@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/src/modules/staff/api/timesheets/access-requests/route.ts

@@ -0,0 +1,299 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { StaffTeamMember, StaffTimeProject } from '../../../data/entities'
+import { emitStaffEvent } from '../../../events'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../guards'
+import { runTimesheetInterceptors } from '../_shared/withTimesheetInterceptors'
+import { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'
+
+const logger = createLogger('staff').child({ component: 'api/timesheets/access-requests' })
+
+const VIEW_FEATURE = 'staff.timesheets.view'
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.accessRequest
+
+/**
+ * Spec D-6: one pending request per user per project (or per user for the
+ * general, project-less request) per 24h. The window is held in the shared
+ * cache rather than a table — the notification itself carries a `groupKey`, so
+ * even if the cache is cold the manager still sees a single refreshed
+ * notification instead of a duplicate row.
+ */
+export const ACCESS_REQUEST_DEDUPE_WINDOW_MS = 24 * 60 * 60 * 1000
+
+const GENERAL_REQUEST_SCOPE = 'general'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },
+}
+
+const accessRequestSchema = z.object({
+  timeProjectId: z.string().uuid().nullish(),
+})
+
+const accessRequestResponseSchema = z.object({
+  ok: z.literal(true),
+  deduplicated: z.boolean(),
+})
+
+type DedupeCacheLike = {
+  get: (key: string) => Promise<unknown>
+  set: (key: string, value: unknown, options?: { ttl?: number }) => Promise<void>
+}
+
+type AccessRequestContext = {
+  container: Awaited<ReturnType<typeof createRequestContainer>>
+  em: EntityManager
+  tenantId: string
+  organizationId: string
+  requesterUserId: string
+  requesterEmail: string | null
+  translate: (key: string, fallback?: string) => string
+}
+
+async function resolveAccessRequestContext(req: Request): Promise<AccessRequestContext> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+  if (!auth || !auth.tenantId) {
+    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+  }
+  const requesterUserId =
+    (typeof auth.sub === 'string' && auth.sub.trim().length > 0 && auth.sub) ||
+    (typeof auth.userId === 'string' && auth.userId.trim().length > 0 && auth.userId) ||
+    null
+  if (!requesterUserId) {
+    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+  }
+  if (!auth.orgId) {
+    throw new CrudHttpError(400, {
+      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),
+    })
+  }
+  return {
+    container,
+    em: (container.resolve('em') as EntityManager).fork(),
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    requesterUserId,
+    requesterEmail: typeof auth.email === 'string' && auth.email.trim().length > 0 ? auth.email : null,
+    translate,
+  }
+}
+
+function resolveDedupeCache(context: AccessRequestContext): DedupeCacheLike | null {
+  try {
+    const cache = context.container.resolve('cache') as Partial<DedupeCacheLike> | undefined
+    if (typeof cache?.get !== 'function' || typeof cache?.set !== 'function') return null
+    return cache as DedupeCacheLike
+  } catch {
+    return null
+  }
+}
+
+export function buildAccessRequestDedupeKey(input: {
+  tenantId: string
+  organizationId: string
+  requesterUserId: string
+  timeProjectId: string | null
+}): string {
+  const scope = input.timeProjectId ?? GENERAL_REQUEST_SCOPE
+  return `staff:timesheets:access-request:${input.tenantId}:${input.organizationId}:${input.requesterUserId}:${scope}`
+}
+
+/**
+ * Resolves the requested project inside the caller's scope. A project the
+ * caller's tenant/organization does not own resolves to `null` and the request
+ * degrades to a general one — the response never differentiates, so the route
+ * cannot be used to probe which project ids exist (screen 17 note 1).
+ */
+async function resolveRequestedProject(
+  context: AccessRequestContext,
+  timeProjectId: string | null,
+): Promise<{ id: string; name: string } | null> {
+  if (!timeProjectId) return null
+  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }
+  const project = await findOneWithDecryption(
+    context.em,
+    StaffTimeProject,
+    { id: timeProjectId, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },
+    {},
+    scope,
+  )
+  if (!project) return null
+  return { id: project.id, name: project.name }
+}
+
+async function resolveRequesterName(context: AccessRequestContext): Promise<string> {
+  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }
+  const staffMember = await findOneWithDecryption(
+    context.em,
+    StaffTeamMember,
+    {
+      userId: context.requesterUserId,
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      deletedAt: null,
+    },
+    {},
+    scope,
+  )
+  const displayName = staffMember?.displayName
+  if (typeof displayName === 'string' && displayName.trim().length > 0) return displayName
+  return context.requesterEmail ?? context.requesterUserId
+}
+
+async function POST(req: Request) {
+  try {
+    const context = await resolveAccessRequestContext(req)
+    // The grant list the interceptors and the mutation-guard registry gate on
+    // comes from the module's single RBAC authority, so it is always an array:
+    // the nullable read it replaces could not say whether an empty answer meant
+    // "no grants" or "could not ask". Authorization itself stays with the
+    // declarative `requireFeatures` guard in `metadata`.
+    const grantedFeatures = (
+      await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+      })
+    ).grantedFeatures
+
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: 'POST',
+      scope: {
+        container: context.container,
+        userId: context.requesterUserId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userFeatures: grantedFeatures,
+      },
+      body: await readJsonSafe<Record<string, unknown>>(req, {}),
+    })
+    if (!interceptors.ok) return interceptors.response
+    const { session } = interceptors
+
+    const parsed = accessRequestSchema.parse(session.body)
+
+    const guardResult = await runRouteMutationGuards({
+      container: context.container,
+      req,
+      auth: {
+        userId: context.requesterUserId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userFeatures: grantedFeatures,
+      },
+      input: {
+        resourceKind: RESOURCE_KIND,
+        resourceId: parsed.timeProjectId ?? GENERAL_REQUEST_SCOPE,
+        operation: 'create',
+        mutationPayload: { timeProjectId: parsed.timeProjectId ?? null },
+      },
+    })
+    if (!guardResult.ok) return guardResult.response
+
+    const effective = guardResult.modifiedPayload
+      ? accessRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })
+      : parsed
+
+    const project = await resolveRequestedProject(context, effective.timeProjectId ?? null)
+    const dedupeKey = buildAccessRequestDedupeKey({
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      requesterUserId: context.requesterUserId,
+      timeProjectId: project?.id ?? null,
+    })
+
+    const cache = resolveDedupeCache(context)
+    if (cache) {
+      const pending = await cache.get(dedupeKey).catch(() => null)
+      if (pending != null) {
+        await guardResult.runAfterSuccess()
+        return session.respond(200, { ok: true, deduplicated: true })
+      }
+    }
+
+    const requesterName = await resolveRequesterName(context)
+    await emitStaffEvent('staff.timesheets.project_access.requested', {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      requesterUserId: context.requesterUserId,
+      requesterName,
+      timeProjectId: project?.id ?? null,
+      timeProjectName: project?.name ?? null,
+      requestedAt: new Date().toISOString(),
+    })
+
+    if (cache) {
+      await cache
+        .set(dedupeKey, { requestedAt: Date.now() }, { ttl: ACCESS_REQUEST_DEDUPE_WINDOW_MS })
+        .catch((err: unknown) => {
+          logger.warn('Failed to record the access-request dedupe window', { err })
+        })
+    }
+
+    await guardResult.runAfterSuccess()
+
+    return session.respond(200, { ok: true, deduplicated: false })
+  } catch (err) {
+    return errorResponse(err, 'staff.timesheets.access-requests.POST failed')
+  }
+}
+
+async function errorResponse(err: unknown, message: string) {
+  if (isCrudHttpError(err)) {
+    return NextResponse.json(err.body, { status: err.status })
+  }
+  const { translate } = await resolveTranslations()
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },
+      { status: 400 },
+    )
+  }
+  logger.error(message, { err })
+  return NextResponse.json(
+    { error: translate('staff.errors.internal', 'Internal server error') },
+    { status: 500 },
+  )
+}
+
+const postDoc: OpenApiMethodDoc = {
+  summary: 'Request time tracking project access',
+  description:
+    'Notifies every holder of staff.timesheets.projects.manage in the caller scope that a team member asked for project access. Omitting timeProjectId sends a general request from the no-assignments empty state.',
+  tags: ['Staff'],
+  requestBody: { schema: accessRequestSchema },
+  responses: [
+    {
+      status: 200,
+      description: 'Access request accepted (deduplicated when an identical request is still pending)',
+      schema: accessRequestResponseSchema,
+    },
+  ],
+  errors: [
+    { status: 400, description: 'Invalid request body or missing organization scope' },
+    { status: 401, description: 'Unauthorized' },
+    { status: 403, description: 'Missing staff.timesheets.view' },
+  ],
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Time tracking project access requests',
+  methods: {
+    POST: postDoc,
+  },
+}
+
+export { POST }

package/src/modules/staff/api/timesheets/my-projects/[projectId]/route.ts

@@ -12,11 +12,12 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { StaffTimeProjectMember, StaffTeamMember } from '../../../../data/entities'
 import { staffMyProjectVisibilityUpdateSchema } from '../../../../data/validators'
 import {
-  resolveUserFeatures,
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards,
 } from '../../../guards'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'
 
 const logger = createLogger('staff')
 
@@ -69,8 +70,16 @@ export async function PATCH(req: Request) {
       })
     }
 
-    const rawBody = await readJsonSafe(req, {})
-    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(rawBody)
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: 'PATCH',
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      body: await readJsonSafe<Record<string, unknown>>(req, {}),
+    })
+    if (!interceptors.ok) return interceptors.response
+    const { session } = interceptors
+
+    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(session.body)
     if (!parsed.success) {
       throw new CrudHttpError(400, {
         error: translate('staff.timesheets.errors.invalidBody', 'Invalid request body.'),
@@ -120,14 +129,13 @@ export async function PATCH(req: Request) {
         tenantId,
         organizationId,
         userId: auth.sub ?? '',
-        resourceKind: 'staff.timesheets.time_project_member',
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,
         resourceId: membership.id,
         operation: 'update',
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: parsed.data as unknown as Record<string, unknown>,
       },
-      resolveUserFeatures(auth),
     )
     if (!guardResult.ok) {
       return NextResponse.json(
@@ -144,7 +152,7 @@ export async function PATCH(req: Request) {
         tenantId,
         organizationId,
         userId: auth.sub ?? '',
-        resourceKind: 'staff.timesheets.time_project_member',
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,
         resourceId: membership.id,
         operation: 'update',
         requestMethod: req.method,
@@ -152,7 +160,7 @@ export async function PATCH(req: Request) {
       })
     }
 
-    return NextResponse.json({ ok: true, showInGrid: membership.showInGrid }, { status: 200 })
+    return session.respond(200, { ok: true, showInGrid: membership.showInGrid })
   } catch (err) {
     if (err instanceof CrudHttpError) {
       return NextResponse.json(err.body, { status: err.status })

package/src/modules/staff/api/timesheets/my-projects/route.ts

@@ -10,6 +10,10 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  readSearchParamsRecord,
+  runTimesheetInterceptors,
+} from '../_shared/withTimesheetInterceptors'
 
 const logger = createLogger('staff')
 
@@ -38,6 +42,15 @@ export async function GET(req: Request) {
       throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
     }
 
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: 'GET',
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      query: readSearchParamsRecord(req.url),
+    })
+    if (!interceptors.ok) return interceptors.response
+    const { session } = interceptors
+
     const em = (container.resolve('em') as EntityManager).fork()
     const scopeCtx = { tenantId, organizationId }
 
@@ -71,7 +84,7 @@ export async function GET(req: Request) {
       show_in_grid: assignment.showInGrid ?? false,
     }))
 
-    return NextResponse.json({ items, total: items.length }, { status: 200 })
+    return session.respond(200, { items, total: items.length })
   } catch (err) {
     if (err instanceof CrudHttpError) {
       return NextResponse.json(err.body, { status: err.status })

package/src/modules/staff/api/timesheets/my-work/myWorkAggregate.ts

@@ -0,0 +1,90 @@
+/**
+ * The arithmetic behind screen 1 (`GET /api/staff/timesheets/my-work`), kept out
+ * of the route so the numbers a consultant reads first thing in the morning can
+ * be tested without a database.
+ *
+ * Three rules it encodes:
+ *
+ *  1. **Targets scale with working days, not calendar days.** "cel 8:00" is one
+ *     day; "z 40:00" is the week's Mon–Fri days times the daily target; the month
+ *     KPI's context is its working-day count. A tenant with no `targets.dailyHours`
+ *     gets `null` everywhere rather than a zero to be under.
+ *  2. **The non-billable KPI is a share of the month, and a share of nothing is
+ *     `null`** — not `0%`, which would read as "all your time is billable".
+ *  3. **Money never crosses currencies.** The payload carries no total cost at
+ *     all: budget burn is per project, in that project's own terms, and the rate
+ *     is only present for a caller who may see rates.
+ */
+
+import { countWorkingDays, type TimesheetDateRange } from '../../../lib/time-tracking-ui/timesheetPeriod'
+
+export type MyWorkTotals = {
+  todayMinutes: number
+  weekMinutes: number
+  monthMinutes: number
+  monthNonBillableMinutes: number
+}
+
+export type MyWorkKpis = MyWorkTotals & {
+  dailyTargetMinutes: number | null
+  weekTargetMinutes: number | null
+  monthTargetMinutes: number | null
+  weekWorkingDays: number
+  monthWorkingDays: number
+  /** Percent of the month that is non-billable, rounded to one decimal; `null` when nothing is logged. */
+  nonBillableSharePercent: number | null
+}
+
+export function buildMyWorkKpis(
+  totals: MyWorkTotals,
+  ranges: { week: TimesheetDateRange; month: TimesheetDateRange },
+  dailyHours: number | null,
+): MyWorkKpis {
+  const hasTarget = typeof dailyHours === 'number' && Number.isFinite(dailyHours) && dailyHours > 0
+  const weekWorkingDays = countWorkingDays(ranges.week)
+  const monthWorkingDays = countWorkingDays(ranges.month)
+  const dailyTargetMinutes = hasTarget ? Math.round(dailyHours * 60) : null
+  return {
+    ...totals,
+    dailyTargetMinutes,
+    weekTargetMinutes: dailyTargetMinutes === null ? null : dailyTargetMinutes * weekWorkingDays,
+    monthTargetMinutes: dailyTargetMinutes === null ? null : dailyTargetMinutes * monthWorkingDays,
+    weekWorkingDays,
+    monthWorkingDays,
+    nonBillableSharePercent:
+      totals.monthMinutes > 0
+        ? Math.round((totals.monthNonBillableMinutes / totals.monthMinutes) * 1000) / 10
+        : null,
+  }
+}
+
+export function toMinutes(value: string | number | null | undefined): number {
+  if (value === null || value === undefined) return 0
+  const parsed = typeof value === 'number' ? value : Number(value)
+  return Number.isFinite(parsed) ? parsed : 0
+}
+
+/**
+ * The most recently worked tasks, newest first, de-duplicated. Screen 1's
+ * "Ostatnie zadania" is a shortcut back into work already started, so it is
+ * derived from the caller's own entries rather than from task assignment: a task
+ * assigned but never touched is not something to resume.
+ */
+export function pickRecentTaskIds(
+  entries: readonly { taskId: string | null; date: string; id: string }[],
+  limit: number,
+): string[] {
+  const ordered = [...entries].sort((left, right) => {
+    if (left.date === right.date) return right.id.localeCompare(left.id)
+    return right.date.localeCompare(left.date)
+  })
+  const seen = new Set<string>()
+  const picked: string[] = []
+  for (const entry of ordered) {
+    if (!entry.taskId || seen.has(entry.taskId)) continue
+    seen.add(entry.taskId)
+    picked.push(entry.taskId)
+    if (picked.length >= limit) break
+  }
+  return picked
+}