add playwright e2e support for extensions

Models that belong to an organization via a parent model (for example
project members via their project) implement AuditableThroughParent and
return the parent relation. The owner organization of their audits is
taken from the loaded parent if it matches the foreign key, otherwise it
is queried. The declaration is also used to backfill the owner of
existing audits.

.github/workflows/build-onpremise.yml

@@ -103,6 +103,8 @@ jobs:
           {
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
+            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout invoicing extension"
@@ -119,9 +121,26 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
+      - name: "Checkout auditing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
+          path: extensions/Auditing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
+
+      - name: "Install composer dependencies in auditing extension"
+        run: cd extensions/Auditing && composer install --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+
+      - name: "Install npm dependencies in auditing extension"
+        run: cd extensions/Auditing && npm ci
+
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
+      - name: "Activate auditing extension"
+        run: php artisan module:enable Auditing
+
       - name: "Install npm dependencies"
         run: npm ci
 

.github/workflows/build-private.yml

@@ -84,6 +84,8 @@ jobs:
             echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
+            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout billing extension"
@@ -145,6 +147,25 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
+      - name: "Checkout auditing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
+          path: extensions/Auditing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
+
+      - name: "Install composer dependencies in auditing extension"
+        uses: php-actions/composer@v6
+        with:
+          working_dir: "extensions/Auditing"
+          command: install
+          only_args: --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+          php_version: 8.3
+
+      - name: "Install npm dependencies in auditing extension"
+        run: cd extensions/Auditing && npm ci
+
       - name: "Setup PHP with PECL extension"
         uses: shivammathur/setup-php@v2
         with:
@@ -168,6 +189,9 @@ jobs:
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
+      - name: "Activate auditing extension"
+        run: php artisan module:enable Auditing
+
       - name: "Install npm dependencies"
         run: npm ci
 

.github/workflows/npm-format-check.yml

@@ -1,6 +1,8 @@
 name: NPM Format Check
 
 on: [push]
+permissions:
+  contents: read
 
 jobs:
   format-check:

.github/workflows/playwright-extensions.yml

@@ -0,0 +1,185 @@
+name: Playwright Tests - Extensions
+on: push
+permissions:
+  contents: read
+jobs:
+  test:
+    name: test (${{ matrix.variant }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    # Same extension sets as build-private.yml and build-onpremise.yml, so the extension specs run
+    # with and without Billing.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: private
+            billing: true
+            extensions: Billing Services Invoicing
+          - variant: onpremise
+            billing: false
+            extensions: Invoicing
+
+    services:
+      mailpit:
+        image: 'axllent/mailpit:latest'
+        ports:
+          - 1025:1025
+          - 8025:8025
+      pgsql_test:
+        image: postgres:15
+        env:
+          PGPASSWORD: 'root'
+          POSTGRES_DB: 'laravel'
+          POSTGRES_USER: 'root'
+          POSTGRES_PASSWORD: 'root'
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      gotenberg:
+        image: gotenberg/gotenberg:8
+        ports:
+          - 3000:3000
+        options: >-
+          --health-cmd "curl --silent --fail http://localhost:3000/health"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+
+      - name: "Setup node"
+        uses: actions/setup-node@v7
+        with:
+          node-version: '20.x'
+
+      - name: "Setup PHP"
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
+          coverage: none
+
+      - name: "Read extension manifest"
+        id: extension-manifest
+        run: |
+          {
+            echo "billing_repository=$(jq -r '.Billing.repository' extensions/manifest.json)"
+            echo "billing_ref=$(jq -r '.Billing.ref' extensions/manifest.json)"
+            echo "services_repository=$(jq -r '.Services.repository' extensions/manifest.json)"
+            echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
+            echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
+            echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: "Checkout billing extension"
+        if: matrix.billing
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.billing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.billing_ref }}
+          path: extensions/Billing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_BILLING_EXTENSION }}
+
+      - name: "Install composer dependencies in billing extension"
+        if: matrix.billing
+        working-directory: extensions/Billing
+        env:
+          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "contact@solidtime.io", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in billing extension"
+        if: matrix.billing
+        run: cd extensions/Billing && npm ci
+
+      - name: "Checkout services extension"
+        if: matrix.billing
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.services_repository }}
+          ref: ${{ steps.extension-manifest.outputs.services_ref }}
+          path: extensions/Services
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_SERVICES_EXTENSION }}
+
+      - name: "Install composer dependencies in services extension"
+        if: matrix.billing
+        working-directory: extensions/Services
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in services extension"
+        if: matrix.billing
+        run: cd extensions/Services && npm ci
+
+      - name: "Checkout invoicing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.invoicing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.invoicing_ref }}
+          path: extensions/Invoicing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_INVOICING_EXTENSION }}
+
+      - name: "Install composer dependencies in invoicing extension"
+        working-directory: extensions/Invoicing
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in invoicing extension"
+        run: cd extensions/Invoicing && npm ci
+
+      - name: "Run composer install"
+        run: composer install -n --prefer-dist
+
+      # Must run before `migrate` so the extensions' migrations are applied, and before the
+      # frontend build so vite collects the extensions' assets. It also writes
+      # modules_statuses.json, which playwright.config.ts reads to collect the extension specs.
+      - name: "Activate extensions"
+        run: |
+          for extension in ${{ matrix.extensions }}; do
+            php artisan module:enable "$extension"
+          done
+
+      - name: "Prepare Laravel Application"
+        run: |
+          cp .env.ci .env
+          php artisan key:generate
+          php artisan passport:keys
+          php artisan migrate --seed
+
+      - name: "Install dependencies"
+        run: npm ci
+
+      - name: "Build Frontend"
+        run: npm run build
+
+      - name: "Install FrankenPHP"
+        run: |
+          ARCH="$(uname -m)"
+          curl -fsSL "https://github.com/dunglas/frankenphp/releases/latest/download/frankenphp-linux-${ARCH}" -o /usr/local/bin/frankenphp
+          chmod +x /usr/local/bin/frankenphp
+
+      - name: "Run Laravel Octane Server"
+        run: php artisan octane:start --server=frankenphp --host=127.0.0.1 --port=8000 --workers=4 --max-requests=500 > /dev/null 2>&1 &
+        env:
+          OCTANE_SERVER: frankenphp
+
+      - name: "Install Playwright Browsers"
+        run: npx playwright install --with-deps
+
+      # Only the extension specs, the core specs run without extensions in playwright.yml
+      - name: "Run Playwright tests"
+        run: npx playwright test extensions/
+        env:
+          PLAYWRIGHT_BASE_URL: 'http://127.0.0.1:8000'
+          MAILPIT_BASE_URL: 'http://localhost:8025'
+
+      # No artifacts are uploaded on purpose. This repository is public, so every artifact is
+      # downloadable by anyone, and Playwright's reports carry the source of the specs that
+      # produced them (traces embed whole source files, error-context.md embeds a window of the
+      # spec). Those specs live in the private extension repositories. Failures are diagnosed from
+      # the job log; to inspect a trace, reproduce the failure locally with the extension checked out.

app/Filament/Resources/AuditResource.php

@@ -1,99 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources;
-
-use App\Filament\Resources\AuditResource\Pages\CreateAudit;
-use App\Filament\Resources\AuditResource\Pages\ListAudits;
-use App\Filament\Resources\AuditResource\Pages\ViewAudit;
-use App\Models\Audit;
-use Filament\Actions\ViewAction;
-use Filament\Forms\Components\Textarea;
-use Filament\Forms\Components\TextInput;
-use Filament\Resources\Resource;
-use Filament\Schemas\Schema;
-use Filament\Tables\Columns\IconColumn;
-use Filament\Tables\Columns\TextColumn;
-use Filament\Tables\Table;
-use Illuminate\Support\Str;
-use Novadaemon\FilamentPrettyJson\Form\PrettyJsonField;
-
-class AuditResource extends Resource
-{
-    protected static ?string $model = Audit::class;
-
-    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-archive-box';
-
-    protected static string|\UnitEnum|null $navigationGroup = 'System';
-
-    public static function form(Schema $schema): Schema
-    {
-        return $schema
-            ->components([
-                TextInput::make('user_type')
-                    ->maxLength(255),
-                TextInput::make('user_id'),
-                TextInput::make('event')
-                    ->required()
-                    ->maxLength(255),
-                TextInput::make('auditable_type')
-                    ->required()
-                    ->maxLength(255),
-                TextInput::make('auditable_id')
-                    ->required(),
-                PrettyJsonField::make('old_values'),
-                PrettyJsonField::make('new_values'),
-                Textarea::make('url'),
-                TextInput::make('ip_address'),
-                TextInput::make('user_agent')
-                    ->maxLength(1023),
-                TextInput::make('tags')
-                    ->maxLength(255),
-            ]);
-    }
-
-    public static function table(Table $table): Table
-    {
-        return $table
-            ->columns([
-                TextColumn::make('user.name'),
-                TextColumn::make('event'),
-                TextColumn::make('auditable_type'),
-                TextColumn::make('auditable_id'),
-                IconColumn::make('was_command')
-                    ->getStateUsing(fn (Audit $record) => Str::startsWith($record->url, 'artisan '))
-                    ->boolean(),
-                TextColumn::make('created_at')
-                    ->sortable()
-                    ->dateTime(),
-                TextColumn::make('updated_at')
-                    ->sortable()
-                    ->dateTime(),
-            ])
-            ->filters([
-                //
-            ])
-            ->recordActions([
-                ViewAction::make(),
-            ])
-            ->toolbarActions([
-            ])
-            ->defaultSort('created_at', 'desc');
-    }
-
-    public static function getRelations(): array
-    {
-        return [
-        ];
-    }
-
-    public static function getPages(): array
-    {
-        return [
-            'index' => ListAudits::route('/'),
-            'create' => CreateAudit::route('/create'),
-            'view' => ViewAudit::route('/{record}'),
-        ];
-    }
-}

app/Filament/Resources/AuditResource/Pages/CreateAudit.php

@@ -1,13 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\CreateRecord;
-
-class CreateAudit extends CreateRecord
-{
-    protected static string $resource = AuditResource::class;
-}

app/Filament/Resources/AuditResource/Pages/ListAudits.php

@@ -1,18 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\ListRecords;
-
-class ListAudits extends ListRecords
-{
-    protected static string $resource = AuditResource::class;
-
-    protected function getHeaderActions(): array
-    {
-        return [];
-    }
-}

app/Filament/Resources/AuditResource/Pages/ViewAudit.php

@@ -1,13 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\ViewRecord;
-
-class ViewAudit extends ViewRecord
-{
-    protected static string $resource = AuditResource::class;
-}

app/Filament/Resources/OrganizationResource.php

@@ -23,7 +23,7 @@ use App\Service\Import\Importers\ImportException;
 use App\Service\Import\Importers\ReportDto;
 use App\Service\Import\ImportService;
 use App\Service\TimezoneService;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Exception;
 use Filament\Actions\Action;
 use Filament\Actions\DeleteAction;
@@ -89,7 +89,7 @@ class OrganizationResource extends Resource
                 Select::make('currency')
                     ->label('Currency')
                     ->options(function (): array {
-                        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+                        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
                         $select = [];
                         foreach ($currencies as $currency) {
                             $select[$currency->getCurrencyCode()] = $currency->getName().' ('.$currency->getCurrencyCode().')';

app/Filament/Resources/OrganizationResource/RelationManagers/UsersRelationManager.php

@@ -98,9 +98,10 @@ class UsersRelationManager extends RelationManager
                             app(BillableRateService::class)->updateTimeEntriesBillableRateForMember($member);
                         }
 
-                        if ($data['role'] !== $member->role) {
+                        $newRole = $data['role'] instanceof Role ? $data['role'] : Role::from($data['role']);
+                        if ($newRole->value !== $member->role) {
                             try {
-                                app(MemberService::class)->changeRole($member, $organization, ($data['role'] instanceof Role ? $data['role'] : Role::from($data['role'])), true);
+                                app(MemberService::class)->changeRole($member, $organization, $newRole, true);
                             } catch (ApiException $exception) {
                                 Notification::make()
                                     ->danger()

app/Filament/Resources/UserResource.php

@@ -16,7 +16,7 @@ use App\Models\User;
 use App\Service\DeletionService;
 use App\Service\TimezoneService;
 use App\Service\UserService;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Exception;
 use Filament\Actions\BulkAction;
 use Filament\Actions\DeleteAction;
@@ -115,7 +115,7 @@ class UserResource extends Resource
                 Select::make('currency')
                     ->label('Currency (Personal Organization)')
                     ->options(function (): array {
-                        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+                        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
                         $select = [];
                         foreach ($currencies as $currency) {
                             $select[$currency->getCurrencyCode()] = $currency->getName().' ('.$currency->getCurrencyCode().')';

app/Filament/Resources/UserResource/RelationManagers/OrganizationsRelationManager.php

@@ -59,9 +59,10 @@ class OrganizationsRelationManager extends RelationManager
                         /** @var Member $member */
                         $member = $record->getRelation('membership');
 
-                        if ($data['role'] !== $member->role) {
+                        $newRole = $data['role'] instanceof Role ? $data['role'] : Role::from($data['role']);
+                        if ($newRole->value !== $member->role) {
                             try {
-                                app(MemberService::class)->changeRole($member, $record, ($data['role'] instanceof Role ? $data['role'] : Role::from($data['role'])), true);
+                                app(MemberService::class)->changeRole($member, $record, $newRole, true);
                             } catch (ApiException $exception) {
                                 Notification::make()
                                     ->danger()

app/Http/Controllers/Api/V1/CurrencyController.php

@@ -7,7 +7,7 @@ namespace App\Http\Controllers\Api\V1;
 use App\Http\Controllers\Controller;
 use App\Service\CurrencyService;
 use Brick\Money\Currency;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Illuminate\Http\JsonResponse;
 
 class CurrencyController extends Controller
@@ -29,7 +29,7 @@ class CurrencyController extends Controller
                 'name' => $currency->getName(),
                 'symbol' => $currencyService->getCurrencySymbol($currency->getCurrencyCode()),
             ],
-            ISOCurrencyProvider::getInstance()->getAvailableCurrencies()
+            IsoCurrencyProvider::getInstance()->getAvailableCurrencies()
         ));
 
         return response()->json($currencies);

app/Http/Controllers/Api/V1/InvitationController.php

@@ -88,6 +88,8 @@ class InvitationController extends Controller
     /**
      * Remove a pending invitation
      *
+     * This revokes the invitation: the link in the invitation email stops working. Find the invitation ID with `GET /organizations/{organization}/invitations`.
+     *
      * @throws AuthorizationException
      *
      * @operationId removeInvitation

app/Http/Controllers/Api/V1/MemberController.php

@@ -145,6 +145,9 @@ class MemberController extends Controller
     /**
      * Merge one member into another
      *
+     * Only placeholder members (for example people created by an import) can be merged. All time entries and other data of the placeholder
+     * are reassigned to the member given in `member_id`, and the placeholder is removed. Find both member IDs with `GET /organizations/{organization}/members`.
+     *
      * @throws AuthorizationException
      * @throws OnlyPlaceholdersCanBeMergedIntoAnotherMember
      * @throws Throwable

app/Http/Controllers/Api/V1/ReportController.php

@@ -71,6 +71,8 @@ class ReportController extends Controller
     /**
      * Create report
      *
+     * A report is a saved set of filters. Set `is_public` to `true` to share it: the response then contains the `shareable_link` that can be opened without logging in.
+     *
      * @throws AuthorizationException
      *
      * @operationId createReport

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -109,9 +109,14 @@ class TimeEntryController extends Controller
     /**
      * Get time entries in organization
      *
-     * If you only need time entries for a specific user, you can filter by `member_id`.
+     * Without a member filter this returns the time entries of all members of the organization (for users who may view all time entries, such as owners and admins), not only your own.
+     * To get only your own time entries, pass your member ID as `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
      * Users with the permission `time-entries:view:own` can only use this endpoint with their own member ID in the member_id filter.
      *
+     * The `start` and `end` filters both apply to the start time of an entry, in UTC. Convert the user's local day boundaries to UTC first.
+     * Results are paginated with `limit` (default 100, max 500) and `offset`; check `meta.total` and fetch further pages when needed.
+     * To find the running timer, use `active=true` (or `GET /v1/users/me/time-entries/active`).
+     *
      * @return TimeEntryCollection<TimeEntryResource>
      *
      * @throws AuthorizationException
@@ -191,8 +196,9 @@ class TimeEntryController extends Controller
         $roundingMinutes = $canAccessPremiumFeatures ? $request->getRoundingMinutes() : null;
         if ($roundingType !== null && $roundingMinutes !== null) {
             $select = array_diff($select, ['start', 'end']);
-            $select[] = DB::raw(app(TimeEntryService::class)->getStartSelectRawForRounding($roundingType, $roundingMinutes).' as start');
-            $select[] = DB::raw(app(TimeEntryService::class)->getEndSelectRawForRounding($roundingType, $roundingMinutes).' as end');
+            // These SQL fragments are generated from a rounding enum and validated minute count.
+            $select[] = DB::raw(app(TimeEntryService::class)->getStartSelectRawForRounding($roundingType, $roundingMinutes).' as start'); // @phpstan-ignore argument.type
+            $select[] = DB::raw(app(TimeEntryService::class)->getEndSelectRawForRounding($roundingType, $roundingMinutes).' as end'); // @phpstan-ignore argument.type
         }
         $timeEntriesQuery = TimeEntry::query()
             ->whereBelongsTo($organization, 'organization')
@@ -350,6 +356,11 @@ class TimeEntryController extends Controller
      * The parameters `group` and `sub_group` allow you to group the time entries by different criteria.
      * If the group parameters are all set to `null` or are all missing, the endpoint will aggregate all filtered time entries.
      *
+     * Durations are returned in `seconds` (divide by 3600 for hours) and amounts in `cost` as cents in the organization's currency (divide by 100 for money).
+     * Filter by member with `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
+     * Array filters use the query format `client_ids[]=<id>`.
+     * Example: billable hours per client for a period: `group=client&billable=true&start=...&end=...`.
+     *
      * @operationId getAggregatedTimeEntries
      *
      * @return array{
@@ -583,6 +594,12 @@ class TimeEntryController extends Controller
     /**
      * Create time entry
      *
+     * `billable` is not taken from the project. To match the web app, set it to the project's `is_billable` value (or `false` without a project).
+     *
+     * A member can only have one running time entry (an entry with `end` set to `null`). Creating a running entry while another one runs fails with `time_entry_still_running`.
+     * To start a new timer, first stop the running entry by updating its `end` to the current time, then create the new entry.
+     * To log past work, send both `start` and `end` (UTC). Create one entry per block of work.
+     *
      * @throws AuthorizationException
      * @throws TimeEntryStillRunningApiException
      *
@@ -633,6 +650,8 @@ class TimeEntryController extends Controller
     /**
      * Update time entry
      *
+     * To stop a running timer, set `end` to the stop time (UTC). Times the user gives in their own timezone must be converted to UTC first.
+     *
      * @throws AuthorizationException|TimeEntryCanNotBeRestartedApiException
      *
      * @operationId updateTimeEntry
@@ -701,6 +720,10 @@ class TimeEntryController extends Controller
     /**
      * Update multiple time entries
      *
+     * Applies the same `changes` to every entry in `ids`. To find the IDs, list entries with `GET /organizations/{organization}/time-entries`
+     * (filtered by `member_id`, the project and the other criteria), then send their IDs here.
+     * When `changes.project_id` moves entries to another project, also set `changes.task_id` to a task of the new project or to `null`, because tasks belong to a project.
+     *
      * @operationId updateMultipleTimeEntries
      *
      * @throws AuthorizationException

app/Http/Controllers/Web/OrganizationController.php

@@ -6,7 +6,7 @@ namespace App\Http\Controllers\Web;
 
 use App\Models\Organization;
 use Brick\Money\Currency;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -53,7 +53,7 @@ class OrganizationController extends Controller
             ],
             'currencies' => array_map(function (Currency $currency): string {
                 return $currency->getName();
-            }, ISOCurrencyProvider::getInstance()->getAvailableCurrencies()),
+            }, IsoCurrencyProvider::getInstance()->getAvailableCurrencies()),
             'permissions' => [
                 'canDeleteTeam' => $this->hasPermission($organization, 'organizations:delete'),
                 'canUpdateTeam' => $this->hasPermission($organization, 'organizations:update'),

app/Http/Kernel.php

@@ -11,6 +11,7 @@ use App\Http\Middleware\EnsureEmailIsVerified;
 use App\Http\Middleware\ForceHttps;
 use App\Http\Middleware\ForceJsonResponse;
 use App\Http\Middleware\HandleInertiaRequests;
+use App\Http\Middleware\PreventRequestForgery;
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\ShareInertiaData;
@@ -18,7 +19,6 @@ use App\Http\Middleware\TrimStrings;
 use App\Http\Middleware\TrustHosts;
 use App\Http\Middleware\TrustProxies;
 use App\Http\Middleware\ValidateSignature;
-use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
 use Illuminate\Auth\Middleware\Authorize;
 use Illuminate\Auth\Middleware\RequirePassword;
@@ -68,7 +68,7 @@ class Kernel extends HttpKernel
             AddQueuedCookiesToResponse::class,
             StartSession::class,
             ShareErrorsFromSession::class,
-            VerifyCsrfToken::class,
+            PreventRequestForgery::class,
             SubstituteBindings::class,
             HandleInertiaRequests::class,
             ShareInertiaData::class,

app/Http/Middleware/AuthenticateFilamentPanel.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Filament\Http\Middleware\Authenticate as Middleware;
+use Illuminate\Http\Request;
+
+class AuthenticateFilamentPanel extends Middleware
+{
+    /**
+     * The admin panel has no login page of its own (it shares the app's
+     * session-based login), so Filament::getLoginUrl() always returns null.
+     * Fall back to the app's login route so guests are redirected instead
+     * of receiving an empty 401 response.
+     */
+    protected function redirectTo($request): ?string
+    {
+        return parent::redirectTo($request) ?? ($request->expectsJson() ? null : route('login'));
+    }
+}

app/Http/Middleware/PreventRequestForgery.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery as Middleware;
+
+class PreventRequestForgery extends Middleware
+{
+    /**
+     * The URIs that should be excluded.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/VerifyCsrfToken.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
-
-class VerifyCsrfToken extends Middleware
-{
-    /**
-     * The URIs that should be excluded from CSRF verification.
-     *
-     * @var array<int, string>
-     */
-    protected $except = [
-        //
-    ];
-}

app/Http/Requests/V1/Member/MemberUpdateRequest.php

@@ -27,6 +27,7 @@ class MemberUpdateRequest extends BaseFormRequest
                 'string',
                 Rule::enum(Role::class),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Organization/OrganizationUpdateRequest.php

@@ -36,6 +36,7 @@ class OrganizationUpdateRequest extends BaseFormRequest
                 'string',
                 new CurrencyRule,
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectStoreRequest.php

@@ -55,6 +55,7 @@ class ProjectStoreRequest extends BaseFormRequest
                 'required',
                 'boolean',
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectUpdateRequest.php

@@ -68,6 +68,7 @@ class ProjectUpdateRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge([
                 'nullable',
             ],

app/Http/Requests/V1/ProjectMember/ProjectMemberStoreRequest.php

@@ -31,6 +31,7 @@ class ProjectMemberStoreRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/ProjectMember/ProjectMemberUpdateRequest.php

@@ -21,6 +21,7 @@ class ProjectMemberUpdateRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/TimeEntry/TimeEntryIndexRequest.php

@@ -35,7 +35,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // Filter by member ID
+            // Filter by member ID. Without it, users who may view all time entries (owners, admins) get the entries of every member; pass your own member ID (from GET /v1/users/me/memberships) to get only yours
             'member_id' => [
                 'string',
                 ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
@@ -155,7 +155,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
                 'string',
                 Rule::enum(TimeEntryType::class),
             ],
-            // Limit the number of returned time entries (default: 150)
+            // Limit the number of returned time entries (default: 100)
             'limit' => [
                 'integer',
                 'min:1',

app/Http/Requests/V1/TimeEntry/TimeEntryStoreRequest.php

@@ -32,7 +32,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // ID of the organization member that the time entry should belong to
+            // ID of the organization member that the time entry should belong to (a member ID from GET /v1/users/me/memberships or the members list, not a user ID)
             'member_id' => [
                 'required',
                 'string',
@@ -86,7 +86,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
                 'date_format:Y-m-d\TH:i:s\Z',
                 'after_or_equal:start',
             ],
-            // Whether time entry is billable
+            // Whether time entry is billable. Not derived from the project: set it to the project's is_billable value to match the web app
             'billable' => [
                 'required',
                 'boolean',

app/Models/Audit.php

@@ -4,15 +4,19 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Concerns\AuditableWithoutOwner;
 use Database\Factories\AuditFactory;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Carbon;
 use OwenIt\Auditing\Models\Audit as PackageAuditModel;
 
 /**
  * @property int $id
- * @property string|null $user_type
- * @property string|null $user_id
+ * @property string|null $actor_type
+ * @property string|null $actor_id
  * @property string $event
  * @property string $auditable_type
  * @property string $auditable_id
@@ -22,13 +26,71 @@ use OwenIt\Auditing\Models\Audit as PackageAuditModel;
  * @property string|null $ip_address
  * @property string|null $user_agent
  * @property string|null $tags
+ * @property string|null $owner_user_id
+ * @property string|null $owner_organization_id
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
+ * @property-read User|null $ownerUser
+ * @property-read Organization|null $ownerOrganization
  *
  * @method static AuditFactory factory()
+ * @method static Builder<Audit> whereMissingOwner()
  */
 class Audit extends PackageAuditModel
 {
     /** @use HasFactory<AuditFactory> */
     use HasFactory;
+
+    /**
+     * @return BelongsTo<User, $this>
+     */
+    public function ownerUser(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'owner_user_id');
+    }
+
+    /**
+     * @return BelongsTo<Organization, $this>
+     */
+    public function ownerOrganization(): BelongsTo
+    {
+        return $this->belongsTo(Organization::class, 'owner_organization_id');
+    }
+
+    /**
+     * Whether audits of the given auditable type intentionally have no owner (see AuditableWithoutOwner).
+     */
+    public static function isAuditableTypeWithoutOwner(string $auditableType): bool
+    {
+        $modelClass = Relation::getMorphedModel($auditableType) ?? $auditableType;
+
+        return is_subclass_of($modelClass, AuditableWithoutOwner::class);
+    }
+
+    /**
+     * Auditable types (morph aliases) whose audits intentionally have no owner (see AuditableWithoutOwner).
+     *
+     * @return array<int, string>
+     */
+    public static function getAuditableTypesWithoutOwner(): array
+    {
+        return collect(Relation::morphMap())
+            ->filter(fn (string $modelClass): bool => is_subclass_of($modelClass, AuditableWithoutOwner::class))
+            ->keys()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * Audits that have neither an owner organization nor an owner user, although their auditable type should have one.
+     * These are audits whose owner no longer exists or could not be determined (yet).
+     *
+     * @param  Builder<Audit>  $builder
+     */
+    public function scopeWhereMissingOwner(Builder $builder): void
+    {
+        $builder->whereNull('owner_organization_id')
+            ->whereNull('owner_user_id')
+            ->whereNotIn('auditable_type', self::getAuditableTypesWithoutOwner());
+    }
 }

app/Models/Concerns/AuditableThroughParent.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Concerns;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Marks an auditable model whose audits are owned by the owner of its parent model,
+ * because the model itself has no organization_id (for example a project member belongs to an organization via its project).
+ * The parent model has to have an organization_id column.
+ * This is used to set the owner of new audits (CustomAuditable) and to backfill the owner of existing audits.
+ */
+interface AuditableThroughParent
+{
+    /**
+     * @return BelongsTo<covariant Model, covariant Model>
+     */
+    public function getAuditParentRelation(): BelongsTo;
+}

app/Models/Concerns/AuditableWithoutOwner.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Concerns;
+
+/**
+ * Marks an auditable model whose audits intentionally have no owner (neither an organization nor a user),
+ * either because the model belongs to neither of them, or because the model and its audits have to be kept
+ * when its organization or user is deleted (for example billing records).
+ * Audits of these models are not deleted together with an organization or user,
+ * and are not considered as missing an owner (for example by the audit backfill command).
+ */
+interface AuditableWithoutOwner {}

app/Models/Concerns/CustomAuditable.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Models\Concerns;
 
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Config;
 use OwenIt\Auditing\Auditable;
 
 trait CustomAuditable
@@ -19,4 +21,92 @@ trait CustomAuditable
     {
         $this->auditEvents = [];
     }
+
+    /**
+     * The organization that owns the audited model.
+     * The audits of the model are deleted (via foreign key cascade) when the organization is deleted.
+     */
+    public function getAuditOwnerOrganizationId(): ?string
+    {
+        if ($this instanceof AuditableThroughParent) {
+            $relation = $this->getAuditParentRelation();
+            $parentId = $this->getAttributes()[$relation->getForeignKeyName()] ?? null;
+            if ($parentId === null) {
+                return null;
+            }
+
+            // Note: The loaded parent is only used if it still matches the foreign key and was loaded with the organization
+            $relationName = $relation->getRelationName();
+            if ($this->relationLoaded($relationName)) {
+                $parent = $this->getRelation($relationName);
+                if ($parent instanceof Model
+                    && $parent->getAttribute($relation->getOwnerKeyName()) === $parentId
+                    && array_key_exists('organization_id', $parent->getAttributes())) {
+                    /** @var string|null $organizationId */
+                    $organizationId = $parent->getAttributes()['organization_id'];
+
+                    return $organizationId;
+                }
+            }
+
+            /** @var string|null $organizationId */
+            $organizationId = $relation->getRelated()->newQuery()
+                ->toBase()
+                ->where($relation->getOwnerKeyName(), $parentId)
+                ->value('organization_id');
+
+            return $organizationId;
+        }
+
+        return $this->getAttributes()['organization_id'] ?? null;
+    }
+
+    /**
+     * The user that owns the audited model.
+     * The audits of the model are deleted (via foreign key cascade) when the user is deleted.
+     */
+    public function getAuditOwnerUserId(): ?string
+    {
+        return null;
+    }
+
+    /**
+     * Models that are the owner of their own audits can not record the deletion audit,
+     * since the audit would reference the already deleted model and therefore violate the foreign key.
+     */
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return false;
+    }
+
+    /**
+     * @return array<int|string, string>
+     */
+    public function getAuditEvents(): array
+    {
+        $events = $this->auditEvents ?? Config::get('audit.events', [
+            'created',
+            'updated',
+            'deleted',
+            'restored',
+        ]);
+
+        if ($this->isAuditOwnerOfItself()) {
+            $events = array_filter($events, fn (string $value, int|string $key): bool => (is_int($key) ? $value : $key) !== 'deleted', ARRAY_FILTER_USE_BOTH);
+        }
+
+        return $events;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    public function transformAudit(array $data): array
+    {
+        $data['owner_organization_id'] = $this->getAuditOwnerOrganizationId();
+        $data['owner_user_id'] = $this->getAuditOwnerUserId();
+
+        return $data;
+    }
 }

app/Models/Organization.php

@@ -19,7 +19,6 @@ use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\Pivot;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Str;
 use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
@@ -97,10 +96,20 @@ class Organization extends Model implements AuditableContract
     protected $attributes = [
     ];
 
+    public function getAuditOwnerOrganizationId(): ?string
+    {
+        return $this->getKey();
+    }
+
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return true;
+    }
+
     /**
      * Get all the users that belong to the team.
      *
-     * @return BelongsToMany<User, $this, Pivot, 'membership'>
+     * @return BelongsToMany<User, $this, Member, 'membership'>
      */
     public function users(): BelongsToMany
     {
@@ -133,7 +142,7 @@ class Organization extends Model implements AuditableContract
     }
 
     /**
-     * @return BelongsToMany<User, $this, Pivot, 'membership'>
+     * @return BelongsToMany<User, $this, Member, 'membership'>
      */
     public function realUsers(): BelongsToMany
     {

app/Models/ProjectMember.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Concerns\AuditableThroughParent;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
 use Database\Factories\ProjectMemberFactory;
@@ -29,7 +30,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @method static Builder<ProjectMember> whereBelongsToOrganization(Organization $organization)
  * @method static ProjectMemberFactory factory()
  */
-class ProjectMember extends Model implements AuditableContract
+class ProjectMember extends Model implements AuditableContract, AuditableThroughParent
 {
     use CustomAuditable;
 
@@ -82,4 +83,12 @@ class ProjectMember extends Model implements AuditableContract
             $query->whereBelongsTo($organization, 'organization');
         });
     }
+
+    /**
+     * @return BelongsTo<Project, $this>
+     */
+    public function getAuditParentRelation(): BelongsTo
+    {
+        return $this->project();
+    }
 }

app/Models/User.php

@@ -20,7 +20,6 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\Pivot;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Support\Carbon;
@@ -125,6 +124,16 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
         'send_time_entry_still_running_email' => true,
     ];
 
+    public function getAuditOwnerUserId(): ?string
+    {
+        return $this->getKey();
+    }
+
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return true;
+    }
+
     /**
      * Get the URL to the user's profile photo.
      *
@@ -175,7 +184,7 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
     }
 
     /**
-     * @return BelongsToMany<Organization, $this, Pivot, 'membership'>
+     * @return BelongsToMany<Organization, $this, Member, 'membership'>
      */
     public function organizations(): BelongsToMany
     {
@@ -190,7 +199,7 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
     }
 
     /**
-     * @return BelongsToMany<Organization, $this, Pivot, 'membership'>
+     * @return BelongsToMany<Organization, $this, Member, 'membership'>
      */
     public function ownedOrganizations(): BelongsToMany
     {

app/Providers/Filament/AdminPanelProvider.php

@@ -9,7 +9,7 @@ use App\Filament\Widgets\ServerOverview;
 use App\Filament\Widgets\TimeEntriesCreated;
 use App\Filament\Widgets\TimeEntriesImported;
 use App\Filament\Widgets\UserRegistrations;
-use Filament\Http\Middleware\Authenticate;
+use App\Http\Middleware\AuthenticateFilamentPanel;
 use Filament\Http\Middleware\DisableBladeIconComponents;
 use Filament\Http\Middleware\DispatchServingFilamentEvent;
 use Filament\Navigation\NavigationGroup;
@@ -19,7 +19,7 @@ use Filament\PanelProvider;
 use Filament\Support\Colors\Color;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Cookie\Middleware\EncryptCookies;
-use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;
 use Illuminate\Routing\Middleware\SubstituteBindings;
 use Illuminate\Session\Middleware\AuthenticateSession;
 use Illuminate\Session\Middleware\StartSession;
@@ -71,6 +71,9 @@ class AdminPanelProvider extends PanelProvider
                 NavigationGroup::make()
                     ->label('Auth')
                     ->collapsed(),
+                NavigationGroup::make()
+                    ->label('Self Hosting')
+                    ->collapsed(),
             ])
             ->middleware([
                 EncryptCookies::class,
@@ -78,13 +81,13 @@ class AdminPanelProvider extends PanelProvider
                 StartSession::class,
                 AuthenticateSession::class,
                 ShareErrorsFromSession::class,
-                VerifyCsrfToken::class,
+                PreventRequestForgery::class,
                 SubstituteBindings::class,
                 DisableBladeIconComponents::class,
                 DispatchServingFilamentEvent::class,
             ])
             ->authMiddleware([
-                Authenticate::class,
+                AuthenticateFilamentPanel::class,
             ]);
 
         $modules = Module::allEnabled();

app/Rules/CurrencyRule.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Rules;
 
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Closure;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Translation\PotentiallyTranslatedString;
@@ -24,7 +24,7 @@ class CurrencyRule implements ValidationRule
             return;
         }
 
-        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
         if (array_key_exists($value, $currencies)) {
             return;
         }

app/Service/ApiService.php

@@ -15,12 +15,18 @@ use App\Models\User;
 use Exception;
 use Illuminate\Support\Facades\Http;
 use Log;
+use Nwidart\Modules\Facades\Module;
 use Throwable;
 
 class ApiService
 {
     private const string API_URL = 'https://app.solidtime.io/api/v1';
 
+    private function isPremium(): bool
+    {
+        return Module::has('Invoicing');
+    }
+
     public function checkForUpdate(): ?string
     {
         try {
@@ -31,6 +37,7 @@ class ApiService
                     'version' => config('app.version'),
                     'build' => config('app.build'),
                     'url' => config('app.url'),
+                    'is_premium' => $this->isPremium(),
                 ]);
 
             if ($response->status() === 200 && isset($response->json()['version']) && is_string($response->json()['version'])) {
@@ -62,6 +69,7 @@ class ApiService
                     'version' => config('app.version'),
                     'build' => config('app.build'),
                     'url' => config('app.url'),
+                    'is_premium' => $this->isPremium(),
                     // telemetry data
                     'user_count' => User::count(),
                     'organization_count' => Organization::count(),

app/Service/CurrencyService.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Service;
 
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Brick\Money\Money;
 
 class CurrencyService
@@ -378,7 +378,7 @@ class CurrencyService
 
     public function getRandomCurrencyCode(): string
     {
-        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
         $currencyCodes = array_keys($currencies);
 
         return $currencyCodes[array_rand($currencyCodes)];

app/Service/DashboardService.php

@@ -152,12 +152,13 @@ class DashboardService
 
         $possibleDays = $this->lastDays($days, $timezone);
 
+        // The SQL fragment contains only a timezone offset calculated as an integer.
         $query = TimeEntry::query()
-            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate'))
+            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate')) // @phpstan-ignore argument.type
             ->where('user_id', '=', $user->getKey())
             ->where('organization_id', '=', $organization->getKey())
             ->workTime()
-            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')'))
+            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')')) // @phpstan-ignore argument.type
             ->orderBy('date');
 
         $query = $this->constrainDateByPossibleDates($query, $possibleDays, $timezone);
@@ -194,12 +195,13 @@ class DashboardService
         }
         $possibleDays = $this->daysOfThisWeek($timezone, $user->week_start);
 
+        // The SQL fragment contains only a timezone offset calculated as an integer.
         $query = TimeEntry::query()
-            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate'))
+            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate')) // @phpstan-ignore argument.type
             ->where('user_id', '=', $user->getKey())
             ->where('organization_id', '=', $organization->getKey())
             ->workTime()
-            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')'))
+            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')')) // @phpstan-ignore argument.type
             ->orderBy('date');
 
         $query = $this->constrainDateByPossibleDates($query, $possibleDays, $timezone);

app/Service/DeletionService.php

@@ -11,6 +11,7 @@ use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
+use App\Models\Passport\RefreshToken;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -169,6 +170,10 @@ class DeletionService
             }
         }
 
+        // Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
+        // Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
+        // which fails with a foreign key violation on oauth_access_tokens.user_id.
+        RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
         $user->accessTokens()->delete();
         $user->authCodes()->delete();
 

app/Service/Import/Importers/ClockifyTimeEntriesImporter.php

@@ -229,7 +229,6 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
             'Project',
             'Description',
             'User',
-            'Group',
             'Email',
             'Tags',
             'Start Date',

app/Service/TimeEntryAggregationService.php

@@ -75,8 +75,9 @@ class TimeEntryAggregationService
         $startRawSelect = app(TimeEntryService::class)->getStartSelectRawForRounding($roundingType, $roundingMinutes);
         $endRawSelect = app(TimeEntryService::class)->getEndSelectRawForRounding($roundingType, $roundingMinutes);
 
+        // SQL fragments come from enum cases, integer offsets, and formatted dates.
         $timeEntriesQuery->selectRaw(
-            ($group1Select !== null ? $group1Select.' as group_1,' : '').
+            ($group1Select !== null ? $group1Select.' as group_1,' : ''). // @phpstan-ignore argument.type
             ($group2Select !== null ? $group2Select.' as group_2,' : '').
             ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'.
             ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')) * (coalesce(billable_rate, 0)::float/60/60))) as cost'
@@ -105,7 +106,7 @@ class TimeEntryAggregationService
                 $baseTotalsPerGroup1Query = $baseTotalsQuery->clone();
                 $baseTotalsPerGroup1 = $baseTotalsPerGroup1Query
                     ->selectRaw(
-                        $group1Select.' as group_1,'.
+                        $group1Select.' as group_1,'. // @phpstan-ignore argument.type
                         ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'.
                         ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')) * (coalesce(billable_rate, 0)::float/60/60))) as cost'
                     )
@@ -170,7 +171,7 @@ class TimeEntryAggregationService
                 // Reset selects and ordering on the cloned base query
                 $baseTotals = $baseTotalsQuery
                     ->selectRaw(
-                        ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'.
+                        ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'. // @phpstan-ignore argument.type
                         ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')) * (coalesce(billable_rate, 0)::float/60/60))) as cost'
                     )
                     ->first();

composer.json

@@ -7,22 +7,22 @@
     "require": {
         "php": "8.3.*",
         "ext-zip": "*",
-        "brick/money": "^0.11.2",
+        "brick/money": "^0.15.1",
         "datomatic/laravel-enum-helper": "^2.0.0",
         "dedoc/scramble": "^0.13.43",
         "filament/filament": "^5.0",
         "flowframe/laravel-trend": "^0.5.0",
         "gotenberg/gotenberg-php": "^2.8",
-        "guzzlehttp/guzzle": "^7.2",
+        "guzzlehttp/guzzle": "^8.2",
         "inertiajs/inertia-laravel": "^3.3.4",
         "korridor/laravel-computed-attributes": "^3.1",
         "korridor/laravel-has-many-sync": "^3.1",
         "korridor/laravel-model-validation-rules": "^3.0",
         "laravel/fortify": "^1.37",
-        "laravel/framework": "^12.19.3",
+        "laravel/framework": "^13.0",
         "laravel/octane": "^2.3",
         "laravel/passport": "^13.0.5",
-        "laravel/tinker": "^2.8",
+        "laravel/tinker": "^3.0",
         "league/csv": "^9.16.0",
         "league/flysystem-aws-s3-v3": "^3.0",
         "league/iso3166": "^4.3",

config/app.php

@@ -24,9 +24,9 @@ return [
     | Application Name
     |--------------------------------------------------------------------------
     |
-    | This value is the name of your application. This value is used when the
+    | This value is the name of your application, which will be used when the
     | framework needs to place the application's name in a notification or
-    | any other location as required by the application or its packages.
+    | other UI elements where an application name needs to be displayed.
     |
     */
 
@@ -110,8 +110,8 @@ return [
     |--------------------------------------------------------------------------
     |
     | Here you may specify the default timezone for your application, which
-    | will be used by the PHP date and date-time functions. We have gone
-    | ahead and set this to a sensible default for you out of the box.
+    | will be used by the PHP date and date-time functions. The timezone
+    | is set to "UTC" by default as it is suitable for most use cases.
     |
     */
 
@@ -123,8 +123,8 @@ return [
     |--------------------------------------------------------------------------
     |
     | The application locale determines the default locale that will be used
-    | by the translation service provider. You are free to set this value
-    | to any of the locales which will be supported by the application.
+    | by Laravel's translation / localization methods. This option can be
+    | set to any locale for which you plan to have translation strings.
     |
     */
 
@@ -178,15 +178,21 @@ return [
     | Encryption Key
     |--------------------------------------------------------------------------
     |
-    | This key is used by the Illuminate encrypter service and should be set
-    | to a random, 32 character string, otherwise these encrypted strings
-    | will not be safe. Please do this before deploying an application!
+    | This key is utilized by Laravel's encryption services and should be set
+    | to a random, 32 character string to ensure that all encrypted values
+    | are secure. You should do this prior to deploying the application.
     |
     */
 
+    'cipher' => 'AES-256-CBC',
+
     'key' => env('APP_KEY'),
 
-    'cipher' => 'AES-256-CBC',
+    'previous_keys' => [
+        ...array_filter(
+            explode(',', (string) env('APP_PREVIOUS_KEYS', ''))
+        ),
+    ],
 
     'localization' => [
         'default_currency' => env('LOCALIZATION_DEFAULT_CURRENCY', 'EUR'),
@@ -206,13 +212,13 @@ return [
     | manage Laravel's "maintenance mode" status. The "cache" driver will
     | allow maintenance mode to be controlled across multiple machines.
     |
-    | Supported drivers: "file", "cache"
+    | Supported drivers: "file", "cache", "array"
     |
     */
 
     'maintenance' => [
-        'driver' => 'file',
-        // 'store' => 'redis',
+        'driver' => env('APP_MAINTENANCE_DRIVER', 'file'),
+        'store' => env('APP_MAINTENANCE_STORE', 'database'),
     ],
 
     /*

config/audit.php

@@ -32,7 +32,7 @@ return [
     */
 
     'user' => [
-        'morph_prefix' => 'user',
+        'morph_prefix' => 'actor',
         'guards' => [
             'web',
             'api',

config/auth.php

@@ -10,8 +10,8 @@ return [
     | Authentication Defaults
     |--------------------------------------------------------------------------
     |
-    | This option controls the default authentication "guard" and password
-    | reset options for your application. You may change these defaults
+    | This option defines the default authentication "guard" and password
+    | reset "broker" for your application. You may change these values
     | as required, but they're a perfect start for most applications.
     |
     */
@@ -28,11 +28,11 @@ return [
     |
     | Next, you may define every authentication guard for your application.
     | Of course, a great default configuration has been defined for you
-    | here which uses session storage and the Eloquent user provider.
+    | which utilizes session storage plus the Eloquent user provider.
     |
-    | All authentication drivers have a user provider. This defines how the
+    | All authentication guards have a user provider, which defines how the
     | users are actually retrieved out of your database or other storage
-    | mechanisms used by this application to persist your user's data.
+    | system used by the application. Typically, Eloquent is utilized.
     |
     | Supported: "session"
     |
@@ -55,12 +55,12 @@ return [
     | User Providers
     |--------------------------------------------------------------------------
     |
-    | All authentication drivers have a user provider. This defines how the
+    | All authentication guards have a user provider, which defines how the
     | users are actually retrieved out of your database or other storage
-    | mechanisms used by this application to persist your user's data.
+    | system used by the application. Typically, Eloquent is utilized.
     |
     | If you have multiple user tables or models you may configure multiple
-    | sources which represent each model / table. These sources may then
+    | providers to represent the model / table. These providers may then
     | be assigned to any extra authentication guards you have defined.
     |
     | Supported: "database", "eloquent"
@@ -80,9 +80,9 @@ return [
     | Resetting Passwords
     |--------------------------------------------------------------------------
     |
-    | You may specify multiple password reset configurations if you have more
-    | than one user table or model in the application and you want to have
-    | separate password reset settings based on the specific user types.
+    | These configuration options specify the behavior of Laravel's password
+    | reset functionality, including the table utilized for token storage
+    | and the user provider that is invoked to actually retrieve users.
     |
     | The expiry time is the number of minutes that each reset token will be
     | considered valid. This security feature keeps tokens short-lived so
@@ -108,13 +108,13 @@ return [
     | Password Confirmation Timeout
     |--------------------------------------------------------------------------
     |
-    | Here you may define the amount of seconds before a password confirmation
-    | times out and the user is prompted to re-enter their password via the
+    | Here you may define the number of seconds before a password confirmation
+    | window expires and users are asked to re-enter their password via the
     | confirmation screen. By default, the timeout lasts for three hours.
     |
     */
 
-    'password_timeout' => 10800,
+    'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),
 
     'super_admins' => ! is_string(env('SUPER_ADMINS', null)) ? [] : explode(',', env('SUPER_ADMINS')),
 

config/cache.php

@@ -11,9 +11,9 @@ return [
     | Default Cache Store
     |--------------------------------------------------------------------------
     |
-    | This option controls the default cache connection that gets used while
-    | using this caching library. This connection is used when another is
-    | not explicitly specified when executing a given caching function.
+    | This option controls the default cache store that will be used by the
+    | framework. This connection is utilized if another isn't explicitly
+    | specified when running a cache operation inside the application.
     |
     */
 
@@ -28,8 +28,9 @@ return [
     | well as their drivers. You may even define multiple stores for the
     | same cache driver to group types of items stored in your caches.
     |
-    | Supported drivers: "apc", "array", "database", "file",
-    |         "memcached", "redis", "dynamodb", "octane", "null"
+    | Supported drivers: "array", "database", "file", "memcached",
+    |                    "redis", "dynamodb", "storage", "octane",
+    |                    "session", "failover", "null"
     |
     */
 
@@ -46,9 +47,10 @@ return [
 
         'database' => [
             'driver' => 'database',
-            'table' => 'cache',
-            'connection' => null,
-            'lock_connection' => null,
+            'connection' => env('DB_CACHE_CONNECTION'),
+            'table' => env('DB_CACHE_TABLE', 'cache'),
+            'lock_connection' => env('DB_CACHE_LOCK_CONNECTION'),
+            'lock_table' => env('DB_CACHE_LOCK_TABLE'),
         ],
 
         'file' => [
@@ -57,6 +59,12 @@ return [
             'lock_path' => storage_path('framework/cache/data'),
         ],
 
+        'storage' => [
+            'driver' => 'storage',
+            'disk' => env('CACHE_STORAGE_DISK'),
+            'path' => env('CACHE_STORAGE_PATH', 'framework/cache/data'),
+        ],
+
         'memcached' => [
             'driver' => 'memcached',
             'persistent_id' => env('MEMCACHED_PERSISTENT_ID'),
@@ -78,8 +86,8 @@ return [
 
         'redis' => [
             'driver' => 'redis',
-            'connection' => 'cache',
-            'lock_connection' => 'default',
+            'connection' => env('REDIS_CACHE_CONNECTION', 'cache'),
+            'lock_connection' => env('REDIS_CACHE_LOCK_CONNECTION', 'default'),
         ],
 
         'dynamodb' => [
@@ -95,6 +103,14 @@ return [
             'driver' => 'octane',
         ],
 
+        'failover' => [
+            'driver' => 'failover',
+            'stores' => [
+                'database',
+                'array',
+            ],
+        ],
+
     ],
 
     /*
@@ -102,12 +118,24 @@ return [
     | Cache Key Prefix
     |--------------------------------------------------------------------------
     |
-    | When utilizing the APC, database, memcached, Redis, or DynamoDB cache
-    | stores there might be other applications using the same cache. For
+    | When utilizing the APC, database, memcached, Redis, and DynamoDB cache
+    | stores, there might be other applications using the same cache. For
     | that reason, you may prefix every cache key to avoid collisions.
     |
     */
 
     'prefix' => env('CACHE_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_').'_cache_'),
 
+    /*
+    |--------------------------------------------------------------------------
+    | Serializable Classes
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the classes that can be unserialized from cache
+    | storage. By default, no PHP classes will be unserialized from your
+    | cache to prevent gadget chain attacks if your APP_KEY is leaked.
+    |
+    */
+
+    'serializable_classes' => false,
 ];

config/database.php

@@ -12,26 +12,22 @@ return [
     |--------------------------------------------------------------------------
     |
     | Here you may specify which of the database connections below you wish
-    | to use as your default connection for all database work. Of course
-    | you may use many connections at once using the Database library.
+    | to use as your default connection for database operations. This is
+    | the connection which will be utilized unless another connection
+    | is explicitly specified when you execute a query / statement.
     |
     */
 
-    'default' => env('DB_CONNECTION', 'mysql'),
+    'default' => env('DB_CONNECTION', 'pgsql'),
 
     /*
     |--------------------------------------------------------------------------
     | Database Connections
     |--------------------------------------------------------------------------
     |
-    | Here are each of the database connections setup for your application.
-    | Of course, examples of configuring each database platform that is
-    | supported by Laravel is shown below to make development simple.
-    |
-    |
-    | All database work in Laravel is done through the PHP PDO facilities
-    | so make sure you have the driver for your particular database of
-    | choice installed on your machine before you begin development.
+    | Below are all of the database connections defined for your application.
+    | An example configuration is provided for each database system which
+    | is supported by Laravel. You're free to add / remove connections.
     |
     */
 
@@ -39,50 +35,34 @@ return [
 
         'sqlite' => [
             'driver' => 'sqlite',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'database' => env('DB_DATABASE', database_path('database.sqlite')),
             'prefix' => '',
             'foreign_key_constraints' => env('DB_FOREIGN_KEYS', true),
-        ],
-
-        'mysql' => [
-            'driver' => 'mysql',
-            'url' => env('DATABASE_URL'),
-            'host' => env('DB_HOST', '127.0.0.1'),
-            'port' => env('DB_PORT', '3306'),
-            'database' => env('DB_DATABASE', 'forge'),
-            'username' => env('DB_USERNAME', 'forge'),
-            'password' => env('DB_PASSWORD', ''),
-            'unix_socket' => env('DB_SOCKET', ''),
-            'charset' => 'utf8mb4',
-            'collation' => 'utf8mb4_unicode_ci',
-            'prefix' => '',
-            'prefix_indexes' => true,
-            'strict' => true,
-            'engine' => null,
-            'options' => extension_loaded('pdo_mysql') ? array_filter([
-                PDO::MYSQL_ATTR_SSL_CA => env('MYSQL_ATTR_SSL_CA'),
-            ]) : [],
+            'busy_timeout' => null,
+            'journal_mode' => null,
+            'synchronous' => null,
+            'transaction_mode' => 'DEFERRED',
         ],
 
         'pgsql' => [
             'driver' => 'pgsql',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'host' => env('DB_HOST', '127.0.0.1'),
             'port' => env('DB_PORT', '5432'),
             'database' => env('DB_DATABASE', 'forge'),
             'username' => env('DB_USERNAME', 'forge'),
             'password' => env('DB_PASSWORD', ''),
-            'charset' => 'utf8',
+            'charset' => env('DB_CHARSET', 'utf8'),
             'prefix' => '',
             'prefix_indexes' => true,
             'search_path' => 'public',
-            'sslmode' => 'prefer',
+            'sslmode' => env('DB_SSL_MODE', 'prefer'),
         ],
 
         'pgsql_test' => [
             'driver' => 'pgsql',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'host' => env('DB_TEST_HOST', '127.0.0.1'),
             'port' => env('DB_TEST_PORT', '5432'),
             'database' => env('DB_TEST_DATABASE', 'forge'),
@@ -92,18 +72,18 @@ return [
             'prefix' => '',
             'prefix_indexes' => true,
             'search_path' => 'public',
-            'sslmode' => 'prefer',
+            'sslmode' => env('DB_SSL_MODE', 'prefer'),
         ],
 
         'sqlsrv' => [
             'driver' => 'sqlsrv',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'host' => env('DB_HOST', 'localhost'),
             'port' => env('DB_PORT', '1433'),
-            'database' => env('DB_DATABASE', 'forge'),
-            'username' => env('DB_USERNAME', 'forge'),
+            'database' => env('DB_DATABASE', 'laravel'),
+            'username' => env('DB_USERNAME', 'root'),
             'password' => env('DB_PASSWORD', ''),
-            'charset' => 'utf8',
+            'charset' => env('DB_CHARSET', 'utf8'),
             'prefix' => '',
             'prefix_indexes' => true,
             // 'encrypt' => env('DB_ENCRYPT', 'yes'),
@@ -119,11 +99,14 @@ return [
     |
     | This table keeps track of all the migrations that have already run for
     | your application. Using this information, we can determine which of
-    | the migrations on disk haven't actually been run in the database.
+    | the migrations on disk haven't actually been run on the database.
     |
     */
 
-    'migrations' => 'migrations',
+    'migrations' => [
+        'table' => 'migrations',
+        'update_date_on_publish' => false,
+    ],
 
     /*
     |--------------------------------------------------------------------------
@@ -132,7 +115,7 @@ return [
     |
     | Redis is an open source, fast, and advanced key-value store that also
     | provides a richer body of commands than a typical key-value system
-    | such as APC or Memcached. Laravel makes it easy to dig right in.
+    | such as Memcached. You may define your connection settings here.
     |
     */
 
@@ -143,6 +126,7 @@ return [
         'options' => [
             'cluster' => env('REDIS_CLUSTER', 'redis'),
             'prefix' => env('REDIS_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_').'_database_'),
+            'persistent' => env('REDIS_PERSISTENT', false),
         ],
 
         'default' => [
@@ -152,6 +136,10 @@ return [
             'password' => env('REDIS_PASSWORD'),
             'port' => env('REDIS_PORT', '6379'),
             'database' => env('REDIS_DB', '0'),
+            'max_retries' => env('REDIS_MAX_RETRIES', 3),
+            'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'),
+            'backoff_base' => env('REDIS_BACKOFF_BASE', 100),
+            'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000),
         ],
 
         'cache' => [
@@ -161,6 +149,10 @@ return [
             'password' => env('REDIS_PASSWORD'),
             'port' => env('REDIS_PORT', '6379'),
             'database' => env('REDIS_CACHE_DB', '1'),
+            'max_retries' => env('REDIS_MAX_RETRIES', 3),
+            'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'),
+            'backoff_base' => env('REDIS_BACKOFF_BASE', 100),
+            'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000),
         ],
 
     ],

config/filesystems.php

@@ -11,7 +11,7 @@ return [
     |
     | Here you may specify the default filesystem disk that should be used
     | by the framework. The "local" disk, as well as a variety of cloud
-    | based disks are available to your application. Just store away!
+    | based disks are available to your application for file storage.
     |
     */
 
@@ -26,11 +26,11 @@ return [
     | Filesystem Disks
     |--------------------------------------------------------------------------
     |
-    | Here you may configure as many filesystem "disks" as you wish, and you
-    | may even configure multiple disks of the same driver. Defaults have
-    | been set up for each driver as an example of the required values.
+    | Below you may configure as many filesystem disks as necessary, and you
+    | may even configure multiple disks for the same driver. Examples for
+    | most supported storage drivers are configured here for reference.
     |
-    | Supported Drivers: "local", "ftp", "sftp", "s3"
+    | Supported drivers: "local", "ftp", "sftp", "s3"
     |
     */
 
@@ -41,14 +41,16 @@ return [
             'root' => storage_path('app'),
             'serve' => true,
             'throw' => true,
+            'report' => false,
         ],
 
         'public' => [
             'driver' => 'local',
             'root' => storage_path('app/public'),
-            'url' => env('APP_URL').'/storage',
+            'url' => rtrim(env('APP_URL', 'http://localhost'), '/').'/storage',
             'visibility' => 'public',
             'throw' => true,
+            'report' => false,
         ],
 
         's3' => [
@@ -62,6 +64,7 @@ return [
             'endpoint' => env('S3_ENDPOINT'),
             'use_path_style_endpoint' => env('S3_USE_PATH_STYLE_ENDPOINT', false),
             'throw' => true,
+            'report' => false,
         ],
 
         'testfiles' => [

config/logging.php

@@ -14,9 +14,9 @@ return [
     | Default Log Channel
     |--------------------------------------------------------------------------
     |
-    | This option defines the default log channel that gets used when writing
-    | messages to the logs. The name specified in this option should match
-    | one of the channels defined in the "channels" configuration array.
+    | This option defines the default log channel that is utilized to write
+    | messages to your logs. The value provided here should match one of
+    | the channels present in the list of "channels" configured below.
     |
     */
 
@@ -43,20 +43,20 @@ return [
     | Log Channels
     |--------------------------------------------------------------------------
     |
-    | Here you may configure the log channels for your application. Out of
-    | the box, Laravel uses the Monolog PHP logging library. This gives
-    | you a variety of powerful log handlers / formatters to utilize.
+    | Here you may configure the log channels for your application. Laravel
+    | utilizes the Monolog PHP logging library, which includes a variety
+    | of powerful log handlers and formatters that you're free to use.
     |
-    | Available Drivers: "single", "daily", "slack", "syslog",
-    |                    "errorlog", "monolog",
-    |                    "custom", "stack"
+    | Available drivers: "single", "daily", "monthly", "slack", "syslog",
+    |                    "errorlog", "monolog", "custom", "stack"
     |
     */
 
     'channels' => [
+
         'stack' => [
             'driver' => 'stack',
-            'channels' => ['single'],
+            'channels' => explode(',', (string) env('LOG_STACK', 'single')),
             'ignore_exceptions' => false,
         ],
 
@@ -81,15 +81,23 @@ return [
             'driver' => 'daily',
             'path' => storage_path('logs/laravel.log'),
             'level' => env('LOG_LEVEL', 'debug'),
-            'days' => 14,
+            'max_files' => env('LOG_DAILY_DAYS', 14),
+            'replace_placeholders' => true,
+        ],
+
+        'monthly' => [
+            'driver' => 'monthly',
+            'path' => storage_path('logs/laravel.log'),
+            'level' => env('LOG_LEVEL', 'debug'),
+            'max_files' => 3,
             'replace_placeholders' => true,
         ],
 
         'slack' => [
             'driver' => 'slack',
             'url' => env('LOG_SLACK_WEBHOOK_URL'),
-            'username' => 'Laravel Log',
-            'emoji' => ':boom:',
+            'username' => env('LOG_SLACK_USERNAME', env('APP_NAME', 'Laravel')),
+            'emoji' => env('LOG_SLACK_EMOJI', ':boom:'),
             'level' => env('LOG_LEVEL', 'critical'),
             'replace_placeholders' => true,
         ],
@@ -116,17 +124,17 @@ return [
             'driver' => 'monolog',
             'level' => env('LOG_LEVEL', 'debug'),
             'handler' => StreamHandler::class,
-            'formatter' => env('LOG_STDERR_FORMATTER'),
-            'with' => [
+            'handler_with' => [
                 'stream' => 'php://stderr',
             ],
+            'formatter' => env('LOG_STDERR_FORMATTER'),
             'processors' => [PsrLogMessageProcessor::class],
         ],
 
         'syslog' => [
             'driver' => 'syslog',
             'level' => env('LOG_LEVEL', 'debug'),
-            'facility' => LOG_USER,
+            'facility' => env('LOG_SYSLOG_FACILITY', LOG_USER),
             'replace_placeholders' => true,
         ],
 

config/mail.php

@@ -9,9 +9,10 @@ return [
     | Default Mailer
     |--------------------------------------------------------------------------
     |
-    | This option controls the default mailer that is used to send any email
-    | messages sent by your application. Alternative mailers may be setup
-    | and used as needed; however, this mailer will be used by default.
+    | This option controls the default mailer that is used to send all email
+    | messages unless another mailer is explicitly specified when sending
+    | the message. All additional mailers can be configured within the
+    | "mailers" array. Examples of each type of mailer are provided.
     |
     */
 
@@ -26,26 +27,28 @@ return [
     | their respective settings. Several examples have been configured for
     | you and you are free to add your own as your application requires.
     |
-    | Laravel supports a variety of mail "transport" drivers to be used while
-    | sending an e-mail. You will specify which one you are using for your
-    | mailers below. You are free to add additional mailers as required.
+    | Laravel supports a variety of mail "transport" drivers that can be used
+    | when delivering an email. You may specify which one you're using for
+    | your mailers below. You may also add additional mailers if needed.
     |
     | Supported: "smtp", "sendmail", "mailgun", "ses", "ses-v2",
-    |            "postmark", "log", "array", "failover", "roundrobin"
+    |            "postmark", "resend", "log", "array",
+    |            "failover", "roundrobin"
     |
     */
 
     'mailers' => [
         'smtp' => [
             'transport' => 'smtp',
+            'scheme' => env('MAIL_SCHEME'),
             'url' => env('MAIL_URL'),
-            'host' => env('MAIL_HOST', 'smtp.mailgun.org'),
-            'port' => env('MAIL_PORT', 587),
+            'host' => env('MAIL_HOST', '127.0.0.1'),
+            'port' => env('MAIL_PORT', 2525),
             'encryption' => env('MAIL_ENCRYPTION', 'tls'),
             'username' => env('MAIL_USERNAME'),
             'password' => env('MAIL_PASSWORD'),
             'timeout' => null,
-            'local_domain' => env('MAIL_EHLO_DOMAIN'),
+            'local_domain' => env('MAIL_EHLO_DOMAIN', parse_url((string) env('APP_URL', 'http://localhost'), PHP_URL_HOST)),
         ],
 
         'ses' => [
@@ -54,17 +57,14 @@ return [
 
         'postmark' => [
             'transport' => 'postmark',
-            // 'message_stream_id' => null,
+            // 'message_stream_id' => env('POSTMARK_MESSAGE_STREAM_ID'),
             // 'client' => [
             //     'timeout' => 5,
             // ],
         ],
 
-        'mailgun' => [
-            'transport' => 'mailgun',
-            // 'client' => [
-            //     'timeout' => 5,
-            // ],
+        'resend' => [
+            'transport' => 'resend',
         ],
 
         'sendmail' => [
@@ -87,6 +87,7 @@ return [
                 'smtp',
                 'log',
             ],
+            'retry_after' => 60,
         ],
 
         'roundrobin' => [
@@ -95,7 +96,9 @@ return [
                 'ses',
                 'postmark',
             ],
+            'retry_after' => 60,
         ],
+
     ],
 
     /*
@@ -103,15 +106,15 @@ return [
     | Global "From" Address
     |--------------------------------------------------------------------------
     |
-    | You may wish for all e-mails sent by your application to be sent from
-    | the same address. Here, you may specify a name and address that is
-    | used globally for all e-mails that are sent by your application.
+    | You may wish for all emails sent by your application to be sent from
+    | the same address. Here you may specify a name and address that is
+    | used globally for all emails that are sent by your application.
     |
     */
 
     'from' => [
         'address' => env('MAIL_FROM_ADDRESS', 'hello@example.com'),
-        'name' => env('MAIL_FROM_NAME', 'Example'),
+        'name' => env('MAIL_FROM_NAME', env('APP_NAME', 'Laravel')),
     ],
 
     'reply_to' => [

config/queue.php

@@ -9,9 +9,9 @@ return [
     | Default Queue Connection Name
     |--------------------------------------------------------------------------
     |
-    | Laravel's queue API supports an assortment of back-ends via a single
-    | API, giving you convenient access to each back-end using the same
-    | syntax for every one. Here you may define a default connection.
+    | Laravel's queue supports a variety of backends via a single, unified
+    | API, giving you convenient access to each backend using identical
+    | syntax for each. The default queue connection is defined below.
     |
     */
 
@@ -22,11 +22,12 @@ return [
     | Queue Connections
     |--------------------------------------------------------------------------
     |
-    | Here you may configure the connection information for each server that
-    | is used by your application. A default configuration has been added
-    | for each back-end shipped with Laravel. You are free to add more.
+    | Here you may configure the connection options for every queue backend
+    | used by your application. An example configuration is provided for
+    | each backend supported by Laravel. You're also free to add more.
     |
-    | Drivers: "sync", "database", "beanstalkd", "sqs", "redis", "null"
+    | Drivers: "sync", "database", "beanstalkd", "sqs", "redis",
+    |          "deferred", "background", "failover", "null"
     |
     */
 
@@ -38,17 +39,18 @@ return [
 
         'database' => [
             'driver' => 'database',
-            'table' => 'jobs',
-            'queue' => 'default',
-            'retry_after' => 90,
+            'connection' => env('DB_QUEUE_CONNECTION'),
+            'table' => env('DB_QUEUE_TABLE', 'jobs'),
+            'queue' => env('DB_QUEUE', 'default'),
+            'retry_after' => (int) env('DB_QUEUE_RETRY_AFTER', 90),
             'after_commit' => false,
         ],
 
         'beanstalkd' => [
             'driver' => 'beanstalkd',
-            'host' => 'localhost',
-            'queue' => 'default',
-            'retry_after' => 90,
+            'host' => env('BEANSTALKD_QUEUE_HOST', 'localhost'),
+            'queue' => env('BEANSTALKD_QUEUE', 'default'),
+            'retry_after' => (int) env('BEANSTALKD_QUEUE_RETRY_AFTER', 90),
             'block_for' => 0,
             'after_commit' => false,
         ],
@@ -66,13 +68,29 @@ return [
 
         'redis' => [
             'driver' => 'redis',
-            'connection' => 'default',
+            'connection' => env('REDIS_QUEUE_CONNECTION', 'default'),
             'queue' => env('REDIS_QUEUE', 'default'),
-            'retry_after' => 90,
+            'retry_after' => (int) env('REDIS_QUEUE_RETRY_AFTER', 90),
             'block_for' => null,
             'after_commit' => false,
         ],
 
+        'deferred' => [
+            'driver' => 'deferred',
+        ],
+
+        'background' => [
+            'driver' => 'background',
+        ],
+
+        'failover' => [
+            'driver' => 'failover',
+            'connections' => [
+                'database',
+                'deferred',
+            ],
+        ],
+
     ],
 
     /*
@@ -87,7 +105,7 @@ return [
     */
 
     'batching' => [
-        'database' => env('DB_CONNECTION', 'mysql'),
+        'database' => env('DB_CONNECTION', 'sqlite'),
         'table' => 'job_batches',
     ],
 
@@ -97,14 +115,16 @@ return [
     |--------------------------------------------------------------------------
     |
     | These options configure the behavior of failed queue job logging so you
-    | can control which database and table are used to store the jobs that
-    | have failed. You may change them to any database / table you wish.
+    | can control how and where failed jobs are stored. Laravel ships with
+    | support for storing failed jobs in a simple file or in a database.
+    |
+    | Supported drivers: "database-uuids", "dynamodb", "file", "null"
     |
     */
 
     'failed' => [
         'driver' => env('QUEUE_FAILED_DRIVER', 'database-uuids'),
-        'database' => env('DB_CONNECTION', 'mysql'),
+        'database' => env('DB_CONNECTION', 'sqlite'),
         'table' => 'failed_jobs',
     ],
 

config/scramble.php

@@ -28,7 +28,30 @@ return [
         /*
          * Description rendered on the home page of the API documentation (`/docs/api`).
          */
-        'description' => '',
+        'description' => <<<'MD'
+## Getting started
+
+All organization endpoints live under `/v1/organizations/{organization}`, where `{organization}` is the organization's ID. Authenticate with `Authorization: Bearer <token>` and send `Accept: application/json`.
+
+**1. Find yourself.** Call `GET /v1/users/me/memberships`. Each membership contains the **organization ID** (use it as `{organization}` in paths) and your **member ID** in that organization (the membership `id`). Most endpoints filter by member ID, not by user ID.
+
+**2. Scope to your own data.** For owners and admins, `GET /time-entries` and `GET /time-entries/aggregate` return the whole organization's time entries unless you pass `member_id`. When acting for "me", always pass your member ID, both when reading and before changing entries.
+
+**3. Resolve names to IDs.** Look up projects, clients, tags, tasks and members by name with their list endpoints (`GET /projects`, `GET /clients`, `GET /tags`, `GET /tasks`, `GET /members`). Never guess IDs.
+
+**4. Use UTC.** All timestamps are sent and returned in UTC as `Y-m-d\TH:i:s\Z` (example: `2026-10-02T07:30:00Z`). Convert the user's local times and day boundaries to UTC before sending them.
+
+**5. Money is in cents.** Billable rates and costs are integers in cents of the organization's currency (`8000` means 80.00).
+
+## Common tasks
+
+- **Start a timer:** stop the running entry first (find it with `GET /v1/users/me/time-entries/active`, then `PUT` its `end`), then `POST /time-entries` with `start` and `end: null`. Only one entry can run per member.
+- **Log past work:** `POST /time-entries` once per block with `member_id`, `start`, `end`, `project_id` and `billable` set to the project's `is_billable` (it is not derived automatically).
+- **Fix or stop an entry:** `PUT /time-entries/{timeEntry}` with the new `start` or `end` in UTC.
+- **Move entries to another project:** list them with `member_id` and filters, then `PATCH /time-entries` with their `ids` and `changes.project_id`, plus `changes.task_id` set to a task of the new project or `null`.
+- **Totals and reports:** `GET /time-entries/aggregate` with `group` (for example `client` or `project`) and `start`/`end`; durations are in `seconds`, amounts in `cost` (cents).
+- **Share a report:** `POST /reports` with `is_public: true` and use the returned `shareable_link`.
+MD,
     ],
 
     /*

config/session.php

@@ -9,12 +9,12 @@ return [
     | Default Session Driver
     |--------------------------------------------------------------------------
     |
-    | This option controls the default session "driver" that will be used on
-    | requests. By default, we will use the lightweight native driver but
-    | you may specify any of the other wonderful drivers provided here.
+    | This option determines the default session driver that is utilized for
+    | incoming requests. Laravel supports a variety of storage options to
+    | persist session data. Database storage is a great default choice.
     |
-    | Supported: "file", "cookie", "database", "apc",
-    |            "memcached", "redis", "dynamodb", "array"
+    | Supported: "file", "cookie", "database", "memcached",
+    |            "redis", "dynamodb", "array"
     |
     */
 
@@ -27,13 +27,14 @@ return [
     |
     | Here you may specify the number of minutes that you wish the session
     | to be allowed to remain idle before it expires. If you want them
-    | to immediately expire on the browser closing, set that option.
+    | to expire immediately when the browser is closed then you may
+    | indicate that via the expire_on_close configuration option.
     |
     */
 
-    'lifetime' => env('SESSION_LIFETIME', 120),
+    'lifetime' => (int) env('SESSION_LIFETIME', 120),
 
-    'expire_on_close' => false,
+    'expire_on_close' => env('SESSION_EXPIRE_ON_CLOSE', false),
 
     /*
     |--------------------------------------------------------------------------
@@ -79,24 +80,24 @@ return [
     | Session Database Table
     |--------------------------------------------------------------------------
     |
-    | When using the "database" session driver, you may specify the table we
-    | should use to manage the sessions. Of course, a sensible default is
-    | provided for you; however, you are free to change this as needed.
+    | When using the "database" session driver, you may specify the table to
+    | be used to store sessions. Of course, a sensible default is defined
+    | for you; however, you're welcome to change this to another table.
     |
     */
 
-    'table' => 'sessions',
+    'table' => env('SESSION_TABLE', 'sessions'),
 
     /*
     |--------------------------------------------------------------------------
     | Session Cache Store
     |--------------------------------------------------------------------------
     |
-    | While using one of the framework's cache driven session backends you may
-    | list a cache store that should be used for these sessions. This value
-    | must match with one of the application's configured cache "stores".
+    | When using one of the framework's cache driven session backends, you may
+    | define the cache store which should be used to store the session data
+    | between requests. This must match one of your defined cache stores.
     |
-    | Affects: "apc", "dynamodb", "memcached", "redis"
+    | Affects: "dynamodb", "memcached", "redis"
     |
     */
 
@@ -120,9 +121,9 @@ return [
     | Session Cookie Name
     |--------------------------------------------------------------------------
     |
-    | Here you may change the name of the cookie used to identify a session
-    | instance by ID. The name specified here will get used every time a
-    | new session cookie is created by the framework for every driver.
+    | Here you may change the name of the session cookie that is created by
+    | the framework. Typically, you should not need to change this value
+    | since doing so does not grant a meaningful security improvement.
     |
     */
 
@@ -138,20 +139,20 @@ return [
     |
     | The session cookie path determines the path for which the cookie will
     | be regarded as available. Typically, this will be the root path of
-    | your application but you are free to change this when necessary.
+    | your application, but you're free to change this when necessary.
     |
     */
 
-    'path' => '/',
+    'path' => env('SESSION_PATH', '/'),
 
     /*
     |--------------------------------------------------------------------------
     | Session Cookie Domain
     |--------------------------------------------------------------------------
     |
-    | Here you may change the domain of the cookie used to identify a session
-    | in your application. This will determine which domains the cookie is
-    | available to in your application. A sensible default has been set.
+    | This value determines the domain and subdomains the session cookie is
+    | available to. By default, the cookie will be available to the root
+    | domain without subdomains. Typically, this shouldn't be changed.
     |
     */
 
@@ -177,11 +178,11 @@ return [
     |
     | Setting this value to true will prevent JavaScript from accessing the
     | value of the cookie and the cookie will only be accessible through
-    | the HTTP protocol. You are free to modify this option if needed.
+    | the HTTP protocol. It's unlikely you should disable this option.
     |
     */
 
-    'http_only' => true,
+    'http_only' => env('SESSION_HTTP_ONLY', true),
 
     /*
     |--------------------------------------------------------------------------
@@ -190,13 +191,15 @@ return [
     |
     | This option determines how your cookies behave when cross-site requests
     | take place, and can be used to mitigate CSRF attacks. By default, we
-    | will set this value to "lax" since this is a secure default value.
+    | will set this value to "lax" to permit secure cross-site requests.
+    |
+    | See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value
     |
     | Supported: "lax", "strict", "none", null
     |
     */
 
-    'same_site' => 'lax',
+    'same_site' => env('SESSION_SAME_SITE', 'lax'),
 
     /*
     |--------------------------------------------------------------------------
@@ -209,6 +212,22 @@ return [
     |
     */
 
-    'partitioned' => false,
+    'partitioned' => env('SESSION_PARTITIONED_COOKIE', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Serialization
+    |--------------------------------------------------------------------------
+    |
+    | This value controls the serialization strategy for session data, which
+    | is JSON by default. Setting this to "php" allows the storage of PHP
+    | objects in the session but can make an application vulnerable to
+    | "gadget chain" serialization attacks if the APP_KEY is leaked.
+    |
+    | Supported: "json", "php"
+    |
+    */
+
+    'serialization' => 'php',
 
 ];

database/factories/UserFactory.php

@@ -91,7 +91,7 @@ class UserFactory extends Factory
 
     public function withProfilePicture(): static
     {
-        $profilePhoto = $this->faker->image(null, 500, 500);
+        $profilePhoto = $this->generateProfilePhoto();
         /** @see FileHelpers::hashName */
         $path = 'profile-photos/'.Str::random(40).'.png';
         Storage::disk(config('filesystems.public'))->put($path, $profilePhoto);
@@ -103,6 +103,21 @@ class UserFactory extends Factory
         });
     }
 
+    /**
+     * Generates a PNG image with a random background color.
+     * Note: The image is generated locally, since downloading a placeholder image (Faker image()) depends on an external service.
+     */
+    private function generateProfilePhoto(): string
+    {
+        $image = imagecreatetruecolor(500, 500);
+        $color = imagecolorallocate($image, $this->faker->numberBetween(0, 255), $this->faker->numberBetween(0, 255), $this->faker->numberBetween(0, 255));
+        imagefill($image, 0, 0, $color);
+        ob_start();
+        imagepng($image);
+
+        return (string) ob_get_clean();
+    }
+
     /**
      * Indicate that the user should have a personal team.
      */

database/migrations/2024_09_02_094105_create_audits_table.php

@@ -18,7 +18,8 @@ class CreateAuditsTable extends Migration
 
         Schema::connection($connection)->create($table, function (Blueprint $table): void {
 
-            $morphPrefix = config('audit.user.morph_prefix', 'user');
+            // Note: The morph prefix is hardcoded, since the columns are renamed in a later migration
+            $morphPrefix = 'user';
 
             $table->bigIncrements('id');
             $table->string($morphPrefix.'_type')->nullable();

database/migrations/2026_10_06_000001_add_owner_columns_to_audits_table.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * Note: Renaming columns and adding nullable columns without default are metadata-only operations in PostgreSQL,
+     * so this migration is fast even for a large audits table.
+     * The indexes and foreign keys for the new columns are added in a separate non-transactional migration.
+     */
+    public function up(): void
+    {
+        Schema::table('audits', function (Blueprint $table): void {
+            $table->renameColumn('user_type', 'actor_type');
+            $table->renameColumn('user_id', 'actor_id');
+            $table->renameIndex('audits_user_id_user_type_index', 'audits_actor_id_actor_type_index');
+            $table->uuid('owner_user_id')->nullable();
+            $table->uuid('owner_organization_id')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('audits', function (Blueprint $table): void {
+            $table->dropColumn('owner_user_id');
+            $table->dropColumn('owner_organization_id');
+            $table->renameIndex('audits_actor_id_actor_type_index', 'audits_user_id_user_type_index');
+            $table->renameColumn('actor_type', 'user_type');
+            $table->renameColumn('actor_id', 'user_id');
+        });
+    }
+};

database/migrations/2026_10_06_000002_add_owner_foreign_keys_to_audits_table.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * PostgreSQL cannot build an index concurrently inside a transaction.
+     * Keeping this migration non-transactional prevents long write locks on the (large) audits table in production.
+     * Every step is idempotent, so the migration can be re-run if it fails halfway.
+     *
+     * @var bool
+     */
+    public $withinTransaction = false;
+
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        $this->createIndex('audits_owner_user_id_index', 'owner_user_id');
+        $this->createIndex('audits_owner_organization_id_index', 'owner_organization_id');
+
+        $this->createForeignKey('audits_owner_user_id_foreign', 'owner_user_id', 'users');
+        $this->createForeignKey('audits_owner_organization_id_foreign', 'owner_organization_id', 'organizations');
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        DB::statement('ALTER TABLE audits DROP CONSTRAINT IF EXISTS audits_owner_user_id_foreign');
+        DB::statement('ALTER TABLE audits DROP CONSTRAINT IF EXISTS audits_owner_organization_id_foreign');
+        DB::statement('DROP INDEX'.$this->concurrently().' IF EXISTS audits_owner_user_id_index');
+        DB::statement('DROP INDEX'.$this->concurrently().' IF EXISTS audits_owner_organization_id_index');
+    }
+
+    private function createIndex(string $index, string $column): void
+    {
+        $state = DB::selectOne(
+            <<<'SQL'
+                SELECT pg_index.indisvalid::int AS valid
+                FROM pg_index
+                JOIN pg_class ON pg_class.oid = pg_index.indexrelid
+                JOIN pg_namespace ON pg_namespace.oid = pg_class.relnamespace
+                WHERE pg_namespace.nspname = current_schema()
+                  AND pg_class.relname = ?
+                SQL,
+            [$index],
+        );
+
+        if ($state !== null && (bool) $state->valid) {
+            return;
+        }
+
+        // A failed concurrent index build leaves an invalid index behind, that needs to be dropped before rebuilding
+        if ($state !== null) {
+            DB::statement('DROP INDEX'.$this->concurrently().' '.$index);
+        }
+
+        DB::statement('CREATE INDEX'.$this->concurrently().' '.$index.' ON audits ('.$column.')');
+    }
+
+    private function createForeignKey(string $constraint, string $column, string $referencedTable): void
+    {
+        $exists = DB::selectOne(
+            <<<'SQL'
+                SELECT 1
+                FROM pg_constraint
+                JOIN pg_namespace ON pg_namespace.oid = pg_constraint.connamespace
+                WHERE pg_namespace.nspname = current_schema()
+                  AND pg_constraint.conname = ?
+                SQL,
+            [$constraint],
+        ) !== null;
+
+        // Note: Adding the constraint as NOT VALID only needs a short lock, the validation of the existing rows
+        // afterward does not block reads or writes on the audits table.
+        if (! $exists) {
+            DB::statement('ALTER TABLE audits ADD CONSTRAINT '.$constraint.' FOREIGN KEY ('.$column.') REFERENCES '.$referencedTable.' (id) ON DELETE CASCADE NOT VALID');
+        }
+
+        DB::statement('ALTER TABLE audits VALIDATE CONSTRAINT '.$constraint);
+    }
+
+    private function concurrently(): string
+    {
+        return DB::transactionLevel() === 0 ? ' CONCURRENTLY' : '';
+    }
+};

e2e/admin-panel.spec.ts

@@ -19,7 +19,6 @@ const resourcePages = [
     { path: '/admin/project-members', heading: 'Project Members' },
     { path: '/admin/tokens', heading: 'Tokens' },
     { path: '/admin/failed-jobs', heading: 'Failed Jobs' },
-    { path: '/admin/audits', heading: 'Audits' },
 ];
 
 test.describe('Admin Panel Access', () => {

e2e/calendar.spec.ts

@@ -252,19 +252,19 @@ test('test that calendar page loads and displays time entries', async ({ page, c
 test('test that calendar navigation buttons work', async ({ page }) => {
     await goToCalendar(page);
     await expect(page.locator('.fc')).toBeVisible();
+    await expect(page.getByTestId('calendar-title')).toContainText('This Week');
 
-    // Click the "next" button to navigate forward
-    await page.getByRole('button', { name: 'Next' }).click();
-    await expect(page.locator('.fc')).toBeVisible();
-
-    // Click the "prev" button to navigate back
+    // Navigate between named periods.
     await page.getByRole('button', { name: 'Previous' }).click();
-    await expect(page.locator('.fc')).toBeVisible();
-
-    // Navigate forward first, then click today
+    await expect(page.getByTestId('calendar-title')).toContainText('Last Week');
     await page.getByRole('button', { name: 'Next' }).click();
+    await expect(page.getByTestId('calendar-title')).toContainText('This Week');
+
+    // Navigate forward first, then use the range button to return to today.
+    await page.getByRole('button', { name: 'Next' }).click();
+    await expect(page.getByTestId('calendar-title')).toContainText('Next Week');
     await page.getByRole('button', { name: 'today' }).click();
-    await expect(page.locator('.fc')).toBeVisible();
+    await expect(page.getByTestId('calendar-title')).toContainText('This Week');
 });
 
 test('test that editing time entry description via calendar modal works', async ({ page, ctx }) => {

e2e/reporting.spec.ts

@@ -18,6 +18,25 @@ import {
 // Each test registers a new user and creates test data via API
 test.describe.configure({ timeout: 30000 });
 
+test('date range picker labels and navigates reporting periods', async ({ page }) => {
+    await goToReporting(page);
+
+    const range = page.getByTestId('date_range_picker_display');
+    const previous = page.getByTestId('date_range_picker_previous');
+    const next = page.getByTestId('date_range_picker_next');
+
+    await expect(range).toContainText('Last 14 Days');
+    await expect(next).toBeDisabled();
+
+    await Promise.all([waitForReportingUpdate(page), previous.click()]);
+    await expect(range).not.toContainText('Last 14 Days');
+
+    // The initial reporting range is still fresh in Vue Query's cache, so returning to it
+    // does not necessarily trigger another aggregate request.
+    await next.click();
+    await expect(range).toContainText('Last 14 Days');
+});
+
 // ──────────────────────────────────────────────────
 // Project Multiselect Dropdown Tests
 // ──────────────────────────────────────────────────

e2e/time.spec.ts

@@ -1579,6 +1579,57 @@ test('test that project selection works in create modal', async ({ page, ctx })
     expect(createBody.data.project_id).not.toBeNull();
 });
 
+test('test that ctrl+enter submits the create modal after selecting a project via keyboard', async ({
+    page,
+    ctx,
+}) => {
+    // Regression test for https://github.com/solidtime-io/solidtime/issues/1238
+    const projectName = 'Keyboard Submit Project ' + Math.floor(1 + Math.random() * 10000);
+    await createProjectViaApi(ctx, { name: projectName });
+
+    await goToTimeOverview(page);
+
+    await page.getByRole('button', { name: 'Time entry actions' }).click();
+    await page.getByRole('menuitem', { name: 'Manual time entry' }).click();
+    await expect(page.getByRole('dialog')).toBeVisible();
+    // The menu that opened the modal animates out and only then hands focus back to its
+    // own trigger.
+    await expect(page.locator('[role="menu"]')).toHaveCount(0);
+
+    // Fill the description, then move to the project dropdown and select a project purely via keyboard
+    const description = page.getByRole('dialog').getByRole('textbox', { name: 'Description' });
+    await description.fill('Keyboard submit test');
+    await description.press('Tab');
+    await expect(
+        page.getByRole('dialog').getByRole('button', { name: 'No Project' })
+    ).toBeFocused();
+    await page.keyboard.press('Enter');
+    await page.getByTestId('client_dropdown_search').fill(projectName);
+    await expect(page.getByRole('option', { name: projectName })).toBeVisible();
+    await page.keyboard.press('Enter');
+    const projectTrigger = page.getByRole('dialog').getByRole('button', { name: projectName });
+    await expect(projectTrigger).toBeVisible();
+    // The trigger label updates on the next tick, but the dropdown keeps focus until its
+    // exit animation has finished and reka-ui hands focus back to the trigger.
+    await expect(projectTrigger).toBeFocused();
+
+    // Ctrl+Enter must submit even though focus is no longer on the description input
+    const [createResponse] = await Promise.all([
+        page.waitForResponse(
+            (response) => response.url().includes('/time-entries') && response.status() === 201
+        ),
+        page.keyboard.press('Control+Enter'),
+    ]);
+    const createBody = await createResponse.json();
+    expect(createBody.data.description).toBe('Keyboard submit test');
+    expect(createBody.data.project_id).not.toBeNull();
+    await expect(page.getByRole('dialog')).toBeHidden();
+    const newTimeEntry = page.locator('[data-testid="time_entry_row"]').first();
+    await expect(newTimeEntry.getByTestId('time_entry_description').first()).toHaveValue(
+        'Keyboard submit test'
+    );
+});
+
 test('test that tag selection works in create modal', async ({ page }) => {
     await goToTimeOverview(page);
 

e2e/timesheet.spec.ts

@@ -409,20 +409,20 @@ test('navigating to previous week shows entries from that week', async ({ page,
 test('can navigate forward and return to current week', async ({ page }) => {
     await Promise.all([goToTimesheet(page), waitForTimesheetLoad(page)]);
 
-    // Should show "This week"
-    await expect(page.getByTestId('timesheet_week_display')).toContainText('This week');
+    // Should show "This Week"
+    await expect(page.getByTestId('timesheet_week_display')).toContainText('This Week');
 
     // Go to next week — the text assertions below auto-retry until the
     // header label flips.
     await page.getByTestId('timesheet_next_week').click();
 
-    // Should no longer show "This week"
-    await expect(page.getByTestId('timesheet_week_display')).not.toContainText('This week');
+    // Should no longer show "This Week"
+    await expect(page.getByTestId('timesheet_week_display')).not.toContainText('This Week');
 
     // Go back to this week
     await page.getByTestId('timesheet_week_display').click();
 
-    await expect(page.getByTestId('timesheet_week_display')).toContainText('This week');
+    await expect(page.getByTestId('timesheet_week_display')).toContainText('This Week');
 });
 
 // ──────────────────────────────────────────────────

e2e/utils/mailpit.ts

@@ -68,7 +68,7 @@ export async function getPasswordResetUrl(
     for (let attempt = 0; attempt < 5; attempt++) {
         searchResult = await searchEmails(
             request,
-            `to:${encodeURIComponent(recipientEmail)} subject:"Reset Password"`
+            `to:${encodeURIComponent(recipientEmail)} subject:"Reset your password"`
         );
         if (searchResult.messages.length > 0) break;
         await new Promise((resolve) => setTimeout(resolve, 500));

extensions/manifest.json

@@ -1,14 +1,18 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "feature/composer-update"
+        "ref": "v0.0.9"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",
-        "ref": "feature/composer-update"
+        "ref": "v0.0.4"
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
-        "ref": "feature/composer-update"
+        "ref": "v0.0.8"
+    },
+    "Auditing": {
+        "repository": "solidtime-io/extension-auditing",
+        "ref": "v0.0.4"
     }
 }

phpunit.xml

@@ -34,6 +34,7 @@
         <env name="BCRYPT_ROUNDS" value="4"/>
         <env name="CACHE_DRIVER" value="array"/>
         <env name="DB_CONNECTION" value="pgsql_test"/>
+        <env name="FILESYSTEM_DISK" value="local"/>
         <env name="MAIL_MAILER" value="array"/>
         <env name="PULSE_ENABLED" value="false"/>
         <env name="QUEUE_CONNECTION" value="sync"/>

playwright.config.ts

@@ -1,4 +1,5 @@
 import { defineConfig, devices } from '@playwright/test';
+import { existsSync, readFileSync } from 'node:fs';
 
 /**
  * Read environment variables from file.
@@ -6,11 +7,57 @@ import { defineConfig, devices } from '@playwright/test';
  */
 // require('dotenv').config();
 
+/**
+ * Extensions ship their e2e specs in extensions/<Name>/tests/e2e. Only the specs of extensions
+ * that are enabled in modules_statuses.json (php artisan module:enable <Name>) are collected,
+ * a checked out but disabled extension would fail its specs otherwise.
+ */
+function enabledExtensions(): string[] {
+    const statusesFile = './modules_statuses.json';
+    if (!existsSync(statusesFile)) {
+        return [];
+    }
+    const statuses: Record<string, boolean> = JSON.parse(readFileSync(statusesFile, 'utf-8'));
+    return Object.entries(statuses)
+        .filter(([, enabled]) => enabled)
+        .map(([name]) => name);
+}
+
+/*
+ * Every test root gets its own testDir (instead of testDir: '.') so playwright does not walk the
+ * whole repository, including node_modules, vendor and nested worktrees, to find the specs.
+ */
+const testRoots = [
+    { suffix: '', testDir: './e2e' },
+    ...enabledExtensions().map((name) => ({
+        suffix: '-' + name,
+        testDir: `./extensions/${name}/tests/e2e`,
+    })),
+];
+
+const browsers = [
+    {
+        name: 'chromium',
+        use: { ...devices['Desktop Chrome'] },
+    },
+
+    // Firefox only in CI to keep local runs fast
+    ...(process.env.CI
+        ? [
+              {
+                  name: 'firefox',
+                  use: { ...devices['Desktop Firefox'] },
+              },
+          ]
+        : []),
+];
+
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-    testDir: './e2e',
+    /* Resolves the @e2e/* and @e2e-support/* aliases that extension specs import core helpers with */
+    tsconfig: './tsconfig.json',
     /* Run tests in files in parallel */
     fullyParallel: true,
     /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -32,23 +79,14 @@ export default defineConfig({
 
     timeout: 20 * 1000,
 
-    /* Configure projects for major browsers */
-    projects: [
-        {
-            name: 'chromium',
-            use: { ...devices['Desktop Chrome'] },
-        },
-
-        // Firefox only in CI to keep local runs fast
-        ...(process.env.CI
-            ? [
-                  {
-                      name: 'firefox',
-                      use: { ...devices['Desktop Firefox'] },
-                  },
-              ]
-            : []),
-    ],
+    /* Configure projects for major browsers, core specs keep the plain browser project name */
+    projects: browsers.flatMap((browser) =>
+        testRoots.map((root) => ({
+            name: browser.name + root.suffix,
+            testDir: root.testDir,
+            use: browser.use,
+        }))
+    ),
 
     /* Run your local dev server before starting the tests */
     // webServer: {

resources/js/Components/Common/Client/ClientCreateModal.vue

@@ -28,7 +28,7 @@ useFocus(clientNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create Client </span>

resources/js/Components/Common/Client/ClientEditModal.vue

@@ -30,7 +30,7 @@ useFocus(clientNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Update Client </span>

resources/js/Components/Common/Member/MemberEditModal.vue

@@ -136,7 +136,7 @@ const roleDescription = computed(() => {
         v-model:show="showOwnershipTransferConfirmModal"
         :member-name="member.name"
         @submit="submit"></MemberOwnershipTransferConfirmModal>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="saveWithChecks()">
         <template #title>
             <div class="flex space-x-2">
                 <span> Update Member </span>

resources/js/Components/Common/Member/MemberInviteModal.vue

@@ -78,7 +78,7 @@ useFocus(clientNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Invite Member </span>

resources/js/Components/Common/Project/ProjectEditModal.vue

@@ -79,7 +79,7 @@ async function submitBillableRate() {
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Edit Project {{ props.originalProject.name }} </span>

resources/js/Components/Common/ProjectMember/ProjectMemberCreateModal.vue

@@ -38,7 +38,7 @@ useFocus(projectNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span>Add Project Member</span>

resources/js/Components/Common/ProjectMember/ProjectMemberEditModal.vue

@@ -63,7 +63,7 @@ useFocus(projectNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span>Edit Project Member</span>

resources/js/Components/Common/Report/ReportCreateModal.vue

@@ -79,7 +79,7 @@ async function submit() {
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create Report </span>

resources/js/Components/Common/Report/ReportEditModal.vue

@@ -96,7 +96,7 @@ async function submit() {
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create Report </span>

resources/js/Components/Common/Reporting/ReportingOverview.vue

@@ -57,7 +57,7 @@ const { handleApiRequestNotifications } = useNotificationsStore();
 
 const startDate = useSessionStorage<string>(
     'reporting-start-date',
-    getLocalizedDayJs(getDayJsInstance()().format()).subtract(14, 'd').format()
+    getLocalizedDayJs(getDayJsInstance()().format()).subtract(13, 'd').format()
 );
 const endDate = useSessionStorage<string>(
     'reporting-end-date',

resources/js/Components/Common/Tag/TagEditModal.vue

@@ -36,7 +36,7 @@ useFocus(tagNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Update Tag </span>

resources/js/Components/Common/Task/TaskCreateModal.vue

@@ -50,7 +50,7 @@ useFocus(taskNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create Task </span>

resources/js/Components/Common/Task/TaskEditModal.vue

@@ -35,7 +35,7 @@ useFocus(taskNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Update Task </span>

resources/js/Components/Timesheet/BreakPlacementModal.vue

@@ -179,7 +179,7 @@ async function submit() {
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="emit('cancel')">
+    <DialogModal closeable :show="show" @close="emit('cancel')" @submit="submit">
         <template #title>
             <div class="flex items-center space-x-2">
                 <Coffee class="w-5 h-5 text-text-secondary" />

resources/js/Components/Timesheet/TimesheetHeader.vue

@@ -1,11 +1,9 @@
 <script setup lang="ts">
-import { Button } from '@/packages/ui/src/Buttons';
-import { ChevronLeftIcon, ChevronRightIcon, CalendarIcon } from '@heroicons/vue/20/solid';
+import DateRangeNavigator from '@/packages/ui/src/Input/DateRangeNavigator.vue';
 
 defineProps<{
-    isCurrentWeek: boolean;
     weekNumber: number;
-    weekRangeDisplay: string;
+    rangeLabel: string;
     weekTotalFormatted: string;
 }>();
 
@@ -19,33 +17,16 @@ defineEmits<{
 <template>
     <div class="flex flex-wrap items-center justify-between gap-4 mb-4 px-2 sm:px-4 lg:px-6">
         <!-- Left: Week navigation -->
-        <div class="flex items-center gap-2">
-            <Button
-                variant="outline"
-                size="icon"
-                class="h-8 w-8"
-                data-testid="timesheet_prev_week"
-                @click="$emit('previous')">
-                <ChevronLeftIcon class="h-4 w-4" />
-            </Button>
-            <button
-                data-testid="timesheet_week_display"
-                class="flex items-center gap-2 px-3 py-1.5 text-sm font-medium text-text-primary hover:bg-card-background rounded-md transition"
-                @click="$emit('current')">
-                <CalendarIcon class="h-4 w-4 text-icon-default" />
-                <span v-if="isCurrentWeek">This week</span>
-                <span v-else>{{ weekRangeDisplay }}</span>
-                <span class="text-text-tertiary">&middot; W{{ weekNumber }}</span>
-            </button>
-            <Button
-                variant="outline"
-                size="icon"
-                class="h-8 w-8"
-                data-testid="timesheet_next_week"
-                @click="$emit('next')">
-                <ChevronRightIcon class="h-4 w-4" />
-            </Button>
-        </div>
+        <DateRangeNavigator
+            :label="rangeLabel"
+            :secondary-label="`W${weekNumber}`"
+            previous-test-id="timesheet_prev_week"
+            trigger-test-id="timesheet_week_display"
+            next-test-id="timesheet_next_week"
+            trigger-aria-label="Return to current week"
+            @previous="$emit('previous')"
+            @next="$emit('next')"
+            @select="$emit('current')" />
 
         <!-- Right: Week total -->
         <div class="flex items-center gap-2.5">

resources/js/Pages/ReportingDetailed.vue

@@ -61,7 +61,7 @@ type TimeEntryRoundingType = 'up' | 'down' | 'nearest';
 
 const startDate = useSessionStorage<string>(
     'reporting-start-date',
-    getLocalizedDayJs(getDayJsInstance()().format()).subtract(14, 'd').format()
+    getLocalizedDayJs(getDayJsInstance()().format()).subtract(13, 'd').format()
 );
 const endDate = useSessionStorage<string>(
     'reporting-end-date',

resources/js/Pages/Timesheet.vue

@@ -30,6 +30,7 @@ import {
     getLocalizedDayJs,
 } from '@/packages/ui/src/utils/time';
 import { getBreakPlacementHint } from '@/packages/ui/src/utils/breakPlacement';
+import { getDateRangeLabel } from '@/packages/ui/src/utils/dateRange';
 import { useTimesheetWeek } from '@/utils/timesheet/useTimesheetWeek';
 import { useTimesheetCellMutations } from '@/utils/timesheet/useTimesheetCellMutations';
 import { useTimesheetRowMutations } from '@/utils/timesheet/useTimesheetRowMutations';
@@ -44,7 +45,6 @@ const {
     weekEnd,
     weekDays,
     weekNumber,
-    isCurrentWeek,
     todayDate,
     goToPreviousWeek,
     goToNextWeek,
@@ -109,13 +109,9 @@ const weekTotalFormatted = computed(() =>
     formatHumanReadableDuration(grandTotal.value, intervalFormat.value, numberFormat.value)
 );
 
-const weekRangeDisplay = computed(() => {
-    const start = weekStart.value;
-    const end = start.add(6, 'day');
-    return start.month() === end.month()
-        ? `${start.format('MMM D')} - ${end.format('D')}`
-        : `${start.format('MMM D')} - ${end.format('MMM D')}`;
-});
+const weekRangeLabel = computed(() =>
+    getDateRangeLabel(weekStart.value, weekStart.value.add(6, 'day'))
+);
 
 // ── Cell / row mutation handlers ──────────────────────────────────
 const {
@@ -208,9 +204,8 @@ async function createTag(name: string): Promise<Tag | undefined> {
     <AppLayout title="Timesheet" data-testid="timesheet_view">
         <div class="pt-5 lg:pt-8 pb-4 lg:pb-6">
             <TimesheetHeader
-                :is-current-week="isCurrentWeek"
                 :week-number="weekNumber"
-                :week-range-display="weekRangeDisplay"
+                :range-label="weekRangeLabel"
                 :week-total-formatted="weekTotalFormatted"
                 @previous="goToPreviousWeek"
                 @next="goToNextWeek"

resources/js/packages/ui/src/DialogModal.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import Modal from './Modal.vue';
 
-const emit = defineEmits(['close']);
+const emit = defineEmits(['close', 'submit']);
 
 defineProps({
     show: {
@@ -24,7 +24,12 @@ const close = () => {
 </script>
 
 <template>
-    <Modal :show="show" :max-width="maxWidth" :closeable="closeable" @close="close">
+    <Modal
+        :show="show"
+        :max-width="maxWidth"
+        :closeable="closeable"
+        @close="close"
+        @submit="emit('submit')">
         <div class="px-4 lg:px-6 py-4">
             <div class="text-lg font-medium text-text-primary" role="heading">
                 <slot name="title" />

resources/js/packages/ui/src/FullCalendar/CalendarToolbar.vue

@@ -1,13 +1,12 @@
 <script setup lang="ts">
-import { Button } from '..';
-import { ChevronLeft, ChevronRight } from '@lucide/vue';
 import { Tabs, TabsList } from '../tabs';
 import TabBarItem from '../TabBar/TabBarItem.vue';
+import DateRangeNavigator from '../Input/DateRangeNavigator.vue';
 import CalendarSettingsPopover from './CalendarSettingsPopover.vue';
 import type { CalendarSettings } from './calendarSettings';
 
 defineProps<{
-    viewTitle: string;
+    rangeLabel: string;
     activeView: string;
     settings: CalendarSettings;
 }>();
@@ -23,31 +22,13 @@ const emit = defineEmits<{
 
 <template>
     <div class="flex items-center justify-between bg-default-background px-2 py-1.5">
-        <!-- Left: Navigation -->
-        <div class="flex items-center gap-1">
-            <Button
-                variant="outline"
-                size="sm"
-                class="h-8 w-8 p-0"
-                aria-label="Previous"
-                @click="emit('prev')">
-                <ChevronLeft class="h-4 w-4" />
-            </Button>
-            <Button
-                variant="outline"
-                size="sm"
-                class="h-8 w-8 p-0"
-                aria-label="Next"
-                @click="emit('next')">
-                <ChevronRight class="h-4 w-4" />
-            </Button>
-            <Button variant="outline" size="sm" @click="emit('today')"> today </Button>
-        </div>
-
-        <!-- Center: Title -->
-        <span data-testid="calendar-title" class="text-base font-semibold text-foreground">{{
-            viewTitle
-        }}</span>
+        <DateRangeNavigator
+            :label="rangeLabel"
+            trigger-test-id="calendar-title"
+            trigger-aria-label="today"
+            @previous="emit('prev')"
+            @next="emit('next')"
+            @select="emit('today')" />
 
         <!-- Right: View switcher + Settings -->
         <div class="flex items-center gap-1">

resources/js/packages/ui/src/FullCalendar/TimeEntryCalendar.vue

@@ -138,7 +138,7 @@ const {
 const {
     activeView,
     viewDays,
-    viewTitle,
+    rangeLabel,
     emitDatesChange,
     handlePrev,
     handleNext,
@@ -514,7 +514,7 @@ function getEventDurationSeconds(dayEvent: DayEvent, dayStr: string): number {
 
         <template v-if="!loading">
             <CalendarToolbar
-                :view-title="viewTitle"
+                :range-label="rangeLabel"
                 :active-view="activeView"
                 :settings="calendarSettings"
                 @prev="handlePrev"

resources/js/packages/ui/src/FullCalendar/useCalendarNavigation.ts

@@ -2,6 +2,7 @@ import { computed, ref } from 'vue';
 import type { Dayjs } from 'dayjs';
 import { getLocalizedDayJs } from '../utils/time';
 import { getWeekStartDayNumber } from '../utils/settings';
+import { getDateRangeLabel } from '../utils/dateRange';
 
 export function useCalendarNavigation(callbacks: {
     onDatesChange: (payload: { start: Dayjs; end: Dayjs }) => void;
@@ -34,24 +35,10 @@ export function useCalendarNavigation(callbacks: {
         return days;
     });
 
-    const viewTitle = computed(() => {
-        if (activeView.value === 'timeGridDay') {
-            return currentDate.value.format('MMMM YYYY');
-        }
-
+    const rangeLabel = computed(() => {
         const days = viewDays.value;
         if (days.length === 0) return '';
-
-        const first = days[0]!;
-        const last = days[days.length - 1]!;
-
-        if (first.year() !== last.year()) {
-            return `${first.format('MMM YYYY')} \u2013 ${last.format('MMM YYYY')}`;
-        }
-        if (first.month() !== last.month()) {
-            return `${first.format('MMM')} \u2013 ${last.format('MMM YYYY')}`;
-        }
-        return first.format('MMMM YYYY');
+        return getDateRangeLabel(days[0]!, days[days.length - 1]!);
     });
 
     function emitDatesChange() {
@@ -99,7 +86,7 @@ export function useCalendarNavigation(callbacks: {
         activeView,
         currentDate,
         viewDays,
-        viewTitle,
+        rangeLabel,
         emitDatesChange,
         handlePrev,
         handleNext,

resources/js/packages/ui/src/FullCalendar/useEventResize.ts

@@ -111,6 +111,8 @@ export function useEventResize(params: {
         edge: 'start' | 'end',
         dayStr: string
     ) {
+        if (e.button !== 0) return;
+
         e.preventDefault();
         e.stopPropagation();
 

resources/js/packages/ui/src/Input/DateRangeNavigator.vue

@@ -0,0 +1,81 @@
+<script setup lang="ts">
+import { ChevronLeft, ChevronRight, CalendarIcon } from '@lucide/vue';
+import { Button } from '../Buttons';
+
+withDefaults(
+    defineProps<{
+        label: string;
+        secondaryLabel?: string;
+        previousDisabled?: boolean;
+        nextDisabled?: boolean;
+        previousTestId?: string;
+        triggerTestId?: string;
+        nextTestId?: string;
+        triggerAriaLabel?: string;
+    }>(),
+    {
+        secondaryLabel: undefined,
+        previousTestId: undefined,
+        triggerTestId: undefined,
+        nextTestId: undefined,
+        triggerAriaLabel: undefined,
+    }
+);
+
+const emit = defineEmits<{
+    previous: [];
+    next: [];
+    select: [];
+}>();
+
+const triggerClass =
+    'h-8 w-[13.5rem] justify-center rounded-none border-l border-r border-border-secondary px-2.5 text-text-primary tabular-nums hover:bg-card-background-active';
+</script>
+
+<template>
+    <div
+        class="tabular-nums inline-flex items-stretch overflow-hidden rounded-md border border-input bg-card-background shadow-xs dark:bg-transparent"
+        role="group"
+        aria-label="Date range navigation">
+        <Button
+            type="button"
+            variant="ghost"
+            size="icon"
+            class="h-8 w-8 shrink-0 rounded-none hover:bg-card-background-active"
+            aria-label="Previous"
+            :disabled="previousDisabled"
+            :data-testid="previousTestId"
+            @click="emit('previous')">
+            <ChevronLeft class="h-4 w-4" />
+        </Button>
+
+        <slot name="trigger" :trigger-class="triggerClass">
+            <Button
+                type="button"
+                variant="ghost"
+                size="sm"
+                :class="triggerClass"
+                :aria-label="triggerAriaLabel"
+                :data-testid="triggerTestId"
+                @click="emit('select')">
+                <CalendarIcon class="h-4 w-4 shrink-0 text-icon-default" />
+                <span class="min-w-0 truncate">{{ label }}</span>
+                <span v-if="secondaryLabel" class="shrink-0 text-text-tertiary">
+                    &middot; {{ secondaryLabel }}
+                </span>
+            </Button>
+        </slot>
+
+        <Button
+            type="button"
+            variant="ghost"
+            size="icon"
+            class="h-8 w-8 shrink-0 rounded-none hover:bg-card-background-active"
+            aria-label="Next"
+            :disabled="nextDisabled"
+            :data-testid="nextTestId"
+            @click="emit('next')">
+            <ChevronRight class="h-4 w-4" />
+        </Button>
+    </div>
+</template>

resources/js/packages/ui/src/Input/DateRangePicker.vue

@@ -6,22 +6,22 @@ import { CalendarDate } from '@internationalized/date';
 import { CalendarIcon } from '@lucide/vue';
 import { computed, ref, inject, type ComputedRef, watch } from 'vue';
 import { twMerge } from 'tailwind-merge';
-import {
-    getDayJsInstance,
-    getLocalizedDayJs,
-    firstDayIndex,
-    type WeekStartDay,
-} from '@/packages/ui/src/utils/time';
+import DateRangeNavigator from './DateRangeNavigator.vue';
+import { getLocalizedDayJs, firstDayIndex, type WeekStartDay } from '@/packages/ui/src/utils/time';
+import { getDateRangeLabel, shiftDateRange, type DateRangeDirection } from '../utils/dateRange';
 import { type Organization } from '@/packages/api/src';
 import { getUserTimezone } from '@/packages/ui/src/utils/settings';
-import { formatDate } from '@/packages/ui/src/utils/time';
 
 const weekStartsOn = computed((): WeekStartDay => firstDayIndex.value as WeekStartDay);
 
-const props = defineProps<{
-    start: string;
-    end: string;
-}>();
+const props = withDefaults(
+    defineProps<{
+        start: string;
+        end: string;
+        allowFuture?: boolean;
+    }>(),
+    { allowFuture: false }
+);
 
 const emit = defineEmits<{
     (e: 'update:start', value: string): void;
@@ -35,10 +35,13 @@ interface CalendarDateRange {
 }
 
 const today = computed(() => {
-    const now = getDayJsInstance()();
+    const now = getLocalizedDayJs();
     return new CalendarDate(now.year(), now.month() + 1, now.date());
 });
 
+const startDay = computed(() => (props.start ? getLocalizedDayJs(props.start) : undefined));
+const endDay = computed(() => (props.end ? getLocalizedDayJs(props.end) : undefined));
+
 const modelValue = computed<CalendarDateRange>({
     get: () => ({
         start: props.start
@@ -91,7 +94,7 @@ function setLastWeek() {
 }
 
 function setLast14Days() {
-    emit('update:start', getLocalizedDayJs().subtract(14, 'days').format());
+    emit('update:start', getLocalizedDayJs().subtract(13, 'days').startOf('day').format());
     emit('update:end', getLocalizedDayJs().format());
     open.value = false;
 }
@@ -109,14 +112,14 @@ function setLastMonth() {
 }
 
 function setLast30Days() {
-    emit('update:start', getLocalizedDayJs().subtract(30, 'days').format());
+    emit('update:start', getLocalizedDayJs().subtract(29, 'days').startOf('day').format());
     emit('update:end', getLocalizedDayJs().format());
     open.value = false;
 }
 
 function setLast90Days() {
-    emit('update:start', getDayJsInstance()().subtract(90, 'days').format());
-    emit('update:end', getDayJsInstance()().format());
+    emit('update:start', getLocalizedDayJs().subtract(89, 'days').startOf('day').format());
+    emit('update:end', getLocalizedDayJs().format());
     open.value = false;
 }
 
@@ -140,6 +143,38 @@ function setLastYear() {
 
 const organization = inject<ComputedRef<Organization>>('organization');
 
+const displayLabel = computed(() => {
+    if (!startDay.value) return 'Pick a date';
+    if (!endDay.value) {
+        return getDateRangeLabel(startDay.value, startDay.value, {
+            dateFormat: organization?.value?.date_format,
+        });
+    }
+    return getDateRangeLabel(startDay.value, endDay.value, {
+        dateFormat: organization?.value?.date_format,
+    });
+});
+
+const nextRange = computed(() => {
+    if (!startDay.value || !endDay.value) return undefined;
+    return shiftDateRange(startDay.value, endDay.value, 1);
+});
+
+const nextDisabled = computed(
+    () =>
+        !props.allowFuture &&
+        !!nextRange.value &&
+        nextRange.value.start.isAfter(getLocalizedDayJs().endOf('day'))
+);
+
+function navigate(direction: DateRangeDirection) {
+    if (!startDay.value || !endDay.value) return;
+    const shifted = shiftDateRange(startDay.value, endDay.value, direction);
+    emit('update:start', shifted.start.format());
+    emit('update:end', shifted.end.format());
+    emit('submit');
+}
+
 watch(open, (value) => {
     if (value === false) {
         emit('submit');
@@ -148,77 +183,120 @@ watch(open, (value) => {
 </script>
 
 <template>
-    <Popover v-model:open="open">
-        <PopoverTrigger as-child>
-            <Button
-                variant="outline"
-                :class="
-                    twMerge(
-                        'flex w-full items-center justify-between whitespace-nowrap h-[34px] text-start',
-                        !modelValue && 'text-muted-foreground'
-                    )
-                ">
-                <CalendarIcon class="-ml-0.5 text-text-quaternary h-4 w-4" />
-                <template v-if="modelValue.start">
-                    <template v-if="modelValue.end">
-                        {{ formatDate(modelValue.start.toString(), organization?.date_format) }}
-                        -
-                        {{ formatDate(modelValue.end.toString(), organization?.date_format) }}
-                    </template>
-                    <template v-else>
-                        {{ formatDate(modelValue.start.toString(), organization?.date_format) }}
-                    </template>
-                </template>
-                <template v-else> Pick a date </template>
-            </Button>
-        </PopoverTrigger>
-        <PopoverContent class="w-auto p-0">
-            <div class="flex divide-x divide-border-secondary">
-                <div
-                    class="text-text-primary text-sm flex flex-col space-y-0.5 items-start py-2 px-2">
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setToday"
-                        >Today</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setThisWeek"
-                        >This Week</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLastWeek"
-                        >Last Week</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLast14Days"
-                        >Last 14 days</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setThisMonth"
-                        >This Month</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLastMonth"
-                        >Last Month</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLast30Days"
-                        >Last 30 days</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLast90Days"
-                        >Last 90 days</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLast12Months"
-                        >Last 12 months</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setThisYear"
-                        >This year</Button
-                    >
-                    <Button variant="ghost" size="sm" class="justify-start" @click="setLastYear"
-                        >Last year</Button
-                    >
-                </div>
-                <div class="pl-2">
-                    <RangeCalendar
-                        v-model="modelValue"
-                        initial-focus
-                        :number-of-months="2"
-                        :max-value="today"
-                        :week-starts-on="weekStartsOn" />
-                </div>
-            </div>
-        </PopoverContent>
-    </Popover>
+    <DateRangeNavigator
+        :label="displayLabel"
+        :next-disabled="nextDisabled"
+        previous-test-id="date_range_picker_previous"
+        trigger-test-id="date_range_picker_display"
+        next-test-id="date_range_picker_next"
+        @previous="navigate(-1)"
+        @next="navigate(1)">
+        <template #trigger="{ triggerClass }">
+            <Popover v-model:open="open">
+                <PopoverTrigger as-child>
+                    <Button
+                        type="button"
+                        variant="ghost"
+                        size="sm"
+                        :class="twMerge(triggerClass, !modelValue.start && 'text-muted-foreground')"
+                        data-testid="date_range_picker_display">
+                        <CalendarIcon class="text-text-quaternary h-4 w-4 shrink-0" />
+                        <span class="min-w-0 truncate">{{ displayLabel }}</span>
+                    </Button>
+                </PopoverTrigger>
+                <PopoverContent class="w-auto p-0">
+                    <div class="flex divide-x divide-border-secondary">
+                        <div
+                            class="text-text-primary text-sm flex flex-col space-y-0.5 items-start py-2 px-2">
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setToday"
+                                >Today</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setThisWeek"
+                                >This Week</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLastWeek"
+                                >Last Week</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLast14Days"
+                                >Last 14 Days</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setThisMonth"
+                                >This Month</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLastMonth"
+                                >Last Month</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLast30Days"
+                                >Last 30 Days</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLast90Days"
+                                >Last 90 Days</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLast12Months"
+                                >Last 12 Months</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setThisYear"
+                                >This Year</Button
+                            >
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                class="justify-start"
+                                @click="setLastYear"
+                                >Last Year</Button
+                            >
+                        </div>
+                        <div class="pl-2">
+                            <RangeCalendar
+                                v-model="modelValue"
+                                initial-focus
+                                :number-of-months="2"
+                                :max-value="allowFuture ? undefined : today"
+                                :week-starts-on="weekStartsOn" />
+                        </div>
+                    </div>
+                </PopoverContent>
+            </Popover>
+        </template>
+    </DateRangeNavigator>
 </template>

resources/js/packages/ui/src/Modal.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { Dialog, DialogContent, DialogFooter } from './dialog/index';
-import { computed } from 'vue';
+import { computed, nextTick } from 'vue';
 
 const props = defineProps({
     show: {
@@ -17,7 +17,7 @@ const props = defineProps({
     },
 });
 
-const emit = defineEmits(['close']);
+const emit = defineEmits(['close', 'submit']);
 
 const close = () => {
     if (props.closeable) {
@@ -25,6 +25,25 @@ const close = () => {
     }
 };
 
+// Ctrl+Enter (Cmd+Enter on macOS) submits the modal from any focused element inside it.
+// Handled in the capture phase so child elements (buttons, dropdown triggers, inputs with
+// their own Enter handlers) never see the keystroke and cannot open or double-submit.
+async function onKeydownCapture(event: KeyboardEvent) {
+    if (event.key !== 'Enter' || !(event.ctrlKey || event.metaKey) || event.isComposing) {
+        return;
+    }
+    event.preventDefault();
+    event.stopPropagation();
+    // Inputs like the time and duration fields commit their value on blur, so blur first
+    // and let the resulting model updates settle before submitting.
+    const active = document.activeElement;
+    if (active instanceof HTMLElement) {
+        active.blur();
+    }
+    await nextTick();
+    emit('submit');
+}
+
 const maxWidthClass = computed(() => {
     return {
         sm: 'sm:max-w-sm',
@@ -39,7 +58,7 @@ const maxWidthClass = computed(() => {
 <template>
     <Dialog :open="show" @update:open="close">
         <DialogContent :class="maxWidthClass">
-            <div class="min-w-0">
+            <div class="min-w-0" @keydown.capture="onKeydownCapture">
                 <slot />
             </div>
 

resources/js/packages/ui/src/Project/ProjectCreateModal.vue

@@ -72,7 +72,7 @@ const currentClientName = computed(() => {
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create Project </span>

resources/js/packages/ui/src/Tag/TagCreateModal.vue

@@ -30,7 +30,7 @@ useFocus(tagNameInput, { initialValue: true });
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create Tags </span>

resources/js/packages/ui/src/TimeEntry/BreakCreateModal.vue

@@ -78,7 +78,7 @@ async function submit() {
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex items-center space-x-2 text-amber-600 dark:text-amber-400">
                 <Coffee class="w-5 h-5" />

resources/js/packages/ui/src/TimeEntry/TimeEntryCreateModal.vue

@@ -126,7 +126,7 @@ const billableProxy = computed({
 </script>
 
 <template>
-    <DialogModal closeable :show="show" @close="show = false">
+    <DialogModal closeable :show="show" @close="show = false" @submit="submit">
         <template #title>
             <div class="flex space-x-2">
                 <span> Create manual time entry </span>