Hartmut
66878f18f4
Infrastructure (Phase 1): - AuditLog schema: add source, entityName, summary fields + index - createAuditEntry() helper: auto-diff, auto-summary, fire-and-forget - auditLog query router: list, getByEntity, getTimeline, getActivitySummary Audit Coverage (Phase 2 — 14 routers, 50+ mutations): - vacation: create, approve, reject, cancel, batch ops (8 mutations) - user: create, updateRole, setPermissions, resetPermissions (5 mutations) - entitlement: set, bulkSet (3 mutations) - client: create, update, delete, batchUpdateSortOrder - org-unit: create, update, deactivate - country: create, update, createCity, updateCity, deleteCity - management-level: createGroup, updateGroup, createLevel, updateLevel, deleteLevel - settings: updateSystemSettings (sensitive fields sanitized), testSmtp - blueprint: create, update, updateRolePresets, delete, batchDelete, setGlobal - rate-card: create, update, deactivate, addLine, updateLine, deleteLine, replaceLines - calculation-rules: create, update, delete - effort-rule: create, update, delete - experience-multiplier: create, update, delete - utilization-category: create, update Admin UI (Phase 3): - /admin/activity-log page with global searchable timeline - Filters: entity type, action, user, date range, text search - Expandable before/after diff view per entry - Summary cards showing top entity types by change count - EntityHistory reusable component for entity detail pages - Sidebar nav link with clock icon AI Assistant (Phase 4): - query_change_history tool: "Who changed project X?" - get_entity_timeline tool: "What happened to resource Y?" Regression: 283 engine + 37 staffing tests pass. TypeScript clean. Co-Authored-By: claude-flow <ruv@ruv.net>
838 lines
29 KiB
TypeScript
838 lines
29 KiB
TypeScript
import { UpdateVacationStatusSchema, getPublicHolidays, buildTaskAction } from "@planarchy/shared";
|
|
import { VacationStatus, VacationType } from "@planarchy/db";
|
|
import { TRPCError } from "@trpc/server";
|
|
import { z } from "zod";
|
|
import { findUniqueOrThrow } from "../db/helpers.js";
|
|
import { RESOURCE_BRIEF_SELECT } from "../db/selects.js";
|
|
import { emitVacationCreated, emitVacationUpdated, emitTaskAssigned } from "../sse/event-bus.js";
|
|
import { createNotification } from "../lib/create-notification.js";
|
|
import { createTRPCRouter, adminProcedure, managerProcedure, protectedProcedure } from "../trpc.js";
|
|
import { sendEmail } from "../lib/email.js";
|
|
import { anonymizeResource, anonymizeUser, getAnonymizationDirectory } from "../lib/anonymization.js";
|
|
import { checkVacationConflicts, checkBatchVacationConflicts } from "../lib/vacation-conflicts.js";
|
|
import { dispatchWebhooks } from "../lib/webhook-dispatcher.js";
|
|
import { createAuditEntry } from "../lib/audit.js";
|
|
|
|
/** Types that consume from annual leave balance */
|
|
const BALANCE_TYPES = [VacationType.ANNUAL, VacationType.OTHER];
|
|
|
|
function anonymizeVacationRecord<T extends {
|
|
resource?: { id: string } | null;
|
|
requestedBy?: { id?: string | null; name?: string | null; email?: string | null } | null;
|
|
approvedBy?: { id?: string | null; name?: string | null; email?: string | null } | null;
|
|
}>(
|
|
vacation: T,
|
|
directory: Awaited<ReturnType<typeof getAnonymizationDirectory>>,
|
|
): T {
|
|
return {
|
|
...vacation,
|
|
...(vacation.resource ? { resource: anonymizeResource(vacation.resource, directory) } : {}),
|
|
...(vacation.requestedBy ? { requestedBy: anonymizeUser(vacation.requestedBy, directory) } : {}),
|
|
...(vacation.approvedBy ? { approvedBy: anonymizeUser(vacation.approvedBy, directory) } : {}),
|
|
};
|
|
}
|
|
|
|
/** Send in-app notification + optional email when vacation status changes */
|
|
async function notifyVacationStatus(
|
|
db: Parameters<Parameters<typeof protectedProcedure["query"]>[0]>[0]["ctx"]["db"],
|
|
vacationId: string,
|
|
resourceId: string,
|
|
newStatus: VacationStatus,
|
|
rejectionReason?: string | null,
|
|
) {
|
|
// Find the resource's linked user
|
|
const resource = await db.resource.findUnique({
|
|
where: { id: resourceId },
|
|
select: {
|
|
displayName: true,
|
|
user: { select: { id: true, email: true, name: true } },
|
|
},
|
|
});
|
|
if (!resource?.user) return;
|
|
|
|
const statusLabel = newStatus === VacationStatus.APPROVED ? "approved" : "rejected";
|
|
const title = `Vacation request ${statusLabel}`;
|
|
const body = rejectionReason
|
|
? `Your vacation request was ${statusLabel}. Reason: ${rejectionReason}`
|
|
: `Your vacation request has been ${statusLabel}.`;
|
|
|
|
// In-app notification
|
|
await createNotification({
|
|
db,
|
|
userId: resource.user.id,
|
|
type: `VACATION_${newStatus}`,
|
|
title,
|
|
body,
|
|
entityId: vacationId,
|
|
entityType: "vacation",
|
|
});
|
|
|
|
// Email (non-blocking)
|
|
if (resource.user.email) {
|
|
void sendEmail({
|
|
to: resource.user.email,
|
|
subject: `Planarchy — ${title}`,
|
|
text: body,
|
|
});
|
|
}
|
|
}
|
|
|
|
export const vacationRouter = createTRPCRouter({
|
|
/**
|
|
* List vacations with optional filters.
|
|
*/
|
|
list: protectedProcedure
|
|
.input(
|
|
z.object({
|
|
resourceId: z.string().optional(),
|
|
status: z.union([z.nativeEnum(VacationStatus), z.array(z.nativeEnum(VacationStatus))]).optional(),
|
|
type: z.nativeEnum(VacationType).optional(),
|
|
startDate: z.coerce.date().optional(),
|
|
endDate: z.coerce.date().optional(),
|
|
limit: z.number().min(1).max(500).default(100),
|
|
}),
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
const vacations = await ctx.db.vacation.findMany({
|
|
where: {
|
|
...(input.resourceId ? { resourceId: input.resourceId } : {}),
|
|
...(input.status ? { status: Array.isArray(input.status) ? { in: input.status } : input.status } : {}),
|
|
...(input.type ? { type: input.type } : {}),
|
|
...(input.startDate ? { endDate: { gte: input.startDate } } : {}),
|
|
...(input.endDate ? { startDate: { lte: input.endDate } } : {}),
|
|
},
|
|
include: {
|
|
resource: { select: RESOURCE_BRIEF_SELECT },
|
|
requestedBy: { select: { id: true, name: true, email: true } },
|
|
approvedBy: { select: { id: true, name: true, email: true } },
|
|
},
|
|
orderBy: { startDate: "asc" },
|
|
take: input.limit,
|
|
});
|
|
const directory = await getAnonymizationDirectory(ctx.db);
|
|
return vacations.map((vacation) => anonymizeVacationRecord(vacation, directory));
|
|
}),
|
|
|
|
/**
|
|
* Get a single vacation by ID.
|
|
*/
|
|
getById: protectedProcedure
|
|
.input(z.object({ id: z.string() }))
|
|
.query(async ({ ctx, input }) => {
|
|
const vacation = await findUniqueOrThrow(
|
|
ctx.db.vacation.findUnique({
|
|
where: { id: input.id },
|
|
include: {
|
|
resource: { select: RESOURCE_BRIEF_SELECT },
|
|
requestedBy: { select: { id: true, name: true, email: true } },
|
|
approvedBy: { select: { id: true, name: true, email: true } },
|
|
},
|
|
}),
|
|
"Vacation",
|
|
);
|
|
const directory = await getAnonymizationDirectory(ctx.db);
|
|
return anonymizeVacationRecord(vacation, directory);
|
|
}),
|
|
|
|
/**
|
|
* Create a vacation request.
|
|
* - MANAGER/ADMIN → auto-approved
|
|
* - USER → PENDING
|
|
* Adds isHalfDay + halfDayPart support.
|
|
*/
|
|
create: protectedProcedure
|
|
.input(
|
|
z.object({
|
|
resourceId: z.string(),
|
|
type: z.nativeEnum(VacationType),
|
|
startDate: z.coerce.date(),
|
|
endDate: z.coerce.date(),
|
|
note: z.string().max(500).optional(),
|
|
isHalfDay: z.boolean().optional(),
|
|
halfDayPart: z.enum(["MORNING", "AFTERNOON"]).optional(),
|
|
}).refine((d) => d.endDate >= d.startDate, {
|
|
message: "End date must be after start date",
|
|
path: ["endDate"],
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true, systemRole: true },
|
|
});
|
|
if (!userRecord) {
|
|
throw new TRPCError({ code: "UNAUTHORIZED" });
|
|
}
|
|
|
|
// Ownership check: USER role can only create vacations for their own resource
|
|
const isManager = userRecord.systemRole === "ADMIN" || userRecord.systemRole === "MANAGER";
|
|
if (!isManager) {
|
|
const resource = await ctx.db.resource.findUnique({
|
|
where: { id: input.resourceId },
|
|
select: { userId: true },
|
|
});
|
|
if (!resource || resource.userId !== userRecord.id) {
|
|
throw new TRPCError({
|
|
code: "FORBIDDEN",
|
|
message: "You can only create vacation requests for your own resource",
|
|
});
|
|
}
|
|
}
|
|
|
|
// Check for overlapping APPROVED or PENDING vacations
|
|
const overlapping = await ctx.db.vacation.findFirst({
|
|
where: {
|
|
resourceId: input.resourceId,
|
|
status: { in: ["APPROVED", "PENDING"] },
|
|
startDate: { lte: input.endDate },
|
|
endDate: { gte: input.startDate },
|
|
},
|
|
});
|
|
if (overlapping) {
|
|
throw new TRPCError({
|
|
code: "BAD_REQUEST",
|
|
message: "Overlapping vacation already exists for this resource in the selected period",
|
|
});
|
|
}
|
|
|
|
const status = isManager ? VacationStatus.APPROVED : VacationStatus.PENDING;
|
|
|
|
const vacation = await ctx.db.vacation.create({
|
|
data: {
|
|
resourceId: input.resourceId,
|
|
type: input.type,
|
|
status,
|
|
startDate: input.startDate,
|
|
endDate: input.endDate,
|
|
...(input.note !== undefined ? { note: input.note } : {}),
|
|
isHalfDay: input.isHalfDay ?? false,
|
|
...(input.halfDayPart !== undefined ? { halfDayPart: input.halfDayPart } : {}),
|
|
requestedById: userRecord.id,
|
|
...(isManager
|
|
? { approvedById: userRecord.id, approvedAt: new Date() }
|
|
: {}),
|
|
},
|
|
include: {
|
|
resource: { select: RESOURCE_BRIEF_SELECT },
|
|
requestedBy: { select: { id: true, name: true, email: true } },
|
|
},
|
|
});
|
|
|
|
emitVacationCreated({ id: vacation.id, resourceId: vacation.resourceId, status: vacation.status });
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: vacation.id,
|
|
entityName: `${vacation.resource?.displayName ?? "Unknown"} - ${vacation.type}`,
|
|
action: "CREATE",
|
|
userId: userRecord.id,
|
|
after: vacation as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
});
|
|
|
|
// Create approval tasks for managers when a non-manager submits a vacation request
|
|
if (status === VacationStatus.PENDING) {
|
|
const resourceName = vacation.resource?.displayName ?? "Unknown";
|
|
const startStr = input.startDate.toISOString().slice(0, 10);
|
|
const endStr = input.endDate.toISOString().slice(0, 10);
|
|
|
|
const managers = await ctx.db.user.findMany({
|
|
where: { systemRole: { in: ["ADMIN", "MANAGER"] } },
|
|
select: { id: true },
|
|
});
|
|
|
|
for (const manager of managers) {
|
|
if (manager.id === userRecord.id) continue;
|
|
const taskId = await createNotification({
|
|
db: ctx.db,
|
|
userId: manager.id,
|
|
category: "APPROVAL",
|
|
type: "VACATION_APPROVAL",
|
|
priority: "NORMAL",
|
|
title: `Vacation approval: ${resourceName}`,
|
|
body: `${resourceName} requests ${input.type} from ${startStr} to ${endStr}`,
|
|
taskStatus: "OPEN",
|
|
taskAction: buildTaskAction("approve_vacation", vacation.id),
|
|
entityId: vacation.id,
|
|
entityType: "vacation",
|
|
link: "/vacations",
|
|
senderId: userRecord.id,
|
|
channel: "in_app",
|
|
});
|
|
emitTaskAssigned(manager.id, taskId);
|
|
}
|
|
}
|
|
|
|
const directory = await getAnonymizationDirectory(ctx.db);
|
|
return anonymizeVacationRecord(vacation, directory);
|
|
}),
|
|
|
|
/**
|
|
* Approve a vacation (manager/admin only).
|
|
*/
|
|
approve: managerProcedure
|
|
.input(z.object({ id: z.string() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const existing = await findUniqueOrThrow(
|
|
ctx.db.vacation.findUnique({ where: { id: input.id } }),
|
|
"Vacation",
|
|
);
|
|
const approvableStatuses: string[] = [VacationStatus.PENDING, VacationStatus.CANCELLED, VacationStatus.REJECTED];
|
|
if (!approvableStatuses.includes(existing.status)) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "Only PENDING, CANCELLED, or REJECTED vacations can be approved" });
|
|
}
|
|
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true },
|
|
});
|
|
|
|
// Check for team conflicts before approving (non-blocking)
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
const conflictResult = await checkVacationConflicts(ctx.db as any, input.id, userRecord?.id);
|
|
|
|
const updated = await ctx.db.vacation.update({
|
|
where: { id: input.id },
|
|
data: {
|
|
status: VacationStatus.APPROVED,
|
|
rejectionReason: null,
|
|
...(userRecord?.id ? { approvedById: userRecord.id } : {}),
|
|
approvedAt: new Date(),
|
|
},
|
|
});
|
|
|
|
emitVacationUpdated({ id: updated.id, resourceId: updated.resourceId, status: updated.status });
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: updated.id,
|
|
entityName: `Vacation ${updated.id}`,
|
|
action: "UPDATE",
|
|
...(userRecord?.id ? { userId: userRecord.id } : {}),
|
|
before: existing as unknown as Record<string, unknown>,
|
|
after: updated as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Approved vacation (was ${existing.status})`,
|
|
});
|
|
|
|
void dispatchWebhooks(ctx.db, "vacation.approved", {
|
|
id: updated.id,
|
|
resourceId: updated.resourceId,
|
|
startDate: updated.startDate.toISOString(),
|
|
endDate: updated.endDate.toISOString(),
|
|
});
|
|
|
|
// Mark approval tasks as DONE
|
|
await ctx.db.notification.updateMany({
|
|
where: {
|
|
taskAction: buildTaskAction("approve_vacation", input.id),
|
|
category: "APPROVAL",
|
|
taskStatus: "OPEN",
|
|
},
|
|
data: {
|
|
taskStatus: "DONE",
|
|
completedAt: new Date(),
|
|
...(userRecord?.id ? { completedBy: userRecord.id } : {}),
|
|
},
|
|
});
|
|
|
|
if (existing.status === VacationStatus.PENDING) {
|
|
void notifyVacationStatus(ctx.db, updated.id, updated.resourceId, VacationStatus.APPROVED);
|
|
}
|
|
|
|
return { ...updated, warnings: conflictResult.warnings };
|
|
}),
|
|
|
|
/**
|
|
* Reject a vacation (manager/admin only).
|
|
*/
|
|
reject: managerProcedure
|
|
.input(z.object({ id: z.string(), rejectionReason: z.string().max(500).optional() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const existing = await findUniqueOrThrow(
|
|
ctx.db.vacation.findUnique({ where: { id: input.id } }),
|
|
"Vacation",
|
|
);
|
|
if (existing.status !== VacationStatus.PENDING) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "Only PENDING vacations can be rejected" });
|
|
}
|
|
|
|
const updated = await ctx.db.vacation.update({
|
|
where: { id: input.id },
|
|
data: {
|
|
status: VacationStatus.REJECTED,
|
|
...(input.rejectionReason !== undefined ? { rejectionReason: input.rejectionReason } : {}),
|
|
},
|
|
});
|
|
|
|
emitVacationUpdated({ id: updated.id, resourceId: updated.resourceId, status: updated.status });
|
|
|
|
// Mark approval tasks as DONE
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true },
|
|
});
|
|
await ctx.db.notification.updateMany({
|
|
where: {
|
|
taskAction: buildTaskAction("approve_vacation", input.id),
|
|
category: "APPROVAL",
|
|
taskStatus: "OPEN",
|
|
},
|
|
data: {
|
|
taskStatus: "DONE",
|
|
completedAt: new Date(),
|
|
...(userRecord?.id ? { completedBy: userRecord.id } : {}),
|
|
},
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: updated.id,
|
|
entityName: `Vacation ${updated.id}`,
|
|
action: "UPDATE",
|
|
...(userRecord?.id ? { userId: userRecord.id } : {}),
|
|
before: existing as unknown as Record<string, unknown>,
|
|
after: updated as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Rejected vacation${input.rejectionReason ? `: ${input.rejectionReason}` : ""}`,
|
|
});
|
|
|
|
void notifyVacationStatus(ctx.db, updated.id, updated.resourceId, VacationStatus.REJECTED, input.rejectionReason);
|
|
|
|
return updated;
|
|
}),
|
|
|
|
/**
|
|
* Batch approve multiple pending vacations (manager/admin only).
|
|
*/
|
|
batchApprove: managerProcedure
|
|
.input(z.object({ ids: z.array(z.string()).min(1).max(100) }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true },
|
|
});
|
|
|
|
const vacations = await ctx.db.vacation.findMany({
|
|
where: { id: { in: input.ids }, status: VacationStatus.PENDING },
|
|
select: { id: true, resourceId: true },
|
|
});
|
|
|
|
// Check for team conflicts before approving (non-blocking)
|
|
const conflictMap = await checkBatchVacationConflicts(
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
ctx.db as any,
|
|
vacations.map((v) => v.id),
|
|
userRecord?.id,
|
|
);
|
|
|
|
await ctx.db.vacation.updateMany({
|
|
where: { id: { in: vacations.map((v) => v.id) } },
|
|
data: {
|
|
status: VacationStatus.APPROVED,
|
|
rejectionReason: null,
|
|
...(userRecord?.id ? { approvedById: userRecord.id } : {}),
|
|
approvedAt: new Date(),
|
|
},
|
|
});
|
|
|
|
for (const v of vacations) {
|
|
emitVacationUpdated({ id: v.id, resourceId: v.resourceId, status: VacationStatus.APPROVED });
|
|
void notifyVacationStatus(ctx.db, v.id, v.resourceId, VacationStatus.APPROVED);
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: v.id,
|
|
entityName: `Vacation ${v.id}`,
|
|
action: "UPDATE",
|
|
...(userRecord?.id ? { userId: userRecord.id } : {}),
|
|
after: { status: VacationStatus.APPROVED } as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: "Batch approved vacation",
|
|
});
|
|
|
|
// Mark approval tasks as DONE
|
|
await ctx.db.notification.updateMany({
|
|
where: {
|
|
taskAction: buildTaskAction("approve_vacation", v.id),
|
|
category: "APPROVAL",
|
|
taskStatus: "OPEN",
|
|
},
|
|
data: {
|
|
taskStatus: "DONE",
|
|
completedAt: new Date(),
|
|
...(userRecord?.id ? { completedBy: userRecord.id } : {}),
|
|
},
|
|
});
|
|
}
|
|
|
|
// Flatten all warnings into a single array
|
|
const warnings: string[] = [];
|
|
for (const [, w] of conflictMap) {
|
|
warnings.push(...w);
|
|
}
|
|
|
|
return { approved: vacations.length, warnings };
|
|
}),
|
|
|
|
/**
|
|
* Batch reject multiple pending vacations (manager/admin only).
|
|
*/
|
|
batchReject: managerProcedure
|
|
.input(
|
|
z.object({
|
|
ids: z.array(z.string()).min(1).max(100),
|
|
rejectionReason: z.string().max(500).optional(),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true },
|
|
});
|
|
|
|
const vacations = await ctx.db.vacation.findMany({
|
|
where: { id: { in: input.ids }, status: VacationStatus.PENDING },
|
|
select: { id: true, resourceId: true },
|
|
});
|
|
|
|
await ctx.db.vacation.updateMany({
|
|
where: { id: { in: vacations.map((v) => v.id) } },
|
|
data: {
|
|
status: VacationStatus.REJECTED,
|
|
...(input.rejectionReason !== undefined ? { rejectionReason: input.rejectionReason } : {}),
|
|
},
|
|
});
|
|
|
|
for (const v of vacations) {
|
|
emitVacationUpdated({ id: v.id, resourceId: v.resourceId, status: VacationStatus.REJECTED });
|
|
void notifyVacationStatus(ctx.db, v.id, v.resourceId, VacationStatus.REJECTED, input.rejectionReason);
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: v.id,
|
|
entityName: `Vacation ${v.id}`,
|
|
action: "UPDATE",
|
|
...(userRecord?.id ? { userId: userRecord.id } : {}),
|
|
after: { status: VacationStatus.REJECTED, rejectionReason: input.rejectionReason } as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Batch rejected vacation${input.rejectionReason ? `: ${input.rejectionReason}` : ""}`,
|
|
});
|
|
|
|
// Mark approval tasks as DONE
|
|
await ctx.db.notification.updateMany({
|
|
where: {
|
|
taskAction: buildTaskAction("approve_vacation", v.id),
|
|
category: "APPROVAL",
|
|
taskStatus: "OPEN",
|
|
},
|
|
data: {
|
|
taskStatus: "DONE",
|
|
completedAt: new Date(),
|
|
...(userRecord?.id ? { completedBy: userRecord.id } : {}),
|
|
},
|
|
});
|
|
}
|
|
|
|
return { rejected: vacations.length };
|
|
}),
|
|
|
|
/**
|
|
* Cancel a vacation (owner or manager).
|
|
*/
|
|
cancel: protectedProcedure
|
|
.input(z.object({ id: z.string() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const existing = await findUniqueOrThrow(
|
|
ctx.db.vacation.findUnique({ where: { id: input.id } }),
|
|
"Vacation",
|
|
);
|
|
if (existing.status === VacationStatus.CANCELLED) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "Already cancelled" });
|
|
}
|
|
|
|
// Ownership check: USER can only cancel their own vacations
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true, systemRole: true },
|
|
});
|
|
if (!userRecord) {
|
|
throw new TRPCError({ code: "UNAUTHORIZED" });
|
|
}
|
|
const isManagerOrAdmin = userRecord.systemRole === "ADMIN" || userRecord.systemRole === "MANAGER";
|
|
if (!isManagerOrAdmin) {
|
|
if (existing.requestedById !== userRecord.id) {
|
|
const resource = await ctx.db.resource.findUnique({
|
|
where: { id: existing.resourceId },
|
|
select: { userId: true },
|
|
});
|
|
if (!resource || resource.userId !== userRecord.id) {
|
|
throw new TRPCError({
|
|
code: "FORBIDDEN",
|
|
message: "You can only cancel your own vacation requests",
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
const updated = await ctx.db.vacation.update({
|
|
where: { id: input.id },
|
|
data: { status: VacationStatus.CANCELLED },
|
|
});
|
|
|
|
emitVacationUpdated({ id: updated.id, resourceId: updated.resourceId, status: updated.status });
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: updated.id,
|
|
entityName: `Vacation ${updated.id}`,
|
|
action: "UPDATE",
|
|
userId: userRecord.id,
|
|
before: existing as unknown as Record<string, unknown>,
|
|
after: updated as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Cancelled vacation (was ${existing.status})`,
|
|
});
|
|
|
|
return updated;
|
|
}),
|
|
|
|
/**
|
|
* Get all APPROVED vacations for a resource in a date range (used by calculator).
|
|
*/
|
|
getForResource: protectedProcedure
|
|
.input(
|
|
z.object({
|
|
resourceId: z.string(),
|
|
startDate: z.coerce.date(),
|
|
endDate: z.coerce.date(),
|
|
}),
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
return ctx.db.vacation.findMany({
|
|
where: {
|
|
resourceId: input.resourceId,
|
|
status: VacationStatus.APPROVED,
|
|
startDate: { lte: input.endDate },
|
|
endDate: { gte: input.startDate },
|
|
},
|
|
select: {
|
|
id: true,
|
|
startDate: true,
|
|
endDate: true,
|
|
type: true,
|
|
status: true,
|
|
},
|
|
orderBy: { startDate: "asc" },
|
|
});
|
|
}),
|
|
|
|
/**
|
|
* Get all PENDING vacations awaiting approval (manager/admin only).
|
|
*/
|
|
getPendingApprovals: managerProcedure.query(async ({ ctx }) => {
|
|
return ctx.db.vacation.findMany({
|
|
where: { status: VacationStatus.PENDING },
|
|
include: {
|
|
resource: { select: RESOURCE_BRIEF_SELECT },
|
|
requestedBy: { select: { id: true, name: true, email: true } },
|
|
},
|
|
orderBy: { startDate: "asc" },
|
|
});
|
|
}),
|
|
|
|
/**
|
|
* Get team overlap: other vacations in the same chapter for a given period.
|
|
* Used by the creation modal to warn the requester.
|
|
*/
|
|
getTeamOverlap: protectedProcedure
|
|
.input(
|
|
z.object({
|
|
resourceId: z.string(),
|
|
startDate: z.coerce.date(),
|
|
endDate: z.coerce.date(),
|
|
}),
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
// Find the chapter of the requesting resource
|
|
const resource = await ctx.db.resource.findUnique({
|
|
where: { id: input.resourceId },
|
|
select: { chapter: true },
|
|
});
|
|
if (!resource?.chapter) return [];
|
|
|
|
// Find team members in the same chapter who are off in this period
|
|
return ctx.db.vacation.findMany({
|
|
where: {
|
|
resource: { chapter: resource.chapter },
|
|
resourceId: { not: input.resourceId },
|
|
status: { in: [VacationStatus.APPROVED, VacationStatus.PENDING] },
|
|
startDate: { lte: input.endDate },
|
|
endDate: { gte: input.startDate },
|
|
},
|
|
include: {
|
|
resource: { select: RESOURCE_BRIEF_SELECT },
|
|
},
|
|
orderBy: { startDate: "asc" },
|
|
take: 20,
|
|
});
|
|
}),
|
|
|
|
/**
|
|
* Batch-create public holidays for all resources (or a chapter) for a given year+state.
|
|
* Admin-only. Creates as APPROVED automatically.
|
|
*/
|
|
batchCreatePublicHolidays: adminProcedure
|
|
.input(
|
|
z.object({
|
|
year: z.number().int().min(2000).max(2100),
|
|
federalState: z.string().optional(), // e.g. "BY"
|
|
chapter: z.string().optional(), // filter to a chapter
|
|
replaceExisting: z.boolean().default(false),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const holidays = getPublicHolidays(input.year, input.federalState);
|
|
if (holidays.length === 0) {
|
|
return { created: 0 };
|
|
}
|
|
|
|
const resources = await ctx.db.resource.findMany({
|
|
where: {
|
|
isActive: true,
|
|
...(input.chapter ? { chapter: input.chapter } : {}),
|
|
},
|
|
select: { id: true },
|
|
});
|
|
|
|
const adminUser = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true },
|
|
});
|
|
if (!adminUser) throw new TRPCError({ code: "UNAUTHORIZED" });
|
|
|
|
let created = 0;
|
|
|
|
for (const resource of resources) {
|
|
for (const holiday of holidays) {
|
|
const startDate = new Date(holiday.date);
|
|
const endDate = new Date(holiday.date);
|
|
|
|
if (input.replaceExisting) {
|
|
// Remove any existing public holiday on this exact date for this resource
|
|
await ctx.db.vacation.deleteMany({
|
|
where: {
|
|
resourceId: resource.id,
|
|
type: VacationType.PUBLIC_HOLIDAY,
|
|
startDate,
|
|
endDate,
|
|
},
|
|
});
|
|
}
|
|
|
|
// Check if one already exists
|
|
const exists = await ctx.db.vacation.findFirst({
|
|
where: {
|
|
resourceId: resource.id,
|
|
type: VacationType.PUBLIC_HOLIDAY,
|
|
startDate,
|
|
endDate,
|
|
},
|
|
});
|
|
if (exists) continue;
|
|
|
|
await ctx.db.vacation.create({
|
|
data: {
|
|
resourceId: resource.id,
|
|
type: VacationType.PUBLIC_HOLIDAY,
|
|
status: VacationStatus.APPROVED,
|
|
startDate,
|
|
endDate,
|
|
note: holiday.name,
|
|
requestedById: adminUser.id,
|
|
approvedById: adminUser.id,
|
|
approvedAt: new Date(),
|
|
},
|
|
});
|
|
created++;
|
|
}
|
|
}
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: `public-holidays-${input.year}`,
|
|
entityName: `Public Holidays ${input.year}${input.federalState ? ` (${input.federalState})` : ""}`,
|
|
action: "CREATE",
|
|
userId: adminUser.id,
|
|
after: { created, holidays: holidays.length, resources: resources.length, year: input.year, federalState: input.federalState } as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Batch created ${created} public holidays for ${resources.length} resources (${input.year})`,
|
|
});
|
|
|
|
return { created, holidays: holidays.length, resources: resources.length };
|
|
}),
|
|
|
|
/**
|
|
* Update vacation status (approve/reject/cancel via schema).
|
|
*/
|
|
updateStatus: protectedProcedure
|
|
.input(UpdateVacationStatusSchema)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const existing = await findUniqueOrThrow(
|
|
ctx.db.vacation.findUnique({ where: { id: input.id } }),
|
|
"Vacation",
|
|
);
|
|
|
|
const userRecord = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { id: true, systemRole: true },
|
|
});
|
|
if (!userRecord) throw new TRPCError({ code: "UNAUTHORIZED" });
|
|
|
|
const isManager = userRecord.systemRole === "ADMIN" || userRecord.systemRole === "MANAGER";
|
|
|
|
if (input.status !== "CANCELLED" && !isManager) {
|
|
throw new TRPCError({ code: "FORBIDDEN", message: "Manager role required to approve/reject" });
|
|
}
|
|
|
|
const data: Record<string, unknown> = { status: input.status };
|
|
if (input.status === "APPROVED") {
|
|
data.approvedById = userRecord.id;
|
|
data.approvedAt = new Date();
|
|
data.rejectionReason = null;
|
|
}
|
|
if (input.note !== undefined) {
|
|
data.note = input.note;
|
|
}
|
|
|
|
const updated = await ctx.db.vacation.update({
|
|
where: { id: input.id },
|
|
data,
|
|
});
|
|
|
|
emitVacationUpdated({ id: updated.id, resourceId: updated.resourceId, status: updated.status });
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "Vacation",
|
|
entityId: updated.id,
|
|
entityName: `Vacation ${updated.id}`,
|
|
action: "UPDATE",
|
|
userId: userRecord.id,
|
|
before: existing as unknown as Record<string, unknown>,
|
|
after: updated as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Updated vacation status to ${input.status}`,
|
|
});
|
|
|
|
return updated;
|
|
}),
|
|
});
|