Merge commit from fork

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -629,9 +629,9 @@ class TimeEntryController extends Controller
         /** @var Member|null $member */
         $member = $request->has('member_id') ? Member::query()->findOrFail($request->input('member_id')) : null;
         if ($timeEntry->member->user_id === Auth::id() && ($member === null || $member->user_id === Auth::id())) {
-            $this->checkPermission($organization, 'time-entries:update:own');
+            $this->checkPermission($organization, 'time-entries:update:own', $timeEntry);
         } else {
-            $this->checkPermission($organization, 'time-entries:update:all');
+            $this->checkPermission($organization, 'time-entries:update:all', $timeEntry);
         }
 
         if ($timeEntry->end !== null && $request->has('end') && $request->input('end') === null) {

package.json

@@ -19,26 +19,26 @@
     },
     "devDependencies": {
         "@eslint/eslintrc": "^3.2.0",
-        "@eslint/js": "^10.0.1",
-        "@inertiajs/vue3": "^3.0.3",
+        "@eslint/js": "^9.19.0",
+        "@inertiajs/vue3": "^2.0.0",
         "@playwright/test": "^1.41.1",
         "@tailwindcss/forms": "^0.5.9",
         "@tailwindcss/typography": "^0.5.15",
         "@types/chroma-js": "^3.1.0",
-        "@types/node": "^25.6.0",
+        "@types/node": "^22.10.10",
         "@vitejs/plugin-vue": "^6.0.3",
         "@vue/tsconfig": "^0.8.0",
         "autoprefixer": "^10.4.20",
         "axios": "^1.6.4",
         "eslint-plugin-unused-imports": "^4.1.4",
-        "laravel-vite-plugin": "^3.0.1",
+        "laravel-vite-plugin": "^2.1.0",
         "openapi-zod-client": "^1.16.2",
         "postcss": "^8.4.47",
-        "postcss-import": "^16.1.1",
-        "postcss-nesting": "^14.0.0",
-        "tailwindcss": "^4.2.2",
-        "typescript": "^6.0.3",
-        "vite": "^8.0.9",
+        "postcss-import": "^15.1.0",
+        "postcss-nesting": "^12.1.5",
+        "tailwindcss": "^3.4.13",
+        "typescript": "^5.7.3",
+        "vite": "^7.0.0",
         "vite-plugin-checker": "^0.12.0",
         "vue": "^3.5.0",
         "vue-tsc": "^3.0.0"
@@ -51,7 +51,7 @@
         "@tailwindcss/container-queries": "^0.1.1",
         "@tanstack/vue-form": "^1.3.1",
         "@tanstack/vue-query": "^5.56.2",
-        "@tanstack/vue-query-devtools": "^6.1.18",
+        "@tanstack/vue-query-devtools": "^5.58.0",
         "@tanstack/vue-table": "^8.21.2",
         "@vue/eslint-config-prettier": "^10.2.0",
         "@vue/eslint-config-typescript": "^14.3.0",
@@ -64,12 +64,12 @@
         "dayjs": "^1.11.11",
         "echarts": "^6.0.0",
         "focus-trap": "^8.0.0",
-        "lucide-vue-next": "^1.0.0",
+        "lucide-vue-next": "^0.487.0",
         "parse-duration": "^2.0.1",
         "pinia": "^3.0.0",
         "radix-vue": "^1.9.6",
         "reka-ui": "^2.8.2",
-        "tailwind-merge": "^3.5.0",
+        "tailwind-merge": "^2.6.0",
         "tailwindcss-animate": "^1.0.7",
         "vue-echarts": "^8.0.0",
         "zod": "^3.23.8"

resources/js/packages/ui/src/TimeEntry/TimeEntryGroupedTable.vue

@@ -20,25 +20,30 @@ const selectedTimeEntries = defineModel<TimeEntry[]>('selected', {
     default: [],
 });
 
-const props = defineProps<{
-    timeEntries: TimeEntry[];
-    projects: Project[];
-    tasks: Task[];
-    tags: Tag[];
-    clients: Client[];
-    createTag: (name: string) => Promise<Tag | undefined>;
-    updateTimeEntry: (entry: TimeEntry) => void;
-    updateTimeEntries: (ids: string[], changes: Partial<TimeEntry>) => void;
-    deleteTimeEntries: (entries: TimeEntry[]) => void;
-    createTimeEntry: (entry: Omit<CreateTimeEntryBody, 'member_id'>) => void;
-    createProject: (project: CreateProjectBody) => Promise<Project | undefined>;
-    createClient: (client: CreateClientBody) => Promise<Client | undefined>;
-    currency: string;
-    organizationBillableRate: number | null;
-    enableEstimatedTime: boolean;
-    canCreateProject: boolean;
-    groupSimilarTimeEntries: boolean;
-}>();
+const props = withDefaults(
+    defineProps<{
+        timeEntries: TimeEntry[];
+        projects: Project[];
+        tasks: Task[];
+        tags: Tag[];
+        clients: Client[];
+        createTag: (name: string) => Promise<Tag | undefined>;
+        updateTimeEntry: (entry: TimeEntry) => void;
+        updateTimeEntries: (ids: string[], changes: Partial<TimeEntry>) => void;
+        deleteTimeEntries: (entries: TimeEntry[]) => void;
+        createTimeEntry: (entry: Omit<CreateTimeEntryBody, 'member_id'>) => void;
+        createProject: (project: CreateProjectBody) => Promise<Project | undefined>;
+        createClient: (client: CreateClientBody) => Promise<Client | undefined>;
+        currency: string;
+        organizationBillableRate: number | null;
+        enableEstimatedTime: boolean;
+        canCreateProject: boolean;
+        groupSimilarTimeEntries?: boolean;
+    }>(),
+    {
+        groupSimilarTimeEntries: true,
+    }
+);
 
 const groupedTimeEntries = computed(() => {
     const groupedEntriesByDay: Record<string, TimeEntry[]> = {};

tests/Unit/Endpoint/Api/V1/TimeEntryEndpointTest.php

@@ -2490,6 +2490,47 @@ class TimeEntryEndpointTest extends ApiEndpointTestAbstract
         $response->assertForbidden();
     }
 
+    public function test_update_endpoint_fails_if_time_entry_belongs_to_different_organization_than_url_even_with_update_all_permission(): void
+    {
+        // Arrange
+        // Attacker: has `time-entries:update:all` in their own organization (orgA).
+        $data = $this->createUserWithPermission([
+            'time-entries:update:all',
+            'projects:view:all',
+        ]);
+        $attackerProject = Project::factory()->forOrganization($data->organization)->create();
+
+        // Victim: entirely separate organization (orgB). Attacker has NO membership in orgB.
+        $victimOrgData = $this->createUserWithPermission([], true);
+        $victimTimeEntry = TimeEntry::factory()
+            ->forOrganization($victimOrgData->organization)
+            ->forMember($victimOrgData->ownerMember)
+            ->create([
+                'description' => 'victim-original',
+                'project_id' => null,
+                'task_id' => null,
+            ]);
+
+        Passport::actingAs($data->user);
+
+        // Act: PUT to /organizations/{orgA}/time-entries/{victim_uuid} — URL org is attacker's
+        // own org, but the route-bound time entry belongs to orgB.
+        $response = $this->putJson(route('api.v1.time-entries.update', [$data->organization->getKey(), $victimTimeEntry->getKey()]), [
+            'description' => 'attacker-overwrite',
+            'project_id' => $attackerProject->getKey(),
+        ]);
+
+        // Assert: must be rejected. Before the fix this returned 200 and rewrote the
+        // victim row with attacker's project_id while keeping organization_id = orgB.
+        $response->assertForbidden();
+        $this->assertDatabaseHas(TimeEntry::class, [
+            'id' => $victimTimeEntry->getKey(),
+            'organization_id' => $victimOrgData->organization->getKey(),
+            'description' => 'victim-original',
+            'project_id' => null,
+        ]);
+    }
+
     public function test_update_endpoint_fails_if_user_has_no_permission_to_update_time_entries_for_other_users_in_organization(): void
     {
         // Arrange