iobroker.time-tracker 0.7.0 → 0.7.1

package/build/lib/web/api.js

@@ -510,6 +510,21 @@ function createApi(deps) {
     const raw = context.query("userId");
     return resolveScope(context, raw ? Number(raw) : null, ownPermission, otherPermission);
   };
+  const dayNoteTarget = (context, actorId) => {
+    var _a2, _b2;
+    const raw = context.query("userId");
+    const target = raw === null || raw.trim() === "" ? actorId : Number(raw);
+    if (!Number.isInteger(target)) {
+      throw new import_errors.ValidationError("userId must be a whole number");
+    }
+    if (target !== actorId && !((_b2 = (_a2 = context.auth) == null ? void 0 : _a2.permissions.includes("time.edit_other")) != null ? _b2 : false)) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: time.edit_other)");
+    }
+    if (!users.findById(target)) {
+      throw new import_errors.NotFoundError(`user ${target} not found`);
+    }
+    return target;
+  };
   const numberQuery = (context, name) => {
     const raw = context.query(name);
     const value = Number(raw);
@@ -612,6 +627,9 @@ function createApi(deps) {
       const result = sync.sync({
         userId: user.id,
         timeZone: user.timezone,
+        // the offline queue is the only way an employee still writes a punch of his own, so the window of the
+        // instance applies to it as well (`0` switches the bound off)
+        maxPastSeconds: Math.max(0, settings.getNumber("edit_window_days", 0)) * 86400,
         punches: body.punches.map((raw) => {
           const punch2 = raw != null ? raw : {};
           const tsUtc = optionalNumber(punch2, "tsUtc");
@@ -648,10 +666,13 @@ function createApi(deps) {
     "GET",
     "/entries/conflicts",
     { permission: "time.resolve_conflict" },
-    (context) => {
-      var _a2, _b2;
-      return (0, import_router.json)(200, { conflicts: sync.conflicts((_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : 0) });
-    }
+    (context) => (
+      // without `?userId=` the own queue; the administration reads the queue of an employee with it, because a
+      // conflict of an employee waits for a decision of the office
+      (0, import_router.json)(200, {
+        conflicts: sync.conflicts(scopeUser(context, "time.resolve_conflict", "time.resolve_conflict"))
+      })
+    )
   );
   route("POST", "/entries/:id/resolve", { permission: "time.resolve_conflict", csrf: true }, (context) => {
     var _a2, _b2;
@@ -732,7 +753,7 @@ function createApi(deps) {
     }
     return (0, import_router.json)(200, { entries: entries.listByRange(userId, from, to) });
   });
-  route("POST", "/entries", { permission: "time.edit_own", csrf: true }, (context) => {
+  route("POST", "/entries", { permission: "time.edit_other", csrf: true }, (context) => {
     var _a2, _b2;
     if (!context.auth) {
       throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
@@ -742,10 +763,6 @@ function createApi(deps) {
     if (!Number.isInteger(target)) {
       throw new import_errors.ValidationError("userId must be a whole number");
     }
-    const own = target === context.auth.user.id;
-    if (!own && !context.auth.permissions.includes("time.edit_other")) {
-      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: time.edit_other)");
-    }
     const user = users.findById(target);
     if (!user) {
       throw new import_errors.NotFoundError(`user ${target} not found`);
@@ -761,7 +778,8 @@ function createApi(deps) {
       tsUtc,
       clientTsUtc: optionalNumber(body, "clientTsUtc"),
       timeZone: user.timezone,
-      source: own ? "web" : "admin",
+      // a hand-written punch is always a correction; the normal punch comes through `POST /punch` (`web`)
+      source: "admin",
       direction: optionalDirection(body),
       idempotencyKey: optionalString(body, "idempotencyKey"),
       note: optionalString(body, "note"),
@@ -778,7 +796,7 @@ function createApi(deps) {
         entryId: stored.entry.id,
         created: stored.created,
         localDate: stored.entry.localDate,
-        source: own ? "web" : "admin"
+        source: "admin"
       }
     });
     return (0, import_router.json)(
@@ -1475,9 +1493,12 @@ function createApi(deps) {
     if (revision === null) {
       throw new import_errors.ValidationError("revision is required");
     }
-    requireInsideEditWindow(context, existing.userId, existing.tsUtc);
     const wantedTs = optionalNumber(body, "tsUtc");
+    if (wantedTs !== null && !context.auth.permissions.includes("time.edit_other")) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: time.edit_other)");
+    }
     if (wantedTs !== null) {
+      requireInsideEditWindow(context, existing.userId, existing.tsUtc);
       requireInsideEditWindow(context, existing.userId, wantedTs);
     }
     const target = users.findById(existing.userId);
@@ -1530,6 +1551,61 @@ function createApi(deps) {
     });
     return (0, import_router.noContent)();
   });
+  route("GET", "/day-notes", { permission: "report.view_own" }, (context) => {
+    var _a2;
+    const userId = scopeUser(context);
+    const from = context.query("from");
+    const to = (_a2 = context.query("to")) != null ? _a2 : from;
+    if (!from || !to) {
+      throw new import_errors.ValidationError("from and to are required");
+    }
+    return (0, import_router.json)(200, { notes: deps.dayNotes.listByRange(userId, from, to) });
+  });
+  route("PUT", "/day-notes", { permission: "time.edit_own", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const userId = dayNoteTarget(context, context.auth.user.id);
+    const localDate2 = context.query("date");
+    if (!localDate2) {
+      throw new import_errors.ValidationError("date is required");
+    }
+    const note = deps.dayNotes.save({
+      userId,
+      localDate: localDate2,
+      // an empty text is how a note is taken back
+      note: (_a2 = optionalString(body, "note")) != null ? _a2 : "",
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    emit({ type: "dayNote.change", userId, data: { localDate: localDate2 } });
+    return (0, import_router.json)(200, { note });
+  });
+  route("POST", "/day-notes/handled", { permission: "time.edit_other", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const userId = dayNoteTarget(context, context.auth.user.id);
+    const localDate2 = context.query("date");
+    if (!localDate2) {
+      throw new import_errors.ValidationError("date is required");
+    }
+    const handled = (_a2 = optionalBoolean(context.jsonBody(), "handled")) != null ? _a2 : true;
+    const note = deps.dayNotes.setHandled({
+      userId,
+      localDate: localDate2,
+      handled,
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    emit({ type: "dayNote.change", userId, data: { localDate: localDate2 } });
+    return (0, import_router.json)(200, { note });
+  });
   route("GET", "/entries/:id/audit", { permission: "audit.view" }, (context) => {
     const entryId = numberParam(context, "id");
     if (!entries.findById(entryId)) {