npm - @open-mercato/core - Versions diffs - 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43 - Mend

@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (808) hide show

package/dist/modules/staff/ai-tools.js ADDED Viewed

@@ -0,0 +1,8 @@
+import timeTrackingAiTools from "./ai-tools/time-tracking-pack.js";
+const aiTools = [...timeTrackingAiTools];
+var ai_tools_default = aiTools;
+export {
+  aiTools,
+  ai_tools_default as default
+};
+//# sourceMappingURL=ai-tools.js.map

package/dist/modules/staff/ai-tools.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/staff/ai-tools.ts"],
+  "sourcesContent": ["import type { AiToolDefinition } from '@open-mercato/ai-assistant/modules/ai_assistant/lib/types'\nimport timeTrackingAiTools from './ai-tools/time-tracking-pack'\n\n/**\n * EP-49. The module's AI tool registry.\n *\n * The generator discovers `ai-tools.ts` at the module root only, so a pack living\n * in `ai-tools/` reaches the runtime through this aggregator \u2014 the customers\n * idiom.\n */\nexport const aiTools: AiToolDefinition[] = [...timeTrackingAiTools]\n\nexport default aiTools\n"],
+  "mappings": "AACA,OAAO,yBAAyB;AASzB,MAAM,UAA8B,CAAC,GAAG,mBAAmB;AAElE,IAAO,mBAAQ;",
+  "names": []
+}

package/dist/modules/staff/analytics.js CHANGED Viewed

@@ -11,14 +11,97 @@ const analyticsConfig = {
       fieldMappings: {
         id: { dbColumn: "id", type: "uuid" },
         durationMinutes: { dbColumn: "duration_minutes", type: "numeric" },
+        roundedMinutes: { dbColumn: "rounded_minutes", type: "numeric" },
         date: { dbColumn: "date", type: "timestamp" },
         timeProjectId: { dbColumn: "time_project_id", type: "uuid" },
         staffMemberId: { dbColumn: "staff_member_id", type: "uuid" },
+        taskId: { dbColumn: "task_id", type: "uuid" },
+        customerId: { dbColumn: "customer_id", type: "uuid" },
+        isBillable: { dbColumn: "is_billable", type: "text" },
+        lockedReportId: { dbColumn: "locked_report_id", type: "uuid" },
         source: { dbColumn: "source", type: "text" }
       },
       labelResolvers: {
         timeProjectId: { table: "staff_time_projects", idColumn: "id", labelColumn: "name" },
-        staffMemberId: { table: "staff_team_members", idColumn: "id", labelColumn: "display_name" }
+        staffMemberId: { table: "staff_team_members", idColumn: "id", labelColumn: "display_name" },
+        taskId: { table: "staff_time_tasks", idColumn: "id", labelColumn: "title" },
+        customerId: { table: "customer_entities", idColumn: "id", labelColumn: "display_name" },
+        lockedReportId: { table: "staff_time_reports", idColumn: "id", labelColumn: "reference" }
+      }
+    },
+    {
+      entityId: "staff:staff_time_tasks",
+      requiredFeatures: ["staff.timesheets.tasks.view"],
+      entityConfig: {
+        tableName: "staff_time_tasks",
+        dateField: "created_at",
+        defaultScopeFields: ["tenant_id", "organization_id"]
+      },
+      fieldMappings: {
+        id: { dbColumn: "id", type: "uuid" },
+        reference: { dbColumn: "reference", type: "text" },
+        timeProjectId: { dbColumn: "time_project_id", type: "uuid" },
+        parentTaskId: { dbColumn: "parent_task_id", type: "uuid" },
+        taskStatusId: { dbColumn: "task_status_id", type: "uuid" },
+        assigneeStaffMemberId: { dbColumn: "assignee_staff_member_id", type: "uuid" },
+        createdAt: { dbColumn: "created_at", type: "timestamp" },
+        closedAt: { dbColumn: "closed_at", type: "timestamp" }
+      },
+      labelResolvers: {
+        timeProjectId: { table: "staff_time_projects", idColumn: "id", labelColumn: "name" },
+        taskStatusId: { table: "staff_time_task_statuses", idColumn: "id", labelColumn: "name" },
+        assigneeStaffMemberId: { table: "staff_team_members", idColumn: "id", labelColumn: "display_name" },
+        parentTaskId: { table: "staff_time_tasks", idColumn: "id", labelColumn: "title" }
+      }
+    },
+    {
+      entityId: "staff:staff_time_projects",
+      requiredFeatures: ["staff.timesheets.projects.view"],
+      entityConfig: {
+        tableName: "staff_time_projects",
+        dateField: "created_at",
+        defaultScopeFields: ["tenant_id", "organization_id"]
+      },
+      fieldMappings: {
+        id: { dbColumn: "id", type: "uuid" },
+        code: { dbColumn: "code", type: "text" },
+        customerId: { dbColumn: "customer_id", type: "uuid" },
+        projectType: { dbColumn: "project_type", type: "text" },
+        status: { dbColumn: "status", type: "text" },
+        ownerUserId: { dbColumn: "owner_user_id", type: "uuid" },
+        costCenter: { dbColumn: "cost_center", type: "text" },
+        budgetKind: { dbColumn: "budget_kind", type: "text" },
+        billableByDefault: { dbColumn: "billable_by_default", type: "text" },
+        startDate: { dbColumn: "start_date", type: "timestamp" },
+        createdAt: { dbColumn: "created_at", type: "timestamp" }
+      },
+      labelResolvers: {
+        customerId: { table: "customer_entities", idColumn: "id", labelColumn: "display_name" }
+      }
+    },
+    {
+      entityId: "staff:staff_time_reports",
+      requiredFeatures: ["staff.timesheets.reports.view"],
+      entityConfig: {
+        tableName: "staff_time_reports",
+        dateField: "period_from",
+        defaultScopeFields: ["tenant_id", "organization_id"]
+      },
+      fieldMappings: {
+        id: { dbColumn: "id", type: "uuid" },
+        reference: { dbColumn: "reference", type: "text" },
+        customerId: { dbColumn: "customer_id", type: "uuid" },
+        status: { dbColumn: "status", type: "text" },
+        periodKind: { dbColumn: "period_kind", type: "text" },
+        periodFrom: { dbColumn: "period_from", type: "timestamp" },
+        periodTo: { dbColumn: "period_to", type: "timestamp" },
+        grouping: { dbColumn: "grouping", type: "text" },
+        totalBillableMinutes: { dbColumn: "total_billable_minutes", type: "numeric" },
+        totalNonbillableMinutes: { dbColumn: "total_nonbillable_minutes", type: "numeric" },
+        closedAt: { dbColumn: "closed_at", type: "timestamp" }
+      },
+      labelResolvers: {
+        customerId: { table: "customer_entities", idColumn: "id", labelColumn: "display_name" }
       }
     }
   ]

package/dist/modules/staff/analytics.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/staff/analytics.ts"],
-  "sourcesContent": ["import type { AnalyticsModuleConfig } from '@open-mercato/shared/modules/analytics'\n\nexport const analyticsConfig: AnalyticsModuleConfig = {\n  entities: [\n    {\n      entityId: 'staff:staff_time_entries',\n      requiredFeatures: ['staff.timesheets.view'],\n      entityConfig: {\n        tableName: 'staff_time_entries',\n        dateField: 'date',\n        defaultScopeFields: ['tenant_id', 'organization_id'],\n      },\n      fieldMappings: {\n        id: { dbColumn: 'id', type: 'uuid' },\n        durationMinutes: { dbColumn: 'duration_minutes', type: 'numeric' },\n        date: { dbColumn: 'date', type: 'timestamp' },\n        timeProjectId: { dbColumn: 'time_project_id', type: 'uuid' },\n        staffMemberId: { dbColumn: 'staff_member_id', type: 'uuid' },\n        source: { dbColumn: 'source', type: 'text' },\n      },\n      labelResolvers: {\n        timeProjectId: { table: 'staff_time_projects', idColumn: 'id', labelColumn: 'name' },\n        staffMemberId: { table: 'staff_team_members', idColumn: 'id', labelColumn: 'display_name' },\n      },\n    },\n  ],\n}\n\nexport const config = analyticsConfig\nexport default analyticsConfig\n"],
-  "mappings": "AAEO,MAAM,kBAAyC;AAAA,EACpD,UAAU;AAAA,IACR;AAAA,MACE,UAAU;AAAA,MACV,kBAAkB,CAAC,uBAAuB;AAAA,MAC1C,cAAc;AAAA,QACZ,WAAW;AAAA,QACX,WAAW;AAAA,QACX,oBAAoB,CAAC,aAAa,iBAAiB;AAAA,MACrD;AAAA,MACA,eAAe;AAAA,QACb,IAAI,EAAE,UAAU,MAAM,MAAM,OAAO;AAAA,QACnC,iBAAiB,EAAE,UAAU,oBAAoB,MAAM,UAAU;AAAA,QACjE,MAAM,EAAE,UAAU,QAAQ,MAAM,YAAY;AAAA,QAC5C,eAAe,EAAE,UAAU,mBAAmB,MAAM,OAAO;AAAA,QAC3D,eAAe,EAAE,UAAU,mBAAmB,MAAM,OAAO;AAAA,QAC3D,QAAQ,EAAE,UAAU,UAAU,MAAM,OAAO;AAAA,MAC7C;AAAA,MACA,gBAAgB;AAAA,QACd,eAAe,EAAE,OAAO,uBAAuB,UAAU,MAAM,aAAa,OAAO;AAAA,QACnF,eAAe,EAAE,OAAO,sBAAsB,UAAU,MAAM,aAAa,eAAe;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,SAAS;AACtB,IAAO,oBAAQ;",
+  "sourcesContent": ["import type { AnalyticsModuleConfig } from '@open-mercato/shared/modules/analytics'\n\n/**\n * EP-47. Four time-tracking entities are aggregatable from a dashboard widget.\n *\n * Two rules shape every mapping below.\n *\n * **Money is absent, never blanked.** `staff_time_entries.rate_override_amount`,\n * `staff_time_projects.hourly_rate` / `budget_value` and\n * `staff_time_reports.total_amount` are deliberately NOT mapped. An\n * `AnalyticsEntityConfig` carries a single `requiredFeatures` list for the whole\n * entity, so there is no shape in which a money column is gated on\n * `staff.timesheets.rates.view` while the rest of the entity stays readable by a\n * plain viewer \u2014 and mapping it under the weaker gate would hand every dashboard\n * author the customer's rates. The minute columns carry the same analysis\n * without the disclosure.\n *\n * **Custom fields are not dimensions and cannot be.** `AnalyticsFieldMapping` is\n * `{ dbColumn, type }` and the aggregation builder emits `dbColumn` as a bare\n * identifier against `entityConfig.tableName` (`dashboards/lib/aggregations.ts`),\n * so a mapping can only ever name a real column on that one table. The custom\n * fields EP-43 declared are EAV rows in the `entities` module's tables, reachable\n * by neither a join nor the jsonb-path form (which needs the values to live in a\n * jsonb column on the row itself). The point is moot in any case while the\n * command-backed write path drops `cf_*` on the way in \u2014 see the module\n * `AGENTS.md` \u00A7 Time-tracking custom fields.\n *\n * `is_billable` and `billable_by_default` are declared `text` because\n * `AnalyticsFieldType` has no boolean member; the type is read for exactly one\n * decision \u2014 whether a group-by column gets a `date_trunc` \u2014 so a boolean column\n * grouped as `text` is emitted verbatim and labelled by its own value.\n */\nexport const analyticsConfig: AnalyticsModuleConfig = {\n  entities: [\n    {\n      entityId: 'staff:staff_time_entries',\n      requiredFeatures: ['staff.timesheets.view'],\n      entityConfig: {\n        tableName: 'staff_time_entries',\n        dateField: 'date',\n        defaultScopeFields: ['tenant_id', 'organization_id'],\n      },\n      fieldMappings: {\n        id: { dbColumn: 'id', type: 'uuid' },\n        durationMinutes: { dbColumn: 'duration_minutes', type: 'numeric' },\n        roundedMinutes: { dbColumn: 'rounded_minutes', type: 'numeric' },\n        date: { dbColumn: 'date', type: 'timestamp' },\n        timeProjectId: { dbColumn: 'time_project_id', type: 'uuid' },\n        staffMemberId: { dbColumn: 'staff_member_id', type: 'uuid' },\n        taskId: { dbColumn: 'task_id', type: 'uuid' },\n        customerId: { dbColumn: 'customer_id', type: 'uuid' },\n        isBillable: { dbColumn: 'is_billable', type: 'text' },\n        lockedReportId: { dbColumn: 'locked_report_id', type: 'uuid' },\n        source: { dbColumn: 'source', type: 'text' },\n      },\n      labelResolvers: {\n        timeProjectId: { table: 'staff_time_projects', idColumn: 'id', labelColumn: 'name' },\n        staffMemberId: { table: 'staff_team_members', idColumn: 'id', labelColumn: 'display_name' },\n        taskId: { table: 'staff_time_tasks', idColumn: 'id', labelColumn: 'title' },\n        customerId: { table: 'customer_entities', idColumn: 'id', labelColumn: 'display_name' },\n        lockedReportId: { table: 'staff_time_reports', idColumn: 'id', labelColumn: 'reference' },\n      },\n    },\n    {\n      entityId: 'staff:staff_time_tasks',\n      requiredFeatures: ['staff.timesheets.tasks.view'],\n      entityConfig: {\n        tableName: 'staff_time_tasks',\n        dateField: 'created_at',\n        defaultScopeFields: ['tenant_id', 'organization_id'],\n      },\n      fieldMappings: {\n        id: { dbColumn: 'id', type: 'uuid' },\n        reference: { dbColumn: 'reference', type: 'text' },\n        timeProjectId: { dbColumn: 'time_project_id', type: 'uuid' },\n        parentTaskId: { dbColumn: 'parent_task_id', type: 'uuid' },\n        taskStatusId: { dbColumn: 'task_status_id', type: 'uuid' },\n        assigneeStaffMemberId: { dbColumn: 'assignee_staff_member_id', type: 'uuid' },\n        createdAt: { dbColumn: 'created_at', type: 'timestamp' },\n        closedAt: { dbColumn: 'closed_at', type: 'timestamp' },\n      },\n      labelResolvers: {\n        timeProjectId: { table: 'staff_time_projects', idColumn: 'id', labelColumn: 'name' },\n        taskStatusId: { table: 'staff_time_task_statuses', idColumn: 'id', labelColumn: 'name' },\n        assigneeStaffMemberId: { table: 'staff_team_members', idColumn: 'id', labelColumn: 'display_name' },\n        parentTaskId: { table: 'staff_time_tasks', idColumn: 'id', labelColumn: 'title' },\n      },\n    },\n    {\n      entityId: 'staff:staff_time_projects',\n      requiredFeatures: ['staff.timesheets.projects.view'],\n      entityConfig: {\n        tableName: 'staff_time_projects',\n        dateField: 'created_at',\n        defaultScopeFields: ['tenant_id', 'organization_id'],\n      },\n      fieldMappings: {\n        id: { dbColumn: 'id', type: 'uuid' },\n        code: { dbColumn: 'code', type: 'text' },\n        customerId: { dbColumn: 'customer_id', type: 'uuid' },\n        projectType: { dbColumn: 'project_type', type: 'text' },\n        status: { dbColumn: 'status', type: 'text' },\n        ownerUserId: { dbColumn: 'owner_user_id', type: 'uuid' },\n        costCenter: { dbColumn: 'cost_center', type: 'text' },\n        budgetKind: { dbColumn: 'budget_kind', type: 'text' },\n        billableByDefault: { dbColumn: 'billable_by_default', type: 'text' },\n        startDate: { dbColumn: 'start_date', type: 'timestamp' },\n        createdAt: { dbColumn: 'created_at', type: 'timestamp' },\n      },\n      labelResolvers: {\n        customerId: { table: 'customer_entities', idColumn: 'id', labelColumn: 'display_name' },\n      },\n    },\n    {\n      entityId: 'staff:staff_time_reports',\n      requiredFeatures: ['staff.timesheets.reports.view'],\n      entityConfig: {\n        tableName: 'staff_time_reports',\n        dateField: 'period_from',\n        defaultScopeFields: ['tenant_id', 'organization_id'],\n      },\n      fieldMappings: {\n        id: { dbColumn: 'id', type: 'uuid' },\n        reference: { dbColumn: 'reference', type: 'text' },\n        customerId: { dbColumn: 'customer_id', type: 'uuid' },\n        status: { dbColumn: 'status', type: 'text' },\n        periodKind: { dbColumn: 'period_kind', type: 'text' },\n        periodFrom: { dbColumn: 'period_from', type: 'timestamp' },\n        periodTo: { dbColumn: 'period_to', type: 'timestamp' },\n        grouping: { dbColumn: 'grouping', type: 'text' },\n        totalBillableMinutes: { dbColumn: 'total_billable_minutes', type: 'numeric' },\n        totalNonbillableMinutes: { dbColumn: 'total_nonbillable_minutes', type: 'numeric' },\n        closedAt: { dbColumn: 'closed_at', type: 'timestamp' },\n      },\n      labelResolvers: {\n        customerId: { table: 'customer_entities', idColumn: 'id', labelColumn: 'display_name' },\n      },\n    },\n  ],\n}\n\nexport const config = analyticsConfig\nexport default analyticsConfig\n"],
+  "mappings": "AAgCO,MAAM,kBAAyC;AAAA,EACpD,UAAU;AAAA,IACR;AAAA,MACE,UAAU;AAAA,MACV,kBAAkB,CAAC,uBAAuB;AAAA,MAC1C,cAAc;AAAA,QACZ,WAAW;AAAA,QACX,WAAW;AAAA,QACX,oBAAoB,CAAC,aAAa,iBAAiB;AAAA,MACrD;AAAA,MACA,eAAe;AAAA,QACb,IAAI,EAAE,UAAU,MAAM,MAAM,OAAO;AAAA,QACnC,iBAAiB,EAAE,UAAU,oBAAoB,MAAM,UAAU;AAAA,QACjE,gBAAgB,EAAE,UAAU,mBAAmB,MAAM,UAAU;AAAA,QAC/D,MAAM,EAAE,UAAU,QAAQ,MAAM,YAAY;AAAA,QAC5C,eAAe,EAAE,UAAU,mBAAmB,MAAM,OAAO;AAAA,QAC3D,eAAe,EAAE,UAAU,mBAAmB,MAAM,OAAO;AAAA,QAC3D,QAAQ,EAAE,UAAU,WAAW,MAAM,OAAO;AAAA,QAC5C,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,gBAAgB,EAAE,UAAU,oBAAoB,MAAM,OAAO;AAAA,QAC7D,QAAQ,EAAE,UAAU,UAAU,MAAM,OAAO;AAAA,MAC7C;AAAA,MACA,gBAAgB;AAAA,QACd,eAAe,EAAE,OAAO,uBAAuB,UAAU,MAAM,aAAa,OAAO;AAAA,QACnF,eAAe,EAAE,OAAO,sBAAsB,UAAU,MAAM,aAAa,eAAe;AAAA,QAC1F,QAAQ,EAAE,OAAO,oBAAoB,UAAU,MAAM,aAAa,QAAQ;AAAA,QAC1E,YAAY,EAAE,OAAO,qBAAqB,UAAU,MAAM,aAAa,eAAe;AAAA,QACtF,gBAAgB,EAAE,OAAO,sBAAsB,UAAU,MAAM,aAAa,YAAY;AAAA,MAC1F;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,kBAAkB,CAAC,6BAA6B;AAAA,MAChD,cAAc;AAAA,QACZ,WAAW;AAAA,QACX,WAAW;AAAA,QACX,oBAAoB,CAAC,aAAa,iBAAiB;AAAA,MACrD;AAAA,MACA,eAAe;AAAA,QACb,IAAI,EAAE,UAAU,MAAM,MAAM,OAAO;AAAA,QACnC,WAAW,EAAE,UAAU,aAAa,MAAM,OAAO;AAAA,QACjD,eAAe,EAAE,UAAU,mBAAmB,MAAM,OAAO;AAAA,QAC3D,cAAc,EAAE,UAAU,kBAAkB,MAAM,OAAO;AAAA,QACzD,cAAc,EAAE,UAAU,kBAAkB,MAAM,OAAO;AAAA,QACzD,uBAAuB,EAAE,UAAU,4BAA4B,MAAM,OAAO;AAAA,QAC5E,WAAW,EAAE,UAAU,cAAc,MAAM,YAAY;AAAA,QACvD,UAAU,EAAE,UAAU,aAAa,MAAM,YAAY;AAAA,MACvD;AAAA,MACA,gBAAgB;AAAA,QACd,eAAe,EAAE,OAAO,uBAAuB,UAAU,MAAM,aAAa,OAAO;AAAA,QACnF,cAAc,EAAE,OAAO,4BAA4B,UAAU,MAAM,aAAa,OAAO;AAAA,QACvF,uBAAuB,EAAE,OAAO,sBAAsB,UAAU,MAAM,aAAa,eAAe;AAAA,QAClG,cAAc,EAAE,OAAO,oBAAoB,UAAU,MAAM,aAAa,QAAQ;AAAA,MAClF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,kBAAkB,CAAC,gCAAgC;AAAA,MACnD,cAAc;AAAA,QACZ,WAAW;AAAA,QACX,WAAW;AAAA,QACX,oBAAoB,CAAC,aAAa,iBAAiB;AAAA,MACrD;AAAA,MACA,eAAe;AAAA,QACb,IAAI,EAAE,UAAU,MAAM,MAAM,OAAO;AAAA,QACnC,MAAM,EAAE,UAAU,QAAQ,MAAM,OAAO;AAAA,QACvC,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,aAAa,EAAE,UAAU,gBAAgB,MAAM,OAAO;AAAA,QACtD,QAAQ,EAAE,UAAU,UAAU,MAAM,OAAO;AAAA,QAC3C,aAAa,EAAE,UAAU,iBAAiB,MAAM,OAAO;AAAA,QACvD,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,mBAAmB,EAAE,UAAU,uBAAuB,MAAM,OAAO;AAAA,QACnE,WAAW,EAAE,UAAU,cAAc,MAAM,YAAY;AAAA,QACvD,WAAW,EAAE,UAAU,cAAc,MAAM,YAAY;AAAA,MACzD;AAAA,MACA,gBAAgB;AAAA,QACd,YAAY,EAAE,OAAO,qBAAqB,UAAU,MAAM,aAAa,eAAe;AAAA,MACxF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,kBAAkB,CAAC,+BAA+B;AAAA,MAClD,cAAc;AAAA,QACZ,WAAW;AAAA,QACX,WAAW;AAAA,QACX,oBAAoB,CAAC,aAAa,iBAAiB;AAAA,MACrD;AAAA,MACA,eAAe;AAAA,QACb,IAAI,EAAE,UAAU,MAAM,MAAM,OAAO;AAAA,QACnC,WAAW,EAAE,UAAU,aAAa,MAAM,OAAO;AAAA,QACjD,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,QAAQ,EAAE,UAAU,UAAU,MAAM,OAAO;AAAA,QAC3C,YAAY,EAAE,UAAU,eAAe,MAAM,OAAO;AAAA,QACpD,YAAY,EAAE,UAAU,eAAe,MAAM,YAAY;AAAA,QACzD,UAAU,EAAE,UAAU,aAAa,MAAM,YAAY;AAAA,QACrD,UAAU,EAAE,UAAU,YAAY,MAAM,OAAO;AAAA,QAC/C,sBAAsB,EAAE,UAAU,0BAA0B,MAAM,UAAU;AAAA,QAC5E,yBAAyB,EAAE,UAAU,6BAA6B,MAAM,UAAU;AAAA,QAClF,UAAU,EAAE,UAAU,aAAa,MAAM,YAAY;AAAA,MACvD;AAAA,MACA,gBAAgB;AAAA,QACd,YAAY,EAAE,OAAO,qBAAqB,UAAU,MAAM,aAAa,eAAe;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,SAAS;AACtB,IAAO,oBAAQ;",
   "names": []
 }

package/dist/modules/staff/api/guards.js CHANGED Viewed

@@ -2,17 +2,50 @@ import {
   bridgeLegacyGuard,
   runMutationGuards
 } from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+import { getAllMutationGuardInstances } from "@open-mercato/shared/lib/crud/mutation-guard-store";
+import { resolveFeatureAccess } from "../lib/time-tracking/featureAccess.js";
 function resolveUserFeatures(auth) {
   const features = auth?.features;
   if (!Array.isArray(features)) return [];
   return features.filter((value) => typeof value === "string");
 }
-async function runStaffMutationGuards(container, input, userFeatures) {
+const STAFF_TIME_TRACKING_RESOURCE_KINDS = {
+  /** `time-entries/{bulk,copy-day,start-timer}`, `time-entries/[id]/{duplicate,timer-start,timer-stop}` */
+  timeEntry: "staff.timesheets.time_entry",
+  /** `time-entries/[id]/segments`, `time-entries/[id]/segments/[segmentId]` */
+  timeEntrySegment: "staff.timesheets.time_entry_segment",
+  /** `tasks/[id]/status` */
+  timeTask: "staff.timesheets.time_task",
+  /** `tasks/[id]/comments` */
+  timeTaskComment: "staff.timesheets.task_comment",
+  /** `time-projects/[id]/change-currency` */
+  timeProject: "staff.timesheets.time_project",
+  /** `my-projects/[projectId]` */
+  timeProjectMember: "staff.timesheets.time_project_member",
+  /** `reports/[id]/close`, `reports/[id]/unlock` */
+  timeReport: "staff.timesheets.time_report",
+  /** `tags/entry-assignments` */
+  entryTag: "staff.timesheets.entry_tag",
+  /** `tags/task-assignments` */
+  taskTag: "staff.timesheets.task_tag",
+  /** `settings`, `settings/reapply-rounding` */
+  settings: "staff.timesheets.settings",
+  /** `access-requests` */
+  accessRequest: "staff.timesheets.access_request"
+};
+async function runStaffMutationGuards(container, input, extraFeatures = []) {
+  const allGuards = [...getAllMutationGuardInstances()];
   const legacyGuard = bridgeLegacyGuard(container);
-  if (!legacyGuard) {
+  if (legacyGuard) allGuards.push(legacyGuard);
+  if (!allGuards.length) {
     return { ok: true, afterSuccessCallbacks: [] };
   }
-  return runMutationGuards([legacyGuard], input, { userFeatures });
+  const { grantedFeatures } = await resolveFeatureAccess(container, input.userId ?? null, [], {
+    tenantId: input.tenantId ?? null,
+    organizationId: input.organizationId ?? null
+  });
+  const userFeatures = Array.from(/* @__PURE__ */ new Set([...grantedFeatures, ...extraFeatures]));
+  return runMutationGuards(allGuards, input, { userFeatures });
 }
 async function runStaffMutationGuardAfterSuccess(callbacks, input) {
   for (const callback of callbacks) {
@@ -24,6 +57,7 @@ async function runStaffMutationGuardAfterSuccess(callbacks, input) {
   }
 }
 export {
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
   resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards

package/dist/modules/staff/api/guards.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/staff/api/guards.ts"],
-  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\n\ntype GuardAfterCallback = {\n  guard: MutationGuard\n  metadata: Record<string, unknown> | null\n}\n\nexport function resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nexport async function runStaffMutationGuards(\n  container: AwilixContainer,\n  input: MutationGuardInput,\n  userFeatures: string[],\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  modifiedPayload?: Record<string, unknown>\n  afterSuccessCallbacks: GuardAfterCallback[]\n}> {\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, { userFeatures })\n}\n\nexport async function runStaffMutationGuardAfterSuccess(\n  callbacks: GuardAfterCallback[],\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n"],
-  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAOA,SAAS,oBAAoB,MAAyB;AAC3D,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAsB,uBACpB,WACA,OACA,cAOC;AACD,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO,EAAE,aAAa,CAAC;AACjE;AAEA,eAAsB,kCACpB,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { getAllMutationGuardInstances } from '@open-mercato/shared/lib/crud/mutation-guard-store'\nimport { resolveFeatureAccess } from '../lib/time-tracking/featureAccess'\n\ntype GuardAfterCallback = {\n  guard: MutationGuard\n  metadata: Record<string, unknown> | null\n}\n\n/**\n * @deprecated `AuthContext` has no `features` field, so this always answered `[]` \u2014\n * which silently filtered out every registered guard declaring `features`, leaving\n * feature-gated guards enforced on the `makeCrudRoute` resources (the factory\n * resolves real grants) and skipped on every hand-rolled write route.\n * `runStaffMutationGuards` now resolves the caller's grants itself through\n * `resolveFeatureAccess`; pass nothing. Kept as an exported symbol for one release.\n */\nexport function resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\n/**\n * The `resourceKind` every hand-rolled time-tracking write route passes into the\n * mutation-guard contract, published as one map so a guard author can target a route\n * without reading it.\n *\n * These strings are what `MutationGuardInput.resourceKind` carries; they are NOT the\n * CRUD factory's cache/audit resource tag, which the factory derives on its own from\n * each route's `events` config. A guard that filters on `resourceKind` matches against\n * the values below on the custom routes and against the factory-derived tag on the\n * eight `makeCrudRoute` resources.\n *\n * `staff.timesheets.time_task` and `staff.timesheets.time_report` are re-exported from\n * the command modules that also feed them to `enforceCommandOptimisticLockWithGuards`\n * (`STAFF_TIME_TASK_RESOURCE_KIND`, `STAFF_TIME_REPORT_RESOURCE_KIND`); the unit test\n * pins both copies to the same string so they cannot drift.\n */\nexport const STAFF_TIME_TRACKING_RESOURCE_KINDS = {\n  /** `time-entries/{bulk,copy-day,start-timer}`, `time-entries/[id]/{duplicate,timer-start,timer-stop}` */\n  timeEntry: 'staff.timesheets.time_entry',\n  /** `time-entries/[id]/segments`, `time-entries/[id]/segments/[segmentId]` */\n  timeEntrySegment: 'staff.timesheets.time_entry_segment',\n  /** `tasks/[id]/status` */\n  timeTask: 'staff.timesheets.time_task',\n  /** `tasks/[id]/comments` */\n  timeTaskComment: 'staff.timesheets.task_comment',\n  /** `time-projects/[id]/change-currency` */\n  timeProject: 'staff.timesheets.time_project',\n  /** `my-projects/[projectId]` */\n  timeProjectMember: 'staff.timesheets.time_project_member',\n  /** `reports/[id]/close`, `reports/[id]/unlock` */\n  timeReport: 'staff.timesheets.time_report',\n  /** `tags/entry-assignments` */\n  entryTag: 'staff.timesheets.entry_tag',\n  /** `tags/task-assignments` */\n  taskTag: 'staff.timesheets.task_tag',\n  /** `settings`, `settings/reapply-rounding` */\n  settings: 'staff.timesheets.settings',\n  /** `access-requests` */\n  accessRequest: 'staff.timesheets.access_request',\n} as const\n\nexport type StaffTimeTrackingResourceKind =\n  typeof STAFF_TIME_TRACKING_RESOURCE_KINDS[keyof typeof STAFF_TIME_TRACKING_RESOURCE_KINDS]\n\n/**\n * Runs the same guard set as `makeCrudRoute`: every guard a module registered through\n * `data/guards.ts` (`getAllMutationGuardInstances()`) plus the bridged legacy DI\n * service. Mirrors `collectAndRunGuards()` in the CRUD factory; bridging only the\n * legacy service \u2014 as this did originally \u2014 left registry guards unenforced on every\n * hand-rolled time-tracking write route.\n *\n * **The grant list is resolved here, not passed in.** `runMutationGuards` drops any\n * guard whose `features` the caller does not hold, so an empty list silently disables\n * every feature-gated guard \u2014 a third-party `record_locks.enforce` guard fired on the\n * `makeCrudRoute` resources (the factory asks RBAC) and was skipped on `/bulk`, the\n * timer transitions, segments, tag assignments and report close/unlock. Callers used\n * to supply `resolveUserFeatures(auth)`, which read a field `AuthContext` does not\n * have and therefore always returned `[]`. The lookup now goes through\n * `resolveFeatureAccess`, the module's one RBAC authority, which fails closed and\n * logs rather than failing silently.\n *\n * `extraFeatures` is additive and exists only for a caller that already holds a\n * resolved grant list; it is never the sole source.\n */\nexport async function runStaffMutationGuards(\n  container: AwilixContainer,\n  input: MutationGuardInput,\n  extraFeatures: readonly string[] = [],\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  modifiedPayload?: Record<string, unknown>\n  afterSuccessCallbacks: GuardAfterCallback[]\n}> {\n  const allGuards: MutationGuard[] = [...getAllMutationGuardInstances()]\n  const legacyGuard = bridgeLegacyGuard(container)\n  if (legacyGuard) allGuards.push(legacyGuard)\n  if (!allGuards.length) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  const { grantedFeatures } = await resolveFeatureAccess(container, input.userId ?? null, [], {\n    tenantId: input.tenantId ?? null,\n    organizationId: input.organizationId ?? null,\n  })\n  const userFeatures = Array.from(new Set([...grantedFeatures, ...extraFeatures]))\n\n  return runMutationGuards(allGuards, input, { userFeatures })\n}\n\nexport async function runStaffMutationGuardAfterSuccess(\n  callbacks: GuardAfterCallback[],\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,oCAAoC;AAC7C,SAAS,4BAA4B;AAe9B,SAAS,oBAAoB,MAAyB;AAC3D,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAkBO,MAAM,qCAAqC;AAAA;AAAA,EAEhD,WAAW;AAAA;AAAA,EAEX,kBAAkB;AAAA;AAAA,EAElB,UAAU;AAAA;AAAA,EAEV,iBAAiB;AAAA;AAAA,EAEjB,aAAa;AAAA;AAAA,EAEb,mBAAmB;AAAA;AAAA,EAEnB,YAAY;AAAA;AAAA,EAEZ,UAAU;AAAA;AAAA,EAEV,SAAS;AAAA;AAAA,EAET,UAAU;AAAA;AAAA,EAEV,eAAe;AACjB;AAyBA,eAAsB,uBACpB,WACA,OACA,gBAAmC,CAAC,GAOnC;AACD,QAAM,YAA6B,CAAC,GAAG,6BAA6B,CAAC;AACrE,QAAM,cAAc,kBAAkB,SAAS;AAC/C,MAAI,YAAa,WAAU,KAAK,WAAW;AAC3C,MAAI,CAAC,UAAU,QAAQ;AACrB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,QAAM,EAAE,gBAAgB,IAAI,MAAM,qBAAqB,WAAW,MAAM,UAAU,MAAM,CAAC,GAAG;AAAA,IAC1F,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM,kBAAkB;AAAA,EAC1C,CAAC;AACD,QAAM,eAAe,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,aAAa,CAAC,CAAC;AAE/E,SAAO,kBAAkB,WAAW,OAAO,EAAE,aAAa,CAAC;AAC7D;AAEA,eAAsB,kCACpB,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests/accept/route.js CHANGED Viewed

@@ -9,7 +9,6 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { staffLeaveRequestDecisionSchema } from "../../../data/validators.js";
 import {
-  resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../guards.js";
@@ -55,8 +54,7 @@ async function POST(req) {
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: input
-      },
-      resolveUserFeatures(auth)
+      }
     );
     if (!guardResult.ok) {
       return NextResponse.json(

package/dist/modules/staff/api/leave-requests/accept/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/leave-requests/accept/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.accept',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.accept failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.accept', 'Failed to approve leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Approve leave request',\n  methods: {\n    POST: {\n      summary: 'Approve leave request',\n      description: 'Approves a leave request and adds unavailability rules for the staff member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request approved', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.accept',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.accept failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.accept', 'Failed to approve leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Approve leave request',\n  methods: {\n    POST: {\n      summary: 'Approve leave request',\n      description: 'Approves a leave request and adds unavailability rules for the staff member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request approved', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests/reject/route.js CHANGED Viewed

@@ -9,7 +9,6 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { staffLeaveRequestDecisionSchema } from "../../../data/validators.js";
 import {
-  resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../guards.js";
@@ -55,8 +54,7 @@ async function POST(req) {
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: input
-      },
-      resolveUserFeatures(auth)
+      }
     );
     if (!guardResult.ok) {
       return NextResponse.json(

package/dist/modules/staff/api/leave-requests/reject/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/leave-requests/reject/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.reject',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.reject failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.reject', 'Failed to reject leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reject leave request',\n  methods: {\n    POST: {\n      summary: 'Reject leave request',\n      description: 'Rejects a leave request with an optional comment.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request rejected', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.reject',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.reject failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.reject', 'Failed to reject leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reject leave request',\n  methods: {\n    POST: {\n      summary: 'Reject leave request',\n      description: 'Rejects a leave request with an optional comment.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request rejected', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/portal/time-reports/[id]/route.js ADDED Viewed

@@ -0,0 +1,131 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { portalOwnedReportClause } from "../../../../lib/time-tracking/portalReports.js";
+import { resolvePortalScope, toIsoDate, toMinutes } from "../route.js";
+const logger = createLogger("staff").child({ component: "api/portal/time-reports/[id]" });
+const metadata = { requireAuth: false };
+const paramsSchema = z.object({ id: z.string().uuid() });
+const errorResponseSchema = z.object({ ok: z.literal(false), error: z.string() });
+const projectLineSchema = z.object({
+  timeProjectId: z.string().nullable(),
+  projectName: z.string().nullable(),
+  billableMinutes: z.number().int(),
+  nonbillableMinutes: z.number().int()
+});
+const detailResponseSchema = z.object({
+  id: z.string().uuid(),
+  reference: z.string(),
+  title: z.string(),
+  periodFrom: z.string(),
+  periodTo: z.string(),
+  closedAt: z.string().nullable(),
+  totalBillableMinutes: z.number().int(),
+  totalNonbillableMinutes: z.number().int(),
+  projects: z.array(projectLineSchema)
+});
+function readReportId(req) {
+  const segments = new URL(req.url).pathname.split("/").filter(Boolean);
+  const last = segments[segments.length - 1];
+  const parsed = paramsSchema.safeParse({ id: last });
+  return parsed.success ? parsed.data.id : null;
+}
+async function GET(req) {
+  try {
+    const scopeOrResponse = await resolvePortalScope(req);
+    if (scopeOrResponse instanceof Response) return scopeOrResponse;
+    const scope = scopeOrResponse;
+    const reportId = readReportId(req);
+    if (!reportId) {
+      return NextResponse.json({ ok: false, error: "staff.errors.invalidInput" }, { status: 400 });
+    }
+    const connection = scope.em.getConnection();
+    const owned = portalOwnedReportClause(scope);
+    const rows = await connection.execute(
+      `
+        SELECT id, reference, title, period_from, period_to, closed_at,
+               total_billable_minutes, total_nonbillable_minutes
+        FROM staff_time_reports
+        WHERE ${owned.sql} AND id = ?
+        LIMIT 1
+      `,
+      [...owned.params, reportId]
+    );
+    const report = rows?.[0];
+    if (!report) {
+      return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+    }
+    const periodFrom = toIsoDate(report.period_from);
+    const periodTo = toIsoDate(report.period_to);
+    if (!periodFrom || !periodTo) {
+      return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+    }
+    const projectRows = await connection.execute(
+      `
+        SELECT entry.time_project_id AS time_project_id,
+               project.name AS project_name,
+               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN line.frozen_rounded_minutes ELSE 0 END), 0) AS billable_minutes,
+               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN 0 ELSE line.frozen_rounded_minutes END), 0) AS nonbillable_minutes
+        FROM staff_time_report_entries line
+        JOIN staff_time_entries entry
+          ON entry.id = line.time_entry_id
+         AND entry.tenant_id = line.tenant_id
+         AND entry.organization_id = line.organization_id
+        LEFT JOIN staff_time_projects project
+          ON project.id = entry.time_project_id
+         AND project.tenant_id = line.tenant_id
+         AND project.organization_id = line.organization_id
+        WHERE line.report_id = ?
+          AND line.tenant_id = ?
+          AND line.organization_id = ?
+        GROUP BY entry.time_project_id, project.name
+        ORDER BY project.name ASC NULLS LAST
+      `,
+      [report.id, scope.tenantId, scope.organizationId]
+    );
+    return NextResponse.json(
+      detailResponseSchema.parse({
+        id: report.id,
+        reference: report.reference,
+        title: report.title,
+        periodFrom,
+        periodTo,
+        closedAt: report.closed_at instanceof Date ? report.closed_at.toISOString() : typeof report.closed_at === "string" && report.closed_at.trim().length > 0 ? report.closed_at : null,
+        totalBillableMinutes: toMinutes(report.total_billable_minutes),
+        totalNonbillableMinutes: toMinutes(report.total_nonbillable_minutes),
+        projects: projectRows.map((row) => ({
+          timeProjectId: row.time_project_id ?? null,
+          projectName: row.project_name ?? null,
+          billableMinutes: toMinutes(row.billable_minutes),
+          nonbillableMinutes: toMinutes(row.nonbillable_minutes)
+        }))
+      })
+    );
+  } catch (err) {
+    logger.error("staff portal time-report detail failed", { err });
+    return NextResponse.json({ ok: false, error: "staff.errors.internal" }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "Staff Portal",
+  pathParams: paramsSchema,
+  methods: {
+    GET: {
+      summary: "Read one closed time report belonging to the signed-in customer",
+      description: "Loads the report by id **together with** the tenant, organization, customer and closed-status predicates, so a report belonging to another customer of the same organization answers 404. Returns the frozen minute totals per project; no rate, cost, amount or currency is present in the response.",
+      pathParams: paramsSchema,
+      responses: [{ status: 200, description: "The report", schema: detailResponseSchema }],
+      errors: [
+        { status: 401, description: "Not signed in to the portal", schema: errorResponseSchema },
+        { status: 403, description: "The portal account is not linked to a customer", schema: errorResponseSchema },
+        { status: 404, description: "No closed report with that id belongs to this customer", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/portal/time-reports/[id]/route.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/staff/api/portal/time-reports/%5Bid%5D/route.ts"],
+  "sourcesContent": ["/**\n * `GET /api/staff/portal/time-reports/{id}` \u2014 EP-50.\n *\n * The ownership check is the list route's, unchanged and re-applied here rather\n * than inherited from it: the id in the path is caller-supplied, so the row it\n * names is loaded WITH `tenant_id`, `organization_id`, `customer_id`,\n * `status = 'closed'` and `deleted_at IS NULL` in the same WHERE clause, never\n * loaded first and checked after. A report belonging to another customer of the\n * same organization is a `404`, not a `403` \u2014 the portal must not confirm that\n * somebody else's report exists.\n *\n * The per-project breakdown reads the FROZEN minutes on `staff_time_report_entries`,\n * which is what the close wrote and what the client was told. It carries no\n * `frozen_rate_amount` and no `frozen_amount`; see the list route's header for why\n * money is structurally absent from this surface rather than conditionally hidden.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { portalOwnedReportClause } from '../../../../lib/time-tracking/portalReports'\nimport { resolvePortalScope, toIsoDate, toMinutes } from '../route'\n\nconst logger = createLogger('staff').child({ component: 'api/portal/time-reports/[id]' })\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nconst errorResponseSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst projectLineSchema = z.object({\n  timeProjectId: z.string().nullable(),\n  projectName: z.string().nullable(),\n  billableMinutes: z.number().int(),\n  nonbillableMinutes: z.number().int(),\n})\n\nconst detailResponseSchema = z.object({\n  id: z.string().uuid(),\n  reference: z.string(),\n  title: z.string(),\n  periodFrom: z.string(),\n  periodTo: z.string(),\n  closedAt: z.string().nullable(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n  projects: z.array(projectLineSchema),\n})\n\ntype ReportRow = {\n  id: string\n  reference: string\n  title: string\n  period_from: Date | string\n  period_to: Date | string\n  closed_at: Date | string | null\n  total_billable_minutes: number | string | null\n  total_nonbillable_minutes: number | string | null\n}\n\ntype ProjectRow = {\n  time_project_id: string | null\n  project_name: string | null\n  billable_minutes: number | string | null\n  nonbillable_minutes: number | string | null\n}\n\nfunction readReportId(req: Request): string | null {\n  const segments = new URL(req.url).pathname.split('/').filter(Boolean)\n  const last = segments[segments.length - 1]\n  const parsed = paramsSchema.safeParse({ id: last })\n  return parsed.success ? parsed.data.id : null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const scopeOrResponse = await resolvePortalScope(req)\n    if (scopeOrResponse instanceof Response) return scopeOrResponse\n    const scope = scopeOrResponse\n\n    const reportId = readReportId(req)\n    if (!reportId) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.invalidInput' }, { status: 400 })\n    }\n\n    const connection = scope.em.getConnection()\n    const owned = portalOwnedReportClause(scope)\n    const rows = (await connection.execute(\n      `\n        SELECT id, reference, title, period_from, period_to, closed_at,\n               total_billable_minutes, total_nonbillable_minutes\n        FROM staff_time_reports\n        WHERE ${owned.sql} AND id = ?\n        LIMIT 1\n      `,\n      [...owned.params, reportId],\n    )) as ReportRow[]\n\n    const report = rows?.[0]\n    if (!report) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.notFound' }, { status: 404 })\n    }\n\n    const periodFrom = toIsoDate(report.period_from)\n    const periodTo = toIsoDate(report.period_to)\n    if (!periodFrom || !periodTo) {\n      return NextResponse.json({ ok: false, error: 'staff.errors.notFound' }, { status: 404 })\n    }\n\n    const projectRows = (await connection.execute(\n      `\n        SELECT entry.time_project_id AS time_project_id,\n               project.name AS project_name,\n               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN line.frozen_rounded_minutes ELSE 0 END), 0) AS billable_minutes,\n               COALESCE(SUM(CASE WHEN line.frozen_is_billable THEN 0 ELSE line.frozen_rounded_minutes END), 0) AS nonbillable_minutes\n        FROM staff_time_report_entries line\n        JOIN staff_time_entries entry\n          ON entry.id = line.time_entry_id\n         AND entry.tenant_id = line.tenant_id\n         AND entry.organization_id = line.organization_id\n        LEFT JOIN staff_time_projects project\n          ON project.id = entry.time_project_id\n         AND project.tenant_id = line.tenant_id\n         AND project.organization_id = line.organization_id\n        WHERE line.report_id = ?\n          AND line.tenant_id = ?\n          AND line.organization_id = ?\n        GROUP BY entry.time_project_id, project.name\n        ORDER BY project.name ASC NULLS LAST\n      `,\n      [report.id, scope.tenantId, scope.organizationId],\n    )) as ProjectRow[]\n\n    return NextResponse.json(\n      detailResponseSchema.parse({\n        id: report.id,\n        reference: report.reference,\n        title: report.title,\n        periodFrom,\n        periodTo,\n        closedAt:\n          report.closed_at instanceof Date\n            ? report.closed_at.toISOString()\n            : typeof report.closed_at === 'string' && report.closed_at.trim().length > 0\n              ? report.closed_at\n              : null,\n        totalBillableMinutes: toMinutes(report.total_billable_minutes),\n        totalNonbillableMinutes: toMinutes(report.total_nonbillable_minutes),\n        projects: projectRows.map((row) => ({\n          timeProjectId: row.time_project_id ?? null,\n          projectName: row.project_name ?? null,\n          billableMinutes: toMinutes(row.billable_minutes),\n          nonbillableMinutes: toMinutes(row.nonbillable_minutes),\n        })),\n      }),\n    )\n  } catch (err) {\n    logger.error('staff portal time-report detail failed', { err })\n    return NextResponse.json({ ok: false, error: 'staff.errors.internal' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff Portal',\n  pathParams: paramsSchema,\n  methods: {\n    GET: {\n      summary: 'Read one closed time report belonging to the signed-in customer',\n      description:\n        'Loads the report by id **together with** the tenant, organization, customer and closed-status predicates, so a report belonging to another customer of the same organization answers 404. Returns the frozen minute totals per project; no rate, cost, amount or currency is present in the response.',\n      pathParams: paramsSchema,\n      responses: [{ status: 200, description: 'The report', schema: detailResponseSchema }],\n      errors: [\n        { status: 401, description: 'Not signed in to the portal', schema: errorResponseSchema },\n        { status: 403, description: 'The portal account is not linked to a customer', schema: errorResponseSchema },\n        { status: 404, description: 'No closed report with that id belongs to this customer', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAiBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,oBAAoB;AAE7B,SAAS,+BAA+B;AACxC,SAAS,oBAAoB,WAAW,iBAAiB;AAEzD,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAEjF,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEvD,MAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEhF,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AACrC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,EACxC,UAAU,EAAE,MAAM,iBAAiB;AACrC,CAAC;AAoBD,SAAS,aAAa,KAA6B;AACjD,QAAM,WAAW,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpE,QAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAM,SAAS,aAAa,UAAU,EAAE,IAAI,KAAK,CAAC;AAClD,SAAO,OAAO,UAAU,OAAO,KAAK,KAAK;AAC3C;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,kBAAkB,MAAM,mBAAmB,GAAG;AACpD,QAAI,2BAA2B,SAAU,QAAO;AAChD,UAAM,QAAQ;AAEd,UAAM,WAAW,aAAa,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7F;AAEA,UAAM,aAAa,MAAM,GAAG,cAAc;AAC1C,UAAM,QAAQ,wBAAwB,KAAK;AAC3C,UAAM,OAAQ,MAAM,WAAW;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA,gBAIU,MAAM,GAAG;AAAA;AAAA;AAAA,MAGnB,CAAC,GAAG,MAAM,QAAQ,QAAQ;AAAA,IAC5B;AAEA,UAAM,SAAS,OAAO,CAAC;AACvB,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzF;AAEA,UAAM,aAAa,UAAU,OAAO,WAAW;AAC/C,UAAM,WAAW,UAAU,OAAO,SAAS;AAC3C,QAAI,CAAC,cAAc,CAAC,UAAU;AAC5B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzF;AAEA,UAAM,cAAe,MAAM,WAAW;AAAA,MACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAoBA,CAAC,OAAO,IAAI,MAAM,UAAU,MAAM,cAAc;AAAA,IAClD;AAEA,WAAO,aAAa;AAAA,MAClB,qBAAqB,MAAM;AAAA,QACzB,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO;AAAA,QACd;AAAA,QACA;AAAA,QACA,UACE,OAAO,qBAAqB,OACxB,OAAO,UAAU,YAAY,IAC7B,OAAO,OAAO,cAAc,YAAY,OAAO,UAAU,KAAK,EAAE,SAAS,IACvE,OAAO,YACP;AAAA,QACR,sBAAsB,UAAU,OAAO,sBAAsB;AAAA,QAC7D,yBAAyB,UAAU,OAAO,yBAAyB;AAAA,QACnE,UAAU,YAAY,IAAI,CAAC,SAAS;AAAA,UAClC,eAAe,IAAI,mBAAmB;AAAA,UACtC,aAAa,IAAI,gBAAgB;AAAA,UACjC,iBAAiB,UAAU,IAAI,gBAAgB;AAAA,UAC/C,oBAAoB,UAAU,IAAI,mBAAmB;AAAA,QACvD,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,YAAY;AAAA,MACZ,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,qBAAqB,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,oBAAoB;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,oBAAoB;AAAA,QAC1G,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,oBAAoB;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}