@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/staff/api/team-members/tags/assign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/team-members/tags/assign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  staffTeamMemberTagAssignmentSchema,\n  type StaffTeamMemberTagAssignmentInput,\n} from '../../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.manage_team'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffTeamMemberTagAssignmentSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: input.memberId,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffTeamMemberTagAssignmentInput, { memberId: string }>(\n      'staff.team-members.tags.assign',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: result?.memberId ?? input.memberId,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.memberId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.teamMemberTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.memberId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.teamMembers.tags.assign failed', { err })\n    return NextResponse.json({ error: translate('staff.teamMembers.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Assign team member tag',\n  methods: {\n    POST: {\n      summary: 'Assign team member tag',\n      description: 'Assigns a tag to a staff team member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTeamMemberTagAssignmentSchema,\n      },\n      responses: [\n        { status: 201, description: 'Tag assignment created', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,oCAAoC,MAAM,KAAK,SAAS;AAE9F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,YAAY,MAAM;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,YAAY,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,YAAY;AAAA,UACvD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  staffTeamMemberTagAssignmentSchema,\n  type StaffTeamMemberTagAssignmentInput,\n} from '../../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.manage_team'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffTeamMemberTagAssignmentSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: input.memberId,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffTeamMemberTagAssignmentInput, { memberId: string }>(\n      'staff.team-members.tags.assign',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: result?.memberId ?? input.memberId,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.memberId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.teamMemberTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.memberId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.teamMembers.tags.assign failed', { err })\n    return NextResponse.json({ error: translate('staff.teamMembers.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Assign team member tag',\n  methods: {\n    POST: {\n      summary: 'Assign team member tag',\n      description: 'Assigns a tag to a staff team member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTeamMemberTagAssignmentSchema,\n      },\n      responses: [\n        { status: 201, description: 'Tag assignment created', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,oCAAoC,MAAM,KAAK,SAAS;AAE9F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,YAAY,MAAM;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,YAAY,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,YAAY;AAAA,UACvD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/team-members/tags/unassign/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -30,7 +31,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/team-members/tags/unassign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/team-members/tags/unassign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  staffTeamMemberTagAssignmentSchema,\n  type StaffTeamMemberTagAssignmentInput,\n} from '../../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.manage_team'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffTeamMemberTagAssignmentSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: input.memberId,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffTeamMemberTagAssignmentInput, { memberId: string }>(\n      'staff.team-members.tags.unassign',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: result?.memberId ?? input.memberId,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.memberId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.teamMemberTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.memberId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.teamMembers.tags.unassign failed', { err })\n    return NextResponse.json({ error: translate('staff.teamMembers.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Unassign team member tag',\n  methods: {\n    POST: {\n      summary: 'Unassign team member tag',\n      description: 'Removes a tag from a staff team member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTeamMemberTagAssignmentSchema,\n      },\n      responses: [\n        { status: 200, description: 'Tag assignment removed', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,oCAAoC,MAAM,KAAK,SAAS;AAE9F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,YAAY,MAAM;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,YAAY,KAAK,CAAC;AACnE,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,YAAY;AAAA,UACvD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  staffTeamMemberTagAssignmentSchema,\n  type StaffTeamMemberTagAssignmentInput,\n} from '../../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.manage_team'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffTeamMemberTagAssignmentSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: input.memberId,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffTeamMemberTagAssignmentInput, { memberId: string }>(\n      'staff.team-members.tags.unassign',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.team_member',\n        resourceId: result?.memberId ?? input.memberId,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.memberId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.teamMemberTagAssignment',\n          resourceId: logEntry.resourceId ?? result?.memberId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.teamMembers.tags.unassign failed', { err })\n    return NextResponse.json({ error: translate('staff.teamMembers.tags.updateError', 'Failed to update tags.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Unassign team member tag',\n  methods: {\n    POST: {\n      summary: 'Unassign team member tag',\n      description: 'Removes a tag from a staff team member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTeamMemberTagAssignmentSchema,\n      },\n      responses: [\n        { status: 200, description: 'Tag assignment removed', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,oCAAoC,MAAM,KAAK,SAAS;AAE9F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,YAAY,MAAM;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,YAAY,KAAK,CAAC;AACnE,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,YAAY;AAAA,UACvD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC7G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/_shared/withTimesheetInterceptors.js

@@ -4,6 +4,7 @@ import { runApiInterceptorsBefore } from "@open-mercato/shared/lib/crud/intercep
 import { runCustomRouteAfterInterceptors } from "@open-mercato/shared/lib/crud/custom-route-interceptor";
 import { parseExtensionHeaders } from "@open-mercato/shared/lib/umes/extension-headers";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveApiInterceptorRoutePath } from "@open-mercato/shared/lib/modules/api-route-identity";
 function readSearchParamsRecord(url) {
   const record = {};
   let params;
@@ -41,16 +42,6 @@ function toSearchParams(query) {
   }
   return params;
 }
-function normalizeRoutePath(url) {
-  try {
-    const pathname = new URL(url).pathname;
-    if (pathname.startsWith("/api/")) return pathname.slice(5);
-    if (pathname === "/api") return "";
-    return pathname.replace(/^\/+/, "");
-  } catch {
-    return "";
-  }
-}
 function toHeaderRecord(headers) {
   const output = {};
   headers.forEach((value, key) => {
@@ -87,7 +78,17 @@ async function runTimesheetInterceptors(args) {
       )
     };
   }
-  const routePath = normalizeRoutePath(request.url);
+  const routePath = resolveApiInterceptorRoutePath(request);
+  if (routePath === null) {
+    const { translate } = await resolveTranslations();
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: translate("api.errors.badRequest", "Bad request") },
+        { status: 400 }
+      )
+    };
+  }
   const headers = toHeaderRecord(request.headers);
   const requestPayload = {
     method,

package/dist/modules/staff/api/timesheets/_shared/withTimesheetInterceptors.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/_shared/withTimesheetInterceptors.ts"],
-  "sourcesContent": ["/**\n * API interceptors for the hand-rolled `/api/staff/timesheets/*` routes.\n *\n * The eight `makeCrudRoute` time-tracking resources run `runApiInterceptorsBefore`\n * and `runApiInterceptorsAfter` through the CRUD factory. The ~23 routes written by\n * hand beside them ran neither, so a third party could rewrite the body of a create\n * on `/time-entries` but not on `/time-entries/bulk`, and could not shape the\n * response of a single aggregate. This wraps the two shared runners in the one shape\n * those routes need: one call before the work, one call around the response.\n *\n * `routePath` is derived from the request URL exactly as the factory derives it\n * (`normalizeInterceptorRoutePath`) \u2014 the pathname with the leading `/api/` removed,\n * so an interceptor targets `staff/timesheets/time-entries/bulk`. A route with a\n * dynamic segment carries the CONCRETE id in that path\n * (`staff/timesheets/time-entries/<uuid>/duplicate`), so an interceptor for one of\n * those must use the registry's prefix wildcard \u2014 `staff/timesheets/time-entries/*`\n * \u2014 rather than a literal with a placeholder in it.\n *\n * Scope: the interceptor context carries `tenantId` and `organizationId` and this\n * helper fails closed with a 400 when either is missing, so no interceptor ever runs\n * \u2014 and no route body is ever handed to one \u2014 outside a resolved tenant scope.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type {\n  ApiInterceptorMethod,\n  InterceptorRequest,\n} from '@open-mercato/shared/lib/crud/api-interceptor'\nimport { getApiInterceptorsForRoute } from '@open-mercato/shared/lib/crud/interceptor-registry'\nimport { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { parseExtensionHeaders } from '@open-mercato/shared/lib/umes/extension-headers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\nexport type TimesheetInterceptorScope = {\n  container: AwilixContainer\n  userId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n  /**\n   * The caller's granted features, when the route already resolved them \u2014 through\n   * `resolveFeatureAccess`, which always yields an array. Deliberately not\n   * nullable: a grant list that can be `null` cannot say whether an empty answer\n   * means \"no grants\" or \"could not ask\", and passing that ambiguity on is what\n   * this helper's own fallback exists to avoid.\n   *\n   * Omitted, the helper asks `rbacService.getGrantedFeatures` once \u2014 the same\n   * source the CRUD factory uses \u2014 so a feature-gated interceptor is evaluated\n   * against a real grant set rather than an empty one, and an unreadable set gates\n   * every feature-scoped interceptor off.\n   */\n  userFeatures?: readonly string[]\n  /**\n   * Opt-in for the tenant-global routes (`/settings`, `/settings/reapply-rounding`),\n   * whose records have no organization at all. Without it a request that resolved no\n   * organization is refused rather than interceptor-scoped to an empty organization \u2014\n   * the same fail-closed default every org-scoped route here keeps. With it, the\n   * context carries the empty organization id the CRUD factory also passes for a\n   * tenant-global caller.\n   */\n  tenantGlobal?: boolean\n}\n\nexport type TimesheetInterceptorSession = {\n  /** The request body after the before-pass, or `{}` for a route that sends none. */\n  body: Record<string, unknown>\n  /** The query after the before-pass. */\n  query: Record<string, unknown>\n  /** `query` as `URLSearchParams`, for routes that read their input that way. */\n  searchParams: URLSearchParams\n  /**\n   * Runs the after-pass over a successful JSON response and returns it. An\n   * interceptor that fails or times out replaces the response with its own error.\n   */\n  respond(statusCode: number, body: Record<string, unknown>): Promise<NextResponse>\n  /**\n   * Runs the after-pass over a descriptor for a non-JSON response (a file export).\n   * The interceptors cannot rewrite the bytes, so the descriptor is what they shape;\n   * the caller applies whatever came back. A failed interceptor yields a JSON error\n   * response instead of the file.\n   */\n  respondWithDescriptor(\n    descriptor: Record<string, unknown>,\n  ): Promise<{ ok: true; descriptor: Record<string, unknown> } | { ok: false; response: NextResponse }>\n}\n\nexport type TimesheetInterceptorRun =\n  | { ok: true; session: TimesheetInterceptorSession }\n  | { ok: false; response: NextResponse }\n\n/**\n * Duplicates and repeated keys collapse to arrays so a rewritten query round-trips\n * `?tagIds=a&tagIds=b` unchanged.\n */\nexport function readSearchParamsRecord(url: string): Record<string, unknown> {\n  const record: Record<string, unknown> = {}\n  let params: URLSearchParams\n  try {\n    params = new URL(url).searchParams\n  } catch {\n    return record\n  }\n  params.forEach((value, key) => {\n    const existing = record[key]\n    if (existing === undefined) {\n      record[key] = value\n      return\n    }\n    if (Array.isArray(existing)) {\n      existing.push(value)\n      return\n    }\n    record[key] = [existing, value]\n  })\n  return record\n}\n\nfunction toSearchParams(query: Record<string, unknown>): URLSearchParams {\n  const params = new URLSearchParams()\n  for (const [key, value] of Object.entries(query)) {\n    if (value === null || value === undefined) continue\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        if (item === null || item === undefined) continue\n        params.append(key, String(item))\n      }\n      continue\n    }\n    params.append(key, String(value))\n  }\n  return params\n}\n\nfunction normalizeRoutePath(url: string): string {\n  try {\n    const pathname = new URL(url).pathname\n    if (pathname.startsWith('/api/')) return pathname.slice(5)\n    if (pathname === '/api') return ''\n    return pathname.replace(/^\\/+/, '')\n  } catch {\n    return ''\n  }\n}\n\nfunction toHeaderRecord(headers: Headers): Record<string, string> {\n  const output: Record<string, string> = {}\n  headers.forEach((value, key) => {\n    output[key] = value\n  })\n  return output\n}\n\nasync function resolveUserFeatures(scope: TimesheetInterceptorScope): Promise<string[]> {\n  if (scope.userFeatures) return [...scope.userFeatures]\n  if (!scope.userId) return []\n  try {\n    const rbac = scope.container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return []\n    return await rbac.getGrantedFeatures(scope.userId, {\n      tenantId: scope.tenantId ?? null,\n      organizationId: scope.organizationId ?? null,\n    })\n  } catch {\n    // An unreadable grant set gates every feature-scoped interceptor off rather\n    // than running it unauthorized.\n    return []\n  }\n}\n\nexport async function runTimesheetInterceptors(args: {\n  request: Request\n  method: ApiInterceptorMethod\n  scope: TimesheetInterceptorScope\n  /** `readJsonSafe` returns `null` for an unparseable body; that reaches here as `{}`. */\n  body?: Record<string, unknown> | null\n  query?: Record<string, unknown>\n}): Promise<TimesheetInterceptorRun> {\n  const { request, method, scope } = args\n  const tenantId = scope.tenantId || null\n  const resolvedOrganizationId = scope.organizationId || null\n  const organizationId = resolvedOrganizationId ?? (scope.tenantGlobal ? '' : null)\n  if (!tenantId || organizationId === null) {\n    const { translate } = await resolveTranslations()\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const routePath = normalizeRoutePath(request.url)\n  const headers = toHeaderRecord(request.headers)\n  const requestPayload: InterceptorRequest = {\n    method,\n    url: request.url,\n    body: args.body ?? {},\n    query: args.query ?? {},\n    headers,\n  }\n\n  // No interceptor targets this route and method, so neither pass can observe or\n  // change anything. Skipping here keeps the request off the RBAC grant read and the\n  // `em` resolve that assembling an interceptor context would otherwise cost on every\n  // call to every one of these routes.\n  if (getApiInterceptorsForRoute(routePath, method).length === 0) {\n    const query = requestPayload.query ?? {}\n    return {\n      ok: true,\n      session: {\n        body: requestPayload.body ?? {},\n        query,\n        searchParams: toSearchParams(query),\n        async respond(statusCode, body) {\n          return NextResponse.json(body, { status: statusCode })\n        },\n        async respondWithDescriptor(descriptor) {\n          return { ok: true, descriptor }\n        },\n      },\n    }\n  }\n\n  const context = {\n    userId: scope.userId ?? '',\n    organizationId,\n    tenantId,\n    em: scope.container.resolve('em') as EntityManager,\n    container: scope.container,\n    userFeatures: await resolveUserFeatures(scope),\n    extensionHeaders: parseExtensionHeaders(headers),\n  }\n\n  const before = await runApiInterceptorsBefore({\n    routePath,\n    method,\n    request: requestPayload,\n    context,\n  })\n  if (!before.ok) {\n    return { ok: false, response: NextResponse.json(before.body, { status: before.statusCode }) }\n  }\n\n  const interceptedRequest = before.request\n  const query = interceptedRequest.query ?? {}\n\n  const runAfter = async (body: Record<string, unknown>, statusCode: number) =>\n    runCustomRouteAfterInterceptors({\n      routePath,\n      method,\n      request: interceptedRequest,\n      response: { statusCode, body, headers: {} },\n      context,\n      metadataByInterceptor: before.metadataByInterceptor,\n    })\n\n  return {\n    ok: true,\n    session: {\n      body: interceptedRequest.body ?? {},\n      query,\n      searchParams: toSearchParams(query),\n      async respond(statusCode, body) {\n        const after = await runAfter(body, statusCode)\n        return NextResponse.json(after.body, {\n          status: after.statusCode,\n          ...(Object.keys(after.headers).length ? { headers: after.headers } : {}),\n        })\n      },\n      async respondWithDescriptor(descriptor) {\n        const after = await runAfter(descriptor, 200)\n        if (!after.ok) {\n          return {\n            ok: false,\n            response: NextResponse.json(after.body, { status: after.statusCode }),\n          }\n        }\n        return { ok: true, descriptor: after.body }\n      },\n    },\n  }\n}\n"],
-  "mappings": "AAuBA,SAAS,oBAAoB;AAO7B,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;AACzC,SAAS,uCAAuC;AAChD,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAqE7B,SAAS,uBAAuB,KAAsC;AAC3E,QAAM,SAAkC,CAAC;AACzC,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,CAAC,OAAO,QAAQ;AAC7B,UAAM,WAAW,OAAO,GAAG;AAC3B,QAAI,aAAa,QAAW;AAC1B,aAAO,GAAG,IAAI;AACd;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,eAAS,KAAK,KAAK;AACnB;AAAA,IACF;AACA,WAAO,GAAG,IAAI,CAAC,UAAU,KAAK;AAAA,EAChC,CAAC;AACD,SAAO;AACT;AAEA,SAAS,eAAe,OAAiD;AACvE,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,iBAAW,QAAQ,OAAO;AACxB,YAAI,SAAS,QAAQ,SAAS,OAAW;AACzC,eAAO,OAAO,KAAK,OAAO,IAAI,CAAC;AAAA,MACjC;AACA;AAAA,IACF;AACA,WAAO,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,QAAI,SAAS,WAAW,OAAO,EAAG,QAAO,SAAS,MAAM,CAAC;AACzD,QAAI,aAAa,OAAQ,QAAO;AAChC,WAAO,SAAS,QAAQ,QAAQ,EAAE;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,SAA0C;AAChE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,oBAAoB,OAAqD;AACtF,MAAI,MAAM,aAAc,QAAO,CAAC,GAAG,MAAM,YAAY;AACrD,MAAI,CAAC,MAAM,OAAQ,QAAO,CAAC;AAC3B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,QAAQ,aAAa;AAClD,QAAI,CAAC,MAAM,mBAAoB,QAAO,CAAC;AACvC,WAAO,MAAM,KAAK,mBAAmB,MAAM,QAAQ;AAAA,MACjD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,yBAAyB,MAOV;AACnC,QAAM,EAAE,SAAS,QAAQ,MAAM,IAAI;AACnC,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,yBAAyB,MAAM,kBAAkB;AACvD,QAAM,iBAAiB,2BAA2B,MAAM,eAAe,KAAK;AAC5E,MAAI,CAAC,YAAY,mBAAmB,MAAM;AACxC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE;AAAA,QACzF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,mBAAmB,QAAQ,GAAG;AAChD,QAAM,UAAU,eAAe,QAAQ,OAAO;AAC9C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB;AAAA,EACF;AAMA,MAAI,2BAA2B,WAAW,MAAM,EAAE,WAAW,GAAG;AAC9D,UAAMA,SAAQ,eAAe,SAAS,CAAC;AACvC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM,eAAe,QAAQ,CAAC;AAAA,QAC9B,OAAAA;AAAA,QACA,cAAc,eAAeA,MAAK;AAAA,QAClC,MAAM,QAAQ,YAAY,MAAM;AAC9B,iBAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,WAAW,CAAC;AAAA,QACvD;AAAA,QACA,MAAM,sBAAsB,YAAY;AACtC,iBAAO,EAAE,IAAI,MAAM,WAAW;AAAA,QAChC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,QAAQ,MAAM,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA,IAAI,MAAM,UAAU,QAAQ,IAAI;AAAA,IAChC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM,oBAAoB,KAAK;AAAA,IAC7C,kBAAkB,sBAAsB,OAAO;AAAA,EACjD;AAEA,QAAM,SAAS,MAAM,yBAAyB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,WAAW,CAAC,EAAE;AAAA,EAC9F;AAEA,QAAM,qBAAqB,OAAO;AAClC,QAAM,QAAQ,mBAAmB,SAAS,CAAC;AAE3C,QAAM,WAAW,OAAO,MAA+B,eACrD,gCAAgC;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU,EAAE,YAAY,MAAM,SAAS,CAAC,EAAE;AAAA,IAC1C;AAAA,IACA,uBAAuB,OAAO;AAAA,EAChC,CAAC;AAEH,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,MACP,MAAM,mBAAmB,QAAQ,CAAC;AAAA,MAClC;AAAA,MACA,cAAc,eAAe,KAAK;AAAA,MAClC,MAAM,QAAQ,YAAY,MAAM;AAC9B,cAAM,QAAQ,MAAM,SAAS,MAAM,UAAU;AAC7C,eAAO,aAAa,KAAK,MAAM,MAAM;AAAA,UACnC,QAAQ,MAAM;AAAA,UACd,GAAI,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,QACxE,CAAC;AAAA,MACH;AAAA,MACA,MAAM,sBAAsB,YAAY;AACtC,cAAM,QAAQ,MAAM,SAAS,YAAY,GAAG;AAC5C,YAAI,CAAC,MAAM,IAAI;AACb,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,UAAU,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,WAAW,CAAC;AAAA,UACtE;AAAA,QACF;AACA,eAAO,EAAE,IAAI,MAAM,YAAY,MAAM,KAAK;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * API interceptors for the hand-rolled `/api/staff/timesheets/*` routes.\n *\n * The eight `makeCrudRoute` time-tracking resources run `runApiInterceptorsBefore`\n * and `runApiInterceptorsAfter` through the CRUD factory. The ~23 routes written by\n * hand beside them ran neither, so a third party could rewrite the body of a create\n * on `/time-entries` but not on `/time-entries/bulk`, and could not shape the\n * response of a single aggregate. This wraps the two shared runners in the one shape\n * those routes need: one call before the work, one call around the response.\n *\n * `routePath` comes from the dispatcher-bound matched-route identity, exactly as it\n * does for factory routes. Static segments therefore use their manifest spelling even\n * when the request used a mixed-case or percent-encoded alias. A route with a dynamic\n * segment carries the CONCRETE id in that path\n * (`staff/timesheets/time-entries/<uuid>/duplicate`), so an interceptor for one of\n * those must use the registry's prefix wildcard \u2014 `staff/timesheets/time-entries/*`\n * \u2014 rather than a literal with a placeholder in it.\n *\n * Scope: the interceptor context carries `tenantId` and `organizationId` and this\n * helper fails closed with a 400 when either is missing, so no interceptor ever runs\n * \u2014 and no route body is ever handed to one \u2014 outside a resolved tenant scope.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type {\n  ApiInterceptorMethod,\n  InterceptorRequest,\n} from '@open-mercato/shared/lib/crud/api-interceptor'\nimport { getApiInterceptorsForRoute } from '@open-mercato/shared/lib/crud/interceptor-registry'\nimport { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { parseExtensionHeaders } from '@open-mercato/shared/lib/umes/extension-headers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveApiInterceptorRoutePath } from '@open-mercato/shared/lib/modules/api-route-identity'\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\nexport type TimesheetInterceptorScope = {\n  container: AwilixContainer\n  userId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n  /**\n   * The caller's granted features, when the route already resolved them \u2014 through\n   * `resolveFeatureAccess`, which always yields an array. Deliberately not\n   * nullable: a grant list that can be `null` cannot say whether an empty answer\n   * means \"no grants\" or \"could not ask\", and passing that ambiguity on is what\n   * this helper's own fallback exists to avoid.\n   *\n   * Omitted, the helper asks `rbacService.getGrantedFeatures` once \u2014 the same\n   * source the CRUD factory uses \u2014 so a feature-gated interceptor is evaluated\n   * against a real grant set rather than an empty one, and an unreadable set gates\n   * every feature-scoped interceptor off.\n   */\n  userFeatures?: readonly string[]\n  /**\n   * Opt-in for the tenant-global routes (`/settings`, `/settings/reapply-rounding`),\n   * whose records have no organization at all. Without it a request that resolved no\n   * organization is refused rather than interceptor-scoped to an empty organization \u2014\n   * the same fail-closed default every org-scoped route here keeps. With it, the\n   * context carries the empty organization id the CRUD factory also passes for a\n   * tenant-global caller.\n   */\n  tenantGlobal?: boolean\n}\n\nexport type TimesheetInterceptorSession = {\n  /** The request body after the before-pass, or `{}` for a route that sends none. */\n  body: Record<string, unknown>\n  /** The query after the before-pass. */\n  query: Record<string, unknown>\n  /** `query` as `URLSearchParams`, for routes that read their input that way. */\n  searchParams: URLSearchParams\n  /**\n   * Runs the after-pass over a successful JSON response and returns it. An\n   * interceptor that fails or times out replaces the response with its own error.\n   */\n  respond(statusCode: number, body: Record<string, unknown>): Promise<NextResponse>\n  /**\n   * Runs the after-pass over a descriptor for a non-JSON response (a file export).\n   * The interceptors cannot rewrite the bytes, so the descriptor is what they shape;\n   * the caller applies whatever came back. A failed interceptor yields a JSON error\n   * response instead of the file.\n   */\n  respondWithDescriptor(\n    descriptor: Record<string, unknown>,\n  ): Promise<{ ok: true; descriptor: Record<string, unknown> } | { ok: false; response: NextResponse }>\n}\n\nexport type TimesheetInterceptorRun =\n  | { ok: true; session: TimesheetInterceptorSession }\n  | { ok: false; response: NextResponse }\n\n/**\n * Duplicates and repeated keys collapse to arrays so a rewritten query round-trips\n * `?tagIds=a&tagIds=b` unchanged.\n */\nexport function readSearchParamsRecord(url: string): Record<string, unknown> {\n  const record: Record<string, unknown> = {}\n  let params: URLSearchParams\n  try {\n    params = new URL(url).searchParams\n  } catch {\n    return record\n  }\n  params.forEach((value, key) => {\n    const existing = record[key]\n    if (existing === undefined) {\n      record[key] = value\n      return\n    }\n    if (Array.isArray(existing)) {\n      existing.push(value)\n      return\n    }\n    record[key] = [existing, value]\n  })\n  return record\n}\n\nfunction toSearchParams(query: Record<string, unknown>): URLSearchParams {\n  const params = new URLSearchParams()\n  for (const [key, value] of Object.entries(query)) {\n    if (value === null || value === undefined) continue\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        if (item === null || item === undefined) continue\n        params.append(key, String(item))\n      }\n      continue\n    }\n    params.append(key, String(value))\n  }\n  return params\n}\n\nfunction toHeaderRecord(headers: Headers): Record<string, string> {\n  const output: Record<string, string> = {}\n  headers.forEach((value, key) => {\n    output[key] = value\n  })\n  return output\n}\n\nasync function resolveUserFeatures(scope: TimesheetInterceptorScope): Promise<string[]> {\n  if (scope.userFeatures) return [...scope.userFeatures]\n  if (!scope.userId) return []\n  try {\n    const rbac = scope.container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return []\n    return await rbac.getGrantedFeatures(scope.userId, {\n      tenantId: scope.tenantId ?? null,\n      organizationId: scope.organizationId ?? null,\n    })\n  } catch {\n    // An unreadable grant set gates every feature-scoped interceptor off rather\n    // than running it unauthorized.\n    return []\n  }\n}\n\nexport async function runTimesheetInterceptors(args: {\n  request: Request\n  method: ApiInterceptorMethod\n  scope: TimesheetInterceptorScope\n  /** `readJsonSafe` returns `null` for an unparseable body; that reaches here as `{}`. */\n  body?: Record<string, unknown> | null\n  query?: Record<string, unknown>\n}): Promise<TimesheetInterceptorRun> {\n  const { request, method, scope } = args\n  const tenantId = scope.tenantId || null\n  const resolvedOrganizationId = scope.organizationId || null\n  const organizationId = resolvedOrganizationId ?? (scope.tenantGlobal ? '' : null)\n  if (!tenantId || organizationId === null) {\n    const { translate } = await resolveTranslations()\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const routePath = resolveApiInterceptorRoutePath(request)\n  if (routePath === null) {\n    const { translate } = await resolveTranslations()\n    return {\n      ok: false,\n      response: NextResponse.json(\n        { error: translate('api.errors.badRequest', 'Bad request') },\n        { status: 400 },\n      ),\n    }\n  }\n  const headers = toHeaderRecord(request.headers)\n  const requestPayload: InterceptorRequest = {\n    method,\n    url: request.url,\n    body: args.body ?? {},\n    query: args.query ?? {},\n    headers,\n  }\n\n  // No interceptor targets this route and method, so neither pass can observe or\n  // change anything. Skipping here keeps the request off the RBAC grant read and the\n  // `em` resolve that assembling an interceptor context would otherwise cost on every\n  // call to every one of these routes.\n  if (getApiInterceptorsForRoute(routePath, method).length === 0) {\n    const query = requestPayload.query ?? {}\n    return {\n      ok: true,\n      session: {\n        body: requestPayload.body ?? {},\n        query,\n        searchParams: toSearchParams(query),\n        async respond(statusCode, body) {\n          return NextResponse.json(body, { status: statusCode })\n        },\n        async respondWithDescriptor(descriptor) {\n          return { ok: true, descriptor }\n        },\n      },\n    }\n  }\n\n  const context = {\n    userId: scope.userId ?? '',\n    organizationId,\n    tenantId,\n    em: scope.container.resolve('em') as EntityManager,\n    container: scope.container,\n    userFeatures: await resolveUserFeatures(scope),\n    extensionHeaders: parseExtensionHeaders(headers),\n  }\n\n  const before = await runApiInterceptorsBefore({\n    routePath,\n    method,\n    request: requestPayload,\n    context,\n  })\n  if (!before.ok) {\n    return { ok: false, response: NextResponse.json(before.body, { status: before.statusCode }) }\n  }\n\n  const interceptedRequest = before.request\n  const query = interceptedRequest.query ?? {}\n\n  const runAfter = async (body: Record<string, unknown>, statusCode: number) =>\n    runCustomRouteAfterInterceptors({\n      routePath,\n      method,\n      request: interceptedRequest,\n      response: { statusCode, body, headers: {} },\n      context,\n      metadataByInterceptor: before.metadataByInterceptor,\n    })\n\n  return {\n    ok: true,\n    session: {\n      body: interceptedRequest.body ?? {},\n      query,\n      searchParams: toSearchParams(query),\n      async respond(statusCode, body) {\n        const after = await runAfter(body, statusCode)\n        return NextResponse.json(after.body, {\n          status: after.statusCode,\n          ...(Object.keys(after.headers).length ? { headers: after.headers } : {}),\n        })\n      },\n      async respondWithDescriptor(descriptor) {\n        const after = await runAfter(descriptor, 200)\n        if (!after.ok) {\n          return {\n            ok: false,\n            response: NextResponse.json(after.body, { status: after.statusCode }),\n          }\n        }\n        return { ok: true, descriptor: after.body }\n      },\n    },\n  }\n}\n"],
+  "mappings": "AAuBA,SAAS,oBAAoB;AAO7B,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;AACzC,SAAS,uCAAuC;AAChD,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,sCAAsC;AAqExC,SAAS,uBAAuB,KAAsC;AAC3E,QAAM,SAAkC,CAAC;AACzC,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,CAAC,OAAO,QAAQ;AAC7B,UAAM,WAAW,OAAO,GAAG;AAC3B,QAAI,aAAa,QAAW;AAC1B,aAAO,GAAG,IAAI;AACd;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,eAAS,KAAK,KAAK;AACnB;AAAA,IACF;AACA,WAAO,GAAG,IAAI,CAAC,UAAU,KAAK;AAAA,EAChC,CAAC;AACD,SAAO;AACT;AAEA,SAAS,eAAe,OAAiD;AACvE,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,iBAAW,QAAQ,OAAO;AACxB,YAAI,SAAS,QAAQ,SAAS,OAAW;AACzC,eAAO,OAAO,KAAK,OAAO,IAAI,CAAC;AAAA,MACjC;AACA;AAAA,IACF;AACA,WAAO,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,SAA0C;AAChE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,oBAAoB,OAAqD;AACtF,MAAI,MAAM,aAAc,QAAO,CAAC,GAAG,MAAM,YAAY;AACrD,MAAI,CAAC,MAAM,OAAQ,QAAO,CAAC;AAC3B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,QAAQ,aAAa;AAClD,QAAI,CAAC,MAAM,mBAAoB,QAAO,CAAC;AACvC,WAAO,MAAM,KAAK,mBAAmB,MAAM,QAAQ;AAAA,MACjD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,yBAAyB,MAOV;AACnC,QAAM,EAAE,SAAS,QAAQ,MAAM,IAAI;AACnC,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,yBAAyB,MAAM,kBAAkB;AACvD,QAAM,iBAAiB,2BAA2B,MAAM,eAAe,KAAK;AAC5E,MAAI,CAAC,YAAY,mBAAmB,MAAM;AACxC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE;AAAA,QACzF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,+BAA+B,OAAO;AACxD,MAAI,cAAc,MAAM;AACtB,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,UAAU,yBAAyB,aAAa,EAAE;AAAA,QAC3D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,eAAe,QAAQ,OAAO;AAC9C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB,OAAO,KAAK,SAAS,CAAC;AAAA,IACtB;AAAA,EACF;AAMA,MAAI,2BAA2B,WAAW,MAAM,EAAE,WAAW,GAAG;AAC9D,UAAMA,SAAQ,eAAe,SAAS,CAAC;AACvC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM,eAAe,QAAQ,CAAC;AAAA,QAC9B,OAAAA;AAAA,QACA,cAAc,eAAeA,MAAK;AAAA,QAClC,MAAM,QAAQ,YAAY,MAAM;AAC9B,iBAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,WAAW,CAAC;AAAA,QACvD;AAAA,QACA,MAAM,sBAAsB,YAAY;AACtC,iBAAO,EAAE,IAAI,MAAM,WAAW;AAAA,QAChC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,QAAQ,MAAM,UAAU;AAAA,IACxB;AAAA,IACA;AAAA,IACA,IAAI,MAAM,UAAU,QAAQ,IAAI;AAAA,IAChC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM,oBAAoB,KAAK;AAAA,IAC7C,kBAAkB,sBAAsB,OAAO;AAAA,EACjD;AAEA,QAAM,SAAS,MAAM,yBAAyB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,WAAW,CAAC,EAAE;AAAA,EAC9F;AAEA,QAAM,qBAAqB,OAAO;AAClC,QAAM,QAAQ,mBAAmB,SAAS,CAAC;AAE3C,QAAM,WAAW,OAAO,MAA+B,eACrD,gCAAgC;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,UAAU,EAAE,YAAY,MAAM,SAAS,CAAC,EAAE;AAAA,IAC1C;AAAA,IACA,uBAAuB,OAAO;AAAA,EAChC,CAAC;AAEH,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,MACP,MAAM,mBAAmB,QAAQ,CAAC;AAAA,MAClC;AAAA,MACA,cAAc,eAAe,KAAK;AAAA,MAClC,MAAM,QAAQ,YAAY,MAAM;AAC9B,cAAM,QAAQ,MAAM,SAAS,MAAM,UAAU;AAC7C,eAAO,aAAa,KAAK,MAAM,MAAM;AAAA,UACnC,QAAQ,MAAM;AAAA,UACd,GAAI,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,QACxE,CAAC;AAAA,MACH;AAAA,MACA,MAAM,sBAAsB,YAAY;AACtC,cAAM,QAAQ,MAAM,SAAS,YAAY,GAAG;AAC5C,YAAI,CAAC,MAAM,IAAI;AACb,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,UAAU,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,WAAW,CAAC;AAAA,UACtE;AAAA,QACF;AACA,eAAO,EAAE,IAAI,MAAM,YAAY,MAAM,KAAK;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["query"]
 }

package/dist/modules/staff/api/timesheets/my-projects/[projectId]/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -45,7 +46,7 @@ async function PATCH(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/my-projects/[projectId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/my-projects/%5BprojectId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../../data/entities'\nimport { staffMyProjectVisibilityUpdateSchema } from '../../../../data/validators'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nfunction extractProjectIdFromUrl(req: Request): string | null {\n  try {\n    const url = new URL(req.url)\n    const match = url.pathname.match(/\\/my-projects\\/([^/]+)(?:\\/|$)/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\n/**\n * PATCH /api/staff/timesheets/my-projects/{projectId}\n *\n * Self-service endpoint for the authenticated user to toggle visibility of a\n * time project on their own My Timesheets grid. Does not require the admin-only\n * `staff.timesheets.projects.manage` feature \u2014 only `staff.timesheets.manage_own`.\n *\n * Added 2026-04-13 to close a gap in the original UX enhancements spec:\n * \"+ Add row\" and the new X remove button need to persist per-user grid membership.\n */\nexport async function PATCH(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const projectId = extractProjectIdFromUrl(req)\n    if (!projectId || !z.string().uuid().safeParse(projectId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidProjectId', 'Invalid project id.'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(session.body)\n    if (!parsed.success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidBody', 'Invalid request body.'),\n        details: parsed.error.flatten(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.'),\n      })\n    }\n\n    const membership = await findOneWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      {\n        timeProjectId: projectId,\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        status: 'active',\n      },\n      {},\n      scopeCtx,\n    )\n    if (!membership) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.notAssigned', 'You are not assigned to this project.'),\n      })\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: parsed.data as unknown as Record<string, unknown>,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    membership.showInGrid = parsed.data.showInGrid\n    await em.flush()\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true, showInGrid: membership.showInGrid })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects.patch failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.updateMyProject', 'Failed to update project visibility.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My project grid visibility',\n  methods: {\n    PATCH: {\n      summary: 'Toggle grid visibility for one of the caller\\'s assigned time projects',\n      description:\n        'Self-service endpoint. Only the authenticated user can toggle `show_in_grid` on their own active membership for the given project. Does not require the admin-only `staff.timesheets.projects.manage` feature.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffMyProjectVisibilityUpdateSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Visibility updated',\n          schema: z.object({ ok: z.boolean(), showInGrid: z.boolean() }),\n        },\n        { status: 400, description: 'Invalid input', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Project membership not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAG7B,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEA,SAAS,wBAAwB,KAA6B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,IAAI,SAAS,MAAM,gCAAgC;AACjE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,YAAY,wBAAwB,GAAG;AAC7C,QAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,EAAE,SAAS;AACjE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,4CAA4C,qBAAqB;AAAA,MACpF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,qCAAqC,UAAU,QAAQ,IAAI;AAC1E,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uBAAuB;AAAA,QAC/E,SAAS,OAAO,MAAM,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,yCAAyC;AAAA,MACrG,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,eAAe;AAAA,QACf,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uCAAuC;AAAA,MACjG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB,OAAO;AAAA,MAC1B;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,eAAW,aAAa,OAAO,KAAK;AACpC,UAAM,GAAG,MAAM;AAEf,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,YAAY,WAAW,WAAW,CAAC;AAAA,EAC7E,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6CAA6C,EAAE,IAAI,CAAC;AACjE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,2CAA2C,sCAAsC,EAAE;AAAA,MACtG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../../data/entities'\nimport { staffMyProjectVisibilityUpdateSchema } from '../../../../data/validators'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nfunction extractProjectIdFromUrl(req: Request): string | null {\n  try {\n    const url = new URL(req.url)\n    const match = url.pathname.match(/\\/my-projects\\/([^/]+)(?:\\/|$)/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\n/**\n * PATCH /api/staff/timesheets/my-projects/{projectId}\n *\n * Self-service endpoint for the authenticated user to toggle visibility of a\n * time project on their own My Timesheets grid. Does not require the admin-only\n * `staff.timesheets.projects.manage` feature \u2014 only `staff.timesheets.manage_own`.\n *\n * Added 2026-04-13 to close a gap in the original UX enhancements spec:\n * \"+ Add row\" and the new X remove button need to persist per-user grid membership.\n */\nexport async function PATCH(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const projectId = extractProjectIdFromUrl(req)\n    if (!projectId || !z.string().uuid().safeParse(projectId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidProjectId', 'Invalid project id.'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffMyProjectVisibilityUpdateSchema.safeParse(session.body)\n    if (!parsed.success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.invalidBody', 'Invalid request body.'),\n        details: parsed.error.flatten(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.'),\n      })\n    }\n\n    const membership = await findOneWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      {\n        timeProjectId: projectId,\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        status: 'active',\n      },\n      {},\n      scopeCtx,\n    )\n    if (!membership) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.notAssigned', 'You are not assigned to this project.'),\n      })\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: parsed.data as unknown as Record<string, unknown>,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    membership.showInGrid = parsed.data.showInGrid\n    await em.flush()\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeProjectMember,\n        resourceId: membership.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true, showInGrid: membership.showInGrid })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects.patch failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.updateMyProject', 'Failed to update project visibility.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My project grid visibility',\n  methods: {\n    PATCH: {\n      summary: 'Toggle grid visibility for one of the caller\\'s assigned time projects',\n      description:\n        'Self-service endpoint. Only the authenticated user can toggle `show_in_grid` on their own active membership for the given project. Does not require the admin-only `staff.timesheets.projects.manage` feature.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffMyProjectVisibilityUpdateSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Visibility updated',\n          schema: z.object({ ok: z.boolean(), showInGrid: z.boolean() }),\n        },\n        { status: 400, description: 'Invalid input', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Project membership not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAG7B,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEA,SAAS,wBAAwB,KAA6B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,IAAI,SAAS,MAAM,gCAAgC;AACjE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,YAAY,wBAAwB,GAAG;AAC7C,QAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,EAAE,SAAS;AACjE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,4CAA4C,qBAAqB;AAAA,MACpF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,qCAAqC,UAAU,QAAQ,IAAI;AAC1E,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uBAAuB;AAAA,QAC/E,SAAS,OAAO,MAAM,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,yCAAyC;AAAA,MACrG,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,eAAe;AAAA,QACf,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uCAAuC,uCAAuC;AAAA,MACjG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB,OAAO;AAAA,MAC1B;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,eAAW,aAAa,OAAO,KAAK;AACpC,UAAM,GAAG,MAAM;AAEf,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,YAAY,WAAW,WAAW,CAAC;AAAA,EAC7E,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6CAA6C,EAAE,IAAI,CAAC;AACjE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,2CAA2C,sCAAsC,EAAE;AAAA,MACtG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,QAC/D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/my-projects/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -24,7 +25,7 @@ async function GET(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }

package/dist/modules/staff/api/timesheets/my-projects/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/my-projects/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n}\n\n/**\n * GET /api/staff/timesheets/my-projects\n *\n * Spec N+1 Mitigation \u2014 Query 1:\n * Returns staff_time_project_members for the authenticated staff member.\n * Used by \"My Timesheets\" grid to resolve assigned project IDs.\n */\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n\n    const assignments = await findWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      { staffMemberId: staffMember.id, tenantId, organizationId, deletedAt: null, status: 'active' },\n      {},\n      scopeCtx,\n    )\n\n    const items = assignments.map((assignment) => ({\n      id: assignment.id,\n      time_project_id: assignment.timeProjectId,\n      staff_member_id: assignment.staffMemberId,\n      role: assignment.role ?? null,\n      status: assignment.status ?? null,\n      assigned_start_date: assignment.assignedStartDate ?? null,\n      assigned_end_date: assignment.assignedEndDate ?? null,\n      show_in_grid: assignment.showInGrid ?? false,\n    }))\n\n    return session.respond(200, { items, total: items.length })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.myProjects', 'Failed to load your projects.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My assigned time projects',\n  methods: {\n    GET: {\n      summary: 'List assigned time project memberships for the current user',\n      description: 'Returns staff_time_project_members where the authenticated user is an active member. Used by the My Timesheets grid to resolve assigned project IDs (spec N+1 mitigation query 1).',\n      responses: [\n        {\n          status: 200,\n          description: 'Assigned project memberships',\n          schema: z.object({\n            items: z.array(z.object({\n              id: z.string().uuid(),\n              time_project_id: z.string().uuid(),\n              staff_member_id: z.string().uuid(),\n              role: z.string().nullable(),\n              status: z.string().nullable(),\n              assigned_start_date: z.string().nullable(),\n              assigned_end_date: z.string().nullable(),\n              show_in_grid: z.boolean(),\n            })),\n            total: z.number(),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,6BAA6B;AAG1D,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AASA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,WAAW,MAAM,QAAQ,SAAS;AAAA,MAC7F,CAAC;AAAA,MACD;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC7C,IAAI,WAAW;AAAA,MACf,iBAAiB,WAAW;AAAA,MAC5B,iBAAiB,WAAW;AAAA,MAC5B,MAAM,WAAW,QAAQ;AAAA,MACzB,QAAQ,WAAW,UAAU;AAAA,MAC7B,qBAAqB,WAAW,qBAAqB;AAAA,MACrD,mBAAmB,WAAW,mBAAmB;AAAA,MACjD,cAAc,WAAW,cAAc;AAAA,IACzC,EAAE;AAEF,WAAO,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE;AAAA,MAC1F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,cAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC5B,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,cACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,cACvC,cAAc,EAAE,QAAQ;AAAA,YAC1B,CAAC,CAAC;AAAA,YACF,OAAO,EAAE,OAAO;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n}\n\n/**\n * GET /api/staff/timesheets/my-projects\n *\n * Spec N+1 Mitigation \u2014 Query 1:\n * Returns staff_time_project_members for the authenticated staff member.\n * Used by \"My Timesheets\" grid to resolve assigned project IDs.\n */\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n\n    const assignments = await findWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      { staffMemberId: staffMember.id, tenantId, organizationId, deletedAt: null, status: 'active' },\n      {},\n      scopeCtx,\n    )\n\n    const items = assignments.map((assignment) => ({\n      id: assignment.id,\n      time_project_id: assignment.timeProjectId,\n      staff_member_id: assignment.staffMemberId,\n      role: assignment.role ?? null,\n      status: assignment.status ?? null,\n      assigned_start_date: assignment.assignedStartDate ?? null,\n      assigned_end_date: assignment.assignedEndDate ?? null,\n      show_in_grid: assignment.showInGrid ?? false,\n    }))\n\n    return session.respond(200, { items, total: items.length })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.myProjects', 'Failed to load your projects.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My assigned time projects',\n  methods: {\n    GET: {\n      summary: 'List assigned time project memberships for the current user',\n      description: 'Returns staff_time_project_members where the authenticated user is an active member. Used by the My Timesheets grid to resolve assigned project IDs (spec N+1 mitigation query 1).',\n      responses: [\n        {\n          status: 200,\n          description: 'Assigned project memberships',\n          schema: z.object({\n            items: z.array(z.object({\n              id: z.string().uuid(),\n              time_project_id: z.string().uuid(),\n              staff_member_id: z.string().uuid(),\n              role: z.string().nullable(),\n              status: z.string().nullable(),\n              assigned_start_date: z.string().nullable(),\n              assigned_end_date: z.string().nullable(),\n              show_in_grid: z.boolean(),\n            })),\n            total: z.number(),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,6BAA6B;AAG1D,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AASA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,WAAW,MAAM,QAAQ,SAAS;AAAA,MAC7F,CAAC;AAAA,MACD;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC7C,IAAI,WAAW;AAAA,MACf,iBAAiB,WAAW;AAAA,MAC5B,iBAAiB,WAAW;AAAA,MAC5B,MAAM,WAAW,QAAQ;AAAA,MACzB,QAAQ,WAAW,UAAU;AAAA,MAC7B,qBAAqB,WAAW,qBAAqB;AAAA,MACrD,mBAAmB,WAAW,mBAAmB;AAAA,MACjD,cAAc,WAAW,cAAc;AAAA,IACzC,EAAE;AAEF,WAAO,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE;AAAA,MAC1F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,cAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC5B,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,cACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,cACvC,cAAc,EAAE,QAAQ;AAAA,YAC1B,CAAC,CAAC;AAAA,YACF,OAAO,EAAE,OAAO;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/my-work/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -104,7 +105,7 @@ async function GET(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/my-work/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/my-work/route.ts"],
-  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/my-work` \u2014 the aggregate behind screen 1 (T5.6).\n *\n * The dashboard a Team Member lands on asks four questions at once (today, this\n * week, this month, how much of it is non-billable), then wants today's entries,\n * the projects they are on with their budget burn, and the tasks they last\n * touched. Answering that with the existing list routes would be six round trips\n * and three client-side aggregations of paginated data; this route answers it in\n * one, with the sums done by the database.\n *\n * Scoping and access:\n *\n *  * Everything is scoped to the CALLER's staff member. There is no\n *    `staffMemberId` parameter \u2014 this endpoint is \"mine\" by construction, so it\n *    can never become a way to read a colleague's day.\n *  * Projects come from the caller's own active memberships, which is the same\n *    set `resolveProjectAccess` would return for a non-manager. A manager sees\n *    their own memberships here too: My work is a personal surface, and the\n *    portfolio view is screen 3.\n *  * **Money is gated on `staff.timesheets.rates.view` and absent, not blanked**,\n *    for anyone else: no `hourlyRate`, no `currencyCode`, and no `amount` budget\n *    burn (which is a money statement). An `hours` budget is not money and stays.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport {\n  StaffTeamMember,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n  StaffTimeTask,\n} from '../../../data/entities'\nimport { computeProjectFinancials } from '../../../lib/timesheets-projects/computeProjectFinancials'\nimport { computeBudgetBurn } from '../../../lib/timesheets-projects/budgetBurn'\nimport {\n  addUtcDays,\n  getFirstDayOfMonthUtc,\n  getFirstDayOfNextMonthUtc,\n  getMondayUtc,\n  toDateOnlyString,\n} from '../../../lib/timesheets-projects/dateBuckets'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildMyWorkKpis, pickRecentTaskIds, toMinutes } from './myWorkAggregate'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/my-work' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst RATES_FEATURE = 'staff.timesheets.rates.view'\nconst RECENT_TASK_LIMIT = 5\nconst MAX_PROJECTS = 50\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\ntype RbacServiceLike = {\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\nconst entrySchema = z.object({\n  id: z.string().uuid(),\n  date: z.string(),\n  taskId: z.string().uuid().nullable(),\n  taskTitle: z.string().nullable(),\n  timeProjectId: z.string().uuid().nullable(),\n  projectName: z.string().nullable(),\n  description: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  endedAt: z.string().nullable(),\n  durationMinutes: z.number().int(),\n  isBillable: z.boolean(),\n  isLocked: z.boolean(),\n})\n\nconst projectSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  code: z.string().nullable(),\n  color: z.string().nullable(),\n  customerName: z.string().nullable(),\n  myMinutes: z.number().int(),\n  totalMinutes: z.number().int(),\n  hourlyRate: z.number().nullable().optional(),\n  currencyCode: z.string().nullable().optional(),\n  budget: z\n    .object({\n      kind: z.enum(['hours', 'amount']),\n      budgetValue: z.number(),\n      usedValue: z.number(),\n      percent: z.number(),\n      barPercent: z.number(),\n      tone: z.string(),\n    })\n    .nullable(),\n})\n\nconst responseSchema = z.object({\n  staffMember: z.object({ id: z.string().uuid(), displayName: z.string() }).nullable(),\n  today: z.string(),\n  kpis: z.object({\n    todayMinutes: z.number().int(),\n    weekMinutes: z.number().int(),\n    monthMinutes: z.number().int(),\n    monthNonBillableMinutes: z.number().int(),\n    dailyTargetMinutes: z.number().int().nullable(),\n    weekTargetMinutes: z.number().int().nullable(),\n    monthTargetMinutes: z.number().int().nullable(),\n    weekWorkingDays: z.number().int(),\n    monthWorkingDays: z.number().int(),\n    nonBillableSharePercent: z.number().nullable(),\n  }),\n  entries: z.array(entrySchema),\n  projects: z.array(projectSchema),\n  recentTasks: z.array(\n    z.object({\n      id: z.string().uuid(),\n      title: z.string(),\n      timeProjectId: z.string().uuid(),\n      projectName: z.string().nullable(),\n    }),\n  ),\n})\n\ntype TotalsRow = {\n  today_minutes: string | number | null\n  week_minutes: string | number | null\n  month_minutes: string | number | null\n  month_nonbillable_minutes: string | number | null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const now = new Date()\n    const todayDate = toDateOnlyString(now)\n    const weekStart = getMondayUtc(now)\n    const weekEnd = addUtcDays(weekStart, 6)\n    const monthStart = getFirstDayOfMonthUtc(now)\n    const nextMonthStart = getFirstDayOfNextMonthUtc(now)\n    const monthEnd = addUtcDays(nextMonthStart, -1)\n\n    let dailyHours: number | null = null\n    try {\n      const configService = container.resolve('moduleConfigService') as ModuleConfigService\n      dailyHours = (await readTimeTrackingSettings(configService, { tenantId })).targets.dailyHours\n    } catch {\n      // A settings read failure must not empty the dashboard; the targets simply\n      // go missing, which the UI already renders as \"no target\".\n      dailyHours = null\n    }\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    const emptyKpis = buildMyWorkKpis(\n      { todayMinutes: 0, weekMinutes: 0, monthMinutes: 0, monthNonBillableMinutes: 0 },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    if (!staffMember) {\n      // No staff profile yet: the shape is the same, so screen 1 renders its\n      // \"set up your profile\" branch instead of failing.\n      return session.respond(200, {\n        staffMember: null,\n        today: todayDate,\n        kpis: emptyKpis,\n        entries: [],\n        projects: [],\n        recentTasks: [],\n      })\n    }\n\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const canSeeMoney =\n      (await rbac?.userHasAllFeatures?.(auth.sub, [RATES_FEATURE], { tenantId, organizationId })) ?? false\n\n    const totalsRows = (await em.getConnection().execute(\n      `\n        SELECT\n          COALESCE(SUM(CASE WHEN date = ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS today_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS week_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS month_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date AND is_billable = false THEN duration_minutes ELSE 0 END), 0)::bigint AS month_nonbillable_minutes\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND organization_id = ?\n          AND staff_member_id = ?\n          AND deleted_at IS NULL\n      `,\n      [\n        todayDate,\n        toDateOnlyString(weekStart),\n        toDateOnlyString(weekEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        tenantId,\n        organizationId,\n        staffMember.id,\n      ],\n    )) as TotalsRow[]\n\n    const totals = totalsRows[0]\n    const kpis = buildMyWorkKpis(\n      {\n        todayMinutes: toMinutes(totals?.today_minutes),\n        weekMinutes: toMinutes(totals?.week_minutes),\n        monthMinutes: toMinutes(totals?.month_minutes),\n        monthNonBillableMinutes: toMinutes(totals?.month_nonbillable_minutes),\n      },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    const memberships = await em.fork().find(StaffTimeProjectMember, {\n      staffMemberId: staffMember.id,\n      tenantId,\n      organizationId,\n      status: 'active',\n      deletedAt: null,\n    })\n    const projectIds = Array.from(new Set(memberships.map((membership) => membership.timeProjectId))).slice(\n      0,\n      MAX_PROJECTS,\n    )\n\n    const projects =\n      projectIds.length > 0\n        ? await findWithDecryption(\n            em.fork(),\n            StaffTimeProject,\n            { id: { $in: projectIds }, tenantId, organizationId, deletedAt: null },\n            {},\n            { tenantId, organizationId },\n          )\n        : []\n\n    const hourlyRateByProjectId = new Map<string, number | null>(\n      projects.map((project) => [\n        project.id,\n        project.hourlyRate === null || project.hourlyRate === undefined ? null : Number(project.hourlyRate),\n      ]),\n    )\n    const [mine, everyone] = await Promise.all([\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n        staffMemberId: staffMember.id,\n      }),\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n      }),\n    ])\n\n    const todaysEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      { staffMemberId: staffMember.id, tenantId, organizationId, date: new Date(`${todayDate}T00:00:00.000Z`), deletedAt: null },\n      { orderBy: { startedAt: 'asc', createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n\n    const recentEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      {\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        taskId: { $ne: null },\n      },\n      { orderBy: { date: 'desc' }, limit: 50 },\n      { tenantId, organizationId },\n    )\n    const recentTaskIds = pickRecentTaskIds(\n      recentEntries.map((entry) => ({\n        id: entry.id,\n        taskId: entry.taskId ?? null,\n        date: toDateOnlyString(new Date(entry.date)),\n      })),\n      RECENT_TASK_LIMIT,\n    )\n    const referencedTaskIds = Array.from(\n      new Set([\n        ...recentTaskIds,\n        ...todaysEntries.map((entry) => entry.taskId).filter((id): id is string => typeof id === 'string'),\n      ]),\n    )\n    const tasks =\n      referencedTaskIds.length > 0\n        ? await em.fork().find(StaffTimeTask, {\n            id: { $in: referencedTaskIds },\n            tenantId,\n            organizationId,\n            deletedAt: null,\n          })\n        : []\n    const taskById = new Map(tasks.map((task) => [task.id, task]))\n    const projectNameById = new Map(projects.map((project) => [project.id, project.name]))\n\n    const payload = {\n      staffMember: { id: staffMember.id, displayName: staffMember.displayName },\n      today: todayDate,\n      kpis,\n      entries: todaysEntries.map((entry) => ({\n        id: entry.id,\n        date: toDateOnlyString(new Date(entry.date)),\n        taskId: entry.taskId ?? null,\n        taskTitle: entry.taskId ? taskById.get(entry.taskId)?.title ?? null : null,\n        timeProjectId: entry.timeProjectId ?? null,\n        projectName: entry.timeProjectId ? projectNameById.get(entry.timeProjectId) ?? null : null,\n        description: entry.notes ?? null,\n        startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,\n        endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,\n        durationMinutes: entry.durationMinutes,\n        isBillable: entry.isBillable !== false,\n        isLocked: Boolean(entry.lockedReportId),\n      })),\n      projects: projects.map((project) => {\n        const myFinancials = mine.get(project.id)\n        const allFinancials = everyone.get(project.id)\n        const snapshot = project.customerSnapshot ?? null\n        const customerName =\n          snapshot && typeof snapshot === 'object' && typeof (snapshot as { name?: unknown }).name === 'string'\n            ? ((snapshot as { name?: string }).name as string)\n            : null\n        // An `amount` budget is a money statement, so it only exists for a caller\n        // who may see money; an `hours` budget is not, and stays for everybody.\n        const burn =\n          project.budgetKind === 'amount' && !canSeeMoney\n            ? null\n            : computeBudgetBurn({\n                kind: project.budgetKind,\n                budgetValue:\n                  project.budgetValue === null || project.budgetValue === undefined\n                    ? null\n                    : Number(project.budgetValue),\n                warnAtPercent: project.budgetWarnAtPercent,\n                totalMinutes: allFinancials?.totalMinutes ?? 0,\n                cost: allFinancials?.cost ?? null,\n              })\n        return {\n          id: project.id,\n          name: project.name,\n          code: project.code ?? null,\n          color: project.color ?? null,\n          customerName,\n          myMinutes: myFinancials?.totalMinutes ?? 0,\n          totalMinutes: allFinancials?.totalMinutes ?? 0,\n          ...(canSeeMoney\n            ? {\n                hourlyRate: hourlyRateByProjectId.get(project.id) ?? null,\n                currencyCode: project.currencyCode ?? null,\n              }\n            : {}),\n          budget: burn\n            ? {\n                kind: burn.kind,\n                budgetValue: burn.budgetValue,\n                usedValue: burn.usedValue,\n                percent: burn.percent,\n                barPercent: burn.barPercent,\n                tone: burn.tone,\n              }\n            : null,\n        }\n      }),\n      recentTasks: recentTaskIds\n        .map((taskId) => {\n          const task = taskById.get(taskId)\n          if (!task) return null\n          return {\n            id: task.id,\n            title: task.title,\n            timeProjectId: task.timeProjectId,\n            projectName: projectNameById.get(task.timeProjectId) ?? null,\n          }\n        })\n        .filter((task): task is NonNullable<typeof task> => task !== null),\n    }\n\n    return session.respond(200, payload)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-work failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.time_tracking.myWork.errors.load', 'Failed to load your work summary.') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My work dashboard aggregate',\n  methods: {\n    GET: {\n      summary: 'Today, this week and this month for the calling staff member',\n      description:\n        'One aggregate for the time tracking landing page: day/week/month/non-billable totals with working-day targets, today\u2019s entries, the caller\u2019s projects with budget burn, and the tasks they last logged against. Always scoped to the caller \u2014 there is no way to ask about another person. Rate and amount-budget fields are present only for holders of `staff.timesheets.rates.view`.',\n      responses: [\n        { status: 200, description: 'My work summary', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAI7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,iBAAiB,mBAAmB,iBAAiB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAElF,MAAM,eAAe;AACrB,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAUA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,QAAQ,EACL,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO;AAAA,IAClB,YAAY,EAAE,OAAO;AAAA,IACrB,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACnF,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,IACb,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,IAC5B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,IACxC,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC7C,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,IACjC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,SAAS,EAAE,MAAM,WAAW;AAAA,EAC5B,UAAU,EAAE,MAAM,aAAa;AAAA,EAC/B,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO;AAAA,MAChB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC;AAAA,EACH;AACF,CAAC;AASD,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YAAY,iBAAiB,GAAG;AACtC,UAAM,YAAY,aAAa,GAAG;AAClC,UAAM,UAAU,WAAW,WAAW,CAAC;AACvC,UAAM,aAAa,sBAAsB,GAAG;AAC5C,UAAM,iBAAiB,0BAA0B,GAAG;AACpD,UAAM,WAAW,WAAW,gBAAgB,EAAE;AAE9C,QAAI,aAA4B;AAChC,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,oBAAc,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,GAAG,QAAQ;AAAA,IACrF,QAAQ;AAGN,mBAAa;AAAA,IACf;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,YAAY;AAAA,MAChB,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,yBAAyB,EAAE;AAAA,MAC/E;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,aAAa;AAGhB,aAAO,QAAQ,QAAQ,KAAK;AAAA,QAC1B,aAAa;AAAA,QACb,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,UAAU,CAAC;AAAA,QACX,aAAa,CAAC;AAAA,MAChB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,cACH,MAAM,MAAM,qBAAqB,KAAK,KAAK,CAAC,aAAa,GAAG,EAAE,UAAU,eAAe,CAAC,KAAM;AAEjG,UAAM,aAAc,MAAM,GAAG,cAAc,EAAE;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYA;AAAA,QACE;AAAA,QACA,iBAAiB,SAAS;AAAA,QAC1B,iBAAiB,OAAO;AAAA,QACxB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,SAAS,WAAW,CAAC;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,QACE,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,aAAa,UAAU,QAAQ,YAAY;AAAA,QAC3C,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,yBAAyB,UAAU,QAAQ,yBAAyB;AAAA,MACtE;AAAA,MACA;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,MAC/D,eAAe,YAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,IACb,CAAC;AACD,UAAM,aAAa,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,aAAa,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,WAAW,SAAS,IAChB,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACrE,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B,IACA,CAAC;AAEP,UAAM,wBAAwB,IAAI;AAAA,MAChC,SAAS,IAAI,CAAC,YAAY;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ,eAAe,QAAQ,QAAQ,eAAe,SAAY,OAAO,OAAO,QAAQ,UAAU;AAAA,MACpG,CAAC;AAAA,IACH;AACA,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,QACA,eAAe,YAAY;AAAA,MAC7B,CAAC;AAAA,MACD,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,MAAM,oBAAI,KAAK,GAAG,SAAS,gBAAgB,GAAG,WAAW,KAAK;AAAA,MACzH,EAAE,SAAS,EAAE,WAAW,OAAO,WAAW,MAAM,EAAE;AAAA,MAClD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA;AAAA,QACE,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ,EAAE,KAAK,KAAK;AAAA,MACtB;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,GAAG;AAAA,MACvC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,gBAAgB;AAAA,MACpB,cAAc,IAAI,CAAC,WAAW;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,QAAQ,MAAM,UAAU;AAAA,QACxB,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,MAC7C,EAAE;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,MAAM;AAAA,MAC9B,oBAAI,IAAI;AAAA,QACN,GAAG;AAAA,QACH,GAAG,cAAc,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,MACnG,CAAC;AAAA,IACH;AACA,UAAM,QACJ,kBAAkB,SAAS,IACvB,MAAM,GAAG,KAAK,EAAE,KAAK,eAAe;AAAA,MAClC,IAAI,EAAE,KAAK,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC,IACD,CAAC;AACP,UAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC7D,UAAM,kBAAkB,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,UAAM,UAAU;AAAA,MACd,aAAa,EAAE,IAAI,YAAY,IAAI,aAAa,YAAY,YAAY;AAAA,MACxE,OAAO;AAAA,MACP;AAAA,MACA,SAAS,cAAc,IAAI,CAAC,WAAW;AAAA,QACrC,IAAI,MAAM;AAAA,QACV,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QAC3C,QAAQ,MAAM,UAAU;AAAA,QACxB,WAAW,MAAM,SAAS,SAAS,IAAI,MAAM,MAAM,GAAG,SAAS,OAAO;AAAA,QACtE,eAAe,MAAM,iBAAiB;AAAA,QACtC,aAAa,MAAM,gBAAgB,gBAAgB,IAAI,MAAM,aAAa,KAAK,OAAO;AAAA,QACtF,aAAa,MAAM,SAAS;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,QAC7D,SAAS,MAAM,UAAU,MAAM,QAAQ,YAAY,IAAI;AAAA,QACvD,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM,eAAe;AAAA,QACjC,UAAU,QAAQ,MAAM,cAAc;AAAA,MACxC,EAAE;AAAA,MACF,UAAU,SAAS,IAAI,CAAC,YAAY;AAClC,cAAM,eAAe,KAAK,IAAI,QAAQ,EAAE;AACxC,cAAM,gBAAgB,SAAS,IAAI,QAAQ,EAAE;AAC7C,cAAM,WAAW,QAAQ,oBAAoB;AAC7C,cAAM,eACJ,YAAY,OAAO,aAAa,YAAY,OAAQ,SAAgC,SAAS,WACvF,SAA+B,OACjC;AAGN,cAAM,OACJ,QAAQ,eAAe,YAAY,CAAC,cAChC,OACA,kBAAkB;AAAA,UAChB,MAAM,QAAQ;AAAA,UACd,aACE,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,SACpD,OACA,OAAO,QAAQ,WAAW;AAAA,UAChC,eAAe,QAAQ;AAAA,UACvB,cAAc,eAAe,gBAAgB;AAAA,UAC7C,MAAM,eAAe,QAAQ;AAAA,QAC/B,CAAC;AACP,eAAO;AAAA,UACL,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,MAAM,QAAQ,QAAQ;AAAA,UACtB,OAAO,QAAQ,SAAS;AAAA,UACxB;AAAA,UACA,WAAW,cAAc,gBAAgB;AAAA,UACzC,cAAc,eAAe,gBAAgB;AAAA,UAC7C,GAAI,cACA;AAAA,YACE,YAAY,sBAAsB,IAAI,QAAQ,EAAE,KAAK;AAAA,YACrD,cAAc,QAAQ,gBAAgB;AAAA,UACxC,IACA,CAAC;AAAA,UACL,QAAQ,OACJ;AAAA,YACE,MAAM,KAAK;AAAA,YACX,aAAa,KAAK;AAAA,YAClB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,YAAY,KAAK;AAAA,YACjB,MAAM,KAAK;AAAA,UACb,IACA;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,aAAa,cACV,IAAI,CAAC,WAAW;AACf,cAAM,OAAO,SAAS,IAAI,MAAM;AAChC,YAAI,CAAC,KAAM,QAAO;AAClB,eAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,KAAK;AAAA,UACZ,eAAe,KAAK;AAAA,UACpB,aAAa,gBAAgB,IAAI,KAAK,aAAa,KAAK;AAAA,QAC1D;AAAA,MACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACrE;AAEA,WAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,EACrC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,0CAA0C,mCAAmC,EAAE;AAAA,MAClG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/my-work` \u2014 the aggregate behind screen 1 (T5.6).\n *\n * The dashboard a Team Member lands on asks four questions at once (today, this\n * week, this month, how much of it is non-billable), then wants today's entries,\n * the projects they are on with their budget burn, and the tasks they last\n * touched. Answering that with the existing list routes would be six round trips\n * and three client-side aggregations of paginated data; this route answers it in\n * one, with the sums done by the database.\n *\n * Scoping and access:\n *\n *  * Everything is scoped to the CALLER's staff member. There is no\n *    `staffMemberId` parameter \u2014 this endpoint is \"mine\" by construction, so it\n *    can never become a way to read a colleague's day.\n *  * Projects come from the caller's own active memberships, which is the same\n *    set `resolveProjectAccess` would return for a non-manager. A manager sees\n *    their own memberships here too: My work is a personal surface, and the\n *    portfolio view is screen 3.\n *  * **Money is gated on `staff.timesheets.rates.view` and absent, not blanked**,\n *    for anyone else: no `hourlyRate`, no `currencyCode`, and no `amount` budget\n *    burn (which is a money statement). An `hours` budget is not money and stays.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport {\n  StaffTeamMember,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n  StaffTimeTask,\n} from '../../../data/entities'\nimport { computeProjectFinancials } from '../../../lib/timesheets-projects/computeProjectFinancials'\nimport { computeBudgetBurn } from '../../../lib/timesheets-projects/budgetBurn'\nimport {\n  addUtcDays,\n  getFirstDayOfMonthUtc,\n  getFirstDayOfNextMonthUtc,\n  getMondayUtc,\n  toDateOnlyString,\n} from '../../../lib/timesheets-projects/dateBuckets'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildMyWorkKpis, pickRecentTaskIds, toMinutes } from './myWorkAggregate'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/my-work' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst RATES_FEATURE = 'staff.timesheets.rates.view'\nconst RECENT_TASK_LIMIT = 5\nconst MAX_PROJECTS = 50\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\ntype RbacServiceLike = {\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\nconst entrySchema = z.object({\n  id: z.string().uuid(),\n  date: z.string(),\n  taskId: z.string().uuid().nullable(),\n  taskTitle: z.string().nullable(),\n  timeProjectId: z.string().uuid().nullable(),\n  projectName: z.string().nullable(),\n  description: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  endedAt: z.string().nullable(),\n  durationMinutes: z.number().int(),\n  isBillable: z.boolean(),\n  isLocked: z.boolean(),\n})\n\nconst projectSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  code: z.string().nullable(),\n  color: z.string().nullable(),\n  customerName: z.string().nullable(),\n  myMinutes: z.number().int(),\n  totalMinutes: z.number().int(),\n  hourlyRate: z.number().nullable().optional(),\n  currencyCode: z.string().nullable().optional(),\n  budget: z\n    .object({\n      kind: z.enum(['hours', 'amount']),\n      budgetValue: z.number(),\n      usedValue: z.number(),\n      percent: z.number(),\n      barPercent: z.number(),\n      tone: z.string(),\n    })\n    .nullable(),\n})\n\nconst responseSchema = z.object({\n  staffMember: z.object({ id: z.string().uuid(), displayName: z.string() }).nullable(),\n  today: z.string(),\n  kpis: z.object({\n    todayMinutes: z.number().int(),\n    weekMinutes: z.number().int(),\n    monthMinutes: z.number().int(),\n    monthNonBillableMinutes: z.number().int(),\n    dailyTargetMinutes: z.number().int().nullable(),\n    weekTargetMinutes: z.number().int().nullable(),\n    monthTargetMinutes: z.number().int().nullable(),\n    weekWorkingDays: z.number().int(),\n    monthWorkingDays: z.number().int(),\n    nonBillableSharePercent: z.number().nullable(),\n  }),\n  entries: z.array(entrySchema),\n  projects: z.array(projectSchema),\n  recentTasks: z.array(\n    z.object({\n      id: z.string().uuid(),\n      title: z.string(),\n      timeProjectId: z.string().uuid(),\n      projectName: z.string().nullable(),\n    }),\n  ),\n})\n\ntype TotalsRow = {\n  today_minutes: string | number | null\n  week_minutes: string | number | null\n  month_minutes: string | number | null\n  month_nonbillable_minutes: string | number | null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const now = new Date()\n    const todayDate = toDateOnlyString(now)\n    const weekStart = getMondayUtc(now)\n    const weekEnd = addUtcDays(weekStart, 6)\n    const monthStart = getFirstDayOfMonthUtc(now)\n    const nextMonthStart = getFirstDayOfNextMonthUtc(now)\n    const monthEnd = addUtcDays(nextMonthStart, -1)\n\n    let dailyHours: number | null = null\n    try {\n      const configService = container.resolve('moduleConfigService') as ModuleConfigService\n      dailyHours = (await readTimeTrackingSettings(configService, { tenantId })).targets.dailyHours\n    } catch {\n      // A settings read failure must not empty the dashboard; the targets simply\n      // go missing, which the UI already renders as \"no target\".\n      dailyHours = null\n    }\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    const emptyKpis = buildMyWorkKpis(\n      { todayMinutes: 0, weekMinutes: 0, monthMinutes: 0, monthNonBillableMinutes: 0 },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    if (!staffMember) {\n      // No staff profile yet: the shape is the same, so screen 1 renders its\n      // \"set up your profile\" branch instead of failing.\n      return session.respond(200, {\n        staffMember: null,\n        today: todayDate,\n        kpis: emptyKpis,\n        entries: [],\n        projects: [],\n        recentTasks: [],\n      })\n    }\n\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const canSeeMoney =\n      (await rbac?.userHasAllFeatures?.(auth.sub, [RATES_FEATURE], { tenantId, organizationId })) ?? false\n\n    const totalsRows = (await em.getConnection().execute(\n      `\n        SELECT\n          COALESCE(SUM(CASE WHEN date = ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS today_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS week_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS month_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date AND is_billable = false THEN duration_minutes ELSE 0 END), 0)::bigint AS month_nonbillable_minutes\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND organization_id = ?\n          AND staff_member_id = ?\n          AND deleted_at IS NULL\n      `,\n      [\n        todayDate,\n        toDateOnlyString(weekStart),\n        toDateOnlyString(weekEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        tenantId,\n        organizationId,\n        staffMember.id,\n      ],\n    )) as TotalsRow[]\n\n    const totals = totalsRows[0]\n    const kpis = buildMyWorkKpis(\n      {\n        todayMinutes: toMinutes(totals?.today_minutes),\n        weekMinutes: toMinutes(totals?.week_minutes),\n        monthMinutes: toMinutes(totals?.month_minutes),\n        monthNonBillableMinutes: toMinutes(totals?.month_nonbillable_minutes),\n      },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    const memberships = await em.fork().find(StaffTimeProjectMember, {\n      staffMemberId: staffMember.id,\n      tenantId,\n      organizationId,\n      status: 'active',\n      deletedAt: null,\n    })\n    const projectIds = Array.from(new Set(memberships.map((membership) => membership.timeProjectId))).slice(\n      0,\n      MAX_PROJECTS,\n    )\n\n    const projects =\n      projectIds.length > 0\n        ? await findWithDecryption(\n            em.fork(),\n            StaffTimeProject,\n            { id: { $in: projectIds }, tenantId, organizationId, deletedAt: null },\n            {},\n            { tenantId, organizationId },\n          )\n        : []\n\n    const hourlyRateByProjectId = new Map<string, number | null>(\n      projects.map((project) => [\n        project.id,\n        project.hourlyRate === null || project.hourlyRate === undefined ? null : Number(project.hourlyRate),\n      ]),\n    )\n    const [mine, everyone] = await Promise.all([\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n        staffMemberId: staffMember.id,\n      }),\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n      }),\n    ])\n\n    const todaysEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      { staffMemberId: staffMember.id, tenantId, organizationId, date: new Date(`${todayDate}T00:00:00.000Z`), deletedAt: null },\n      { orderBy: { startedAt: 'asc', createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n\n    const recentEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      {\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        taskId: { $ne: null },\n      },\n      { orderBy: { date: 'desc' }, limit: 50 },\n      { tenantId, organizationId },\n    )\n    const recentTaskIds = pickRecentTaskIds(\n      recentEntries.map((entry) => ({\n        id: entry.id,\n        taskId: entry.taskId ?? null,\n        date: toDateOnlyString(new Date(entry.date)),\n      })),\n      RECENT_TASK_LIMIT,\n    )\n    const referencedTaskIds = Array.from(\n      new Set([\n        ...recentTaskIds,\n        ...todaysEntries.map((entry) => entry.taskId).filter((id): id is string => typeof id === 'string'),\n      ]),\n    )\n    const tasks =\n      referencedTaskIds.length > 0\n        ? await em.fork().find(StaffTimeTask, {\n            id: { $in: referencedTaskIds },\n            tenantId,\n            organizationId,\n            deletedAt: null,\n          })\n        : []\n    const taskById = new Map(tasks.map((task) => [task.id, task]))\n    const projectNameById = new Map(projects.map((project) => [project.id, project.name]))\n\n    const payload = {\n      staffMember: { id: staffMember.id, displayName: staffMember.displayName },\n      today: todayDate,\n      kpis,\n      entries: todaysEntries.map((entry) => ({\n        id: entry.id,\n        date: toDateOnlyString(new Date(entry.date)),\n        taskId: entry.taskId ?? null,\n        taskTitle: entry.taskId ? taskById.get(entry.taskId)?.title ?? null : null,\n        timeProjectId: entry.timeProjectId ?? null,\n        projectName: entry.timeProjectId ? projectNameById.get(entry.timeProjectId) ?? null : null,\n        description: entry.notes ?? null,\n        startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,\n        endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,\n        durationMinutes: entry.durationMinutes,\n        isBillable: entry.isBillable !== false,\n        isLocked: Boolean(entry.lockedReportId),\n      })),\n      projects: projects.map((project) => {\n        const myFinancials = mine.get(project.id)\n        const allFinancials = everyone.get(project.id)\n        const snapshot = project.customerSnapshot ?? null\n        const customerName =\n          snapshot && typeof snapshot === 'object' && typeof (snapshot as { name?: unknown }).name === 'string'\n            ? ((snapshot as { name?: string }).name as string)\n            : null\n        // An `amount` budget is a money statement, so it only exists for a caller\n        // who may see money; an `hours` budget is not, and stays for everybody.\n        const burn =\n          project.budgetKind === 'amount' && !canSeeMoney\n            ? null\n            : computeBudgetBurn({\n                kind: project.budgetKind,\n                budgetValue:\n                  project.budgetValue === null || project.budgetValue === undefined\n                    ? null\n                    : Number(project.budgetValue),\n                warnAtPercent: project.budgetWarnAtPercent,\n                totalMinutes: allFinancials?.totalMinutes ?? 0,\n                cost: allFinancials?.cost ?? null,\n              })\n        return {\n          id: project.id,\n          name: project.name,\n          code: project.code ?? null,\n          color: project.color ?? null,\n          customerName,\n          myMinutes: myFinancials?.totalMinutes ?? 0,\n          totalMinutes: allFinancials?.totalMinutes ?? 0,\n          ...(canSeeMoney\n            ? {\n                hourlyRate: hourlyRateByProjectId.get(project.id) ?? null,\n                currencyCode: project.currencyCode ?? null,\n              }\n            : {}),\n          budget: burn\n            ? {\n                kind: burn.kind,\n                budgetValue: burn.budgetValue,\n                usedValue: burn.usedValue,\n                percent: burn.percent,\n                barPercent: burn.barPercent,\n                tone: burn.tone,\n              }\n            : null,\n        }\n      }),\n      recentTasks: recentTaskIds\n        .map((taskId) => {\n          const task = taskById.get(taskId)\n          if (!task) return null\n          return {\n            id: task.id,\n            title: task.title,\n            timeProjectId: task.timeProjectId,\n            projectName: projectNameById.get(task.timeProjectId) ?? null,\n          }\n        })\n        .filter((task): task is NonNullable<typeof task> => task !== null),\n    }\n\n    return session.respond(200, payload)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-work failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.time_tracking.myWork.errors.load', 'Failed to load your work summary.') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My work dashboard aggregate',\n  methods: {\n    GET: {\n      summary: 'Today, this week and this month for the calling staff member',\n      description:\n        'One aggregate for the time tracking landing page: day/week/month/non-billable totals with working-day targets, today\u2019s entries, the caller\u2019s projects with budget burn, and the tasks they last logged against. Always scoped to the caller \u2014 there is no way to ask about another person. Rate and amount-budget fields are present only for holders of `staff.timesheets.rates.view`.',\n      responses: [\n        { status: 200, description: 'My work summary', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAI7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,iBAAiB,mBAAmB,iBAAiB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAElF,MAAM,eAAe;AACrB,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAUA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,QAAQ,EACL,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO;AAAA,IAClB,YAAY,EAAE,OAAO;AAAA,IACrB,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACnF,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,IACb,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,IAC5B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,IACxC,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC7C,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,IACjC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,SAAS,EAAE,MAAM,WAAW;AAAA,EAC5B,UAAU,EAAE,MAAM,aAAa;AAAA,EAC/B,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO;AAAA,MAChB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC;AAAA,EACH;AACF,CAAC;AASD,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YAAY,iBAAiB,GAAG;AACtC,UAAM,YAAY,aAAa,GAAG;AAClC,UAAM,UAAU,WAAW,WAAW,CAAC;AACvC,UAAM,aAAa,sBAAsB,GAAG;AAC5C,UAAM,iBAAiB,0BAA0B,GAAG;AACpD,UAAM,WAAW,WAAW,gBAAgB,EAAE;AAE9C,QAAI,aAA4B;AAChC,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,oBAAc,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,GAAG,QAAQ;AAAA,IACrF,QAAQ;AAGN,mBAAa;AAAA,IACf;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,YAAY;AAAA,MAChB,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,yBAAyB,EAAE;AAAA,MAC/E;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,aAAa;AAGhB,aAAO,QAAQ,QAAQ,KAAK;AAAA,QAC1B,aAAa;AAAA,QACb,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,UAAU,CAAC;AAAA,QACX,aAAa,CAAC;AAAA,MAChB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,cACH,MAAM,MAAM,qBAAqB,KAAK,KAAK,CAAC,aAAa,GAAG,EAAE,UAAU,eAAe,CAAC,KAAM;AAEjG,UAAM,aAAc,MAAM,GAAG,cAAc,EAAE;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYA;AAAA,QACE;AAAA,QACA,iBAAiB,SAAS;AAAA,QAC1B,iBAAiB,OAAO;AAAA,QACxB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,SAAS,WAAW,CAAC;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,QACE,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,aAAa,UAAU,QAAQ,YAAY;AAAA,QAC3C,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,yBAAyB,UAAU,QAAQ,yBAAyB;AAAA,MACtE;AAAA,MACA;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,MAC/D,eAAe,YAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,IACb,CAAC;AACD,UAAM,aAAa,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,aAAa,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,WAAW,SAAS,IAChB,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACrE,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B,IACA,CAAC;AAEP,UAAM,wBAAwB,IAAI;AAAA,MAChC,SAAS,IAAI,CAAC,YAAY;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ,eAAe,QAAQ,QAAQ,eAAe,SAAY,OAAO,OAAO,QAAQ,UAAU;AAAA,MACpG,CAAC;AAAA,IACH;AACA,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,QACA,eAAe,YAAY;AAAA,MAC7B,CAAC;AAAA,MACD,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,MAAM,oBAAI,KAAK,GAAG,SAAS,gBAAgB,GAAG,WAAW,KAAK;AAAA,MACzH,EAAE,SAAS,EAAE,WAAW,OAAO,WAAW,MAAM,EAAE;AAAA,MAClD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA;AAAA,QACE,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ,EAAE,KAAK,KAAK;AAAA,MACtB;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,GAAG;AAAA,MACvC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,gBAAgB;AAAA,MACpB,cAAc,IAAI,CAAC,WAAW;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,QAAQ,MAAM,UAAU;AAAA,QACxB,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,MAC7C,EAAE;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,MAAM;AAAA,MAC9B,oBAAI,IAAI;AAAA,QACN,GAAG;AAAA,QACH,GAAG,cAAc,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,MACnG,CAAC;AAAA,IACH;AACA,UAAM,QACJ,kBAAkB,SAAS,IACvB,MAAM,GAAG,KAAK,EAAE,KAAK,eAAe;AAAA,MAClC,IAAI,EAAE,KAAK,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC,IACD,CAAC;AACP,UAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC7D,UAAM,kBAAkB,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,UAAM,UAAU;AAAA,MACd,aAAa,EAAE,IAAI,YAAY,IAAI,aAAa,YAAY,YAAY;AAAA,MACxE,OAAO;AAAA,MACP;AAAA,MACA,SAAS,cAAc,IAAI,CAAC,WAAW;AAAA,QACrC,IAAI,MAAM;AAAA,QACV,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QAC3C,QAAQ,MAAM,UAAU;AAAA,QACxB,WAAW,MAAM,SAAS,SAAS,IAAI,MAAM,MAAM,GAAG,SAAS,OAAO;AAAA,QACtE,eAAe,MAAM,iBAAiB;AAAA,QACtC,aAAa,MAAM,gBAAgB,gBAAgB,IAAI,MAAM,aAAa,KAAK,OAAO;AAAA,QACtF,aAAa,MAAM,SAAS;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,QAC7D,SAAS,MAAM,UAAU,MAAM,QAAQ,YAAY,IAAI;AAAA,QACvD,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM,eAAe;AAAA,QACjC,UAAU,QAAQ,MAAM,cAAc;AAAA,MACxC,EAAE;AAAA,MACF,UAAU,SAAS,IAAI,CAAC,YAAY;AAClC,cAAM,eAAe,KAAK,IAAI,QAAQ,EAAE;AACxC,cAAM,gBAAgB,SAAS,IAAI,QAAQ,EAAE;AAC7C,cAAM,WAAW,QAAQ,oBAAoB;AAC7C,cAAM,eACJ,YAAY,OAAO,aAAa,YAAY,OAAQ,SAAgC,SAAS,WACvF,SAA+B,OACjC;AAGN,cAAM,OACJ,QAAQ,eAAe,YAAY,CAAC,cAChC,OACA,kBAAkB;AAAA,UAChB,MAAM,QAAQ;AAAA,UACd,aACE,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,SACpD,OACA,OAAO,QAAQ,WAAW;AAAA,UAChC,eAAe,QAAQ;AAAA,UACvB,cAAc,eAAe,gBAAgB;AAAA,UAC7C,MAAM,eAAe,QAAQ;AAAA,QAC/B,CAAC;AACP,eAAO;AAAA,UACL,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,MAAM,QAAQ,QAAQ;AAAA,UACtB,OAAO,QAAQ,SAAS;AAAA,UACxB;AAAA,UACA,WAAW,cAAc,gBAAgB;AAAA,UACzC,cAAc,eAAe,gBAAgB;AAAA,UAC7C,GAAI,cACA;AAAA,YACE,YAAY,sBAAsB,IAAI,QAAQ,EAAE,KAAK;AAAA,YACrD,cAAc,QAAQ,gBAAgB;AAAA,UACxC,IACA,CAAC;AAAA,UACL,QAAQ,OACJ;AAAA,YACE,MAAM,KAAK;AAAA,YACX,aAAa,KAAK;AAAA,YAClB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,YAAY,KAAK;AAAA,YACjB,MAAM,KAAK;AAAA,UACb,IACA;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,aAAa,cACV,IAAI,CAAC,WAAW;AACf,cAAM,OAAO,SAAS,IAAI,MAAM;AAChC,YAAI,CAAC,KAAM,QAAO;AAClB,eAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,KAAK;AAAA,UACZ,eAAe,KAAK;AAAA,UACpB,aAAa,gBAAgB,IAAI,KAAK,aAAa,KAAK;AAAA,QAC1D;AAAA,MACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACrE;AAEA,WAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,EACrC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,0CAA0C,mCAAmC,EAAE;AAAA,MAClG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/projects/kpis/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -61,7 +62,7 @@ async function GET(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")