iobroker.time-tracker 0.4.1 → 0.4.3

package/build/lib/web/api.js

@@ -813,7 +813,7 @@ function createApi(deps) {
     });
   });
   route("POST", "/absences", { permission: "absence.request", csrf: true }, (context) => {
-    var _a2, _b2, _c2, _d2, _e;
+    var _a2, _b2, _c2, _d2, _e, _f, _g;
     if (!context.auth) {
       throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
     }
@@ -825,19 +825,35 @@ function createApi(deps) {
     }
     const mayDecide = context.auth.permissions.includes("absence.edit_other");
     const approval = mayDecide ? "approved" : "requested";
+    if (!mayDecide) {
+      const wanted = absences.findType(
+        (_b2 = (_a2 = optionalNumber(body, "typeId")) != null ? _a2 : optionalString(body, "typeCode")) != null ? _b2 : "",
+        userId
+      );
+      if (!wanted) {
+        throw new import_errors.ValidationError("unknown absence type");
+      }
+      if (!wanted.isActive) {
+        throw (0, import_problem.problem)(
+          403,
+          "permission_denied",
+          "request rejected (permission_denied: absence type is not public)"
+        );
+      }
+    }
     const created = absences.create({
       userId,
-      typeCode: (_a2 = optionalString(body, "typeCode")) != null ? _a2 : void 0,
-      typeId: (_b2 = optionalNumber(body, "typeId")) != null ? _b2 : void 0,
+      typeCode: (_c2 = optionalString(body, "typeCode")) != null ? _c2 : void 0,
+      typeId: (_d2 = optionalNumber(body, "typeId")) != null ? _d2 : void 0,
       dateFrom: requireString(body, "dateFrom"),
-      dateTo: (_c2 = optionalString(body, "dateTo")) != null ? _c2 : void 0,
-      dayPortion: (_d2 = optionalNumber(body, "dayPortion")) != null ? _d2 : void 0,
+      dateTo: (_e = optionalString(body, "dateTo")) != null ? _e : void 0,
+      dayPortion: (_f = optionalNumber(body, "dayPortion")) != null ? _f : void 0,
       hours: optionalNumber(body, "hours"),
       status: status != null ? status : void 0,
       approval,
       note: optionalString(body, "note"),
       actorId: context.auth.user.id,
-      actorIp: (_e = context.request.remoteAddress) != null ? _e : null,
+      actorIp: (_g = context.request.remoteAddress) != null ? _g : null,
       now: now()
     });
     emit({ type: "absence.change", userId, data: { absenceId: created.id, action: "created" } });
@@ -897,7 +913,7 @@ function createApi(deps) {
     return absence;
   };
   route("PATCH", "/absences/:id", { permission: "absence.request", csrf: true }, (context) => {
-    var _a2, _b2, _c2, _d2, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
+    var _a2, _b2, _c2, _d2, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t;
     const absence = changeableAbsence(context);
     const body = context.jsonBody();
     const status = optionalString(body, "status");
@@ -917,12 +933,25 @@ function createApi(deps) {
       ...Object.prototype.hasOwnProperty.call(body, "note") ? { note: optionalString(body, "note") } : {}
     };
     const hasFields = Object.values(patch).some((value) => value !== void 0);
+    if (hasFields && !((_g = context.auth) == null ? void 0 : _g.permissions.includes("absence.edit_other")) && (patch.typeId !== void 0 || patch.typeCode !== void 0)) {
+      const wanted = absences.findType((_i = (_h = patch.typeId) != null ? _h : patch.typeCode) != null ? _i : "", absence.userId);
+      if (!wanted) {
+        throw new import_errors.ValidationError("unknown absence type");
+      }
+      if (!wanted.isActive) {
+        throw (0, import_problem.problem)(
+          403,
+          "permission_denied",
+          "request rejected (permission_denied: absence type is not public)"
+        );
+      }
+    }
     if (status !== null) {
       absences.setStatus({
         id: absence.id,
         status,
-        actorId: (_h = (_g = context.auth) == null ? void 0 : _g.user.id) != null ? _h : 0,
-        actorIp: (_i = context.request.remoteAddress) != null ? _i : null,
+        actorId: (_k = (_j = context.auth) == null ? void 0 : _j.user.id) != null ? _k : 0,
+        actorIp: (_l = context.request.remoteAddress) != null ? _l : null,
         now: now()
       });
     }
@@ -930,16 +959,16 @@ function createApi(deps) {
       id: absence.id,
       patch,
       reason: optionalString(body, "reason"),
-      actorId: (_k = (_j = context.auth) == null ? void 0 : _j.user.id) != null ? _k : 0,
-      actorIp: (_l = context.request.remoteAddress) != null ? _l : null,
+      actorId: (_n = (_m = context.auth) == null ? void 0 : _m.user.id) != null ? _n : 0,
+      actorIp: (_o = context.request.remoteAddress) != null ? _o : null,
       now: now()
-    }) : (_m = absences.findById(absence.id)) != null ? _m : absence;
-    const updated = hasFields && !((_n = context.auth) == null ? void 0 : _n.permissions.includes("absence.edit_other")) && changed.approval !== "requested" ? absences.setApproval({
+    }) : (_p = absences.findById(absence.id)) != null ? _p : absence;
+    const updated = hasFields && !((_q = context.auth) == null ? void 0 : _q.permissions.includes("absence.edit_other")) && changed.approval !== "requested" ? absences.setApproval({
       id: changed.id,
       approval: "requested",
       note: null,
-      actorId: (_p = (_o = context.auth) == null ? void 0 : _o.user.id) != null ? _p : 0,
-      actorIp: (_q = context.request.remoteAddress) != null ? _q : null,
+      actorId: (_s = (_r = context.auth) == null ? void 0 : _r.user.id) != null ? _s : 0,
+      actorIp: (_t = context.request.remoteAddress) != null ? _t : null,
       now: now()
     }) : changed;
     emit({ type: "absence.change", userId: updated.userId, data: { absenceId: updated.id, action: "updated" } });
@@ -960,15 +989,13 @@ function createApi(deps) {
     emit({ type: "absence.change", userId: absence.userId, data: { absenceId: absence.id, action: "deleted" } });
     return (0, import_router.noContent)();
   });
-  route(
-    "GET",
-    "/absence-types",
-    {},
-    (context) => {
-      var _a2, _b2;
-      return (0, import_router.json)(200, { types: absences.types({ userId: (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : null }) });
-    }
-  );
+  route("GET", "/absence-types", {}, (context) => {
+    var _a2, _b2, _c2, _d2;
+    const includeInactive = context.query("includeInactive") === "true" && ((_b2 = (_a2 = context.auth) == null ? void 0 : _a2.permissions.includes("absence.manage_types")) != null ? _b2 : false);
+    return (0, import_router.json)(200, {
+      types: absences.types({ userId: (_d2 = (_c2 = context.auth) == null ? void 0 : _c2.user.id) != null ? _d2 : null, includeInactive })
+    });
+  });
   route("POST", "/absence-types", { permission: "absence.manage_types", csrf: true }, (context) => {
     var _a2, _b2, _c2, _d2, _e;
     if (!context.auth) {
@@ -989,6 +1016,22 @@ function createApi(deps) {
     });
     return (0, import_router.json)(result.created ? 201 : 200, { type: result.type, created: result.created });
   });
+  route("DELETE", "/absence-types/:id", { permission: "absence.manage_types", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const removed = absences.removeType({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`absence type ${context.params.id} not found`);
+    }
+    return (0, import_router.noContent)();
+  });
   route("GET", "/holidays", { permission: "report.view_own" }, (context) => {
     var _a2;
     const year = numberQuery(context, "year");