@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/staff/api/timesheets/tasks/[id]/comments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/comments/route.ts"],
-  "sourcesContent": ["/**\n * Task comments (T3.4b) \u2014 the \"Komentarze (2)\" thread in the task drawer of\n * screen 7: avatar, author name, timestamp, body, and a composer that posts on\n * \u2318\u21B5.\n *\n * Hand-written rather than `makeCrudRoute`, for one reason that decides\n * everything else: **a caller who cannot see the task's project must not be able\n * to tell that the task exists.** A CRUD list would answer such a request with\n * an empty page \u2014 which is a different response from \"no such task\" and\n * therefore an existence oracle for every task id in the tenant. Here every\n * method funnels through the same `requireAccessibleTask` call before it touches\n * a comment, so \"not yours\" and \"does not exist\" produce one and the same 404\n * body, byte for byte.\n *\n * Because the route is hand-written it wires `runRouteMutationGuards` itself\n * (`packages/core/AGENTS.md` \u00A7 API Routes) \u2014 the same guard set every\n * `makeCrudRoute` write runs \u2014 and the writes go through the task-comment\n * commands so audit, undo, events and indexing stay consistent.\n *\n * Two more things the thread depends on:\n *\n *  - **Oldest first.** Screen 7 reads as a conversation, so the list sorts by\n *    `created_at ASC` with an id tiebreak, not the newest-first default a grid\n *    would want.\n *  - **The author's display name is resolved for rendering**, reusing the same\n *    `User` lookup `api/comments.ts` uses for the team-member timeline rather\n *    than inventing a cross-module join. A name that cannot be resolved degrades\n *    to `null` and the thread still renders \u2014 the comment is the record, the\n *    name is decoration.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { StaffTimeTaskComment } from '../../../../../data/entities'\nimport {\n  staffTimeTaskCommentCreateSchema,\n  staffTimeTaskCommentUpdateSchema,\n} from '../../../../../data/validators'\nimport { staffTimeTaskCommentCommandIds } from '../../../../../commands/timesheets-task-comments'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport {\n  loadTagProjectAccess as loadTaskProjectAccess,\n  requireAccessibleTask,\n  type TagAssignmentScope as TaskAccessScope,\n} from '../../../tags/access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/comments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTaskComment\n\nconst VIEW_FEATURE = 'staff.timesheets.tasks.view'\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n})\n\nconst commentItemSchema = z.object({\n  id: z.string().uuid(),\n  taskId: z.string().uuid(),\n  body: z.string(),\n  authorUserId: z.string().uuid().nullable(),\n  authorName: z.string().nullable(),\n  authorEmail: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(commentItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n  taskId: z.string().uuid(),\n  authorUserId: z.string().uuid().nullable(),\n})\n\nconst okResponseSchema = z.object({ ok: z.boolean() })\n\nconst createBodySchema = z.object({ body: z.string().trim().min(1).max(5000) })\nconst updateBodySchema = z.object({ id: z.string().uuid(), body: z.string().trim().min(1).max(5000) })\n\ntype RouteContext = {\n  ctx: CommandRuntimeContext\n  scope: TaskAccessScope\n  translate: (key: string, fallback?: string) => string\n  taskId: string\n}\n\n/**\n * The task id comes from the path segment. Read from the URL rather than the\n * handler's `params` argument so the route behaves identically under the app's\n * catch-all dispatcher and under a direct call in tests.\n */\nfunction extractTaskId(req: Request): string | null {\n  try {\n    const match = new URL(req.url).pathname.match(/\\/tasks\\/([^/]+)\\/comments/)\n    const id = match?.[1] ? decodeURIComponent(match[1]) : null\n    return id && id.length > 0 ? id : null\n  } catch {\n    return null\n  }\n}\n\nasync function buildRouteContext(req: Request): Promise<RouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const userId = auth.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const taskId = extractTaskId(req)\n  if (!taskId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.taskComments.errors.taskIdRequired', 'Task id is required.'),\n    })\n  }\n\n  return { ctx, scope: { tenantId, organizationId, userId }, translate, taskId }\n}\n\n/**\n * The single gate every method passes through. Resolving project access before\n * the task is loaded \u2014 and answering both misses with one body \u2014 is what keeps\n * the endpoint from confirming that a task the caller may not see exists.\n */\nasync function requireTaskAccess(route: RouteContext): Promise<void> {\n  const access = await loadTaskProjectAccess(route.ctx.container, route.scope)\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, route.taskId, route.scope, access, route.translate)\n}\n\nfunction commentNotFoundError(translate: (key: string, fallback?: string) => string): CrudHttpError {\n  return new CrudHttpError(404, {\n    error: translate('staff.time_tracking.taskComments.errors.notFound', 'Comment not found or not accessible.'),\n  })\n}\n\n/**\n * A comment addressed through another task's URL is refused exactly like a\n * comment that does not exist, so the path segment cannot be swapped to reach a\n * thread the caller has no route to.\n */\nasync function requireCommentOnTask(route: RouteContext, commentId: string): Promise<StaffTimeTaskComment> {\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  const comment = await em.findOne(StaffTimeTaskComment, {\n    id: commentId,\n    taskId: route.taskId,\n    tenantId: route.scope.tenantId,\n    organizationId: route.scope.organizationId,\n    deletedAt: null,\n  })\n  if (!comment) throw commentNotFoundError(route.translate)\n  return comment\n}\n\ntype AuthorMeta = { name: string | null; email: string | null }\n\nasync function resolveAuthorMeta(\n  route: RouteContext,\n  authorUserIds: string[],\n): Promise<Map<string, AuthorMeta>> {\n  const map = new Map<string, AuthorMeta>()\n  const unique = Array.from(new Set(authorUserIds))\n  if (unique.length === 0) return map\n  try {\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const users = await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } },\n      undefined,\n      { tenantId: route.scope.tenantId, organizationId: route.scope.organizationId },\n    )\n    for (const user of users) {\n      const name = typeof user.name === 'string' && user.name.trim().length > 0 ? user.name.trim() : null\n      map.set(user.id, { name, email: user.email ?? null })\n    }\n  } catch (err) {\n    // A thread that renders without display names is still a usable thread.\n    logger.warn('staff.timesheets.task comments failed to resolve author metadata', { err })\n  }\n  return map\n}\n\nfunction serializeComment(comment: StaffTimeTaskComment, authors: Map<string, AuthorMeta>) {\n  const authorUserId = comment.authorUserId ?? null\n  const meta = authorUserId ? authors.get(authorUserId) ?? null : null\n  return {\n    id: comment.id,\n    taskId: comment.taskId,\n    body: comment.body,\n    authorUserId,\n    authorName: meta?.name ?? null,\n    authorEmail: meta?.email ?? null,\n    createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,\n    updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null,\n  }\n}\n\nasync function runGuards(\n  route: RouteContext,\n  operation: 'create' | 'update' | 'delete',\n  resourceId: string | null,\n  mutationPayload: Record<string, unknown> | null,\n) {\n  return runRouteMutationGuards({\n    container: route.ctx.container,\n    req: route.ctx.request as Request,\n    auth: {\n      userId: route.scope.userId,\n      tenantId: route.scope.tenantId,\n      organizationId: route.scope.organizationId,\n    },\n    input: {\n      resourceKind: RESOURCE_KIND,\n      resourceId,\n      operation,\n      mutationPayload,\n    },\n  })\n}\n\nfunction withOperationHeader(\n  response: NextResponse,\n  logEntry: {\n    id?: string\n    undoToken?: string | null\n    commandId?: string\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceId: string,\n): NextResponse {\n  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id: logEntry.id,\n      undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId,\n      actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n      resourceId: logEntry.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const query = listQuerySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const [comments, total] = await em.findAndCount(\n      StaffTimeTaskComment,\n      {\n        taskId: route.taskId,\n        tenantId: route.scope.tenantId,\n        organizationId: route.scope.organizationId,\n        deletedAt: null,\n      },\n      {\n        // Oldest first \u2014 the drawer reads the thread top to bottom.\n        orderBy: { createdAt: 'asc', id: 'asc' },\n        limit: query.pageSize,\n        offset: (query.page - 1) * query.pageSize,\n      },\n    )\n\n    const authors = await resolveAuthorMeta(\n      route,\n      comments.map((comment) => comment.authorUserId).filter((id): id is string => typeof id === 'string'),\n    )\n\n    return NextResponse.json({\n      items: comments.map((comment) => serializeComment(comment, authors)),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: query.pageSize > 0 ? Math.ceil(total / query.pageSize) : 0,\n    })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.tasks.comments.GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = createBodySchema.parse(raw ?? {})\n    // `authorUserId` is never forwarded: whatever the client sent is dropped\n    // here and the command stamps the authenticated caller instead.\n    const input = parseScopedCommandInput(\n      staffTimeTaskCommentCreateSchema,\n      { taskId: route.taskId, body: parsedBody.body },\n      route.ctx,\n      route.translate,\n    )\n\n    const guardResult = await runGuards(route, 'create', route.taskId, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      typeof input,\n      { commentId: string; taskId: string; authorUserId: string | null }\n    >(staffTimeTaskCommentCommandIds.create, { input, ctx: route.ctx })\n\n    await guardResult.runAfterSuccess()\n\n    const response = NextResponse.json(\n      {\n        id: result?.commentId ?? null,\n        taskId: route.taskId,\n        authorUserId: result?.authorUserId ?? null,\n      },\n      { status: 201 },\n    )\n    return withOperationHeader(response, logEntry, result?.commentId ?? route.taskId)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.POST failed')\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = updateBodySchema.parse(raw ?? {})\n    await requireCommentOnTask(route, parsedBody.id)\n\n    const input = staffTimeTaskCommentUpdateSchema.parse({ id: parsedBody.id, body: parsedBody.body })\n\n    const guardResult = await runGuards(route, 'update', input.id, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<typeof input, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.update,\n      { input, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, input.id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.PUT failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const raw = await readJsonSafe(req, {})\n    const rawId = url.searchParams.get('id') ?? (raw as { id?: unknown } | null)?.id\n    const id = z.string().uuid().parse(typeof rawId === 'string' ? rawId : undefined)\n    await requireCommentOnTask(route, id)\n\n    const guardResult = await runGuards(route, 'delete', id, { id })\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<{ id: string }, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.delete,\n      { input: { id }, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task comments',\n  methods: {\n    GET: {\n      summary: 'List task comments',\n      description:\n        'Returns the task comment thread oldest-first, with the author display name resolved for rendering. Answers 404 \u2014 identical to a task that does not exist \u2014 when the task belongs to a project the caller cannot see.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Comment thread', schema: listResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.view' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    POST: {\n      summary: 'Post a task comment',\n      description:\n        'Adds a comment to the task. The author is stamped from the authenticated caller \u2014 an authorUserId supplied by the client is ignored.',\n      requestBody: { contentType: 'application/json', schema: createBodySchema },\n      responses: [{ status: 201, description: 'Comment created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    PUT: {\n      summary: 'Edit a task comment',\n      description:\n        'Updates a comment body. Only the comment author may edit, unless the caller holds staff.timesheets.manage_all. Honours the optimistic-lock header.',\n      requestBody: { contentType: 'application/json', schema: updateBodySchema },\n      responses: [{ status: 200, description: 'Comment updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a task comment',\n      description:\n        'Soft-deletes a comment so its audit trail survives. Only the comment author may delete, unless the caller holds staff.timesheets.manage_all.',\n      requestBody: { contentType: 'application/json', schema: z.object({ id: z.string().uuid() }) },\n      responses: [{ status: 200, description: 'Comment deleted', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing comment id, task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA8BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AACrB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,0CAA0C;AACnD;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,gBAAgB,mCAAmC;AAEzD,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM,EAAE,OAAO;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAErD,MAAM,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAcrG,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,4BAA4B;AAC1E,UAAM,KAAK,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACvD,WAAO,MAAM,GAAG,SAAS,IAAI,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,KAAqC;AACpE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,IACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,IAAI,0BAA0B,KAAK,SAAS;AACnE,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,0DAA0D,sBAAsB;AAAA,IACnG,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,KAAK,OAAO,EAAE,UAAU,gBAAgB,OAAO,GAAG,WAAW,OAAO;AAC/E;AAOA,eAAe,kBAAkB,OAAoC;AACnE,QAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,WAAW,MAAM,KAAK;AAC3E,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,sBAAsB,IAAI,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,SAAS;AACpF;AAEA,SAAS,qBAAqB,WAAsE;AAClG,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,UAAU,oDAAoD,sCAAsC;AAAA,EAC7G,CAAC;AACH;AAOA,eAAe,qBAAqB,OAAqB,WAAkD;AACzG,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,UAAU,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACrD,IAAI;AAAA,IACJ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,qBAAqB,MAAM,SAAS;AACxD,SAAO;AACT;AAIA,eAAe,kBACb,OACA,eACkC;AAClC,QAAM,MAAM,oBAAI,IAAwB;AACxC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC;AAChD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/E;AACA,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI;AAC/F,UAAI,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,IACtD;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO,KAAK,oEAAoE,EAAE,IAAI,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA+B,SAAkC;AACzF,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,OAAO,eAAe,QAAQ,IAAI,YAAY,KAAK,OAAO;AAChE,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY,MAAM,QAAQ;AAAA,IAC1B,aAAa,MAAM,SAAS;AAAA,IAC5B,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,IACjE,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,EACnE;AACF;AAEA,eAAe,UACb,OACA,WACA,YACA,iBACA;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,MAAM,IAAI;AAAA,IACrB,KAAK,MAAM,IAAI;AAAA,IACf,MAAM;AAAA,MACJ,QAAQ,MAAM,MAAM;AAAA,MACpB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,UASA,oBACc;AACd,MAAI,CAAC,UAAU,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,UAAW,QAAO;AACxE,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB,IAAI,SAAS;AAAA,MACb,WAAW,SAAS;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS,eAAe;AAAA,MACrC,cAAc,SAAS,gBAAgB;AAAA,MACvC,YAAY,SAAS,cAAc;AAAA,MACnC,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,gBAAgB,MAAM;AAAA,MAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,CAAC,UAAU,KAAK,IAAI,MAAM,GAAG;AAAA,MACjC;AAAA,MACA;AAAA,QACE,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM;AAAA,QAC5B,WAAW;AAAA,MACb;AAAA,MACA;AAAA;AAAA,QAEE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,SAAS,IAAI,CAAC,YAAY,QAAQ,YAAY,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,IACrG;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,OAAO,CAAC;AAAA,MACnE;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AAGnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,QAAQ,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MAC9C,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,QAAQ,KAA2C;AAC9G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,+BAA+B,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAElE,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,aAAa;AAAA,MAC5B;AAAA,QACE,IAAI,QAAQ,aAAa;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,oBAAoB,UAAU,UAAU,QAAQ,aAAa,MAAM,MAAM;AAAA,EAClF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,6CAA6C;AAAA,EACzE;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AACnD,UAAM,qBAAqB,OAAO,WAAW,EAAE;AAE/C,UAAM,QAAQ,iCAAiC,MAAM,EAAE,IAAI,WAAW,IAAI,MAAM,WAAW,KAAK,CAAC;AAEjG,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,IAAI,KAA2C;AAC1G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,MAAM,EAAE;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAM,KAAiC;AAC9E,UAAM,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAS;AAChF,UAAM,qBAAqB,OAAO,EAAE;AAEpC,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,IAAI,EAAE,GAAG,CAAC;AAC/D,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,IAAI;AAAA,IAClC;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,+CAA+C;AAAA,EAC3E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Task comments (T3.4b) \u2014 the \"Komentarze (2)\" thread in the task drawer of\n * screen 7: avatar, author name, timestamp, body, and a composer that posts on\n * \u2318\u21B5.\n *\n * Hand-written rather than `makeCrudRoute`, for one reason that decides\n * everything else: **a caller who cannot see the task's project must not be able\n * to tell that the task exists.** A CRUD list would answer such a request with\n * an empty page \u2014 which is a different response from \"no such task\" and\n * therefore an existence oracle for every task id in the tenant. Here every\n * method funnels through the same `requireAccessibleTask` call before it touches\n * a comment, so \"not yours\" and \"does not exist\" produce one and the same 404\n * body, byte for byte.\n *\n * Because the route is hand-written it wires `runRouteMutationGuards` itself\n * (`packages/core/AGENTS.md` \u00A7 API Routes) \u2014 the same guard set every\n * `makeCrudRoute` write runs \u2014 and the writes go through the task-comment\n * commands so audit, undo, events and indexing stay consistent.\n *\n * Two more things the thread depends on:\n *\n *  - **Oldest first.** Screen 7 reads as a conversation, so the list sorts by\n *    `created_at ASC` with an id tiebreak, not the newest-first default a grid\n *    would want.\n *  - **The author's display name is resolved for rendering**, reusing the same\n *    `User` lookup `api/comments.ts` uses for the team-member timeline rather\n *    than inventing a cross-module join. A name that cannot be resolved degrades\n *    to `null` and the thread still renders \u2014 the comment is the record, the\n *    name is decoration.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { StaffTimeTaskComment } from '../../../../../data/entities'\nimport {\n  staffTimeTaskCommentCreateSchema,\n  staffTimeTaskCommentUpdateSchema,\n} from '../../../../../data/validators'\nimport { staffTimeTaskCommentCommandIds } from '../../../../../commands/timesheets-task-comments'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport {\n  loadTagProjectAccess as loadTaskProjectAccess,\n  requireAccessibleTask,\n  type TagAssignmentScope as TaskAccessScope,\n} from '../../../tags/access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/comments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTaskComment\n\nconst VIEW_FEATURE = 'staff.timesheets.tasks.view'\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n})\n\nconst commentItemSchema = z.object({\n  id: z.string().uuid(),\n  taskId: z.string().uuid(),\n  body: z.string(),\n  authorUserId: z.string().uuid().nullable(),\n  authorName: z.string().nullable(),\n  authorEmail: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(commentItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n  taskId: z.string().uuid(),\n  authorUserId: z.string().uuid().nullable(),\n})\n\nconst okResponseSchema = z.object({ ok: z.boolean() })\n\nconst createBodySchema = z.object({ body: z.string().trim().min(1).max(5000) })\nconst updateBodySchema = z.object({ id: z.string().uuid(), body: z.string().trim().min(1).max(5000) })\n\ntype RouteContext = {\n  ctx: CommandRuntimeContext\n  scope: TaskAccessScope\n  translate: (key: string, fallback?: string) => string\n  taskId: string\n}\n\n/**\n * The task id comes from the path segment. Read from the URL rather than the\n * handler's `params` argument so the route behaves identically under the app's\n * catch-all dispatcher and under a direct call in tests.\n */\nfunction extractTaskId(req: Request): string | null {\n  try {\n    const match = new URL(req.url).pathname.match(/\\/tasks\\/([^/]+)\\/comments/)\n    const id = match?.[1] ? decodeURIComponent(match[1]) : null\n    return id && id.length > 0 ? id : null\n  } catch {\n    return null\n  }\n}\n\nasync function buildRouteContext(req: Request): Promise<RouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const userId = auth.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const taskId = extractTaskId(req)\n  if (!taskId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.taskComments.errors.taskIdRequired', 'Task id is required.'),\n    })\n  }\n\n  return { ctx, scope: { tenantId, organizationId, userId }, translate, taskId }\n}\n\n/**\n * The single gate every method passes through. Resolving project access before\n * the task is loaded \u2014 and answering both misses with one body \u2014 is what keeps\n * the endpoint from confirming that a task the caller may not see exists.\n */\nasync function requireTaskAccess(route: RouteContext): Promise<void> {\n  const access = await loadTaskProjectAccess(route.ctx.container, route.scope)\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, route.taskId, route.scope, access, route.translate)\n}\n\nfunction commentNotFoundError(translate: (key: string, fallback?: string) => string): CrudHttpError {\n  return new CrudHttpError(404, {\n    error: translate('staff.time_tracking.taskComments.errors.notFound', 'Comment not found or not accessible.'),\n  })\n}\n\n/**\n * A comment addressed through another task's URL is refused exactly like a\n * comment that does not exist, so the path segment cannot be swapped to reach a\n * thread the caller has no route to.\n */\nasync function requireCommentOnTask(route: RouteContext, commentId: string): Promise<StaffTimeTaskComment> {\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  const comment = await em.findOne(StaffTimeTaskComment, {\n    id: commentId,\n    taskId: route.taskId,\n    tenantId: route.scope.tenantId,\n    organizationId: route.scope.organizationId,\n    deletedAt: null,\n  })\n  if (!comment) throw commentNotFoundError(route.translate)\n  return comment\n}\n\ntype AuthorMeta = { name: string | null; email: string | null }\n\nasync function resolveAuthorMeta(\n  route: RouteContext,\n  authorUserIds: string[],\n): Promise<Map<string, AuthorMeta>> {\n  const map = new Map<string, AuthorMeta>()\n  const unique = Array.from(new Set(authorUserIds))\n  if (unique.length === 0) return map\n  try {\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const users = await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } },\n      undefined,\n      { tenantId: route.scope.tenantId, organizationId: route.scope.organizationId },\n    )\n    for (const user of users) {\n      const name = typeof user.name === 'string' && user.name.trim().length > 0 ? user.name.trim() : null\n      map.set(user.id, { name, email: user.email ?? null })\n    }\n  } catch (err) {\n    // A thread that renders without display names is still a usable thread.\n    logger.warn('staff.timesheets.task comments failed to resolve author metadata', { err })\n  }\n  return map\n}\n\nfunction serializeComment(comment: StaffTimeTaskComment, authors: Map<string, AuthorMeta>) {\n  const authorUserId = comment.authorUserId ?? null\n  const meta = authorUserId ? authors.get(authorUserId) ?? null : null\n  return {\n    id: comment.id,\n    taskId: comment.taskId,\n    body: comment.body,\n    authorUserId,\n    authorName: meta?.name ?? null,\n    authorEmail: meta?.email ?? null,\n    createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,\n    updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null,\n  }\n}\n\nasync function runGuards(\n  route: RouteContext,\n  operation: 'create' | 'update' | 'delete',\n  resourceId: string | null,\n  mutationPayload: Record<string, unknown> | null,\n) {\n  return runRouteMutationGuards({\n    container: route.ctx.container,\n    req: route.ctx.request as Request,\n    auth: {\n      userId: route.scope.userId,\n      tenantId: route.scope.tenantId,\n      organizationId: route.scope.organizationId,\n    },\n    input: {\n      resourceKind: RESOURCE_KIND,\n      resourceId,\n      operation,\n      mutationPayload,\n    },\n  })\n}\n\nfunction withOperationHeader(\n  response: NextResponse,\n  logEntry: {\n    id?: string\n    undoToken?: string | null\n    commandId?: string\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceId: string,\n): NextResponse {\n  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id: logEntry.id,\n      undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId,\n      actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n      resourceId: logEntry.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const query = listQuerySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const [comments, total] = await em.findAndCount(\n      StaffTimeTaskComment,\n      {\n        taskId: route.taskId,\n        tenantId: route.scope.tenantId,\n        organizationId: route.scope.organizationId,\n        deletedAt: null,\n      },\n      {\n        // Oldest first \u2014 the drawer reads the thread top to bottom.\n        orderBy: { createdAt: 'asc', id: 'asc' },\n        limit: query.pageSize,\n        offset: (query.page - 1) * query.pageSize,\n      },\n    )\n\n    const authors = await resolveAuthorMeta(\n      route,\n      comments.map((comment) => comment.authorUserId).filter((id): id is string => typeof id === 'string'),\n    )\n\n    return NextResponse.json({\n      items: comments.map((comment) => serializeComment(comment, authors)),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: query.pageSize > 0 ? Math.ceil(total / query.pageSize) : 0,\n    })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.tasks.comments.GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = createBodySchema.parse(raw ?? {})\n    // `authorUserId` is never forwarded: whatever the client sent is dropped\n    // here and the command stamps the authenticated caller instead.\n    const input = parseScopedCommandInput(\n      staffTimeTaskCommentCreateSchema,\n      { taskId: route.taskId, body: parsedBody.body },\n      route.ctx,\n      route.translate,\n    )\n\n    const guardResult = await runGuards(route, 'create', route.taskId, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      typeof input,\n      { commentId: string; taskId: string; authorUserId: string | null }\n    >(staffTimeTaskCommentCommandIds.create, { input, ctx: route.ctx })\n\n    await guardResult.runAfterSuccess()\n\n    const response = NextResponse.json(\n      {\n        id: result?.commentId ?? null,\n        taskId: route.taskId,\n        authorUserId: result?.authorUserId ?? null,\n      },\n      { status: 201 },\n    )\n    return withOperationHeader(response, logEntry, result?.commentId ?? route.taskId)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.POST failed')\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = updateBodySchema.parse(raw ?? {})\n    await requireCommentOnTask(route, parsedBody.id)\n\n    const input = staffTimeTaskCommentUpdateSchema.parse({ id: parsedBody.id, body: parsedBody.body })\n\n    const guardResult = await runGuards(route, 'update', input.id, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<typeof input, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.update,\n      { input, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, input.id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.PUT failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const raw = await readJsonSafe(req, {})\n    const rawId = url.searchParams.get('id') ?? (raw as { id?: unknown } | null)?.id\n    const id = z.string().uuid().parse(typeof rawId === 'string' ? rawId : undefined)\n    await requireCommentOnTask(route, id)\n\n    const guardResult = await runGuards(route, 'delete', id, { id })\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<{ id: string }, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.delete,\n      { input: { id }, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task comments',\n  methods: {\n    GET: {\n      summary: 'List task comments',\n      description:\n        'Returns the task comment thread oldest-first, with the author display name resolved for rendering. Answers 404 \u2014 identical to a task that does not exist \u2014 when the task belongs to a project the caller cannot see.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Comment thread', schema: listResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.view' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    POST: {\n      summary: 'Post a task comment',\n      description:\n        'Adds a comment to the task. The author is stamped from the authenticated caller \u2014 an authorUserId supplied by the client is ignored.',\n      requestBody: { contentType: 'application/json', schema: createBodySchema },\n      responses: [{ status: 201, description: 'Comment created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    PUT: {\n      summary: 'Edit a task comment',\n      description:\n        'Updates a comment body. Only the comment author may edit, unless the caller holds staff.timesheets.manage_all. Honours the optimistic-lock header.',\n      requestBody: { contentType: 'application/json', schema: updateBodySchema },\n      responses: [{ status: 200, description: 'Comment updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a task comment',\n      description:\n        'Soft-deletes a comment so its audit trail survives. Only the comment author may delete, unless the caller holds staff.timesheets.manage_all.',\n      requestBody: { contentType: 'application/json', schema: z.object({ id: z.string().uuid() }) },\n      responses: [{ status: 200, description: 'Comment deleted', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing comment id, task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA8BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AACrB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,0CAA0C;AACnD;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,gBAAgB,mCAAmC;AAEzD,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM,EAAE,OAAO;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAErD,MAAM,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAcrG,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,4BAA4B;AAC1E,UAAM,KAAK,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACvD,WAAO,MAAM,GAAG,SAAS,IAAI,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,KAAqC;AACpE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,IACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,IAAI,0BAA0B,KAAK,SAAS;AACnE,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,0DAA0D,sBAAsB;AAAA,IACnG,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,KAAK,OAAO,EAAE,UAAU,gBAAgB,OAAO,GAAG,WAAW,OAAO;AAC/E;AAOA,eAAe,kBAAkB,OAAoC;AACnE,QAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,WAAW,MAAM,KAAK;AAC3E,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,sBAAsB,IAAI,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,SAAS;AACpF;AAEA,SAAS,qBAAqB,WAAsE;AAClG,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,UAAU,oDAAoD,sCAAsC;AAAA,EAC7G,CAAC;AACH;AAOA,eAAe,qBAAqB,OAAqB,WAAkD;AACzG,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,UAAU,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACrD,IAAI;AAAA,IACJ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,qBAAqB,MAAM,SAAS;AACxD,SAAO;AACT;AAIA,eAAe,kBACb,OACA,eACkC;AAClC,QAAM,MAAM,oBAAI,IAAwB;AACxC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC;AAChD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/E;AACA,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI;AAC/F,UAAI,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,IACtD;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO,KAAK,oEAAoE,EAAE,IAAI,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA+B,SAAkC;AACzF,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,OAAO,eAAe,QAAQ,IAAI,YAAY,KAAK,OAAO;AAChE,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY,MAAM,QAAQ;AAAA,IAC1B,aAAa,MAAM,SAAS;AAAA,IAC5B,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,IACjE,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,EACnE;AACF;AAEA,eAAe,UACb,OACA,WACA,YACA,iBACA;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,MAAM,IAAI;AAAA,IACrB,KAAK,MAAM,IAAI;AAAA,IACf,MAAM;AAAA,MACJ,QAAQ,MAAM,MAAM;AAAA,MACpB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,UASA,oBACc;AACd,MAAI,CAAC,UAAU,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,UAAW,QAAO;AACxE,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB,IAAI,SAAS;AAAA,MACb,WAAW,SAAS;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS,eAAe;AAAA,MACrC,cAAc,SAAS,gBAAgB;AAAA,MACvC,YAAY,SAAS,cAAc;AAAA,MACnC,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,gBAAgB,MAAM;AAAA,MAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,CAAC,UAAU,KAAK,IAAI,MAAM,GAAG;AAAA,MACjC;AAAA,MACA;AAAA,QACE,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM;AAAA,QAC5B,WAAW;AAAA,MACb;AAAA,MACA;AAAA;AAAA,QAEE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,SAAS,IAAI,CAAC,YAAY,QAAQ,YAAY,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,IACrG;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,OAAO,CAAC;AAAA,MACnE;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AAGnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,QAAQ,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MAC9C,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,QAAQ,KAA2C;AAC9G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,+BAA+B,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAElE,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,aAAa;AAAA,MAC5B;AAAA,QACE,IAAI,QAAQ,aAAa;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,oBAAoB,UAAU,UAAU,QAAQ,aAAa,MAAM,MAAM;AAAA,EAClF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,6CAA6C;AAAA,EACzE;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AACnD,UAAM,qBAAqB,OAAO,WAAW,EAAE;AAE/C,UAAM,QAAQ,iCAAiC,MAAM,EAAE,IAAI,WAAW,IAAI,MAAM,WAAW,KAAK,CAAC;AAEjG,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,IAAI,KAA2C;AAC1G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,MAAM,EAAE;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAM,KAAiC;AAC9E,UAAM,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAS;AAChF,UAAM,qBAAqB,OAAO,EAAE;AAEpC,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,IAAI,EAAE,GAAG,CAAC;AAC/D,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,IAAI;AAAA,IAClC;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,+CAA+C;AAAA,EAC3E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tasks/[id]/status/route.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -51,7 +52,7 @@ async function PATCH(req, context) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/tasks/[id]/status/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/status/route.ts"],
-  "sourcesContent": ["/**\n * The Kanban drag of screen 6 (US-C2), and the drawer's subtask tick, which is the\n * same move without a meaningful position.\n *\n * The board writes optimistically \u2014 the card lands in the new column before the\n * request completes \u2014 so this endpoint's contract is what makes the rollback in the\n * mockup's note 2 correct:\n *\n *  1. **The `updated_at` version travels with the drag.** Two people moving the same\n *     card is the one genuinely likely conflict on this board, so a stale\n *     `x-om-ext-optimistic-lock-expected-updated-at` answers 409 and the client puts\n *     the card back where it came from instead of overwriting the other move.\n *  2. **Project access is intersected before anything else is revealed.** The access\n *     decision reuses the tasks list route's memoised resolver, and a caller who is\n *     not a member gets the same 404 a missing task gets \u2014 the body never confirms\n *     the task exists.\n *  3. **The target column must belong to the task's own project.** A foreign column\n *     is refused by the command (422) rather than quietly accepted, because a task\n *     lives in exactly one project (\u00A72) and its board is that project's.\n *\n * The write itself is the `staff.timesheets.tasks.status_change` command, which owns\n * the `closed_at` stamping and emits `staff.timesheets.time_task.status_changed`.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeTask } from '../../../../../data/entities'\nimport { staffTimeTaskStatusChangeSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskCommandIds,\n  type StaffTimeTaskStatusChangeCommandInput,\n  type StaffTimeTaskStatusChangeResult,\n} from '../../../../../commands/timesheets-tasks'\nimport { assertProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { resolveListProjectAccess } from '../../route'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/status' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\ntype RouteContext = {\n  params?: Promise<Record<string, string | string[]>> | Record<string, string | string[]>\n}\n\nfunction extractTaskIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/tasks\\/([^/]+)\\/status/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveTaskId(req: Request, context?: RouteContext): Promise<string | null> {\n  const params = context?.params ? await context.params : null\n  const fromParams = params?.id\n  if (typeof fromParams === 'string' && fromParams.length > 0) return fromParams\n  return extractTaskIdFromUrl(req)\n}\n\nexport async function PATCH(req: Request, context?: RouteContext): Promise<Response> {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const taskId = await resolveTaskId(req, context)\n    if (!taskId || !z.string().uuid().safeParse(taskId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.time_tracking.tasks.errors.idRequired', 'Task id is required.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority, answering both\n    // questions this route asks: may the caller manage tasks, and what grant list\n    // do the interceptors and the mutation-guard registry gate on. The decision is\n    // checked unconditionally and fails closed; the list is plumbing and is empty \u2014\n    // never absent \u2014 when RBAC could not produce it.\n    const manageTasks = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!manageTasks.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageTasks.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeTaskStatusChangeSchema.parse(session.body)\n\n    const routeCtx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    // Membership is resolved against the task's project, so the lookup has to happen\n    // here. Both \"no such task\" and \"not your project\" answer with the same body.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const task = await em.findOne(StaffTimeTask, { id: taskId, tenantId, organizationId, deletedAt: null })\n    const access = task ? await resolveListProjectAccess(routeCtx) : null\n    if (!task || !access || !assertProjectAccess(access, task.timeProjectId)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.tasks.errors.notFound', 'Task not found or not accessible.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n        resourceId: taskId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? staffTimeTaskStatusChangeSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      StaffTimeTaskStatusChangeCommandInput,\n      StaffTimeTaskStatusChangeResult\n    >(staffTimeTaskCommandIds.statusChange, {\n      input: { ...effective, id: taskId },\n      ctx: routeCtx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.taskId ?? taskId,\n      timeProjectId: result?.timeProjectId ?? task.timeProjectId,\n      previousTaskStatusId: result?.previousTaskStatusId ?? null,\n      taskStatusId: result?.taskStatusId ?? effective.taskStatusId,\n      position: result?.position ?? null,\n      closedAt: result?.closedAt ?? null,\n      updatedAt: result?.updatedAt ?? null,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n          resourceId: logEntry.resourceId ?? taskId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.tasks.status PATCH failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst statusChangeResponseSchema = z.object({\n  id: z.string().uuid(),\n  timeProjectId: z.string().uuid(),\n  previousTaskStatusId: z.string().uuid().nullable(),\n  taskStatusId: z.string().uuid(),\n  position: z.number().int().nullable(),\n  closedAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst conflictSchema = z.object({\n  code: z.literal('optimistic_lock_conflict'),\n  error: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Move a task to another board column',\n  methods: {\n    PATCH: {\n      summary: 'Move a task to another board column',\n      description:\n        'Moves a task to the requested status column and slot. `position` is optional \u2014 omitting it appends the task to the end of the target column, which is what the drawer subtask tick does. The target status must belong to the task project (422 otherwise). Landing on a done column stamps `closedAt`, leaving one clears it. Send the record version in `x-om-ext-optimistic-lock-expected-updated-at`: a stale version answers 409 so an optimistic board can roll the card back to its origin column. Emits `staff.timesheets.time_task.status_changed`, which is bridged to connected boards.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeTaskStatusChangeSchema,\n      },\n      responses: [{ status: 200, description: 'Task moved', schema: statusChangeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid task id or body' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found, or not on a project the caller can see' },\n        { status: 409, description: 'The task changed since the version the caller sent', schema: conflictSchema },\n        { status: 422, description: 'The target column does not belong to this project' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,qBAAqB;AAC9B,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,8BAA8B,CAAC;AAEvF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAChE;AAMA,SAAS,qBAAqB,SAAkC;AAC9D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,0BAA0B;AAC3D,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,KAAc,SAAgD;AACzF,QAAM,SAAS,SAAS,SAAS,MAAM,QAAQ,SAAS;AACxD,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,QAAO;AACpE,SAAO,qBAAqB,GAAG;AACjC;AAEA,eAAsB,MAAM,KAAc,SAA2C;AACnF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,cAAc,KAAK,OAAO;AAC/C,QAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,EAAE,SAAS;AAC3D,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,sBAAsB;AAAA,MACxF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAM5B,UAAM,cAAc,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AACjH,QAAI,CAAC,YAAY,SAAS;AACxB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,YAAY;AAEpC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,gCAAgC,MAAM,QAAQ,IAAI;AAEjE,UAAM,WAAkC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAIA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,OAAO,MAAM,GAAG,QAAQ,eAAe,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AACtG,UAAM,SAAS,OAAO,MAAM,yBAAyB,QAAQ,IAAI;AACjE,QAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,QAAQ,KAAK,aAAa,GAAG;AACxE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6CAA6C,mCAAmC;AAAA,MACnG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,gCAAgC,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IACnF;AAEJ,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,wBAAwB,cAAc;AAAA,MACtC,OAAO,EAAE,GAAG,WAAW,IAAI,OAAO;AAAA,MAClC,KAAK;AAAA,IACP,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,UAAU;AAAA,MACtB,eAAe,QAAQ,iBAAiB,KAAK;AAAA,MAC7C,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,cAAc,QAAQ,gBAAgB,UAAU;AAAA,MAChD,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,2BAA2B,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sDAAsD,QAAQ,eAAe;AAAA,QACzG,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * The Kanban drag of screen 6 (US-C2), and the drawer's subtask tick, which is the\n * same move without a meaningful position.\n *\n * The board writes optimistically \u2014 the card lands in the new column before the\n * request completes \u2014 so this endpoint's contract is what makes the rollback in the\n * mockup's note 2 correct:\n *\n *  1. **The `updated_at` version travels with the drag.** Two people moving the same\n *     card is the one genuinely likely conflict on this board, so a stale\n *     `x-om-ext-optimistic-lock-expected-updated-at` answers 409 and the client puts\n *     the card back where it came from instead of overwriting the other move.\n *  2. **Project access is intersected before anything else is revealed.** The access\n *     decision reuses the tasks list route's memoised resolver, and a caller who is\n *     not a member gets the same 404 a missing task gets \u2014 the body never confirms\n *     the task exists.\n *  3. **The target column must belong to the task's own project.** A foreign column\n *     is refused by the command (422) rather than quietly accepted, because a task\n *     lives in exactly one project (\u00A72) and its board is that project's.\n *\n * The write itself is the `staff.timesheets.tasks.status_change` command, which owns\n * the `closed_at` stamping and emits `staff.timesheets.time_task.status_changed`.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeTask } from '../../../../../data/entities'\nimport { staffTimeTaskStatusChangeSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskCommandIds,\n  type StaffTimeTaskStatusChangeCommandInput,\n  type StaffTimeTaskStatusChangeResult,\n} from '../../../../../commands/timesheets-tasks'\nimport { assertProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { resolveListProjectAccess } from '../../route'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/status' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\ntype RouteContext = {\n  params?: Promise<Record<string, string | string[]>> | Record<string, string | string[]>\n}\n\nfunction extractTaskIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/tasks\\/([^/]+)\\/status/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveTaskId(req: Request, context?: RouteContext): Promise<string | null> {\n  const params = context?.params ? await context.params : null\n  const fromParams = params?.id\n  if (typeof fromParams === 'string' && fromParams.length > 0) return fromParams\n  return extractTaskIdFromUrl(req)\n}\n\nexport async function PATCH(req: Request, context?: RouteContext): Promise<Response> {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const taskId = await resolveTaskId(req, context)\n    if (!taskId || !z.string().uuid().safeParse(taskId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.time_tracking.tasks.errors.idRequired', 'Task id is required.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority, answering both\n    // questions this route asks: may the caller manage tasks, and what grant list\n    // do the interceptors and the mutation-guard registry gate on. The decision is\n    // checked unconditionally and fails closed; the list is plumbing and is empty \u2014\n    // never absent \u2014 when RBAC could not produce it.\n    const manageTasks = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!manageTasks.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageTasks.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeTaskStatusChangeSchema.parse(session.body)\n\n    const routeCtx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    // Membership is resolved against the task's project, so the lookup has to happen\n    // here. Both \"no such task\" and \"not your project\" answer with the same body.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const task = await em.findOne(StaffTimeTask, { id: taskId, tenantId, organizationId, deletedAt: null })\n    const access = task ? await resolveListProjectAccess(routeCtx) : null\n    if (!task || !access || !assertProjectAccess(access, task.timeProjectId)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.tasks.errors.notFound', 'Task not found or not accessible.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n        resourceId: taskId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? staffTimeTaskStatusChangeSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      StaffTimeTaskStatusChangeCommandInput,\n      StaffTimeTaskStatusChangeResult\n    >(staffTimeTaskCommandIds.statusChange, {\n      input: { ...effective, id: taskId },\n      ctx: routeCtx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.taskId ?? taskId,\n      timeProjectId: result?.timeProjectId ?? task.timeProjectId,\n      previousTaskStatusId: result?.previousTaskStatusId ?? null,\n      taskStatusId: result?.taskStatusId ?? effective.taskStatusId,\n      position: result?.position ?? null,\n      closedAt: result?.closedAt ?? null,\n      updatedAt: result?.updatedAt ?? null,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n          resourceId: logEntry.resourceId ?? taskId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.tasks.status PATCH failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst statusChangeResponseSchema = z.object({\n  id: z.string().uuid(),\n  timeProjectId: z.string().uuid(),\n  previousTaskStatusId: z.string().uuid().nullable(),\n  taskStatusId: z.string().uuid(),\n  position: z.number().int().nullable(),\n  closedAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst conflictSchema = z.object({\n  code: z.literal('optimistic_lock_conflict'),\n  error: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Move a task to another board column',\n  methods: {\n    PATCH: {\n      summary: 'Move a task to another board column',\n      description:\n        'Moves a task to the requested status column and slot. `position` is optional \u2014 omitting it appends the task to the end of the target column, which is what the drawer subtask tick does. The target status must belong to the task project (422 otherwise). Landing on a done column stamps `closedAt`, leaving one clears it. Send the record version in `x-om-ext-optimistic-lock-expected-updated-at`: a stale version answers 409 so an optimistic board can roll the card back to its origin column. Emits `staff.timesheets.time_task.status_changed`, which is bridged to connected boards.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeTaskStatusChangeSchema,\n      },\n      responses: [{ status: 200, description: 'Task moved', schema: statusChangeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid task id or body' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found, or not on a project the caller can see' },\n        { status: 409, description: 'The task changed since the version the caller sent', schema: conflictSchema },\n        { status: 422, description: 'The target column does not belong to this project' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,qBAAqB;AAC9B,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,8BAA8B,CAAC;AAEvF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAChE;AAMA,SAAS,qBAAqB,SAAkC;AAC9D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,0BAA0B;AAC3D,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,KAAc,SAAgD;AACzF,QAAM,SAAS,SAAS,SAAS,MAAM,QAAQ,SAAS;AACxD,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,QAAO;AACpE,SAAO,qBAAqB,GAAG;AACjC;AAEA,eAAsB,MAAM,KAAc,SAA2C;AACnF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,cAAc,KAAK,OAAO;AAC/C,QAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,EAAE,SAAS;AAC3D,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,sBAAsB;AAAA,MACxF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAM5B,UAAM,cAAc,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AACjH,QAAI,CAAC,YAAY,SAAS;AACxB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,YAAY;AAEpC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,gCAAgC,MAAM,QAAQ,IAAI;AAEjE,UAAM,WAAkC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAIA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,OAAO,MAAM,GAAG,QAAQ,eAAe,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AACtG,UAAM,SAAS,OAAO,MAAM,yBAAyB,QAAQ,IAAI;AACjE,QAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,QAAQ,KAAK,aAAa,GAAG;AACxE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6CAA6C,mCAAmC;AAAA,MACnG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,gCAAgC,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IACnF;AAEJ,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,wBAAwB,cAAc;AAAA,MACtC,OAAO,EAAE,GAAG,WAAW,IAAI,OAAO;AAAA,MAClC,KAAK;AAAA,IACP,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,UAAU;AAAA,MACtB,eAAe,QAAQ,iBAAiB,KAAK;AAAA,MAC7C,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,cAAc,QAAQ,gBAAgB,UAAU;AAAA,MAChD,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,2BAA2B,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sDAAsD,QAAQ,eAAe;AAAA,QACzG,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/duplicate/route.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -86,7 +87,7 @@ async function POST(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
@@ -149,7 +150,7 @@ async function POST(req) {
       container,
       auth,
       organizationScope: scope,
-      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
       organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req
     };

package/dist/modules/staff/api/timesheets/time-entries/[id]/duplicate/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/duplicate/route.ts"],
-  "sourcesContent": ["/**\n * US-D6 \u2014 \"repeat yesterday\", for one entry.\n *\n * The row action on screen 10 and the per-row copy button on screen 1 both land\n * here. The route is deliberately thin: T4.2 already put the whole copy in the\n * `staff.timesheets.time_entries.duplicate` command, which resolves the SOURCE,\n * runs it past the lock gate and then delegates the write to the create command\n * so the copy inherits ownership enforcement, project access, the billable and\n * currency defaults, rounding (D-7), tag syncing and the audit entry unchanged.\n * Nothing here re-implements any of that.\n *\n * Two things the route owns that the command cannot:\n *\n *  1. **Existence is decided by the caller's project access, not by the row.** The\n *     source is looked up through the same intersection the list route applies \u2014\n *     entries on projects the caller belongs to, plus their own project-less\n *     entries \u2014 and anything outside it answers `404`, never `403`. A `403` on a\n *     project the caller cannot see would confirm the entry exists and name the\n *     project it belongs to.\n *  2. **`date` and `durationMinutes` overrides.** US-D6 ends with \"I adjust the\n *     duration and the date\", so both travel with the copy request instead of\n *     costing a follow-up PUT that would briefly show the wrong duration.\n *\n * `tagIds` is passed in by the caller rather than read off the junction: the\n * command writes tags only through the tag commands and never touches\n * `staff_time_entry_tags`, and the client already holds the source's `tags[]`\n * from the list response.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry } from '../../../../../data/entities'\nimport { staffTimeEntryCommandIds } from '../../../../../commands/timesheets-entries'\nimport { resolveProjectAccess, type ProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../../../lib/time-tracking/settings'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/duplicate' })\n\nconst MANAGE_OWN_FEATURE = 'staff.timesheets.manage_own'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_OWN_FEATURE] },\n}\n\nconst duplicateRequestSchema = z.object({\n  date: z.coerce.date().optional(),\n  durationMinutes: z.number().int().min(0).max(1440).optional(),\n  tagIds: z.array(z.string().uuid()).max(50).optional(),\n})\n\nconst duplicateResponseSchema = z.object({\n  id: z.string().uuid(),\n  sourceId: z.string().uuid(),\n})\n\nconst lockedConflictSchema = z.object({\n  code: z.literal('time_entry_locked'),\n  error: z.string(),\n  lockedReportId: z.string().uuid().nullable(),\n  lockedEntryIds: z.array(z.string().uuid()),\n  lockedReportIds: z.array(z.string().uuid()),\n})\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/duplicate/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string,\n  organizationId: string,\n  grantedFeatures: readonly string[],\n): Promise<ProjectAccess> {\n  const em = container.resolve('em') as EntityManager\n  return resolveProjectAccess({\n    em: em.fork(),\n    userId,\n    tenantId,\n    organizationId,\n    userFeatures: grantedFeatures,\n    assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n  })\n}\n\n/**\n * The per-row form of the list route's `$or` intersection: an entry on a project\n * is visible to the members of that project, and a project-less entry is visible\n * only to the member who logged it.\n */\nfunction isTimeEntryVisible(\n  entry: { staffMemberId: string; timeProjectId?: string | null },\n  access: ProjectAccess,\n): boolean {\n  if (access.canManageAll) return true\n  const projectId = entry.timeProjectId ?? null\n  if (projectId) return access.projectIds.includes(projectId)\n  return access.staffMemberId !== null && access.staffMemberId === entry.staffMemberId\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const timeEntryId = extractEntryIdFromUrl(req)\n    if (!timeEntryId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const manageOwn = await resolveFeatureAccess(container, actorId, [MANAGE_OWN_FEATURE], { tenantId, organizationId })\n    if (!manageOwn.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageOwn.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = duplicateRequestSchema.parse(session.body)\n\n    // The source is resolved here, before the command, purely so an entry the\n    // caller cannot see answers 404 instead of the command's 403 \u2014 which would\n    // confirm the entry exists and name the project that hides it.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const source = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: timeEntryId, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    const access = await loadProjectAccess(container, actorId || null, tenantId, organizationId, grantedFeatures)\n    if (!source || !isTimeEntryVisible(source, access)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found, deleted, or not owned by you.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: timeEntryId,\n        operation: 'create',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? duplicateRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<unknown, { timeEntryId: string }>(\n      staffTimeEntryCommandIds.duplicate,\n      { input: { ...effective, id: timeEntryId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    if (result?.timeEntryId) {\n      void emitStaffEvent('staff.timesheets.time_entry.copied', {\n        id: result.timeEntryId,\n        sourceId: timeEntryId,\n        tenantId,\n        organizationId,\n      }, { persistent: true }).catch((err) => {\n        logger.error('staff.timesheets emit time_entry.copied failed', { err })\n      })\n    }\n\n    return session.respond(201, { id: result?.timeEntryId ?? null, sourceId: timeEntryId })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.time-entries.duplicate failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Duplicate a time entry',\n  methods: {\n    POST: {\n      summary: 'Duplicate a time entry',\n      description:\n        'US-D6. Copies an existing time entry, carrying its task, project, description, billable flag and rate override across. `date` and `durationMinutes` override the copy without a second request; `tagIds` sets the copy tag set (the caller passes the source tags it already holds from the list response). The copy is written through the create command, so ownership, project access, the billable and currency defaults, and the tenant rounding rule apply to it exactly as they do to a hand-made entry. A source locked into a closed report is refused with 409 `time_entry_locked`; a source the caller cannot see answers 404.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: duplicateRequestSchema,\n      },\n      responses: [\n        { status: 201, description: 'Copy created', schema: duplicateResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.manage_own' },\n        { status: 404, description: 'Time entry not found, deleted, or outside the caller project access' },\n        {\n          status: 409,\n          description: 'The source entry is locked into a closed report; nothing was copied',\n          schema: lockedConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA6BA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,0CAA0C;AAGnD,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,4BAAgD;AACzD,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,qBAAqB;AAC3B,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,mBAAmB;AAAA,EACnC,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC5C,CAAC;AAID,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,oCAAoC;AACrE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACA,iBACwB;AACxB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO,qBAAqB;AAAA,IAC1B,IAAI,GAAG,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,EAC3E,CAAC;AACH;AAOA,SAAS,mBACP,OACA,QACS;AACT,MAAI,OAAO,aAAc,QAAO;AAChC,QAAM,YAAY,MAAM,iBAAiB;AACzC,MAAI,UAAW,QAAO,OAAO,WAAW,SAAS,SAAS;AAC1D,SAAO,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,MAAM;AACzE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,sBAAsB,GAAG;AAC7C,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,0CAA0C,mBAAmB;AAAA,MAChF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAI5B,UAAM,YAAY,MAAM,qBAAqB,WAAW,SAAS,CAAC,kBAAkB,GAAG,EAAE,UAAU,eAAe,CAAC;AACnH,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,UAAU;AAElC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,uBAAuB,MAAM,QAAQ,IAAI;AAKxD,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,aAAa,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC7D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,SAAS,MAAM,kBAAkB,WAAW,WAAW,MAAM,UAAU,gBAAgB,eAAe;AAC5G,QAAI,CAAC,UAAU,CAAC,mBAAmB,QAAQ,MAAM,GAAG;AAClD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,qDAAqD;AAAA,MACjH,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,uBAAuB,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC1E;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,MAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC,yBAAyB;AAAA,MACzB,EAAE,OAAO,EAAE,GAAG,WAAW,IAAI,YAAY,GAAG,IAAI;AAAA,IAClD;AAEA,UAAM,YAAY,gBAAgB;AAElC,QAAI,QAAQ,aAAa;AACvB,WAAK,eAAe,sCAAsC;AAAA,QACxD,IAAI,OAAO;AAAA,QACX,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,eAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,QAAQ,eAAe,MAAM,UAAU,YAAY,CAAC;AAAA,EACxF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,wBAAwB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * US-D6 \u2014 \"repeat yesterday\", for one entry.\n *\n * The row action on screen 10 and the per-row copy button on screen 1 both land\n * here. The route is deliberately thin: T4.2 already put the whole copy in the\n * `staff.timesheets.time_entries.duplicate` command, which resolves the SOURCE,\n * runs it past the lock gate and then delegates the write to the create command\n * so the copy inherits ownership enforcement, project access, the billable and\n * currency defaults, rounding (D-7), tag syncing and the audit entry unchanged.\n * Nothing here re-implements any of that.\n *\n * Two things the route owns that the command cannot:\n *\n *  1. **Existence is decided by the caller's project access, not by the row.** The\n *     source is looked up through the same intersection the list route applies \u2014\n *     entries on projects the caller belongs to, plus their own project-less\n *     entries \u2014 and anything outside it answers `404`, never `403`. A `403` on a\n *     project the caller cannot see would confirm the entry exists and name the\n *     project it belongs to.\n *  2. **`date` and `durationMinutes` overrides.** US-D6 ends with \"I adjust the\n *     duration and the date\", so both travel with the copy request instead of\n *     costing a follow-up PUT that would briefly show the wrong duration.\n *\n * `tagIds` is passed in by the caller rather than read off the junction: the\n * command writes tags only through the tag commands and never touches\n * `staff_time_entry_tags`, and the client already holds the source's `tags[]`\n * from the list response.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry } from '../../../../../data/entities'\nimport { staffTimeEntryCommandIds } from '../../../../../commands/timesheets-entries'\nimport { resolveProjectAccess, type ProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../../../lib/time-tracking/settings'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/duplicate' })\n\nconst MANAGE_OWN_FEATURE = 'staff.timesheets.manage_own'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_OWN_FEATURE] },\n}\n\nconst duplicateRequestSchema = z.object({\n  date: z.coerce.date().optional(),\n  durationMinutes: z.number().int().min(0).max(1440).optional(),\n  tagIds: z.array(z.string().uuid()).max(50).optional(),\n})\n\nconst duplicateResponseSchema = z.object({\n  id: z.string().uuid(),\n  sourceId: z.string().uuid(),\n})\n\nconst lockedConflictSchema = z.object({\n  code: z.literal('time_entry_locked'),\n  error: z.string(),\n  lockedReportId: z.string().uuid().nullable(),\n  lockedEntryIds: z.array(z.string().uuid()),\n  lockedReportIds: z.array(z.string().uuid()),\n})\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/duplicate/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string,\n  organizationId: string,\n  grantedFeatures: readonly string[],\n): Promise<ProjectAccess> {\n  const em = container.resolve('em') as EntityManager\n  return resolveProjectAccess({\n    em: em.fork(),\n    userId,\n    tenantId,\n    organizationId,\n    userFeatures: grantedFeatures,\n    assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n  })\n}\n\n/**\n * The per-row form of the list route's `$or` intersection: an entry on a project\n * is visible to the members of that project, and a project-less entry is visible\n * only to the member who logged it.\n */\nfunction isTimeEntryVisible(\n  entry: { staffMemberId: string; timeProjectId?: string | null },\n  access: ProjectAccess,\n): boolean {\n  if (access.canManageAll) return true\n  const projectId = entry.timeProjectId ?? null\n  if (projectId) return access.projectIds.includes(projectId)\n  return access.staffMemberId !== null && access.staffMemberId === entry.staffMemberId\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const timeEntryId = extractEntryIdFromUrl(req)\n    if (!timeEntryId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const manageOwn = await resolveFeatureAccess(container, actorId, [MANAGE_OWN_FEATURE], { tenantId, organizationId })\n    if (!manageOwn.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageOwn.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = duplicateRequestSchema.parse(session.body)\n\n    // The source is resolved here, before the command, purely so an entry the\n    // caller cannot see answers 404 instead of the command's 403 \u2014 which would\n    // confirm the entry exists and name the project that hides it.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const source = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: timeEntryId, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    const access = await loadProjectAccess(container, actorId || null, tenantId, organizationId, grantedFeatures)\n    if (!source || !isTimeEntryVisible(source, access)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found, deleted, or not owned by you.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: timeEntryId,\n        operation: 'create',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? duplicateRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<unknown, { timeEntryId: string }>(\n      staffTimeEntryCommandIds.duplicate,\n      { input: { ...effective, id: timeEntryId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    if (result?.timeEntryId) {\n      void emitStaffEvent('staff.timesheets.time_entry.copied', {\n        id: result.timeEntryId,\n        sourceId: timeEntryId,\n        tenantId,\n        organizationId,\n      }, { persistent: true }).catch((err) => {\n        logger.error('staff.timesheets emit time_entry.copied failed', { err })\n      })\n    }\n\n    return session.respond(201, { id: result?.timeEntryId ?? null, sourceId: timeEntryId })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.time-entries.duplicate failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Duplicate a time entry',\n  methods: {\n    POST: {\n      summary: 'Duplicate a time entry',\n      description:\n        'US-D6. Copies an existing time entry, carrying its task, project, description, billable flag and rate override across. `date` and `durationMinutes` override the copy without a second request; `tagIds` sets the copy tag set (the caller passes the source tags it already holds from the list response). The copy is written through the create command, so ownership, project access, the billable and currency defaults, and the tenant rounding rule apply to it exactly as they do to a hand-made entry. A source locked into a closed report is refused with 409 `time_entry_locked`; a source the caller cannot see answers 404.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: duplicateRequestSchema,\n      },\n      responses: [\n        { status: 201, description: 'Copy created', schema: duplicateResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.manage_own' },\n        { status: 404, description: 'Time entry not found, deleted, or outside the caller project access' },\n        {\n          status: 409,\n          description: 'The source entry is locked into a closed report; nothing was copied',\n          schema: lockedConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA6BA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,0CAA0C;AAGnD,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,4BAAgD;AACzD,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,qBAAqB;AAC3B,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,mBAAmB;AAAA,EACnC,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC5C,CAAC;AAID,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,oCAAoC;AACrE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACA,iBACwB;AACxB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO,qBAAqB;AAAA,IAC1B,IAAI,GAAG,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,EAC3E,CAAC;AACH;AAOA,SAAS,mBACP,OACA,QACS;AACT,MAAI,OAAO,aAAc,QAAO;AAChC,QAAM,YAAY,MAAM,iBAAiB;AACzC,MAAI,UAAW,QAAO,OAAO,WAAW,SAAS,SAAS;AAC1D,SAAO,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,MAAM;AACzE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,sBAAsB,GAAG;AAC7C,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,0CAA0C,mBAAmB;AAAA,MAChF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAI5B,UAAM,YAAY,MAAM,qBAAqB,WAAW,SAAS,CAAC,kBAAkB,GAAG,EAAE,UAAU,eAAe,CAAC;AACnH,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,UAAU;AAElC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,uBAAuB,MAAM,QAAQ,IAAI;AAKxD,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,aAAa,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC7D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,SAAS,MAAM,kBAAkB,WAAW,WAAW,MAAM,UAAU,gBAAgB,eAAe;AAC5G,QAAI,CAAC,UAAU,CAAC,mBAAmB,QAAQ,MAAM,GAAG;AAClD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,qDAAqD;AAAA,MACjH,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,uBAAuB,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC1E;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,MAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC,yBAAyB;AAAA,MACzB,EAAE,OAAO,EAAE,GAAG,WAAW,IAAI,YAAY,GAAG,IAAI;AAAA,IAClD;AAEA,UAAM,YAAY,gBAAgB;AAElC,QAAI,QAAQ,aAAa;AACvB,WAAK,eAAe,sCAAsC;AAAA,QACxD,IAAI,OAAO;AAAA,QACX,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,eAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,QAAQ,eAAe,MAAM,UAAU,YAAY,CAAC;AAAA,EACxF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,wBAAwB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -50,7 +51,7 @@ async function PATCH(req) {
   const container = await createRequestContainer();
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!tenantId || !organizationId) {
     return NextResponse.json({ error: "Missing tenant or organization scope." }, { status: 400 });
   }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/segments/%5BsegmentId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport { emitStaffEvent } from '../../../../../../events'\nimport { runTimesheetInterceptors } from '../../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/segments' })\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: 'PATCH',\n    scope: { container, userId: auth.sub, tenantId, organizationId },\n    body: rawBody,\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...session.body, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  void emitStaffEvent('staff.timesheets.time_entry_segment.updated', {\n    id: updatedSegment.id,\n    timeEntryId: updatedSegment.timeEntryId,\n    tenantId,\n    organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry_segment.updated failed', { err })\n  })\n\n  return session.respond(200, {\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,QAAQ,MAAM,IAAI,IAAI,UAAU,CAAC;AACjG,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,OAAK,eAAe,+CAA+C;AAAA,IACjE,IAAI,eAAe;AAAA,IACnB,aAAa,eAAe;AAAA,IAC5B;AAAA,IACA;AAAA,EACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,EACjF,CAAC;AAED,SAAO,QAAQ,QAAQ,KAAK;AAAA,IAC1B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport { emitStaffEvent } from '../../../../../../events'\nimport { runTimesheetInterceptors } from '../../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/segments' })\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: 'PATCH',\n    scope: { container, userId: auth.sub, tenantId, organizationId },\n    body: rawBody,\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...session.body, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  void emitStaffEvent('staff.timesheets.time_entry_segment.updated', {\n    id: updatedSegment.id,\n    timeEntryId: updatedSegment.timeEntryId,\n    tenantId,\n    organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry_segment.updated failed', { err })\n  })\n\n  return session.respond(200, {\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,QAAQ,MAAM,IAAI,IAAI,UAAU,CAAC;AACjG,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,OAAK,eAAe,+CAA+C;AAAA,IACjE,IAAI,eAAe;AAAA,IACnB,aAAa,eAAe;AAAA,IAC5B;AAAA,IACA;AAAA,EACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,EACjF,CAAC;AAED,SAAO,QAAQ,QAAQ,KAAK;AAAA,IAC1B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
@@ -42,7 +43,7 @@ async function POST(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }