Clarify out of scope items for vulnerability reports

Added out of scope section for vulnerability reporting.

README.md

@@ -1,4 +1,4 @@
-# solidtime - The modern Open-Source Time Tracker
+# solidtime - The modern Open-Source TimeTracker
 
 [![GitHub License](https://img.shields.io/github/license/solidtime-io/solidtime?style=flat-square)](https://github.com/solidtime-io/solidtime/blob/main/LICENSE.md)
 [![Codecov](https://img.shields.io/codecov/c/github/solidtime-io/solidtime?style=flat-square&logo=codecov)](https://codecov.io/gh/solidtime-io/solidtime)

SECURITY.md

@@ -3,3 +3,18 @@
 ## Reporting a Vulnerability
 
 If you discover a security vulnerability regarding this project, please e-mail me to [security@solidtime.io](mailto:security@solidtime.io)!
+
+## Out of scope
+
+
+Reports we typically won't issue an advisory for:
+
+* Theoretical findings without a working PoC
+* Raw scanner output without manual validation
+* Missing/weak security headers in isolation (CSP, X-Frame-Options, HSTS, etc.)
+* SPF/DKIM/DMARC on non-mail-sending domains; missing DNSSEC/CAA; TLS cipher preferences
+* Self-XSS; CSRF on non-state-changing endpoints (logout, theme)
+* CSV / spreadsheet formula injection in exports — treated as a spreadsheet-application issue
+* Org owners or admins acting destructively within their own organization
+* Anything requiring direct DB, shell, or filesystem access on a self-hosted instance
+* Missing OAuth Scope enforcement (this is not implemented yet, but AI scanners flag it which is why it is included in this list until we actually support it)

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -629,9 +629,9 @@ class TimeEntryController extends Controller
         /** @var Member|null $member */
         $member = $request->has('member_id') ? Member::query()->findOrFail($request->input('member_id')) : null;
         if ($timeEntry->member->user_id === Auth::id() && ($member === null || $member->user_id === Auth::id())) {
-            $this->checkPermission($organization, 'time-entries:update:own');
+            $this->checkPermission($organization, 'time-entries:update:own', $timeEntry);
         } else {
-            $this->checkPermission($organization, 'time-entries:update:all');
+            $this->checkPermission($organization, 'time-entries:update:all', $timeEntry);
         }
 
         if ($timeEntry->end !== null && $request->has('end') && $request->input('end') === null) {

app/Providers/JetstreamServiceProvider.php

@@ -304,28 +304,8 @@ class JetstreamServiceProvider extends ServiceProvider
                             'owner' => [
                                 'id' => $owner->getKey(),
                                 'name' => $owner->name,
-                                'email' => $owner->email,
                                 'profile_photo_url' => $owner->profile_photo_url,
                             ],
-                            'users' => $teamModel->users->map(function (User $user): array {
-                                return [
-                                    'id' => $user->getKey(),
-                                    'name' => $user->name,
-                                    'email' => $user->email,
-                                    'profile_photo_url' => $user->profile_photo_url,
-                                    'membership' => [
-                                        'id' => $user->membership->id,
-                                        'role' => $user->membership->role,
-                                    ],
-                                ];
-                            }),
-                            'team_invitations' => $teamModel->teamInvitations->map(function (OrganizationInvitation $invitation): array {
-                                return [
-                                    'id' => $invitation->getKey(),
-                                    'email' => $invitation->email,
-                                    'role' => $invitation->role,
-                                ];
-                            }),
                         ],
                         'currencies' => array_map(function (Currency $currency): string {
                             return $currency->getName();

app/Service/LocalizationService.php

@@ -96,6 +96,30 @@ class LocalizationService
         }
     }
 
+    /**
+     * Format a duration for reporting contexts (PDF reports, places that display duration
+     * directly next to cost). Promotes the verbose `Hh Mm` format to the compact `HH:MM:SS`
+     * so totals stay narrow and reconcile with cost, which is always computed to the second.
+     */
+    public function formatIntervalForReporting(CarbonInterval $interval): string
+    {
+        $promoted = [
+            IntervalFormat::HoursMinutes,
+            IntervalFormat::HoursMinutesColonSeparated,
+        ];
+        if (! in_array($this->intervalFormat, $promoted, true)) {
+            return $this->formatInterval($interval);
+        }
+
+        $previous = $this->intervalFormat;
+        $this->intervalFormat = IntervalFormat::HoursMinutesSecondsColonSeparated;
+        try {
+            return $this->formatInterval($interval);
+        } finally {
+            $this->intervalFormat = $previous;
+        }
+    }
+
     public function formatCurrency(Money $money): string
     {
         $currencyService = app(CurrencyService::class);

e2e/profile.spec.ts

@@ -230,6 +230,37 @@ test('test that theme can be changed to dark and light', async ({ page }) => {
     await expect(page.getByText('System default:')).toBeVisible();
 });
 
+// =============================================
+// Group similar time entries
+// =============================================
+
+test('test that group similar time entries setting can be toggled', async ({ page }) => {
+    await goToProfilePage(page);
+
+    // Get the checkbox
+    const checkbox = page.getByLabel('Group similar time entries');
+
+    // Get initial value and verify it is checked (default is true)
+    const initialValue = await checkbox.isChecked();
+    await expect(checkbox).toBeChecked();
+
+    // Toggle the checkbox
+    await checkbox.click();
+
+    // Reload
+    await page.reload();
+
+    // Verify the value is toggled
+    const afterValue = await page.getByLabel('Group similar time entries').isChecked();
+    expect(afterValue).toBe(!initialValue);
+
+    // Verify localStorage persists the setting
+    const storedValue = await page.evaluate(() =>
+        localStorage.getItem('group-similar-time-entries')
+    );
+    expect(storedValue).toBe(String(!initialValue));
+});
+
 // =============================================
 // Two Factor Authentication Tests
 // =============================================

e2e/reporting-detailed.spec.ts

@@ -32,7 +32,7 @@ test('test that detailed view shows time entries correctly', async ({ page, ctx
 
     // Verify the time entry is shown with all details
     await expect(page.getByText(projectName, { exact: true }).first()).toBeVisible();
-    await expect(page.locator('input[name="Duration"]').first()).toHaveValue('1h 00min');
+    await expect(page.locator('input[name="Duration"]').first()).toHaveValue('1:00:00');
     await expect(page.getByText('Entry for ' + projectName, { exact: true }).first()).toBeVisible();
 });
 
@@ -62,8 +62,8 @@ test('test that updating duration in detailed view works correctly', async ({ pa
         ),
     ]);
 
-    // Verify the new duration is displayed
-    await expect(durationInput).toHaveValue(updatedDuration);
+    // Verify the new duration is displayed (reporting views promote to HH:MM:SS format)
+    await expect(durationInput).toHaveValue('2:30:00');
 });
 
 // ──────────────────────────────────────────────────

e2e/reporting.spec.ts

@@ -333,7 +333,7 @@ test('test that task filtering works in reporting', async ({ page, ctx }) => {
     await page.keyboard.press('Escape');
 
     // Verify the report only shows 1h (task1's duration)
-    await expect(page.getByTestId('reporting_view').getByText('1h 00min').first()).toBeVisible();
+    await expect(page.getByTestId('reporting_view').getByText('1:00:00').first()).toBeVisible();
 });
 
 test('test that task multiselect search filters the option list', async ({ page, ctx }) => {
@@ -474,7 +474,7 @@ test('test that tag filtering works in reporting', async ({ page, ctx }) => {
     await page.keyboard.press('Escape');
 
     // Verify only time entries with tag1 are shown
-    await expect(page.getByTestId('reporting_view').getByText('1h 00min').first()).toBeVisible();
+    await expect(page.getByTestId('reporting_view').getByText('1:00:00').first()).toBeVisible();
 });
 
 test('test that tag dropdown search filters the option list', async ({ page, ctx }) => {
@@ -594,7 +594,7 @@ test('test that billable status filtering works in reporting', async ({ page, ct
         waitForReportingUpdate(page),
     ]);
 
-    await expect(page.getByTestId('reporting_view').getByText('1h 00min').first()).toBeVisible();
+    await expect(page.getByTestId('reporting_view').getByText('1:00:00').first()).toBeVisible();
 });
 
 test('test that billable filter can switch between all three states', async ({ page }) => {
@@ -885,7 +885,7 @@ test.describe('Employee Reporting Restrictions', () => {
 
         // Employee's data should be visible (1h)
         await expect(
-            employee.page.getByTestId('reporting_view').getByText('1h 00min').first()
+            employee.page.getByTestId('reporting_view').getByText('1:00:00').first()
         ).toBeVisible();
     });
 

e2e/shared-reports.spec.ts

@@ -292,8 +292,8 @@ test('test that shared report respects task filter', async ({ page, ctx }) => {
     await page.goto(shareableLink);
     await expect(page.getByText('Reporting')).toBeVisible();
     await expect(page.getByText('Total')).toBeVisible();
-    await expect(page.getByText('1h 00min').first()).toBeVisible();
-    await expect(page.getByText('3h 00min')).not.toBeVisible();
+    await expect(page.getByText('1:00:00').first()).toBeVisible();
+    await expect(page.getByText('3:00:00')).not.toBeVisible();
 });
 
 test('test that shared report respects client filter', async ({ page, ctx }) => {
@@ -369,8 +369,8 @@ test('test that shared report respects tag filter', async ({ page, ctx }) => {
     await page.goto(shareableLink);
     await expect(page.getByText('Reporting')).toBeVisible();
     await expect(page.getByText('Total')).toBeVisible();
-    await expect(page.getByText('1h 00min').first()).toBeVisible();
-    await expect(page.getByText('3h 00min')).not.toBeVisible();
+    await expect(page.getByText('1:00:00').first()).toBeVisible();
+    await expect(page.getByText('3:00:00')).not.toBeVisible();
 });
 
 test('test that shared report respects member filter', async ({ page, ctx }) => {
@@ -425,7 +425,7 @@ test('test that shared report with billable filter only shows billable entries',
     ]);
 
     // Verify only 1h shows before saving
-    await expect(page.getByTestId('reporting_view').getByText('1h 00min').first()).toBeVisible();
+    await expect(page.getByTestId('reporting_view').getByText('1:00:00').first()).toBeVisible();
 
     const { shareableLink } = await saveAsSharedReport(page, reportName);
 
@@ -435,8 +435,8 @@ test('test that shared report with billable filter only shows billable entries',
     await expect(page.getByText('Total')).toBeVisible();
 
     // Shared report should only show the 1h billable entry, not the 2h non-billable
-    await expect(page.getByText('1h 00min').first()).toBeVisible();
-    await expect(page.getByText('3h 00min')).not.toBeVisible();
+    await expect(page.getByText('1:00:00').first()).toBeVisible();
+    await expect(page.getByText('3:00:00')).not.toBeVisible();
 });
 
 // ──────────────────────────────────────────────────

e2e/time.spec.ts

@@ -39,6 +39,10 @@ function getMonthFromTimestamp(timestamp: string): number {
     return new Date(timestamp).getUTCMonth() + 1;
 }
 
+async function goToProfilePage(page: Page) {
+    await page.goto(PLAYWRIGHT_BASE_URL + '/user/profile');
+}
+
 async function goToTimeOverview(page: Page) {
     await page.goto(PLAYWRIGHT_BASE_URL + '/time');
 }
@@ -67,6 +71,14 @@ async function createEmptyTimeEntry(page: Page) {
     ]);
 }
 
+async function setTimeEntriesGrouping(page: Page, enabled: boolean) {
+    await goToProfilePage(page);
+    const checkbox = page.getByLabel('Group similar time entries');
+    const isChecked = await checkbox.isChecked();
+    if (isChecked !== enabled) await checkbox.click();
+    await goToTimeOverview(page);
+}
+
 test('test that starting and stopping an empty time entry shows a new time entry in the overview', async ({
     page,
 }) => {
@@ -333,6 +345,30 @@ test.skip('test that load more works when the end of page is reached', async ({
     await expect(page.locator('body')).toHaveText(/All time entries are loaded!/);
 });
 
+test('test that Group similar time entries option is affected', async ({ page }) => {
+    // Enable grouping
+    await setTimeEntriesGrouping(page, true);
+
+    // Create 2 similar time entries
+    await createEmptyTimeEntry(page);
+    await page.waitForSelector('[data-testid="time_entry_row"]', { timeout: 1000 });
+    await createEmptyTimeEntry(page);
+
+    // Verify similar time entries are grouped
+    await expect(page.getByTestId('grouped_items_count_button').first()).toBeVisible({
+        timeout: 1000,
+    });
+
+    // Disable grouping
+    await setTimeEntriesGrouping(page, false);
+
+    // Verify similar time entries are not grouped
+    await expect(page.locator('[data-testid="time_entry_row"]')).toHaveCount(2, { timeout: 1000 });
+    await expect(page.locator('[data-testid="grouped_items_count_button"]')).toHaveCount(0, {
+        timeout: 1000,
+    });
+});
+
 // TODO: Test that updating the time entry start / end times works while it is running
 
 // TODO: Test for project update

resources/js/Components/Common/Reporting/ReportingChart.vue

@@ -2,7 +2,7 @@
 import VChart, { THEME_KEY } from 'vue-echarts';
 import { computed, provide, inject, shallowRef, type ComputedRef } from 'vue';
 import LinearGradient from 'zrender/lib/graphic/LinearGradient';
-import { formatDate, formatHumanReadableDuration, formatWeek } from '@/packages/ui/src/utils/time';
+import { formatDate, formatReportingDuration, formatWeek } from '@/packages/ui/src/utils/time';
 import { use } from 'echarts/core';
 import { CanvasRenderer } from 'echarts/renderers';
 import { BarChart } from 'echarts/charts';
@@ -137,7 +137,7 @@ const option = computed(() => ({
             type: 'bar',
             tooltip: {
                 valueFormatter: (value: number) => {
-                    return formatHumanReadableDuration(
+                    return formatReportingDuration(
                         value,
                         organization?.value?.interval_format,
                         organization?.value?.number_format

resources/js/Components/Common/Reporting/ReportingOverview.vue

@@ -8,7 +8,7 @@ import {
 import { SaveIcon } from 'lucide-vue-next';
 import { getOrganizationCurrencyString } from '@/utils/money';
 import {
-    formatHumanReadableDuration,
+    formatReportingDuration,
     getDayJsInstance,
     getLocalizedDayJs,
 } from '@/packages/ui/src/utils/time';
@@ -426,7 +426,7 @@ const tableData = computed(() => {
                                 class="justify-end flex items-center font-medium"
                                 :class="!showBillableRate ? 'pr-6' : ''">
                                 {{
-                                    formatHumanReadableDuration(
+                                    formatReportingDuration(
                                         aggregatedTableTimeEntries.seconds,
                                         organization?.interval_format,
                                         organization?.number_format

resources/js/Components/Common/Reporting/ReportingPieChart.vue

@@ -10,7 +10,7 @@ import {
     TitleComponent,
     TooltipComponent,
 } from 'echarts/components';
-import { formatHumanReadableDuration } from '@/packages/ui/src/utils/time';
+import { formatReportingDuration } from '@/packages/ui/src/utils/time';
 import { useCssVariable } from '@/packages/ui/src';
 import type { Organization } from '@/packages/api/src';
 
@@ -67,7 +67,7 @@ const option = computed(() => ({
             },
             tooltip: {
                 valueFormatter: (value: number) => {
-                    return formatHumanReadableDuration(
+                    return formatReportingDuration(
                         value,
                         organization?.value?.interval_format,
                         organization?.value?.number_format

resources/js/Components/Common/Reporting/ReportingRow.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { formatHumanReadableDuration } from '@/packages/ui/src/utils/time';
+import { formatReportingDuration } from '@/packages/ui/src/utils/time';
 import { formatCents } from '@/packages/ui/src/utils/money';
 import GroupedItemsCountButton from '@/packages/ui/src/GroupedItemsCountButton.vue';
 import { ref, inject, type ComputedRef } from 'vue';
@@ -44,7 +44,7 @@ const organization = inject<ComputedRef<Organization>>('organization');
         </div>
         <div class="justify-end flex items-center" :class="!showCost ? 'pr-6' : ''">
             {{
-                formatHumanReadableDuration(
+                formatReportingDuration(
                     entry.seconds,
                     organization?.interval_format,
                     organization?.number_format

resources/js/Components/Dashboard/ThisWeekOverview.vue

@@ -16,7 +16,7 @@ import CardTitle from '@/packages/ui/src/CardTitle.vue';
 import LinearGradient from 'zrender/lib/graphic/LinearGradient';
 import ProjectsChartCard from '@/Components/Dashboard/ProjectsChartCard.vue';
 import ThisWeekReportingTable from '@/Components/Dashboard/ThisWeekReportingTable.vue';
-import { formatHumanReadableDuration } from '@/packages/ui/src/utils/time';
+import { formatReportingDuration } from '@/packages/ui/src/utils/time';
 import { formatCents } from '@/packages/ui/src/utils/money';
 import { getWeekStart } from '@/packages/ui/src/utils/settings';
 import { useCssVariable } from '@/packages/ui/src';
@@ -223,7 +223,7 @@ const option = computed(() => {
                 type: 'bar',
                 tooltip: {
                     valueFormatter: (value: number) => {
-                        return formatHumanReadableDuration(
+                        return formatReportingDuration(
                             value,
                             organization?.value?.interval_format,
                             organization?.value?.number_format
@@ -252,7 +252,7 @@ const option = computed(() => {
                 title="Spent Time"
                 :value="
                     totalWeeklyTime
-                        ? formatHumanReadableDuration(
+                        ? formatReportingDuration(
                               totalWeeklyTime,
                               organization?.interval_format,
                               organization?.number_format
@@ -263,7 +263,7 @@ const option = computed(() => {
                 title="Billable Time"
                 :value="
                     totalWeeklyBillableTime
-                        ? formatHumanReadableDuration(
+                        ? formatReportingDuration(
                               totalWeeklyBillableTime,
                               organization?.interval_format,
                               organization?.number_format

resources/js/Components/Dashboard/ThisWeekReportingTable.vue

@@ -2,7 +2,7 @@
 import ReportingRow from '@/Components/Common/Reporting/ReportingRow.vue';
 import ReportingGroupBySelect from '@/Components/Common/Reporting/ReportingGroupBySelect.vue';
 import {
-    formatHumanReadableDuration,
+    formatReportingDuration,
     getDayJsInstance,
     getLocalizedDayJs,
 } from '@/packages/ui/src/utils/time';
@@ -174,7 +174,7 @@ const showBillableRate = computed(() => {
                         class="justify-end flex items-center font-medium"
                         :class="!showBillableRate ? 'pr-6' : ''">
                         {{
-                            formatHumanReadableDuration(
+                            formatReportingDuration(
                                 aggregatedTableTimeEntries.seconds,
                                 organization?.interval_format,
                                 organization?.number_format

resources/js/Pages/Profile/Partials/ThemeForm.vue

@@ -2,8 +2,10 @@
 import FormSection from '@/Components/FormSection.vue';
 import { Field, FieldLabel, FieldDescription } from '@/packages/ui/src/field';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/packages/ui/src';
+import { Checkbox } from '@/packages/ui/src';
 import { usePreferredColorScheme } from '@vueuse/core';
 import { themeSetting } from '@/utils/theme';
+import { groupSimilarTimeEntriesSetting } from '@/utils/timeEntryGrouping';
 
 const preferredColor = usePreferredColorScheme();
 </script>
@@ -15,6 +17,7 @@ const preferredColor = usePreferredColorScheme();
         <template #description> Choose how you want solidtime to look on your device </template>
 
         <template #form>
+            <!-- Theme -->
             <Field class="col-span-6 sm:col-span-4">
                 <FieldLabel for="theme">Theme</FieldLabel>
                 <Select id="theme" v-model="themeSetting">
@@ -31,6 +34,14 @@ const preferredColor = usePreferredColorScheme();
                     System default: {{ preferredColor }}
                 </FieldDescription>
             </Field>
+
+            <!-- Group similar time entries -->
+            <Field class="col-span-6 sm:col-span-4" orientation="horizontal">
+                <Checkbox
+                    id="group_similar_time_entries"
+                    v-model:checked="groupSimilarTimeEntriesSetting" />
+                <FieldLabel for="group_similar_time_entries">Group similar time entries</FieldLabel>
+            </Field>
         </template>
     </FormSection>
 </template>

resources/js/Pages/ReportingDetailed.vue

@@ -390,6 +390,7 @@ async function downloadExport(format: ExportFormat) {
                     :organization-billable-rate="organization?.billable_rate ?? null"
                     :duplicate-time-entry="() => createTimeEntry(entry)"
                     :members="members"
+                    is-report
                     show-date
                     show-member
                     :time-entry="entry"

resources/js/Pages/SharedReport.vue

@@ -3,7 +3,7 @@ import MainContainer from '@/packages/ui/src/MainContainer.vue';
 import PageTitle from '@/Components/Common/PageTitle.vue';
 import { ChartBarIcon } from '@heroicons/vue/20/solid';
 import ReportingChart from '@/Components/Common/Reporting/ReportingChart.vue';
-import { formatHumanReadableDuration } from '@/packages/ui/src/utils/time';
+import { formatReportingDuration } from '@/packages/ui/src/utils/time';
 import ReportingRow from '@/Components/Common/Reporting/ReportingRow.vue';
 import ReportingPieChart from '@/Components/Common/Reporting/ReportingPieChart.vue';
 import { formatCents } from '@/packages/ui/src/utils/money';
@@ -231,7 +231,7 @@ onMounted(async () => {
                                 </div>
                                 <div class="justify-end flex items-center font-medium">
                                     {{
-                                        formatHumanReadableDuration(
+                                        formatReportingDuration(
                                             aggregatedTableTimeEntries.seconds,
                                             reportIntervalFormat,
                                             reportNumberFormat

resources/js/Pages/Teams/Partials/OrganizationFormatSettings.vue

@@ -1,8 +1,8 @@
 <script setup lang="ts">
 import FormSection from '@/Components/FormSection.vue';
 import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
-import { onMounted, ref } from 'vue';
-import { Field, FieldLabel } from '@/packages/ui/src/field';
+import { computed, onMounted, ref } from 'vue';
+import { Field, FieldDescription, FieldLabel } from '@/packages/ui/src/field';
 import type { UpdateOrganizationBody } from '@/packages/api/src';
 import { useOrganizationStore } from '@/utils/useOrganization';
 import { storeToRefs } from 'pinia';
@@ -52,6 +52,12 @@ onMounted(async () => {
     }
 });
 
+const showsHhMmSsInReports = computed(
+    () =>
+        form.value.interval_format === 'hours-minutes' ||
+        form.value.interval_format === 'hours-minutes-colon-separated'
+);
+
 async function submit() {
     mutation.mutate(form.value);
 }
@@ -149,6 +155,12 @@ async function submit() {
                         >
                     </SelectContent>
                 </Select>
+                <FieldDescription v-if="showsHhMmSsInReports">
+                    Reports and totals shown next to cost use HH:MM:SS for this format, so the
+                    duration reconciles with the billable amount down to the second. Everywhere else
+                    (time tracker, calendar, entry rows) seconds are omitted and durations stay in
+                    your chosen format.
+                </FieldDescription>
             </Field>
         </template>
 

resources/js/Pages/Teams/Partials/TeamMemberManager.vue

@@ -1,448 +0,0 @@
-<script setup lang="ts">
-import { computed, ref } from 'vue';
-import { router, useForm, usePage } from '@inertiajs/vue3';
-import ActionMessage from '@/Components/ActionMessage.vue';
-import ActionSection from '@/Components/ActionSection.vue';
-import ConfirmationModal from '@/Components/ConfirmationModal.vue';
-import DangerButton from '@/packages/ui/src/Buttons/DangerButton.vue';
-import DialogModal from '@/packages/ui/src/DialogModal.vue';
-import FormSection from '@/Components/FormSection.vue';
-import { Field, FieldLabel, FieldError } from '@/packages/ui/src/field';
-
-import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
-import SecondaryButton from '@/packages/ui/src/Buttons/SecondaryButton.vue';
-import SectionBorder from '@/Components/SectionBorder.vue';
-import TextInput from '@/packages/ui/src/Input/TextInput.vue';
-import type { Organization, OrganizationInvitation, User } from '@/types/models';
-import type { Membership, Permissions, Role } from '@/types/jetstream';
-import { filterRoles } from '@/utils/roles';
-
-type UserWithMembership = User & { membership: Membership };
-
-const props = defineProps<{
-    team: Organization;
-    availableRoles: Role[];
-    userPermissions: Permissions;
-}>();
-
-const users = computed(() => {
-    return props.team.users as Array<UserWithMembership>;
-});
-
-const page = usePage<{
-    auth: {
-        user: User;
-    };
-}>();
-
-const addTeamMemberForm = useForm({
-    email: '',
-    role: null as string | null,
-});
-
-const updateRoleForm = useForm({
-    role: null as string | null,
-});
-
-const leaveTeamForm = useForm({});
-const removeTeamMemberForm = useForm({});
-
-const currentlyManagingRole = ref(false);
-const managingRoleFor = ref<User | null>(null);
-const confirmingLeavingTeam = ref(false);
-const teamMemberBeingRemoved = ref<User | null>(null);
-
-const addTeamMember = () => {
-    addTeamMemberForm.post(route('team-members.store', props.team.id), {
-        errorBag: 'addTeamMember',
-        preserveScroll: true,
-        onSuccess: () => addTeamMemberForm.reset(),
-    });
-};
-
-const cancelTeamInvitation = (invitation: OrganizationInvitation) => {
-    router.delete(route('team-invitations.destroy', invitation.id), {
-        preserveScroll: true,
-    });
-};
-
-const manageRole = (teamMember: User & { membership: Membership }) => {
-    managingRoleFor.value = teamMember;
-    updateRoleForm.role = teamMember.membership.role;
-    currentlyManagingRole.value = true;
-};
-
-const updateRole = () => {
-    updateRoleForm.put(
-        route('team-members.update', {
-            team: props.team.id,
-            user: managingRoleFor.value?.id,
-        }),
-        {
-            preserveScroll: true,
-            onSuccess: () => (currentlyManagingRole.value = false),
-        }
-    );
-};
-
-const confirmLeavingTeam = () => {
-    confirmingLeavingTeam.value = true;
-};
-
-const leaveTeam = () => {
-    leaveTeamForm.delete(route('team-members.destroy', [props.team.id, page.props.auth.user.id]));
-};
-
-const confirmTeamMemberRemoval = (teamMember: User) => {
-    teamMemberBeingRemoved.value = teamMember;
-};
-
-const removeTeamMember = () => {
-    removeTeamMemberForm.delete(
-        route('team-members.destroy', {
-            team: props.team.id,
-            user: teamMemberBeingRemoved.value?.id,
-        }),
-        {
-            errorBag: 'removeTeamMember',
-            preserveScroll: true,
-            preserveState: true,
-            onSuccess: () => (teamMemberBeingRemoved.value = null),
-        }
-    );
-};
-
-const displayableRole = (role: string) => {
-    return props.availableRoles.find((r) => r.key === role)?.name;
-};
-</script>
-
-<template>
-    <div>
-        <div v-if="userPermissions.canAddTeamMembers">
-            <SectionBorder />
-
-            <!-- Add Organization Member -->
-            <FormSection @submitted="addTeamMember">
-                <template #title> Add Organization Member</template>
-
-                <template #description>
-                    Add a new member to your organization, allowing them to collaborate with you.
-                </template>
-
-                <template #form>
-                    <div class="col-span-6">
-                        <div class="max-w-xl text-sm text-muted">
-                            Please provide the email address of the person you would like to add to
-                            this organization.
-                        </div>
-                    </div>
-
-                    <!-- Member Email -->
-                    <Field class="col-span-6 sm:col-span-4">
-                        <FieldLabel for="email">Email</FieldLabel>
-                        <TextInput
-                            id="email"
-                            v-model="addTeamMemberForm.email"
-                            type="email"
-                            class="block w-full" />
-                        <FieldError v-if="addTeamMemberForm.errors.email">{{
-                            addTeamMemberForm.errors.email
-                        }}</FieldError>
-                    </Field>
-
-                    <!-- Role -->
-                    <div v-if="availableRoles.length > 0" class="col-span-6 lg:col-span-4">
-                        <FieldLabel for="roles">Role</FieldLabel>
-                        <FieldError v-if="addTeamMemberForm.errors.role">{{
-                            addTeamMemberForm.errors.role
-                        }}</FieldError>
-
-                        <div
-                            class="relative z-0 mt-1 border border-card-border rounded-lg cursor-pointer">
-                            <button
-                                v-for="(role, i) in filterRoles(availableRoles)"
-                                :key="role.key"
-                                type="button"
-                                class="relative px-4 py-3 inline-flex w-full rounded-lg focus:z-10 focus:outline-none focus:border-indigo-500 focus:ring-2 focus:ring-indigo-500"
-                                :class="{
-                                    'border-t border-card-border focus:border-none rounded-t-none':
-                                        i > 0,
-                                    'rounded-b-none': i != Object.keys(availableRoles).length - 1,
-                                }"
-                                @click="addTeamMemberForm.role = role.key">
-                                <div
-                                    :class="{
-                                        'opacity-50':
-                                            addTeamMemberForm.role &&
-                                            addTeamMemberForm.role != role.key,
-                                    }">
-                                    <!-- Role Name -->
-                                    <div class="flex items-center">
-                                        <div
-                                            class="text-sm text-text-primary"
-                                            :class="{
-                                                'font-semibold': addTeamMemberForm.role == role.key,
-                                            }">
-                                            {{ role.name }}
-                                        </div>
-
-                                        <svg
-                                            v-if="addTeamMemberForm.role == role.key"
-                                            class="ms-2 h-5 w-5 text-green-400"
-                                            xmlns="http://www.w3.org/2000/svg"
-                                            fill="none"
-                                            viewBox="0 0 24 24"
-                                            stroke-width="1.5"
-                                            stroke="currentColor">
-                                            <path
-                                                stroke-linecap="round"
-                                                stroke-linejoin="round"
-                                                d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-                                        </svg>
-                                    </div>
-
-                                    <!-- Role Description -->
-                                    <div class="mt-2 text-xs text-muted text-start">
-                                        {{ role.description }}
-                                    </div>
-                                </div>
-                            </button>
-                        </div>
-                    </div>
-                </template>
-
-                <template #actions>
-                    <ActionMessage :on="addTeamMemberForm.recentlySuccessful" class="me-3">
-                        Added.
-                    </ActionMessage>
-
-                    <PrimaryButton
-                        :class="{ 'opacity-25': addTeamMemberForm.processing }"
-                        :disabled="addTeamMemberForm.processing">
-                        Add
-                    </PrimaryButton>
-                </template>
-            </FormSection>
-        </div>
-
-        <div v-if="team.team_invitations.length > 0 && userPermissions.canAddTeamMembers">
-            <SectionBorder />
-
-            <!-- Organization Member Invitations -->
-            <ActionSection class="mt-10 sm:mt-0">
-                <template #title> Pending Organization Invitations</template>
-
-                <template #description>
-                    These people have been invited to your organization and have been sent an
-                    invitation email. They may join the organization by accepting the email
-                    invitation.
-                </template>
-
-                <!-- Pending Organization Member Invitation List -->
-                <template #content>
-                    <div class="space-y-6">
-                        <div
-                            v-for="invitation in team.team_invitations"
-                            :key="invitation.id"
-                            class="flex items-center justify-between">
-                            <div class="text-muted">
-                                {{ invitation.email }}
-                            </div>
-
-                            <div class="flex items-center">
-                                <!-- Cancel Organization Invitation -->
-                                <button
-                                    v-if="userPermissions.canRemoveTeamMembers"
-                                    class="cursor-pointer ms-6 text-sm text-red-500 focus:outline-none"
-                                    @click="cancelTeamInvitation(invitation)">
-                                    Cancel
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </template>
-            </ActionSection>
-        </div>
-
-        <div v-if="users.length > 0">
-            <SectionBorder />
-
-            <!-- Manage Organization Members -->
-            <ActionSection class="mt-10 sm:mt-0">
-                <template #title> Organization Members</template>
-
-                <template #description>
-                    All of the people that are part of this organization.
-                </template>
-
-                <!-- Organization Member List -->
-                <template #content>
-                    <div class="space-y-6">
-                        <div
-                            v-for="user in users"
-                            :key="user.id"
-                            class="flex items-center justify-between">
-                            <div class="flex items-center">
-                                <img
-                                    class="w-8 h-8 rounded-full object-cover"
-                                    :src="user.profile_photo_url"
-                                    :alt="user.name" />
-                                <div class="ms-4 text-text-primary">
-                                    {{ user.name }}
-                                </div>
-                            </div>
-
-                            <div class="flex items-center">
-                                <!-- Manage Organization Member Role -->
-                                <button
-                                    v-if="
-                                        userPermissions.canUpdateTeamMembers &&
-                                        availableRoles.length
-                                    "
-                                    class="ms-2 text-sm text-gray-400 underline"
-                                    @click="manageRole(user)">
-                                    {{ displayableRole(user.membership.role) }}
-                                </button>
-
-                                <div
-                                    v-else-if="availableRoles.length"
-                                    class="ms-2 text-sm text-gray-400">
-                                    {{ displayableRole(user.membership.role) }}
-                                </div>
-
-                                <!-- Leave Organization -->
-                                <button
-                                    v-if="page.props.auth.user.id === user.id"
-                                    class="cursor-pointer ms-6 text-sm text-red-500"
-                                    @click="confirmLeavingTeam">
-                                    Leave
-                                </button>
-
-                                <!-- Remove Organization Member -->
-                                <button
-                                    v-else-if="userPermissions.canRemoveTeamMembers"
-                                    class="cursor-pointer ms-6 text-sm text-red-500"
-                                    @click="confirmTeamMemberRemoval(user)">
-                                    Remove
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </template>
-            </ActionSection>
-        </div>
-
-        <!-- Role Management Modal -->
-        <DialogModal :show="currentlyManagingRole" @close="currentlyManagingRole = false">
-            <template #title> Manage Role</template>
-
-            <template #content>
-                <div v-if="managingRoleFor">
-                    <div
-                        class="relative z-0 mt-1 border border-card-border rounded-lg cursor-pointer">
-                        <button
-                            v-for="(role, i) in availableRoles"
-                            :key="role.key"
-                            type="button"
-                            class="relative px-4 py-3 inline-flex w-full rounded-lg focus:z-10 focus:outline-none focus:border-indigo-500 focus:ring-2 focus:ring-indigo-500"
-                            :class="{
-                                'border-t border-card-border focus:border-none rounded-t-none':
-                                    i > 0,
-                                'rounded-b-none': i !== Object.keys(availableRoles).length - 1,
-                            }"
-                            @click="updateRoleForm.role = role.key">
-                            <div
-                                :class="{
-                                    'opacity-50':
-                                        updateRoleForm.role && updateRoleForm.role !== role.key,
-                                }">
-                                <!-- Role Name -->
-                                <div class="flex items-center">
-                                    <div
-                                        class="text-sm text-muted"
-                                        :class="{
-                                            'font-semibold': updateRoleForm.role === role.key,
-                                        }">
-                                        {{ role.name }}
-                                    </div>
-
-                                    <svg
-                                        v-if="updateRoleForm.role == role.key"
-                                        class="ms-2 h-5 w-5 text-green-400"
-                                        xmlns="http://www.w3.org/2000/svg"
-                                        fill="none"
-                                        viewBox="0 0 24 24"
-                                        stroke-width="1.5"
-                                        stroke="currentColor">
-                                        <path
-                                            stroke-linecap="round"
-                                            stroke-linejoin="round"
-                                            d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-                                    </svg>
-                                </div>
-
-                                <!-- Role Description -->
-                                <div class="mt-2 text-xs text-muted">
-                                    {{ role.description }}
-                                </div>
-                            </div>
-                        </button>
-                    </div>
-                </div>
-            </template>
-
-            <template #footer>
-                <SecondaryButton @click="currentlyManagingRole = false"> Cancel </SecondaryButton>
-
-                <PrimaryButton
-                    class="ms-3"
-                    :class="{ 'opacity-25': updateRoleForm.processing }"
-                    :disabled="updateRoleForm.processing"
-                    @click="updateRole">
-                    Save
-                </PrimaryButton>
-            </template>
-        </DialogModal>
-
-        <!-- Leave Organization Confirmation Modal -->
-        <ConfirmationModal :show="confirmingLeavingTeam" @close="confirmingLeavingTeam = false">
-            <template #title> Leave Organization</template>
-
-            <template #content> Are you sure you would like to leave this organization? </template>
-
-            <template #footer>
-                <SecondaryButton @click="confirmingLeavingTeam = false"> Cancel </SecondaryButton>
-
-                <DangerButton
-                    class="ms-3"
-                    :class="{ 'opacity-25': leaveTeamForm.processing }"
-                    :disabled="leaveTeamForm.processing"
-                    @click="leaveTeam">
-                    Leave
-                </DangerButton>
-            </template>
-        </ConfirmationModal>
-
-        <!-- Remove Organization Member Confirmation Modal -->
-        <ConfirmationModal :show="!!teamMemberBeingRemoved" @close="teamMemberBeingRemoved = null">
-            <template #title> Remove Organization Member</template>
-
-            <template #content>
-                Are you sure you would like to remove this person from the organization?
-            </template>
-
-            <template #footer>
-                <SecondaryButton @click="teamMemberBeingRemoved = null"> Cancel </SecondaryButton>
-
-                <DangerButton
-                    class="ms-3"
-                    :class="{ 'opacity-25': removeTeamMemberForm.processing }"
-                    :disabled="removeTeamMemberForm.processing"
-                    @click="removeTeamMember">
-                    Remove
-                </DangerButton>
-            </template>
-        </ConfirmationModal>
-    </div>
-</template>

resources/js/Pages/Teams/Partials/UpdateTeamNameForm.vue

@@ -51,9 +51,6 @@ const updateTeamName = () => {
                             <div class="text-text-primary">
                                 {{ team.owner.name }}
                             </div>
-                            <div class="text-text-secondary text-sm">
-                                {{ team.owner.email }}
-                            </div>
                         </div>
                     </div>
                 </div>

resources/js/Pages/Time.vue

@@ -16,6 +16,7 @@ import { useElementVisibility } from '@vueuse/core';
 import { ClockIcon } from '@heroicons/vue/20/solid';
 import LoadingSpinner from '@/packages/ui/src/LoadingSpinner.vue';
 import { useCurrentTimeEntryStore } from '@/utils/useCurrentTimeEntry';
+import { groupSimilarTimeEntriesSetting } from '@/utils/timeEntryGrouping';
 import { useTasksQuery } from '@/utils/useTasksQuery';
 import { useProjectsQuery } from '@/utils/useProjectsQuery';
 import TimeEntryGroupedTable from '@/packages/ui/src/TimeEntry/TimeEntryGroupedTable.vue';
@@ -151,6 +152,7 @@ function deleteSelected() {
             :tasks="tasks"
             :currency="getOrganizationCurrencyString()"
             :time-entries="timeEntries"
+            :group-similar-time-entries="groupSimilarTimeEntriesSetting"
             :tags="tags"></TimeEntryGroupedTable>
         <div v-if="isPending" class="flex justify-center items-center py-12">
             <LoadingSpinner></LoadingSpinner>

resources/js/packages/ui/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@solidtime/ui",
-    "version": "0.0.20",
+    "version": "0.0.21",
     "description": "Package containing the solidtime ui components",
     "main": "./dist/solidtime-ui-lib.umd.cjs",
     "module": "./dist/solidtime-ui-lib.js",

resources/js/packages/ui/src/GroupedItemsCountButton.vue

@@ -6,10 +6,15 @@ const props = withDefaults(
     defineProps<{
         expanded?: boolean;
         size?: string;
+        /**
+         * Test ID used for Playwright/E2E tests.
+         */
+        testId?: string;
     }>(),
     {
         expanded: false,
         size: 'w-7 h-7',
+        testId: 'grouped_items_count_button',
     }
 );
 
@@ -23,6 +28,7 @@ const expandedStatusClasses = computed(() => {
 
 <template>
     <button
+        :data-testid="props.testId"
         :class="
             twMerge(
                 'font-medium text-base rounded flex items-center transition justify-center focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:border-transparent',

resources/js/packages/ui/src/Input/MultiselectDropdown.vue

@@ -35,7 +35,8 @@ watch(open, (isOpen) => {
         sortedItems.value = [...props.items].sort((a, b) => {
             const aSelected = model.value.includes(props.getKeyFromItem(a)) ? 0 : 1;
             const bSelected = model.value.includes(props.getKeyFromItem(b)) ? 0 : 1;
-            return aSelected - bSelected;
+            if (aSelected !== bSelected) return aSelected - bSelected;
+            return props.getNameForItem(a).localeCompare(props.getNameForItem(b));
         });
     }
 });

resources/js/packages/ui/src/TimeEntry/TimeEntryGroupedTable.vue

@@ -20,24 +20,30 @@ const selectedTimeEntries = defineModel<TimeEntry[]>('selected', {
     default: [],
 });
 
-const props = defineProps<{
-    timeEntries: TimeEntry[];
-    projects: Project[];
-    tasks: Task[];
-    tags: Tag[];
-    clients: Client[];
-    createTag: (name: string) => Promise<Tag | undefined>;
-    updateTimeEntry: (entry: TimeEntry) => void;
-    updateTimeEntries: (ids: string[], changes: Partial<TimeEntry>) => void;
-    deleteTimeEntries: (entries: TimeEntry[]) => void;
-    createTimeEntry: (entry: Omit<CreateTimeEntryBody, 'member_id'>) => void;
-    createProject: (project: CreateProjectBody) => Promise<Project | undefined>;
-    createClient: (client: CreateClientBody) => Promise<Client | undefined>;
-    currency: string;
-    organizationBillableRate: number | null;
-    enableEstimatedTime: boolean;
-    canCreateProject: boolean;
-}>();
+const props = withDefaults(
+    defineProps<{
+        timeEntries: TimeEntry[];
+        projects: Project[];
+        tasks: Task[];
+        tags: Tag[];
+        clients: Client[];
+        createTag: (name: string) => Promise<Tag | undefined>;
+        updateTimeEntry: (entry: TimeEntry) => void;
+        updateTimeEntries: (ids: string[], changes: Partial<TimeEntry>) => void;
+        deleteTimeEntries: (entries: TimeEntry[]) => void;
+        createTimeEntry: (entry: Omit<CreateTimeEntryBody, 'member_id'>) => void;
+        createProject: (project: CreateProjectBody) => Promise<Project | undefined>;
+        createClient: (client: CreateClientBody) => Promise<Client | undefined>;
+        currency: string;
+        organizationBillableRate: number | null;
+        enableEstimatedTime: boolean;
+        canCreateProject: boolean;
+        groupSimilarTimeEntries?: boolean;
+    }>(),
+    {
+        groupSimilarTimeEntries: true,
+    }
+);
 
 const groupedTimeEntries = computed(() => {
     const groupedEntriesByDay: Record<string, TimeEntry[]> = {};
@@ -58,6 +64,11 @@ const groupedTimeEntries = computed(() => {
         const newDailyEntries: TimeEntriesGroupedByType[] = [];
 
         for (const entry of dailyEntries) {
+            if (!props.groupSimilarTimeEntries) {
+                newDailyEntries.push({ ...entry, timeEntries: [entry] });
+                continue;
+            }
+
             // check if same entry already exists
             const oldEntriesIndex = newDailyEntries.findIndex(
                 (e) =>

resources/js/packages/ui/src/TimeEntry/TimeEntryRow.vue

@@ -52,6 +52,7 @@ const props = defineProps<{
     selected?: boolean;
     canCreateProject: boolean;
     enableEstimatedTime: boolean;
+    isReport?: boolean;
 }>();
 
 const emit = defineEmits<{ selected: []; unselected: [] }>();
@@ -172,6 +173,7 @@ async function handleDeleteTimeEntry() {
                             <TimeEntryRowDurationInput
                                 :start="timeEntry.start"
                                 :end="timeEntry.end"
+                                :is-report="props.isReport"
                                 @changed="updateStartEndTime"></TimeEntryRowDurationInput>
                             <TimeTrackerStartStop
                                 :active="!!(timeEntry.start && !timeEntry.end)"
@@ -196,6 +198,7 @@ async function handleDeleteTimeEntry() {
                                 <TimeEntryRowDurationInput
                                     :start="timeEntry.start"
                                     :end="timeEntry.end"
+                                    :is-report="props.isReport"
                                     @changed="updateStartEndTime"></TimeEntryRowDurationInput>
                             </div>
                             <!-- Second row: project/task - tags - billable - start - more -->

resources/js/packages/ui/src/TimeEntry/TimeEntryRowDurationInput.vue

@@ -2,6 +2,7 @@
 import {
     calculateDifference,
     formatHumanReadableDuration,
+    formatReportingDuration,
     parseTimeInput,
 } from '@/packages/ui/src/utils/time';
 import { computed, ref, inject, type ComputedRef } from 'vue';
@@ -18,6 +19,7 @@ const organizationSettings = computed(() => ({
 const props = defineProps<{
     start: string;
     end: string | null;
+    isReport?: boolean;
 }>();
 const emit = defineEmits<{
     changed: [start: string, end: string | null];
@@ -51,7 +53,8 @@ const currentTime = computed({
         if (temporaryCustomTimerEntry.value !== '') {
             return temporaryCustomTimerEntry.value;
         }
-        return formatHumanReadableDuration(
+        const formatter = props.isReport ? formatReportingDuration : formatHumanReadableDuration;
+        return formatter(
             calculateDifference(props.start, props.end),
             organizationSettings.value.intervalFormat,
             organizationSettings.value.numberFormat

resources/js/packages/ui/src/utils/time.ts

@@ -118,6 +118,26 @@ export function formatHumanReadableDuration(
     }
 }
 
+/**
+ * Format a duration for reporting views where cost and duration must reconcile.
+ *
+ * When the org's `hours-minutes` format is selected, seconds are normally dropped for
+ * readability (e.g. "14h 45min"). In reports this can make the total duration appear
+ * inconsistent with the billable cost (which is computed to the second). To keep the
+ * two columns reconcilable without inflating column widths with "14h 45min 06s",
+ * promote to the compact `HH:MM:SS` format in reporting contexts.
+ */
+export function formatReportingDuration(
+    duration: number,
+    intervalFormat?: string,
+    numberFormat?: string
+): string {
+    const promoted =
+        intervalFormat === 'hours-minutes' || intervalFormat === 'hours-minutes-colon-separated';
+    const effectiveFormat = promoted ? 'hours-minutes-seconds-colon-separated' : intervalFormat;
+    return formatHumanReadableDuration(duration, effectiveFormat, numberFormat);
+}
+
 export function formatDuration(duration: number): string {
     const dayJsDuration = dayjs.duration(duration, 's');
     const hours = Math.floor(dayJsDuration.asHours());

resources/js/types/models.d.ts

@@ -22,9 +22,7 @@ export interface Organization {
     currency: string;
     created_at: string | null;
     updated_at: string | null;
-    owner: User;
-    users: User[];
-    team_invitations: OrganizationInvitation[];
+    owner: Pick<User, 'id' | 'name' | 'profile_photo_url'>;
 }
 export interface OrganizationInvitation {
     id: string;

resources/js/types/models.ts

@@ -29,9 +29,7 @@ export interface Organization {
     created_at: string | null;
     updated_at: string | null;
     // relations
-    owner: User;
-    users: User[];
-    team_invitations: OrganizationInvitation[];
+    owner: Pick<User, 'id' | 'name' | 'profile_photo_url'>;
 }
 
 export interface OrganizationInvitation {

resources/js/utils/timeEntryGrouping.ts

@@ -0,0 +1,6 @@
+import { useStorage } from '@vueuse/core';
+
+export const groupSimilarTimeEntriesSetting = useStorage<boolean>(
+    'group-similar-time-entries',
+    true
+);

resources/views/reports/time-entry-aggregate/pdf.blade.php

@@ -150,7 +150,7 @@
         <div style="padding: 8px 12px; border-radius: 8px;">
             <div style="color: #71717a; font-weight: 600;">Duration</div>
             <div
-                style="font-size: 24px; font-weight: 500; margin-top: 2px;">{{ $localization->formatInterval(CarbonInterval::seconds($aggregatedData['seconds'])) }} </div>
+                style="font-size: 24px; font-weight: 500; margin-top: 2px;">{{ $localization->formatIntervalForReporting(CarbonInterval::seconds($aggregatedData['seconds'])) }} </div>
         </div>
         @if($showBillableRate)
         <div style="padding: 8px 12px; border-radius: 8px;">
@@ -199,7 +199,7 @@
                             </span>
                         </td>
                         <td style="text-align: left;">
-                            {{ $localization->formatInterval(CarbonInterval::seconds($group1Entry['seconds'])) }}
+                            {{ $localization->formatIntervalForReporting(CarbonInterval::seconds($group1Entry['seconds'])) }}
                         </td>
                         @if($showBillableRate)
                         <td style="text-align: right;">
@@ -214,7 +214,7 @@
                         Total
                     </td>
                     <td style="font-weight: 500;color: #18181b;">
-                        {{ $localization->formatInterval(CarbonInterval::seconds($aggregatedData['seconds'])) }}
+                        {{ $localization->formatIntervalForReporting(CarbonInterval::seconds($aggregatedData['seconds'])) }}
                     </td>
                     @if($showBillableRate)
                     <td style="text-align: right; font-weight: 500;color: #18181b;">
@@ -282,7 +282,7 @@
                             @endif
                         </td>
                         <td>
-                            {{ $localization->formatInterval($duration) }}
+                            {{ $localization->formatIntervalForReporting($duration) }}
                         </td>
                         <td>
                             {{ $localization->formatNumber($duration->totalHours) }}
@@ -403,7 +403,7 @@
                 type: "bar",
                 data: {!! json_encode(collect($dataHistoryChart['grouped_data'])->map(fn($value) => (object) [
                             'value' => $value['seconds'],
-                            'name' => ((int) $value['seconds']) === 0 ? '' : $localization->formatInterval(CarbonInterval::seconds((int) $value['seconds']))
+                            'name' => ((int) $value['seconds']) === 0 ? '' : $localization->formatIntervalForReporting(CarbonInterval::seconds((int) $value['seconds']))
                         ])->toArray()) !!},
                 itemStyle: {
                     borderColor: "#7dd3fc",

resources/views/reports/time-entry-index/pdf.blade.php

@@ -138,7 +138,7 @@
         <div style="padding: 8px 12px; border-radius: 8px;">
             <div style="color: #71717a; font-weight: 600;">Duration</div>
             <div
-                style="font-size: 24px; font-weight: 500; margin-top: 2px;">{{ $localization->formatInterval(CarbonInterval::seconds($aggregatedData['seconds'])) }} </div>
+                style="font-size: 24px; font-weight: 500; margin-top: 2px;">{{ $localization->formatIntervalForReporting(CarbonInterval::seconds($aggregatedData['seconds'])) }} </div>
         </div>
         @if($showBillableRate)
         <div style="padding: 8px 12px; border-radius: 8px;">
@@ -189,7 +189,7 @@
                         {{ $localization->formatTime($timeEntry->start->timezone($timezone)) }} - {{ $localization->formatTime($timeEntry->end->timezone($timezone)) }}
                     </td>
                     <td style="overflow-wrap: break-word; min-width: 75px;">
-                        {{ $localization->formatInterval($timeEntry->getDuration()) }}
+                        {{ $localization->formatIntervalForReporting($timeEntry->getDuration()) }}
                     </td>
                     <td style="overflow-wrap: break-word;">{{ $timeEntry->billable ? 'Yes' : 'No' }}</td>
                     <td style="overflow-wrap: break-word; min-width: 75px;">{{ count($timeEntry->tagsRelation) === 0 ? '-' : $timeEntry->tagsRelation->implode('name', ', ') }}</td>

tests/Unit/Endpoint/Api/V1/TimeEntryEndpointTest.php

@@ -2490,6 +2490,47 @@ class TimeEntryEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
+    public function test_update_endpoint_fails_if_time_entry_belongs_to_different_organization_than_url_even_with_update_all_permission(): void
+    {
+        // Arrange
+        // Attacker: has `time-entries:update:all` in their own organization (orgA).
+        $data = $this->createUserWithPermission([
+            'time-entries:update:all',
+            'projects:view:all',
+        ]);
+        $attackerProject = Project::factory()->forOrganization($data->organization)->create();
+
+        // Victim: entirely separate organization (orgB). Attacker has NO membership in orgB.
+        $victimOrgData = $this->createUserWithPermission([], true);
+        $victimTimeEntry = TimeEntry::factory()
+            ->forOrganization($victimOrgData->organization)
+            ->forMember($victimOrgData->ownerMember)
+            ->create([
+                'description' => 'victim-original',
+                'project_id' => null,
+                'task_id' => null,
+            ]);
+
+        Passport::actingAs($data->user);
+
+        // Act: PUT to /organizations/{orgA}/time-entries/{victim_uuid} — URL org is attacker's
+        // own org, but the route-bound time entry belongs to orgB.
+        $response = $this->putJson(route('api.v1.time-entries.update', [$data->organization->getKey(), $victimTimeEntry->getKey()]), [
+            'description' => 'attacker-overwrite',
+            'project_id' => $attackerProject->getKey(),
+        ]);
+
+        // Assert: must be rejected. Before the fix this returned 200 and rewrote the
+        // victim row with attacker's project_id while keeping organization_id = orgB.
+        $response->assertForbidden();
+        $this->assertDatabaseHas(TimeEntry::class, [
+            'id' => $victimTimeEntry->getKey(),
+            'organization_id' => $victimOrgData->organization->getKey(),
+            'description' => 'victim-original',
+            'project_id' => null,
+        ]);
+    }
+
     public function test_update_endpoint_fails_if_user_has_no_permission_to_update_time_entries_for_other_users_in_organization(): void
     {
         // Arrange

tests/Unit/Endpoint/Web/TeamShowEndpointTest.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Endpoint\Web;
+
+use App\Models\OrganizationInvitation;
+use App\Providers\JetstreamServiceProvider;
+use Inertia\Testing\AssertableInertia as Assert;
+use Laravel\Jetstream\Jetstream;
+use PHPUnit\Framework\Attributes\CoversClass;
+
+#[CoversClass(JetstreamServiceProvider::class)]
+class TeamShowEndpointTest extends EndpointTestAbstract
+{
+    protected function setUp(): void
+    {
+        Jetstream::$inertiaManager = null;
+        parent::setUp();
+    }
+
+    public function test_team_show_does_not_expose_member_roster_invitations_or_owner_email(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([]);
+        OrganizationInvitation::factory()->forOrganization($data->organization)->create([
+            'email' => 'pending@example.com',
+        ]);
+        $this->actingAs($data->user);
+
+        // Act
+        $response = $this->get('/teams/'.$data->organization->getKey());
+
+        // Assert
+        $response->assertOk();
+        $response->assertInertia(fn (Assert $page) => $page
+            ->missing('team.users')
+            ->missing('team.team_invitations')
+            ->missing('team.owner.email')
+            ->has('team.owner.id')
+            ->has('team.owner.name')
+            ->has('team.owner.profile_photo_url')
+        );
+    }
+}

tests/Unit/Service/LocalizationServiceTest.php

@@ -129,6 +129,58 @@ class LocalizationServiceTest extends TestCaseWithDatabase
         $this->assertSame('30001:03:04', $formatted);
     }
 
+    public function test_format_interval_for_reporting_with_type_decimal(): void
+    {
+        // Arrange
+        $interval = CarbonInterval::seconds(4 + (60 * 3) + (60 * 60 * 30001));
+        $this->localizationService->setIntervalFormat(IntervalFormat::Decimal);
+
+        // Act
+        $formatted = $this->localizationService->formatIntervalForReporting($interval);
+
+        // Assert
+        $this->assertSame('30.001,05 h', $formatted);
+    }
+
+    public function test_format_interval_for_reporting_with_type_hours_minutes(): void
+    {
+        // Arrange
+        $interval = CarbonInterval::seconds(4 + (60 * 3) + (60 * 60 * 30001));
+        $this->localizationService->setIntervalFormat(IntervalFormat::HoursMinutes);
+
+        // Act
+        $formatted = $this->localizationService->formatIntervalForReporting($interval);
+
+        // Assert
+        $this->assertSame('30001:03:04', $formatted);
+    }
+
+    public function test_format_interval_for_reporting_with_type_hours_minutes_colon_separated(): void
+    {
+        // Arrange
+        $interval = CarbonInterval::seconds(4 + (60 * 3) + (60 * 60 * 30001));
+        $this->localizationService->setIntervalFormat(IntervalFormat::HoursMinutesColonSeparated);
+
+        // Act
+        $formatted = $this->localizationService->formatIntervalForReporting($interval);
+
+        // Assert
+        $this->assertSame('30001:03:04', $formatted);
+    }
+
+    public function test_format_interval_for_reporting_with_type_hours_minutes_seconds_colon_separated(): void
+    {
+        // Arrange
+        $interval = CarbonInterval::seconds(4 + (60 * 3) + (60 * 60 * 30001));
+        $this->localizationService->setIntervalFormat(IntervalFormat::HoursMinutesSecondsColonSeparated);
+
+        // Act
+        $formatted = $this->localizationService->formatIntervalForReporting($interval);
+
+        // Assert
+        $this->assertSame('30001:03:04', $formatted);
+    }
+
     public function test_format_currency_with_type_symbol_after_with_space_and_number_format_thousands_space_decimal_comma(): void
     {
         // Arrange