PUT /time-entries/{id} accepted a new project_id while keeping a task from
the previous project, leaving the entry with a task that belongs to a
different project. The bulk endpoint already handled a project switch but
kept the task when the project was removed.
Both endpoints now remove the task whenever project_id is changed without
task_id and the current task does not belong to the new project.
The running time entries of the merged member could give the destination
member a second running time entry. The placeholder is deleted after the
merge, so its running time entries can not stay with it.
Moving a running time entry to another member could give that member's
user a second running time entry. Stopping the time entry and changing
the member in the same request is still allowed.
The running time entry check in the store endpoint was scoped to the
member, so a user could start a time entry in each of their
organizations. The active time entry endpoint and the database
consistency check expect only one running time entry per user.
Partial updates of time entries only validated end against start if both
were part of the payload. Start and end are now also validated against the
persisted value if only one of them is sent (fixes#1189).
The importers now fail if the end of a time entry is before the start and
the database consistency check reports such time entries.
Remove redundant @var annotations from API resources and defer the user
access in the email unique rule of UserUpdateRequest, so rules() can be
evaluated by Scramble without route model binding. Add a test that fails
on any Scramble diagnostic and tests for the email unique rule.
The Teams/Show Inertia page serialized members, pending invitations, and the
owner email into props using only a belongsToTeam authorization gate, while
the corresponding API endpoints correctly enforced members:view and
invitations:view. The serialized data was unused by the live UI (the
TeamMemberManager partial that referenced it was orphaned), so dropping the
fields removes the disclosure surface without functional impact. The owner
card retains name and photo.
