,CAAC;AAAA,MAC1E,CAAC;AAAA,IACL;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,cAAc,MAAM,CAAC;AAAA,EAC/D,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,8CAA8C;AAAA,EAC1E;AACF;AAEA,eAAe,cAAc,KAAc,SAAiB;AAC1D,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,MAAM,UAA4B;AAAA,EAChC,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,OAAO;AAAA,EACd,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qDAAqD;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,IAC3C,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,EAC9D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/my-projects/[projectId]/route.js

@@ -10,11 +10,12 @@ import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { StaffTimeProjectMember, StaffTeamMember } from "../../../../data/entities.js";
 import { staffMyProjectVisibilityUpdateSchema } from "../../../../data/validators.js";
 import {
-  resolveUserFeatures,
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../../guards.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { runTimesheetInterceptors } from "../../_shared/withTimesheetInterceptors.js";
 const logger = createLogger("staff");
 const metadata = {
   PATCH: { requireAuth: true, requireFeatures: ["staff.timesheets.manage_own"] }
@@ -50,8 +51,15 @@ async function PATCH(req) {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
       });
     }
-    const rawBody = await readJsonSafe(req, {});
-    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(rawBody);
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "PATCH",
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(session.body);
     if (!parsed.success) {
       throw new CrudHttpError(400, {
         error: translate("staff.timesheets.errors.invalidBody", "Invalid request body."),
@@ -97,14 +105,13 @@ async function PATCH(req) {
         tenantId,
         organizationId,
         userId: auth.sub ?? "",
-        resourceKind: "staff.timesheets.time_project_member",
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,
         resourceId: membership.id,
         operation: "update",
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: parsed.data
-      },
-      resolveUserFeatures(auth)
+      }
     );
     if (!guardResult.ok) {
       return NextResponse.json(
@@ -119,14 +126,14 @@ async function PATCH(req) {
         tenantId,
         organizationId,
         userId: auth.sub ?? "",
-        resourceKind: "staff.timesheets.time_project_member",
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,
         resourceId: membership.id,
         operation: "update",
         requestMethod: req.method,
         requestHeaders: req.headers
       });
     }
-    return NextResponse.json({ ok: true, showInGrid: membership.showInGrid }, { status: 200 });
+    return session.respond(200, { ok: true, showInGrid: membership.showInGrid });
   } catch (err) {
     if (err instanceof CrudHttpError) {
       return NextResponse.json(err.body, { status: err.status });

package/dist/modules/staff/api/timesheets/my-projects/[projectId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/my-projects/%5BprojectId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../../data/entities'\nimport { staffMyProjectVisibilityUpdateSchema } from '../../../../data/validators'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nfunction extractProjectIdFromUrl(req: Request): string | null {\n  try {\n    const url = new URL(req.url)\n    const match = url.pathname.match(/\\/my-projects\\/([^/]+)(?:\\/|$)/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\n/**\n * PATCH /api/staff/timesheets/my-projects/{projectId}\n *\n * Self-service endpoint for the authenticated user to toggle visibility of a\n * time project on their own My Timesheets grid. Does not require the admin-only\n * `staff.timesheets.projects.manage` feature \u2014 only `staff.timesheets.manage_own`.\n *\n * Added 2026-04-13 to close a gap in the original UX enhancements spec:\n * \"+ Add row\" and the new X remove button need to persist per-user grid membership.\n */\nexport async function PATCH(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const projectId = extractProjectIdFromUrl(req)\n    if (!projectId || !z.string().uuid().safeParse(projectId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidProjectId', 'Invalid project id.'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const rawBody = await readJsonSafe(req, {})\n    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(rawBody)\n    if (!parsed.success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidBody', 'Invalid request body.'),\n        details: parsed.error.flatten(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.'),\n      })\n    }\n\n    const membership = await findOneWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      {\n        timeProjectId: projectId,\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        status: 'active',\n      },\n      {},\n      scopeCtx,\n    )\n    if (!membership) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.notAssigned', 'You are not assigned to this project.'),\n      })\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_project_member',\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: parsed.data as unknown as Record<string, unknown>,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    membership.showInGrid = parsed.data.showInGrid\n    await em.flush()\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_project_member',\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true, showInGrid: membership.showInGrid }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects.patch failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.updateMyProject', 'Failed to update project visibility.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My project grid visibility',\n  methods: {\n    PATCH: {\n      summary: 'Toggle grid visibility for one of the caller\\'s assigned time projects',\n      description:\n        'Self-service endpoint. Only the authenticated user can toggle `show_in_grid` on their own active membership for the given project. Does not require the admin-only `staff.timesheets.projects.manage` feature.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffMyProjectVisibilityUpdateSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Visibility updated',\n          schema: z.object({ ok: z.boolean(), showInGrid: z.boolean() }),\n        },\n        { status: 400, description: 'Invalid input', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Project membership not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAG7B,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEA,SAAS,wBAAwB,KAA6B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,IAAI,SAAS,MAAM,gCAAgC;AACjE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,YAAY,wBAAwB,GAAG;AAC7C,QAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,EAAE,SAAS;AACjE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,4CAA4C,qBAAqB;AAAA,MACpF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,MAAM,aAAa,KAAK,CAAC,CAAC;AAC1C,UAAM,SAAS,qCAAqC,UAAU,OAAO;AACrE,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uBAAuB;AAAA,QAC/E,SAAS,OAAO,MAAM,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,yCAAyC;AAAA,MACrG,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,eAAe;AAAA,QACf,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uCAAuC;AAAA,MACjG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB,OAAO;AAAA,MAC1B;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,eAAW,aAAa,OAAO,KAAK;AACpC,UAAM,GAAG,MAAM;AAEf,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,YAAY,WAAW,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6CAA6C,EAAE,IAAI,CAAC;AACjE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,2CAA2C,sCAAsC,EAAE;AAAA,MACtG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../../data/entities'\nimport { staffMyProjectVisibilityUpdateSchema } from '../../../../data/validators'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nfunction extractProjectIdFromUrl(req: Request): string | null {\n  try {\n    const url = new URL(req.url)\n    const match = url.pathname.match(/\\/my-projects\\/([^/]+)(?:\\/|$)/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\n/**\n * PATCH /api/staff/timesheets/my-projects/{projectId}\n *\n * Self-service endpoint for the authenticated user to toggle visibility of a\n * time project on their own My Timesheets grid. Does not require the admin-only\n * `staff.timesheets.projects.manage` feature \u2014 only `staff.timesheets.manage_own`.\n *\n * Added 2026-04-13 to close a gap in the original UX enhancements spec:\n * \"+ Add row\" and the new X remove button need to persist per-user grid membership.\n */\nexport async function PATCH(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const projectId = extractProjectIdFromUrl(req)\n    if (!projectId || !z.string().uuid().safeParse(projectId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidProjectId', 'Invalid project id.'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(session.body)\n    if (!parsed.success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidBody', 'Invalid request body.'),\n        details: parsed.error.flatten(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.'),\n      })\n    }\n\n    const membership = await findOneWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      {\n        timeProjectId: projectId,\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        status: 'active',\n      },\n      {},\n      scopeCtx,\n    )\n    if (!membership) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.notAssigned', 'You are not assigned to this project.'),\n      })\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: parsed.data as unknown as Record<string, unknown>,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    membership.showInGrid = parsed.data.showInGrid\n    await em.flush()\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true, showInGrid: membership.showInGrid })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects.patch failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.updateMyProject', 'Failed to update project visibility.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My project grid visibility',\n  methods: {\n    PATCH: {\n      summary: 'Toggle grid visibility for one of the caller\\'s assigned time projects',\n      description:\n        'Self-service endpoint. Only the authenticated user can toggle `show_in_grid` on their own active membership for the given project. Does not require the admin-only `staff.timesheets.projects.manage` feature.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffMyProjectVisibilityUpdateSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Visibility updated',\n          schema: z.object({ ok: z.boolean(), showInGrid: z.boolean() }),\n        },\n        { status: 400, description: 'Invalid input', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Project membership not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAG7B,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEA,SAAS,wBAAwB,KAA6B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,IAAI,SAAS,MAAM,gCAAgC;AACjE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,YAAY,wBAAwB,GAAG;AAC7C,QAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,EAAE,SAAS;AACjE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,4CAA4C,qBAAqB;AAAA,MACpF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,qCAAqC,UAAU,QAAQ,IAAI;AAC1E,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uBAAuB;AAAA,QAC/E,SAAS,OAAO,MAAM,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,yCAAyC;AAAA,MACrG,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,eAAe;AAAA,QACf,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uCAAuC;AAAA,MACjG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB,OAAO;AAAA,MAC1B;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,eAAW,aAAa,OAAO,KAAK;AACpC,UAAM,GAAG,MAAM;AAEf,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,YAAY,WAAW,WAAW,CAAC;AAAA,EAC7E,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6CAA6C,EAAE,IAAI,CAAC;AACjE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,2CAA2C,sCAAsC,EAAE;AAAA,MACtG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/my-projects/route.js

@@ -8,6 +8,10 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { StaffTimeProjectMember, StaffTeamMember } from "../../../data/entities.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  readSearchParamsRecord,
+  runTimesheetInterceptors
+} from "../_shared/withTimesheetInterceptors.js";
 const logger = createLogger("staff");
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["staff.timesheets.view"] }
@@ -24,6 +28,14 @@ async function GET(req) {
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "GET",
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      query: readSearchParamsRecord(req.url)
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
     const em = container.resolve("em").fork();
     const scopeCtx = { tenantId, organizationId };
     const staffMember = await findOneWithDecryption(
@@ -53,7 +65,7 @@ async function GET(req) {
       assigned_end_date: assignment.assignedEndDate ?? null,
       show_in_grid: assignment.showInGrid ?? false
     }));
-    return NextResponse.json({ items, total: items.length }, { status: 200 });
+    return session.respond(200, { items, total: items.length });
   } catch (err) {
     if (err instanceof CrudHttpError) {
       return NextResponse.json(err.body, { status: err.status });

package/dist/modules/staff/api/timesheets/my-projects/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/my-projects/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n}\n\n/**\n * GET /api/staff/timesheets/my-projects\n *\n * Spec N+1 Mitigation \u2014 Query 1:\n * Returns staff_time_project_members for the authenticated staff member.\n * Used by \"My Timesheets\" grid to resolve assigned project IDs.\n */\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n\n    const assignments = await findWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      { staffMemberId: staffMember.id, tenantId, organizationId, deletedAt: null, status: 'active' },\n      {},\n      scopeCtx,\n    )\n\n    const items = assignments.map((assignment) => ({\n      id: assignment.id,\n      time_project_id: assignment.timeProjectId,\n      staff_member_id: assignment.staffMemberId,\n      role: assignment.role ?? null,\n      status: assignment.status ?? null,\n      assigned_start_date: assignment.assignedStartDate ?? null,\n      assigned_end_date: assignment.assignedEndDate ?? null,\n      show_in_grid: assignment.showInGrid ?? false,\n    }))\n\n    return NextResponse.json({ items, total: items.length }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.myProjects', 'Failed to load your projects.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My assigned time projects',\n  methods: {\n    GET: {\n      summary: 'List assigned time project memberships for the current user',\n      description: 'Returns staff_time_project_members where the authenticated user is an active member. Used by the My Timesheets grid to resolve assigned project IDs (spec N+1 mitigation query 1).',\n      responses: [\n        {\n          status: 200,\n          description: 'Assigned project memberships',\n          schema: z.object({\n            items: z.array(z.object({\n              id: z.string().uuid(),\n              time_project_id: z.string().uuid(),\n              staff_member_id: z.string().uuid(),\n              role: z.string().nullable(),\n              status: z.string().nullable(),\n              assigned_start_date: z.string().nullable(),\n              assigned_end_date: z.string().nullable(),\n              show_in_grid: z.boolean(),\n            })),\n            total: z.number(),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,6BAA6B;AAG1D,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AASA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,WAAW,MAAM,QAAQ,SAAS;AAAA,MAC7F,CAAC;AAAA,MACD;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC7C,IAAI,WAAW;AAAA,MACf,iBAAiB,WAAW;AAAA,MAC5B,iBAAiB,WAAW;AAAA,MAC5B,MAAM,WAAW,QAAQ;AAAA,MACzB,QAAQ,WAAW,UAAU;AAAA,MAC7B,qBAAqB,WAAW,qBAAqB;AAAA,MACrD,mBAAmB,WAAW,mBAAmB;AAAA,MACjD,cAAc,WAAW,cAAc;AAAA,IACzC,EAAE;AAEF,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE;AAAA,MAC1F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,cAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC5B,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,cACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,cACvC,cAAc,EAAE,QAAQ;AAAA,YAC1B,CAAC,CAAC;AAAA,YACF,OAAO,EAAE,OAAO;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n}\n\n/**\n * GET /api/staff/timesheets/my-projects\n *\n * Spec N+1 Mitigation \u2014 Query 1:\n * Returns staff_time_project_members for the authenticated staff member.\n * Used by \"My Timesheets\" grid to resolve assigned project IDs.\n */\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n\n    const assignments = await findWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      { staffMemberId: staffMember.id, tenantId, organizationId, deletedAt: null, status: 'active' },\n      {},\n      scopeCtx,\n    )\n\n    const items = assignments.map((assignment) => ({\n      id: assignment.id,\n      time_project_id: assignment.timeProjectId,\n      staff_member_id: assignment.staffMemberId,\n      role: assignment.role ?? null,\n      status: assignment.status ?? null,\n      assigned_start_date: assignment.assignedStartDate ?? null,\n      assigned_end_date: assignment.assignedEndDate ?? null,\n      show_in_grid: assignment.showInGrid ?? false,\n    }))\n\n    return session.respond(200, { items, total: items.length })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.myProjects', 'Failed to load your projects.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My assigned time projects',\n  methods: {\n    GET: {\n      summary: 'List assigned time project memberships for the current user',\n      description: 'Returns staff_time_project_members where the authenticated user is an active member. Used by the My Timesheets grid to resolve assigned project IDs (spec N+1 mitigation query 1).',\n      responses: [\n        {\n          status: 200,\n          description: 'Assigned project memberships',\n          schema: z.object({\n            items: z.array(z.object({\n              id: z.string().uuid(),\n              time_project_id: z.string().uuid(),\n              staff_member_id: z.string().uuid(),\n              role: z.string().nullable(),\n              status: z.string().nullable(),\n              assigned_start_date: z.string().nullable(),\n              assigned_end_date: z.string().nullable(),\n              show_in_grid: z.boolean(),\n            })),\n            total: z.number(),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,6BAA6B;AAG1D,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AASA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,WAAW,MAAM,QAAQ,SAAS;AAAA,MAC7F,CAAC;AAAA,MACD;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC7C,IAAI,WAAW;AAAA,MACf,iBAAiB,WAAW;AAAA,MAC5B,iBAAiB,WAAW;AAAA,MAC5B,MAAM,WAAW,QAAQ;AAAA,MACzB,QAAQ,WAAW,UAAU;AAAA,MAC7B,qBAAqB,WAAW,qBAAqB;AAAA,MACrD,mBAAmB,WAAW,mBAAmB;AAAA,MACjD,cAAc,WAAW,cAAc;AAAA,IACzC,EAAE;AAEF,WAAO,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE;AAAA,MAC1F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,cAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC5B,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,cACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,cACvC,cAAc,EAAE,QAAQ;AAAA,YAC1B,CAAC,CAAC;AAAA,YACF,OAAO,EAAE,OAAO;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/my-work/myWorkAggregate.js

@@ -0,0 +1,42 @@
+import { countWorkingDays } from "../../../lib/time-tracking-ui/timesheetPeriod.js";
+function buildMyWorkKpis(totals, ranges, dailyHours) {
+  const hasTarget = typeof dailyHours === "number" && Number.isFinite(dailyHours) && dailyHours > 0;
+  const weekWorkingDays = countWorkingDays(ranges.week);
+  const monthWorkingDays = countWorkingDays(ranges.month);
+  const dailyTargetMinutes = hasTarget ? Math.round(dailyHours * 60) : null;
+  return {
+    ...totals,
+    dailyTargetMinutes,
+    weekTargetMinutes: dailyTargetMinutes === null ? null : dailyTargetMinutes * weekWorkingDays,
+    monthTargetMinutes: dailyTargetMinutes === null ? null : dailyTargetMinutes * monthWorkingDays,
+    weekWorkingDays,
+    monthWorkingDays,
+    nonBillableSharePercent: totals.monthMinutes > 0 ? Math.round(totals.monthNonBillableMinutes / totals.monthMinutes * 1e3) / 10 : null
+  };
+}
+function toMinutes(value) {
+  if (value === null || value === void 0) return 0;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+function pickRecentTaskIds(entries, limit) {
+  const ordered = [...entries].sort((left, right) => {
+    if (left.date === right.date) return right.id.localeCompare(left.id);
+    return right.date.localeCompare(left.date);
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const picked = [];
+  for (const entry of ordered) {
+    if (!entry.taskId || seen.has(entry.taskId)) continue;
+    seen.add(entry.taskId);
+    picked.push(entry.taskId);
+    if (picked.length >= limit) break;
+  }
+  return picked;
+}
+export {
+  buildMyWorkKpis,
+  pickRecentTaskIds,
+  toMinutes
+};
+//# sourceMappingURL=myWorkAggregate.js.map

package/dist/modules/staff/api/timesheets/my-work/myWorkAggregate.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/my-work/myWorkAggregate.ts"],
+  "sourcesContent": ["/**\n * The arithmetic behind screen 1 (`GET /api/staff/timesheets/my-work`), kept out\n * of the route so the numbers a consultant reads first thing in the morning can\n * be tested without a database.\n *\n * Three rules it encodes:\n *\n *  1. **Targets scale with working days, not calendar days.** \"cel 8:00\" is one\n *     day; \"z 40:00\" is the week's Mon\u2013Fri days times the daily target; the month\n *     KPI's context is its working-day count. A tenant with no `targets.dailyHours`\n *     gets `null` everywhere rather than a zero to be under.\n *  2. **The non-billable KPI is a share of the month, and a share of nothing is\n *     `null`** \u2014 not `0%`, which would read as \"all your time is billable\".\n *  3. **Money never crosses currencies.** The payload carries no total cost at\n *     all: budget burn is per project, in that project's own terms, and the rate\n *     is only present for a caller who may see rates.\n */\n\nimport { countWorkingDays, type TimesheetDateRange } from '../../../lib/time-tracking-ui/timesheetPeriod'\n\nexport type MyWorkTotals = {\n  todayMinutes: number\n  weekMinutes: number\n  monthMinutes: number\n  monthNonBillableMinutes: number\n}\n\nexport type MyWorkKpis = MyWorkTotals & {\n  dailyTargetMinutes: number | null\n  weekTargetMinutes: number | null\n  monthTargetMinutes: number | null\n  weekWorkingDays: number\n  monthWorkingDays: number\n  /** Percent of the month that is non-billable, rounded to one decimal; `null` when nothing is logged. */\n  nonBillableSharePercent: number | null\n}\n\nexport function buildMyWorkKpis(\n  totals: MyWorkTotals,\n  ranges: { week: TimesheetDateRange; month: TimesheetDateRange },\n  dailyHours: number | null,\n): MyWorkKpis {\n  const hasTarget = typeof dailyHours === 'number' && Number.isFinite(dailyHours) && dailyHours > 0\n  const weekWorkingDays = countWorkingDays(ranges.week)\n  const monthWorkingDays = countWorkingDays(ranges.month)\n  const dailyTargetMinutes = hasTarget ? Math.round(dailyHours * 60) : null\n  return {\n    ...totals,\n    dailyTargetMinutes,\n    weekTargetMinutes: dailyTargetMinutes === null ? null : dailyTargetMinutes * weekWorkingDays,\n    monthTargetMinutes: dailyTargetMinutes === null ? null : dailyTargetMinutes * monthWorkingDays,\n    weekWorkingDays,\n    monthWorkingDays,\n    nonBillableSharePercent:\n      totals.monthMinutes > 0\n        ? Math.round((totals.monthNonBillableMinutes / totals.monthMinutes) * 1000) / 10\n        : null,\n  }\n}\n\nexport function toMinutes(value: string | number | null | undefined): number {\n  if (value === null || value === undefined) return 0\n  const parsed = typeof value === 'number' ? value : Number(value)\n  return Number.isFinite(parsed) ? parsed : 0\n}\n\n/**\n * The most recently worked tasks, newest first, de-duplicated. Screen 1's\n * \"Ostatnie zadania\" is a shortcut back into work already started, so it is\n * derived from the caller's own entries rather than from task assignment: a task\n * assigned but never touched is not something to resume.\n */\nexport function pickRecentTaskIds(\n  entries: readonly { taskId: string | null; date: string; id: string }[],\n  limit: number,\n): string[] {\n  const ordered = [...entries].sort((left, right) => {\n    if (left.date === right.date) return right.id.localeCompare(left.id)\n    return right.date.localeCompare(left.date)\n  })\n  const seen = new Set<string>()\n  const picked: string[] = []\n  for (const entry of ordered) {\n    if (!entry.taskId || seen.has(entry.taskId)) continue\n    seen.add(entry.taskId)\n    picked.push(entry.taskId)\n    if (picked.length >= limit) break\n  }\n  return picked\n}\n"],
+  "mappings": "AAkBA,SAAS,wBAAiD;AAmBnD,SAAS,gBACd,QACA,QACA,YACY;AACZ,QAAM,YAAY,OAAO,eAAe,YAAY,OAAO,SAAS,UAAU,KAAK,aAAa;AAChG,QAAM,kBAAkB,iBAAiB,OAAO,IAAI;AACpD,QAAM,mBAAmB,iBAAiB,OAAO,KAAK;AACtD,QAAM,qBAAqB,YAAY,KAAK,MAAM,aAAa,EAAE,IAAI;AACrE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,mBAAmB,uBAAuB,OAAO,OAAO,qBAAqB;AAAA,IAC7E,oBAAoB,uBAAuB,OAAO,OAAO,qBAAqB;AAAA,IAC9E;AAAA,IACA;AAAA,IACA,yBACE,OAAO,eAAe,IAClB,KAAK,MAAO,OAAO,0BAA0B,OAAO,eAAgB,GAAI,IAAI,KAC5E;AAAA,EACR;AACF;AAEO,SAAS,UAAU,OAAmD;AAC3E,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC/D,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAQO,SAAS,kBACd,SACA,OACU;AACV,QAAM,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,MAAM,UAAU;AACjD,QAAI,KAAK,SAAS,MAAM,KAAM,QAAO,MAAM,GAAG,cAAc,KAAK,EAAE;AACnE,WAAO,MAAM,KAAK,cAAc,KAAK,IAAI;AAAA,EAC3C,CAAC;AACD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,UAAU,KAAK,IAAI,MAAM,MAAM,EAAG;AAC7C,SAAK,IAAI,MAAM,MAAM;AACrB,WAAO,KAAK,MAAM,MAAM;AACxB,QAAI,OAAO,UAAU,MAAO;AAAA,EAC9B;AACA,SAAO;AACT;",
+  "names": []
+}