@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/my-work/route.js

@@ -0,0 +1,383 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  StaffTeamMember,
+  StaffTimeEntry,
+  StaffTimeProject,
+  StaffTimeProjectMember,
+  StaffTimeTask
+} from "../../../data/entities.js";
+import { computeProjectFinancials } from "../../../lib/timesheets-projects/computeProjectFinancials.js";
+import { computeBudgetBurn } from "../../../lib/timesheets-projects/budgetBurn.js";
+import {
+  addUtcDays,
+  getFirstDayOfMonthUtc,
+  getFirstDayOfNextMonthUtc,
+  getMondayUtc,
+  toDateOnlyString
+} from "../../../lib/timesheets-projects/dateBuckets.js";
+import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+import { buildMyWorkKpis, pickRecentTaskIds, toMinutes } from "./myWorkAggregate.js";
+import {
+  readSearchParamsRecord,
+  runTimesheetInterceptors
+} from "../_shared/withTimesheetInterceptors.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/my-work" });
+const VIEW_FEATURE = "staff.timesheets.view";
+const RATES_FEATURE = "staff.timesheets.rates.view";
+const RECENT_TASK_LIMIT = 5;
+const MAX_PROJECTS = 50;
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] }
+};
+const entrySchema = z.object({
+  id: z.string().uuid(),
+  date: z.string(),
+  taskId: z.string().uuid().nullable(),
+  taskTitle: z.string().nullable(),
+  timeProjectId: z.string().uuid().nullable(),
+  projectName: z.string().nullable(),
+  description: z.string().nullable(),
+  startedAt: z.string().nullable(),
+  endedAt: z.string().nullable(),
+  durationMinutes: z.number().int(),
+  isBillable: z.boolean(),
+  isLocked: z.boolean()
+});
+const projectSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  code: z.string().nullable(),
+  color: z.string().nullable(),
+  customerName: z.string().nullable(),
+  myMinutes: z.number().int(),
+  totalMinutes: z.number().int(),
+  hourlyRate: z.number().nullable().optional(),
+  currencyCode: z.string().nullable().optional(),
+  budget: z.object({
+    kind: z.enum(["hours", "amount"]),
+    budgetValue: z.number(),
+    usedValue: z.number(),
+    percent: z.number(),
+    barPercent: z.number(),
+    tone: z.string()
+  }).nullable()
+});
+const responseSchema = z.object({
+  staffMember: z.object({ id: z.string().uuid(), displayName: z.string() }).nullable(),
+  today: z.string(),
+  kpis: z.object({
+    todayMinutes: z.number().int(),
+    weekMinutes: z.number().int(),
+    monthMinutes: z.number().int(),
+    monthNonBillableMinutes: z.number().int(),
+    dailyTargetMinutes: z.number().int().nullable(),
+    weekTargetMinutes: z.number().int().nullable(),
+    monthTargetMinutes: z.number().int().nullable(),
+    weekWorkingDays: z.number().int(),
+    monthWorkingDays: z.number().int(),
+    nonBillableSharePercent: z.number().nullable()
+  }),
+  entries: z.array(entrySchema),
+  projects: z.array(projectSchema),
+  recentTasks: z.array(
+    z.object({
+      id: z.string().uuid(),
+      title: z.string(),
+      timeProjectId: z.string().uuid(),
+      projectName: z.string().nullable()
+    })
+  )
+});
+async function GET(req) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const { translate } = await resolveTranslations();
+    if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+      });
+    }
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "GET",
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      query: readSearchParamsRecord(req.url)
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const em = container.resolve("em");
+    const now = /* @__PURE__ */ new Date();
+    const todayDate = toDateOnlyString(now);
+    const weekStart = getMondayUtc(now);
+    const weekEnd = addUtcDays(weekStart, 6);
+    const monthStart = getFirstDayOfMonthUtc(now);
+    const nextMonthStart = getFirstDayOfNextMonthUtc(now);
+    const monthEnd = addUtcDays(nextMonthStart, -1);
+    let dailyHours = null;
+    try {
+      const configService = container.resolve("moduleConfigService");
+      dailyHours = (await readTimeTrackingSettings(configService, { tenantId })).targets.dailyHours;
+    } catch {
+      dailyHours = null;
+    }
+    const staffMember = await findOneWithDecryption(
+      em.fork(),
+      StaffTeamMember,
+      { userId: auth.sub, tenantId, organizationId, deletedAt: null },
+      {},
+      { tenantId, organizationId }
+    );
+    const emptyKpis = buildMyWorkKpis(
+      { todayMinutes: 0, weekMinutes: 0, monthMinutes: 0, monthNonBillableMinutes: 0 },
+      {
+        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },
+        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) }
+      },
+      dailyHours
+    );
+    if (!staffMember) {
+      return session.respond(200, {
+        staffMember: null,
+        today: todayDate,
+        kpis: emptyKpis,
+        entries: [],
+        projects: [],
+        recentTasks: []
+      });
+    }
+    const rbac = container.resolve("rbacService");
+    const canSeeMoney = await rbac?.userHasAllFeatures?.(auth.sub, [RATES_FEATURE], { tenantId, organizationId }) ?? false;
+    const totalsRows = await em.getConnection().execute(
+      `
+        SELECT
+          COALESCE(SUM(CASE WHEN date = ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS today_minutes,
+          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS week_minutes,
+          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS month_minutes,
+          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date AND is_billable = false THEN duration_minutes ELSE 0 END), 0)::bigint AS month_nonbillable_minutes
+        FROM staff_time_entries
+        WHERE tenant_id = ?
+          AND organization_id = ?
+          AND staff_member_id = ?
+          AND deleted_at IS NULL
+      `,
+      [
+        todayDate,
+        toDateOnlyString(weekStart),
+        toDateOnlyString(weekEnd),
+        toDateOnlyString(monthStart),
+        toDateOnlyString(monthEnd),
+        toDateOnlyString(monthStart),
+        toDateOnlyString(monthEnd),
+        tenantId,
+        organizationId,
+        staffMember.id
+      ]
+    );
+    const totals = totalsRows[0];
+    const kpis = buildMyWorkKpis(
+      {
+        todayMinutes: toMinutes(totals?.today_minutes),
+        weekMinutes: toMinutes(totals?.week_minutes),
+        monthMinutes: toMinutes(totals?.month_minutes),
+        monthNonBillableMinutes: toMinutes(totals?.month_nonbillable_minutes)
+      },
+      {
+        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },
+        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) }
+      },
+      dailyHours
+    );
+    const memberships = await em.fork().find(StaffTimeProjectMember, {
+      staffMemberId: staffMember.id,
+      tenantId,
+      organizationId,
+      status: "active",
+      deletedAt: null
+    });
+    const projectIds = Array.from(new Set(memberships.map((membership) => membership.timeProjectId))).slice(
+      0,
+      MAX_PROJECTS
+    );
+    const projects = projectIds.length > 0 ? await findWithDecryption(
+      em.fork(),
+      StaffTimeProject,
+      { id: { $in: projectIds }, tenantId, organizationId, deletedAt: null },
+      {},
+      { tenantId, organizationId }
+    ) : [];
+    const hourlyRateByProjectId = new Map(
+      projects.map((project) => [
+        project.id,
+        project.hourlyRate === null || project.hourlyRate === void 0 ? null : Number(project.hourlyRate)
+      ])
+    );
+    const [mine, everyone] = await Promise.all([
+      computeProjectFinancials({
+        em,
+        tenantId,
+        organizationId,
+        projectIds: projects.map((project) => project.id),
+        hourlyRateByProjectId,
+        staffMemberId: staffMember.id
+      }),
+      computeProjectFinancials({
+        em,
+        tenantId,
+        organizationId,
+        projectIds: projects.map((project) => project.id),
+        hourlyRateByProjectId
+      })
+    ]);
+    const todaysEntries = await findWithDecryption(
+      em.fork(),
+      StaffTimeEntry,
+      { staffMemberId: staffMember.id, tenantId, organizationId, date: /* @__PURE__ */ new Date(`${todayDate}T00:00:00.000Z`), deletedAt: null },
+      { orderBy: { startedAt: "asc", createdAt: "asc" } },
+      { tenantId, organizationId }
+    );
+    const recentEntries = await findWithDecryption(
+      em.fork(),
+      StaffTimeEntry,
+      {
+        staffMemberId: staffMember.id,
+        tenantId,
+        organizationId,
+        deletedAt: null,
+        taskId: { $ne: null }
+      },
+      { orderBy: { date: "desc" }, limit: 50 },
+      { tenantId, organizationId }
+    );
+    const recentTaskIds = pickRecentTaskIds(
+      recentEntries.map((entry) => ({
+        id: entry.id,
+        taskId: entry.taskId ?? null,
+        date: toDateOnlyString(new Date(entry.date))
+      })),
+      RECENT_TASK_LIMIT
+    );
+    const referencedTaskIds = Array.from(
+      /* @__PURE__ */ new Set([
+        ...recentTaskIds,
+        ...todaysEntries.map((entry) => entry.taskId).filter((id) => typeof id === "string")
+      ])
+    );
+    const tasks = referencedTaskIds.length > 0 ? await em.fork().find(StaffTimeTask, {
+      id: { $in: referencedTaskIds },
+      tenantId,
+      organizationId,
+      deletedAt: null
+    }) : [];
+    const taskById = new Map(tasks.map((task) => [task.id, task]));
+    const projectNameById = new Map(projects.map((project) => [project.id, project.name]));
+    const payload = {
+      staffMember: { id: staffMember.id, displayName: staffMember.displayName },
+      today: todayDate,
+      kpis,
+      entries: todaysEntries.map((entry) => ({
+        id: entry.id,
+        date: toDateOnlyString(new Date(entry.date)),
+        taskId: entry.taskId ?? null,
+        taskTitle: entry.taskId ? taskById.get(entry.taskId)?.title ?? null : null,
+        timeProjectId: entry.timeProjectId ?? null,
+        projectName: entry.timeProjectId ? projectNameById.get(entry.timeProjectId) ?? null : null,
+        description: entry.notes ?? null,
+        startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,
+        endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,
+        durationMinutes: entry.durationMinutes,
+        isBillable: entry.isBillable !== false,
+        isLocked: Boolean(entry.lockedReportId)
+      })),
+      projects: projects.map((project) => {
+        const myFinancials = mine.get(project.id);
+        const allFinancials = everyone.get(project.id);
+        const snapshot = project.customerSnapshot ?? null;
+        const customerName = snapshot && typeof snapshot === "object" && typeof snapshot.name === "string" ? snapshot.name : null;
+        const burn = project.budgetKind === "amount" && !canSeeMoney ? null : computeBudgetBurn({
+          kind: project.budgetKind,
+          budgetValue: project.budgetValue === null || project.budgetValue === void 0 ? null : Number(project.budgetValue),
+          warnAtPercent: project.budgetWarnAtPercent,
+          totalMinutes: allFinancials?.totalMinutes ?? 0,
+          cost: allFinancials?.cost ?? null
+        });
+        return {
+          id: project.id,
+          name: project.name,
+          code: project.code ?? null,
+          color: project.color ?? null,
+          customerName,
+          myMinutes: myFinancials?.totalMinutes ?? 0,
+          totalMinutes: allFinancials?.totalMinutes ?? 0,
+          ...canSeeMoney ? {
+            hourlyRate: hourlyRateByProjectId.get(project.id) ?? null,
+            currencyCode: project.currencyCode ?? null
+          } : {},
+          budget: burn ? {
+            kind: burn.kind,
+            budgetValue: burn.budgetValue,
+            usedValue: burn.usedValue,
+            percent: burn.percent,
+            barPercent: burn.barPercent,
+            tone: burn.tone
+          } : null
+        };
+      }),
+      recentTasks: recentTaskIds.map((taskId) => {
+        const task = taskById.get(taskId);
+        if (!task) return null;
+        return {
+          id: task.id,
+          title: task.title,
+          timeProjectId: task.timeProjectId,
+          projectName: projectNameById.get(task.timeProjectId) ?? null
+        };
+      }).filter((task) => task !== null)
+    };
+    return session.respond(200, payload);
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    logger.error("staff.timesheets.my-work failed", { err });
+    const { translate } = await resolveTranslations();
+    return NextResponse.json(
+      { error: translate("staff.time_tracking.myWork.errors.load", "Failed to load your work summary.") },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: "Staff",
+  summary: "My work dashboard aggregate",
+  methods: {
+    GET: {
+      summary: "Today, this week and this month for the calling staff member",
+      description: "One aggregate for the time tracking landing page: day/week/month/non-billable totals with working-day targets, today\u2019s entries, the caller\u2019s projects with budget burn, and the tasks they last logged against. Always scoped to the caller \u2014 there is no way to ask about another person. Rate and amount-budget fields are present only for holders of `staff.timesheets.rates.view`.",
+      responses: [
+        { status: 200, description: "My work summary", schema: responseSchema },
+        { status: 400, description: "Missing scope", schema: z.object({ error: z.string() }) },
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 500, description: "Aggregation failure", schema: z.object({ error: z.string() }) }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/my-work/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/my-work/route.ts"],
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/my-work` \u2014 the aggregate behind screen 1 (T5.6).\n *\n * The dashboard a Team Member lands on asks four questions at once (today, this\n * week, this month, how much of it is non-billable), then wants today's entries,\n * the projects they are on with their budget burn, and the tasks they last\n * touched. Answering that with the existing list routes would be six round trips\n * and three client-side aggregations of paginated data; this route answers it in\n * one, with the sums done by the database.\n *\n * Scoping and access:\n *\n *  * Everything is scoped to the CALLER's staff member. There is no\n *    `staffMemberId` parameter \u2014 this endpoint is \"mine\" by construction, so it\n *    can never become a way to read a colleague's day.\n *  * Projects come from the caller's own active memberships, which is the same\n *    set `resolveProjectAccess` would return for a non-manager. A manager sees\n *    their own memberships here too: My work is a personal surface, and the\n *    portfolio view is screen 3.\n *  * **Money is gated on `staff.timesheets.rates.view` and absent, not blanked**,\n *    for anyone else: no `hourlyRate`, no `currencyCode`, and no `amount` budget\n *    burn (which is a money statement). An `hours` budget is not money and stays.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport {\n  StaffTeamMember,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n  StaffTimeTask,\n} from '../../../data/entities'\nimport { computeProjectFinancials } from '../../../lib/timesheets-projects/computeProjectFinancials'\nimport { computeBudgetBurn } from '../../../lib/timesheets-projects/budgetBurn'\nimport {\n  addUtcDays,\n  getFirstDayOfMonthUtc,\n  getFirstDayOfNextMonthUtc,\n  getMondayUtc,\n  toDateOnlyString,\n} from '../../../lib/timesheets-projects/dateBuckets'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildMyWorkKpis, pickRecentTaskIds, toMinutes } from './myWorkAggregate'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/my-work' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst RATES_FEATURE = 'staff.timesheets.rates.view'\nconst RECENT_TASK_LIMIT = 5\nconst MAX_PROJECTS = 50\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\ntype RbacServiceLike = {\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\nconst entrySchema = z.object({\n  id: z.string().uuid(),\n  date: z.string(),\n  taskId: z.string().uuid().nullable(),\n  taskTitle: z.string().nullable(),\n  timeProjectId: z.string().uuid().nullable(),\n  projectName: z.string().nullable(),\n  description: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  endedAt: z.string().nullable(),\n  durationMinutes: z.number().int(),\n  isBillable: z.boolean(),\n  isLocked: z.boolean(),\n})\n\nconst projectSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  code: z.string().nullable(),\n  color: z.string().nullable(),\n  customerName: z.string().nullable(),\n  myMinutes: z.number().int(),\n  totalMinutes: z.number().int(),\n  hourlyRate: z.number().nullable().optional(),\n  currencyCode: z.string().nullable().optional(),\n  budget: z\n    .object({\n      kind: z.enum(['hours', 'amount']),\n      budgetValue: z.number(),\n      usedValue: z.number(),\n      percent: z.number(),\n      barPercent: z.number(),\n      tone: z.string(),\n    })\n    .nullable(),\n})\n\nconst responseSchema = z.object({\n  staffMember: z.object({ id: z.string().uuid(), displayName: z.string() }).nullable(),\n  today: z.string(),\n  kpis: z.object({\n    todayMinutes: z.number().int(),\n    weekMinutes: z.number().int(),\n    monthMinutes: z.number().int(),\n    monthNonBillableMinutes: z.number().int(),\n    dailyTargetMinutes: z.number().int().nullable(),\n    weekTargetMinutes: z.number().int().nullable(),\n    monthTargetMinutes: z.number().int().nullable(),\n    weekWorkingDays: z.number().int(),\n    monthWorkingDays: z.number().int(),\n    nonBillableSharePercent: z.number().nullable(),\n  }),\n  entries: z.array(entrySchema),\n  projects: z.array(projectSchema),\n  recentTasks: z.array(\n    z.object({\n      id: z.string().uuid(),\n      title: z.string(),\n      timeProjectId: z.string().uuid(),\n      projectName: z.string().nullable(),\n    }),\n  ),\n})\n\ntype TotalsRow = {\n  today_minutes: string | number | null\n  week_minutes: string | number | null\n  month_minutes: string | number | null\n  month_nonbillable_minutes: string | number | null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const now = new Date()\n    const todayDate = toDateOnlyString(now)\n    const weekStart = getMondayUtc(now)\n    const weekEnd = addUtcDays(weekStart, 6)\n    const monthStart = getFirstDayOfMonthUtc(now)\n    const nextMonthStart = getFirstDayOfNextMonthUtc(now)\n    const monthEnd = addUtcDays(nextMonthStart, -1)\n\n    let dailyHours: number | null = null\n    try {\n      const configService = container.resolve('moduleConfigService') as ModuleConfigService\n      dailyHours = (await readTimeTrackingSettings(configService, { tenantId })).targets.dailyHours\n    } catch {\n      // A settings read failure must not empty the dashboard; the targets simply\n      // go missing, which the UI already renders as \"no target\".\n      dailyHours = null\n    }\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    const emptyKpis = buildMyWorkKpis(\n      { todayMinutes: 0, weekMinutes: 0, monthMinutes: 0, monthNonBillableMinutes: 0 },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    if (!staffMember) {\n      // No staff profile yet: the shape is the same, so screen 1 renders its\n      // \"set up your profile\" branch instead of failing.\n      return session.respond(200, {\n        staffMember: null,\n        today: todayDate,\n        kpis: emptyKpis,\n        entries: [],\n        projects: [],\n        recentTasks: [],\n      })\n    }\n\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const canSeeMoney =\n      (await rbac?.userHasAllFeatures?.(auth.sub, [RATES_FEATURE], { tenantId, organizationId })) ?? false\n\n    const totalsRows = (await em.getConnection().execute(\n      `\n        SELECT\n          COALESCE(SUM(CASE WHEN date = ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS today_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS week_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS month_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date AND is_billable = false THEN duration_minutes ELSE 0 END), 0)::bigint AS month_nonbillable_minutes\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND organization_id = ?\n          AND staff_member_id = ?\n          AND deleted_at IS NULL\n      `,\n      [\n        todayDate,\n        toDateOnlyString(weekStart),\n        toDateOnlyString(weekEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        tenantId,\n        organizationId,\n        staffMember.id,\n      ],\n    )) as TotalsRow[]\n\n    const totals = totalsRows[0]\n    const kpis = buildMyWorkKpis(\n      {\n        todayMinutes: toMinutes(totals?.today_minutes),\n        weekMinutes: toMinutes(totals?.week_minutes),\n        monthMinutes: toMinutes(totals?.month_minutes),\n        monthNonBillableMinutes: toMinutes(totals?.month_nonbillable_minutes),\n      },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    const memberships = await em.fork().find(StaffTimeProjectMember, {\n      staffMemberId: staffMember.id,\n      tenantId,\n      organizationId,\n      status: 'active',\n      deletedAt: null,\n    })\n    const projectIds = Array.from(new Set(memberships.map((membership) => membership.timeProjectId))).slice(\n      0,\n      MAX_PROJECTS,\n    )\n\n    const projects =\n      projectIds.length > 0\n        ? await findWithDecryption(\n            em.fork(),\n            StaffTimeProject,\n            { id: { $in: projectIds }, tenantId, organizationId, deletedAt: null },\n            {},\n            { tenantId, organizationId },\n          )\n        : []\n\n    const hourlyRateByProjectId = new Map<string, number | null>(\n      projects.map((project) => [\n        project.id,\n        project.hourlyRate === null || project.hourlyRate === undefined ? null : Number(project.hourlyRate),\n      ]),\n    )\n    const [mine, everyone] = await Promise.all([\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n        staffMemberId: staffMember.id,\n      }),\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n      }),\n    ])\n\n    const todaysEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      { staffMemberId: staffMember.id, tenantId, organizationId, date: new Date(`${todayDate}T00:00:00.000Z`), deletedAt: null },\n      { orderBy: { startedAt: 'asc', createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n\n    const recentEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      {\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        taskId: { $ne: null },\n      },\n      { orderBy: { date: 'desc' }, limit: 50 },\n      { tenantId, organizationId },\n    )\n    const recentTaskIds = pickRecentTaskIds(\n      recentEntries.map((entry) => ({\n        id: entry.id,\n        taskId: entry.taskId ?? null,\n        date: toDateOnlyString(new Date(entry.date)),\n      })),\n      RECENT_TASK_LIMIT,\n    )\n    const referencedTaskIds = Array.from(\n      new Set([\n        ...recentTaskIds,\n        ...todaysEntries.map((entry) => entry.taskId).filter((id): id is string => typeof id === 'string'),\n      ]),\n    )\n    const tasks =\n      referencedTaskIds.length > 0\n        ? await em.fork().find(StaffTimeTask, {\n            id: { $in: referencedTaskIds },\n            tenantId,\n            organizationId,\n            deletedAt: null,\n          })\n        : []\n    const taskById = new Map(tasks.map((task) => [task.id, task]))\n    const projectNameById = new Map(projects.map((project) => [project.id, project.name]))\n\n    const payload = {\n      staffMember: { id: staffMember.id, displayName: staffMember.displayName },\n      today: todayDate,\n      kpis,\n      entries: todaysEntries.map((entry) => ({\n        id: entry.id,\n        date: toDateOnlyString(new Date(entry.date)),\n        taskId: entry.taskId ?? null,\n        taskTitle: entry.taskId ? taskById.get(entry.taskId)?.title ?? null : null,\n        timeProjectId: entry.timeProjectId ?? null,\n        projectName: entry.timeProjectId ? projectNameById.get(entry.timeProjectId) ?? null : null,\n        description: entry.notes ?? null,\n        startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,\n        endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,\n        durationMinutes: entry.durationMinutes,\n        isBillable: entry.isBillable !== false,\n        isLocked: Boolean(entry.lockedReportId),\n      })),\n      projects: projects.map((project) => {\n        const myFinancials = mine.get(project.id)\n        const allFinancials = everyone.get(project.id)\n        const snapshot = project.customerSnapshot ?? null\n        const customerName =\n          snapshot && typeof snapshot === 'object' && typeof (snapshot as { name?: unknown }).name === 'string'\n            ? ((snapshot as { name?: string }).name as string)\n            : null\n        // An `amount` budget is a money statement, so it only exists for a caller\n        // who may see money; an `hours` budget is not, and stays for everybody.\n        const burn =\n          project.budgetKind === 'amount' && !canSeeMoney\n            ? null\n            : computeBudgetBurn({\n                kind: project.budgetKind,\n                budgetValue:\n                  project.budgetValue === null || project.budgetValue === undefined\n                    ? null\n                    : Number(project.budgetValue),\n                warnAtPercent: project.budgetWarnAtPercent,\n                totalMinutes: allFinancials?.totalMinutes ?? 0,\n                cost: allFinancials?.cost ?? null,\n              })\n        return {\n          id: project.id,\n          name: project.name,\n          code: project.code ?? null,\n          color: project.color ?? null,\n          customerName,\n          myMinutes: myFinancials?.totalMinutes ?? 0,\n          totalMinutes: allFinancials?.totalMinutes ?? 0,\n          ...(canSeeMoney\n            ? {\n                hourlyRate: hourlyRateByProjectId.get(project.id) ?? null,\n                currencyCode: project.currencyCode ?? null,\n              }\n            : {}),\n          budget: burn\n            ? {\n                kind: burn.kind,\n                budgetValue: burn.budgetValue,\n                usedValue: burn.usedValue,\n                percent: burn.percent,\n                barPercent: burn.barPercent,\n                tone: burn.tone,\n              }\n            : null,\n        }\n      }),\n      recentTasks: recentTaskIds\n        .map((taskId) => {\n          const task = taskById.get(taskId)\n          if (!task) return null\n          return {\n            id: task.id,\n            title: task.title,\n            timeProjectId: task.timeProjectId,\n            projectName: projectNameById.get(task.timeProjectId) ?? null,\n          }\n        })\n        .filter((task): task is NonNullable<typeof task> => task !== null),\n    }\n\n    return session.respond(200, payload)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-work failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.time_tracking.myWork.errors.load', 'Failed to load your work summary.') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My work dashboard aggregate',\n  methods: {\n    GET: {\n      summary: 'Today, this week and this month for the calling staff member',\n      description:\n        'One aggregate for the time tracking landing page: day/week/month/non-billable totals with working-day targets, today\u2019s entries, the caller\u2019s projects with budget burn, and the tasks they last logged against. Always scoped to the caller \u2014 there is no way to ask about another person. Rate and amount-budget fields are present only for holders of `staff.timesheets.rates.view`.',\n      responses: [\n        { status: 200, description: 'My work summary', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAI7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,iBAAiB,mBAAmB,iBAAiB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAElF,MAAM,eAAe;AACrB,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAUA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,QAAQ,EACL,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO;AAAA,IAClB,YAAY,EAAE,OAAO;AAAA,IACrB,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACnF,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,IACb,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,IAC5B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,IACxC,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC7C,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,IACjC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,SAAS,EAAE,MAAM,WAAW;AAAA,EAC5B,UAAU,EAAE,MAAM,aAAa;AAAA,EAC/B,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO;AAAA,MAChB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC;AAAA,EACH;AACF,CAAC;AASD,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YAAY,iBAAiB,GAAG;AACtC,UAAM,YAAY,aAAa,GAAG;AAClC,UAAM,UAAU,WAAW,WAAW,CAAC;AACvC,UAAM,aAAa,sBAAsB,GAAG;AAC5C,UAAM,iBAAiB,0BAA0B,GAAG;AACpD,UAAM,WAAW,WAAW,gBAAgB,EAAE;AAE9C,QAAI,aAA4B;AAChC,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,oBAAc,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,GAAG,QAAQ;AAAA,IACrF,QAAQ;AAGN,mBAAa;AAAA,IACf;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,YAAY;AAAA,MAChB,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,yBAAyB,EAAE;AAAA,MAC/E;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,aAAa;AAGhB,aAAO,QAAQ,QAAQ,KAAK;AAAA,QAC1B,aAAa;AAAA,QACb,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,UAAU,CAAC;AAAA,QACX,aAAa,CAAC;AAAA,MAChB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,cACH,MAAM,MAAM,qBAAqB,KAAK,KAAK,CAAC,aAAa,GAAG,EAAE,UAAU,eAAe,CAAC,KAAM;AAEjG,UAAM,aAAc,MAAM,GAAG,cAAc,EAAE;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYA;AAAA,QACE;AAAA,QACA,iBAAiB,SAAS;AAAA,QAC1B,iBAAiB,OAAO;AAAA,QACxB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,SAAS,WAAW,CAAC;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,QACE,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,aAAa,UAAU,QAAQ,YAAY;AAAA,QAC3C,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,yBAAyB,UAAU,QAAQ,yBAAyB;AAAA,MACtE;AAAA,MACA;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,MAC/D,eAAe,YAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,IACb,CAAC;AACD,UAAM,aAAa,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,aAAa,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,WAAW,SAAS,IAChB,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACrE,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B,IACA,CAAC;AAEP,UAAM,wBAAwB,IAAI;AAAA,MAChC,SAAS,IAAI,CAAC,YAAY;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ,eAAe,QAAQ,QAAQ,eAAe,SAAY,OAAO,OAAO,QAAQ,UAAU;AAAA,MACpG,CAAC;AAAA,IACH;AACA,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,QACA,eAAe,YAAY;AAAA,MAC7B,CAAC;AAAA,MACD,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,MAAM,oBAAI,KAAK,GAAG,SAAS,gBAAgB,GAAG,WAAW,KAAK;AAAA,MACzH,EAAE,SAAS,EAAE,WAAW,OAAO,WAAW,MAAM,EAAE;AAAA,MAClD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA;AAAA,QACE,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ,EAAE,KAAK,KAAK;AAAA,MACtB;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,GAAG;AAAA,MACvC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,gBAAgB;AAAA,MACpB,cAAc,IAAI,CAAC,WAAW;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,QAAQ,MAAM,UAAU;AAAA,QACxB,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,MAC7C,EAAE;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,MAAM;AAAA,MAC9B,oBAAI,IAAI;AAAA,QACN,GAAG;AAAA,QACH,GAAG,cAAc,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,MACnG,CAAC;AAAA,IACH;AACA,UAAM,QACJ,kBAAkB,SAAS,IACvB,MAAM,GAAG,KAAK,EAAE,KAAK,eAAe;AAAA,MAClC,IAAI,EAAE,KAAK,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC,IACD,CAAC;AACP,UAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC7D,UAAM,kBAAkB,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,UAAM,UAAU;AAAA,MACd,aAAa,EAAE,IAAI,YAAY,IAAI,aAAa,YAAY,YAAY;AAAA,MACxE,OAAO;AAAA,MACP;AAAA,MACA,SAAS,cAAc,IAAI,CAAC,WAAW;AAAA,QACrC,IAAI,MAAM;AAAA,QACV,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QAC3C,QAAQ,MAAM,UAAU;AAAA,QACxB,WAAW,MAAM,SAAS,SAAS,IAAI,MAAM,MAAM,GAAG,SAAS,OAAO;AAAA,QACtE,eAAe,MAAM,iBAAiB;AAAA,QACtC,aAAa,MAAM,gBAAgB,gBAAgB,IAAI,MAAM,aAAa,KAAK,OAAO;AAAA,QACtF,aAAa,MAAM,SAAS;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,QAC7D,SAAS,MAAM,UAAU,MAAM,QAAQ,YAAY,IAAI;AAAA,QACvD,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM,eAAe;AAAA,QACjC,UAAU,QAAQ,MAAM,cAAc;AAAA,MACxC,EAAE;AAAA,MACF,UAAU,SAAS,IAAI,CAAC,YAAY;AAClC,cAAM,eAAe,KAAK,IAAI,QAAQ,EAAE;AACxC,cAAM,gBAAgB,SAAS,IAAI,QAAQ,EAAE;AAC7C,cAAM,WAAW,QAAQ,oBAAoB;AAC7C,cAAM,eACJ,YAAY,OAAO,aAAa,YAAY,OAAQ,SAAgC,SAAS,WACvF,SAA+B,OACjC;AAGN,cAAM,OACJ,QAAQ,eAAe,YAAY,CAAC,cAChC,OACA,kBAAkB;AAAA,UAChB,MAAM,QAAQ;AAAA,UACd,aACE,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,SACpD,OACA,OAAO,QAAQ,WAAW;AAAA,UAChC,eAAe,QAAQ;AAAA,UACvB,cAAc,eAAe,gBAAgB;AAAA,UAC7C,MAAM,eAAe,QAAQ;AAAA,QAC/B,CAAC;AACP,eAAO;AAAA,UACL,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,MAAM,QAAQ,QAAQ;AAAA,UACtB,OAAO,QAAQ,SAAS;AAAA,UACxB;AAAA,UACA,WAAW,cAAc,gBAAgB;AAAA,UACzC,cAAc,eAAe,gBAAgB;AAAA,UAC7C,GAAI,cACA;AAAA,YACE,YAAY,sBAAsB,IAAI,QAAQ,EAAE,KAAK;AAAA,YACrD,cAAc,QAAQ,gBAAgB;AAAA,UACxC,IACA,CAAC;AAAA,UACL,QAAQ,OACJ;AAAA,YACE,MAAM,KAAK;AAAA,YACX,aAAa,KAAK;AAAA,YAClB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,YAAY,KAAK;AAAA,YACjB,MAAM,KAAK;AAAA,UACb,IACA;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,aAAa,cACV,IAAI,CAAC,WAAW;AACf,cAAM,OAAO,SAAS,IAAI,MAAM;AAChC,YAAI,CAAC,KAAM,QAAO;AAClB,eAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,KAAK;AAAA,UACZ,eAAe,KAAK;AAAA,UACpB,aAAa,gBAAgB,IAAI,KAAK,aAAa,KAAK;AAAA,QAC1D;AAAA,MACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACrE;AAEA,WAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,EACrC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,0CAA0C,mCAAmC,EAAE;AAAA,MAClG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/projects/kpis/route.js

@@ -12,6 +12,10 @@ import {
   computePmProjectsKpis
 } from "../../../../lib/timesheets-projects/computeProjectsKpis.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  readSearchParamsRecord,
+  runTimesheetInterceptors
+} from "../../_shared/withTimesheetInterceptors.js";
 const logger = createLogger("staff");
 const VIEW_FEATURE = "staff.timesheets.projects.view";
 const MANAGE_FEATURE = "staff.timesheets.projects.manage";
@@ -63,6 +67,14 @@ async function GET(req) {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
       });
     }
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "GET",
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      query: readSearchParamsRecord(req.url)
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
     const em = container.resolve("em");
     const rbac = container.resolve("rbacService");
     const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {
@@ -83,7 +95,7 @@ async function GET(req) {
         organizationId,
         callerStaffMemberId: staffMember?.id ?? null
       });
-      return NextResponse.json(result2, { status: 200 });
+      return session.respond(200, result2);
     }
     if (!staffMember) {
       throw new CrudHttpError(403, {
@@ -99,7 +111,7 @@ async function GET(req) {
       organizationId,
       staffMemberId: staffMember.id
     });
-    return NextResponse.json(result, { status: 200 });
+    return session.respond(200, result);
   } catch (err) {
     if (err instanceof CrudHttpError) {
       return NextResponse.json(err.body, { status: err.status });

package/dist/modules/staff/api/timesheets/projects/kpis/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/projects/kpis/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { StaffTeamMember } from '../../../../data/entities'\nimport {\n  computeCollabProjectsKpis,\n  computePmProjectsKpis,\n} from '../../../../lib/timesheets-projects/computeProjectsKpis'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nconst VIEW_FEATURE = 'staff.timesheets.projects.view'\nconst MANAGE_FEATURE = 'staff.timesheets.projects.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst deltaSchema = z.object({\n  current: z.number(),\n  previous: z.number(),\n  deltaPct: z.number().nullable(),\n})\n\nconst pmResponseSchema = z.object({\n  role: z.literal('pm'),\n  totals: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n    onHold: z.number().int(),\n    completed: z.number().int(),\n  }),\n  hoursWeek: deltaSchema,\n  hoursMonth: deltaSchema,\n  teamActive: z.object({ count: z.number().int() }),\n  assignedToMe: z.object({ total: z.number().int(), active: z.number().int() }),\n})\n\nconst collabResponseSchema = z.object({\n  role: z.literal('collab'),\n  myProjects: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n  }),\n  myHoursWeek: deltaSchema,\n  myHoursMonth: deltaSchema,\n})\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth) {\n      throw new CrudHttpError(401, {\n        error: translate('staff.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const rbac = container.resolve('rbacService') as RbacService\n    const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    if (isPm) {\n      const result = await computePmProjectsKpis({\n        em,\n        tenantId,\n        organizationId,\n        callerStaffMemberId: staffMember?.id ?? null,\n      })\n      return NextResponse.json(result, { status: 200 })\n    }\n\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate(\n          'staff.timesheets.errors.noStaffMember',\n          'No staff member linked to your account.',\n        ),\n      })\n    }\n\n    const result = await computeCollabProjectsKpis({\n      em,\n      tenantId,\n      organizationId,\n      staffMemberId: staffMember.id,\n    })\n    return NextResponse.json(result, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.projects.kpis failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      {\n        error: translate(\n          'staff.timesheets.errors.projectsKpis',\n          'Failed to load project KPIs.',\n        ),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Timesheet projects KPIs',\n  methods: {\n    GET: {\n      summary: 'Aggregate KPIs for the timesheets Projects page',\n      description:\n        'Returns a role-aware KPI payload. Users with `staff.timesheets.projects.manage` get the PM shape (portfolio totals, monthly team hours, active team member count). Other viewers get the Collaborator shape scoped to their own memberships and hours.',\n      responses: [\n        {\n          status: 200,\n          description: 'PM or Collaborator KPIs',\n          schema: z.union([pmResponseSchema, collabResponseSchema]),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing viewing feature or no staff member linked',\n          schema: z.object({ error: z.string() }),\n        },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAItC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,QAAQ,IAAI;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EAChD,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,CAAC;AAAA,EACD,aAAa;AAAA,EACb,cAAc;AAChB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,OAAO,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG;AAAA,MACrE;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,MAAM;AACR,YAAMA,UAAS,MAAM,sBAAsB;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,qBAAqB,aAAa,MAAM;AAAA,MAC1C,CAAC;AACD,aAAO,aAAa,KAAKA,SAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClD;AAEA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,0BAA0B;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,IAC7B,CAAC;AACD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,CAAC,kBAAkB,oBAAoB,CAAC;AAAA,QAC1D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { StaffTeamMember } from '../../../../data/entities'\nimport {\n  computeCollabProjectsKpis,\n  computePmProjectsKpis,\n} from '../../../../lib/timesheets-projects/computeProjectsKpis'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nconst VIEW_FEATURE = 'staff.timesheets.projects.view'\nconst MANAGE_FEATURE = 'staff.timesheets.projects.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst deltaSchema = z.object({\n  current: z.number(),\n  previous: z.number(),\n  deltaPct: z.number().nullable(),\n})\n\nconst pmResponseSchema = z.object({\n  role: z.literal('pm'),\n  totals: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n    onHold: z.number().int(),\n    completed: z.number().int(),\n  }),\n  hoursWeek: deltaSchema,\n  hoursMonth: deltaSchema,\n  teamActive: z.object({ count: z.number().int() }),\n  assignedToMe: z.object({ total: z.number().int(), active: z.number().int() }),\n})\n\nconst collabResponseSchema = z.object({\n  role: z.literal('collab'),\n  myProjects: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n  }),\n  myHoursWeek: deltaSchema,\n  myHoursMonth: deltaSchema,\n})\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth) {\n      throw new CrudHttpError(401, {\n        error: translate('staff.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const rbac = container.resolve('rbacService') as RbacService\n    const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    if (isPm) {\n      const result = await computePmProjectsKpis({\n        em,\n        tenantId,\n        organizationId,\n        callerStaffMemberId: staffMember?.id ?? null,\n      })\n      return session.respond(200, result)\n    }\n\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate(\n          'staff.timesheets.errors.noStaffMember',\n          'No staff member linked to your account.',\n        ),\n      })\n    }\n\n    const result = await computeCollabProjectsKpis({\n      em,\n      tenantId,\n      organizationId,\n      staffMemberId: staffMember.id,\n    })\n    return session.respond(200, result)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.projects.kpis failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      {\n        error: translate(\n          'staff.timesheets.errors.projectsKpis',\n          'Failed to load project KPIs.',\n        ),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Timesheet projects KPIs',\n  methods: {\n    GET: {\n      summary: 'Aggregate KPIs for the timesheets Projects page',\n      description:\n        'Returns a role-aware KPI payload. Users with `staff.timesheets.projects.manage` get the PM shape (portfolio totals, monthly team hours, active team member count). Other viewers get the Collaborator shape scoped to their own memberships and hours.',\n      responses: [\n        {\n          status: 200,\n          description: 'PM or Collaborator KPIs',\n          schema: z.union([pmResponseSchema, collabResponseSchema]),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing viewing feature or no staff member linked',\n          schema: z.object({ error: z.string() }),\n        },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAItC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,QAAQ,IAAI;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EAChD,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,CAAC;AAAA,EACD,aAAa;AAAA,EACb,cAAc;AAChB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,OAAO,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG;AAAA,MACrE;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,MAAM;AACR,YAAMA,UAAS,MAAM,sBAAsB;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,qBAAqB,aAAa,MAAM;AAAA,MAC1C,CAAC;AACD,aAAO,QAAQ,QAAQ,KAAKA,OAAM;AAAA,IACpC;AAEA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,0BAA0B;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,IAC7B,CAAC;AACD,WAAO,QAAQ,QAAQ,KAAK,MAAM;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,CAAC,kBAAkB,oBAAoB,CAAC;AAAA,QAC1D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["result"]
 }