@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/settings/rounding-impact/route.js

@@ -0,0 +1,168 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { readTimeTrackingSettings } from "../../../../lib/time-tracking/settings.js";
+import { projectRoundingImpact } from "../../../../lib/time-tracking/roundingImpact.js";
+import { buildSqlInClause } from "../../../../lib/time-tracking/sqlInClause.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/settings/rounding-impact" });
+const MANAGE_FEATURE = "staff.timesheets.settings.manage";
+const DEFAULT_IMPACT_WINDOW_DAYS = 90;
+const MAX_IMPACT_WINDOW_DAYS = 365;
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] }
+};
+const querySchema = z.object({
+  unitMinutes: z.coerce.number().optional(),
+  direction: z.enum(["up", "nearest"]).optional(),
+  windowDays: z.coerce.number().int().min(1).max(MAX_IMPACT_WINDOW_DAYS).optional()
+});
+const impactSchema = z.object({
+  entryCount: z.number().int(),
+  rawMinutes: z.number().int(),
+  roundedMinutes: z.number().int(),
+  deltaMinutes: z.number().int()
+});
+const responseSchema = z.object({
+  windowDays: z.number().int(),
+  from: z.string(),
+  to: z.string(),
+  rounding: z.object({
+    unitMinutes: z.union([z.literal(0), z.literal(5), z.literal(10), z.literal(15)]),
+    direction: z.enum(["up", "nearest"])
+  }),
+  /** The projection under the requested (or stored) rule, locked entries excluded. */
+  projected: impactSchema,
+  /** The same window under the rule currently stored, so the screen can show the move. */
+  current: impactSchema,
+  /** Entries in the window that a rounding change can never restate. */
+  lockedEntryCount: z.number().int()
+});
+const ROUNDING_UNITS = [0, 5, 10, 15];
+function toDateOnlyString(value) {
+  return value.toISOString().slice(0, 10);
+}
+async function GET(req) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const { translate } = await resolveTranslations();
+    if (!auth) {
+      throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
+    if (!tenantId) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+      });
+    }
+    const url = new URL(req.url);
+    const parsedQuery = querySchema.safeParse(Object.fromEntries(url.searchParams.entries()));
+    if (!parsedQuery.success) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.errors.invalid_request", "Invalid request"),
+        details: parsedQuery.error.issues
+      });
+    }
+    const configService = container.resolve("moduleConfigService");
+    const stored = await readTimeTrackingSettings(configService, { tenantId });
+    const requestedUnit = parsedQuery.data.unitMinutes;
+    const candidate = {
+      unitMinutes: typeof requestedUnit === "number" && ROUNDING_UNITS.includes(requestedUnit) ? requestedUnit : stored.rounding.unitMinutes,
+      direction: parsedQuery.data.direction ?? stored.rounding.direction
+    };
+    const windowDays = parsedQuery.data.windowDays ?? DEFAULT_IMPACT_WINDOW_DAYS;
+    const to = /* @__PURE__ */ new Date();
+    const from = new Date(to.getTime() - (windowDays - 1) * 24 * 60 * 60 * 1e3);
+    const fromDate = toDateOnlyString(from);
+    const toDate = toDateOnlyString(to);
+    const organizationIds = scope?.filterIds ?? null;
+    const orgIn = organizationIds ? buildSqlInClause("organization_id", organizationIds) : null;
+    const orgClause = orgIn ? ` AND ${orgIn.sql}` : "";
+    const orgParams = orgIn ? orgIn.params : [];
+    const em = container.resolve("em");
+    const connection = em.getConnection();
+    const bucketRows = await connection.execute(
+      `
+        SELECT duration_minutes, COUNT(*)::bigint AS entry_count
+        FROM staff_time_entries
+        WHERE tenant_id = ?
+          AND deleted_at IS NULL
+          AND locked_report_id IS NULL
+          AND date >= ?::date
+          AND date <= ?::date${orgClause}
+        GROUP BY duration_minutes
+      `,
+      [tenantId, fromDate, toDate, ...orgParams]
+    );
+    const lockedRows = await connection.execute(
+      `
+        SELECT COUNT(*)::bigint AS locked_count
+        FROM staff_time_entries
+        WHERE tenant_id = ?
+          AND deleted_at IS NULL
+          AND locked_report_id IS NOT NULL
+          AND date >= ?::date
+          AND date <= ?::date${orgClause}
+      `,
+      [tenantId, fromDate, toDate, ...orgParams]
+    );
+    const buckets = (bucketRows ?? []).map((row) => ({
+      durationMinutes: Number(row.duration_minutes ?? 0),
+      entryCount: Number(row.entry_count ?? 0)
+    }));
+    const lockedRaw = Number(lockedRows?.[0]?.locked_count ?? 0);
+    return NextResponse.json(
+      {
+        windowDays,
+        from: fromDate,
+        to: toDate,
+        rounding: candidate,
+        projected: projectRoundingImpact(buckets, candidate),
+        current: projectRoundingImpact(buckets, stored.rounding),
+        lockedEntryCount: Number.isFinite(lockedRaw) ? lockedRaw : 0
+      },
+      { status: 200 }
+    );
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    logger.error("staff.timesheets.settings.rounding-impact failed", { err });
+    const { translate } = await resolveTranslations();
+    return NextResponse.json(
+      { error: translate("staff.errors.internal", "Internal server error") },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: "Staff",
+  summary: "Rounding impact preview",
+  methods: {
+    GET: {
+      summary: "Project the billing impact of a rounding rule over a recent window",
+      description: "Answers what the last `windowDays` (default 90) would have billed under a candidate rounding rule, before it is saved. Entries already locked into a closed report are excluded from the projection \u2014 they cannot be restated \u2014 and reported separately as `lockedEntryCount`. Rounding is applied per entry (D-7) through the same helper the write path uses.",
+      query: querySchema,
+      responses: [
+        { status: 200, description: "Rounding impact projection", schema: responseSchema },
+        { status: 400, description: "Invalid request or missing scope", schema: z.object({ error: z.string() }) },
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Missing staff.timesheets.settings.manage" },
+        { status: 500, description: "Projection failure", schema: z.object({ error: z.string() }) }
+      ]
+    }
+  }
+};
+export {
+  DEFAULT_IMPACT_WINDOW_DAYS,
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/settings/rounding-impact/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/staff/api/timesheets/settings/rounding-impact/route.ts"],
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/settings/rounding-impact` \u2014 screen 16's 90-day preview (T7.2).\n *\n * Rounding is the one setting on that screen that moves money, and its effect is\n * invisible until an invoice goes out. This route answers \"what would the last 90\n * days have billed under the rule I am about to save\" before the Save button is\n * pressed, so changing it stops being a blind shot at client amounts.\n *\n * Three deliberate properties:\n *\n *  * **Locked entries are excluded.** An entry frozen into a closed report cannot\n *    be restated, so counting it in the projection would promise a change that the\n *    retro-rounding job would then refuse to make. They are counted separately and\n *    returned as `lockedEntryCount`, which is what lets the screen say \"closed\n *    reports stay as they are\" from data rather than as boilerplate.\n *  * **The projection is per entry** (D-7) \u2014 the database groups identical\n *    durations and `projectRoundingImpact` rounds each distinct duration once,\n *    through the same `roundMinutes` the write path uses.\n *  * **The candidate rule comes from the query string**, defaulting to what is\n *    stored, so the card recomputes as the toggles move without saving anything.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { readTimeTrackingSettings } from '../../../../lib/time-tracking/settings'\nimport type { RoundingDirection, RoundingSettings, RoundingUnitMinutes } from '../../../../lib/time-tracking/rounding'\nimport { projectRoundingImpact, type DurationBucket } from '../../../../lib/time-tracking/roundingImpact'\nimport { buildSqlInClause } from '../../../../lib/time-tracking/sqlInClause'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings/rounding-impact' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\n\nexport const DEFAULT_IMPACT_WINDOW_DAYS = 90\nconst MAX_IMPACT_WINDOW_DAYS = 365\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst querySchema = z.object({\n  unitMinutes: z.coerce.number().optional(),\n  direction: z.enum(['up', 'nearest']).optional(),\n  windowDays: z.coerce.number().int().min(1).max(MAX_IMPACT_WINDOW_DAYS).optional(),\n})\n\nconst impactSchema = z.object({\n  entryCount: z.number().int(),\n  rawMinutes: z.number().int(),\n  roundedMinutes: z.number().int(),\n  deltaMinutes: z.number().int(),\n})\n\nconst responseSchema = z.object({\n  windowDays: z.number().int(),\n  from: z.string(),\n  to: z.string(),\n  rounding: z.object({\n    unitMinutes: z.union([z.literal(0), z.literal(5), z.literal(10), z.literal(15)]),\n    direction: z.enum(['up', 'nearest']),\n  }),\n  /** The projection under the requested (or stored) rule, locked entries excluded. */\n  projected: impactSchema,\n  /** The same window under the rule currently stored, so the screen can show the move. */\n  current: impactSchema,\n  /** Entries in the window that a rounding change can never restate. */\n  lockedEntryCount: z.number().int(),\n})\n\nconst ROUNDING_UNITS: readonly number[] = [0, 5, 10, 15]\n\ntype BucketRow = {\n  duration_minutes: string | number | null\n  entry_count: string | number | null\n}\n\ntype LockedRow = {\n  locked_count: string | number | null\n}\n\nfunction toDateOnlyString(value: Date): string {\n  return value.toISOString().slice(0, 10)\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    if (!tenantId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const url = new URL(req.url)\n    const parsedQuery = querySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n    if (!parsedQuery.success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.invalid_request', 'Invalid request'),\n        details: parsedQuery.error.issues,\n      })\n    }\n\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const stored = await readTimeTrackingSettings(configService, { tenantId })\n\n    const requestedUnit = parsedQuery.data.unitMinutes\n    const candidate: RoundingSettings = {\n      unitMinutes:\n        typeof requestedUnit === 'number' && ROUNDING_UNITS.includes(requestedUnit)\n          ? (requestedUnit as RoundingUnitMinutes)\n          : stored.rounding.unitMinutes,\n      direction: (parsedQuery.data.direction ?? stored.rounding.direction) as RoundingDirection,\n    }\n\n    const windowDays = parsedQuery.data.windowDays ?? DEFAULT_IMPACT_WINDOW_DAYS\n    const to = new Date()\n    const from = new Date(to.getTime() - (windowDays - 1) * 24 * 60 * 60 * 1000)\n    const fromDate = toDateOnlyString(from)\n    const toDate = toDateOnlyString(to)\n\n    // Organizations narrow the same way every other read in the module does; a null\n    // filter list means \"every organization of this tenant\", which is what a\n    // tenant-global setting is asking about.\n    const organizationIds = scope?.filterIds ?? null\n    const orgIn = organizationIds ? buildSqlInClause('organization_id', organizationIds) : null\n    const orgClause = orgIn ? ` AND ${orgIn.sql}` : ''\n    const orgParams = orgIn ? orgIn.params : []\n\n    const em = container.resolve('em') as EntityManager\n    const connection = em.getConnection()\n\n    const bucketRows = (await connection.execute(\n      `\n        SELECT duration_minutes, COUNT(*)::bigint AS entry_count\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND deleted_at IS NULL\n          AND locked_report_id IS NULL\n          AND date >= ?::date\n          AND date <= ?::date${orgClause}\n        GROUP BY duration_minutes\n      `,\n      [tenantId, fromDate, toDate, ...orgParams],\n    )) as BucketRow[]\n\n    const lockedRows = (await connection.execute(\n      `\n        SELECT COUNT(*)::bigint AS locked_count\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND deleted_at IS NULL\n          AND locked_report_id IS NOT NULL\n          AND date >= ?::date\n          AND date <= ?::date${orgClause}\n      `,\n      [tenantId, fromDate, toDate, ...orgParams],\n    )) as LockedRow[]\n\n    const buckets: DurationBucket[] = (bucketRows ?? []).map((row) => ({\n      durationMinutes: Number(row.duration_minutes ?? 0),\n      entryCount: Number(row.entry_count ?? 0),\n    }))\n\n    const lockedRaw = Number(lockedRows?.[0]?.locked_count ?? 0)\n\n    return NextResponse.json(\n      {\n        windowDays,\n        from: fromDate,\n        to: toDate,\n        rounding: candidate,\n        projected: projectRoundingImpact(buckets, candidate),\n        current: projectRoundingImpact(buckets, stored.rounding),\n        lockedEntryCount: Number.isFinite(lockedRaw) ? lockedRaw : 0,\n      },\n      { status: 200 },\n    )\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.settings.rounding-impact failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Rounding impact preview',\n  methods: {\n    GET: {\n      summary: 'Project the billing impact of a rounding rule over a recent window',\n      description:\n        'Answers what the last `windowDays` (default 90) would have billed under a candidate rounding rule, before it is saved. Entries already locked into a closed report are excluded from the projection \u2014 they cannot be restated \u2014 and reported separately as `lockedEntryCount`. Rounding is applied per entry (D-7) through the same helper the write path uses.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'Rounding impact projection', schema: responseSchema },\n        { status: 400, description: 'Invalid request or missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n        { status: 500, description: 'Projection failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAsBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAG7B,SAAS,gCAAgC;AAEzC,SAAS,6BAAkD;AAC3D,SAAS,wBAAwB;AAEjC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,0CAA0C,CAAC;AAEnG,MAAM,iBAAiB;AAEhB,MAAM,6BAA6B;AAC1C,MAAM,yBAAyB;AAExB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC9D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,aAAa,EAAE,OAAO,OAAO,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sBAAsB,EAAE,SAAS;AAClF,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,gBAAgB,EAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,IAAI;AAC/B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,MAAM,EAAE,OAAO;AAAA,EACf,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,IACjB,aAAa,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,IAC/E,WAAW,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC;AAAA,EACrC,CAAC;AAAA;AAAA,EAED,WAAW;AAAA;AAAA,EAEX,SAAS;AAAA;AAAA,EAET,kBAAkB,EAAE,OAAO,EAAE,IAAI;AACnC,CAAC;AAED,MAAM,iBAAoC,CAAC,GAAG,GAAG,IAAI,EAAE;AAWvD,SAAS,iBAAiB,OAAqB;AAC7C,SAAO,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE;AACxC;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,cAAc,YAAY,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACxF,QAAI,CAAC,YAAY,SAAS;AACxB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,gCAAgC,iBAAiB;AAAA,QAClE,SAAS,YAAY,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH;AAEA,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,SAAS,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAEzE,UAAM,gBAAgB,YAAY,KAAK;AACvC,UAAM,YAA8B;AAAA,MAClC,aACE,OAAO,kBAAkB,YAAY,eAAe,SAAS,aAAa,IACrE,gBACD,OAAO,SAAS;AAAA,MACtB,WAAY,YAAY,KAAK,aAAa,OAAO,SAAS;AAAA,IAC5D;AAEA,UAAM,aAAa,YAAY,KAAK,cAAc;AAClD,UAAM,KAAK,oBAAI,KAAK;AACpB,UAAM,OAAO,IAAI,KAAK,GAAG,QAAQ,KAAK,aAAa,KAAK,KAAK,KAAK,KAAK,GAAI;AAC3E,UAAM,WAAW,iBAAiB,IAAI;AACtC,UAAM,SAAS,iBAAiB,EAAE;AAKlC,UAAM,kBAAkB,OAAO,aAAa;AAC5C,UAAM,QAAQ,kBAAkB,iBAAiB,mBAAmB,eAAe,IAAI;AACvF,UAAM,YAAY,QAAQ,QAAQ,MAAM,GAAG,KAAK;AAChD,UAAM,YAAY,QAAQ,MAAM,SAAS,CAAC;AAE1C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,aAAa,GAAG,cAAc;AAEpC,UAAM,aAAc,MAAM,WAAW;AAAA,MACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAOyB,SAAS;AAAA;AAAA;AAAA,MAGlC,CAAC,UAAU,UAAU,QAAQ,GAAG,SAAS;AAAA,IAC3C;AAEA,UAAM,aAAc,MAAM,WAAW;AAAA,MACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAOyB,SAAS;AAAA;AAAA,MAElC,CAAC,UAAU,UAAU,QAAQ,GAAG,SAAS;AAAA,IAC3C;AAEA,UAAM,WAA6B,cAAc,CAAC,GAAG,IAAI,CAAC,SAAS;AAAA,MACjE,iBAAiB,OAAO,IAAI,oBAAoB,CAAC;AAAA,MACjD,YAAY,OAAO,IAAI,eAAe,CAAC;AAAA,IACzC,EAAE;AAEF,UAAM,YAAY,OAAO,aAAa,CAAC,GAAG,gBAAgB,CAAC;AAE3D,WAAO,aAAa;AAAA,MAClB;AAAA,QACE;AAAA,QACA,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,WAAW,sBAAsB,SAAS,SAAS;AAAA,QACnD,SAAS,sBAAsB,SAAS,OAAO,QAAQ;AAAA,QACvD,kBAAkB,OAAO,SAAS,SAAS,IAAI,YAAY;AAAA,MAC7D;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,eAAe;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/settings/route.js

@@ -0,0 +1,199 @@
+import { NextResponse } from "next/server";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { emitStaffEvent } from "../../../events.js";
+import { buildTimeTrackingSettingsSchema } from "../../../lib/time-tracking/settingKeys.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../guards.js";
+import {
+  readSearchParamsRecord,
+  runTimesheetInterceptors
+} from "../_shared/withTimesheetInterceptors.js";
+import {
+  readTimeTrackingSettings,
+  writeTimeTrackingSettings
+} from "../../../lib/time-tracking/settings.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/settings" });
+const VIEW_FEATURE = "staff.timesheets.view";
+const MANAGE_FEATURE = "staff.timesheets.settings.manage";
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings;
+const RESOURCE_ID = "time_tracking";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },
+  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] }
+};
+function settingsResponseSchema() {
+  return buildTimeTrackingSettingsSchema();
+}
+async function resolveSettingsContext(req) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(req);
+  const { translate } = await resolveTranslations();
+  if (!auth || !auth.tenantId) {
+    throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+  }
+  const actorId = typeof auth.sub === "string" && auth.sub.trim().length > 0 && auth.sub || typeof auth.userId === "string" && auth.userId.trim().length > 0 && auth.userId || typeof auth.keyId === "string" && auth.keyId.trim().length > 0 && auth.keyId || "system";
+  return {
+    container,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+    actorId,
+    translate
+  };
+}
+function resolveConfigService(context) {
+  return context.container.resolve("moduleConfigService");
+}
+async function GET(req) {
+  try {
+    const context = await resolveSettingsContext(req);
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "GET",
+      scope: {
+        container: context.container,
+        userId: context.actorId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        tenantGlobal: true
+      },
+      query: readSearchParamsRecord(req.url)
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const settings = await readTimeTrackingSettings(resolveConfigService(context), {
+      tenantId: context.tenantId
+    });
+    return interceptors.session.respond(200, settings);
+  } catch (err) {
+    return errorResponse(err, "staff.timesheets.settings.GET failed");
+  }
+}
+async function PUT(req) {
+  try {
+    const context = await resolveSettingsContext(req);
+    const access = await resolveFeatureAccess(context.container, context.actorId || null, [MANAGE_FEATURE], {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId
+    });
+    if (!access.allowed) {
+      throw forbidden(context.translate("staff.errors.forbidden", "Forbidden"));
+    }
+    const grantedFeatures = access.grantedFeatures;
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "PUT",
+      scope: {
+        container: context.container,
+        userId: context.actorId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userFeatures: grantedFeatures,
+        tenantGlobal: true
+      },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const settingsSchema = buildTimeTrackingSettingsSchema();
+    const parsed = settingsSchema.parse(session.body);
+    const guardResult = await runRouteMutationGuards({
+      container: context.container,
+      req,
+      auth: {
+        userId: context.actorId,
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userFeatures: grantedFeatures
+      },
+      input: {
+        resourceKind: RESOURCE_KIND,
+        resourceId: RESOURCE_ID,
+        operation: "update",
+        mutationPayload: parsed
+      }
+    });
+    if (!guardResult.ok) return guardResult.response;
+    const effective = guardResult.modifiedPayload ? settingsSchema.parse({ ...parsed, ...guardResult.modifiedPayload }) : parsed;
+    const settings = await writeTimeTrackingSettings(
+      resolveConfigService(context),
+      { tenantId: context.tenantId },
+      effective
+    );
+    await guardResult.runAfterSuccess();
+    void emitStaffEvent("staff.timesheets.time_tracking.settings_updated", {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      settings
+    }, { persistent: true }).catch((err) => {
+      logger.error("staff.timesheets emit time_tracking.settings_updated failed", { err });
+    });
+    return session.respond(200, settings);
+  } catch (err) {
+    return errorResponse(err, "staff.timesheets.settings.PUT failed");
+  }
+}
+async function errorResponse(err, message) {
+  if (isCrudHttpError(err)) {
+    return NextResponse.json(err.body, { status: err.status });
+  }
+  const { translate } = await resolveTranslations();
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: translate("staff.errors.invalid_request", "Invalid request"), details: err.issues },
+      { status: 400 }
+    );
+  }
+  logger.error(message, { err });
+  return NextResponse.json(
+    { error: translate("staff.errors.internal", "Internal server error") },
+    { status: 500 }
+  );
+}
+const getDoc = {
+  summary: "Read time tracking settings",
+  tags: ["Staff"],
+  get responses() {
+    return [
+      { status: 200, description: "Tenant time tracking settings", schema: settingsResponseSchema() },
+      { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) }
+    ];
+  }
+};
+const putDoc = {
+  summary: "Update time tracking settings",
+  tags: ["Staff"],
+  get requestBody() {
+    return { schema: buildTimeTrackingSettingsSchema() };
+  },
+  get responses() {
+    return [
+      { status: 200, description: "Updated time tracking settings", schema: settingsResponseSchema() }
+    ];
+  },
+  errors: [
+    { status: 400, description: "Invalid request body" },
+    { status: 401, description: "Unauthorized" },
+    { status: 403, description: "Missing staff.timesheets.settings.manage" }
+  ]
+};
+const openApi = {
+  tag: "Staff",
+  summary: "Time tracking module settings",
+  methods: {
+    GET: getDoc,
+    PUT: putDoc
+  }
+};
+export {
+  GET,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/settings/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/settings/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../events'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { buildTimeTrackingSettingsSchema } from '../../../lib/time-tracking/settingKeys'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../guards'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\nimport {\n  readTimeTrackingSettings,\n  writeTimeTrackingSettings,\n  type TimeTrackingSettings,\n} from '../../../lib/time-tracking/settings'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings\nconst RESOURCE_ID = 'time_tracking'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\n/**\n * EP-42 \u2014 derived from the setting-key registry, so a contributed key is published in\n * the OpenAPI response shape instead of being invisible to it. Rebuilt per read for the\n * same reason the request schema is: a key may be registered after this module loads.\n */\nfunction settingsResponseSchema(): z.ZodTypeAny {\n  return buildTimeTrackingSettingsSchema()\n}\n\ntype SettingsContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  tenantId: string\n  organizationId: string | null\n  actorId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nasync function resolveSettingsContext(req: Request): Promise<SettingsContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n  const actorId =\n    (typeof auth.sub === 'string' && auth.sub.trim().length > 0 && auth.sub) ||\n    (typeof auth.userId === 'string' && auth.userId.trim().length > 0 && auth.userId) ||\n    (typeof auth.keyId === 'string' && auth.keyId.trim().length > 0 && auth.keyId) ||\n    'system'\n  return {\n    container,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId ?? null,\n    actorId,\n    translate,\n  }\n}\n\nfunction resolveConfigService(context: SettingsContext): ModuleConfigService {\n  return context.container.resolve('moduleConfigService') as ModuleConfigService\n}\n\nasync function GET(req: Request) {\n  try {\n    const context = await resolveSettingsContext(req)\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: {\n        container: context.container,\n        userId: context.actorId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        tenantGlobal: true,\n      },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n\n    const settings = await readTimeTrackingSettings(resolveConfigService(context), {\n      tenantId: context.tenantId,\n    })\n    return interceptors.session.respond(200, settings)\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.settings.GET failed')\n  }\n}\n\nasync function PUT(req: Request) {\n  try {\n    const context = await resolveSettingsContext(req)\n    // One lookup through the module's single RBAC authority, answering both\n    // questions this route asks: may the caller manage settings, and what grant\n    // list do the interceptors and the mutation-guard registry gate on. The\n    // decision is checked unconditionally and fails closed; the list is plumbing\n    // and is empty \u2014 never absent \u2014 when RBAC could not produce it.\n    const access = await resolveFeatureAccess(context.container, context.actorId || null, [MANAGE_FEATURE], {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    })\n    if (!access.allowed) {\n      throw forbidden(context.translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = access.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PUT',\n      scope: {\n        container: context.container,\n        userId: context.actorId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userFeatures: grantedFeatures,\n        tenantGlobal: true,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const settingsSchema = buildTimeTrackingSettingsSchema()\n    const parsed = settingsSchema.parse(session.body)\n\n    const guardResult = await runRouteMutationGuards({\n      container: context.container,\n      req,\n      auth: {\n        userId: context.actorId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: RESOURCE_ID,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? settingsSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const settings: TimeTrackingSettings = await writeTimeTrackingSettings(\n      resolveConfigService(context),\n      { tenantId: context.tenantId },\n      effective,\n    )\n\n    await guardResult.runAfterSuccess()\n\n    void emitStaffEvent('staff.timesheets.time_tracking.settings_updated', {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      settings,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_tracking.settings_updated failed', { err })\n    })\n\n    return session.respond(200, settings)\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.settings.PUT failed')\n  }\n}\n\nasync function errorResponse(err: unknown, message: string) {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json(\n    { error: translate('staff.errors.internal', 'Internal server error') },\n    { status: 500 },\n  )\n}\n\nconst getDoc: OpenApiMethodDoc = {\n  summary: 'Read time tracking settings',\n  tags: ['Staff'],\n  get responses() {\n    return [\n      { status: 200, description: 'Tenant time tracking settings', schema: settingsResponseSchema() },\n      { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n    ]\n  },\n}\n\nconst putDoc: OpenApiMethodDoc = {\n  summary: 'Update time tracking settings',\n  tags: ['Staff'],\n  get requestBody() {\n    return { schema: buildTimeTrackingSettingsSchema() }\n  },\n  get responses() {\n    return [\n      { status: 200, description: 'Updated time tracking settings', schema: settingsResponseSchema() },\n    ]\n  },\n  errors: [\n    { status: 400, description: 'Invalid request body' },\n    { status: 401, description: 'Unauthorized' },\n    { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time tracking module settings',\n  methods: {\n    GET: getDoc,\n    PUT: putDoc,\n  },\n}\n\nexport { GET, PUT }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAG/B,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,0BAA0B,CAAC;AAEnF,MAAM,eAAe;AACrB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,mCAAmC;AACzD,MAAM,cAAc;AAEb,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC9D;AAOA,SAAS,yBAAuC;AAC9C,SAAO,gCAAgC;AACzC;AAUA,eAAe,uBAAuB,KAAwC;AAC5E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AACA,QAAM,UACH,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,KAAK,KAAK,OACnE,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,KAAK,KAAK,UACzE,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,KAAK,KAAK,SACxE;AACF,SAAO;AAAA,IACL;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAA+C;AAC3E,SAAO,QAAQ,UAAU,QAAQ,qBAAqB;AACxD;AAEA,eAAe,IAAI,KAAc;AAC/B,MAAI;AACF,UAAM,UAAU,MAAM,uBAAuB,GAAG;AAChD,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,cAAc;AAAA,MAChB;AAAA,MACA,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAE1C,UAAM,WAAW,MAAM,yBAAyB,qBAAqB,OAAO,GAAG;AAAA,MAC7E,UAAU,QAAQ;AAAA,IACpB,CAAC;AACD,WAAO,aAAa,QAAQ,QAAQ,KAAK,QAAQ;AAAA,EACnD,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,sCAAsC;AAAA,EAClE;AACF;AAEA,eAAe,IAAI,KAAc;AAC/B,MAAI;AACF,UAAM,UAAU,MAAM,uBAAuB,GAAG;AAMhD,UAAM,SAAS,MAAM,qBAAqB,QAAQ,WAAW,QAAQ,WAAW,MAAM,CAAC,cAAc,GAAG;AAAA,MACtG,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,UAAU,QAAQ,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAC1E;AACA,UAAM,kBAAkB,OAAO;AAE/B,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,iBAAiB,gCAAgC;AACvD,UAAM,SAAS,eAAe,MAAM,QAAQ,IAAI;AAEhD,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,eAAe,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAClE;AAEJ,UAAM,WAAiC,MAAM;AAAA,MAC3C,qBAAqB,OAAO;AAAA,MAC5B,EAAE,UAAU,QAAQ,SAAS;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,YAAY,gBAAgB;AAElC,SAAK,eAAe,mDAAmD;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,+DAA+D,EAAE,IAAI,CAAC;AAAA,IACrF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK,QAAQ;AAAA,EACtC,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,sCAAsC;AAAA,EAClE;AACF;AAEA,eAAe,cAAc,KAAc,SAAiB;AAC1D,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,MAAM,SAA2B;AAAA,EAC/B,SAAS;AAAA,EACT,MAAM,CAAC,OAAO;AAAA,EACd,IAAI,YAAY;AACd,WAAO;AAAA,MACL,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,uBAAuB,EAAE;AAAA,MAC9F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,IACtF;AAAA,EACF;AACF;AAEA,MAAM,SAA2B;AAAA,EAC/B,SAAS;AAAA,EACT,MAAM,CAAC,OAAO;AAAA,EACd,IAAI,cAAc;AAChB,WAAO,EAAE,QAAQ,gCAAgC,EAAE;AAAA,EACrD;AAAA,EACA,IAAI,YAAY;AACd,WAAO;AAAA,MACL,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,uBAAuB,EAAE;AAAA,IACjG;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,IACnD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,IAC3C,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,EACzE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/tags/access.js

@@ -0,0 +1,76 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { StaffTimeEntry, StaffTimeTask } from "../../../data/entities.js";
+import { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from "../../../lib/time-tracking/access.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/tags" });
+const DENIED_ACCESS = { canManageAll: false, projectIds: [], staffMemberId: null };
+async function resolveAssignmentGraceDays(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    const settings = await readTimeTrackingSettings(configService, { tenantId });
+    return settings.access.assignmentGraceDays;
+  } catch {
+    return null;
+  }
+}
+async function loadTagProjectAccess(container, scope) {
+  try {
+    const access = await resolveFeatureAccess(container, scope.userId, [MANAGE_PROJECTS_FEATURE], {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId
+    });
+    const em = container.resolve("em");
+    return await resolveProjectAccess({
+      em: em.fork(),
+      userId: scope.userId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      canManageAll: access.allowed,
+      userFeatures: access.grantedFeatures,
+      assignmentGraceDays: await resolveAssignmentGraceDays(container, scope.tenantId)
+    });
+  } catch (err) {
+    logger.error("staff.timesheets.tags access resolution failed", { err });
+    return { ...DENIED_ACCESS };
+  }
+}
+function targetNotFound(translate, target) {
+  const message = target === "task" ? translate("staff.time_tracking.tags.errors.taskNotFound", "Task not found or not accessible.") : translate("staff.time_tracking.tags.errors.entryNotFound", "Time entry not found or not accessible.");
+  return new CrudHttpError(404, { error: message });
+}
+async function requireAccessibleTask(em, taskId, scope, access, translate) {
+  const task = await em.findOne(StaffTimeTask, {
+    id: taskId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    deletedAt: null
+  });
+  if (!task) throw targetNotFound(translate, "task");
+  if (!access.canManageAll && !access.projectIds.includes(task.timeProjectId)) {
+    throw targetNotFound(translate, "task");
+  }
+  return { id: task.id, timeProjectId: task.timeProjectId };
+}
+async function requireAccessibleTimeEntry(em, timeEntryId, scope, access, translate) {
+  const entry = await em.findOne(StaffTimeEntry, {
+    id: timeEntryId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    deletedAt: null
+  });
+  if (!entry) throw targetNotFound(translate, "time_entry");
+  if (!access.canManageAll) {
+    const projectId = entry.timeProjectId ?? null;
+    const reachable = projectId ? access.projectIds.includes(projectId) : access.staffMemberId != null && entry.staffMemberId === access.staffMemberId;
+    if (!reachable) throw targetNotFound(translate, "time_entry");
+  }
+  return { id: entry.id, timeProjectId: entry.timeProjectId ?? null };
+}
+export {
+  loadTagProjectAccess,
+  requireAccessibleTask,
+  requireAccessibleTimeEntry
+};
+//# sourceMappingURL=access.js.map

package/dist/modules/staff/api/timesheets/tags/access.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/tags/access.ts"],
+  "sourcesContent": ["/**\n * Shared access filtering for the two tag-assignment endpoints (T3.4).\n *\n * Tagging a task or a time entry is a write on a project-scoped row, so it goes\n * through the same resolver every other project-scoped read and write uses: a\n * caller without `staff.timesheets.projects.manage` only reaches the projects\n * they are an active member of. Skipping the resolver here would let anyone with\n * `tasks.manage` tag a task on a project they cannot even see \u2014 that is the R3\n * defect class, and it is why the target lookup below is never done without it.\n *\n * The refusal is a flat 404 with a generic message. \"Not yours\" and \"does not\n * exist\" are deliberately indistinguishable, so the endpoint cannot be used to\n * probe which task or entry ids exist.\n */\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry, StaffTimeTask } from '../../../data/entities'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags' })\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\nexport type ContainerLike = { resolve: (name: string) => unknown }\n\nexport type TagAssignmentScope = {\n  tenantId: string\n  organizationId: string\n  userId: string\n}\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nexport async function loadTagProjectAccess(\n  container: ContainerLike,\n  scope: TagAssignmentScope,\n): Promise<ProjectAccess> {\n  try {\n    // One lookup, one authority, one failure direction. The hand-rolled grant read\n    // this replaces could not tell \"denied\" from \"could not ask\", so an RBAC hiccup\n    // silently demoted a manager to their own memberships.\n    const access = await resolveFeatureAccess(container, scope.userId, [MANAGE_PROJECTS_FEATURE], {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    })\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, scope.tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.tags access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nfunction targetNotFound(translate: (key: string, fallback: string) => string, target: 'task' | 'time_entry'): CrudHttpError {\n  const message =\n    target === 'task'\n      ? translate('staff.time_tracking.tags.errors.taskNotFound', 'Task not found or not accessible.')\n      : translate('staff.time_tracking.tags.errors.entryNotFound', 'Time entry not found or not accessible.')\n  return new CrudHttpError(404, { error: message })\n}\n\n/**\n * Loads the task inside the caller's tenant/organization AND inside the projects\n * the resolver grants them. Both misses answer the same 404.\n */\nexport async function requireAccessibleTask(\n  em: EntityManager,\n  taskId: string,\n  scope: TagAssignmentScope,\n  access: ProjectAccess,\n  translate: (key: string, fallback: string) => string,\n): Promise<{ id: string; timeProjectId: string }> {\n  const task = await em.findOne(StaffTimeTask, {\n    id: taskId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n  if (!task) throw targetNotFound(translate, 'task')\n  if (!access.canManageAll && !access.projectIds.includes(task.timeProjectId)) {\n    throw targetNotFound(translate, 'task')\n  }\n  return { id: task.id, timeProjectId: task.timeProjectId }\n}\n\n/**\n * Same rule for a time entry, with one extra branch: an entry that carries no\n * project is personal time, reachable only by the member who logged it (or by a\n * manager).\n */\nexport async function requireAccessibleTimeEntry(\n  em: EntityManager,\n  timeEntryId: string,\n  scope: TagAssignmentScope,\n  access: ProjectAccess,\n  translate: (key: string, fallback: string) => string,\n): Promise<{ id: string; timeProjectId: string | null }> {\n  const entry = await em.findOne(StaffTimeEntry, {\n    id: timeEntryId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n  if (!entry) throw targetNotFound(translate, 'time_entry')\n  if (!access.canManageAll) {\n    const projectId = entry.timeProjectId ?? null\n    const reachable = projectId\n      ? access.projectIds.includes(projectId)\n      : access.staffMemberId != null && entry.staffMemberId === access.staffMemberId\n    if (!reachable) throw targetNotFound(translate, 'time_entry')\n  }\n  return { id: entry.id, timeProjectId: entry.timeProjectId ?? null }\n}\n"],
+  "mappings": "AAeA,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB,qBAAqB;AAC9C,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,sBAAsB,CAAC;AAE/E,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAUhG,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,qBACpB,WACA,OACwB;AACxB,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,MAAM,QAAQ,CAAC,uBAAuB,GAAG;AAAA,MAC5F,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,MAAM,QAAQ;AAAA,IACjF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AACtE,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,SAAS,eAAe,WAAsD,QAA8C;AAC1H,QAAM,UACJ,WAAW,SACP,UAAU,gDAAgD,mCAAmC,IAC7F,UAAU,iDAAiD,yCAAyC;AAC1G,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAClD;AAMA,eAAsB,sBACpB,IACA,QACA,OACA,QACA,WACgD;AAChD,QAAM,OAAO,MAAM,GAAG,QAAQ,eAAe;AAAA,IAC3C,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,KAAM,OAAM,eAAe,WAAW,MAAM;AACjD,MAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,WAAW,SAAS,KAAK,aAAa,GAAG;AAC3E,UAAM,eAAe,WAAW,MAAM;AAAA,EACxC;AACA,SAAO,EAAE,IAAI,KAAK,IAAI,eAAe,KAAK,cAAc;AAC1D;AAOA,eAAsB,2BACpB,IACA,aACA,OACA,QACA,WACuD;AACvD,QAAM,QAAQ,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAC7C,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,eAAe,WAAW,YAAY;AACxD,MAAI,CAAC,OAAO,cAAc;AACxB,UAAM,YAAY,MAAM,iBAAiB;AACzC,UAAM,YAAY,YACd,OAAO,WAAW,SAAS,SAAS,IACpC,OAAO,iBAAiB,QAAQ,MAAM,kBAAkB,OAAO;AACnE,QAAI,CAAC,UAAW,OAAM,eAAe,WAAW,YAAY;AAAA,EAC9D;AACA,SAAO,EAAE,IAAI,MAAM,IAAI,eAAe,MAAM,iBAAiB,KAAK;AACpE;",
+  "names": []
+}