@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/staff/api/timesheets/reports/[id]/sheet/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/sheet/route.ts"],
-  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/sheet` \u2014 everything screens 14 and 15\n * render: the report header, the grouped sheet, the raw entry rows and the\n * close/unlock/export history.\n *\n * It is a separate route from the CRUD detail because the sheet is COMPUTED. A\n * draft is computed live (and therefore moves when an entry is edited); a closed\n * report is rebuilt from its own freeze records, so a later rounding change\n * cannot restate an invoice the client already has (risk R1). One endpoint\n * answering both keeps the page from having to know which case it is in.\n *\n * `?grouping=` re-groups the same numbers without persisting the choice, which\n * is what lets screen 14 flip between task / person / day and still print the\n * same grand total (D-7).\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport { hasReportGrouping, type ReportGrouping } from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { resolveReportRequestContext, reportSheetLabels, MAX_SHEET_ROWS } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/sheet' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/** EP-36: the accepted set is the grouping registry, not a literal union. */\nfunction readGrouping(params: URLSearchParams): ReportGrouping | undefined {\n  const value = params.get('grouping')\n  return hasReportGrouping(value) ? (value as ReportGrouping) : undefined\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'sheet' })\n    // See the note in the export route: this decision is made once, fail-closed,\n    // in `buildReportRequestContext`.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping: readGrouping(session.searchParams),\n    })\n\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const events = await em.find(\n      StaffTimeReportEvent,\n      { reportId: report.id, tenantId, organizationId },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    return session.respond(200, {\n      report: {\n        id: report.id,\n        reference: report.reference,\n        title: report.title,\n        status: report.status,\n        customerId: report.customerId,\n        customerSnapshot: report.customerSnapshot ?? null,\n        periodKind: report.periodKind,\n        periodFrom: report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : null,\n        periodTo: report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : null,\n        currencyCode: sheet.currencyCode,\n        grouping: sheet.grouping,\n        nonbillableMode: sheet.nonbillableMode,\n        includeAlreadyReported: report.includeAlreadyReported ?? false,\n        showRates: (report.showRates ?? true) && canSeeMoney,\n        roundingUnitMinutes: report.roundingUnitMinutes ?? 0,\n        roundingDirection: report.roundingDirection ?? 'up',\n        closedAt: report.closedAt ? report.closedAt.toISOString() : null,\n        closedByUserId: report.closedByUserId ?? null,\n        createdByUserId: report.createdByUserId ?? null,\n        createdAt: report.createdAt ? report.createdAt.toISOString() : null,\n        updatedAt: report.updatedAt ? report.updatedAt.toISOString() : null,\n        timeProjectIds,\n      },\n      groups: canSeeMoney ? sheet.totals.groups : stripAmounts(sheet.totals.groups),\n      totals: {\n        entryCount: sheet.totals.entryCount,\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : null,\n      },\n      alreadyReportedCount: sheet.totals.alreadyReportedCount,\n      alreadyReportedMinutes: sheet.totals.alreadyReportedMinutes,\n      alreadyReportedIn: sheet.totals.alreadyReportedIn,\n      rows: rows.slice(0, MAX_SHEET_ROWS).map((row) => ({\n        ...row,\n        rate: canSeeMoney ? row.rate : null,\n        amount: canSeeMoney ? row.amount : null,\n      })),\n      rowCount: rows.length,\n      rowsTruncated: rows.length > MAX_SHEET_ROWS,\n      events: events.map((event) => ({\n        id: event.id,\n        eventType: event.eventType,\n        reason: event.reason ?? null,\n        actorUserId: event.actorUserId ?? null,\n        metadata: event.metadata ?? null,\n        createdAt: event.createdAt ? event.createdAt.toISOString() : null,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.sheet failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype SheetGroups = Awaited<ReturnType<typeof buildReportSheet>>['totals']['groups']\n\n/** Money is absent, not zeroed, for a caller without `rates.view`. */\nfunction stripAmounts(groups: SheetGroups): SheetGroups {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): SheetGroups[number]['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nconst sheetResponseSchema = z.object({\n  report: z.object({\n    id: z.string().uuid(),\n    reference: z.string(),\n    title: z.string(),\n    status: z.enum(['draft', 'closed']),\n    currencyCode: z.string().nullable(),\n    periodFrom: z.string().nullable(),\n    periodTo: z.string().nullable(),\n    showRates: z.boolean(),\n  }),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  rowCount: z.number().int(),\n  rowsTruncated: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Read a customer report sheet',\n  methods: {\n    GET: {\n      summary: 'Read a customer report sheet',\n      description:\n        'Returns the report header, the grouped sheet, the raw entry rows and the close/unlock/export history. A draft is computed live; a closed report is rebuilt from its own frozen snapshots so a later rounding or rate change cannot restate it. `?grouping=project_task|project_person|project_day` re-groups the same numbers without persisting the choice \u2014 the grand total is invariant under it (D-7). Amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'Report sheet', schema: sheetResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAgBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAKlB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC,SAAS,yBAA8C;AACvD,SAAS,6BAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAGjF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAGA,SAAS,aAAa,QAAqD;AACzE,QAAM,QAAQ,OAAO,IAAI,UAAU;AACnC,SAAO,kBAAkB,KAAK,IAAK,QAA2B;AAChE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAG3E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,aAAa,QAAQ,YAAY;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,OAAO,IAAI,UAAU,eAAe;AAAA,MAChD,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,QAAQ;AAAA,QACN,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,QACnB,kBAAkB,OAAO,oBAAoB;AAAA,QAC7C,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO,sBAAsB,OAAO,OAAO,WAAW,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,QAC/F,UAAU,OAAO,oBAAoB,OAAO,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,QACzF,cAAc,MAAM;AAAA,QACpB,UAAU,MAAM;AAAA,QAChB,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,OAAO,0BAA0B;AAAA,QACzD,YAAY,OAAO,aAAa,SAAS;AAAA,QACzC,qBAAqB,OAAO,uBAAuB;AAAA,QACnD,mBAAmB,OAAO,qBAAqB;AAAA,QAC/C,UAAU,OAAO,WAAW,OAAO,SAAS,YAAY,IAAI;AAAA,QAC5D,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,iBAAiB,OAAO,mBAAmB;AAAA,QAC3C,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D;AAAA,MACF;AAAA,MACA,QAAQ,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,OAAO,MAAM;AAAA,MAC5E,QAAQ;AAAA,QACN,YAAY,MAAM,OAAO;AAAA,QACzB,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,sBAAsB,MAAM,OAAO;AAAA,MACnC,wBAAwB,MAAM,OAAO;AAAA,MACrC,mBAAmB,MAAM,OAAO;AAAA,MAChC,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,IAAI,CAAC,SAAS;AAAA,QAChD,GAAG;AAAA,QACH,MAAM,cAAc,IAAI,OAAO;AAAA,QAC/B,QAAQ,cAAc,IAAI,SAAS;AAAA,MACrC,EAAE;AAAA,MACF,UAAU,KAAK;AAAA,MACf,eAAe,KAAK,SAAS;AAAA,MAC7B,QAAQ,OAAO,IAAI,CAAC,WAAW;AAAA,QAC7B,IAAI,MAAM;AAAA,QACV,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM,UAAU;AAAA,QACxB,aAAa,MAAM,eAAe;AAAA,QAClC,UAAU,MAAM,YAAY;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,MAC/D,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAKA,SAAS,aAAa,QAAkC;AACtD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAA4C;AAChF,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,OAAO;AAAA,IACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAClC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,WAAW,EAAE,QAAQ;AAAA,EACvB,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,eAAe,EAAE,QAAQ;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/sheet` \u2014 everything screens 14 and 15\n * render: the report header, the grouped sheet, the raw entry rows and the\n * close/unlock/export history.\n *\n * It is a separate route from the CRUD detail because the sheet is COMPUTED. A\n * draft is computed live (and therefore moves when an entry is edited); a closed\n * report is rebuilt from its own freeze records, so a later rounding change\n * cannot restate an invoice the client already has (risk R1). One endpoint\n * answering both keeps the page from having to know which case it is in.\n *\n * `?grouping=` re-groups the same numbers without persisting the choice, which\n * is what lets screen 14 flip between task / person / day and still print the\n * same grand total (D-7).\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport { formatReportPeriodDate } from '../../../../../lib/timesheets-reports/reportPeriod'\nimport { hasReportGrouping, type ReportGrouping } from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { resolveReportRequestContext, reportSheetLabels, MAX_SHEET_ROWS } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/sheet' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/** EP-36: the accepted set is the grouping registry, not a literal union. */\nfunction readGrouping(params: URLSearchParams): ReportGrouping | undefined {\n  const value = params.get('grouping')\n  return hasReportGrouping(value) ? (value as ReportGrouping) : undefined\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'sheet' })\n    // See the note in the export route: this decision is made once, fail-closed,\n    // in `buildReportRequestContext`.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping: readGrouping(session.searchParams),\n    })\n\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const events = await em.find(\n      StaffTimeReportEvent,\n      { reportId: report.id, tenantId, organizationId },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    return session.respond(200, {\n      report: {\n        id: report.id,\n        reference: report.reference,\n        title: report.title,\n        status: report.status,\n        customerId: report.customerId,\n        customerSnapshot: report.customerSnapshot ?? null,\n        periodKind: report.periodKind,\n        periodFrom: formatReportPeriodDate(report.periodFrom),\n        periodTo: formatReportPeriodDate(report.periodTo),\n        currencyCode: sheet.currencyCode,\n        grouping: sheet.grouping,\n        nonbillableMode: sheet.nonbillableMode,\n        includeAlreadyReported: report.includeAlreadyReported ?? false,\n        showRates: (report.showRates ?? true) && canSeeMoney,\n        roundingUnitMinutes: report.roundingUnitMinutes ?? 0,\n        roundingDirection: report.roundingDirection ?? 'up',\n        closedAt: report.closedAt ? report.closedAt.toISOString() : null,\n        closedByUserId: report.closedByUserId ?? null,\n        createdByUserId: report.createdByUserId ?? null,\n        createdAt: report.createdAt ? report.createdAt.toISOString() : null,\n        updatedAt: report.updatedAt ? report.updatedAt.toISOString() : null,\n        timeProjectIds,\n      },\n      groups: canSeeMoney ? sheet.totals.groups : stripAmounts(sheet.totals.groups),\n      totals: {\n        entryCount: sheet.totals.entryCount,\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : null,\n      },\n      alreadyReportedCount: sheet.totals.alreadyReportedCount,\n      alreadyReportedMinutes: sheet.totals.alreadyReportedMinutes,\n      alreadyReportedIn: sheet.totals.alreadyReportedIn,\n      rows: rows.slice(0, MAX_SHEET_ROWS).map((row) => ({\n        ...row,\n        rate: canSeeMoney ? row.rate : null,\n        amount: canSeeMoney ? row.amount : null,\n      })),\n      rowCount: rows.length,\n      rowsTruncated: rows.length > MAX_SHEET_ROWS,\n      events: events.map((event) => ({\n        id: event.id,\n        eventType: event.eventType,\n        reason: event.reason ?? null,\n        actorUserId: event.actorUserId ?? null,\n        metadata: event.metadata ?? null,\n        createdAt: event.createdAt ? event.createdAt.toISOString() : null,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.sheet failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype SheetGroups = Awaited<ReturnType<typeof buildReportSheet>>['totals']['groups']\n\n/** Money is absent, not zeroed, for a caller without `rates.view`. */\nfunction stripAmounts(groups: SheetGroups): SheetGroups {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): SheetGroups[number]['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nconst sheetResponseSchema = z.object({\n  report: z.object({\n    id: z.string().uuid(),\n    reference: z.string(),\n    title: z.string(),\n    status: z.enum(['draft', 'closed']),\n    currencyCode: z.string().nullable(),\n    periodFrom: z.string().nullable(),\n    periodTo: z.string().nullable(),\n    showRates: z.boolean(),\n  }),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  rowCount: z.number().int(),\n  rowsTruncated: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Read a customer report sheet',\n  methods: {\n    GET: {\n      summary: 'Read a customer report sheet',\n      description:\n        'Returns the report header, the grouped sheet, the raw entry rows and the close/unlock/export history. A draft is computed live; a closed report is rebuilt from its own frozen snapshots so a later rounding or rate change cannot restate it. `?grouping=project_task|project_person|project_day` re-groups the same numbers without persisting the choice \u2014 the grand total is invariant under it (D-7). Amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'Report sheet', schema: sheetResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAgBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAKlB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,yBAA8C;AACvD,SAAS,6BAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAGjF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAGA,SAAS,aAAa,QAAqD;AACzE,QAAM,QAAQ,OAAO,IAAI,UAAU;AACnC,SAAO,kBAAkB,KAAK,IAAK,QAA2B;AAChE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAG3E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,aAAa,QAAQ,YAAY;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,OAAO,IAAI,UAAU,eAAe;AAAA,MAChD,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,QAAQ;AAAA,QACN,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,QACnB,kBAAkB,OAAO,oBAAoB;AAAA,QAC7C,YAAY,OAAO;AAAA,QACnB,YAAY,uBAAuB,OAAO,UAAU;AAAA,QACpD,UAAU,uBAAuB,OAAO,QAAQ;AAAA,QAChD,cAAc,MAAM;AAAA,QACpB,UAAU,MAAM;AAAA,QAChB,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,OAAO,0BAA0B;AAAA,QACzD,YAAY,OAAO,aAAa,SAAS;AAAA,QACzC,qBAAqB,OAAO,uBAAuB;AAAA,QACnD,mBAAmB,OAAO,qBAAqB;AAAA,QAC/C,UAAU,OAAO,WAAW,OAAO,SAAS,YAAY,IAAI;AAAA,QAC5D,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,iBAAiB,OAAO,mBAAmB;AAAA,QAC3C,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D;AAAA,MACF;AAAA,MACA,QAAQ,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,OAAO,MAAM;AAAA,MAC5E,QAAQ;AAAA,QACN,YAAY,MAAM,OAAO;AAAA,QACzB,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,sBAAsB,MAAM,OAAO;AAAA,MACnC,wBAAwB,MAAM,OAAO;AAAA,MACrC,mBAAmB,MAAM,OAAO;AAAA,MAChC,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,IAAI,CAAC,SAAS;AAAA,QAChD,GAAG;AAAA,QACH,MAAM,cAAc,IAAI,OAAO;AAAA,QAC/B,QAAQ,cAAc,IAAI,SAAS;AAAA,MACrC,EAAE;AAAA,MACF,UAAU,KAAK;AAAA,MACf,eAAe,KAAK,SAAS;AAAA,MAC7B,QAAQ,OAAO,IAAI,CAAC,WAAW;AAAA,QAC7B,IAAI,MAAM;AAAA,QACV,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM,UAAU;AAAA,QACxB,aAAa,MAAM,eAAe;AAAA,QAClC,UAAU,MAAM,YAAY;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,MAC/D,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAKA,SAAS,aAAa,QAAkC;AACtD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAA4C;AAChF,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,OAAO;AAAA,IACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAClC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,WAAW,EAAE,QAAQ;AAAA,EACvB,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,eAAe,EAAE,QAAQ;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/[id]/unlock/route.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { resolveFeatureAccess } from "../../../../../lib/time-tracking/featureAccess.js";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { z } from "zod";
 import { forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
@@ -72,7 +73,7 @@ async function POST(req) {
       container,
       auth,
       organizationScope,
-      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
       organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req
     };
@@ -143,7 +144,7 @@ const openApi = {
   methods: {
     POST: {
       summary: "Unlock a closed customer report",
-      description: "Clears locked_report_id / locked_at on every entry this report froze, removes its freeze records so a previously billed hour stops being counted as already reported, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.",
+      description: "Removes the freeze records of this report so a previously billed hour stops being counted as already reported by it, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. Clears locked_report_id / locked_at on every entry this report locked that no other closed report quotes; an entry another closed report re-included stays locked, and its lock moves to that report. `unlockedEntryCount` counts the entries actually freed. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.",
       requestBody: { contentType: "application/json", schema: staffTimeReportUnlockSchema.pick({ reason: true }) },
       responses: [{ status: 200, description: "Report unlocked", schema: unlockResponseSchema }],
       errors: [

package/dist/modules/staff/api/timesheets/reports/[id]/unlock/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/unlock/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/unlock` \u2014 screen 15.\n *\n * Gated on `staff.timesheets.reports.unlock`, deliberately a DIFFERENT feature\n * from `staff.timesheets.lock`. Screen 15 note 4 asked who may unlock and\n * observed that \u00A710 leaves nobody \"above\" a Team Leader; the answer is a\n * separate grant that can be withheld from a Team Leader who should not restate\n * billed time, rather than an admin role the requirements reject.\n *\n * The reason is mandatory at the schema level and is written verbatim into the\n * `unlocked` report event beside the actor and the timestamp, which is what\n * makes this the \"explicit, audited action\" US-G3 asks for rather than a confirm\n * dialog.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffTimeReportUnlockSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportUnlockResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport { evaluateReportUnlockPolicies } from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/unlock' })\n\nconst UNLOCK_FEATURE = 'staff.timesheets.reports.unlock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [UNLOCK_FEATURE] },\n}\n\nconst bodySchema = z.object({ reason: z.string().trim().min(1).max(2000) })\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'unlock' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [UNLOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = bodySchema.parse(session.body)\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A\n    // four-eyes or accounting-period policy narrows who may unlock; nothing here\n    // widens it past staff.timesheets.reports.unlock.\n    const refusal = evaluateReportUnlockPolicies({\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'closed',\n      reason: parsed.reason,\n    })\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? bodySchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { id: string; reason: string },\n      StaffTimeReportUnlockResult\n    >(staffTimeReportCommandIds.unlock, {\n      input: { id: reportId, reason: effective.reason },\n      ctx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'draft',\n      unlockedEntryCount: result?.unlockedEntryCount ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate(\n            'staff.time_tracking.reports.errors.reasonRequired',\n            'An unlock reason is required.',\n          ),\n          details: err.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.unlock failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst unlockResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('draft'),\n  unlockedEntryCount: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Unlock a closed customer report',\n  methods: {\n    POST: {\n      summary: 'Unlock a closed customer report',\n      description:\n        'Clears locked_report_id / locked_at on every entry this report froze, removes its freeze records so a previously billed hour stops being counted as already reported, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.',\n      requestBody: { contentType: 'application/json', schema: staffTimeReportUnlockSchema.pick({ reason: true }) },\n      responses: [{ status: 200, description: 'Report unlocked', schema: unlockResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing or empty reason' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.unlock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is not closed (report_not_closed)' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAeA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAE7C,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAE1E,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAC5E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACtH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,WAAW,MAAM,QAAQ,IAAI;AAK5C,UAAM,UAAU,6BAA6B;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,WAAW,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC9D;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,MACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,0BAA0B,QAAQ;AAAA,MAClC,OAAO,EAAE,IAAI,UAAU,QAAQ,UAAU,OAAO;AAAA,MAChD;AAAA,IACF,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,oBAAoB,QAAQ,sBAAsB;AAAA,IACpD,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA,UAGb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,UACA,SAAS,IAAI;AAAA,QACf;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,OAAO;AAAA,EACzB,oBAAoB,EAAE,OAAO,EAAE,IAAI;AACrC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,4BAA4B,KAAK,EAAE,QAAQ,KAAK,CAAC,EAAE;AAAA,MAC3G,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,6FAA6F;AAAA,QACzH,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/unlock` \u2014 screen 15.\n *\n * Gated on `staff.timesheets.reports.unlock`, deliberately a DIFFERENT feature\n * from `staff.timesheets.lock`. Screen 15 note 4 asked who may unlock and\n * observed that \u00A710 leaves nobody \"above\" a Team Leader; the answer is a\n * separate grant that can be withheld from a Team Leader who should not restate\n * billed time, rather than an admin role the requirements reject.\n *\n * The reason is mandatory at the schema level and is written verbatim into the\n * `unlocked` report event beside the actor and the timestamp, which is what\n * makes this the \"explicit, audited action\" US-G3 asks for rather than a confirm\n * dialog.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffTimeReportUnlockSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportUnlockResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport { evaluateReportUnlockPolicies } from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/unlock' })\n\nconst UNLOCK_FEATURE = 'staff.timesheets.reports.unlock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [UNLOCK_FEATURE] },\n}\n\nconst bodySchema = z.object({ reason: z.string().trim().min(1).max(2000) })\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'unlock' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [UNLOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = bodySchema.parse(session.body)\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A\n    // four-eyes or accounting-period policy narrows who may unlock; nothing here\n    // widens it past staff.timesheets.reports.unlock.\n    const refusal = evaluateReportUnlockPolicies({\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'closed',\n      reason: parsed.reason,\n    })\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? bodySchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { id: string; reason: string },\n      StaffTimeReportUnlockResult\n    >(staffTimeReportCommandIds.unlock, {\n      input: { id: reportId, reason: effective.reason },\n      ctx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'draft',\n      unlockedEntryCount: result?.unlockedEntryCount ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate(\n            'staff.time_tracking.reports.errors.reasonRequired',\n            'An unlock reason is required.',\n          ),\n          details: err.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.unlock failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst unlockResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('draft'),\n  unlockedEntryCount: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Unlock a closed customer report',\n  methods: {\n    POST: {\n      summary: 'Unlock a closed customer report',\n      description:\n        'Removes the freeze records of this report so a previously billed hour stops being counted as already reported by it, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. Clears locked_report_id / locked_at on every entry this report locked that no other closed report quotes; an entry another closed report re-included stays locked, and its lock moves to that report. `unlockedEntryCount` counts the entries actually freed. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.',\n      requestBody: { contentType: 'application/json', schema: staffTimeReportUnlockSchema.pick({ reason: true }) },\n      responses: [{ status: 200, description: 'Report unlocked', schema: unlockResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing or empty reason' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.unlock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is not closed (report_not_closed)' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAeA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,yCAAyC;AAClD,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAE7C,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAE1E,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAC5E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACtH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,WAAW,MAAM,QAAQ,IAAI;AAK5C,UAAM,UAAU,6BAA6B;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,WAAW,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC9D;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,0BAA0B,QAAQ;AAAA,MAClC,OAAO,EAAE,IAAI,UAAU,QAAQ,UAAU,OAAO;AAAA,MAChD;AAAA,IACF,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,oBAAoB,QAAQ,sBAAsB;AAAA,IACpD,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA,UAGb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,UACA,SAAS,IAAI;AAAA,QACf;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,OAAO;AAAA,EACzB,oBAAoB,EAAE,OAAO,EAAE,IAAI;AACrC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,4BAA4B,KAAK,EAAE,QAAQ,KAAK,CAAC,EAAE;AAAA,MAC3G,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,6FAA6F;AAAA,QACzH,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/preview/route.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -83,7 +84,7 @@ async function POST(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/reports/preview/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/reports/preview/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/preview` \u2014 screen 13's live numbers.\n *\n * It persists nothing. It exists because the project pick-list has to show what\n * each project would contribute BEFORE a report row exists, and because the\n * already-reported panel (D-5) has to be answerable at configuration time \u2014 the\n * whole point of that panel is to be read before the report is generated, not\n * after.\n *\n * It is a POST because the input is a project selection plus a period, not a\n * URL-shaped filter. It is nonetheless a **read**: it runs no command, writes no\n * row and therefore wires no mutation guard, which would otherwise run\n * after-success callbacks for a mutation that never happened. Authorization is\n * `staff.timesheets.reports.view` plus the same `resolveProjectAccess`\n * narrowing every other timesheets route uses.\n *\n * Two refusals are deliberate and named:\n *\n *  - **`422 report_currency_conflict`** when the selected projects disagree on a\n *    currency (risk R2). The body lists the currencies and the offending\n *    projects, because \"pick one currency\" is unactionable otherwise.\n *  - **`422 report_project_not_found`** when a requested project is outside the\n *    caller's access. Dropping it silently would produce a smaller, plausible\n *    total that nobody could explain.\n */\n\nimport { resolveMoneyVisibility } from '../../../../lib/time-tracking/moneyVisibility'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { staffTimeReportPreviewSchema } from '../../../../data/validators'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from '../../../../lib/time-tracking/access'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { readTimeTrackingSettings } from '../../../../lib/time-tracking/settings'\nimport { loadReportData } from '../../../../lib/timesheets-reports/loadReportData'\nimport {\n  computeReportTotals,\n  resolveEntryValues,\n  resolveReportCurrency,\n  sumAmounts,\n  type ReportGroup,\n  type ReportInputEntry,\n} from '../../../../lib/timesheets-reports/reportTotals'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/preview' })\n\nconst VIEW_FEATURE = 'staff.timesheets.reports.view'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nexport type PreviewProjectTotals = {\n  id: string\n  name: string\n  hourlyRate: number | null\n  currencyCode: string | null\n  entryCount: number\n  billableMinutes: number\n  nonbillableMinutes: number\n  amount: number | null\n}\n\n/**\n * Per-project figures for the pick-list. They depend only on (project, period)\n * and never on which other projects are ticked, so the screen can render every\n * candidate \u2014 including one with no entries, which stays listed but unticked and\n * greyed (screen 13 note 2) rather than disappearing.\n *\n * The amounts here go through the same `resolveEntryValues` the totals use, so a\n * row's figure and the grand total can never come from two different rules.\n */\nexport function summarizeProjectsForPreview(\n  projects: readonly { id: string; name: string; hourlyRate: number | null; currencyCode: string | null }[],\n  entries: readonly ReportInputEntry[],\n  options: { includeAlreadyReported: boolean; excludeNonBillable: boolean; canSeeMoney: boolean },\n): PreviewProjectTotals[] {\n  const byProject = new Map<string, ReportInputEntry[]>()\n  for (const entry of entries) {\n    const bucket = byProject.get(entry.timeProjectId)\n    if (bucket) bucket.push(entry)\n    else byProject.set(entry.timeProjectId, [entry])\n  }\n\n  return projects.map((project) => {\n    const projectEntries = byProject.get(project.id) ?? []\n    let billableMinutes = 0\n    let nonbillableMinutes = 0\n    const amounts: Array<number | null> = []\n    let entryCount = 0\n\n    for (const entry of projectEntries) {\n      if (entry.frozen && !options.includeAlreadyReported) continue\n      const values = resolveEntryValues(entry, project)\n      if (!values.isBillable) {\n        if (options.excludeNonBillable) continue\n        nonbillableMinutes += values.minutes\n        entryCount += 1\n        continue\n      }\n      billableMinutes += values.minutes\n      amounts.push(values.amount)\n      entryCount += 1\n    }\n\n    return {\n      id: project.id,\n      name: project.name,\n      hourlyRate: options.canSeeMoney ? project.hourlyRate : null,\n      currencyCode: project.currencyCode,\n      entryCount,\n      billableMinutes,\n      nonbillableMinutes,\n      amount: options.canSeeMoney ? sumAmounts(amounts) : null,\n    }\n  })\n}\n\n/** Money is absent from the payload \u2014 not zeroed \u2014 for a caller without `rates.view`. */\nfunction stripMoney(groups: ReportGroup[]): ReportGroup[] {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): ReportGroup['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    // Both questions go through the module's single RBAC authority, which asks the\n    // service and fails closed on every path. The hand-rolled grant read this\n    // replaces returned `string[] | null`, and a null it could not explain was read\n    // as \"no restriction\" \u2014 that is how rates reached a plain report viewer, since\n    // this route requires only `reports.view`.\n    const manageAccess = await resolveFeatureAccess(container, auth.sub ?? null, [MANAGE_PROJECTS_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n    const grantedFeatures = manageAccess.grantedFeatures\n    const canSeeMoney = await resolveMoneyVisibility(container, auth.sub ?? null, {\n      tenantId,\n      organizationId,\n    })\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeReportPreviewSchema.parse(session.body)\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const access = await resolveProjectAccess({\n      em,\n      userId: auth.sub ?? null,\n      tenantId,\n      organizationId,\n      canManageAll: manageAccess.allowed,\n      userFeatures: grantedFeatures,\n      assignmentGraceDays: await readAssignmentGraceDays(container, tenantId),\n    })\n\n    const requestedIds = Array.from(new Set(parsed.timeProjectIds))\n    const deniedIds = access.canManageAll\n      ? []\n      : requestedIds.filter((id) => !access.projectIds.includes(id))\n    if (deniedIds.length > 0) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: deniedIds,\n      })\n    }\n\n    const data = await loadReportData({\n      em,\n      scope: { tenantId, organizationId },\n      timeProjectIds: requestedIds,\n      periodFrom: parsed.periodFrom,\n      periodTo: parsed.periodTo,\n    })\n\n    if (data.projects.length !== requestedIds.length) {\n      const found = new Set(data.projects.map((project) => project.id))\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: requestedIds.filter((id) => !found.has(id)),\n      })\n    }\n\n    // Risk R2, asserted before a single amount is produced.\n    const currency = resolveReportCurrency(\n      data.projects.map((project) => ({\n        id: project.id,\n        name: project.name,\n        currencyCode: project.currencyCode,\n      })),\n    )\n    if (!currency.ok) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.currencyConflict',\n        'A report always covers one currency. Selected projects use {currencies}.',\n      ).replace('{currencies}', currency.currencies.join(', '))\n      throw new CrudHttpError(422, {\n        code: 'report_currency_conflict',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        currencies: currency.currencies,\n        offenders: currency.offenders.map((project) => ({\n          id: project.id,\n          name: project.name,\n          currencyCode: project.currencyCode ?? null,\n        })),\n      })\n    }\n\n    const totals = computeReportTotals({\n      entries: data.entries,\n      projects: data.projects,\n      directory: data.directory,\n      options: {\n        grouping: parsed.grouping,\n        nonbillableMode: parsed.nonbillableMode,\n        includeAlreadyReported: parsed.includeAlreadyReported,\n      },\n      labels: reportLabels(translate),\n    })\n\n    const configService = safeConfigService(container)\n    const settings = configService\n      ? await readTimeTrackingSettings(configService, { tenantId })\n      : null\n\n    return session.respond(200, {\n      currencyCode: currency.currencyCode,\n      grouping: parsed.grouping,\n      nonbillableMode: parsed.nonbillableMode,\n      includeAlreadyReported: parsed.includeAlreadyReported,\n      showRates: parsed.showRates && canSeeMoney,\n      projects: summarizeProjectsForPreview(data.projects, data.entries, {\n        includeAlreadyReported: parsed.includeAlreadyReported,\n        excludeNonBillable: parsed.nonbillableMode === 'exclude',\n        canSeeMoney,\n      }),\n      groups: canSeeMoney ? totals.groups : stripMoney(totals.groups),\n      totals: {\n        entryCount: totals.entryCount,\n        billableMinutes: totals.billableMinutes,\n        nonbillableMinutes: totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? totals.totalAmount : null,\n      },\n      alreadyReportedCount: totals.alreadyReportedCount,\n      alreadyReportedMinutes: totals.alreadyReportedMinutes,\n      alreadyReportedIn: totals.alreadyReportedIn,\n      rounding: {\n        unitMinutes: settings?.rounding.unitMinutes ?? 0,\n        direction: settings?.rounding.direction ?? 'up',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.preview failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction safeConfigService(container: ContainerLike): ModuleConfigService | null {\n  try {\n    return container.resolve('moduleConfigService') as ModuleConfigService\n  } catch {\n    return null\n  }\n}\n\nasync function readAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  const configService = safeConfigService(container)\n  if (!configService) return null\n  try {\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    return null\n  }\n}\n\nexport function reportLabels(translate: (key: string, fallback: string) => string) {\n  return {\n    unassignedTask: translate('staff.time_tracking.reports.sheet.noTask', 'No task'),\n    unassignedPerson: translate('staff.time_tracking.reports.sheet.noPerson', 'Unassigned'),\n    nonbillableGroup: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n  }\n}\n\nconst previewLineSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.object({\n    key: z.string(),\n    label: z.string(),\n    minutes: z.number().int(),\n    rate: z.number().nullable(),\n    amount: z.number(),\n    entryCount: z.number().int(),\n    hasOverride: z.boolean(),\n    children: z.array(previewLineSchema),\n  }),\n)\n\nconst previewResponseSchema = z.object({\n  currencyCode: z.string().nullable(),\n  grouping: z.string(),\n  nonbillableMode: z.enum(['separate', 'exclude']),\n  includeAlreadyReported: z.boolean(),\n  showRates: z.boolean(),\n  projects: z.array(\n    z.object({\n      id: z.string().uuid(),\n      name: z.string(),\n      hourlyRate: z.number().nullable(),\n      currencyCode: z.string().nullable(),\n      entryCount: z.number().int(),\n      billableMinutes: z.number().int(),\n      nonbillableMinutes: z.number().int(),\n      amount: z.number().nullable(),\n    }),\n  ),\n  groups: z.array(\n    z.object({\n      key: z.string(),\n      kind: z.enum(['project', 'nonbillable']),\n      label: z.string(),\n      rate: z.number().nullable(),\n      minutes: z.number().int(),\n      amount: z.number(),\n      entryCount: z.number().int(),\n      lines: z.array(previewLineSchema),\n    }),\n  ),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  alreadyReportedCount: z.number().int(),\n  alreadyReportedMinutes: z.number().int(),\n  alreadyReportedIn: z.array(\n    z.object({\n      reportId: z.string().uuid(),\n      reference: z.string().nullable(),\n      title: z.string().nullable(),\n      entryCount: z.number().int(),\n      minutes: z.number().int(),\n    }),\n  ),\n  rounding: z.object({ unitMinutes: z.number().int(), direction: z.string() }),\n})\n\nconst currencyConflictSchema = z.object({\n  code: z.literal('report_currency_conflict'),\n  error: z.string(),\n  currencies: z.array(z.string()),\n  offenders: z.array(\n    z.object({ id: z.string().uuid(), name: z.string(), currencyCode: z.string().nullable() }),\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Preview a customer report',\n  methods: {\n    POST: {\n      summary: 'Preview a customer report',\n      description:\n        'Computes report totals for a project selection and period WITHOUT persisting anything. Powers the live per-project numbers and the range summary of the report config screen. Money is rounded at the entry and summed upward (D-7), so the grand total does not change when the grouping changes. Entries already frozen in a closed report are excluded unless `includeAlreadyReported` is set, and are reported as `alreadyReportedCount` / `alreadyReportedMinutes` / `alreadyReportedIn` either way (D-5). Amounts and rates are omitted for a caller without staff.timesheets.rates.view.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeReportPreviewSchema,\n      },\n      responses: [{ status: 200, description: 'Computed totals', schema: previewResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        {\n          status: 422,\n          description: 'Selected projects disagree on a currency, or one is not accessible',\n          schema: currencyConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA0BA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAG7B,SAAS,oBAAoB;AAC7B,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,4BAA4B;AAC9D,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,iCAAiC,CAAC;AAE1F,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAsBO,SAAS,4BACd,UACA,SACA,SACwB;AACxB,QAAM,YAAY,oBAAI,IAAgC;AACtD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,UAAU,IAAI,MAAM,aAAa;AAChD,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,WAAU,IAAI,MAAM,eAAe,CAAC,KAAK,CAAC;AAAA,EACjD;AAEA,SAAO,SAAS,IAAI,CAAC,YAAY;AAC/B,UAAM,iBAAiB,UAAU,IAAI,QAAQ,EAAE,KAAK,CAAC;AACrD,QAAI,kBAAkB;AACtB,QAAI,qBAAqB;AACzB,UAAM,UAAgC,CAAC;AACvC,QAAI,aAAa;AAEjB,eAAW,SAAS,gBAAgB;AAClC,UAAI,MAAM,UAAU,CAAC,QAAQ,uBAAwB;AACrD,YAAM,SAAS,mBAAmB,OAAO,OAAO;AAChD,UAAI,CAAC,OAAO,YAAY;AACtB,YAAI,QAAQ,mBAAoB;AAChC,8BAAsB,OAAO;AAC7B,sBAAc;AACd;AAAA,MACF;AACA,yBAAmB,OAAO;AAC1B,cAAQ,KAAK,OAAO,MAAM;AAC1B,oBAAc;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,YAAY,QAAQ,cAAc,QAAQ,aAAa;AAAA,MACvD,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,cAAc,WAAW,OAAO,IAAI;AAAA,IACtD;AAAA,EACF,CAAC;AACH;AAGA,SAAS,WAAW,QAAsC;AACxD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAAoC;AACxE,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAOA,UAAM,eAAe,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,uBAAuB,GAAG;AAAA,MACtG;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,kBAAkB,aAAa;AACrC,UAAM,cAAc,MAAM,uBAAuB,WAAW,KAAK,OAAO,MAAM;AAAA,MAC5E;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,6BAA6B,MAAM,QAAQ,IAAI;AAE9D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,qBAAqB;AAAA,MACxC;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA,cAAc,aAAa;AAAA,MAC3B,cAAc;AAAA,MACd,qBAAqB,MAAM,wBAAwB,WAAW,QAAQ;AAAA,IACxE,CAAC;AAED,UAAM,eAAe,MAAM,KAAK,IAAI,IAAI,OAAO,cAAc,CAAC;AAC9D,UAAM,YAAY,OAAO,eACrB,CAAC,IACD,aAAa,OAAO,CAAC,OAAO,CAAC,OAAO,WAAW,SAAS,EAAE,CAAC;AAC/D,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,gBAAgB;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,IACnB,CAAC;AAED,QAAI,KAAK,SAAS,WAAW,aAAa,QAAQ;AAChD,YAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC;AAChE,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAGA,UAAM,WAAW;AAAA,MACf,KAAK,SAAS,IAAI,CAAC,aAAa;AAAA,QAC9B,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB,EAAE;AAAA,IACJ;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF,EAAE,QAAQ,gBAAgB,SAAS,WAAW,KAAK,IAAI,CAAC;AACxD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,YAAY,SAAS;AAAA,QACrB,WAAW,SAAS,UAAU,IAAI,CAAC,aAAa;AAAA,UAC9C,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,cAAc,QAAQ,gBAAgB;AAAA,QACxC,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,oBAAoB;AAAA,MACjC,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,QACP,UAAU,OAAO;AAAA,QACjB,iBAAiB,OAAO;AAAA,QACxB,wBAAwB,OAAO;AAAA,MACjC;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAED,UAAM,gBAAgB,kBAAkB,SAAS;AACjD,UAAM,WAAW,gBACb,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,IAC1D;AAEJ,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,cAAc,SAAS;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,iBAAiB,OAAO;AAAA,MACxB,wBAAwB,OAAO;AAAA,MAC/B,WAAW,OAAO,aAAa;AAAA,MAC/B,UAAU,4BAA4B,KAAK,UAAU,KAAK,SAAS;AAAA,QACjE,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO,oBAAoB;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,MACD,QAAQ,cAAc,OAAO,SAAS,WAAW,OAAO,MAAM;AAAA,MAC9D,QAAQ;AAAA,QACN,YAAY,OAAO;AAAA,QACnB,iBAAiB,OAAO;AAAA,QACxB,oBAAoB,OAAO;AAAA,QAC3B,aAAa,cAAc,OAAO,cAAc;AAAA,MAClD;AAAA,MACA,sBAAsB,OAAO;AAAA,MAC7B,wBAAwB,OAAO;AAAA,MAC/B,mBAAmB,OAAO;AAAA,MAC1B,UAAU;AAAA,QACR,aAAa,UAAU,SAAS,eAAe;AAAA,QAC/C,WAAW,UAAU,SAAS,aAAa;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,2CAA2C,EAAE,IAAI,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAIA,SAAS,kBAAkB,WAAsD;AAC/E,MAAI;AACF,WAAO,UAAU,QAAQ,qBAAqB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBAAwB,WAA0B,UAA0C;AACzG,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACF,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,WAAsD;AACjF,SAAO;AAAA,IACL,gBAAgB,UAAU,4CAA4C,SAAS;AAAA,IAC/E,kBAAkB,UAAU,8CAA8C,YAAY;AAAA,IACtF,kBAAkB,UAAU,iDAAiD,mBAAmB;AAAA,EAClG;AACF;AAEA,MAAM,oBAAwC,EAAE;AAAA,EAAK,MACnD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,OAAO;AAAA,IACd,OAAO,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,QAAQ,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,aAAa,EAAE,QAAQ;AAAA,IACvB,UAAU,EAAE,MAAM,iBAAiB;AAAA,EACrC,CAAC;AACH;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,UAAU,EAAE,OAAO;AAAA,EACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY,SAAS,CAAC;AAAA,EAC/C,wBAAwB,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,MAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,MACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,KAAK,EAAE,OAAO;AAAA,MACd,MAAM,EAAE,KAAK,CAAC,WAAW,aAAa,CAAC;AAAA,MACvC,OAAO,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,MACxB,QAAQ,EAAE,OAAO;AAAA,MACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,wBAAwB,EAAE,OAAO,EAAE,IAAI;AAAA,EACvC,mBAAmB,EAAE;AAAA,IACnB,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EACA,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC9B,WAAW,EAAE;AAAA,IACX,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EAC3F;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/preview` \u2014 screen 13's live numbers.\n *\n * It persists nothing. It exists because the project pick-list has to show what\n * each project would contribute BEFORE a report row exists, and because the\n * already-reported panel (D-5) has to be answerable at configuration time \u2014 the\n * whole point of that panel is to be read before the report is generated, not\n * after.\n *\n * It is a POST because the input is a project selection plus a period, not a\n * URL-shaped filter. It is nonetheless a **read**: it runs no command, writes no\n * row and therefore wires no mutation guard, which would otherwise run\n * after-success callbacks for a mutation that never happened. Authorization is\n * `staff.timesheets.reports.view` plus the same `resolveProjectAccess`\n * narrowing every other timesheets route uses.\n *\n * Two refusals are deliberate and named:\n *\n *  - **`422 report_currency_conflict`** when the selected projects disagree on a\n *    currency (risk R2). The body lists the currencies and the offending\n *    projects, because \"pick one currency\" is unactionable otherwise.\n *  - **`422 report_project_not_found`** when a requested project is outside the\n *    caller's access. Dropping it silently would produce a smaller, plausible\n *    total that nobody could explain.\n */\n\nimport { resolveMoneyVisibility } from '../../../../lib/time-tracking/moneyVisibility'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { staffTimeReportPreviewSchema } from '../../../../data/validators'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from '../../../../lib/time-tracking/access'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { readTimeTrackingSettings } from '../../../../lib/time-tracking/settings'\nimport { loadReportData } from '../../../../lib/timesheets-reports/loadReportData'\nimport {\n  computeReportTotals,\n  resolveEntryValues,\n  resolveReportCurrency,\n  sumAmounts,\n  type ReportGroup,\n  type ReportInputEntry,\n} from '../../../../lib/timesheets-reports/reportTotals'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/preview' })\n\nconst VIEW_FEATURE = 'staff.timesheets.reports.view'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nexport type PreviewProjectTotals = {\n  id: string\n  name: string\n  hourlyRate: number | null\n  currencyCode: string | null\n  entryCount: number\n  billableMinutes: number\n  nonbillableMinutes: number\n  amount: number | null\n}\n\n/**\n * Per-project figures for the pick-list. They depend only on (project, period)\n * and never on which other projects are ticked, so the screen can render every\n * candidate \u2014 including one with no entries, which stays listed but unticked and\n * greyed (screen 13 note 2) rather than disappearing.\n *\n * The amounts here go through the same `resolveEntryValues` the totals use, so a\n * row's figure and the grand total can never come from two different rules.\n */\nexport function summarizeProjectsForPreview(\n  projects: readonly { id: string; name: string; hourlyRate: number | null; currencyCode: string | null }[],\n  entries: readonly ReportInputEntry[],\n  options: { includeAlreadyReported: boolean; excludeNonBillable: boolean; canSeeMoney: boolean },\n): PreviewProjectTotals[] {\n  const byProject = new Map<string, ReportInputEntry[]>()\n  for (const entry of entries) {\n    const bucket = byProject.get(entry.timeProjectId)\n    if (bucket) bucket.push(entry)\n    else byProject.set(entry.timeProjectId, [entry])\n  }\n\n  return projects.map((project) => {\n    const projectEntries = byProject.get(project.id) ?? []\n    let billableMinutes = 0\n    let nonbillableMinutes = 0\n    const amounts: Array<number | null> = []\n    let entryCount = 0\n\n    for (const entry of projectEntries) {\n      if (entry.frozen && !options.includeAlreadyReported) continue\n      const values = resolveEntryValues(entry, project)\n      if (!values.isBillable) {\n        if (options.excludeNonBillable) continue\n        nonbillableMinutes += values.minutes\n        entryCount += 1\n        continue\n      }\n      billableMinutes += values.minutes\n      amounts.push(values.amount)\n      entryCount += 1\n    }\n\n    return {\n      id: project.id,\n      name: project.name,\n      hourlyRate: options.canSeeMoney ? project.hourlyRate : null,\n      currencyCode: project.currencyCode,\n      entryCount,\n      billableMinutes,\n      nonbillableMinutes,\n      amount: options.canSeeMoney ? sumAmounts(amounts) : null,\n    }\n  })\n}\n\n/** Money is absent from the payload \u2014 not zeroed \u2014 for a caller without `rates.view`. */\nfunction stripMoney(groups: ReportGroup[]): ReportGroup[] {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): ReportGroup['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    // Both questions go through the module's single RBAC authority, which asks the\n    // service and fails closed on every path. The hand-rolled grant read this\n    // replaces returned `string[] | null`, and a null it could not explain was read\n    // as \"no restriction\" \u2014 that is how rates reached a plain report viewer, since\n    // this route requires only `reports.view`.\n    const manageAccess = await resolveFeatureAccess(container, auth.sub ?? null, [MANAGE_PROJECTS_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n    const grantedFeatures = manageAccess.grantedFeatures\n    const canSeeMoney = await resolveMoneyVisibility(container, auth.sub ?? null, {\n      tenantId,\n      organizationId,\n    })\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeReportPreviewSchema.parse(session.body)\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const access = await resolveProjectAccess({\n      em,\n      userId: auth.sub ?? null,\n      tenantId,\n      organizationId,\n      canManageAll: manageAccess.allowed,\n      userFeatures: grantedFeatures,\n      assignmentGraceDays: await readAssignmentGraceDays(container, tenantId),\n    })\n\n    const requestedIds = Array.from(new Set(parsed.timeProjectIds))\n    const deniedIds = access.canManageAll\n      ? []\n      : requestedIds.filter((id) => !access.projectIds.includes(id))\n    if (deniedIds.length > 0) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: deniedIds,\n      })\n    }\n\n    const data = await loadReportData({\n      em,\n      scope: { tenantId, organizationId },\n      timeProjectIds: requestedIds,\n      periodFrom: parsed.periodFrom,\n      periodTo: parsed.periodTo,\n    })\n\n    if (data.projects.length !== requestedIds.length) {\n      const found = new Set(data.projects.map((project) => project.id))\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: requestedIds.filter((id) => !found.has(id)),\n      })\n    }\n\n    // Risk R2, asserted before a single amount is produced.\n    const currency = resolveReportCurrency(\n      data.projects.map((project) => ({\n        id: project.id,\n        name: project.name,\n        currencyCode: project.currencyCode,\n      })),\n    )\n    if (!currency.ok) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.currencyConflict',\n        'A report always covers one currency. Selected projects use {currencies}.',\n      ).replace('{currencies}', currency.currencies.join(', '))\n      throw new CrudHttpError(422, {\n        code: 'report_currency_conflict',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        currencies: currency.currencies,\n        offenders: currency.offenders.map((project) => ({\n          id: project.id,\n          name: project.name,\n          currencyCode: project.currencyCode ?? null,\n        })),\n      })\n    }\n\n    const totals = computeReportTotals({\n      entries: data.entries,\n      projects: data.projects,\n      directory: data.directory,\n      options: {\n        grouping: parsed.grouping,\n        nonbillableMode: parsed.nonbillableMode,\n        includeAlreadyReported: parsed.includeAlreadyReported,\n      },\n      labels: reportLabels(translate),\n    })\n\n    const configService = safeConfigService(container)\n    const settings = configService\n      ? await readTimeTrackingSettings(configService, { tenantId })\n      : null\n\n    return session.respond(200, {\n      currencyCode: currency.currencyCode,\n      grouping: parsed.grouping,\n      nonbillableMode: parsed.nonbillableMode,\n      includeAlreadyReported: parsed.includeAlreadyReported,\n      showRates: parsed.showRates && canSeeMoney,\n      projects: summarizeProjectsForPreview(data.projects, data.entries, {\n        includeAlreadyReported: parsed.includeAlreadyReported,\n        excludeNonBillable: parsed.nonbillableMode === 'exclude',\n        canSeeMoney,\n      }),\n      groups: canSeeMoney ? totals.groups : stripMoney(totals.groups),\n      totals: {\n        entryCount: totals.entryCount,\n        billableMinutes: totals.billableMinutes,\n        nonbillableMinutes: totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? totals.totalAmount : null,\n      },\n      alreadyReportedCount: totals.alreadyReportedCount,\n      alreadyReportedMinutes: totals.alreadyReportedMinutes,\n      alreadyReportedIn: totals.alreadyReportedIn,\n      rounding: {\n        unitMinutes: settings?.rounding.unitMinutes ?? 0,\n        direction: settings?.rounding.direction ?? 'up',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.preview failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction safeConfigService(container: ContainerLike): ModuleConfigService | null {\n  try {\n    return container.resolve('moduleConfigService') as ModuleConfigService\n  } catch {\n    return null\n  }\n}\n\nasync function readAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  const configService = safeConfigService(container)\n  if (!configService) return null\n  try {\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    return null\n  }\n}\n\nexport function reportLabels(translate: (key: string, fallback: string) => string) {\n  return {\n    unassignedTask: translate('staff.time_tracking.reports.sheet.noTask', 'No task'),\n    unassignedPerson: translate('staff.time_tracking.reports.sheet.noPerson', 'Unassigned'),\n    nonbillableGroup: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n  }\n}\n\nconst previewLineSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.object({\n    key: z.string(),\n    label: z.string(),\n    minutes: z.number().int(),\n    rate: z.number().nullable(),\n    amount: z.number(),\n    entryCount: z.number().int(),\n    hasOverride: z.boolean(),\n    children: z.array(previewLineSchema),\n  }),\n)\n\nconst previewResponseSchema = z.object({\n  currencyCode: z.string().nullable(),\n  grouping: z.string(),\n  nonbillableMode: z.enum(['separate', 'exclude']),\n  includeAlreadyReported: z.boolean(),\n  showRates: z.boolean(),\n  projects: z.array(\n    z.object({\n      id: z.string().uuid(),\n      name: z.string(),\n      hourlyRate: z.number().nullable(),\n      currencyCode: z.string().nullable(),\n      entryCount: z.number().int(),\n      billableMinutes: z.number().int(),\n      nonbillableMinutes: z.number().int(),\n      amount: z.number().nullable(),\n    }),\n  ),\n  groups: z.array(\n    z.object({\n      key: z.string(),\n      kind: z.enum(['project', 'nonbillable']),\n      label: z.string(),\n      rate: z.number().nullable(),\n      minutes: z.number().int(),\n      amount: z.number(),\n      entryCount: z.number().int(),\n      lines: z.array(previewLineSchema),\n    }),\n  ),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  alreadyReportedCount: z.number().int(),\n  alreadyReportedMinutes: z.number().int(),\n  alreadyReportedIn: z.array(\n    z.object({\n      reportId: z.string().uuid(),\n      reference: z.string().nullable(),\n      title: z.string().nullable(),\n      entryCount: z.number().int(),\n      minutes: z.number().int(),\n    }),\n  ),\n  rounding: z.object({ unitMinutes: z.number().int(), direction: z.string() }),\n})\n\nconst currencyConflictSchema = z.object({\n  code: z.literal('report_currency_conflict'),\n  error: z.string(),\n  currencies: z.array(z.string()),\n  offenders: z.array(\n    z.object({ id: z.string().uuid(), name: z.string(), currencyCode: z.string().nullable() }),\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Preview a customer report',\n  methods: {\n    POST: {\n      summary: 'Preview a customer report',\n      description:\n        'Computes report totals for a project selection and period WITHOUT persisting anything. Powers the live per-project numbers and the range summary of the report config screen. Money is rounded at the entry and summed upward (D-7), so the grand total does not change when the grouping changes. Entries already frozen in a closed report are excluded unless `includeAlreadyReported` is set, and are reported as `alreadyReportedCount` / `alreadyReportedMinutes` / `alreadyReportedIn` either way (D-5). Amounts and rates are omitted for a caller without staff.timesheets.rates.view.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeReportPreviewSchema,\n      },\n      responses: [{ status: 200, description: 'Computed totals', schema: previewResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        {\n          status: 422,\n          description: 'Selected projects disagree on a currency, or one is not accessible',\n          schema: currencyConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA0BA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAG7B,SAAS,oBAAoB;AAC7B,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,4BAA4B;AAC9D,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,iCAAiC,CAAC;AAE1F,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAsBO,SAAS,4BACd,UACA,SACA,SACwB;AACxB,QAAM,YAAY,oBAAI,IAAgC;AACtD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,UAAU,IAAI,MAAM,aAAa;AAChD,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,WAAU,IAAI,MAAM,eAAe,CAAC,KAAK,CAAC;AAAA,EACjD;AAEA,SAAO,SAAS,IAAI,CAAC,YAAY;AAC/B,UAAM,iBAAiB,UAAU,IAAI,QAAQ,EAAE,KAAK,CAAC;AACrD,QAAI,kBAAkB;AACtB,QAAI,qBAAqB;AACzB,UAAM,UAAgC,CAAC;AACvC,QAAI,aAAa;AAEjB,eAAW,SAAS,gBAAgB;AAClC,UAAI,MAAM,UAAU,CAAC,QAAQ,uBAAwB;AACrD,YAAM,SAAS,mBAAmB,OAAO,OAAO;AAChD,UAAI,CAAC,OAAO,YAAY;AACtB,YAAI,QAAQ,mBAAoB;AAChC,8BAAsB,OAAO;AAC7B,sBAAc;AACd;AAAA,MACF;AACA,yBAAmB,OAAO;AAC1B,cAAQ,KAAK,OAAO,MAAM;AAC1B,oBAAc;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,YAAY,QAAQ,cAAc,QAAQ,aAAa;AAAA,MACvD,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,cAAc,WAAW,OAAO,IAAI;AAAA,IACtD;AAAA,EACF,CAAC;AACH;AAGA,SAAS,WAAW,QAAsC;AACxD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAAoC;AACxE,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAOA,UAAM,eAAe,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,uBAAuB,GAAG;AAAA,MACtG;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,kBAAkB,aAAa;AACrC,UAAM,cAAc,MAAM,uBAAuB,WAAW,KAAK,OAAO,MAAM;AAAA,MAC5E;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,6BAA6B,MAAM,QAAQ,IAAI;AAE9D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,qBAAqB;AAAA,MACxC;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA,cAAc,aAAa;AAAA,MAC3B,cAAc;AAAA,MACd,qBAAqB,MAAM,wBAAwB,WAAW,QAAQ;AAAA,IACxE,CAAC;AAED,UAAM,eAAe,MAAM,KAAK,IAAI,IAAI,OAAO,cAAc,CAAC;AAC9D,UAAM,YAAY,OAAO,eACrB,CAAC,IACD,aAAa,OAAO,CAAC,OAAO,CAAC,OAAO,WAAW,SAAS,EAAE,CAAC;AAC/D,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,gBAAgB;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,IACnB,CAAC;AAED,QAAI,KAAK,SAAS,WAAW,aAAa,QAAQ;AAChD,YAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC;AAChE,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAGA,UAAM,WAAW;AAAA,MACf,KAAK,SAAS,IAAI,CAAC,aAAa;AAAA,QAC9B,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB,EAAE;AAAA,IACJ;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF,EAAE,QAAQ,gBAAgB,SAAS,WAAW,KAAK,IAAI,CAAC;AACxD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,YAAY,SAAS;AAAA,QACrB,WAAW,SAAS,UAAU,IAAI,CAAC,aAAa;AAAA,UAC9C,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,cAAc,QAAQ,gBAAgB;AAAA,QACxC,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,oBAAoB;AAAA,MACjC,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,QACP,UAAU,OAAO;AAAA,QACjB,iBAAiB,OAAO;AAAA,QACxB,wBAAwB,OAAO;AAAA,MACjC;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAED,UAAM,gBAAgB,kBAAkB,SAAS;AACjD,UAAM,WAAW,gBACb,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,IAC1D;AAEJ,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,cAAc,SAAS;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,iBAAiB,OAAO;AAAA,MACxB,wBAAwB,OAAO;AAAA,MAC/B,WAAW,OAAO,aAAa;AAAA,MAC/B,UAAU,4BAA4B,KAAK,UAAU,KAAK,SAAS;AAAA,QACjE,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO,oBAAoB;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,MACD,QAAQ,cAAc,OAAO,SAAS,WAAW,OAAO,MAAM;AAAA,MAC9D,QAAQ;AAAA,QACN,YAAY,OAAO;AAAA,QACnB,iBAAiB,OAAO;AAAA,QACxB,oBAAoB,OAAO;AAAA,QAC3B,aAAa,cAAc,OAAO,cAAc;AAAA,MAClD;AAAA,MACA,sBAAsB,OAAO;AAAA,MAC7B,wBAAwB,OAAO;AAAA,MAC/B,mBAAmB,OAAO;AAAA,MAC1B,UAAU;AAAA,QACR,aAAa,UAAU,SAAS,eAAe;AAAA,QAC/C,WAAW,UAAU,SAAS,aAAa;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,2CAA2C,EAAE,IAAI,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAIA,SAAS,kBAAkB,WAAsD;AAC/E,MAAI;AACF,WAAO,UAAU,QAAQ,qBAAqB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBAAwB,WAA0B,UAA0C;AACzG,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACF,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,WAAsD;AACjF,SAAO;AAAA,IACL,gBAAgB,UAAU,4CAA4C,SAAS;AAAA,IAC/E,kBAAkB,UAAU,8CAA8C,YAAY;AAAA,IACtF,kBAAkB,UAAU,iDAAiD,mBAAmB;AAAA,EAClG;AACF;AAEA,MAAM,oBAAwC,EAAE;AAAA,EAAK,MACnD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,OAAO;AAAA,IACd,OAAO,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,QAAQ,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,aAAa,EAAE,QAAQ;AAAA,IACvB,UAAU,EAAE,MAAM,iBAAiB;AAAA,EACrC,CAAC;AACH;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,UAAU,EAAE,OAAO;AAAA,EACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY,SAAS,CAAC;AAAA,EAC/C,wBAAwB,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,MAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,MACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,KAAK,EAAE,OAAO;AAAA,MACd,MAAM,EAAE,KAAK,CAAC,WAAW,aAAa,CAAC;AAAA,MACvC,OAAO,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,MACxB,QAAQ,EAAE,OAAO;AAAA,MACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,wBAAwB,EAAE,OAAO,EAAE,IAAI;AAAA,EACvC,mBAAmB,EAAE;AAAA,IACnB,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EACA,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC9B,WAAW,EAAE;AAAA,IACX,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EAC3F;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/shared.js

@@ -3,6 +3,7 @@ import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.j
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { reportSheetLabels } from "../../../lib/timesheets-reports/reportLabels.js";
@@ -26,7 +27,7 @@ async function resolveReportRequestContext(req, options) {
   }
   const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null;
-  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
   if (!tenantId || !organizationId) {
     throw new CrudHttpError(400, {
       error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/reports/shared.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/reports/shared.ts"],
-  "sourcesContent": ["/**\n * Shared boilerplate for the hand-written report sub-routes (`sheet`, `close`,\n * `unlock`, `export`).\n *\n * Four routes needing the same six lines of auth, scope, id extraction and\n * granted-feature resolution is exactly the situation where one of them\n * eventually forgets the tenant filter. Resolving it in one place makes that\n * impossible rather than unlikely.\n */\n\nimport { RATES_FEATURE } from '../../../lib/time-tracking/moneyVisibility'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { reportSheetLabels } from '../../../lib/timesheets-reports/reportLabels'\n\nexport { reportSheetLabels }\n\n/**\n * Cap on the raw rows a sheet response carries. A report covering a quarter of a\n * ten-person team can run into the thousands, and the screen paginates anyway;\n * the response says when it truncated rather than quietly serving a short list.\n */\nexport const MAX_SHEET_ROWS = 500\n\nexport type Translate = (key: string, fallback: string) => string\n\nexport type ReportRequestContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  organizationScope: Awaited<ReturnType<typeof resolveOrganizationScopeForRequest>>\n  tenantId: string\n  organizationId: string\n  reportId: string\n  translate: Translate\n  /**\n   * The caller's grants, for the plumbing that takes a list: the approval\n   * policies, the interceptor context and the mutation-guard registry. Always an\n   * array, never `null` \u2014 a nullable grant list is what let \"RBAC could not\n   * answer\" read as \"no restriction\" on these routes.\n   *\n   * Empty means the same thing whether RBAC answered \"nothing\" or could not\n   * answer at all, and every consumer treats it the same fail-closed way: an\n   * approval policy that requires a feature refuses, a feature-gated interceptor\n   * does not run, and a feature-gated guard does not run. Authorization never\n   * rests on it \u2014 `canSeeMoney` and each route's own `resolveFeatureAccess` gate\n   * are the decisions, and both fail closed on their own. `resolveFeatureAccess`\n   * logs a grant list it could not read, so an outage is visible to operators\n   * without a flag here that no caller can act on.\n   */\n  grantedFeatures: string[]\n  /** Fail-closed `staff.timesheets.rates.view` decision \u2014 never re-derive it. */\n  canSeeMoney: boolean\n}\n\nexport function extractReportIdFromUrl(url: string | undefined, segment: string): string | null {\n  if (!url) return null\n  try {\n    const pathname = new URL(url).pathname\n    const match = pathname.match(new RegExp(`/reports/([^/]+)/${segment}`))\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function resolveReportRequestContext(\n  req: Request,\n  options: { segment: string },\n): Promise<ReportRequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const reportId = extractReportIdFromUrl(req.url, options.segment)\n  if (!reportId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.reports.errors.idRequired', 'Report id is required.'),\n    })\n  }\n\n  // One lookup, through the module's single RBAC authority, answering both\n  // questions the four routes ask: may this caller see money, and what is the\n  // grant list the plumbing wants. Decided here, once, so no route re-derives it\n  // and none can pick the other failure direction.\n  //\n  // `resolveFeatureAccess` fails closed on every path \u2014 an unresolvable service,\n  // a service that cannot answer, a call that throws \u2014 so an RBAC outage hides\n  // rates and costs instead of handing them to a plain report viewer.\n  const ratesAccess = await resolveFeatureAccess(container, auth.sub ?? null, [RATES_FEATURE], {\n    tenantId,\n    organizationId,\n  })\n\n  return {\n    container,\n    auth,\n    organizationScope,\n    tenantId,\n    organizationId,\n    reportId,\n    translate,\n    grantedFeatures: ratesAccess.grantedFeatures,\n    canSeeMoney: ratesAccess.allowed,\n  }\n}\n"],
-  "mappings": "AAUA,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAS3B,MAAM,iBAAiB;AAgCvB,SAAS,uBAAuB,KAAyB,SAAgC;AAC9F,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,UAAM,QAAQ,SAAS,MAAM,IAAI,OAAO,oBAAoB,OAAO,EAAE,CAAC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,4BACpB,KACA,SAC+B;AAC/B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AAEA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,uBAAuB,IAAI,KAAK,QAAQ,OAAO;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,iDAAiD,wBAAwB;AAAA,IAC5F,CAAC;AAAA,EACH;AAUA,QAAM,cAAc,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,aAAa,GAAG;AAAA,IAC3F;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,EAC3B;AACF;",
+  "sourcesContent": ["/**\n * Shared boilerplate for the hand-written report sub-routes (`sheet`, `close`,\n * `unlock`, `export`).\n *\n * Four routes needing the same six lines of auth, scope, id extraction and\n * granted-feature resolution is exactly the situation where one of them\n * eventually forgets the tenant filter. Resolving it in one place makes that\n * impossible rather than unlikely.\n */\n\nimport { RATES_FEATURE } from '../../../lib/time-tracking/moneyVisibility'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { reportSheetLabels } from '../../../lib/timesheets-reports/reportLabels'\n\nexport { reportSheetLabels }\n\n/**\n * Cap on the raw rows a sheet response carries. A report covering a quarter of a\n * ten-person team can run into the thousands, and the screen paginates anyway;\n * the response says when it truncated rather than quietly serving a short list.\n */\nexport const MAX_SHEET_ROWS = 500\n\nexport type Translate = (key: string, fallback: string) => string\n\nexport type ReportRequestContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  organizationScope: Awaited<ReturnType<typeof resolveOrganizationScopeForRequest>>\n  tenantId: string\n  organizationId: string\n  reportId: string\n  translate: Translate\n  /**\n   * The caller's grants, for the plumbing that takes a list: the approval\n   * policies, the interceptor context and the mutation-guard registry. Always an\n   * array, never `null` \u2014 a nullable grant list is what let \"RBAC could not\n   * answer\" read as \"no restriction\" on these routes.\n   *\n   * Empty means the same thing whether RBAC answered \"nothing\" or could not\n   * answer at all, and every consumer treats it the same fail-closed way: an\n   * approval policy that requires a feature refuses, a feature-gated interceptor\n   * does not run, and a feature-gated guard does not run. Authorization never\n   * rests on it \u2014 `canSeeMoney` and each route's own `resolveFeatureAccess` gate\n   * are the decisions, and both fail closed on their own. `resolveFeatureAccess`\n   * logs a grant list it could not read, so an outage is visible to operators\n   * without a flag here that no caller can act on.\n   */\n  grantedFeatures: string[]\n  /** Fail-closed `staff.timesheets.rates.view` decision \u2014 never re-derive it. */\n  canSeeMoney: boolean\n}\n\nexport function extractReportIdFromUrl(url: string | undefined, segment: string): string | null {\n  if (!url) return null\n  try {\n    const pathname = new URL(url).pathname\n    const match = pathname.match(new RegExp(`/reports/([^/]+)/${segment}`))\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function resolveReportRequestContext(\n  req: Request,\n  options: { segment: string },\n): Promise<ReportRequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const reportId = extractReportIdFromUrl(req.url, options.segment)\n  if (!reportId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.reports.errors.idRequired', 'Report id is required.'),\n    })\n  }\n\n  // One lookup, through the module's single RBAC authority, answering both\n  // questions the four routes ask: may this caller see money, and what is the\n  // grant list the plumbing wants. Decided here, once, so no route re-derives it\n  // and none can pick the other failure direction.\n  //\n  // `resolveFeatureAccess` fails closed on every path \u2014 an unresolvable service,\n  // a service that cannot answer, a call that throws \u2014 so an RBAC outage hides\n  // rates and costs instead of handing them to a plain report viewer.\n  const ratesAccess = await resolveFeatureAccess(container, auth.sub ?? null, [RATES_FEATURE], {\n    tenantId,\n    organizationId,\n  })\n\n  return {\n    container,\n    auth,\n    organizationScope,\n    tenantId,\n    organizationId,\n    reportId,\n    translate,\n    grantedFeatures: ratesAccess.grantedFeatures,\n    canSeeMoney: ratesAccess.allowed,\n  }\n}\n"],
+  "mappings": "AAUA,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAS3B,MAAM,iBAAiB;AAgCvB,SAAS,uBAAuB,KAAyB,SAAgC;AAC9F,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,UAAM,QAAQ,SAAS,MAAM,IAAI,OAAO,oBAAoB,OAAO,EAAE,CAAC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,4BACpB,KACA,SAC+B;AAC/B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AAEA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AACrF,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,uBAAuB,IAAI,KAAK,QAAQ,OAAO;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,iDAAiD,wBAAwB;AAAA,IAC5F,CAAC;AAAA,EACH;AAUA,QAAM,cAAc,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,aAAa,GAAG;AAAA,IAC3F;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,EAC3B;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/settings/reapply-rounding/route.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -47,7 +48,7 @@ async function POST(req) {
       });
     }
     const actorId = typeof auth.sub === "string" && auth.sub.trim().length > 0 ? auth.sub : "system";
-    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
     const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId });
     if (!access.allowed) {
       throw forbidden(translate("staff.errors.forbidden", "Forbidden"));

package/dist/modules/staff/api/timesheets/settings/reapply-rounding/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/settings/reapply-rounding/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/settings/reapply-rounding` \u2014 screen 16 note 3 (T7.3).\n *\n * The mockup draws retroactive rounding as a switch. It is implemented as an\n * **action**, because the two are not the same promise: a switch that rewrites\n * `rounded_minutes` across a tenant's history when the settings form is saved\n * changes invoiced amounts as a side effect of an unrelated save. This endpoint\n * makes it something a person does, once, on purpose, with a progress bar and a\n * final count.\n *\n * It enqueues; it does not do the work. Restating a tenant's entries is exactly the\n * long-running job the progress module exists for, so the response is a `202` with\n * a `progressJobId` that the top bar picks up on its own.\n *\n * Locked entries are never touched \u2014 the candidate query excludes them and the\n * command excludes them again, independently.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ProgressService } from '../../../../../progress/lib/progressService'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../guards'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n  STAFF_TIME_REAPPLY_ROUNDING_QUEUE,\n  countReapplyRoundingCandidates,\n  getStaffQueue,\n  type ReapplyRoundingScope,\n} from '../../../../lib/time-tracking/reapplyRounding'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings/reapply-rounding' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings\nconst RESOURCE_ID = 'time_tracking'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst responseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: z.string().uuid().nullable(),\n  /** Entries eligible for restatement \u2014 locked ones are not among them. */\n  candidateCount: z.number().int(),\n})\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n    if (!tenantId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const actorId = typeof auth.sub === 'string' && auth.sub.trim().length > 0 ? auth.sub : 'system'\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!access.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = access.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: {\n        container,\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n        tenantGlobal: true,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: RESOURCE_ID,\n        operation: 'update',\n        mutationPayload: { action: 'reapply-rounding' },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const scope: ReapplyRoundingScope = {\n      tenantId,\n      // `filterIds === null` means the caller may act across every organization of\n      // the tenant, which is what a tenant-global rule is about; anything narrower\n      // restates only what the caller can already see.\n      organizationIds: organizationScope?.filterIds ?? (organizationId ? [organizationId] : null),\n      userId: actorId,\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const candidateCount = await countReapplyRoundingCandidates(em.fork(), scope)\n    if (candidateCount === 0) {\n      // Nothing to restate: no job, no progress bar, no queue traffic. The caller\n      // gets an honest zero rather than a job that completes instantly.\n      await guardResult.runAfterSuccess()\n      return session.respond(200, responseSchema.parse({ ok: true, progressJobId: null, candidateCount: 0 }))\n    }\n\n    const progressService = container.resolve('progressService') as ProgressService\n    const progressJob = await progressService.createJob(\n      {\n        jobType: STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n        name: translate('staff.time_tracking.settings.retro.jobName', 'Reapply rounding to existing entries'),\n        description: translate(\n          'staff.time_tracking.settings.retro.jobDescription',\n          'Recomputing rounded time on existing entries. Locked entries are not changed.',\n        ),\n        totalCount: candidateCount,\n        cancellable: true,\n        meta: { source: 'staff.timesheets.settings.reapply-rounding' },\n      },\n      { tenantId, organizationId, userId: actorId },\n    )\n\n    const queue = getStaffQueue(STAFF_TIME_REAPPLY_ROUNDING_QUEUE)\n    await queue.enqueue({ progressJobId: progressJob.id, scope })\n\n    await guardResult.runAfterSuccess()\n\n    void emitStaffEvent('staff.timesheets.time_tracking.rounding_reapplied', {\n      tenantId,\n      organizationId,\n      progressJobId: progressJob.id,\n      candidateCount,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_tracking.rounding_reapplied failed', { err })\n    })\n\n    return session.respond(202, responseSchema.parse({ ok: true, progressJobId: progressJob.id, candidateCount }))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.settings.reapply-rounding failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reapply the rounding rule to existing entries',\n  methods: {\n    POST: {\n      summary: 'Queue a retroactive rounding job',\n      description:\n        'Enqueues a `ProgressJob` that recomputes `rounded_minutes` on existing time entries under the tenant\u2019s current rounding rule. Entries locked into a closed report are excluded \u2014 a billed amount is never restated. Returns `202` with `progressJobId`, or `200` with a null job id when there is nothing to restate.',\n      responses: [\n        { status: 200, description: 'Nothing to restate', schema: responseSchema },\n        { status: 202, description: 'Job queued', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n        { status: 500, description: 'Queueing failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAkBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAG/B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,2CAA2C,CAAC;AAEpG,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,mCAAmC;AACzD,MAAM,cAAc;AAEb,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,IAAI;AACjC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,UAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IAAI,KAAK,MAAM;AACxF,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AAKtE,UAAM,SAAS,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAC5G,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,OAAO;AAE/B,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,MAChD;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,QAA8B;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAIA,iBAAiB,mBAAmB,cAAc,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACtF,QAAQ;AAAA,IACV;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,MAAM,+BAA+B,GAAG,KAAK,GAAG,KAAK;AAC5E,QAAI,mBAAmB,GAAG;AAGxB,YAAM,YAAY,gBAAgB;AAClC,aAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,MAAM,gBAAgB,EAAE,CAAC,CAAC;AAAA,IACxG;AAEA,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC;AAAA,QACE,SAAS;AAAA,QACT,MAAM,UAAU,8CAA8C,sCAAsC;AAAA,QACpG,aAAa;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,MAAM,EAAE,QAAQ,6CAA6C;AAAA,MAC/D;AAAA,MACA,EAAE,UAAU,gBAAgB,QAAQ,QAAQ;AAAA,IAC9C;AAEA,UAAM,QAAQ,cAAc,iCAAiC;AAC7D,UAAM,MAAM,QAAQ,EAAE,eAAe,YAAY,IAAI,MAAM,CAAC;AAE5D,UAAM,YAAY,gBAAgB;AAElC,SAAK,eAAe,qDAAqD;AAAA,MACvE;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,iEAAiE,EAAE,IAAI,CAAC;AAAA,IACvF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,YAAY,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/G,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AACzE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,eAAe;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/settings/reapply-rounding` \u2014 screen 16 note 3 (T7.3).\n *\n * The mockup draws retroactive rounding as a switch. It is implemented as an\n * **action**, because the two are not the same promise: a switch that rewrites\n * `rounded_minutes` across a tenant's history when the settings form is saved\n * changes invoiced amounts as a side effect of an unrelated save. This endpoint\n * makes it something a person does, once, on purpose, with a progress bar and a\n * final count.\n *\n * It enqueues; it does not do the work. Restating a tenant's entries is exactly the\n * long-running job the progress module exists for, so the response is a `202` with\n * a `progressJobId` that the top bar picks up on its own.\n *\n * Locked entries are never touched \u2014 the candidate query excludes them and the\n * command excludes them again, independently.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ProgressService } from '../../../../../progress/lib/progressService'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../guards'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n  STAFF_TIME_REAPPLY_ROUNDING_QUEUE,\n  countReapplyRoundingCandidates,\n  getStaffQueue,\n  type ReapplyRoundingScope,\n} from '../../../../lib/time-tracking/reapplyRounding'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings/reapply-rounding' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings\nconst RESOURCE_ID = 'time_tracking'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst responseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: z.string().uuid().nullable(),\n  /** Entries eligible for restatement \u2014 locked ones are not among them. */\n  candidateCount: z.number().int(),\n})\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n    if (!tenantId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const actorId = typeof auth.sub === 'string' && auth.sub.trim().length > 0 ? auth.sub : 'system'\n    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!access.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = access.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: {\n        container,\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n        tenantGlobal: true,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: RESOURCE_ID,\n        operation: 'update',\n        mutationPayload: { action: 'reapply-rounding' },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const scope: ReapplyRoundingScope = {\n      tenantId,\n      // `filterIds === null` means the caller may act across every organization of\n      // the tenant, which is what a tenant-global rule is about; anything narrower\n      // restates only what the caller can already see.\n      organizationIds: organizationScope?.filterIds ?? (organizationId ? [organizationId] : null),\n      userId: actorId,\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const candidateCount = await countReapplyRoundingCandidates(em.fork(), scope)\n    if (candidateCount === 0) {\n      // Nothing to restate: no job, no progress bar, no queue traffic. The caller\n      // gets an honest zero rather than a job that completes instantly.\n      await guardResult.runAfterSuccess()\n      return session.respond(200, responseSchema.parse({ ok: true, progressJobId: null, candidateCount: 0 }))\n    }\n\n    const progressService = container.resolve('progressService') as ProgressService\n    const progressJob = await progressService.createJob(\n      {\n        jobType: STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n        name: translate('staff.time_tracking.settings.retro.jobName', 'Reapply rounding to existing entries'),\n        description: translate(\n          'staff.time_tracking.settings.retro.jobDescription',\n          'Recomputing rounded time on existing entries. Locked entries are not changed.',\n        ),\n        totalCount: candidateCount,\n        cancellable: true,\n        meta: { source: 'staff.timesheets.settings.reapply-rounding' },\n      },\n      { tenantId, organizationId, userId: actorId },\n    )\n\n    const queue = getStaffQueue(STAFF_TIME_REAPPLY_ROUNDING_QUEUE)\n    await queue.enqueue({ progressJobId: progressJob.id, scope })\n\n    await guardResult.runAfterSuccess()\n\n    void emitStaffEvent('staff.timesheets.time_tracking.rounding_reapplied', {\n      tenantId,\n      organizationId,\n      progressJobId: progressJob.id,\n      candidateCount,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_tracking.rounding_reapplied failed', { err })\n    })\n\n    return session.respond(202, responseSchema.parse({ ok: true, progressJobId: progressJob.id, candidateCount }))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.settings.reapply-rounding failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reapply the rounding rule to existing entries',\n  methods: {\n    POST: {\n      summary: 'Queue a retroactive rounding job',\n      description:\n        'Enqueues a `ProgressJob` that recomputes `rounded_minutes` on existing time entries under the tenant\u2019s current rounding rule. Entries locked into a closed report are excluded \u2014 a billed amount is never restated. Returns `202` with `progressJobId`, or `200` with a null job id when there is nothing to restate.',\n      responses: [\n        { status: 200, description: 'Nothing to restate', schema: responseSchema },\n        { status: 202, description: 'Job queued', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n        { status: 500, description: 'Queueing failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAkBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAG/B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,2CAA2C,CAAC;AAEpG,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,mCAAmC;AACzD,MAAM,cAAc;AAEb,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,IAAI;AACjC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,UAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IAAI,KAAK,MAAM;AACxF,UAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AAKrF,UAAM,SAAS,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAC5G,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,OAAO;AAE/B,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,MAChD;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,QAA8B;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAIA,iBAAiB,mBAAmB,cAAc,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACtF,QAAQ;AAAA,IACV;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,MAAM,+BAA+B,GAAG,KAAK,GAAG,KAAK;AAC5E,QAAI,mBAAmB,GAAG;AAGxB,YAAM,YAAY,gBAAgB;AAClC,aAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,MAAM,gBAAgB,EAAE,CAAC,CAAC;AAAA,IACxG;AAEA,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC;AAAA,QACE,SAAS;AAAA,QACT,MAAM,UAAU,8CAA8C,sCAAsC;AAAA,QACpG,aAAa;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,MAAM,EAAE,QAAQ,6CAA6C;AAAA,MAC/D;AAAA,MACA,EAAE,UAAU,gBAAgB,QAAQ,QAAQ;AAAA,IAC9C;AAEA,UAAM,QAAQ,cAAc,iCAAiC;AAC7D,UAAM,MAAM,QAAQ,EAAE,eAAe,YAAY,IAAI,MAAM,CAAC;AAE5D,UAAM,YAAY,gBAAgB;AAElC,SAAK,eAAe,qDAAqD;AAAA,MACvE;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,iEAAiE,EAAE,IAAI,CAAC;AAAA,IACvF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,YAAY,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/G,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AACzE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,eAAe;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tags/entry-assignments/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -50,7 +51,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };