Fix API docs generation with Scramble 0.13

Scramble 0.13 moved the collected resource type of resource collections
to a different template slot, which broke the custom paginated resource
collection extension and the API docs export. Scramble now infers
paginated responses natively, so the extension, the marker interface and
the @return annotations that overrode the inference are removed.

Scramble 0.13 also documents closure routes, so the API fallback routes
are moved to a controller that is excluded from the docs.

Add a test that exports the API docs.

.env.ci

@@ -6,6 +6,7 @@ APP_DEBUG=true
 APP_URL=http://localhost
 APP_FORCE_HTTPS=false
 APP_ENABLE_REGISTRATION=true
+SUPER_ADMINS=admin@example.com
 
 # Logging
 LOG_CHANNEL=stack

.github/workflows/build-onpremise.yml

@@ -103,6 +103,8 @@ jobs:
           {
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
+            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout invoicing extension"
@@ -119,9 +121,26 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
+      - name: "Checkout auditing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
+          path: extensions/Auditing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
+
+      - name: "Install composer dependencies in auditing extension"
+        run: cd extensions/Auditing && composer install --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+
+      - name: "Install npm dependencies in auditing extension"
+        run: cd extensions/Auditing && npm ci
+
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
+      - name: "Activate auditing extension"
+        run: php artisan module:enable Auditing
+
       - name: "Install npm dependencies"
         run: npm ci
 
@@ -141,7 +160,7 @@ jobs:
             ${{ env.DOCKER_REPO }}
 
       - name: "Login to solidtime OnPremise Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: registry.on-premise.solidtime.io
           username: ${{ secrets.ONPREMISE_USERNAME }}
@@ -195,7 +214,7 @@ jobs:
           merge-multiple: true
 
       - name: "Login to solidtime OnPremise Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: registry.on-premise.solidtime.io
           username: ${{ secrets.ONPREMISE_USERNAME }}

.github/workflows/build-private.yml

@@ -84,6 +84,8 @@ jobs:
             echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
+            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout billing extension"
@@ -97,7 +99,7 @@ jobs:
       - name: "Install dependencies in billing extension"
         uses: php-actions/composer@v6
         env:
-          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "gregor@vostrak.at", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
+          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "${{ secrets.LARAVEL_SPARK_USERNAME }}", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
         with:
           working_dir: "extensions/Billing"
           command: install
@@ -145,6 +147,25 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
+      - name: "Checkout auditing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
+          path: extensions/Auditing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
+
+      - name: "Install composer dependencies in auditing extension"
+        uses: php-actions/composer@v6
+        with:
+          working_dir: "extensions/Auditing"
+          command: install
+          only_args: --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+          php_version: 8.3
+
+      - name: "Install npm dependencies in auditing extension"
+        run: cd extensions/Auditing && npm ci
+
       - name: "Setup PHP with PECL extension"
         uses: shivammathur/setup-php@v2
         with:
@@ -168,6 +189,9 @@ jobs:
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
+      - name: "Activate auditing extension"
+        run: php artisan module:enable Auditing
+
       - name: "Install npm dependencies"
         run: npm ci
 
@@ -177,7 +201,7 @@ jobs:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
 
       - name: "Login to GitHub Container Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: rg.fr-par.scw.cloud/solidtime
           username: nologin

.github/workflows/build-public.yml

@@ -117,13 +117,13 @@ jobs:
             ${{ env.GHCR_REPO }}
 
       - name: "Login to Docker Hub Container Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: "Login to GitHub Container Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -177,13 +177,13 @@ jobs:
           merge-multiple: true
 
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: "Login to GHCR"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/extension-manifest-check.yml

@@ -0,0 +1,31 @@
+name: Extension Manifest Check
+on:
+  pull_request:
+    paths:
+      - extensions/manifest.json
+      - .github/workflows/extension-manifest-check.yml
+permissions:
+  contents: read
+jobs:
+  check-refs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+
+      # Extension refs must be pinned to a release tag (vX.Y.Z) or a full commit
+      # SHA. Branch names (main, feature/foo, ...) are only acceptable while
+      # developing and must be replaced before the pull request is merged.
+      - name: "Check extension refs are pinned"
+        run: |
+          failed=0
+          while IFS=$'\t' read -r name ref; do
+            if [[ "$ref" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.]+)?$ ]] || [[ "$ref" =~ ^[0-9a-f]{40}$ ]]; then
+              echo "✅ $name: $ref"
+            else
+              echo "::error file=extensions/manifest.json::Extension \"$name\" uses ref \"$ref\", which is not a release tag or commit SHA. Pin it before merging."
+              failed=1
+            fi
+          done < <(jq -r 'to_entries[] | [.key, .value.ref] | @tsv' extensions/manifest.json)
+          exit $failed

.github/workflows/npm-format-check.yml

@@ -1,6 +1,8 @@
 name: NPM Format Check
 
 on: [push]
+permissions:
+  contents: read
 
 jobs:
   format-check:

.github/workflows/phpunit-extensions.yml

@@ -0,0 +1,136 @@
+name: PHPUnit Tests - Extensions
+on: push
+permissions:
+  contents: read
+jobs:
+  phpunit-extensions:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      matrix:
+        postgres_version: [ 15, 16, 17 ]
+
+    services:
+      pgsql_test:
+        image: postgres:${{ matrix.postgres_version }}
+        env:
+          PGPASSWORD: 'root'
+          POSTGRES_DB: 'laravel'
+          POSTGRES_USER: 'root'
+          POSTGRES_PASSWORD: 'root'
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      gotenberg:
+        image: gotenberg/gotenberg:8
+        ports:
+          - 3000:3000
+        options: >-
+          --health-cmd "curl --silent --fail http://localhost:3000/health"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+
+      - name: "Setup PHP"
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
+          coverage: pcov
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '20.x'
+
+      - name: "Read extension manifest"
+        id: extension-manifest
+        run: |
+          {
+            echo "billing_repository=$(jq -r '.Billing.repository' extensions/manifest.json)"
+            echo "billing_ref=$(jq -r '.Billing.ref' extensions/manifest.json)"
+            echo "services_repository=$(jq -r '.Services.repository' extensions/manifest.json)"
+            echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
+            echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
+            echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: "Checkout billing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.billing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.billing_ref }}
+          path: extensions/Billing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_BILLING_EXTENSION }}
+
+      - name: "Install composer dependencies in billing extension"
+        working-directory: extensions/Billing
+        env:
+          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "contact@solidtime.io", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in billing extension"
+        run: cd extensions/Billing && npm ci
+
+      - name: "Checkout services extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.services_repository }}
+          ref: ${{ steps.extension-manifest.outputs.services_ref }}
+          path: extensions/Services
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_SERVICES_EXTENSION }}
+
+      - name: "Install composer dependencies in services extension"
+        working-directory: extensions/Services
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in services extension"
+        run: cd extensions/Services && npm ci
+
+      - name: "Checkout invoicing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.invoicing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.invoicing_ref }}
+          path: extensions/Invoicing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_INVOICING_EXTENSION }}
+
+      - name: "Install composer dependencies in invoicing extension"
+        working-directory: extensions/Invoicing
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in invoicing extension"
+        run: cd extensions/Invoicing && npm ci
+
+      - name: "Run composer install"
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Activate billing extension"
+        run: php artisan module:enable Billing
+
+      - name: "Activate services extension"
+        run: php artisan module:enable Services
+
+      - name: "Activate invoicing extension"
+        run: php artisan module:enable Invoicing
+
+      - name: "Install dependencies"
+        run: npm ci
+
+      - name: "Build Frontend"
+        run: npm run build
+
+      - name: "Prepare Laravel Application"
+        run: |
+          cp .env.ci .env
+          php artisan key:generate
+          php artisan passport:keys
+
+      - name: "Run PHPUnit"
+        run: php artisan test extensions/Billing/tests extensions/Services/tests extensions/Invoicing/tests --stop-on-failure

.github/workflows/phpunit.yml

@@ -68,7 +68,7 @@ jobs:
         run: php artisan test --stop-on-failure --coverage-text --coverage-clover=coverage.xml
 
       - name: "Upload coverage reports to Codecov"
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: solidtime-io/solidtime

.gitignore

@@ -6,6 +6,7 @@ dist
 /public/storage
 /public/css
 /public/js
+/public/fonts/filament
 /public/vendor
 /lang/vendor
 /storage/*.key
@@ -43,4 +44,5 @@ yarn-error.log
 /data
 /config/caddy
 /config/composer
+/config/psysh
 /AGENTS.md

app/Extensions/Scramble/PaginatedResourceCollectionTypeToSchema.php

@@ -1,107 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Extensions\Scramble;
-
-use App\Http\Resources\PaginatedResourceCollection;
-use App\Http\Resources\V1\TimeEntry\TimeEntryCollection;
-use Dedoc\Scramble\Extensions\TypeToSchemaExtension;
-use Dedoc\Scramble\Support\Generator\Response;
-use Dedoc\Scramble\Support\Generator\Schema;
-use Dedoc\Scramble\Support\Generator\Types\ArrayType;
-use Dedoc\Scramble\Support\Generator\Types\BooleanType;
-use Dedoc\Scramble\Support\Generator\Types\IntegerType;
-use Dedoc\Scramble\Support\Generator\Types\ObjectType as OpenApiObjectType;
-use Dedoc\Scramble\Support\Generator\Types\StringType;
-use Dedoc\Scramble\Support\Type\Generic;
-use Dedoc\Scramble\Support\Type\ObjectType;
-use Dedoc\Scramble\Support\Type\Type;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Http\Resources\Json\JsonResource;
-
-class PaginatedResourceCollectionTypeToSchema extends TypeToSchemaExtension
-{
-    public function shouldHandle(Type $type): bool
-    {
-        return $type instanceof ObjectType
-            && $type->isInstanceOf(PaginatedResourceCollection::class);
-    }
-
-    public function toSchema(Type $type): ?OpenApiObjectType
-    {
-        /** @var Type|null $collectingClassType */
-        $collectingClassType = $type->templateTypes[0] ?? null;
-
-        if (! $collectingClassType instanceof ObjectType) {
-            return null;
-        }
-
-        if (! $collectingClassType->isInstanceOf(JsonResource::class) && ! $collectingClassType->isInstanceOf(Model::class)) {
-            return null;
-        }
-
-        $collectingType = $this->openApiTransformer->transform($collectingClassType);
-
-        $newType = new OpenApiObjectType;
-        $newType->addProperty('data', (new ArrayType)->setItems($collectingType));
-        if ($type instanceof ObjectType && $type->isInstanceOf(TimeEntryCollection::class)) {
-            $newType->addProperty(
-                'meta',
-                (new OpenApiObjectType)
-                    ->addProperty('total', (new IntegerType)->setDescription('Total number of items being paginated.'))
-                    ->setRequired(['total'])
-            );
-            $newType->setRequired(['data', 'meta']);
-        } else {
-            $newType->addProperty(
-                'links',
-                (new OpenApiObjectType)
-                    ->addProperty('first', (new StringType)->nullable(true))
-                    ->addProperty('last', (new StringType)->nullable(true))
-                    ->addProperty('prev', (new StringType)->nullable(true))
-                    ->addProperty('next', (new StringType)->nullable(true))
-                    ->setRequired(['first', 'last', 'prev', 'next'])
-            );
-            $newType->addProperty(
-                'meta',
-                (new OpenApiObjectType)
-                    ->addProperty('current_page', new IntegerType)
-                    ->addProperty('from', (new IntegerType)->nullable(true))
-                    ->addProperty('last_page', new IntegerType)
-                    ->addProperty('links', (new ArrayType)->setItems(
-                        (new OpenApiObjectType)
-                            ->addProperty('url', (new StringType)->nullable(true))
-                            ->addProperty('label', new StringType)
-                            ->addProperty('active', new BooleanType)
-                            ->setRequired(['url', 'label', 'active'])
-                    )->setDescription('Generated paginator links.'))
-                    ->addProperty('path', (new StringType)->nullable(true)->setDescription('Base path for paginator generated URLs.'))
-                    ->addProperty('per_page', (new IntegerType)->setDescription('Number of items shown per page.'))
-                    ->addProperty('to', (new IntegerType)->nullable(true)->setDescription('Number of the last item in the slice.'))
-                    ->addProperty('total', (new IntegerType)->setDescription('Total number of items being paginated.'))
-                    ->setRequired(['current_page', 'from', 'last_page', 'links', 'path', 'per_page', 'to', 'total'])
-            );
-            $newType->setRequired(['data', 'links', 'meta']);
-        }
-
-        return $newType;
-    }
-
-    /**
-     * @param  Generic  $type
-     */
-    public function toResponse(Type $type): ?Response
-    {
-        /** @var ObjectType|null $collectingClassType */
-        $collectingClassType = $type->templateTypes[0] ?? null;
-        if (! $collectingClassType instanceof ObjectType) {
-            return null;
-        }
-        $type = $this->toSchema($type);
-
-        return Response::make(200)
-            ->description('Paginated set of `'.$this->components->uniqueSchemaName($collectingClassType->name).'`')
-            ->setContent('application/json', Schema::fromType($type));
-    }
-}

app/Filament/Resources/AuditResource.php

@@ -1,99 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources;
-
-use App\Filament\Resources\AuditResource\Pages\CreateAudit;
-use App\Filament\Resources\AuditResource\Pages\ListAudits;
-use App\Filament\Resources\AuditResource\Pages\ViewAudit;
-use App\Models\Audit;
-use Filament\Actions\ViewAction;
-use Filament\Forms\Components\Textarea;
-use Filament\Forms\Components\TextInput;
-use Filament\Resources\Resource;
-use Filament\Schemas\Schema;
-use Filament\Tables\Columns\IconColumn;
-use Filament\Tables\Columns\TextColumn;
-use Filament\Tables\Table;
-use Illuminate\Support\Str;
-use Novadaemon\FilamentPrettyJson\Form\PrettyJsonField;
-
-class AuditResource extends Resource
-{
-    protected static ?string $model = Audit::class;
-
-    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-archive-box';
-
-    protected static string|\UnitEnum|null $navigationGroup = 'System';
-
-    public static function form(Schema $schema): Schema
-    {
-        return $schema
-            ->components([
-                TextInput::make('user_type')
-                    ->maxLength(255),
-                TextInput::make('user_id'),
-                TextInput::make('event')
-                    ->required()
-                    ->maxLength(255),
-                TextInput::make('auditable_type')
-                    ->required()
-                    ->maxLength(255),
-                TextInput::make('auditable_id')
-                    ->required(),
-                PrettyJsonField::make('old_values'),
-                PrettyJsonField::make('new_values'),
-                Textarea::make('url'),
-                TextInput::make('ip_address'),
-                TextInput::make('user_agent')
-                    ->maxLength(1023),
-                TextInput::make('tags')
-                    ->maxLength(255),
-            ]);
-    }
-
-    public static function table(Table $table): Table
-    {
-        return $table
-            ->columns([
-                TextColumn::make('user.name'),
-                TextColumn::make('event'),
-                TextColumn::make('auditable_type'),
-                TextColumn::make('auditable_id'),
-                IconColumn::make('was_command')
-                    ->getStateUsing(fn (Audit $record) => Str::startsWith($record->url, 'artisan '))
-                    ->boolean(),
-                TextColumn::make('created_at')
-                    ->sortable()
-                    ->dateTime(),
-                TextColumn::make('updated_at')
-                    ->sortable()
-                    ->dateTime(),
-            ])
-            ->filters([
-                //
-            ])
-            ->recordActions([
-                ViewAction::make(),
-            ])
-            ->toolbarActions([
-            ])
-            ->defaultSort('created_at', 'desc');
-    }
-
-    public static function getRelations(): array
-    {
-        return [
-        ];
-    }
-
-    public static function getPages(): array
-    {
-        return [
-            'index' => ListAudits::route('/'),
-            'create' => CreateAudit::route('/create'),
-            'view' => ViewAudit::route('/{record}'),
-        ];
-    }
-}

app/Filament/Resources/AuditResource/Pages/CreateAudit.php

@@ -1,13 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\CreateRecord;
-
-class CreateAudit extends CreateRecord
-{
-    protected static string $resource = AuditResource::class;
-}

app/Filament/Resources/AuditResource/Pages/ListAudits.php

@@ -1,18 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\ListRecords;
-
-class ListAudits extends ListRecords
-{
-    protected static string $resource = AuditResource::class;
-
-    protected function getHeaderActions(): array
-    {
-        return [];
-    }
-}

app/Filament/Resources/AuditResource/Pages/ViewAudit.php

@@ -1,13 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\ViewRecord;
-
-class ViewAudit extends ViewRecord
-{
-    protected static string $resource = AuditResource::class;
-}

app/Filament/Resources/OrganizationResource.php

@@ -23,7 +23,7 @@ use App\Service\Import\Importers\ImportException;
 use App\Service\Import\Importers\ReportDto;
 use App\Service\Import\ImportService;
 use App\Service\TimezoneService;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Exception;
 use Filament\Actions\Action;
 use Filament\Actions\DeleteAction;
@@ -40,6 +40,7 @@ use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 use Illuminate\Support\Facades\Storage;
+use League\Flysystem\UnableToReadFile;
 
 class OrganizationResource extends Resource
 {
@@ -88,7 +89,7 @@ class OrganizationResource extends Resource
                 Select::make('currency')
                     ->label('Currency')
                     ->options(function (): array {
-                        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+                        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
                         $select = [];
                         foreach ($currencies as $currency) {
                             $select[$currency->getCurrencyCode()] = $currency->getName().' ('.$currency->getCurrencyCode().')';
@@ -181,9 +182,13 @@ class OrganizationResource extends Resource
                     ->icon('heroicon-o-inbox-arrow-down')
                     ->action(function (Organization $record, array $data): void {
                         try {
-                            $file = Storage::disk(config('filament.default_filesystem_disk'))->get($data['file']);
+                            try {
+                                $file = Storage::disk(config('filament.default_filesystem_disk'))->get($data['file']);
+                            } catch (UnableToReadFile) {
+                                $file = null;
+                            }
                             if ($file === null) {
-                                throw new Exception('File not found');
+                                throw new ImportException('File not found');
                             }
                             /** @var string $timezone */
                             $timezone = $data['timezone'];

app/Filament/Resources/OrganizationResource/RelationManagers/UsersRelationManager.php

@@ -98,9 +98,10 @@ class UsersRelationManager extends RelationManager
                             app(BillableRateService::class)->updateTimeEntriesBillableRateForMember($member);
                         }
 
-                        if ($data['role'] !== $member->role) {
+                        $newRole = $data['role'] instanceof Role ? $data['role'] : Role::from($data['role']);
+                        if ($newRole->value !== $member->role) {
                             try {
-                                app(MemberService::class)->changeRole($member, $organization, ($data['role'] instanceof Role ? $data['role'] : Role::from($data['role'])), true);
+                                app(MemberService::class)->changeRole($member, $organization, $newRole, true);
                             } catch (ApiException $exception) {
                                 Notification::make()
                                     ->danger()

app/Filament/Resources/UserResource.php

@@ -16,7 +16,7 @@ use App\Models\User;
 use App\Service\DeletionService;
 use App\Service\TimezoneService;
 use App\Service\UserService;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Exception;
 use Filament\Actions\BulkAction;
 use Filament\Actions\DeleteAction;
@@ -115,7 +115,7 @@ class UserResource extends Resource
                 Select::make('currency')
                     ->label('Currency (Personal Organization)')
                     ->options(function (): array {
-                        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+                        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
                         $select = [];
                         foreach ($currencies as $currency) {
                             $select[$currency->getCurrencyCode()] = $currency->getName().' ('.$currency->getCurrencyCode().')';

app/Filament/Resources/UserResource/RelationManagers/OrganizationsRelationManager.php

@@ -59,9 +59,10 @@ class OrganizationsRelationManager extends RelationManager
                         /** @var Member $member */
                         $member = $record->getRelation('membership');
 
-                        if ($data['role'] !== $member->role) {
+                        $newRole = $data['role'] instanceof Role ? $data['role'] : Role::from($data['role']);
+                        if ($newRole->value !== $member->role) {
                             try {
-                                app(MemberService::class)->changeRole($member, $record, ($data['role'] instanceof Role ? $data['role'] : Role::from($data['role'])), true);
+                                app(MemberService::class)->changeRole($member, $record, $newRole, true);
                             } catch (ApiException $exception) {
                                 Notification::make()
                                     ->danger()

app/Http/Controllers/Api/FallbackController.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use Dedoc\Scramble\Attributes\ExcludeAllRoutesFromDocs;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Fallback for unknown /api/* routes, to prevent a rendered HTML page
+ */
+#[ExcludeAllRoutesFromDocs]
+class FallbackController extends Controller
+{
+    public function __invoke(): never
+    {
+        throw new NotFoundHttpException('API resource not found');
+    }
+}

app/Http/Controllers/Api/V1/ClientController.php

@@ -29,8 +29,6 @@ class ClientController extends Controller
     /**
      * Get clients
      *
-     * @return ClientCollection<ClientResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getClients

app/Http/Controllers/Api/V1/CurrencyController.php

@@ -7,7 +7,7 @@ namespace App\Http\Controllers\Api\V1;
 use App\Http\Controllers\Controller;
 use App\Service\CurrencyService;
 use Brick\Money\Currency;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Illuminate\Http\JsonResponse;
 
 class CurrencyController extends Controller
@@ -29,7 +29,7 @@ class CurrencyController extends Controller
                 'name' => $currency->getName(),
                 'symbol' => $currencyService->getCurrencySymbol($currency->getCurrencyCode()),
             ],
-            ISOCurrencyProvider::getInstance()->getAvailableCurrencies()
+            IsoCurrencyProvider::getInstance()->getAvailableCurrencies()
         ));
 
         return response()->json($currencies);

app/Http/Controllers/Api/V1/InvitationController.php

@@ -9,7 +9,6 @@ use App\Exceptions\Api\UserIsAlreadyMemberOfOrganizationApiException;
 use App\Http\Requests\V1\Invitation\InvitationIndexRequest;
 use App\Http\Requests\V1\Invitation\InvitationStoreRequest;
 use App\Http\Resources\V1\Invitation\InvitationCollection;
-use App\Http\Resources\V1\Invitation\InvitationResource;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
 use App\Service\InvitationService;
@@ -30,8 +29,6 @@ class InvitationController extends Controller
     /**
      * List all invitations of an organization
      *
-     * @return InvitationCollection<InvitationResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getInvitations
@@ -88,6 +85,8 @@ class InvitationController extends Controller
     /**
      * Remove a pending invitation
      *
+     * This revokes the invitation: the link in the invitation email stops working. Find the invitation ID with `GET /organizations/{organization}/invitations`.
+     *
      * @throws AuthorizationException
      *
      * @operationId removeInvitation

app/Http/Controllers/Api/V1/MemberController.php

@@ -48,8 +48,6 @@ class MemberController extends Controller
     /**
      * List all members of an organization
      *
-     * @return MemberCollection<MemberResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getMembers
@@ -145,6 +143,9 @@ class MemberController extends Controller
     /**
      * Merge one member into another
      *
+     * Only placeholder members (for example people created by an import) can be merged. All time entries and other data of the placeholder
+     * are reassigned to the member given in `member_id`, and the placeholder is removed. Find both member IDs with `GET /organizations/{organization}/members`.
+     *
      * @throws AuthorizationException
      * @throws OnlyPlaceholdersCanBeMergedIntoAnotherMember
      * @throws Throwable

app/Http/Controllers/Api/V1/ProjectController.php

@@ -35,8 +35,6 @@ class ProjectController extends Controller
     /**
      * Get projects visible to the current user
      *
-     * @return ProjectCollection<ProjectResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getProjects

app/Http/Controllers/Api/V1/ProjectMemberController.php

@@ -36,8 +36,6 @@ class ProjectMemberController extends Controller
     /**
      * Get project members for project
      *
-     * @return ProjectMemberCollection<ProjectMemberResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getProjectMembers

app/Http/Controllers/Api/V1/ReportController.php

@@ -10,7 +10,6 @@ use App\Http\Requests\V1\Report\ReportStoreRequest;
 use App\Http\Requests\V1\Report\ReportUpdateRequest;
 use App\Http\Resources\V1\Report\DetailedReportResource;
 use App\Http\Resources\V1\Report\ReportCollection;
-use App\Http\Resources\V1\Report\ReportResource;
 use App\Models\Organization;
 use App\Models\Report;
 use App\Service\Dto\ReportPropertiesDto;
@@ -35,8 +34,6 @@ class ReportController extends Controller
     /**
      * Get reports
      *
-     * @return ReportCollection<ReportResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getReports
@@ -71,6 +68,8 @@ class ReportController extends Controller
     /**
      * Create report
      *
+     * A report is a saved set of filters. Set `is_public` to `true` to share it: the response then contains the `shareable_link` that can be opened without logging in.
+     *
      * @throws AuthorizationException
      *
      * @operationId createReport

app/Http/Controllers/Api/V1/TagController.php

@@ -29,8 +29,6 @@ class TagController extends Controller
     /**
      * Get tags
      *
-     * @return TagCollection<TagResource>
-     *
      * @operationId getTags
      *
      * @throws AuthorizationException

app/Http/Controllers/Api/V1/TaskController.php

@@ -51,8 +51,6 @@ class TaskController extends Controller
     /**
      * Get tasks
      *
-     * @return TaskCollection<TaskResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getTasks

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -109,10 +109,13 @@ class TimeEntryController extends Controller
     /**
      * Get time entries in organization
      *
-     * If you only need time entries for a specific user, you can filter by `member_id`.
+     * Without a member filter this returns the time entries of all members of the organization (for users who may view all time entries, such as owners and admins), not only your own.
+     * To get only your own time entries, pass your member ID as `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
      * Users with the permission `time-entries:view:own` can only use this endpoint with their own member ID in the member_id filter.
      *
-     * @return TimeEntryCollection<TimeEntryResource>
+     * The `start` and `end` filters both apply to the start time of an entry, in UTC. Convert the user's local day boundaries to UTC first.
+     * Results are paginated with `limit` (default 100, max 500) and `offset`; check `meta.total` and fetch further pages when needed.
+     * To find the running timer, use `active=true` (or `GET /v1/users/me/time-entries/active`).
      *
      * @throws AuthorizationException
      *
@@ -191,8 +194,9 @@ class TimeEntryController extends Controller
         $roundingMinutes = $canAccessPremiumFeatures ? $request->getRoundingMinutes() : null;
         if ($roundingType !== null && $roundingMinutes !== null) {
             $select = array_diff($select, ['start', 'end']);
-            $select[] = DB::raw(app(TimeEntryService::class)->getStartSelectRawForRounding($roundingType, $roundingMinutes).' as start');
-            $select[] = DB::raw(app(TimeEntryService::class)->getEndSelectRawForRounding($roundingType, $roundingMinutes).' as end');
+            // These SQL fragments are generated from a rounding enum and validated minute count.
+            $select[] = DB::raw(app(TimeEntryService::class)->getStartSelectRawForRounding($roundingType, $roundingMinutes).' as start'); // @phpstan-ignore argument.type
+            $select[] = DB::raw(app(TimeEntryService::class)->getEndSelectRawForRounding($roundingType, $roundingMinutes).' as end'); // @phpstan-ignore argument.type
         }
         $timeEntriesQuery = TimeEntry::query()
             ->whereBelongsTo($organization, 'organization')
@@ -350,6 +354,11 @@ class TimeEntryController extends Controller
      * The parameters `group` and `sub_group` allow you to group the time entries by different criteria.
      * If the group parameters are all set to `null` or are all missing, the endpoint will aggregate all filtered time entries.
      *
+     * Durations are returned in `seconds` (divide by 3600 for hours) and amounts in `cost` as cents in the organization's currency (divide by 100 for money).
+     * Filter by member with `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
+     * Array filters use the query format `client_ids[]=<id>`.
+     * Example: billable hours per client for a period: `group=client&billable=true&start=...&end=...`.
+     *
      * @operationId getAggregatedTimeEntries
      *
      * @return array{
@@ -583,6 +592,12 @@ class TimeEntryController extends Controller
     /**
      * Create time entry
      *
+     * `billable` is not taken from the project. To match the web app, set it to the project's `is_billable` value (or `false` without a project).
+     *
+     * A member can only have one running time entry (an entry with `end` set to `null`). Creating a running entry while another one runs fails with `time_entry_still_running`.
+     * To start a new timer, first stop the running entry by updating its `end` to the current time, then create the new entry.
+     * To log past work, send both `start` and `end` (UTC). Create one entry per block of work.
+     *
      * @throws AuthorizationException
      * @throws TimeEntryStillRunningApiException
      *
@@ -633,6 +648,8 @@ class TimeEntryController extends Controller
     /**
      * Update time entry
      *
+     * To stop a running timer, set `end` to the stop time (UTC). Times the user gives in their own timezone must be converted to UTC first.
+     *
      * @throws AuthorizationException|TimeEntryCanNotBeRestartedApiException
      *
      * @operationId updateTimeEntry
@@ -701,6 +718,10 @@ class TimeEntryController extends Controller
     /**
      * Update multiple time entries
      *
+     * Applies the same `changes` to every entry in `ids`. To find the IDs, list entries with `GET /organizations/{organization}/time-entries`
+     * (filtered by `member_id`, the project and the other criteria), then send their IDs here.
+     * When `changes.project_id` moves entries to another project, also set `changes.task_id` to a task of the new project or to `null`, because tasks belong to a project.
+     *
      * @operationId updateMultipleTimeEntries
      *
      * @throws AuthorizationException

app/Http/Controllers/Web/OrganizationController.php

@@ -6,7 +6,7 @@ namespace App\Http\Controllers\Web;
 
 use App\Models\Organization;
 use Brick\Money\Currency;
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -53,7 +53,7 @@ class OrganizationController extends Controller
             ],
             'currencies' => array_map(function (Currency $currency): string {
                 return $currency->getName();
-            }, ISOCurrencyProvider::getInstance()->getAvailableCurrencies()),
+            }, IsoCurrencyProvider::getInstance()->getAvailableCurrencies()),
             'permissions' => [
                 'canDeleteTeam' => $this->hasPermission($organization, 'organizations:delete'),
                 'canUpdateTeam' => $this->hasPermission($organization, 'organizations:update'),

app/Http/Kernel.php

@@ -11,6 +11,7 @@ use App\Http\Middleware\EnsureEmailIsVerified;
 use App\Http\Middleware\ForceHttps;
 use App\Http\Middleware\ForceJsonResponse;
 use App\Http\Middleware\HandleInertiaRequests;
+use App\Http\Middleware\PreventRequestForgery;
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Http\Middleware\RedirectIfAuthenticated;
 use App\Http\Middleware\ShareInertiaData;
@@ -18,7 +19,6 @@ use App\Http\Middleware\TrimStrings;
 use App\Http\Middleware\TrustHosts;
 use App\Http\Middleware\TrustProxies;
 use App\Http\Middleware\ValidateSignature;
-use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
 use Illuminate\Auth\Middleware\Authorize;
 use Illuminate\Auth\Middleware\RequirePassword;
@@ -68,7 +68,7 @@ class Kernel extends HttpKernel
             AddQueuedCookiesToResponse::class,
             StartSession::class,
             ShareErrorsFromSession::class,
-            VerifyCsrfToken::class,
+            PreventRequestForgery::class,
             SubstituteBindings::class,
             HandleInertiaRequests::class,
             ShareInertiaData::class,

app/Http/Middleware/AuthenticateFilamentPanel.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Filament\Http\Middleware\Authenticate as Middleware;
+use Illuminate\Http\Request;
+
+class AuthenticateFilamentPanel extends Middleware
+{
+    /**
+     * The admin panel has no login page of its own (it shares the app's
+     * session-based login), so Filament::getLoginUrl() always returns null.
+     * Fall back to the app's login route so guests are redirected instead
+     * of receiving an empty 401 response.
+     */
+    protected function redirectTo($request): ?string
+    {
+        return parent::redirectTo($request) ?? ($request->expectsJson() ? null : route('login'));
+    }
+}

app/Http/Middleware/PreventRequestForgery.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery as Middleware;
+
+class PreventRequestForgery extends Middleware
+{
+    /**
+     * The URIs that should be excluded.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/VerifyCsrfToken.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
-
-class VerifyCsrfToken extends Middleware
-{
-    /**
-     * The URIs that should be excluded from CSRF verification.
-     *
-     * @var array<int, string>
-     */
-    protected $except = [
-        //
-    ];
-}

app/Http/Requests/V1/Member/MemberUpdateRequest.php

@@ -27,6 +27,7 @@ class MemberUpdateRequest extends BaseFormRequest
                 'string',
                 Rule::enum(Role::class),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Organization/OrganizationUpdateRequest.php

@@ -36,6 +36,7 @@ class OrganizationUpdateRequest extends BaseFormRequest
                 'string',
                 new CurrencyRule,
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectStoreRequest.php

@@ -55,6 +55,7 @@ class ProjectStoreRequest extends BaseFormRequest
                 'required',
                 'boolean',
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectUpdateRequest.php

@@ -68,6 +68,7 @@ class ProjectUpdateRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge([
                 'nullable',
             ],

app/Http/Requests/V1/ProjectMember/ProjectMemberStoreRequest.php

@@ -31,6 +31,7 @@ class ProjectMemberStoreRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/ProjectMember/ProjectMemberUpdateRequest.php

@@ -21,6 +21,7 @@ class ProjectMemberUpdateRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/TimeEntry/TimeEntryIndexRequest.php

@@ -35,7 +35,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // Filter by member ID
+            // Filter by member ID. Without it, users who may view all time entries (owners, admins) get the entries of every member; pass your own member ID (from GET /v1/users/me/memberships) to get only yours
             'member_id' => [
                 'string',
                 ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
@@ -155,7 +155,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
                 'string',
                 Rule::enum(TimeEntryType::class),
             ],
-            // Limit the number of returned time entries (default: 150)
+            // Limit the number of returned time entries (default: 100)
             'limit' => [
                 'integer',
                 'min:1',

app/Http/Requests/V1/TimeEntry/TimeEntryStoreRequest.php

@@ -32,7 +32,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // ID of the organization member that the time entry should belong to
+            // ID of the organization member that the time entry should belong to (a member ID from GET /v1/users/me/memberships or the members list, not a user ID)
             'member_id' => [
                 'required',
                 'string',
@@ -86,7 +86,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
                 'date_format:Y-m-d\TH:i:s\Z',
                 'after_or_equal:start',
             ],
-            // Whether time entry is billable
+            // Whether time entry is billable. Not derived from the project: set it to the project's is_billable value to match the web app
             'billable' => [
                 'required',
                 'boolean',

app/Http/Resources/PaginatedResourceCollection.php

@@ -1,7 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Resources;
-
-interface PaginatedResourceCollection {}

app/Http/Resources/V1/Client/ClientCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Client;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ClientCollection extends ResourceCollection implements PaginatedResourceCollection
+class ClientCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Invitation/InvitationCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Invitation;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class InvitationCollection extends ResourceCollection implements PaginatedResourceCollection
+class InvitationCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Member/MemberCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Member;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class MemberCollection extends ResourceCollection implements PaginatedResourceCollection
+class MemberCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Member/PersonalMembershipCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Member;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class PersonalMembershipCollection extends ResourceCollection implements PaginatedResourceCollection
+class PersonalMembershipCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Project/ProjectCollection.php

@@ -4,12 +4,11 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Project;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use App\Models\Project;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ProjectCollection extends ResourceCollection implements PaginatedResourceCollection
+class ProjectCollection extends ResourceCollection
 {
     private bool $showBillableRates;
 

app/Http/Resources/V1/ProjectMember/ProjectMemberCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\ProjectMember;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ProjectMemberCollection extends ResourceCollection implements PaginatedResourceCollection
+class ProjectMemberCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Report/ReportCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Report;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ReportCollection extends ResourceCollection implements PaginatedResourceCollection
+class ReportCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Tag/TagCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Tag;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TagCollection extends ResourceCollection implements PaginatedResourceCollection
+class TagCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Task/TaskCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Task;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TaskCollection extends ResourceCollection implements PaginatedResourceCollection
+class TaskCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/TimeEntry/TimeEntryCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\TimeEntry;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TimeEntryCollection extends ResourceCollection implements PaginatedResourceCollection
+class TimeEntryCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Models/Audit.php

@@ -4,15 +4,19 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Concerns\AuditableWithoutOwner;
 use Database\Factories\AuditFactory;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Carbon;
 use OwenIt\Auditing\Models\Audit as PackageAuditModel;
 
 /**
  * @property int $id
- * @property string|null $user_type
- * @property string|null $user_id
+ * @property string|null $actor_type
+ * @property string|null $actor_id
  * @property string $event
  * @property string $auditable_type
  * @property string $auditable_id
@@ -22,13 +26,71 @@ use OwenIt\Auditing\Models\Audit as PackageAuditModel;
  * @property string|null $ip_address
  * @property string|null $user_agent
  * @property string|null $tags
+ * @property string|null $owner_user_id
+ * @property string|null $owner_organization_id
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
+ * @property-read User|null $ownerUser
+ * @property-read Organization|null $ownerOrganization
  *
  * @method static AuditFactory factory()
+ * @method static Builder<Audit> whereMissingOwner()
  */
 class Audit extends PackageAuditModel
 {
     /** @use HasFactory<AuditFactory> */
     use HasFactory;
+
+    /**
+     * @return BelongsTo<User, $this>
+     */
+    public function ownerUser(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'owner_user_id');
+    }
+
+    /**
+     * @return BelongsTo<Organization, $this>
+     */
+    public function ownerOrganization(): BelongsTo
+    {
+        return $this->belongsTo(Organization::class, 'owner_organization_id');
+    }
+
+    /**
+     * Whether audits of the given auditable type intentionally have no owner (see AuditableWithoutOwner).
+     */
+    public static function isAuditableTypeWithoutOwner(string $auditableType): bool
+    {
+        $modelClass = Relation::getMorphedModel($auditableType) ?? $auditableType;
+
+        return is_subclass_of($modelClass, AuditableWithoutOwner::class);
+    }
+
+    /**
+     * Auditable types (morph aliases) whose audits intentionally have no owner (see AuditableWithoutOwner).
+     *
+     * @return array<int, string>
+     */
+    public static function getAuditableTypesWithoutOwner(): array
+    {
+        return collect(Relation::morphMap())
+            ->filter(fn (string $modelClass): bool => is_subclass_of($modelClass, AuditableWithoutOwner::class))
+            ->keys()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * Audits that have neither an owner organization nor an owner user, although their auditable type should have one.
+     * These are audits whose owner no longer exists or could not be determined (yet).
+     *
+     * @param  Builder<Audit>  $builder
+     */
+    public function scopeWhereMissingOwner(Builder $builder): void
+    {
+        $builder->whereNull('owner_organization_id')
+            ->whereNull('owner_user_id')
+            ->whereNotIn('auditable_type', self::getAuditableTypesWithoutOwner());
+    }
 }

app/Models/Concerns/AuditableThroughParent.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Concerns;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Marks an auditable model whose audits are owned by the owner of its parent model,
+ * because the model itself has no organization_id (for example a project member belongs to an organization via its project).
+ * The parent model has to have an organization_id column.
+ * This is used to set the owner of new audits (CustomAuditable) and to backfill the owner of existing audits.
+ */
+interface AuditableThroughParent
+{
+    /**
+     * @return BelongsTo<covariant Model, covariant Model>
+     */
+    public function getAuditParentRelation(): BelongsTo;
+}

app/Models/Concerns/AuditableWithoutOwner.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Concerns;
+
+/**
+ * Marks an auditable model whose audits intentionally have no owner (neither an organization nor a user),
+ * either because the model belongs to neither of them, or because the model and its audits have to be kept
+ * when its organization or user is deleted (for example billing records).
+ * Audits of these models are not deleted together with an organization or user,
+ * and are not considered as missing an owner (for example by the audit backfill command).
+ */
+interface AuditableWithoutOwner {}

app/Models/Concerns/CustomAuditable.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Models\Concerns;
 
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Config;
 use OwenIt\Auditing\Auditable;
 
 trait CustomAuditable
@@ -19,4 +21,92 @@ trait CustomAuditable
     {
         $this->auditEvents = [];
     }
+
+    /**
+     * The organization that owns the audited model.
+     * The audits of the model are deleted (via foreign key cascade) when the organization is deleted.
+     */
+    public function getAuditOwnerOrganizationId(): ?string
+    {
+        if ($this instanceof AuditableThroughParent) {
+            $relation = $this->getAuditParentRelation();
+            $parentId = $this->getAttributes()[$relation->getForeignKeyName()] ?? null;
+            if ($parentId === null) {
+                return null;
+            }
+
+            // Note: The loaded parent is only used if it still matches the foreign key and was loaded with the organization
+            $relationName = $relation->getRelationName();
+            if ($this->relationLoaded($relationName)) {
+                $parent = $this->getRelation($relationName);
+                if ($parent instanceof Model
+                    && $parent->getAttribute($relation->getOwnerKeyName()) === $parentId
+                    && array_key_exists('organization_id', $parent->getAttributes())) {
+                    /** @var string|null $organizationId */
+                    $organizationId = $parent->getAttributes()['organization_id'];
+
+                    return $organizationId;
+                }
+            }
+
+            /** @var string|null $organizationId */
+            $organizationId = $relation->getRelated()->newQuery()
+                ->toBase()
+                ->where($relation->getOwnerKeyName(), $parentId)
+                ->value('organization_id');
+
+            return $organizationId;
+        }
+
+        return $this->getAttributes()['organization_id'] ?? null;
+    }
+
+    /**
+     * The user that owns the audited model.
+     * The audits of the model are deleted (via foreign key cascade) when the user is deleted.
+     */
+    public function getAuditOwnerUserId(): ?string
+    {
+        return null;
+    }
+
+    /**
+     * Models that are the owner of their own audits can not record the deletion audit,
+     * since the audit would reference the already deleted model and therefore violate the foreign key.
+     */
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return false;
+    }
+
+    /**
+     * @return array<int|string, string>
+     */
+    public function getAuditEvents(): array
+    {
+        $events = $this->auditEvents ?? Config::get('audit.events', [
+            'created',
+            'updated',
+            'deleted',
+            'restored',
+        ]);
+
+        if ($this->isAuditOwnerOfItself()) {
+            $events = array_filter($events, fn (string $value, int|string $key): bool => (is_int($key) ? $value : $key) !== 'deleted', ARRAY_FILTER_USE_BOTH);
+        }
+
+        return $events;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    public function transformAudit(array $data): array
+    {
+        $data['owner_organization_id'] = $this->getAuditOwnerOrganizationId();
+        $data['owner_user_id'] = $this->getAuditOwnerUserId();
+
+        return $data;
+    }
 }

app/Models/Organization.php

@@ -19,7 +19,6 @@ use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\Pivot;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Str;
 use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
@@ -97,10 +96,20 @@ class Organization extends Model implements AuditableContract
     protected $attributes = [
     ];
 
+    public function getAuditOwnerOrganizationId(): ?string
+    {
+        return $this->getKey();
+    }
+
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return true;
+    }
+
     /**
      * Get all the users that belong to the team.
      *
-     * @return BelongsToMany<User, $this, Pivot, 'membership'>
+     * @return BelongsToMany<User, $this, Member, 'membership'>
      */
     public function users(): BelongsToMany
     {
@@ -133,7 +142,7 @@ class Organization extends Model implements AuditableContract
     }
 
     /**
-     * @return BelongsToMany<User, $this, Pivot, 'membership'>
+     * @return BelongsToMany<User, $this, Member, 'membership'>
      */
     public function realUsers(): BelongsToMany
     {

app/Models/ProjectMember.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Concerns\AuditableThroughParent;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
 use Database\Factories\ProjectMemberFactory;
@@ -29,7 +30,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @method static Builder<ProjectMember> whereBelongsToOrganization(Organization $organization)
  * @method static ProjectMemberFactory factory()
  */
-class ProjectMember extends Model implements AuditableContract
+class ProjectMember extends Model implements AuditableContract, AuditableThroughParent
 {
     use CustomAuditable;
 
@@ -82,4 +83,12 @@ class ProjectMember extends Model implements AuditableContract
             $query->whereBelongsTo($organization, 'organization');
         });
     }
+
+    /**
+     * @return BelongsTo<Project, $this>
+     */
+    public function getAuditParentRelation(): BelongsTo
+    {
+        return $this->project();
+    }
 }

app/Models/User.php

@@ -20,7 +20,6 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Relations\Pivot;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Support\Carbon;
@@ -125,6 +124,16 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
         'send_time_entry_still_running_email' => true,
     ];
 
+    public function getAuditOwnerUserId(): ?string
+    {
+        return $this->getKey();
+    }
+
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return true;
+    }
+
     /**
      * Get the URL to the user's profile photo.
      *
@@ -175,7 +184,7 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
     }
 
     /**
-     * @return BelongsToMany<Organization, $this, Pivot, 'membership'>
+     * @return BelongsToMany<Organization, $this, Member, 'membership'>
      */
     public function organizations(): BelongsToMany
     {
@@ -190,7 +199,7 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
     }
 
     /**
-     * @return BelongsToMany<Organization, $this, Pivot, 'membership'>
+     * @return BelongsToMany<Organization, $this, Member, 'membership'>
      */
     public function ownedOrganizations(): BelongsToMany
     {

app/Providers/Filament/AdminPanelProvider.php

@@ -9,7 +9,7 @@ use App\Filament\Widgets\ServerOverview;
 use App\Filament\Widgets\TimeEntriesCreated;
 use App\Filament\Widgets\TimeEntriesImported;
 use App\Filament\Widgets\UserRegistrations;
-use Filament\Http\Middleware\Authenticate;
+use App\Http\Middleware\AuthenticateFilamentPanel;
 use Filament\Http\Middleware\DisableBladeIconComponents;
 use Filament\Http\Middleware\DispatchServingFilamentEvent;
 use Filament\Navigation\NavigationGroup;
@@ -19,7 +19,7 @@ use Filament\PanelProvider;
 use Filament\Support\Colors\Color;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Cookie\Middleware\EncryptCookies;
-use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
+use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;
 use Illuminate\Routing\Middleware\SubstituteBindings;
 use Illuminate\Session\Middleware\AuthenticateSession;
 use Illuminate\Session\Middleware\StartSession;
@@ -71,6 +71,9 @@ class AdminPanelProvider extends PanelProvider
                 NavigationGroup::make()
                     ->label('Auth')
                     ->collapsed(),
+                NavigationGroup::make()
+                    ->label('Self Hosting')
+                    ->collapsed(),
             ])
             ->middleware([
                 EncryptCookies::class,
@@ -78,13 +81,13 @@ class AdminPanelProvider extends PanelProvider
                 StartSession::class,
                 AuthenticateSession::class,
                 ShareErrorsFromSession::class,
-                VerifyCsrfToken::class,
+                PreventRequestForgery::class,
                 SubstituteBindings::class,
                 DisableBladeIconComponents::class,
                 DispatchServingFilamentEvent::class,
             ])
             ->authMiddleware([
-                Authenticate::class,
+                AuthenticateFilamentPanel::class,
             ]);
 
         $modules = Module::allEnabled();

app/Rules/CurrencyRule.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Rules;
 
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Closure;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Translation\PotentiallyTranslatedString;
@@ -24,7 +24,7 @@ class CurrencyRule implements ValidationRule
             return;
         }
 
-        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
         if (array_key_exists($value, $currencies)) {
             return;
         }

app/Service/ApiService.php

@@ -15,12 +15,18 @@ use App\Models\User;
 use Exception;
 use Illuminate\Support\Facades\Http;
 use Log;
+use Nwidart\Modules\Facades\Module;
 use Throwable;
 
 class ApiService
 {
     private const string API_URL = 'https://app.solidtime.io/api/v1';
 
+    private function isPremium(): bool
+    {
+        return Module::has('Invoicing');
+    }
+
     public function checkForUpdate(): ?string
     {
         try {
@@ -31,6 +37,7 @@ class ApiService
                     'version' => config('app.version'),
                     'build' => config('app.build'),
                     'url' => config('app.url'),
+                    'is_premium' => $this->isPremium(),
                 ]);
 
             if ($response->status() === 200 && isset($response->json()['version']) && is_string($response->json()['version'])) {
@@ -62,6 +69,7 @@ class ApiService
                     'version' => config('app.version'),
                     'build' => config('app.build'),
                     'url' => config('app.url'),
+                    'is_premium' => $this->isPremium(),
                     // telemetry data
                     'user_count' => User::count(),
                     'organization_count' => Organization::count(),

app/Service/CurrencyService.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Service;
 
-use Brick\Money\ISOCurrencyProvider;
+use Brick\Money\IsoCurrencyProvider;
 use Brick\Money\Money;
 
 class CurrencyService
@@ -378,7 +378,7 @@ class CurrencyService
 
     public function getRandomCurrencyCode(): string
     {
-        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+        $currencies = IsoCurrencyProvider::getInstance()->getAvailableCurrencies();
         $currencyCodes = array_keys($currencies);
 
         return $currencyCodes[array_rand($currencyCodes)];

app/Service/DashboardService.php

@@ -152,12 +152,13 @@ class DashboardService
 
         $possibleDays = $this->lastDays($days, $timezone);
 
+        // The SQL fragment contains only a timezone offset calculated as an integer.
         $query = TimeEntry::query()
-            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate'))
+            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate')) // @phpstan-ignore argument.type
             ->where('user_id', '=', $user->getKey())
             ->where('organization_id', '=', $organization->getKey())
             ->workTime()
-            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')'))
+            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')')) // @phpstan-ignore argument.type
             ->orderBy('date');
 
         $query = $this->constrainDateByPossibleDates($query, $possibleDays, $timezone);
@@ -194,12 +195,13 @@ class DashboardService
         }
         $possibleDays = $this->daysOfThisWeek($timezone, $user->week_start);
 
+        // The SQL fragment contains only a timezone offset calculated as an integer.
         $query = TimeEntry::query()
-            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate'))
+            ->select(DB::raw('DATE('.$dateWithTimeZone.') as date, round(sum(extract(epoch from (coalesce("end", now()) - start)))) as aggregate')) // @phpstan-ignore argument.type
             ->where('user_id', '=', $user->getKey())
             ->where('organization_id', '=', $organization->getKey())
             ->workTime()
-            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')'))
+            ->groupBy(DB::raw('DATE('.$dateWithTimeZone.')')) // @phpstan-ignore argument.type
             ->orderBy('date');
 
         $query = $this->constrainDateByPossibleDates($query, $possibleDays, $timezone);

app/Service/DeletionService.php

@@ -11,6 +11,7 @@ use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
+use App\Models\Passport\RefreshToken;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -169,6 +170,10 @@ class DeletionService
             }
         }
 
+        // Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
+        // Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
+        // which fails with a foreign key violation on oauth_access_tokens.user_id.
+        RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
         $user->accessTokens()->delete();
         $user->authCodes()->delete();
 

app/Service/Import/Importers/ClockifyProjectsImporter.php

@@ -45,7 +45,7 @@ class ClockifyProjectsImporter extends DefaultImporter
                         'organization_id' => $this->organization->id,
                     ], [
                         'color' => $this->colorService->getRandomColor(),
-                        'is_billable' => $record['Billability'] === 'Yes',
+                        'is_billable' => ($record['Billability'] ?? '') === 'Yes',
                         'billable_rate' => $billableRateKey !== null && $record[$billableRateKey] !== '' ? (int) (((float) $record[$billableRateKey]) * 100) : null,
                         'estimated_time' => isset($record['Estimated (h)']) && is_numeric($record['Estimated (h)']) ? (int) ($record['Estimated (h)'] * 3600) : null,
                         'archived_at' => $record['Status'] === 'Archived' ? Carbon::now() : null,
@@ -55,6 +55,7 @@ class ClockifyProjectsImporter extends DefaultImporter
                 if ($tasksKey !== null && $record[$tasksKey] !== '') {
                     $tasks = explode(', ', $record[$tasksKey]);
                     foreach ($tasks as $task) {
+                        $this->checkTaskNameLength($task);
                         $this->taskImportHelper->getKey([
                             'name' => $task,
                             'project_id' => $projectId,
@@ -84,7 +85,6 @@ class ClockifyProjectsImporter extends DefaultImporter
             'Project',
             'Status',
             'Visibility',
-            'Billability',
         ];
         foreach ($requiredFields as $requiredField) {
             if (! in_array($requiredField, $header, true)) {

app/Service/Import/Importers/ClockifyTimeEntriesImporter.php

@@ -104,6 +104,7 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
                 }
                 $taskId = null;
                 if (! $isBreak && $taskKey !== null && $record[$taskKey] !== '') {
+                    $this->checkTaskNameLength($record[$taskKey]);
                     $taskId = $this->taskImportHelper->getKey([
                         'name' => $record[$taskKey],
                         'project_id' => $projectId,
@@ -228,7 +229,6 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
             'Project',
             'Description',
             'User',
-            'Group',
             'Email',
             'Tags',
             'Start Date',

app/Service/Import/Importers/DefaultImporter.php

@@ -22,6 +22,8 @@ use Override;
 
 abstract class DefaultImporter implements ImporterContract
 {
+    protected const TASK_NAME_MAX_LENGTH = 500;
+
     protected Organization $organization;
 
     /**
@@ -182,6 +184,16 @@ abstract class DefaultImporter implements ImporterContract
         $this->billableRateService = app(BillableRateService::class);
     }
 
+    /**
+     * @throws ImportException
+     */
+    protected function checkTaskNameLength(string $taskName): void
+    {
+        if (strlen($taskName) > self::TASK_NAME_MAX_LENGTH) {
+            throw new ImportException('Task name ("'.$taskName.'") is too long, maximum length is '.self::TASK_NAME_MAX_LENGTH.' characters');
+        }
+    }
+
     #[Override]
     public function getReport(): ReportDto
     {

app/Service/Import/Importers/GenericTimeEntriesImporter.php

@@ -114,6 +114,7 @@ class GenericTimeEntriesImporter extends DefaultImporter
                 }
                 $taskId = null;
                 if ($record['task'] !== '') {
+                    $this->checkTaskNameLength($record['task']);
                     $taskId = $this->taskImportHelper->getKey([
                         'name' => $record['task'],
                         'project_id' => $projectId,

app/Service/Import/Importers/HarvestTimeEntriesImporter.php

@@ -92,6 +92,7 @@ class HarvestTimeEntriesImporter extends DefaultImporter
                 }
                 $taskId = null;
                 if ($record['Task'] !== '') {
+                    $this->checkTaskNameLength($record['Task']);
                     $taskId = $this->taskImportHelper->getKey([
                         'name' => $record['Task'],
                         'project_id' => $projectId,

app/Service/Import/Importers/SolidtimeImporter.php

@@ -199,6 +199,7 @@ class SolidtimeImporter extends DefaultImporter
                 if ($projectId === null) {
                     throw new Exception('Project does not exist');
                 }
+                $this->checkTaskNameLength($task['name']);
                 $this->taskImportHelper->getKey([
                     'name' => $task['name'],
                     'project_id' => $projectId,

app/Service/Import/Importers/TogglDataImporter.php

@@ -153,9 +153,16 @@ class TogglDataImporter extends DefaultImporter
                 }
                 foreach ($projectMembers as $projectMember) {
                     $userId = $this->userImportHelper->getKeyByExternalIdentifier((string) $projectMember->user_id);
+                    if ($userId === null) {
+                        throw new Exception('User does not exist');
+                    }
+                    $memberId = $this->memberImportHelper->getKeyByExternalIdentifier($userId);
+                    if ($memberId === null) {
+                        throw new Exception('Member does not exist');
+                    }
                     $this->projectMemberImportHelper->getKey([
                         'project_id' => $projectId,
-                        'member_id' => $this->memberImportHelper->getKeyByExternalIdentifier($userId),
+                        'member_id' => $memberId,
                     ], [
                         'user_id' => $userId,
                         'billable_rate' => $projectMember->rate !== null ? (int) ($projectMember->rate * 100) : null,
@@ -182,6 +189,7 @@ class TogglDataImporter extends DefaultImporter
                     if ($projectId === null) {
                         throw new Exception('Project does not exist');
                     }
+                    $this->checkTaskNameLength($task->name);
                     $this->taskImportHelper->getKey([
                         'name' => $task->name,
                         'project_id' => $projectId,

app/Service/Import/Importers/TogglTimeEntriesImporter.php

@@ -98,6 +98,7 @@ class TogglTimeEntriesImporter extends DefaultImporter
                 }
                 $taskId = null;
                 if ($record['Task'] !== '') {
+                    $this->checkTaskNameLength($record['Task']);
                     $taskId = $this->taskImportHelper->getKey([
                         'name' => $record['Task'],
                         'project_id' => $projectId,

app/Service/TimeEntryAggregationService.php

@@ -75,8 +75,9 @@ class TimeEntryAggregationService
         $startRawSelect = app(TimeEntryService::class)->getStartSelectRawForRounding($roundingType, $roundingMinutes);
         $endRawSelect = app(TimeEntryService::class)->getEndSelectRawForRounding($roundingType, $roundingMinutes);
 
+        // SQL fragments come from enum cases, integer offsets, and formatted dates.
         $timeEntriesQuery->selectRaw(
-            ($group1Select !== null ? $group1Select.' as group_1,' : '').
+            ($group1Select !== null ? $group1Select.' as group_1,' : ''). // @phpstan-ignore argument.type
             ($group2Select !== null ? $group2Select.' as group_2,' : '').
             ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'.
             ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')) * (coalesce(billable_rate, 0)::float/60/60))) as cost'
@@ -105,7 +106,7 @@ class TimeEntryAggregationService
                 $baseTotalsPerGroup1Query = $baseTotalsQuery->clone();
                 $baseTotalsPerGroup1 = $baseTotalsPerGroup1Query
                     ->selectRaw(
-                        $group1Select.' as group_1,'.
+                        $group1Select.' as group_1,'. // @phpstan-ignore argument.type
                         ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'.
                         ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')) * (coalesce(billable_rate, 0)::float/60/60))) as cost'
                     )
@@ -170,7 +171,7 @@ class TimeEntryAggregationService
                 // Reset selects and ordering on the cloned base query
                 $baseTotals = $baseTotalsQuery
                     ->selectRaw(
-                        ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'.
+                        ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')))) as aggregate,'. // @phpstan-ignore argument.type
                         ' round(sum(extract(epoch from ('.$endRawSelect.' - '.$startRawSelect.')) * (coalesce(billable_rate, 0)::float/60/60))) as cost'
                     )
                     ->first();

composer.json

@@ -7,22 +7,22 @@
     "require": {
         "php": "8.3.*",
         "ext-zip": "*",
-        "brick/money": "^0.11.2",
+        "brick/money": "^0.15.1",
         "datomatic/laravel-enum-helper": "^2.0.0",
         "dedoc/scramble": "^0.13.43",
         "filament/filament": "^5.0",
         "flowframe/laravel-trend": "^0.5.0",
         "gotenberg/gotenberg-php": "^2.8",
-        "guzzlehttp/guzzle": "^7.2",
+        "guzzlehttp/guzzle": "^8.2",
         "inertiajs/inertia-laravel": "^3.3.4",
         "korridor/laravel-computed-attributes": "^3.1",
         "korridor/laravel-has-many-sync": "^3.1",
         "korridor/laravel-model-validation-rules": "^3.0",
         "laravel/fortify": "^1.37",
-        "laravel/framework": "^12.19.3",
+        "laravel/framework": "^13.0",
         "laravel/octane": "^2.3",
         "laravel/passport": "^13.0.5",
-        "laravel/tinker": "^2.8",
+        "laravel/tinker": "^3.0",
         "league/csv": "^9.16.0",
         "league/flysystem-aws-s3-v3": "^3.0",
         "league/iso3166": "^4.3",

config/app.php

@@ -24,9 +24,9 @@ return [
     | Application Name
     |--------------------------------------------------------------------------
     |
-    | This value is the name of your application. This value is used when the
+    | This value is the name of your application, which will be used when the
     | framework needs to place the application's name in a notification or
-    | any other location as required by the application or its packages.
+    | other UI elements where an application name needs to be displayed.
     |
     */
 
@@ -110,8 +110,8 @@ return [
     |--------------------------------------------------------------------------
     |
     | Here you may specify the default timezone for your application, which
-    | will be used by the PHP date and date-time functions. We have gone
-    | ahead and set this to a sensible default for you out of the box.
+    | will be used by the PHP date and date-time functions. The timezone
+    | is set to "UTC" by default as it is suitable for most use cases.
     |
     */
 
@@ -123,8 +123,8 @@ return [
     |--------------------------------------------------------------------------
     |
     | The application locale determines the default locale that will be used
-    | by the translation service provider. You are free to set this value
-    | to any of the locales which will be supported by the application.
+    | by Laravel's translation / localization methods. This option can be
+    | set to any locale for which you plan to have translation strings.
     |
     */
 
@@ -178,15 +178,21 @@ return [
     | Encryption Key
     |--------------------------------------------------------------------------
     |
-    | This key is used by the Illuminate encrypter service and should be set
-    | to a random, 32 character string, otherwise these encrypted strings
-    | will not be safe. Please do this before deploying an application!
+    | This key is utilized by Laravel's encryption services and should be set
+    | to a random, 32 character string to ensure that all encrypted values
+    | are secure. You should do this prior to deploying the application.
     |
     */
 
+    'cipher' => 'AES-256-CBC',
+
     'key' => env('APP_KEY'),
 
-    'cipher' => 'AES-256-CBC',
+    'previous_keys' => [
+        ...array_filter(
+            explode(',', (string) env('APP_PREVIOUS_KEYS', ''))
+        ),
+    ],
 
     'localization' => [
         'default_currency' => env('LOCALIZATION_DEFAULT_CURRENCY', 'EUR'),
@@ -206,13 +212,13 @@ return [
     | manage Laravel's "maintenance mode" status. The "cache" driver will
     | allow maintenance mode to be controlled across multiple machines.
     |
-    | Supported drivers: "file", "cache"
+    | Supported drivers: "file", "cache", "array"
     |
     */
 
     'maintenance' => [
-        'driver' => 'file',
-        // 'store' => 'redis',
+        'driver' => env('APP_MAINTENANCE_DRIVER', 'file'),
+        'store' => env('APP_MAINTENANCE_STORE', 'database'),
     ],
 
     /*

config/audit.php

@@ -32,7 +32,7 @@ return [
     */
 
     'user' => [
-        'morph_prefix' => 'user',
+        'morph_prefix' => 'actor',
         'guards' => [
             'web',
             'api',

config/auth.php

@@ -10,8 +10,8 @@ return [
     | Authentication Defaults
     |--------------------------------------------------------------------------
     |
-    | This option controls the default authentication "guard" and password
-    | reset options for your application. You may change these defaults
+    | This option defines the default authentication "guard" and password
+    | reset "broker" for your application. You may change these values
     | as required, but they're a perfect start for most applications.
     |
     */
@@ -28,11 +28,11 @@ return [
     |
     | Next, you may define every authentication guard for your application.
     | Of course, a great default configuration has been defined for you
-    | here which uses session storage and the Eloquent user provider.
+    | which utilizes session storage plus the Eloquent user provider.
     |
-    | All authentication drivers have a user provider. This defines how the
+    | All authentication guards have a user provider, which defines how the
     | users are actually retrieved out of your database or other storage
-    | mechanisms used by this application to persist your user's data.
+    | system used by the application. Typically, Eloquent is utilized.
     |
     | Supported: "session"
     |
@@ -55,12 +55,12 @@ return [
     | User Providers
     |--------------------------------------------------------------------------
     |
-    | All authentication drivers have a user provider. This defines how the
+    | All authentication guards have a user provider, which defines how the
     | users are actually retrieved out of your database or other storage
-    | mechanisms used by this application to persist your user's data.
+    | system used by the application. Typically, Eloquent is utilized.
     |
     | If you have multiple user tables or models you may configure multiple
-    | sources which represent each model / table. These sources may then
+    | providers to represent the model / table. These providers may then
     | be assigned to any extra authentication guards you have defined.
     |
     | Supported: "database", "eloquent"
@@ -80,9 +80,9 @@ return [
     | Resetting Passwords
     |--------------------------------------------------------------------------
     |
-    | You may specify multiple password reset configurations if you have more
-    | than one user table or model in the application and you want to have
-    | separate password reset settings based on the specific user types.
+    | These configuration options specify the behavior of Laravel's password
+    | reset functionality, including the table utilized for token storage
+    | and the user provider that is invoked to actually retrieve users.
     |
     | The expiry time is the number of minutes that each reset token will be
     | considered valid. This security feature keeps tokens short-lived so
@@ -108,13 +108,13 @@ return [
     | Password Confirmation Timeout
     |--------------------------------------------------------------------------
     |
-    | Here you may define the amount of seconds before a password confirmation
-    | times out and the user is prompted to re-enter their password via the
+    | Here you may define the number of seconds before a password confirmation
+    | window expires and users are asked to re-enter their password via the
     | confirmation screen. By default, the timeout lasts for three hours.
     |
     */
 
-    'password_timeout' => 10800,
+    'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),
 
     'super_admins' => ! is_string(env('SUPER_ADMINS', null)) ? [] : explode(',', env('SUPER_ADMINS')),
 

config/cache.php

@@ -11,9 +11,9 @@ return [
     | Default Cache Store
     |--------------------------------------------------------------------------
     |
-    | This option controls the default cache connection that gets used while
-    | using this caching library. This connection is used when another is
-    | not explicitly specified when executing a given caching function.
+    | This option controls the default cache store that will be used by the
+    | framework. This connection is utilized if another isn't explicitly
+    | specified when running a cache operation inside the application.
     |
     */
 
@@ -28,8 +28,9 @@ return [
     | well as their drivers. You may even define multiple stores for the
     | same cache driver to group types of items stored in your caches.
     |
-    | Supported drivers: "apc", "array", "database", "file",
-    |         "memcached", "redis", "dynamodb", "octane", "null"
+    | Supported drivers: "array", "database", "file", "memcached",
+    |                    "redis", "dynamodb", "storage", "octane",
+    |                    "session", "failover", "null"
     |
     */
 
@@ -46,9 +47,10 @@ return [
 
         'database' => [
             'driver' => 'database',
-            'table' => 'cache',
-            'connection' => null,
-            'lock_connection' => null,
+            'connection' => env('DB_CACHE_CONNECTION'),
+            'table' => env('DB_CACHE_TABLE', 'cache'),
+            'lock_connection' => env('DB_CACHE_LOCK_CONNECTION'),
+            'lock_table' => env('DB_CACHE_LOCK_TABLE'),
         ],
 
         'file' => [
@@ -57,6 +59,12 @@ return [
             'lock_path' => storage_path('framework/cache/data'),
         ],
 
+        'storage' => [
+            'driver' => 'storage',
+            'disk' => env('CACHE_STORAGE_DISK'),
+            'path' => env('CACHE_STORAGE_PATH', 'framework/cache/data'),
+        ],
+
         'memcached' => [
             'driver' => 'memcached',
             'persistent_id' => env('MEMCACHED_PERSISTENT_ID'),
@@ -78,8 +86,8 @@ return [
 
         'redis' => [
             'driver' => 'redis',
-            'connection' => 'cache',
-            'lock_connection' => 'default',
+            'connection' => env('REDIS_CACHE_CONNECTION', 'cache'),
+            'lock_connection' => env('REDIS_CACHE_LOCK_CONNECTION', 'default'),
         ],
 
         'dynamodb' => [
@@ -95,6 +103,14 @@ return [
             'driver' => 'octane',
         ],
 
+        'failover' => [
+            'driver' => 'failover',
+            'stores' => [
+                'database',
+                'array',
+            ],
+        ],
+
     ],
 
     /*
@@ -102,12 +118,24 @@ return [
     | Cache Key Prefix
     |--------------------------------------------------------------------------
     |
-    | When utilizing the APC, database, memcached, Redis, or DynamoDB cache
-    | stores there might be other applications using the same cache. For
+    | When utilizing the APC, database, memcached, Redis, and DynamoDB cache
+    | stores, there might be other applications using the same cache. For
     | that reason, you may prefix every cache key to avoid collisions.
     |
     */
 
     'prefix' => env('CACHE_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_').'_cache_'),
 
+    /*
+    |--------------------------------------------------------------------------
+    | Serializable Classes
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the classes that can be unserialized from cache
+    | storage. By default, no PHP classes will be unserialized from your
+    | cache to prevent gadget chain attacks if your APP_KEY is leaked.
+    |
+    */
+
+    'serializable_classes' => false,
 ];

config/database.php

@@ -12,26 +12,22 @@ return [
     |--------------------------------------------------------------------------
     |
     | Here you may specify which of the database connections below you wish
-    | to use as your default connection for all database work. Of course
-    | you may use many connections at once using the Database library.
+    | to use as your default connection for database operations. This is
+    | the connection which will be utilized unless another connection
+    | is explicitly specified when you execute a query / statement.
     |
     */
 
-    'default' => env('DB_CONNECTION', 'mysql'),
+    'default' => env('DB_CONNECTION', 'pgsql'),
 
     /*
     |--------------------------------------------------------------------------
     | Database Connections
     |--------------------------------------------------------------------------
     |
-    | Here are each of the database connections setup for your application.
-    | Of course, examples of configuring each database platform that is
-    | supported by Laravel is shown below to make development simple.
-    |
-    |
-    | All database work in Laravel is done through the PHP PDO facilities
-    | so make sure you have the driver for your particular database of
-    | choice installed on your machine before you begin development.
+    | Below are all of the database connections defined for your application.
+    | An example configuration is provided for each database system which
+    | is supported by Laravel. You're free to add / remove connections.
     |
     */
 
@@ -39,50 +35,34 @@ return [
 
         'sqlite' => [
             'driver' => 'sqlite',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'database' => env('DB_DATABASE', database_path('database.sqlite')),
             'prefix' => '',
             'foreign_key_constraints' => env('DB_FOREIGN_KEYS', true),
-        ],
-
-        'mysql' => [
-            'driver' => 'mysql',
-            'url' => env('DATABASE_URL'),
-            'host' => env('DB_HOST', '127.0.0.1'),
-            'port' => env('DB_PORT', '3306'),
-            'database' => env('DB_DATABASE', 'forge'),
-            'username' => env('DB_USERNAME', 'forge'),
-            'password' => env('DB_PASSWORD', ''),
-            'unix_socket' => env('DB_SOCKET', ''),
-            'charset' => 'utf8mb4',
-            'collation' => 'utf8mb4_unicode_ci',
-            'prefix' => '',
-            'prefix_indexes' => true,
-            'strict' => true,
-            'engine' => null,
-            'options' => extension_loaded('pdo_mysql') ? array_filter([
-                PDO::MYSQL_ATTR_SSL_CA => env('MYSQL_ATTR_SSL_CA'),
-            ]) : [],
+            'busy_timeout' => null,
+            'journal_mode' => null,
+            'synchronous' => null,
+            'transaction_mode' => 'DEFERRED',
         ],
 
         'pgsql' => [
             'driver' => 'pgsql',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'host' => env('DB_HOST', '127.0.0.1'),
             'port' => env('DB_PORT', '5432'),
             'database' => env('DB_DATABASE', 'forge'),
             'username' => env('DB_USERNAME', 'forge'),
             'password' => env('DB_PASSWORD', ''),
-            'charset' => 'utf8',
+            'charset' => env('DB_CHARSET', 'utf8'),
             'prefix' => '',
             'prefix_indexes' => true,
             'search_path' => 'public',
-            'sslmode' => 'prefer',
+            'sslmode' => env('DB_SSL_MODE', 'prefer'),
         ],
 
         'pgsql_test' => [
             'driver' => 'pgsql',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'host' => env('DB_TEST_HOST', '127.0.0.1'),
             'port' => env('DB_TEST_PORT', '5432'),
             'database' => env('DB_TEST_DATABASE', 'forge'),
@@ -92,18 +72,18 @@ return [
             'prefix' => '',
             'prefix_indexes' => true,
             'search_path' => 'public',
-            'sslmode' => 'prefer',
+            'sslmode' => env('DB_SSL_MODE', 'prefer'),
         ],
 
         'sqlsrv' => [
             'driver' => 'sqlsrv',
-            'url' => env('DATABASE_URL'),
+            'url' => env('DB_URL', env('DATABASE_URL')),
             'host' => env('DB_HOST', 'localhost'),
             'port' => env('DB_PORT', '1433'),
-            'database' => env('DB_DATABASE', 'forge'),
-            'username' => env('DB_USERNAME', 'forge'),
+            'database' => env('DB_DATABASE', 'laravel'),
+            'username' => env('DB_USERNAME', 'root'),
             'password' => env('DB_PASSWORD', ''),
-            'charset' => 'utf8',
+            'charset' => env('DB_CHARSET', 'utf8'),
             'prefix' => '',
             'prefix_indexes' => true,
             // 'encrypt' => env('DB_ENCRYPT', 'yes'),
@@ -119,11 +99,14 @@ return [
     |
     | This table keeps track of all the migrations that have already run for
     | your application. Using this information, we can determine which of
-    | the migrations on disk haven't actually been run in the database.
+    | the migrations on disk haven't actually been run on the database.
     |
     */
 
-    'migrations' => 'migrations',
+    'migrations' => [
+        'table' => 'migrations',
+        'update_date_on_publish' => false,
+    ],
 
     /*
     |--------------------------------------------------------------------------
@@ -132,7 +115,7 @@ return [
     |
     | Redis is an open source, fast, and advanced key-value store that also
     | provides a richer body of commands than a typical key-value system
-    | such as APC or Memcached. Laravel makes it easy to dig right in.
+    | such as Memcached. You may define your connection settings here.
     |
     */
 
@@ -143,6 +126,7 @@ return [
         'options' => [
             'cluster' => env('REDIS_CLUSTER', 'redis'),
             'prefix' => env('REDIS_PREFIX', Str::slug(env('APP_NAME', 'laravel'), '_').'_database_'),
+            'persistent' => env('REDIS_PERSISTENT', false),
         ],
 
         'default' => [
@@ -152,6 +136,10 @@ return [
             'password' => env('REDIS_PASSWORD'),
             'port' => env('REDIS_PORT', '6379'),
             'database' => env('REDIS_DB', '0'),
+            'max_retries' => env('REDIS_MAX_RETRIES', 3),
+            'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'),
+            'backoff_base' => env('REDIS_BACKOFF_BASE', 100),
+            'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000),
         ],
 
         'cache' => [
@@ -161,6 +149,10 @@ return [
             'password' => env('REDIS_PASSWORD'),
             'port' => env('REDIS_PORT', '6379'),
             'database' => env('REDIS_CACHE_DB', '1'),
+            'max_retries' => env('REDIS_MAX_RETRIES', 3),
+            'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'),
+            'backoff_base' => env('REDIS_BACKOFF_BASE', 100),
+            'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000),
         ],
 
     ],

config/filesystems.php

@@ -11,7 +11,7 @@ return [
     |
     | Here you may specify the default filesystem disk that should be used
     | by the framework. The "local" disk, as well as a variety of cloud
-    | based disks are available to your application. Just store away!
+    | based disks are available to your application for file storage.
     |
     */
 
@@ -26,11 +26,11 @@ return [
     | Filesystem Disks
     |--------------------------------------------------------------------------
     |
-    | Here you may configure as many filesystem "disks" as you wish, and you
-    | may even configure multiple disks of the same driver. Defaults have
-    | been set up for each driver as an example of the required values.
+    | Below you may configure as many filesystem disks as necessary, and you
+    | may even configure multiple disks for the same driver. Examples for
+    | most supported storage drivers are configured here for reference.
     |
-    | Supported Drivers: "local", "ftp", "sftp", "s3"
+    | Supported drivers: "local", "ftp", "sftp", "s3"
     |
     */
 
@@ -41,14 +41,16 @@ return [
             'root' => storage_path('app'),
             'serve' => true,
             'throw' => true,
+            'report' => false,
         ],
 
         'public' => [
             'driver' => 'local',
             'root' => storage_path('app/public'),
-            'url' => env('APP_URL').'/storage',
+            'url' => rtrim(env('APP_URL', 'http://localhost'), '/').'/storage',
             'visibility' => 'public',
             'throw' => true,
+            'report' => false,
         ],
 
         's3' => [
@@ -62,6 +64,7 @@ return [
             'endpoint' => env('S3_ENDPOINT'),
             'use_path_style_endpoint' => env('S3_USE_PATH_STYLE_ENDPOINT', false),
             'throw' => true,
+            'report' => false,
         ],
 
         'testfiles' => [

config/inertia.php

@@ -23,7 +23,7 @@ return [
 
     'ssr' => [
 
-        'enabled' => (bool) env('INERTIA_SSR_ENABLED', true),
+        'enabled' => (bool) env('INERTIA_SSR_ENABLED', false),
 
         'runtime' => env('INERTIA_SSR_RUNTIME', 'node'),
 

config/logging.php

@@ -14,9 +14,9 @@ return [
     | Default Log Channel
     |--------------------------------------------------------------------------
     |
-    | This option defines the default log channel that gets used when writing
-    | messages to the logs. The name specified in this option should match
-    | one of the channels defined in the "channels" configuration array.
+    | This option defines the default log channel that is utilized to write
+    | messages to your logs. The value provided here should match one of
+    | the channels present in the list of "channels" configured below.
     |
     */
 
@@ -43,20 +43,20 @@ return [
     | Log Channels
     |--------------------------------------------------------------------------
     |
-    | Here you may configure the log channels for your application. Out of
-    | the box, Laravel uses the Monolog PHP logging library. This gives
-    | you a variety of powerful log handlers / formatters to utilize.
+    | Here you may configure the log channels for your application. Laravel
+    | utilizes the Monolog PHP logging library, which includes a variety
+    | of powerful log handlers and formatters that you're free to use.
     |
-    | Available Drivers: "single", "daily", "slack", "syslog",
-    |                    "errorlog", "monolog",
-    |                    "custom", "stack"
+    | Available drivers: "single", "daily", "monthly", "slack", "syslog",
+    |                    "errorlog", "monolog", "custom", "stack"
     |
     */
 
     'channels' => [
+
         'stack' => [
             'driver' => 'stack',
-            'channels' => ['single'],
+            'channels' => explode(',', (string) env('LOG_STACK', 'single')),
             'ignore_exceptions' => false,
         ],
 
@@ -81,15 +81,23 @@ return [
             'driver' => 'daily',
             'path' => storage_path('logs/laravel.log'),
             'level' => env('LOG_LEVEL', 'debug'),
-            'days' => 14,
+            'max_files' => env('LOG_DAILY_DAYS', 14),
+            'replace_placeholders' => true,
+        ],
+
+        'monthly' => [
+            'driver' => 'monthly',
+            'path' => storage_path('logs/laravel.log'),
+            'level' => env('LOG_LEVEL', 'debug'),
+            'max_files' => 3,
             'replace_placeholders' => true,
         ],
 
         'slack' => [
             'driver' => 'slack',
             'url' => env('LOG_SLACK_WEBHOOK_URL'),
-            'username' => 'Laravel Log',
-            'emoji' => ':boom:',
+            'username' => env('LOG_SLACK_USERNAME', env('APP_NAME', 'Laravel')),
+            'emoji' => env('LOG_SLACK_EMOJI', ':boom:'),
             'level' => env('LOG_LEVEL', 'critical'),
             'replace_placeholders' => true,
         ],
@@ -116,17 +124,17 @@ return [
             'driver' => 'monolog',
             'level' => env('LOG_LEVEL', 'debug'),
             'handler' => StreamHandler::class,
-            'formatter' => env('LOG_STDERR_FORMATTER'),
-            'with' => [
+            'handler_with' => [
                 'stream' => 'php://stderr',
             ],
+            'formatter' => env('LOG_STDERR_FORMATTER'),
             'processors' => [PsrLogMessageProcessor::class],
         ],
 
         'syslog' => [
             'driver' => 'syslog',
             'level' => env('LOG_LEVEL', 'debug'),
-            'facility' => LOG_USER,
+            'facility' => env('LOG_SYSLOG_FACILITY', LOG_USER),
             'replace_placeholders' => true,
         ],
 

config/mail.php

@@ -9,9 +9,10 @@ return [
     | Default Mailer
     |--------------------------------------------------------------------------
     |
-    | This option controls the default mailer that is used to send any email
-    | messages sent by your application. Alternative mailers may be setup
-    | and used as needed; however, this mailer will be used by default.
+    | This option controls the default mailer that is used to send all email
+    | messages unless another mailer is explicitly specified when sending
+    | the message. All additional mailers can be configured within the
+    | "mailers" array. Examples of each type of mailer are provided.
     |
     */
 
@@ -26,26 +27,28 @@ return [
     | their respective settings. Several examples have been configured for
     | you and you are free to add your own as your application requires.
     |
-    | Laravel supports a variety of mail "transport" drivers to be used while
-    | sending an e-mail. You will specify which one you are using for your
-    | mailers below. You are free to add additional mailers as required.
+    | Laravel supports a variety of mail "transport" drivers that can be used
+    | when delivering an email. You may specify which one you're using for
+    | your mailers below. You may also add additional mailers if needed.
     |
     | Supported: "smtp", "sendmail", "mailgun", "ses", "ses-v2",
-    |            "postmark", "log", "array", "failover", "roundrobin"
+    |            "postmark", "resend", "log", "array",
+    |            "failover", "roundrobin"
     |
     */
 
     'mailers' => [
         'smtp' => [
             'transport' => 'smtp',
+            'scheme' => env('MAIL_SCHEME'),
             'url' => env('MAIL_URL'),
-            'host' => env('MAIL_HOST', 'smtp.mailgun.org'),
-            'port' => env('MAIL_PORT', 587),
+            'host' => env('MAIL_HOST', '127.0.0.1'),
+            'port' => env('MAIL_PORT', 2525),
             'encryption' => env('MAIL_ENCRYPTION', 'tls'),
             'username' => env('MAIL_USERNAME'),
             'password' => env('MAIL_PASSWORD'),
             'timeout' => null,
-            'local_domain' => env('MAIL_EHLO_DOMAIN'),
+            'local_domain' => env('MAIL_EHLO_DOMAIN', parse_url((string) env('APP_URL', 'http://localhost'), PHP_URL_HOST)),
         ],
 
         'ses' => [
@@ -54,17 +57,14 @@ return [
 
         'postmark' => [
             'transport' => 'postmark',
-            // 'message_stream_id' => null,
+            // 'message_stream_id' => env('POSTMARK_MESSAGE_STREAM_ID'),
             // 'client' => [
             //     'timeout' => 5,
             // ],
         ],
 
-        'mailgun' => [
-            'transport' => 'mailgun',
-            // 'client' => [
-            //     'timeout' => 5,
-            // ],
+        'resend' => [
+            'transport' => 'resend',
         ],
 
         'sendmail' => [
@@ -87,6 +87,7 @@ return [
                 'smtp',
                 'log',
             ],
+            'retry_after' => 60,
         ],
 
         'roundrobin' => [
@@ -95,7 +96,9 @@ return [
                 'ses',
                 'postmark',
             ],
+            'retry_after' => 60,
         ],
+
     ],
 
     /*
@@ -103,15 +106,15 @@ return [
     | Global "From" Address
     |--------------------------------------------------------------------------
     |
-    | You may wish for all e-mails sent by your application to be sent from
-    | the same address. Here, you may specify a name and address that is
-    | used globally for all e-mails that are sent by your application.
+    | You may wish for all emails sent by your application to be sent from
+    | the same address. Here you may specify a name and address that is
+    | used globally for all emails that are sent by your application.
     |
     */
 
     'from' => [
         'address' => env('MAIL_FROM_ADDRESS', 'hello@example.com'),
-        'name' => env('MAIL_FROM_NAME', 'Example'),
+        'name' => env('MAIL_FROM_NAME', env('APP_NAME', 'Laravel')),
     ],
 
     'reply_to' => [

config/queue.php

@@ -9,9 +9,9 @@ return [
     | Default Queue Connection Name
     |--------------------------------------------------------------------------
     |
-    | Laravel's queue API supports an assortment of back-ends via a single
-    | API, giving you convenient access to each back-end using the same
-    | syntax for every one. Here you may define a default connection.
+    | Laravel's queue supports a variety of backends via a single, unified
+    | API, giving you convenient access to each backend using identical
+    | syntax for each. The default queue connection is defined below.
     |
     */
 
@@ -22,11 +22,12 @@ return [
     | Queue Connections
     |--------------------------------------------------------------------------
     |
-    | Here you may configure the connection information for each server that
-    | is used by your application. A default configuration has been added
-    | for each back-end shipped with Laravel. You are free to add more.
+    | Here you may configure the connection options for every queue backend
+    | used by your application. An example configuration is provided for
+    | each backend supported by Laravel. You're also free to add more.
     |
-    | Drivers: "sync", "database", "beanstalkd", "sqs", "redis", "null"
+    | Drivers: "sync", "database", "beanstalkd", "sqs", "redis",
+    |          "deferred", "background", "failover", "null"
     |
     */
 
@@ -38,17 +39,18 @@ return [
 
         'database' => [
             'driver' => 'database',
-            'table' => 'jobs',
-            'queue' => 'default',
-            'retry_after' => 90,
+            'connection' => env('DB_QUEUE_CONNECTION'),
+            'table' => env('DB_QUEUE_TABLE', 'jobs'),
+            'queue' => env('DB_QUEUE', 'default'),
+            'retry_after' => (int) env('DB_QUEUE_RETRY_AFTER', 90),
             'after_commit' => false,
         ],
 
         'beanstalkd' => [
             'driver' => 'beanstalkd',
-            'host' => 'localhost',
-            'queue' => 'default',
-            'retry_after' => 90,
+            'host' => env('BEANSTALKD_QUEUE_HOST', 'localhost'),
+            'queue' => env('BEANSTALKD_QUEUE', 'default'),
+            'retry_after' => (int) env('BEANSTALKD_QUEUE_RETRY_AFTER', 90),
             'block_for' => 0,
             'after_commit' => false,
         ],
@@ -66,13 +68,29 @@ return [
 
         'redis' => [
             'driver' => 'redis',
-            'connection' => 'default',
+            'connection' => env('REDIS_QUEUE_CONNECTION', 'default'),
             'queue' => env('REDIS_QUEUE', 'default'),
-            'retry_after' => 90,
+            'retry_after' => (int) env('REDIS_QUEUE_RETRY_AFTER', 90),
             'block_for' => null,
             'after_commit' => false,
         ],
 
+        'deferred' => [
+            'driver' => 'deferred',
+        ],
+
+        'background' => [
+            'driver' => 'background',
+        ],
+
+        'failover' => [
+            'driver' => 'failover',
+            'connections' => [
+                'database',
+                'deferred',
+            ],
+        ],
+
     ],
 
     /*
@@ -87,7 +105,7 @@ return [
     */
 
     'batching' => [
-        'database' => env('DB_CONNECTION', 'mysql'),
+        'database' => env('DB_CONNECTION', 'sqlite'),
         'table' => 'job_batches',
     ],
 
@@ -97,14 +115,16 @@ return [
     |--------------------------------------------------------------------------
     |
     | These options configure the behavior of failed queue job logging so you
-    | can control which database and table are used to store the jobs that
-    | have failed. You may change them to any database / table you wish.
+    | can control how and where failed jobs are stored. Laravel ships with
+    | support for storing failed jobs in a simple file or in a database.
+    |
+    | Supported drivers: "database-uuids", "dynamodb", "file", "null"
     |
     */
 
     'failed' => [
         'driver' => env('QUEUE_FAILED_DRIVER', 'database-uuids'),
-        'database' => env('DB_CONNECTION', 'mysql'),
+        'database' => env('DB_CONNECTION', 'sqlite'),
         'table' => 'failed_jobs',
     ],
 

config/scramble.php

@@ -3,7 +3,6 @@
 declare(strict_types=1);
 
 use App\Extensions\Scramble\ApiExceptionTypeToSchema;
-use App\Extensions\Scramble\PaginatedResourceCollectionTypeToSchema;
 use Dedoc\Scramble\Http\Middleware\RestrictedDocsAccess;
 
 return [
@@ -28,7 +27,30 @@ return [
         /*
          * Description rendered on the home page of the API documentation (`/docs/api`).
          */
-        'description' => '',
+        'description' => <<<'MD'
+## Getting started
+
+All organization endpoints live under `/v1/organizations/{organization}`, where `{organization}` is the organization's ID. Authenticate with `Authorization: Bearer <token>` and send `Accept: application/json`.
+
+**1. Find yourself.** Call `GET /v1/users/me/memberships`. Each membership contains the **organization ID** (use it as `{organization}` in paths) and your **member ID** in that organization (the membership `id`). Most endpoints filter by member ID, not by user ID.
+
+**2. Scope to your own data.** For owners and admins, `GET /time-entries` and `GET /time-entries/aggregate` return the whole organization's time entries unless you pass `member_id`. When acting for "me", always pass your member ID, both when reading and before changing entries.
+
+**3. Resolve names to IDs.** Look up projects, clients, tags, tasks and members by name with their list endpoints (`GET /projects`, `GET /clients`, `GET /tags`, `GET /tasks`, `GET /members`). Never guess IDs.
+
+**4. Use UTC.** All timestamps are sent and returned in UTC as `Y-m-d\TH:i:s\Z` (example: `2026-10-02T07:30:00Z`). Convert the user's local times and day boundaries to UTC before sending them.
+
+**5. Money is in cents.** Billable rates and costs are integers in cents of the organization's currency (`8000` means 80.00).
+
+## Common tasks
+
+- **Start a timer:** stop the running entry first (find it with `GET /v1/users/me/time-entries/active`, then `PUT` its `end`), then `POST /time-entries` with `start` and `end: null`. Only one entry can run per member.
+- **Log past work:** `POST /time-entries` once per block with `member_id`, `start`, `end`, `project_id` and `billable` set to the project's `is_billable` (it is not derived automatically).
+- **Fix or stop an entry:** `PUT /time-entries/{timeEntry}` with the new `start` or `end` in UTC.
+- **Move entries to another project:** list them with `member_id` and filters, then `PATCH /time-entries` with their `ids` and `changes.project_id`, plus `changes.task_id` set to a task of the new project or `null`.
+- **Totals and reports:** `GET /time-entries/aggregate` with `group` (for example `client` or `project`) and `start`/`end`; durations are in `seconds`, amounts in `cost` (cents).
+- **Share a report:** `POST /reports` with `is_public: true` and use the returned `shareable_link`.
+MD,
     ],
 
     /*
@@ -78,6 +100,5 @@ return [
 
     'extensions' => [
         ApiExceptionTypeToSchema::class,
-        PaginatedResourceCollectionTypeToSchema::class,
     ],
 ];

config/session.php

@@ -9,12 +9,12 @@ return [
     | Default Session Driver
     |--------------------------------------------------------------------------
     |
-    | This option controls the default session "driver" that will be used on
-    | requests. By default, we will use the lightweight native driver but
-    | you may specify any of the other wonderful drivers provided here.
+    | This option determines the default session driver that is utilized for
+    | incoming requests. Laravel supports a variety of storage options to
+    | persist session data. Database storage is a great default choice.
     |
-    | Supported: "file", "cookie", "database", "apc",
-    |            "memcached", "redis", "dynamodb", "array"
+    | Supported: "file", "cookie", "database", "memcached",
+    |            "redis", "dynamodb", "array"
     |
     */
 
@@ -27,13 +27,14 @@ return [
     |
     | Here you may specify the number of minutes that you wish the session
     | to be allowed to remain idle before it expires. If you want them
-    | to immediately expire on the browser closing, set that option.
+    | to expire immediately when the browser is closed then you may
+    | indicate that via the expire_on_close configuration option.
     |
     */
 
-    'lifetime' => env('SESSION_LIFETIME', 120),
+    'lifetime' => (int) env('SESSION_LIFETIME', 120),
 
-    'expire_on_close' => false,
+    'expire_on_close' => env('SESSION_EXPIRE_ON_CLOSE', false),
 
     /*
     |--------------------------------------------------------------------------
@@ -79,24 +80,24 @@ return [
     | Session Database Table
     |--------------------------------------------------------------------------
     |
-    | When using the "database" session driver, you may specify the table we
-    | should use to manage the sessions. Of course, a sensible default is
-    | provided for you; however, you are free to change this as needed.
+    | When using the "database" session driver, you may specify the table to
+    | be used to store sessions. Of course, a sensible default is defined
+    | for you; however, you're welcome to change this to another table.
     |
     */
 
-    'table' => 'sessions',
+    'table' => env('SESSION_TABLE', 'sessions'),
 
     /*
     |--------------------------------------------------------------------------
     | Session Cache Store
     |--------------------------------------------------------------------------
     |
-    | While using one of the framework's cache driven session backends you may
-    | list a cache store that should be used for these sessions. This value
-    | must match with one of the application's configured cache "stores".
+    | When using one of the framework's cache driven session backends, you may
+    | define the cache store which should be used to store the session data
+    | between requests. This must match one of your defined cache stores.
     |
-    | Affects: "apc", "dynamodb", "memcached", "redis"
+    | Affects: "dynamodb", "memcached", "redis"
     |
     */
 
@@ -120,9 +121,9 @@ return [
     | Session Cookie Name
     |--------------------------------------------------------------------------
     |
-    | Here you may change the name of the cookie used to identify a session
-    | instance by ID. The name specified here will get used every time a
-    | new session cookie is created by the framework for every driver.
+    | Here you may change the name of the session cookie that is created by
+    | the framework. Typically, you should not need to change this value
+    | since doing so does not grant a meaningful security improvement.
     |
     */
 
@@ -138,20 +139,20 @@ return [
     |
     | The session cookie path determines the path for which the cookie will
     | be regarded as available. Typically, this will be the root path of
-    | your application but you are free to change this when necessary.
+    | your application, but you're free to change this when necessary.
     |
     */
 
-    'path' => '/',
+    'path' => env('SESSION_PATH', '/'),
 
     /*
     |--------------------------------------------------------------------------
     | Session Cookie Domain
     |--------------------------------------------------------------------------
     |
-    | Here you may change the domain of the cookie used to identify a session
-    | in your application. This will determine which domains the cookie is
-    | available to in your application. A sensible default has been set.
+    | This value determines the domain and subdomains the session cookie is
+    | available to. By default, the cookie will be available to the root
+    | domain without subdomains. Typically, this shouldn't be changed.
     |
     */
 
@@ -177,11 +178,11 @@ return [
     |
     | Setting this value to true will prevent JavaScript from accessing the
     | value of the cookie and the cookie will only be accessible through
-    | the HTTP protocol. You are free to modify this option if needed.
+    | the HTTP protocol. It's unlikely you should disable this option.
     |
     */
 
-    'http_only' => true,
+    'http_only' => env('SESSION_HTTP_ONLY', true),
 
     /*
     |--------------------------------------------------------------------------
@@ -190,13 +191,15 @@ return [
     |
     | This option determines how your cookies behave when cross-site requests
     | take place, and can be used to mitigate CSRF attacks. By default, we
-    | will set this value to "lax" since this is a secure default value.
+    | will set this value to "lax" to permit secure cross-site requests.
+    |
+    | See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value
     |
     | Supported: "lax", "strict", "none", null
     |
     */
 
-    'same_site' => 'lax',
+    'same_site' => env('SESSION_SAME_SITE', 'lax'),
 
     /*
     |--------------------------------------------------------------------------
@@ -209,6 +212,22 @@ return [
     |
     */
 
-    'partitioned' => false,
+    'partitioned' => env('SESSION_PARTITIONED_COOKIE', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Serialization
+    |--------------------------------------------------------------------------
+    |
+    | This value controls the serialization strategy for session data, which
+    | is JSON by default. Setting this to "php" allows the storage of PHP
+    | objects in the session but can make an application vulnerable to
+    | "gadget chain" serialization attacks if the APP_KEY is leaked.
+    |
+    | Supported: "json", "php"
+    |
+    */
+
+    'serialization' => 'php',
 
 ];

database/factories/UserFactory.php

@@ -91,7 +91,7 @@ class UserFactory extends Factory
 
     public function withProfilePicture(): static
     {
-        $profilePhoto = $this->faker->image(null, 500, 500);
+        $profilePhoto = $this->generateProfilePhoto();
         /** @see FileHelpers::hashName */
         $path = 'profile-photos/'.Str::random(40).'.png';
         Storage::disk(config('filesystems.public'))->put($path, $profilePhoto);
@@ -103,6 +103,21 @@ class UserFactory extends Factory
         });
     }
 
+    /**
+     * Generates a PNG image with a random background color.
+     * Note: The image is generated locally, since downloading a placeholder image (Faker image()) depends on an external service.
+     */
+    private function generateProfilePhoto(): string
+    {
+        $image = imagecreatetruecolor(500, 500);
+        $color = imagecolorallocate($image, $this->faker->numberBetween(0, 255), $this->faker->numberBetween(0, 255), $this->faker->numberBetween(0, 255));
+        imagefill($image, 0, 0, $color);
+        ob_start();
+        imagepng($image);
+
+        return (string) ob_get_clean();
+    }
+
     /**
      * Indicate that the user should have a personal team.
      */

database/migrations/2024_09_02_094105_create_audits_table.php

@@ -18,7 +18,8 @@ class CreateAuditsTable extends Migration
 
         Schema::connection($connection)->create($table, function (Blueprint $table): void {
 
-            $morphPrefix = config('audit.user.morph_prefix', 'user');
+            // Note: The morph prefix is hardcoded, since the columns are renamed in a later migration
+            $morphPrefix = 'user';
 
             $table->bigIncrements('id');
             $table->string($morphPrefix.'_type')->nullable();

database/migrations/2026_10_06_000001_add_owner_columns_to_audits_table.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * Note: Renaming columns and adding nullable columns without default are metadata-only operations in PostgreSQL,
+     * so this migration is fast even for a large audits table.
+     * The indexes and foreign keys for the new columns are added in a separate non-transactional migration.
+     */
+    public function up(): void
+    {
+        Schema::table('audits', function (Blueprint $table): void {
+            $table->renameColumn('user_type', 'actor_type');
+            $table->renameColumn('user_id', 'actor_id');
+            $table->renameIndex('audits_user_id_user_type_index', 'audits_actor_id_actor_type_index');
+            $table->uuid('owner_user_id')->nullable();
+            $table->uuid('owner_organization_id')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('audits', function (Blueprint $table): void {
+            $table->dropColumn('owner_user_id');
+            $table->dropColumn('owner_organization_id');
+            $table->renameIndex('audits_actor_id_actor_type_index', 'audits_user_id_user_type_index');
+            $table->renameColumn('actor_type', 'user_type');
+            $table->renameColumn('actor_id', 'user_id');
+        });
+    }
+};

database/migrations/2026_10_06_000002_add_owner_foreign_keys_to_audits_table.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * PostgreSQL cannot build an index concurrently inside a transaction.
+     * Keeping this migration non-transactional prevents long write locks on the (large) audits table in production.
+     * Every step is idempotent, so the migration can be re-run if it fails halfway.
+     *
+     * @var bool
+     */
+    public $withinTransaction = false;
+
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        $this->createIndex('audits_owner_user_id_index', 'owner_user_id');
+        $this->createIndex('audits_owner_organization_id_index', 'owner_organization_id');
+
+        $this->createForeignKey('audits_owner_user_id_foreign', 'owner_user_id', 'users');
+        $this->createForeignKey('audits_owner_organization_id_foreign', 'owner_organization_id', 'organizations');
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        DB::statement('ALTER TABLE audits DROP CONSTRAINT IF EXISTS audits_owner_user_id_foreign');
+        DB::statement('ALTER TABLE audits DROP CONSTRAINT IF EXISTS audits_owner_organization_id_foreign');
+        DB::statement('DROP INDEX'.$this->concurrently().' IF EXISTS audits_owner_user_id_index');
+        DB::statement('DROP INDEX'.$this->concurrently().' IF EXISTS audits_owner_organization_id_index');
+    }
+
+    private function createIndex(string $index, string $column): void
+    {
+        $state = DB::selectOne(
+            <<<'SQL'
+                SELECT pg_index.indisvalid::int AS valid
+                FROM pg_index
+                JOIN pg_class ON pg_class.oid = pg_index.indexrelid
+                JOIN pg_namespace ON pg_namespace.oid = pg_class.relnamespace
+                WHERE pg_namespace.nspname = current_schema()
+                  AND pg_class.relname = ?
+                SQL,
+            [$index],
+        );
+
+        if ($state !== null && (bool) $state->valid) {
+            return;
+        }
+
+        // A failed concurrent index build leaves an invalid index behind, that needs to be dropped before rebuilding
+        if ($state !== null) {
+            DB::statement('DROP INDEX'.$this->concurrently().' '.$index);
+        }
+
+        DB::statement('CREATE INDEX'.$this->concurrently().' '.$index.' ON audits ('.$column.')');
+    }
+
+    private function createForeignKey(string $constraint, string $column, string $referencedTable): void
+    {
+        $exists = DB::selectOne(
+            <<<'SQL'
+                SELECT 1
+                FROM pg_constraint
+                JOIN pg_namespace ON pg_namespace.oid = pg_constraint.connamespace
+                WHERE pg_namespace.nspname = current_schema()
+                  AND pg_constraint.conname = ?
+                SQL,
+            [$constraint],
+        ) !== null;
+
+        // Note: Adding the constraint as NOT VALID only needs a short lock, the validation of the existing rows
+        // afterward does not block reads or writes on the audits table.
+        if (! $exists) {
+            DB::statement('ALTER TABLE audits ADD CONSTRAINT '.$constraint.' FOREIGN KEY ('.$column.') REFERENCES '.$referencedTable.' (id) ON DELETE CASCADE NOT VALID');
+        }
+
+        DB::statement('ALTER TABLE audits VALIDATE CONSTRAINT '.$constraint);
+    }
+
+    private function concurrently(): string
+    {
+        return DB::transactionLevel() === 0 ? ' CONCURRENTLY' : '';
+    }
+};

docker/prod/Dockerfile

@@ -1,7 +1,6 @@
 ARG PHP_VERSION=8.3
-ARG FRANKENPHP_VERSION=1.8
+ARG FRANKENPHP_VERSION=1.11
 ARG COMPOSER_VERSION=2.8
-ARG BUN_VERSION="latest"
 ARG APP_ENV
 ARG DOCKER_FILES_BASE_PATH="docker/prod/"
 
@@ -16,13 +15,13 @@ RUN CGO_ENABLED=1 \
     XCADDY_GO_BUILD_FLAGS="-ldflags='-w -s' -tags=nobadger,nomysql,nopgx" \
     CGO_CFLAGS=$(php-config --includes) \
     CGO_LDFLAGS="$(php-config --ldflags) $(php-config --libs)" \
-    xcaddy build v2.10.0 \
+    xcaddy build \
         --output /usr/local/bin/frankenphp \
         --with github.com/dunglas/frankenphp=./ \
         --with github.com/dunglas/frankenphp/caddy=./caddy/ \
         --with github.com/dunglas/caddy-cbrotli
 
-FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-php${PHP_VERSION} AS base
+FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-php${PHP_VERSION}
 
 COPY --from=upstream /usr/local/bin/frankenphp /usr/local/bin/frankenphp
 
@@ -32,26 +31,28 @@ LABEL org.opencontainers.image.description="solidtime is a modern open source ti
 LABEL org.opencontainers.image.source="https://github.com/solidtime-io/solidtime"
 LABEL org.opencontainers.image.licenses="AGPL"
 
-ARG WWWUSER=1000
-ARG WWWGROUP=1000
+ARG USER_ID=1000
+ARG GROUP_ID=1000
 ARG TZ=UTC
-ARG APP_DIR=/var/www/html
-ARG APP_ENV
-ARG APP_HOST
 ARG DOCKER_FILES_BASE_PATH
 
 ENV DEBIAN_FRONTEND=noninteractive \
     TERM=xterm-color \
     OCTANE_SERVER=frankenphp \
     TZ=${TZ} \
-    USER=octane \
-    ROOT=${APP_DIR} \
-    APP_ENV=${APP_ENV} \
+    LANG=C.UTF-8 \
+    USER=laravel \
+    ROOT=/var/www/html \
+    APP_ENV=production \
+    COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_FUND=0 \
-    COMPOSER_MAX_PARALLEL_HTTP=24 \
-    XDG_CONFIG_HOME=${APP_DIR}/.config \
-    XDG_DATA_HOME=${APP_DIR}/.data \
-    SERVER_NAME=${APP_HOST}
+    COMPOSER_MAX_PARALLEL_HTTP=48 \
+    WITH_HORIZON=false \
+    WITH_SCHEDULER=false \
+    WITH_REVERB=false \
+    WITH_SSR=false
+
+ENV XDG_CONFIG_HOME=${ROOT}/.config XDG_DATA_HOME=${ROOT}/.data
 
 WORKDIR ${ROOT}
 
@@ -60,6 +61,9 @@ SHELL ["/bin/bash", "-eou", "pipefail", "-c"]
 RUN ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
     && echo ${TZ} > /etc/timezone
 
+RUN echo "Acquire::http::No-Cache true;" >> /etc/apt/apt.conf.d/99custom && \
+    echo "Acquire::BrokenProxy    true;" >> /etc/apt/apt.conf.d/99custom
+
 RUN apt-get update; \
     apt-get upgrade -yqq; \
     apt-get install -yqq --no-install-recommends --show-progress \
@@ -68,40 +72,36 @@ RUN apt-get update; \
     wget \
     vim \
     git \
+    unzip \
     ncdu \
     procps \
-    unzip \
     ca-certificates \
     supervisor \
     libsodium-dev \
-    libbrotli-dev \
-    # Install PHP extensions (included with dunglas/frankenphp)
+#    && curl -fsSL https://bun.sh/install | BUN_INSTALL=/usr bash \
     && install-php-extensions \
+    apcu \
     bz2 \
     pcntl \
     mbstring \
     bcmath \
     sockets \
-    pgsql \
     pdo_pgsql \
     opcache \
     exif \
     pdo_mysql \
     zip \
     uv \
-    vips \
     intl \
     gd \
     redis \
     rdkafka \
-    memcached \
-    igbinary \
+    ffi \
     ldap \
     && apt-get -y autoremove \
     && apt-get clean \
     && docker-php-source delete \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
-    && rm /var/log/lastlog /var/log/faillog
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /var/log/lastlog /var/log/faillog
 
 RUN arch="$(uname -m)" \
     && case "$arch" in \
@@ -111,106 +111,64 @@ RUN arch="$(uname -m)" \
     x86) _cronic_fname='supercronic-linux-386' ;; \
     *) echo >&2 "error: unsupported architecture: $arch"; exit 1 ;; \
     esac \
-    && wget -q "https://github.com/aptible/supercronic/releases/download/v0.2.29/${_cronic_fname}" \
+    && wget -q "https://github.com/aptible/supercronic/releases/download/v0.2.38/${_cronic_fname}" \
     -O /usr/bin/supercronic \
     && chmod +x /usr/bin/supercronic \
     && mkdir -p /etc/supercronic \
     && echo "*/1 * * * * php ${ROOT}/artisan schedule:run --no-interaction" > /etc/supercronic/laravel
 
 RUN userdel --remove --force www-data \
-    && groupadd --force -g ${WWWGROUP} ${USER} \
-    && useradd -ms /bin/bash --no-log-init --no-user-group -g ${WWWGROUP} -u ${WWWUSER} ${USER} \
-    && setcap -r /usr/local/bin/frankenphp
-
-RUN chown -R ${USER}:${USER} ${ROOT} /var/{log,run} \
-    && chmod -R a+rw ${ROOT} /var/{log,run}
+    && groupadd --force -g ${GROUP_ID} ${USER} \
+    && useradd -ms /bin/bash --no-log-init --no-user-group -g ${GROUP_ID} -u ${USER_ID} ${USER}
 
 RUN cp ${PHP_INI_DIR}/php.ini-production ${PHP_INI_DIR}/php.ini
 
-USER ${USER}
+COPY --link --from=vendor /usr/bin/composer /usr/bin/composer
+COPY --link ${DOCKER_FILES_BASE_PATH}deployment/supervisord.conf /etc/
+COPY --link ${DOCKER_FILES_BASE_PATH}deployment/octane/FrankenPHP/supervisord.frankenphp.conf /etc/supervisor/conf.d/
+COPY --link ${DOCKER_FILES_BASE_PATH}deployment/supervisord.*.conf /etc/supervisor/conf.d/
+COPY --link ${DOCKER_FILES_BASE_PATH}deployment/start-container /usr/local/bin/start-container
+COPY --link ${DOCKER_FILES_BASE_PATH}deployment/healthcheck /usr/local/bin/healthcheck
+COPY --link ${DOCKER_FILES_BASE_PATH}deployment/php.ini ${PHP_INI_DIR}/conf.d/99-php.ini
+#COPY --link composer.* ./
 
-COPY --link --chown=${WWWUSER}:${WWWUSER} --from=vendor /usr/bin/composer /usr/bin/composer
-
-COPY --link --chown=${WWWUSER}:${WWWUSER} ${DOCKER_FILES_BASE_PATH}deployment/supervisord.conf /etc/
-COPY --link --chown=${WWWUSER}:${WWWUSER} ${DOCKER_FILES_BASE_PATH}deployment/octane/FrankenPHP/supervisord.frankenphp.conf /etc/supervisor/conf.d/
-COPY --link --chown=${WWWUSER}:${WWWUSER} ${DOCKER_FILES_BASE_PATH}deployment/supervisord.*.conf /etc/supervisor/conf.d/
-COPY --link --chown=${WWWUSER}:${WWWUSER} ${DOCKER_FILES_BASE_PATH}deployment/start-container /usr/local/bin/start-container
-COPY --link --chown=${WWWUSER}:${WWWUSER} ${DOCKER_FILES_BASE_PATH}deployment/healthcheck /usr/local/bin/healthcheck
-COPY --link --chown=${WWWUSER}:${WWWUSER} ${DOCKER_FILES_BASE_PATH}deployment/php.ini ${PHP_INI_DIR}/conf.d/99-octane.ini
-
-RUN chmod +x /usr/local/bin/start-container /usr/local/bin/healthcheck
-
-###########################################
-
-#FROM base AS common
-#
-#USER ${USER}
-#
-#COPY --link --chown=${WWWUSER}:${WWWUSER} . .
-#
 #RUN composer install \
 #    --no-dev \
 #    --no-interaction \
 #    --no-autoloader \
 #    --no-ansi \
 #    --no-scripts \
+#    --no-progress \
 #    --audit
 
-###########################################
-# Build frontend assets with Bun
-###########################################
-
-#FROM oven/bun:${BUN_VERSION} AS build
-#
-#ARG APP_ENV
-#
-#ENV ROOT=/var/www/html \
-#    APP_ENV=${APP_ENV} \
-#    NODE_ENV=${APP_ENV:-production}
-#
-#WORKDIR ${ROOT}
-#
 #COPY --link package.json bun.lock* ./
-#
+
 #RUN bun install --frozen-lockfile
-#
-#COPY --link . .
-#COPY --link --from=common ${ROOT}/vendor vendor
-#
-#RUN bun run build
 
-###########################################
-
-#FROM common AS runner
-
-USER ${USER}
-
-ENV WITH_HORIZON=false \
-    WITH_SCHEDULER=false \
-    WITH_REVERB=false
-
-COPY --link --chown=${WWWUSER}:${WWWUSER} . ./
-
-RUN test -z "$(find . -name .git -print -quit)"
-#COPY --link --chown=${WWWUSER}:${WWWUSER} --from=build ${ROOT}/public public
+COPY --link . .
 
 RUN mkdir -p \
     storage/framework/{sessions,views,cache,testing} \
     storage/logs \
-    bootstrap/cache && chmod -R a+rw storage
+    bootstrap/cache \
+    && chmod +x /usr/local/bin/start-container /usr/local/bin/healthcheck
 
-#RUN composer install \
-#    --classmap-authoritative \
-#    --no-interaction \
-#    --no-ansi \
-#    --no-dev \
-#    && composer clear-cache
+RUN composer dump-autoload \
+    --optimize \
+    --apcu \
+    --no-dev
 
-RUN cat .env
-#RUN php artisan env
+#RUN bun run build
+
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
+
+USER ${USER}
 
 EXPOSE 8000
+#EXPOSE 2019
+#EXPOSE 8080
 
 ENTRYPOINT ["start-container"]
 
-#HEALTHCHECK --start-period=5s --interval=2s --timeout=5s --retries=8 CMD healthcheck || exit 1
+#HEALTHCHECK --start-period=30s --interval=10s --timeout=3s --retries=3 CMD healthcheck || exit 1

docker/prod/deployment/healthcheck

@@ -22,6 +22,13 @@ elif [ "${container_mode}" = "reverb" ]; then
         echo "Healthcheck failed."
         exit 1
     fi
+elif [ "${container_mode}" = "ssr" ]; then
+    if [ "$(supervisorctl status inertia-ssr-server:inertia-ssr-server_0 | awk '{print tolower($2)}')" = "running" ]; then
+        exit 0
+    else
+        echo "Healthcheck failed."
+        exit 1
+    fi
 elif [ "${container_mode}" = "worker" ]; then
     if [ "$(supervisorctl status worker:worker_0 | awk '{print tolower($2)}')" = "running" ]; then
         exit 0

docker/prod/deployment/octane/FrankenPHP/Caddyfile

@@ -3,6 +3,14 @@
 
 	admin {$CADDY_SERVER_ADMIN_HOST}:{$CADDY_SERVER_ADMIN_PORT}
 
+	log {
+		level {$CADDY_SERVER_LOG_LEVEL:WARN}
+	}
+
+	auto_https off
+
+	skip_install_trust
+
 	frankenphp {
 		worker "{$APP_PUBLIC_PATH}/frankenphp-worker.php" {$CADDY_SERVER_WORKER_COUNT}
 	}
@@ -20,7 +28,7 @@
 
 {$CADDY_SERVER_SERVER_NAME} {
 	log {
-		level WARN
+		level {$CADDY_SERVER_LOG_LEVEL:WARN}
 
 		format filter {
 			wrap {$CADDY_SERVER_LOGGER}
@@ -60,7 +68,6 @@
 		error @rejected 401
 
 		php_server {
-			index frankenphp-worker.php
 			try_files {path} frankenphp-worker.php
 			resolve_root_symlink
 		}

docker/prod/deployment/octane/FrankenPHP/supervisord.frankenphp.conf

@@ -1,65 +1,18 @@
 [program:octane]
 process_name = %(program_name)s_%(process_num)s
-command = php %(ENV_ROOT)s/artisan octane:frankenphp --host=0.0.0.0 --port=8000 --admin-port=2019 --caddyfile=%(ENV_ROOT)s/docker/prod/deployment/octane/FrankenPHP/Caddyfile
+command = php %(ENV_ROOT)s/artisan octane:frankenphp --host=0.0.0.0 --port=8000 --admin-host=0.0.0.0 --admin-port=2019 --log-level=WARN --caddyfile=%(ENV_ROOT)s/docker/prod/deployment/octane/FrankenPHP/Caddyfile
 user = %(ENV_USER)s
 priority = 1
 autostart = true
 autorestart = true
+stopwaitsecs = 30
+stopasgroup = true
+killasgroup = true
 environment = LARAVEL_OCTANE = "1"
 stdout_logfile = /dev/stdout
 stdout_logfile_maxbytes = 0
 stderr_logfile = /dev/stderr
 stderr_logfile_maxbytes = 0
 
-[program:horizon]
-process_name = %(program_name)s_%(process_num)s
-command = php %(ENV_ROOT)s/artisan horizon
-user = %(ENV_USER)s
-priority = 3
-autostart = %(ENV_WITH_HORIZON)s
-autorestart = true
-stdout_logfile = %(ENV_ROOT)s/storage/logs/horizon.log
-stdout_logfile_maxbytes = 200MB
-stderr_logfile = %(ENV_ROOT)s/storage/logs/horizon.log
-stderr_logfile_maxbytes = 200MB
-stopwaitsecs = 3600
-
-[program:scheduler]
-process_name = %(program_name)s_%(process_num)s
-command = supercronic -overlapping /etc/supercronic/laravel
-user = %(ENV_USER)s
-autostart = %(ENV_WITH_SCHEDULER)s
-autorestart = true
-stdout_logfile = %(ENV_ROOT)s/storage/logs/scheduler.log
-stdout_logfile_maxbytes = 200MB
-stderr_logfile = %(ENV_ROOT)s/storage/logs/scheduler.log
-stderr_logfile_maxbytes = 200MB
-
-[program:clear-scheduler-cache]
-process_name = %(program_name)s_%(process_num)s
-command = php %(ENV_ROOT)s/artisan schedule:clear-cache
-user = %(ENV_USER)s
-autostart = %(ENV_WITH_SCHEDULER)s
-autorestart = false
-startsecs = 0
-startretries = 1
-stdout_logfile = %(ENV_ROOT)s/storage/logs/scheduler.log
-stdout_logfile_maxbytes = 200MB
-stderr_logfile = %(ENV_ROOT)s/storage/logs/scheduler.log
-stderr_logfile_maxbytes = 200MB
-
-[program:reverb]
-process_name = %(program_name)s_%(process_num)s
-command = php %(ENV_ROOT)s/artisan reverb:start
-user = %(ENV_USER)s
-priority = 2
-autostart = %(ENV_WITH_REVERB)s
-autorestart = true
-stdout_logfile = %(ENV_ROOT)s/storage/logs/reverb.log
-stdout_logfile_maxbytes = 200MB
-stderr_logfile = %(ENV_ROOT)s/storage/logs/reverb.log
-stderr_logfile_maxbytes = 200MB
-minfds = 10000
-
 [include]
-files = /etc/supervisord.conf
+files = /etc/supervisord.conf /etc/supervisor/conf.d/supervisord.services.conf

docker/prod/deployment/php.ini

@@ -2,8 +2,9 @@
 post_max_size = 100M
 upload_max_filesize = 100M
 expose_php = 0
-realpath_cache_size = 16M
-realpath_cache_ttl = 360
+realpath_cache_size = 32M
+realpath_cache_ttl = 720
+memory_limit = 256M
 max_input_time = 5
 register_argc_argv = 0
 date.timezone = ${TZ:-UTC}
@@ -11,18 +12,24 @@ date.timezone = ${TZ:-UTC}
 [Opcache]
 opcache.enable = 1
 opcache.enable_cli = 1
-opcache.memory_consumption = 256M
+opcache.memory_consumption = 256
 opcache.use_cwd = 0
+opcache.save_comments = 1
 opcache.max_file_size = 0
 opcache.max_accelerated_files = 32531
 opcache.validate_timestamps = 0
 opcache.file_update_protection = 0
 opcache.interned_strings_buffer = 16
+opcache.enable_file_override = 1
+opcache.file_cache_consistency_checks = 0
+opcache.file_cache = /tmp/opcache-file-cache
 
 [JIT]
 opcache.jit_buffer_size = 128M
-opcache.jit = function
-opcache.jit_prof_threshold = 0.001
+opcache.jit = tracing
+opcache.jit_hot_loop = 16
+opcache.jit_hot_func = 32
+opcache.jit_hot_return = 4
 opcache.jit_max_root_traces = 2048
 opcache.jit_max_side_traces = 256
 

docker/prod/deployment/supervisord.conf

@@ -1,8 +1,6 @@
 [supervisord]
 nodaemon = true
 user = %(ENV_USER)s
-logfile = /var/log/supervisor/supervisord.log
-pidfile = /var/run/supervisord.pid
 
 [supervisorctl]
 
@@ -10,4 +8,4 @@ pidfile = /var/run/supervisord.pid
 port = 127.0.0.1:9001
 
 [rpcinterface:supervisor]
-supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

docker/prod/deployment/supervisord.horizon.conf

@@ -4,6 +4,8 @@ command = php %(ENV_ROOT)s/artisan horizon
 user = %(ENV_USER)s
 autostart = true
 autorestart = true
+stopasgroup = true
+killasgroup = true
 stdout_logfile = /dev/stdout
 stdout_logfile_maxbytes = 0
 stderr_logfile = /dev/stderr