npm - @open-mercato/core - Versions diffs - 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c - Mend

@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2353) hide show

package/dist/modules/staff/api/timesheets/tags/entry-assignments/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/tags/entry-assignments/route.ts"],
-  "sourcesContent": ["/**\n * Time entry tag assignment (T3.4) \u2014 the tag list of the entry form on screen 8\n * and the badges the entries list of screen 10 renders.\n *\n * Mirrors the task endpoint: `POST` adds, `DELETE` removes, both idempotent, and\n * both filter through `resolveProjectAccess` before the entry is even loaded. An\n * entry frozen in a closed report is refused by the command with `409`.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeEntryTagAssignmentSchema,\n  type StaffTimeEntryTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTimeEntry, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/entry-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.entryTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(req: Request, commandId: string, operation: 'create' | 'delete'): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeEntryTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTimeEntry(em, input.timeEntryId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeEntryTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the entry itself, so it travels as the entry's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_entry.updated', {\n    id: input.timeEntryId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          timeEntryId: input.timeEntryId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          timeEntryId: input.timeEntryId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.timeEntryId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignEntry, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignEntry, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a time entry',\n      description:\n        'Adds tags to a time entry. Idempotent \u2014 a tag the entry already carries comes back in alreadyAssignedTagIds. Refused with 404 when the entry is outside the caller\\'s project access, and with 409 when it is locked in a closed report.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a time entry',\n      description:\n        'Removes tags from a time entry. Idempotent \u2014 a tag the entry does not carry comes back in notAssignedTagIds.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAQA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,kCAA2D;AAE1F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OAAO,KAAc,WAAmB,WAAmD;AACxG,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,mCAAmC,QAAQ,MAAM,KAAK,SAAS;AAErG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,2BAA2B,IAAI,MAAM,aAAa,OAAO,QAAQ,SAAS;AAEhF,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,uCAAuC;AAAA,IACzD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,aAAa,QAAQ;AAAA,EACvE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,qDAAqD;AAAA,EACjF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,eAAe,QAAQ;AAAA,EACzE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,uDAAuD;AAAA,EACnF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Time entry tag assignment (T3.4) \u2014 the tag list of the entry form on screen 8\n * and the badges the entries list of screen 10 renders.\n *\n * Mirrors the task endpoint: `POST` adds, `DELETE` removes, both idempotent, and\n * both filter through `resolveProjectAccess` before the entry is even loaded. An\n * entry frozen in a closed report is refused by the command with `409`.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeEntryTagAssignmentSchema,\n  type StaffTimeEntryTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTimeEntry, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/entry-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.entryTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(req: Request, commandId: string, operation: 'create' | 'delete'): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeEntryTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTimeEntry(em, input.timeEntryId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeEntryTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the entry itself, so it travels as the entry's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_entry.updated', {\n    id: input.timeEntryId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          timeEntryId: input.timeEntryId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          timeEntryId: input.timeEntryId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.timeEntryId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignEntry, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignEntry, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a time entry',\n      description:\n        'Adds tags to a time entry. Idempotent \u2014 a tag the entry already carries comes back in alreadyAssignedTagIds. Refused with 404 when the entry is outside the caller\\'s project access, and with 409 when it is locked in a closed report.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a time entry',\n      description:\n        'Removes tags from a time entry. Idempotent \u2014 a tag the entry does not carry comes back in notAssignedTagIds.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,kCAA2D;AAE1F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OAAO,KAAc,WAAmB,WAAmD;AACxG,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,mCAAmC,QAAQ,MAAM,KAAK,SAAS;AAErG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,2BAA2B,IAAI,MAAM,aAAa,OAAO,QAAQ,SAAS;AAEhF,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,uCAAuC;AAAA,IACzD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,aAAa,QAAQ;AAAA,EACvE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,qDAAqD;AAAA,EACjF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,eAAe,QAAQ;AAAA,EACzE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,uDAAuD;AAAA,EACnF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tags/task-assignments/route.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -50,7 +51,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/timesheets/tags/task-assignments/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/tags/task-assignments/route.ts"],
-  "sourcesContent": ["/**\n * Task tag assignment (T3.4) \u2014 the \"Dodaj tag\" chip in the task drawer of screen\n * 7 and the badges on the board cards of screen 6.\n *\n * `POST` adds the tags, `DELETE` removes them; both are idempotent, so the drawer\n * can re-send its chip list without special-casing what was already there.\n *\n * Every call resolves the caller's project access before it touches the task \u2014\n * see `../access.ts` for why that lookup and the 404 are shaped the way they are.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskTagAssignmentSchema,\n  type StaffTimeTaskTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTask, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/task-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(\n  req: Request,\n  commandId: string,\n  operation: 'create' | 'delete',\n): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, input.taskId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeTaskTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the task itself, so it travels as the task's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_task.updated', {\n    id: input.taskId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_task.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          taskId: input.taskId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          taskId: input.taskId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.taskId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignTask, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignTask, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a task',\n      description:\n        'Adds tags to a task. Idempotent \u2014 a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller\\'s project access.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a task',\n      description:\n        'Removes tags from a task. Idempotent \u2014 a tag the task does not carry comes back in notAssignedTagIds instead of failing.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,6BAAsD;AAErF,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OACb,KACA,WACA,WACmB;AACnB,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,kCAAkC,QAAQ,MAAM,KAAK,SAAS;AAEpG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,sBAAsB,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS;AAEtE,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,sCAAsC;AAAA,IACxD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,EACxE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,YAAY,QAAQ;AAAA,EACtE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,oDAAoD;AAAA,EAChF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,cAAc,QAAQ;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,sDAAsD;AAAA,EAClF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Task tag assignment (T3.4) \u2014 the \"Dodaj tag\" chip in the task drawer of screen\n * 7 and the badges on the board cards of screen 6.\n *\n * `POST` adds the tags, `DELETE` removes them; both are idempotent, so the drawer\n * can re-send its chip list without special-casing what was already there.\n *\n * Every call resolves the caller's project access before it touches the task \u2014\n * see `../access.ts` for why that lookup and the 404 are shaped the way they are.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskTagAssignmentSchema,\n  type StaffTimeTaskTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTask, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/task-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(\n  req: Request,\n  commandId: string,\n  operation: 'create' | 'delete',\n): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, input.taskId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeTaskTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the task itself, so it travels as the task's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_task.updated', {\n    id: input.taskId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_task.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          taskId: input.taskId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          taskId: input.taskId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.taskId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignTask, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignTask, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a task',\n      description:\n        'Adds tags to a task. Idempotent \u2014 a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller\\'s project access.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a task',\n      description:\n        'Removes tags from a task. Idempotent \u2014 a tag the task does not carry comes back in notAssignedTagIds instead of failing.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,6BAAsD;AAErF,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OACb,KACA,WACA,WACmB;AACnB,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,kCAAkC,QAAQ,MAAM,KAAK,SAAS;AAEpG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,sBAAsB,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS;AAEtE,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,sCAAsC;AAAA,IACxD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,EACxE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,YAAY,QAAQ;AAAA,EACtE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,oDAAoD;AAAA,EAChF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,cAAc,QAAQ;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,sDAAsD;AAAA,EAClF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tasks/[id]/comments/route.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -82,7 +83,7 @@ async function buildRouteContext(req) {
     container,
     auth,
     organizationScope,
-    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
     organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/timesheets/tasks/[id]/comments/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/comments/route.ts"],
-  "sourcesContent": ["/**\n * Task comments (T3.4b) \u2014 the \"Komentarze (2)\" thread in the task drawer of\n * screen 7: avatar, author name, timestamp, body, and a composer that posts on\n * \u2318\u21B5.\n *\n * Hand-written rather than `makeCrudRoute`, for one reason that decides\n * everything else: **a caller who cannot see the task's project must not be able\n * to tell that the task exists.** A CRUD list would answer such a request with\n * an empty page \u2014 which is a different response from \"no such task\" and\n * therefore an existence oracle for every task id in the tenant. Here every\n * method funnels through the same `requireAccessibleTask` call before it touches\n * a comment, so \"not yours\" and \"does not exist\" produce one and the same 404\n * body, byte for byte.\n *\n * Because the route is hand-written it wires `runRouteMutationGuards` itself\n * (`packages/core/AGENTS.md` \u00A7 API Routes) \u2014 the same guard set every\n * `makeCrudRoute` write runs \u2014 and the writes go through the task-comment\n * commands so audit, undo, events and indexing stay consistent.\n *\n * Two more things the thread depends on:\n *\n *  - **Oldest first.** Screen 7 reads as a conversation, so the list sorts by\n *    `created_at ASC` with an id tiebreak, not the newest-first default a grid\n *    would want.\n *  - **The author's display name is resolved for rendering**, reusing the same\n *    `User` lookup `api/comments.ts` uses for the team-member timeline rather\n *    than inventing a cross-module join. A name that cannot be resolved degrades\n *    to `null` and the thread still renders \u2014 the comment is the record, the\n *    name is decoration.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { StaffTimeTaskComment } from '../../../../../data/entities'\nimport {\n  staffTimeTaskCommentCreateSchema,\n  staffTimeTaskCommentUpdateSchema,\n} from '../../../../../data/validators'\nimport { staffTimeTaskCommentCommandIds } from '../../../../../commands/timesheets-task-comments'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport {\n  loadTagProjectAccess as loadTaskProjectAccess,\n  requireAccessibleTask,\n  type TagAssignmentScope as TaskAccessScope,\n} from '../../../tags/access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/comments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTaskComment\n\nconst VIEW_FEATURE = 'staff.timesheets.tasks.view'\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n})\n\nconst commentItemSchema = z.object({\n  id: z.string().uuid(),\n  taskId: z.string().uuid(),\n  body: z.string(),\n  authorUserId: z.string().uuid().nullable(),\n  authorName: z.string().nullable(),\n  authorEmail: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(commentItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n  taskId: z.string().uuid(),\n  authorUserId: z.string().uuid().nullable(),\n})\n\nconst okResponseSchema = z.object({ ok: z.boolean() })\n\nconst createBodySchema = z.object({ body: z.string().trim().min(1).max(5000) })\nconst updateBodySchema = z.object({ id: z.string().uuid(), body: z.string().trim().min(1).max(5000) })\n\ntype RouteContext = {\n  ctx: CommandRuntimeContext\n  scope: TaskAccessScope\n  translate: (key: string, fallback?: string) => string\n  taskId: string\n}\n\n/**\n * The task id comes from the path segment. Read from the URL rather than the\n * handler's `params` argument so the route behaves identically under the app's\n * catch-all dispatcher and under a direct call in tests.\n */\nfunction extractTaskId(req: Request): string | null {\n  try {\n    const match = new URL(req.url).pathname.match(/\\/tasks\\/([^/]+)\\/comments/)\n    const id = match?.[1] ? decodeURIComponent(match[1]) : null\n    return id && id.length > 0 ? id : null\n  } catch {\n    return null\n  }\n}\n\nasync function buildRouteContext(req: Request): Promise<RouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const userId = auth.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const taskId = extractTaskId(req)\n  if (!taskId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.taskComments.errors.taskIdRequired', 'Task id is required.'),\n    })\n  }\n\n  return { ctx, scope: { tenantId, organizationId, userId }, translate, taskId }\n}\n\n/**\n * The single gate every method passes through. Resolving project access before\n * the task is loaded \u2014 and answering both misses with one body \u2014 is what keeps\n * the endpoint from confirming that a task the caller may not see exists.\n */\nasync function requireTaskAccess(route: RouteContext): Promise<void> {\n  const access = await loadTaskProjectAccess(route.ctx.container, route.scope)\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, route.taskId, route.scope, access, route.translate)\n}\n\nfunction commentNotFoundError(translate: (key: string, fallback?: string) => string): CrudHttpError {\n  return new CrudHttpError(404, {\n    error: translate('staff.time_tracking.taskComments.errors.notFound', 'Comment not found or not accessible.'),\n  })\n}\n\n/**\n * A comment addressed through another task's URL is refused exactly like a\n * comment that does not exist, so the path segment cannot be swapped to reach a\n * thread the caller has no route to.\n */\nasync function requireCommentOnTask(route: RouteContext, commentId: string): Promise<StaffTimeTaskComment> {\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  const comment = await em.findOne(StaffTimeTaskComment, {\n    id: commentId,\n    taskId: route.taskId,\n    tenantId: route.scope.tenantId,\n    organizationId: route.scope.organizationId,\n    deletedAt: null,\n  })\n  if (!comment) throw commentNotFoundError(route.translate)\n  return comment\n}\n\ntype AuthorMeta = { name: string | null; email: string | null }\n\nasync function resolveAuthorMeta(\n  route: RouteContext,\n  authorUserIds: string[],\n): Promise<Map<string, AuthorMeta>> {\n  const map = new Map<string, AuthorMeta>()\n  const unique = Array.from(new Set(authorUserIds))\n  if (unique.length === 0) return map\n  try {\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const users = await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } },\n      undefined,\n      { tenantId: route.scope.tenantId, organizationId: route.scope.organizationId },\n    )\n    for (const user of users) {\n      const name = typeof user.name === 'string' && user.name.trim().length > 0 ? user.name.trim() : null\n      map.set(user.id, { name, email: user.email ?? null })\n    }\n  } catch (err) {\n    // A thread that renders without display names is still a usable thread.\n    logger.warn('staff.timesheets.task comments failed to resolve author metadata', { err })\n  }\n  return map\n}\n\nfunction serializeComment(comment: StaffTimeTaskComment, authors: Map<string, AuthorMeta>) {\n  const authorUserId = comment.authorUserId ?? null\n  const meta = authorUserId ? authors.get(authorUserId) ?? null : null\n  return {\n    id: comment.id,\n    taskId: comment.taskId,\n    body: comment.body,\n    authorUserId,\n    authorName: meta?.name ?? null,\n    authorEmail: meta?.email ?? null,\n    createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,\n    updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null,\n  }\n}\n\nasync function runGuards(\n  route: RouteContext,\n  operation: 'create' | 'update' | 'delete',\n  resourceId: string | null,\n  mutationPayload: Record<string, unknown> | null,\n) {\n  return runRouteMutationGuards({\n    container: route.ctx.container,\n    req: route.ctx.request as Request,\n    auth: {\n      userId: route.scope.userId,\n      tenantId: route.scope.tenantId,\n      organizationId: route.scope.organizationId,\n    },\n    input: {\n      resourceKind: RESOURCE_KIND,\n      resourceId,\n      operation,\n      mutationPayload,\n    },\n  })\n}\n\nfunction withOperationHeader(\n  response: NextResponse,\n  logEntry: {\n    id?: string\n    undoToken?: string | null\n    commandId?: string\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceId: string,\n): NextResponse {\n  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id: logEntry.id,\n      undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId,\n      actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n      resourceId: logEntry.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const query = listQuerySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const [comments, total] = await em.findAndCount(\n      StaffTimeTaskComment,\n      {\n        taskId: route.taskId,\n        tenantId: route.scope.tenantId,\n        organizationId: route.scope.organizationId,\n        deletedAt: null,\n      },\n      {\n        // Oldest first \u2014 the drawer reads the thread top to bottom.\n        orderBy: { createdAt: 'asc', id: 'asc' },\n        limit: query.pageSize,\n        offset: (query.page - 1) * query.pageSize,\n      },\n    )\n\n    const authors = await resolveAuthorMeta(\n      route,\n      comments.map((comment) => comment.authorUserId).filter((id): id is string => typeof id === 'string'),\n    )\n\n    return NextResponse.json({\n      items: comments.map((comment) => serializeComment(comment, authors)),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: query.pageSize > 0 ? Math.ceil(total / query.pageSize) : 0,\n    })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.tasks.comments.GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = createBodySchema.parse(raw ?? {})\n    // `authorUserId` is never forwarded: whatever the client sent is dropped\n    // here and the command stamps the authenticated caller instead.\n    const input = parseScopedCommandInput(\n      staffTimeTaskCommentCreateSchema,\n      { taskId: route.taskId, body: parsedBody.body },\n      route.ctx,\n      route.translate,\n    )\n\n    const guardResult = await runGuards(route, 'create', route.taskId, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      typeof input,\n      { commentId: string; taskId: string; authorUserId: string | null }\n    >(staffTimeTaskCommentCommandIds.create, { input, ctx: route.ctx })\n\n    await guardResult.runAfterSuccess()\n\n    const response = NextResponse.json(\n      {\n        id: result?.commentId ?? null,\n        taskId: route.taskId,\n        authorUserId: result?.authorUserId ?? null,\n      },\n      { status: 201 },\n    )\n    return withOperationHeader(response, logEntry, result?.commentId ?? route.taskId)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.POST failed')\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = updateBodySchema.parse(raw ?? {})\n    await requireCommentOnTask(route, parsedBody.id)\n\n    const input = staffTimeTaskCommentUpdateSchema.parse({ id: parsedBody.id, body: parsedBody.body })\n\n    const guardResult = await runGuards(route, 'update', input.id, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<typeof input, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.update,\n      { input, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, input.id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.PUT failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const raw = await readJsonSafe(req, {})\n    const rawId = url.searchParams.get('id') ?? (raw as { id?: unknown } | null)?.id\n    const id = z.string().uuid().parse(typeof rawId === 'string' ? rawId : undefined)\n    await requireCommentOnTask(route, id)\n\n    const guardResult = await runGuards(route, 'delete', id, { id })\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<{ id: string }, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.delete,\n      { input: { id }, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task comments',\n  methods: {\n    GET: {\n      summary: 'List task comments',\n      description:\n        'Returns the task comment thread oldest-first, with the author display name resolved for rendering. Answers 404 \u2014 identical to a task that does not exist \u2014 when the task belongs to a project the caller cannot see.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Comment thread', schema: listResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.view' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    POST: {\n      summary: 'Post a task comment',\n      description:\n        'Adds a comment to the task. The author is stamped from the authenticated caller \u2014 an authorUserId supplied by the client is ignored.',\n      requestBody: { contentType: 'application/json', schema: createBodySchema },\n      responses: [{ status: 201, description: 'Comment created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    PUT: {\n      summary: 'Edit a task comment',\n      description:\n        'Updates a comment body. Only the comment author may edit, unless the caller holds staff.timesheets.manage_all. Honours the optimistic-lock header.',\n      requestBody: { contentType: 'application/json', schema: updateBodySchema },\n      responses: [{ status: 200, description: 'Comment updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a task comment',\n      description:\n        'Soft-deletes a comment so its audit trail survives. Only the comment author may delete, unless the caller holds staff.timesheets.manage_all.',\n      requestBody: { contentType: 'application/json', schema: z.object({ id: z.string().uuid() }) },\n      responses: [{ status: 200, description: 'Comment deleted', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing comment id, task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA8BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AACrB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,0CAA0C;AACnD;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,gBAAgB,mCAAmC;AAEzD,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM,EAAE,OAAO;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAErD,MAAM,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAcrG,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,4BAA4B;AAC1E,UAAM,KAAK,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACvD,WAAO,MAAM,GAAG,SAAS,IAAI,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,KAAqC;AACpE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,IACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,IAAI,0BAA0B,KAAK,SAAS;AACnE,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,0DAA0D,sBAAsB;AAAA,IACnG,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,KAAK,OAAO,EAAE,UAAU,gBAAgB,OAAO,GAAG,WAAW,OAAO;AAC/E;AAOA,eAAe,kBAAkB,OAAoC;AACnE,QAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,WAAW,MAAM,KAAK;AAC3E,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,sBAAsB,IAAI,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,SAAS;AACpF;AAEA,SAAS,qBAAqB,WAAsE;AAClG,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,UAAU,oDAAoD,sCAAsC;AAAA,EAC7G,CAAC;AACH;AAOA,eAAe,qBAAqB,OAAqB,WAAkD;AACzG,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,UAAU,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACrD,IAAI;AAAA,IACJ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,qBAAqB,MAAM,SAAS;AACxD,SAAO;AACT;AAIA,eAAe,kBACb,OACA,eACkC;AAClC,QAAM,MAAM,oBAAI,IAAwB;AACxC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC;AAChD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/E;AACA,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI;AAC/F,UAAI,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,IACtD;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO,KAAK,oEAAoE,EAAE,IAAI,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA+B,SAAkC;AACzF,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,OAAO,eAAe,QAAQ,IAAI,YAAY,KAAK,OAAO;AAChE,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY,MAAM,QAAQ;AAAA,IAC1B,aAAa,MAAM,SAAS;AAAA,IAC5B,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,IACjE,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,EACnE;AACF;AAEA,eAAe,UACb,OACA,WACA,YACA,iBACA;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,MAAM,IAAI;AAAA,IACrB,KAAK,MAAM,IAAI;AAAA,IACf,MAAM;AAAA,MACJ,QAAQ,MAAM,MAAM;AAAA,MACpB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,UASA,oBACc;AACd,MAAI,CAAC,UAAU,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,UAAW,QAAO;AACxE,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB,IAAI,SAAS;AAAA,MACb,WAAW,SAAS;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS,eAAe;AAAA,MACrC,cAAc,SAAS,gBAAgB;AAAA,MACvC,YAAY,SAAS,cAAc;AAAA,MACnC,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,gBAAgB,MAAM;AAAA,MAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,CAAC,UAAU,KAAK,IAAI,MAAM,GAAG;AAAA,MACjC;AAAA,MACA;AAAA,QACE,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM;AAAA,QAC5B,WAAW;AAAA,MACb;AAAA,MACA;AAAA;AAAA,QAEE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,SAAS,IAAI,CAAC,YAAY,QAAQ,YAAY,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,IACrG;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,OAAO,CAAC;AAAA,MACnE;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AAGnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,QAAQ,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MAC9C,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,QAAQ,KAA2C;AAC9G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,+BAA+B,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAElE,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,aAAa;AAAA,MAC5B;AAAA,QACE,IAAI,QAAQ,aAAa;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,oBAAoB,UAAU,UAAU,QAAQ,aAAa,MAAM,MAAM;AAAA,EAClF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,6CAA6C;AAAA,EACzE;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AACnD,UAAM,qBAAqB,OAAO,WAAW,EAAE;AAE/C,UAAM,QAAQ,iCAAiC,MAAM,EAAE,IAAI,WAAW,IAAI,MAAM,WAAW,KAAK,CAAC;AAEjG,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,IAAI,KAA2C;AAC1G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,MAAM,EAAE;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAM,KAAiC;AAC9E,UAAM,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAS;AAChF,UAAM,qBAAqB,OAAO,EAAE;AAEpC,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,IAAI,EAAE,GAAG,CAAC;AAC/D,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,IAAI;AAAA,IAClC;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,+CAA+C;AAAA,EAC3E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Task comments (T3.4b) \u2014 the \"Komentarze (2)\" thread in the task drawer of\n * screen 7: avatar, author name, timestamp, body, and a composer that posts on\n * \u2318\u21B5.\n *\n * Hand-written rather than `makeCrudRoute`, for one reason that decides\n * everything else: **a caller who cannot see the task's project must not be able\n * to tell that the task exists.** A CRUD list would answer such a request with\n * an empty page \u2014 which is a different response from \"no such task\" and\n * therefore an existence oracle for every task id in the tenant. Here every\n * method funnels through the same `requireAccessibleTask` call before it touches\n * a comment, so \"not yours\" and \"does not exist\" produce one and the same 404\n * body, byte for byte.\n *\n * Because the route is hand-written it wires `runRouteMutationGuards` itself\n * (`packages/core/AGENTS.md` \u00A7 API Routes) \u2014 the same guard set every\n * `makeCrudRoute` write runs \u2014 and the writes go through the task-comment\n * commands so audit, undo, events and indexing stay consistent.\n *\n * Two more things the thread depends on:\n *\n *  - **Oldest first.** Screen 7 reads as a conversation, so the list sorts by\n *    `created_at ASC` with an id tiebreak, not the newest-first default a grid\n *    would want.\n *  - **The author's display name is resolved for rendering**, reusing the same\n *    `User` lookup `api/comments.ts` uses for the team-member timeline rather\n *    than inventing a cross-module join. A name that cannot be resolved degrades\n *    to `null` and the thread still renders \u2014 the comment is the record, the\n *    name is decoration.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { StaffTimeTaskComment } from '../../../../../data/entities'\nimport {\n  staffTimeTaskCommentCreateSchema,\n  staffTimeTaskCommentUpdateSchema,\n} from '../../../../../data/validators'\nimport { staffTimeTaskCommentCommandIds } from '../../../../../commands/timesheets-task-comments'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport {\n  loadTagProjectAccess as loadTaskProjectAccess,\n  requireAccessibleTask,\n  type TagAssignmentScope as TaskAccessScope,\n} from '../../../tags/access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/comments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTaskComment\n\nconst VIEW_FEATURE = 'staff.timesheets.tasks.view'\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n})\n\nconst commentItemSchema = z.object({\n  id: z.string().uuid(),\n  taskId: z.string().uuid(),\n  body: z.string(),\n  authorUserId: z.string().uuid().nullable(),\n  authorName: z.string().nullable(),\n  authorEmail: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(commentItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n  taskId: z.string().uuid(),\n  authorUserId: z.string().uuid().nullable(),\n})\n\nconst okResponseSchema = z.object({ ok: z.boolean() })\n\nconst createBodySchema = z.object({ body: z.string().trim().min(1).max(5000) })\nconst updateBodySchema = z.object({ id: z.string().uuid(), body: z.string().trim().min(1).max(5000) })\n\ntype RouteContext = {\n  ctx: CommandRuntimeContext\n  scope: TaskAccessScope\n  translate: (key: string, fallback?: string) => string\n  taskId: string\n}\n\n/**\n * The task id comes from the path segment. Read from the URL rather than the\n * handler's `params` argument so the route behaves identically under the app's\n * catch-all dispatcher and under a direct call in tests.\n */\nfunction extractTaskId(req: Request): string | null {\n  try {\n    const match = new URL(req.url).pathname.match(/\\/tasks\\/([^/]+)\\/comments/)\n    const id = match?.[1] ? decodeURIComponent(match[1]) : null\n    return id && id.length > 0 ? id : null\n  } catch {\n    return null\n  }\n}\n\nasync function buildRouteContext(req: Request): Promise<RouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const userId = auth.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const taskId = extractTaskId(req)\n  if (!taskId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.taskComments.errors.taskIdRequired', 'Task id is required.'),\n    })\n  }\n\n  return { ctx, scope: { tenantId, organizationId, userId }, translate, taskId }\n}\n\n/**\n * The single gate every method passes through. Resolving project access before\n * the task is loaded \u2014 and answering both misses with one body \u2014 is what keeps\n * the endpoint from confirming that a task the caller may not see exists.\n */\nasync function requireTaskAccess(route: RouteContext): Promise<void> {\n  const access = await loadTaskProjectAccess(route.ctx.container, route.scope)\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, route.taskId, route.scope, access, route.translate)\n}\n\nfunction commentNotFoundError(translate: (key: string, fallback?: string) => string): CrudHttpError {\n  return new CrudHttpError(404, {\n    error: translate('staff.time_tracking.taskComments.errors.notFound', 'Comment not found or not accessible.'),\n  })\n}\n\n/**\n * A comment addressed through another task's URL is refused exactly like a\n * comment that does not exist, so the path segment cannot be swapped to reach a\n * thread the caller has no route to.\n */\nasync function requireCommentOnTask(route: RouteContext, commentId: string): Promise<StaffTimeTaskComment> {\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  const comment = await em.findOne(StaffTimeTaskComment, {\n    id: commentId,\n    taskId: route.taskId,\n    tenantId: route.scope.tenantId,\n    organizationId: route.scope.organizationId,\n    deletedAt: null,\n  })\n  if (!comment) throw commentNotFoundError(route.translate)\n  return comment\n}\n\ntype AuthorMeta = { name: string | null; email: string | null }\n\nasync function resolveAuthorMeta(\n  route: RouteContext,\n  authorUserIds: string[],\n): Promise<Map<string, AuthorMeta>> {\n  const map = new Map<string, AuthorMeta>()\n  const unique = Array.from(new Set(authorUserIds))\n  if (unique.length === 0) return map\n  try {\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const users = await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } },\n      undefined,\n      { tenantId: route.scope.tenantId, organizationId: route.scope.organizationId },\n    )\n    for (const user of users) {\n      const name = typeof user.name === 'string' && user.name.trim().length > 0 ? user.name.trim() : null\n      map.set(user.id, { name, email: user.email ?? null })\n    }\n  } catch (err) {\n    // A thread that renders without display names is still a usable thread.\n    logger.warn('staff.timesheets.task comments failed to resolve author metadata', { err })\n  }\n  return map\n}\n\nfunction serializeComment(comment: StaffTimeTaskComment, authors: Map<string, AuthorMeta>) {\n  const authorUserId = comment.authorUserId ?? null\n  const meta = authorUserId ? authors.get(authorUserId) ?? null : null\n  return {\n    id: comment.id,\n    taskId: comment.taskId,\n    body: comment.body,\n    authorUserId,\n    authorName: meta?.name ?? null,\n    authorEmail: meta?.email ?? null,\n    createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,\n    updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null,\n  }\n}\n\nasync function runGuards(\n  route: RouteContext,\n  operation: 'create' | 'update' | 'delete',\n  resourceId: string | null,\n  mutationPayload: Record<string, unknown> | null,\n) {\n  return runRouteMutationGuards({\n    container: route.ctx.container,\n    req: route.ctx.request as Request,\n    auth: {\n      userId: route.scope.userId,\n      tenantId: route.scope.tenantId,\n      organizationId: route.scope.organizationId,\n    },\n    input: {\n      resourceKind: RESOURCE_KIND,\n      resourceId,\n      operation,\n      mutationPayload,\n    },\n  })\n}\n\nfunction withOperationHeader(\n  response: NextResponse,\n  logEntry: {\n    id?: string\n    undoToken?: string | null\n    commandId?: string\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceId: string,\n): NextResponse {\n  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id: logEntry.id,\n      undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId,\n      actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n      resourceId: logEntry.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const query = listQuerySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const [comments, total] = await em.findAndCount(\n      StaffTimeTaskComment,\n      {\n        taskId: route.taskId,\n        tenantId: route.scope.tenantId,\n        organizationId: route.scope.organizationId,\n        deletedAt: null,\n      },\n      {\n        // Oldest first \u2014 the drawer reads the thread top to bottom.\n        orderBy: { createdAt: 'asc', id: 'asc' },\n        limit: query.pageSize,\n        offset: (query.page - 1) * query.pageSize,\n      },\n    )\n\n    const authors = await resolveAuthorMeta(\n      route,\n      comments.map((comment) => comment.authorUserId).filter((id): id is string => typeof id === 'string'),\n    )\n\n    return NextResponse.json({\n      items: comments.map((comment) => serializeComment(comment, authors)),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: query.pageSize > 0 ? Math.ceil(total / query.pageSize) : 0,\n    })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.tasks.comments.GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = createBodySchema.parse(raw ?? {})\n    // `authorUserId` is never forwarded: whatever the client sent is dropped\n    // here and the command stamps the authenticated caller instead.\n    const input = parseScopedCommandInput(\n      staffTimeTaskCommentCreateSchema,\n      { taskId: route.taskId, body: parsedBody.body },\n      route.ctx,\n      route.translate,\n    )\n\n    const guardResult = await runGuards(route, 'create', route.taskId, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      typeof input,\n      { commentId: string; taskId: string; authorUserId: string | null }\n    >(staffTimeTaskCommentCommandIds.create, { input, ctx: route.ctx })\n\n    await guardResult.runAfterSuccess()\n\n    const response = NextResponse.json(\n      {\n        id: result?.commentId ?? null,\n        taskId: route.taskId,\n        authorUserId: result?.authorUserId ?? null,\n      },\n      { status: 201 },\n    )\n    return withOperationHeader(response, logEntry, result?.commentId ?? route.taskId)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.POST failed')\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = updateBodySchema.parse(raw ?? {})\n    await requireCommentOnTask(route, parsedBody.id)\n\n    const input = staffTimeTaskCommentUpdateSchema.parse({ id: parsedBody.id, body: parsedBody.body })\n\n    const guardResult = await runGuards(route, 'update', input.id, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<typeof input, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.update,\n      { input, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, input.id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.PUT failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const raw = await readJsonSafe(req, {})\n    const rawId = url.searchParams.get('id') ?? (raw as { id?: unknown } | null)?.id\n    const id = z.string().uuid().parse(typeof rawId === 'string' ? rawId : undefined)\n    await requireCommentOnTask(route, id)\n\n    const guardResult = await runGuards(route, 'delete', id, { id })\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<{ id: string }, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.delete,\n      { input: { id }, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task comments',\n  methods: {\n    GET: {\n      summary: 'List task comments',\n      description:\n        'Returns the task comment thread oldest-first, with the author display name resolved for rendering. Answers 404 \u2014 identical to a task that does not exist \u2014 when the task belongs to a project the caller cannot see.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Comment thread', schema: listResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.view' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    POST: {\n      summary: 'Post a task comment',\n      description:\n        'Adds a comment to the task. The author is stamped from the authenticated caller \u2014 an authorUserId supplied by the client is ignored.',\n      requestBody: { contentType: 'application/json', schema: createBodySchema },\n      responses: [{ status: 201, description: 'Comment created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    PUT: {\n      summary: 'Edit a task comment',\n      description:\n        'Updates a comment body. Only the comment author may edit, unless the caller holds staff.timesheets.manage_all. Honours the optimistic-lock header.',\n      requestBody: { contentType: 'application/json', schema: updateBodySchema },\n      responses: [{ status: 200, description: 'Comment updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a task comment',\n      description:\n        'Soft-deletes a comment so its audit trail survives. Only the comment author may delete, unless the caller holds staff.timesheets.manage_all.',\n      requestBody: { contentType: 'application/json', schema: z.object({ id: z.string().uuid() }) },\n      responses: [{ status: 200, description: 'Comment deleted', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing comment id, task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA8BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AACrB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,0CAA0C;AACnD;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,gBAAgB,mCAAmC;AAEzD,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM,EAAE,OAAO;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAErD,MAAM,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAcrG,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,4BAA4B;AAC1E,UAAM,KAAK,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACvD,WAAO,MAAM,GAAG,SAAS,IAAI,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,KAAqC;AACpE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,IACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,IAAI,0BAA0B,KAAK,SAAS;AACnE,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,0DAA0D,sBAAsB;AAAA,IACnG,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,KAAK,OAAO,EAAE,UAAU,gBAAgB,OAAO,GAAG,WAAW,OAAO;AAC/E;AAOA,eAAe,kBAAkB,OAAoC;AACnE,QAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,WAAW,MAAM,KAAK;AAC3E,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,sBAAsB,IAAI,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,SAAS;AACpF;AAEA,SAAS,qBAAqB,WAAsE;AAClG,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,UAAU,oDAAoD,sCAAsC;AAAA,EAC7G,CAAC;AACH;AAOA,eAAe,qBAAqB,OAAqB,WAAkD;AACzG,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,UAAU,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACrD,IAAI;AAAA,IACJ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,qBAAqB,MAAM,SAAS;AACxD,SAAO;AACT;AAIA,eAAe,kBACb,OACA,eACkC;AAClC,QAAM,MAAM,oBAAI,IAAwB;AACxC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC;AAChD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/E;AACA,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI;AAC/F,UAAI,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,IACtD;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO,KAAK,oEAAoE,EAAE,IAAI,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA+B,SAAkC;AACzF,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,OAAO,eAAe,QAAQ,IAAI,YAAY,KAAK,OAAO;AAChE,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY,MAAM,QAAQ;AAAA,IAC1B,aAAa,MAAM,SAAS;AAAA,IAC5B,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,IACjE,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,EACnE;AACF;AAEA,eAAe,UACb,OACA,WACA,YACA,iBACA;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,MAAM,IAAI;AAAA,IACrB,KAAK,MAAM,IAAI;AAAA,IACf,MAAM;AAAA,MACJ,QAAQ,MAAM,MAAM;AAAA,MACpB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,UASA,oBACc;AACd,MAAI,CAAC,UAAU,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,UAAW,QAAO;AACxE,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB,IAAI,SAAS;AAAA,MACb,WAAW,SAAS;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS,eAAe;AAAA,MACrC,cAAc,SAAS,gBAAgB;AAAA,MACvC,YAAY,SAAS,cAAc;AAAA,MACnC,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,gBAAgB,MAAM;AAAA,MAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,CAAC,UAAU,KAAK,IAAI,MAAM,GAAG;AAAA,MACjC;AAAA,MACA;AAAA,QACE,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM;AAAA,QAC5B,WAAW;AAAA,MACb;AAAA,MACA;AAAA;AAAA,QAEE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,SAAS,IAAI,CAAC,YAAY,QAAQ,YAAY,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,IACrG;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,OAAO,CAAC;AAAA,MACnE;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AAGnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,QAAQ,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MAC9C,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,QAAQ,KAA2C;AAC9G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,+BAA+B,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAElE,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,aAAa;AAAA,MAC5B;AAAA,QACE,IAAI,QAAQ,aAAa;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,oBAAoB,UAAU,UAAU,QAAQ,aAAa,MAAM,MAAM;AAAA,EAClF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,6CAA6C;AAAA,EACzE;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AACnD,UAAM,qBAAqB,OAAO,WAAW,EAAE;AAE/C,UAAM,QAAQ,iCAAiC,MAAM,EAAE,IAAI,WAAW,IAAI,MAAM,WAAW,KAAK,CAAC;AAEjG,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,IAAI,KAA2C;AAC1G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,MAAM,EAAE;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAM,KAAiC;AAC9E,UAAM,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAS;AAChF,UAAM,qBAAqB,OAAO,EAAE;AAEpC,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,IAAI,EAAE,GAAG,CAAC;AAC/D,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,IAAI;AAAA,IAClC;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,+CAA+C;AAAA,EAC3E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tasks/[id]/status/route.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -51,7 +52,7 @@ async function PATCH(req, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/tasks/[id]/status/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/status/route.ts"],
-  "sourcesContent": ["/**\n * The Kanban drag of screen 6 (US-C2), and the drawer's subtask tick, which is the\n * same move without a meaningful position.\n *\n * The board writes optimistically \u2014 the card lands in the new column before the\n * request completes \u2014 so this endpoint's contract is what makes the rollback in the\n * mockup's note 2 correct:\n *\n *  1. **The `updated_at` version travels with the drag.** Two people moving the same\n *     card is the one genuinely likely conflict on this board, so a stale\n *     `x-om-ext-optimistic-lock-expected-updated-at` answers 409 and the client puts\n *     the card back where it came from instead of overwriting the other move.\n *  2. **Project access is intersected before anything else is revealed.** The access\n *     decision reuses the tasks list route's memoised resolver, and a caller who is\n *     not a member gets the same 404 a missing task gets \u2014 the body never confirms\n *     the task exists.\n *  3. **The target column must belong to the task's own project.** A foreign column\n *     is refused by the command (422) rather than quietly accepted, because a task\n *     lives in exactly one project (\u00A72) and its board is that project's.\n *\n * The write itself is the `staff.timesheets.tasks.status_change` command, which owns\n * the `closed_at` stamping and emits `staff.timesheets.time_task.status_changed`.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeTask } from '../../../../../data/entities'\nimport { staffTimeTaskStatusChangeSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskCommandIds,\n  type StaffTimeTaskStatusChangeCommandInput,\n  type StaffTimeTaskStatusChangeResult,\n} from '../../../../../commands/timesheets-tasks'\nimport { assertProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { resolveListProjectAccess } from '../../route'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/status' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\ntype RouteContext = {\n  params?: Promise<Record<string, string | string[]>> | Record<string, string | string[]>\n}\n\nfunction extractTaskIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/tasks\\/([^/]+)\\/status/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveTaskId(req: Request, context?: RouteContext): Promise<string | null> {\n  const params = context?.params ? await context.params : null\n  const fromParams = params?.id\n  if (typeof fromParams === 'string' && fromParams.length > 0) return fromParams\n  return extractTaskIdFromUrl(req)\n}\n\nexport async function PATCH(req: Request, context?: RouteContext): Promise<Response> {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const taskId = await resolveTaskId(req, context)\n    if (!taskId || !z.string().uuid().safeParse(taskId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.time_tracking.tasks.errors.idRequired', 'Task id is required.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority, answering both\n    // questions this route asks: may the caller manage tasks, and what grant list\n    // do the interceptors and the mutation-guard registry gate on. The decision is\n    // checked unconditionally and fails closed; the list is plumbing and is empty \u2014\n    // never absent \u2014 when RBAC could not produce it.\n    const manageTasks = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!manageTasks.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageTasks.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeTaskStatusChangeSchema.parse(session.body)\n\n    const routeCtx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    // Membership is resolved against the task's project, so the lookup has to happen\n    // here. Both \"no such task\" and \"not your project\" answer with the same body.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const task = await em.findOne(StaffTimeTask, { id: taskId, tenantId, organizationId, deletedAt: null })\n    const access = task ? await resolveListProjectAccess(routeCtx) : null\n    if (!task || !access || !assertProjectAccess(access, task.timeProjectId)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.tasks.errors.notFound', 'Task not found or not accessible.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n        resourceId: taskId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? staffTimeTaskStatusChangeSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      StaffTimeTaskStatusChangeCommandInput,\n      StaffTimeTaskStatusChangeResult\n    >(staffTimeTaskCommandIds.statusChange, {\n      input: { ...effective, id: taskId },\n      ctx: routeCtx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.taskId ?? taskId,\n      timeProjectId: result?.timeProjectId ?? task.timeProjectId,\n      previousTaskStatusId: result?.previousTaskStatusId ?? null,\n      taskStatusId: result?.taskStatusId ?? effective.taskStatusId,\n      position: result?.position ?? null,\n      closedAt: result?.closedAt ?? null,\n      updatedAt: result?.updatedAt ?? null,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n          resourceId: logEntry.resourceId ?? taskId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.tasks.status PATCH failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst statusChangeResponseSchema = z.object({\n  id: z.string().uuid(),\n  timeProjectId: z.string().uuid(),\n  previousTaskStatusId: z.string().uuid().nullable(),\n  taskStatusId: z.string().uuid(),\n  position: z.number().int().nullable(),\n  closedAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst conflictSchema = z.object({\n  code: z.literal('optimistic_lock_conflict'),\n  error: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Move a task to another board column',\n  methods: {\n    PATCH: {\n      summary: 'Move a task to another board column',\n      description:\n        'Moves a task to the requested status column and slot. `position` is optional \u2014 omitting it appends the task to the end of the target column, which is what the drawer subtask tick does. The target status must belong to the task project (422 otherwise). Landing on a done column stamps `closedAt`, leaving one clears it. Send the record version in `x-om-ext-optimistic-lock-expected-updated-at`: a stale version answers 409 so an optimistic board can roll the card back to its origin column. Emits `staff.timesheets.time_task.status_changed`, which is bridged to connected boards.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeTaskStatusChangeSchema,\n      },\n      responses: [{ status: 200, description: 'Task moved', schema: statusChangeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid task id or body' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found, or not on a project the caller can see' },\n        { status: 409, description: 'The task changed since the version the caller sent', schema: conflictSchema },\n        { status: 422, description: 'The target column does not belong to this project' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,qBAAqB;AAC9B,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,8BAA8B,CAAC;AAEvF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAChE;AAMA,SAAS,qBAAqB,SAAkC;AAC9D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,0BAA0B;AAC3D,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,KAAc,SAAgD;AACzF,QAAM,SAAS,SAAS,SAAS,MAAM,QAAQ,SAAS;AACxD,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,QAAO;AACpE,SAAO,qBAAqB,GAAG;AACjC;AAEA,eAAsB,MAAM,KAAc,SAA2C;AACnF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,cAAc,KAAK,OAAO;AAC/C,QAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,EAAE,SAAS;AAC3D,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,sBAAsB;AAAA,MACxF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAM5B,UAAM,cAAc,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AACjH,QAAI,CAAC,YAAY,SAAS;AACxB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,YAAY;AAEpC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,gCAAgC,MAAM,QAAQ,IAAI;AAEjE,UAAM,WAAkC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAIA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,OAAO,MAAM,GAAG,QAAQ,eAAe,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AACtG,UAAM,SAAS,OAAO,MAAM,yBAAyB,QAAQ,IAAI;AACjE,QAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,QAAQ,KAAK,aAAa,GAAG;AACxE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6CAA6C,mCAAmC;AAAA,MACnG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,gCAAgC,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IACnF;AAEJ,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,wBAAwB,cAAc;AAAA,MACtC,OAAO,EAAE,GAAG,WAAW,IAAI,OAAO;AAAA,MAClC,KAAK;AAAA,IACP,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,UAAU;AAAA,MACtB,eAAe,QAAQ,iBAAiB,KAAK;AAAA,MAC7C,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,cAAc,QAAQ,gBAAgB,UAAU;AAAA,MAChD,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,2BAA2B,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sDAAsD,QAAQ,eAAe;AAAA,QACzG,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * The Kanban drag of screen 6 (US-C2), and the drawer's subtask tick, which is the\n * same move without a meaningful position.\n *\n * The board writes optimistically \u2014 the card lands in the new column before the\n * request completes \u2014 so this endpoint's contract is what makes the rollback in the\n * mockup's note 2 correct:\n *\n *  1. **The `updated_at` version travels with the drag.** Two people moving the same\n *     card is the one genuinely likely conflict on this board, so a stale\n *     `x-om-ext-optimistic-lock-expected-updated-at` answers 409 and the client puts\n *     the card back where it came from instead of overwriting the other move.\n *  2. **Project access is intersected before anything else is revealed.** The access\n *     decision reuses the tasks list route's memoised resolver, and a caller who is\n *     not a member gets the same 404 a missing task gets \u2014 the body never confirms\n *     the task exists.\n *  3. **The target column must belong to the task's own project.** A foreign column\n *     is refused by the command (422) rather than quietly accepted, because a task\n *     lives in exactly one project (\u00A72) and its board is that project's.\n *\n * The write itself is the `staff.timesheets.tasks.status_change` command, which owns\n * the `closed_at` stamping and emits `staff.timesheets.time_task.status_changed`.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeTask } from '../../../../../data/entities'\nimport { staffTimeTaskStatusChangeSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskCommandIds,\n  type StaffTimeTaskStatusChangeCommandInput,\n  type StaffTimeTaskStatusChangeResult,\n} from '../../../../../commands/timesheets-tasks'\nimport { assertProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { resolveListProjectAccess } from '../../route'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/status' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\ntype RouteContext = {\n  params?: Promise<Record<string, string | string[]>> | Record<string, string | string[]>\n}\n\nfunction extractTaskIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/tasks\\/([^/]+)\\/status/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveTaskId(req: Request, context?: RouteContext): Promise<string | null> {\n  const params = context?.params ? await context.params : null\n  const fromParams = params?.id\n  if (typeof fromParams === 'string' && fromParams.length > 0) return fromParams\n  return extractTaskIdFromUrl(req)\n}\n\nexport async function PATCH(req: Request, context?: RouteContext): Promise<Response> {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const taskId = await resolveTaskId(req, context)\n    if (!taskId || !z.string().uuid().safeParse(taskId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.time_tracking.tasks.errors.idRequired', 'Task id is required.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority, answering both\n    // questions this route asks: may the caller manage tasks, and what grant list\n    // do the interceptors and the mutation-guard registry gate on. The decision is\n    // checked unconditionally and fails closed; the list is plumbing and is empty \u2014\n    // never absent \u2014 when RBAC could not produce it.\n    const manageTasks = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!manageTasks.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageTasks.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeTaskStatusChangeSchema.parse(session.body)\n\n    const routeCtx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    // Membership is resolved against the task's project, so the lookup has to happen\n    // here. Both \"no such task\" and \"not your project\" answer with the same body.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const task = await em.findOne(StaffTimeTask, { id: taskId, tenantId, organizationId, deletedAt: null })\n    const access = task ? await resolveListProjectAccess(routeCtx) : null\n    if (!task || !access || !assertProjectAccess(access, task.timeProjectId)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.tasks.errors.notFound', 'Task not found or not accessible.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n        resourceId: taskId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? staffTimeTaskStatusChangeSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      StaffTimeTaskStatusChangeCommandInput,\n      StaffTimeTaskStatusChangeResult\n    >(staffTimeTaskCommandIds.statusChange, {\n      input: { ...effective, id: taskId },\n      ctx: routeCtx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.taskId ?? taskId,\n      timeProjectId: result?.timeProjectId ?? task.timeProjectId,\n      previousTaskStatusId: result?.previousTaskStatusId ?? null,\n      taskStatusId: result?.taskStatusId ?? effective.taskStatusId,\n      position: result?.position ?? null,\n      closedAt: result?.closedAt ?? null,\n      updatedAt: result?.updatedAt ?? null,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n          resourceId: logEntry.resourceId ?? taskId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.tasks.status PATCH failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst statusChangeResponseSchema = z.object({\n  id: z.string().uuid(),\n  timeProjectId: z.string().uuid(),\n  previousTaskStatusId: z.string().uuid().nullable(),\n  taskStatusId: z.string().uuid(),\n  position: z.number().int().nullable(),\n  closedAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst conflictSchema = z.object({\n  code: z.literal('optimistic_lock_conflict'),\n  error: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Move a task to another board column',\n  methods: {\n    PATCH: {\n      summary: 'Move a task to another board column',\n      description:\n        'Moves a task to the requested status column and slot. `position` is optional \u2014 omitting it appends the task to the end of the target column, which is what the drawer subtask tick does. The target status must belong to the task project (422 otherwise). Landing on a done column stamps `closedAt`, leaving one clears it. Send the record version in `x-om-ext-optimistic-lock-expected-updated-at`: a stale version answers 409 so an optimistic board can roll the card back to its origin column. Emits `staff.timesheets.time_task.status_changed`, which is bridged to connected boards.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeTaskStatusChangeSchema,\n      },\n      responses: [{ status: 200, description: 'Task moved', schema: statusChangeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid task id or body' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found, or not on a project the caller can see' },\n        { status: 409, description: 'The task changed since the version the caller sent', schema: conflictSchema },\n        { status: 422, description: 'The target column does not belong to this project' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,qBAAqB;AAC9B,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,8BAA8B,CAAC;AAEvF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAChE;AAMA,SAAS,qBAAqB,SAAkC;AAC9D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,0BAA0B;AAC3D,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,KAAc,SAAgD;AACzF,QAAM,SAAS,SAAS,SAAS,MAAM,QAAQ,SAAS;AACxD,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,QAAO;AACpE,SAAO,qBAAqB,GAAG;AACjC;AAEA,eAAsB,MAAM,KAAc,SAA2C;AACnF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,cAAc,KAAK,OAAO;AAC/C,QAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,EAAE,SAAS;AAC3D,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,sBAAsB;AAAA,MACxF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAM5B,UAAM,cAAc,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AACjH,QAAI,CAAC,YAAY,SAAS;AACxB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,YAAY;AAEpC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,gCAAgC,MAAM,QAAQ,IAAI;AAEjE,UAAM,WAAkC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAIA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,OAAO,MAAM,GAAG,QAAQ,eAAe,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AACtG,UAAM,SAAS,OAAO,MAAM,yBAAyB,QAAQ,IAAI;AACjE,QAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,QAAQ,KAAK,aAAa,GAAG;AACxE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6CAA6C,mCAAmC;AAAA,MACnG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,gCAAgC,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IACnF;AAEJ,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,wBAAwB,cAAc;AAAA,MACtC,OAAO,EAAE,GAAG,WAAW,IAAI,OAAO;AAAA,MAClC,KAAK;AAAA,IACP,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,UAAU;AAAA,MACtB,eAAe,QAAQ,iBAAiB,KAAK;AAAA,MAC7C,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,cAAc,QAAQ,gBAAgB,UAAU;AAAA,MAChD,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,2BAA2B,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sDAAsD,QAAQ,eAAe;AAAA,QACzG,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/duplicate/route.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -86,7 +87,7 @@ async function POST(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
@@ -149,7 +150,7 @@ async function POST(req) {
       container,
       auth,
       organizationScope: scope,
-      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
       organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req
     };