Added endpoint to update multiple time entries at once

app/Http/Controllers/Api/V1/Controller.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Models\Member;
 use App\Models\Organization;
 use App\Models\User;
 use App\Service\PermissionStore;
@@ -28,6 +29,21 @@ class Controller extends \App\Http\Controllers\Controller
         }
     }
 
+    /**
+     * @param  array<string>  $permissions
+     *
+     * @throws AuthorizationException
+     */
+    protected function checkAnyPermission(Organization $organization, array $permissions): void
+    {
+        foreach ($permissions as $permission) {
+            if ($this->permissionStore->has($organization, $permission)) {
+                return;
+            }
+        }
+        throw new AuthorizationException();
+    }
+
     protected function hasPermission(Organization $organization, string $permission): bool
     {
         return $this->permissionStore->has($organization, $permission);
@@ -47,4 +63,19 @@ class Controller extends \App\Http\Controllers\Controller
 
         return $user;
     }
+
+    /**
+     * @throws AuthorizationException
+     */
+    protected function member(Organization $organization): Member
+    {
+        $user = $this->user();
+        $member = Member::query()->whereBelongsTo($organization, 'organization')->whereBelongsTo($user, 'user')->first();
+        if ($member === null) {
+            Log::error('This function should only be called in authenticated context after checking the user is a member of the organization');
+            throw new AuthorizationException();
+        }
+
+        return $member;
+    }
 }

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -10,6 +10,7 @@ use App\Exceptions\Api\TimeEntryStillRunningApiException;
 use App\Http\Requests\V1\TimeEntry\TimeEntryAggregateRequest;
 use App\Http\Requests\V1\TimeEntry\TimeEntryIndexRequest;
 use App\Http\Requests\V1\TimeEntry\TimeEntryStoreRequest;
+use App\Http\Requests\V1\TimeEntry\TimeEntryUpdateMultipleRequest;
 use App\Http\Requests\V1\TimeEntry\TimeEntryUpdateRequest;
 use App\Http\Resources\V1\TimeEntry\TimeEntryCollection;
 use App\Http\Resources\V1\TimeEntry\TimeEntryResource;
@@ -359,6 +360,56 @@ class TimeEntryController extends Controller
         return new TimeEntryResource($timeEntry);
     }
 
+    /**
+     * @throws AuthorizationException
+     */
+    public function updateMultiple(Organization $organization, TimeEntryUpdateMultipleRequest $request): JsonResponse
+    {
+        $this->checkAnyPermission($organization, ['time-entries:update:all', 'time-entries:update:own']);
+        $canAccessAll = $this->hasPermission($organization, 'time-entries:update:all');
+
+        $ids = $request->get('ids');
+
+        $timeEntries = TimeEntry::query()
+            ->whereBelongsTo($organization, 'organization')
+            ->whereIn('id', $ids)
+            ->get();
+
+        $changes = $request->get('changes');
+
+        if (isset($changes['member_id']) && ! $canAccessAll && $this->member($organization)->getKey() !== $changes['member_id']) {
+            throw new AuthorizationException();
+        }
+
+        $success = new Collection();
+        $error = new Collection();
+
+        foreach ($ids as $id) {
+            $timeEntry = $timeEntries->firstWhere('id', $id);
+            if ($timeEntry === null) {
+                // Note: ID wrong or time entry in different organization
+                $error->push($id);
+
+                continue;
+            }
+            if (! $canAccessAll && $timeEntry->user_id !== Auth::id()) {
+                $error->push($id);
+
+                continue;
+
+            }
+
+            $timeEntry->fill($changes);
+            $timeEntry->save();
+            $success->push($id);
+        }
+
+        return response()->json([
+            'success' => $success->toArray(),
+            'error' => $error->toArray(),
+        ]);
+    }
+
     /**
      * Delete time entry
      *

app/Http/Requests/V1/TimeEntry/TimeEntryUpdateMultipleRequest.php

@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\TimeEntry;
+
+use App\Models\Member;
+use App\Models\Organization;
+use App\Models\Project;
+use App\Models\Tag;
+use App\Models\Task;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Foundation\Http\FormRequest;
+use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
+
+/**
+ * @property Organization $organization Organization from model binding
+ */
+class TimeEntryUpdateMultipleRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<string|ValidationRule>>
+     */
+    public function rules(): array
+    {
+        return [
+            'ids' => [
+                'required',
+                'array',
+            ],
+            'ids.*' => [
+                'string',
+                'uuid',
+            ],
+            'changes' => [
+                'required',
+                'array',
+            ],
+            // ID of the organization member that the time entry should belong to
+            'changes.member_id' => [
+                'string',
+                'uuid',
+                new ExistsEloquent(Member::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Member> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                }),
+            ],
+            // ID of the project that the time entry should belong to
+            'changes.project_id' => [
+                'nullable',
+                'string',
+                'uuid',
+                'required_with:task_id',
+                new ExistsEloquent(Project::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Project> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                }),
+            ],
+            // ID of the task that the time entry should belong to
+            'changes.task_id' => [
+                'nullable',
+                'string',
+                'uuid',
+                new ExistsEloquent(Task::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Task> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                }),
+                (new ExistsEloquent(Task::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Task> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization')
+                        ->where('project_id', $this->input('changes.project_id'));
+                }))->withMessage(__('validation.task_belongs_to_project')),
+            ],
+            // Whether time entry is billable
+            'changes.billable' => [
+                'boolean',
+            ],
+            // Description of time entry
+            'changes.description' => [
+                'nullable',
+                'string',
+                'max:500',
+            ],
+            // List of tag IDs
+            'changes.tags' => [
+                'nullable',
+                'array',
+            ],
+            'changes.tags.*' => [
+                'string',
+                'uuid',
+                new ExistsEloquent(Tag::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Tag> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                }),
+            ],
+        ];
+    }
+}