Migrate workflows to Blacksmith

.env.example

@@ -5,8 +5,7 @@ APP_KEY=base64:UNQNf1SXeASNkWux01Rj8EnHYx8FO0kAxWNDwktclkk=
 APP_DEBUG=true
 APP_URL=https://solidtime.test
 APP_FORCE_HTTPS=false
-# Supported values: on, off, invite-only (true/false are supported for backwards compatibility)
+APP_ENABLE_REGISTRATION=true
-APP_ENABLE_REGISTRATION=on
 SUPER_ADMINS=admin@example.com
 PAGINATION_PER_PAGE_DEFAULT=500
 

.github/VOUCHED.td

@@ -14,12 +14,10 @@
 # Seeded 2026-07-25 from the authors of every merged pull request.
 
 agross
-akolenda
 bufferhead-code
 candideu
 kasparrosin
 korridor
-nikbucher tasks table sorting
 onatcer
 shrootbuck
 smilebeda

.github/workflows/build-onpremise.yml

@@ -28,7 +28,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - runs-on: "ubuntu-24.04-arm"
+          - runs-on: "blacksmith-4vcpu-ubuntu-2404-arm"
             platform: "linux/arm64"
           - runs-on: "ubuntu-24.04"
             platform: "linux/amd64"
@@ -141,7 +141,7 @@ jobs:
             ${{ env.DOCKER_REPO }}
 
       - name: "Login to solidtime OnPremise Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: registry.on-premise.solidtime.io
           username: ${{ secrets.ONPREMISE_USERNAME }}
@@ -182,7 +182,7 @@ jobs:
           retention-days: 1
 
   merge:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 90
     needs:
       - build
@@ -195,7 +195,7 @@ jobs:
           merge-multiple: true
 
       - name: "Login to solidtime OnPremise Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: registry.on-premise.solidtime.io
           username: ${{ secrets.ONPREMISE_USERNAME }}

.github/workflows/build-private.yml

@@ -18,7 +18,7 @@ permissions:
 name: Build - Private
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
 
 
@@ -177,7 +177,7 @@ jobs:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
 
       - name: "Login to GitHub Container Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: rg.fr-par.scw.cloud/solidtime
           username: nologin

.github/workflows/build-public.yml

@@ -28,7 +28,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - runs-on: "ubuntu-24.04-arm"
+          - runs-on: "blacksmith-4vcpu-ubuntu-2404-arm"
             platform: "linux/arm64"
           - runs-on: "ubuntu-24.04"
             platform: "linux/amd64"
@@ -117,13 +117,13 @@ jobs:
             ${{ env.GHCR_REPO }}
 
       - name: "Login to Docker Hub Container Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: "Login to GitHub Container Registry"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -164,7 +164,7 @@ jobs:
           retention-days: 1
 
   merge:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 90
     needs:
       - build
@@ -177,13 +177,13 @@ jobs:
           merge-multiple: true
 
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: "Login to GHCR"
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/generate-api-docs.yml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   api_docs:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     services:

.github/workflows/npm-build.yml

@@ -6,7 +6,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:

.github/workflows/npm-format-check.yml

@@ -4,7 +4,7 @@ on: [push]
 
 jobs:
   format-check:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:

.github/workflows/npm-lint.yml

@@ -6,7 +6,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:

.github/workflows/npm-publish-api.yml

@@ -5,7 +5,7 @@ permissions:
   contents: read
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       id-token: write

.github/workflows/npm-publish-ui.yml

@@ -5,7 +5,7 @@ permissions:
   contents: read
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       id-token: write

.github/workflows/npm-test-unit.yml

@@ -6,7 +6,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     env:
       TZ: UTC

.github/workflows/npm-typecheck.yml

@@ -5,7 +5,7 @@ permissions:
   contents: read
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:

.github/workflows/phpstan.yml

@@ -4,7 +4,7 @@ permissions:
   contents: read
 jobs:
   phpstan:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:

.github/workflows/phpunit.yml

@@ -4,7 +4,7 @@ permissions:
   contents: read
 jobs:
   phpunit:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     strategy:
       matrix:

.github/workflows/pint.yml

@@ -4,7 +4,7 @@ permissions:
   contents: read
 jobs:
   pint:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
 
     steps:

.github/workflows/playwright.yml

@@ -4,7 +4,7 @@ permissions:
   contents: read
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -96,7 +96,7 @@ jobs:
   merge-reports:
     if: always()
     needs: [test]
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: "Checkout code"
         uses: actions/checkout@v7

.github/workflows/vouch-check-pr.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     if: >-
       github.event_name == 'pull_request_target' ||

.github/workflows/vouch-manage-by-discussion.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   manage:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
 
     steps:

.github/workflows/vouch-manage-by-issue.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   manage:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
 
     steps:

app/Actions/Fortify/CreateNewUser.php

@@ -4,11 +4,9 @@ declare(strict_types=1);
 
 namespace App\Actions\Fortify;
 
-use App\Enums\RegistrationMode;
 use App\Enums\Weekday;
 use App\Events\NewsletterRegistered;
 use App\Models\User;
-use App\Service\InvitationService;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\TimezoneService;
 use App\Service\UserService;
@@ -33,14 +31,13 @@ class CreateNewUser implements CreatesNewUsers
      */
     public function create(array $input): User
     {
-        $registrationMode = RegistrationMode::fromConfig(config('app.enable_registration'));
+        if (! config('app.enable_registration')) {
-        if ($registrationMode === RegistrationMode::Off) {
             throw ValidationException::withMessages([
                 'email' => [__('Registration is disabled.')],
             ]);
         }
 
-        $validated = Validator::make($input, [
+        Validator::make($input, [
             'name' => [
                 'required',
                 'string',
@@ -63,20 +60,6 @@ class CreateNewUser implements CreatesNewUsers
             ],
         ])->validate();
 
-        if ($registrationMode === RegistrationMode::InviteOnly) {
-            $invitationService = app(InvitationService::class);
-            $email = (string) $validated['email'];
-            if (! $invitationService->hasAcceptedInvitationForEmail($email)) {
-                $message = $invitationService->hasPendingInvitationForEmail($email)
-                    ? __('Please accept the organization invitation sent to your email address before registering.')
-                    : __('Registration is only available to invited users.');
-
-                throw ValidationException::withMessages([
-                    'email' => [$message],
-                ]);
-            }
-        }
-
         $timezone = null;
         if (array_key_exists('timezone', $input) && is_string($input['timezone'])) {
             if (app(TimezoneService::class)->isValid($input['timezone'])) {

app/Auth/ActiveUserProvider.php

@@ -1,37 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Auth;
-
-use Illuminate\Auth\EloquentUserProvider;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Model;
-
-/**
- * User provider that only resolves non-placeholder users.
- *
- * Placeholder users are created by imports and when members are removed from an
- * organization. They can share an email address with a real user, so resolving a user by
- * email can return a placeholder instead of the real account. The login flow filters them
- * out explicitly, but the password broker and the guard credential checks (for example the
- * password confirmation) resolve users through the configured user provider.
- *
- * Registered as the "eloquent" provider driver in the AuthServiceProvider, so it replaces the
- * built-in one for every provider in config/auth.php.
- */
-class ActiveUserProvider extends EloquentUserProvider
-{
-    /**
-     * @param  Model|null  $model
-     * @return Builder<Model>
-     */
-    #[\Override]
-    protected function newModelQuery($model = null): Builder
-    {
-        $query = parent::newModelQuery($model);
-        $query->getQuery()->where('is_placeholder', '=', false);
-
-        return $query;
-    }
-}

app/Console/Commands/TimeEntry/TimeEntrySendStillRunningMailsCommand.php

@@ -51,8 +51,7 @@ class TimeEntrySendStillRunningMailsCommand extends Command
             ])
             ->whereHas('user', function (Builder $query): void {
                 /** @var Builder<User> $query */
-                $query->where('is_placeholder', '=', false)
+                $query->where('is_placeholder', '=', false);
-                    ->where('send_time_entry_still_running_email', '=', true);
             })
             ->orderBy('created_at', 'asc')
             ->chunk(500, function (Collection $timeEntries) use ($dryRun, &$sentMails): void {

app/Enums/RegistrationMode.php

@@ -1,29 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Enums;
-
-enum RegistrationMode: string
-{
-    case On = 'on';
-    case InviteOnly = 'invite-only';
-    case Off = 'off';
-
-    public static function fromConfig(mixed $value): self
-    {
-        if ($value === true) {
-            return self::On;
-        }
-
-        if ($value === false || $value === null) {
-            return self::Off;
-        }
-
-        return match (strtolower(trim((string) $value))) {
-            '1', 'on', 'true' => self::On,
-            'invite-only' => self::InviteOnly,
-            default => self::Off,
-        };
-    }
-}

app/Exceptions/Api/ApiException.php

@@ -60,6 +60,7 @@ abstract class ApiException extends Exception
      */
     public function report(): bool
     {
+        // TODO: temporary activated
         return false;
     }
 }

app/Exceptions/Api/CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembers.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembers extends ApiException
 {
     public const string KEY = 'can_not_delete_user_who_is_owner_of_organization_with_multiple_members';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/CanNotRemoveOwnerFromOrganization.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class CanNotRemoveOwnerFromOrganization extends ApiException
 {
     public const string KEY = 'can_not_remove_owner_from_organization';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/ChangingRoleOfPlaceholderIsNotAllowed.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class ChangingRoleOfPlaceholderIsNotAllowed extends ApiException
 {
     public const string KEY = 'changing_role_of_placeholder_is_not_allowed';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/ChangingRoleToPlaceholderIsNotAllowed.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class ChangingRoleToPlaceholderIsNotAllowed extends ApiException
 {
     public const string KEY = 'changing_role_to_placeholder_is_not_allowed';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/EntityStillInUseApiException.php

@@ -19,16 +19,6 @@ class EntityStillInUseApiException extends ApiException
 
     public const string KEY = 'entity_still_in_use';
 
-    /**
-     * Report the exception.
-     *
-     * @return bool true means the exception handler will not report it again
-     */
-    public function report(): bool
-    {
-        return true;
-    }
-
     /**
      * Get the translated message for the exception.
      */

app/Exceptions/Api/FeatureIsNotAvailableInFreePlanApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class FeatureIsNotAvailableInFreePlanApiException extends ApiException
 {
     public const string KEY = 'feature_is_not_available_in_free_plan';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/InactiveUserCanNotBeUsedApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class InactiveUserCanNotBeUsedApiException extends ApiException
 {
     public const string KEY = 'inactive_user_can_not_be_used';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/InvitationForTheEmailAlreadyExistsApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class InvitationForTheEmailAlreadyExistsApiException extends ApiException
 {
     public const string KEY = 'invitation_for_the_email_already_exists';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/OnlyOwnerCanChangeOwnership.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class OnlyOwnerCanChangeOwnership extends ApiException
 {
     public const string KEY = 'only_owner_can_change_ownership';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/OnlyPlaceholdersCanBeMergedIntoAnotherMember.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class OnlyPlaceholdersCanBeMergedIntoAnotherMember extends ApiException
 {
     public const string KEY = 'only_placeholders_can_be_merged_into_another_member';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/OrganizationHasNoSubscriptionButMultipleMembersException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class OrganizationHasNoSubscriptionButMultipleMembersException extends ApiException
 {
     public const string KEY = 'organization_has_no_subscription_but_multiple_members';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/OrganizationNeedsAtLeastOneOwner.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class OrganizationNeedsAtLeastOneOwner extends ApiException
 {
     public const string KEY = 'organization_needs_at_least_one_owner';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/OverlappingTimeEntryApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class OverlappingTimeEntryApiException extends ApiException
 {
     public const string KEY = 'overlapping_time_entry';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException extends ApiException
 {
     public const string KEY = 'this_placeholder_can_not_be_invited_use_the_merge_tool_instead_api_exception';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/TimeEntryCanNotBeRestartedApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class TimeEntryCanNotBeRestartedApiException extends ApiException
 {
     public const string KEY = 'time_entry_can_not_be_restarted';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/TimeEntryStillRunningApiException.php

@@ -7,14 +7,4 @@ namespace App\Exceptions\Api;
 class TimeEntryStillRunningApiException extends ApiException
 {
     public const string KEY = 'time_entry_still_running';
-
-    /**
-     * Report the exception.
-     *
-     * @return bool true means the exception handler will not report it again
-     */
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/UserIsAlreadyMemberOfOrganizationApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class UserIsAlreadyMemberOfOrganizationApiException extends ApiException
 {
     public const string KEY = 'user_is_already_member_of_organization';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/UserIsAlreadyMemberOfProjectApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class UserIsAlreadyMemberOfProjectApiException extends ApiException
 {
     public const string KEY = 'user_is_already_member_of_project';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/UserNotPlaceholderApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class UserNotPlaceholderApiException extends ApiException
 {
     public const string KEY = 'user_not_placeholder';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Api/UserResendEmailVerificationNoPendingEmailApiException.php

@@ -7,9 +7,4 @@ namespace App\Exceptions\Api;
 class UserResendEmailVerificationNoPendingEmailApiException extends ApiException
 {
     public const string KEY = 'user_resend_email_verification_no_pending_email';
-
-    public function report(): bool
-    {
-        return true;
-    }
 }

app/Exceptions/Handler.php

@@ -7,7 +7,6 @@ namespace App\Exceptions;
 use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
-use League\OAuth2\Server\Exception\OAuthServerException;
 use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
@@ -35,10 +34,6 @@ class Handler extends ExceptionHandler
             //
         });
 
-        $this->dontReportWhen(fn (Throwable $e): bool => $e instanceof OAuthServerException
-            && $e->getErrorType() === 'access_denied'
-            && $e->getHttpStatusCode() === 401);
-
         // A request on an untrusted host (see App\Http\Middleware\TrustHosts)
         // otherwise renders as a bare "Bad request." 400. Show a message that
         // says how to fix it instead. The framework has already converted the

app/Http/Controllers/Api/V1/ExportController.php

@@ -28,9 +28,7 @@ class ExportController extends Controller
 
         $filepath = $exportService->export($organization);
         $downloadUrl = Storage::disk(config('filesystems.private'))
-            ->temporaryUrl($filepath, Carbon::now()->addMinutes(10), [
+            ->temporaryUrl($filepath, Carbon::now()->addMinutes(10));
-                'ResponseContentDisposition' => 'attachment; filename="'.basename($filepath).'"',
-            ]);
 
         return new JsonResponse([
             'success' => true,

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -336,9 +336,7 @@ class TimeEntryController extends Controller
 
         return response()->json([
             'download_url' => Storage::disk(config('filesystems.private'))
-                ->temporaryUrl($path, now()->addMinutes(5), [
+                ->temporaryUrl($path, now()->addMinutes(5)),
-                    'ResponseContentDisposition' => 'attachment; filename="'.$filename.'"',
-                ]),
         ]);
     }
 
@@ -537,7 +535,7 @@ class TimeEntryController extends Controller
                 ->putFileAs($folderPath, new File($tempFolder->path($filenameTemp)), $filename);
         } else {
             Excel::store(
-                new TimeEntriesReportExport($aggregatedData, $format, $currency, $group, $subGroup, $showBillableRate, $localizationService),
+                new TimeEntriesReportExport($aggregatedData, $format, $currency, $group, $subGroup, $showBillableRate),
                 $path,
                 config('filesystems.private'),
                 $format->getExportPackageType(),
@@ -549,9 +547,7 @@ class TimeEntryController extends Controller
 
         return response()->json([
             'download_url' => Storage::disk(config('filesystems.private'))
-                ->temporaryUrl($path, now()->addMinutes(5), [
+                ->temporaryUrl($path, now()->addMinutes(5)),
-                    'ResponseContentDisposition' => 'attachment; filename="'.$filename.'"',
-                ]),
         ]);
     }
 

app/Http/Controllers/Api/V1/UserController.php

@@ -124,10 +124,6 @@ class UserController extends Controller
             $user->week_start = $request->getWeekStart();
         }
 
-        if ($request->getSendTimeEntryStillRunningEmail() !== null) {
-            $user->send_time_entry_still_running_email = $request->getSendTimeEntryStillRunningEmail();
-        }
-
         $user->save();
 
         if ($emailToVerify !== null) {

app/Http/Controllers/Web/OrganizationInvitationController.php

@@ -36,7 +36,6 @@ class OrganizationInvitationController extends Controller
             }
 
             return redirect(route('register'))
-                ->with('registration_email', $email)
                 ->with('bannerText', __('Please create an account to finish joining the :organization organization.', [
                     'organization' => $organization->name,
                 ]))

app/Http/Requests/V1/Import/ImportRequest.php

@@ -24,7 +24,6 @@ class ImportRequest extends BaseFormRequest
             'data' => [
                 'required',
                 'string',
-                'max:'.config('import.max_data_size'),
             ],
         ];
     }

app/Http/Requests/V1/User/UserUpdateRequest.php

@@ -58,9 +58,6 @@ class UserUpdateRequest extends BaseFormRequest
             'week_start' => [
                 Rule::enum(Weekday::class),
             ],
-            'send_time_entry_still_running_email' => [
-                'boolean',
-            ],
         ];
     }
 
@@ -84,13 +81,6 @@ class UserUpdateRequest extends BaseFormRequest
         return $this->has('week_start') ? Weekday::from($this->input('week_start')) : null;
     }
 
-    public function getSendTimeEntryStillRunningEmail(): ?bool
-    {
-        return $this->has('send_time_entry_still_running_email')
-            ? $this->boolean('send_time_entry_still_running_email')
-            : null;
-    }
-
     public function hasPhotoKey(): bool
     {
         return $this->has('photo');

app/Http/Resources/V1/User/UserResource.php

@@ -36,8 +36,6 @@ class UserResource extends BaseResource
             'timezone' => $this->resource->timezone,
             /** @var Weekday $week_start Starting day of the week */
             'week_start' => $this->resource->week_start->value,
-            /** @var bool $send_time_entry_still_running_email Whether to email the user when a time entry has been running for more than 8 hours */
-            'send_time_entry_still_running_email' => $this->resource->send_time_entry_still_running_email,
         ];
     }
 }

app/Models/User.php

@@ -38,14 +38,10 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property string|null $pending_email
  * @property Carbon|null $email_verified_at
  * @property string|null $password
- * @property string|null $remember_token
  * @property string|null $two_factor_secret
- * @property string|null $two_factor_recovery_codes
- * @property Carbon|null $two_factor_confirmed_at
  * @property string $timezone
  * @property bool $is_placeholder
  * @property Weekday $week_start
- * @property bool $send_time_entry_still_running_email
  * @property string|null $profile_photo_path
  * @property-read Organization|null $currentOrganization
  * @property-read string $profile_photo_url
@@ -112,7 +108,6 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
         'is_admin' => 'boolean',
         'is_placeholder' => 'boolean',
         'week_start' => Weekday::class,
-        'send_time_entry_still_running_email' => 'boolean',
     ];
 
     /**
@@ -122,7 +117,6 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
      */
     protected $attributes = [
         'week_start' => Weekday::Monday,
-        'send_time_entry_still_running_email' => true,
     ];
 
     /**
@@ -153,9 +147,7 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
 
     public function canAccessPanel(Panel $panel): bool
     {
-        return $this->is_placeholder === false
+        return in_array($this->email, config('auth.super_admins', []), true) && $this->hasVerifiedEmail();
-            && in_array($this->email, config('auth.super_admins', []), true)
-            && $this->hasVerifiedEmail();
     }
 
     public function isMemberOfOrganization(Organization $organization): bool

app/Providers/AppServiceProvider.php

@@ -20,7 +20,6 @@ use App\Service\BillingContract;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\IpLookup\NoIpLookupService;
 use App\Service\PermissionStore;
-use DateTimeInterface;
 use Dedoc\Scramble\Scramble;
 use Dedoc\Scramble\Support\Generator\OpenApi;
 use Dedoc\Scramble\Support\Generator\SecurityScheme;
@@ -30,13 +29,8 @@ use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Foundation\Application;
-use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
-use Illuminate\Support\Facades\Storage;
-use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
-use Illuminate\Support\Str;
-use Symfony\Component\HttpFoundation\StreamedResponse;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -104,27 +98,6 @@ class AppServiceProvider extends ServiceProvider
         $this->app->bind(IpLookupServiceContract::class, NoIpLookupService::class);
         $this->app->bind(BillingContract::class);
 
-        // Storage
-        // The local driver ignores the ResponseContentDisposition option of temporaryUrl,
-        // so mirror it through the signed query parameters of the storage route.
-        $privateDisk = config('filesystems.private');
-        if (config('filesystems.disks.'.$privateDisk.'.driver') === 'local') {
-            $disk = Storage::disk($privateDisk);
-            $disk->serveUsing(function (Request $request, string $path, array $headers) use ($disk): StreamedResponse {
-                return $disk->response($path, null, $headers, $request->query('disposition', 'inline'));
-            });
-            $disk->buildTemporaryUrlsUsing(function (string $path, DateTimeInterface $expiration, array $options) use ($privateDisk): string {
-                $parameters = array_filter([
-                    'path' => $path,
-                    'disposition' => isset($options['ResponseContentDisposition'])
-                        ? Str::before($options['ResponseContentDisposition'], ';')
-                        : null,
-                ]);
-
-                return url(URL::temporarySignedRoute('storage.'.$privateDisk, $expiration, $parameters, absolute: false));
-            });
-        }
-
         // Routing
         Route::model('member', Member::class);
         Route::model('invitation', OrganizationInvitation::class);

app/Providers/AuthServiceProvider.php

@@ -4,14 +4,11 @@ declare(strict_types=1);
 
 namespace App\Providers;
 
-use App\Auth\ActiveUserProvider;
 use App\Models\Passport\AuthCode;
 use App\Models\Passport\Client;
 use App\Models\Passport\RefreshToken;
 use App\Models\Passport\Token;
-use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
-use Illuminate\Support\Facades\Auth;
 use Laravel\Passport\Passport;
 
 class AuthServiceProvider extends ServiceProvider
@@ -29,13 +26,6 @@ class AuthServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        // Replaces the built-in eloquent user provider, so that no authentication flow can
-        // resolve a placeholder user. The driver name is kept, because Passport recognizes
-        // only providers that are configured with the driver "eloquent".
-        Auth::provider('eloquent', function (Application $app, array $config): ActiveUserProvider {
-            return new ActiveUserProvider($app->make('hash'), $config['model']);
-        });
-
         // define scopes for passport tokens
         Passport::tokensCan([
             'create' => 'Create resources',

app/Providers/FortifyServiceProvider.php

@@ -45,7 +45,6 @@ class FortifyServiceProvider extends ServiceProvider
 
         Fortify::registerView(function () {
             return Inertia::render('Auth/Register', [
-                'email' => session('registration_email', ''),
                 'terms_url' => config('auth.terms_url'),
                 'privacy_policy_url' => config('auth.privacy_policy_url'),
                 'newsletter_consent' => config('auth.newsletter_consent'),

app/Providers/RouteServiceProvider.php

@@ -33,8 +33,8 @@ class RouteServiceProvider extends ServiceProvider
             }
 
             return $request->user()
-                ? Limit::perMinute(config('app.api_rate_limit_authenticated_per_minute'))->by($request->user()->id)
+                ? Limit::perMinute(200)->by($request->user()->id)
-                : Limit::perMinute(config('app.api_rate_limit_guest_per_minute'))->by($request->ip());
+                : Limit::perMinute(60)->by($request->ip());
         });
 
         $this->routes(function (): void {

app/Service/Import/ImportService.php

@@ -9,8 +9,11 @@ use App\Service\Import\Importers\ImporterContract;
 use App\Service\Import\Importers\ImporterProvider;
 use App\Service\Import\Importers\ImportException;
 use App\Service\Import\Importers\ReportDto;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
 
 class ImportService
 {
@@ -22,6 +25,8 @@ class ImportService
         /** @var ImporterContract $importer */
         $importer = app(ImporterProvider::class)->getImporter($importerType);
         $importer->init($organization);
+        Storage::disk(config('filesystems.default'))
+            ->put('import/'.Carbon::now()->toDateString().'-'.$organization->getKey().'-'.Str::uuid(), $data);
 
         $lock = Cache::lock('import:'.$organization->getKey(), config('octane.max_execution_time', 60) + 1);
 

app/Service/Import/Importers/SolidtimeImporter.php

@@ -16,6 +16,7 @@ use Illuminate\Support\Str;
 use League\Csv\Reader;
 use Override;
 use Spatie\TemporaryDirectory\TemporaryDirectory;
+use ZipArchive;
 
 class SolidtimeImporter extends DefaultImporter
 {
@@ -33,10 +34,16 @@ class SolidtimeImporter extends DefaultImporter
         $temporaryDirectoryZip = null;
         $temporaryDirectory = null;
         try {
+            $zip = new ZipArchive;
             $temporaryDirectoryZip = TemporaryDirectory::make();
             file_put_contents($temporaryDirectoryZip->path('import.zip'), $data);
+            $res = $zip->open($temporaryDirectoryZip->path('import.zip'), ZipArchive::RDONLY);
+            if ($res !== true) {
+                throw new ImportException('Invalid ZIP, error code: '.$res);
+            }
             $temporaryDirectory = TemporaryDirectory::make();
-            app(ZipImportHelper::class)->extract($temporaryDirectoryZip->path('import.zip'), $temporaryDirectory->path());
+            $zip->extractTo($temporaryDirectory->path());
+            $zip->close();
 
             if (! file_exists($temporaryDirectory->path('meta.json'))) {
                 throw new ImportException('File "meta.json" missing in ZIP');

app/Service/Import/Importers/TogglDataImporter.php

@@ -13,6 +13,7 @@ use Illuminate\Support\Str;
 use Override;
 use Spatie\TemporaryDirectory\TemporaryDirectory;
 use ValueError;
+use ZipArchive;
 
 class TogglDataImporter extends DefaultImporter
 {
@@ -25,10 +26,16 @@ class TogglDataImporter extends DefaultImporter
         $temporaryDirectoryZip = null;
         $temporaryDirectory = null;
         try {
+            $zip = new ZipArchive;
             $temporaryDirectoryZip = TemporaryDirectory::make();
             file_put_contents($temporaryDirectoryZip->path('import.zip'), $data);
+            $res = $zip->open($temporaryDirectoryZip->path('import.zip'), ZipArchive::RDONLY);
+            if ($res !== true) {
+                throw new ImportException('Invalid ZIP, error code: '.$res);
+            }
             $temporaryDirectory = TemporaryDirectory::make();
-            app(ZipImportHelper::class)->extract($temporaryDirectoryZip->path('import.zip'), $temporaryDirectory->path());
+            $zip->extractTo($temporaryDirectory->path());
+            $zip->close();
             if (! file_exists($temporaryDirectory->path('clients.json'))) {
                 throw new ImportException('File "clients.json" missing in ZIP');
             }

app/Service/Import/Importers/ZipImportHelper.php

@@ -1,129 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Service\Import\Importers;
-
-use ZipArchive;
-
-/**
- * Extracts uploaded ZIP archives with limits on file count, total uncompressed
- * size and entry paths, so a small malicious archive can not fill the disk
- * (decompression bomb) or write outside the target directory (zip slip).
- */
-class ZipImportHelper
-{
-    private const int CHUNK_SIZE = 1024 * 1024;
-
-    /**
-     * @throws ImportException
-     */
-    public function extract(string $zipPath, string $targetPath): void
-    {
-        $zip = new ZipArchive;
-        $res = $zip->open($zipPath, ZipArchive::RDONLY);
-        if ($res !== true) {
-            throw new ImportException('Invalid ZIP, error code: '.$res);
-        }
-
-        try {
-            $maxFiles = (int) config('import.zip_max_files');
-            $maxUncompressedSize = (int) config('import.zip_max_uncompressed_size');
-
-            if ($zip->numFiles > $maxFiles) {
-                throw new ImportException('ZIP contains too many files, maximum is '.$maxFiles);
-            }
-
-            // Check the sizes declared in the archive before writing anything to disk
-            $declaredSize = 0;
-            for ($index = 0; $index < $zip->numFiles; $index++) {
-                $stat = $zip->statIndex($index);
-                if ($stat === false) {
-                    throw new ImportException('Invalid ZIP entry');
-                }
-                $this->validateEntryName($stat['name']);
-                $declaredSize += $stat['size'];
-                if ($declaredSize > $maxUncompressedSize) {
-                    throw new ImportException('ZIP uncompressed size exceeds the maximum of '.$maxUncompressedSize.' bytes');
-                }
-            }
-
-            // The declared sizes can be forged, so the written bytes are counted as well
-            $writtenSize = 0;
-            for ($index = 0; $index < $zip->numFiles; $index++) {
-                $stat = $zip->statIndex($index);
-                if ($stat === false) {
-                    throw new ImportException('Invalid ZIP entry');
-                }
-                $name = $stat['name'];
-                $entryPath = $targetPath.DIRECTORY_SEPARATOR.$name;
-
-                if (str_ends_with($name, '/')) {
-                    $this->ensureDirectoryExists($entryPath);
-
-                    continue;
-                }
-                $this->ensureDirectoryExists(dirname($entryPath));
-
-                $stream = $zip->getStreamIndex($index);
-                if ($stream === false) {
-                    throw new ImportException('ZIP entry "'.$name.'" can not be read');
-                }
-                $target = fopen($entryPath, 'wb');
-                if ($target === false) {
-                    fclose($stream);
-                    throw new ImportException('ZIP entry "'.$name.'" can not be extracted');
-                }
-                try {
-                    while (! feof($stream)) {
-                        $chunk = fread($stream, self::CHUNK_SIZE);
-                        if ($chunk === false) {
-                            throw new ImportException('ZIP entry "'.$name.'" can not be read');
-                        }
-                        $writtenSize += strlen($chunk);
-                        if ($writtenSize > $maxUncompressedSize) {
-                            throw new ImportException('ZIP uncompressed size exceeds the maximum of '.$maxUncompressedSize.' bytes');
-                        }
-                        fwrite($target, $chunk);
-                    }
-                } finally {
-                    fclose($target);
-                    fclose($stream);
-                }
-            }
-        } finally {
-            $zip->close();
-        }
-    }
-
-    /**
-     * @throws ImportException
-     */
-    private function validateEntryName(string $name): void
-    {
-        if ($name === '' || str_contains($name, "\0") || str_contains($name, '\\') || str_starts_with($name, '/')) {
-            throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
-        }
-        if (preg_match('/^[a-zA-Z]:/', $name) === 1) {
-            throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
-        }
-        foreach (explode('/', rtrim($name, '/')) as $segment) {
-            if ($segment === '' || $segment === '..') {
-                throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
-            }
-        }
-    }
-
-    /**
-     * @throws ImportException
-     */
-    private function ensureDirectoryExists(string $path): void
-    {
-        if (is_dir($path)) {
-            return;
-        }
-        if (! mkdir($path, 0700, true) && ! is_dir($path)) {
-            throw new ImportException('Directory "'.$path.'" can not be created');
-        }
-    }
-}

app/Service/InvitationService.php

@@ -18,22 +18,6 @@ use Illuminate\Support\Facades\Mail;
 
 class InvitationService
 {
-    public function hasAcceptedInvitationForEmail(string $email): bool
-    {
-        return OrganizationInvitation::query()
-            ->whereRaw('lower(email) = ?', [strtolower($email)])
-            ->whereNotNull('accepted_at')
-            ->exists();
-    }
-
-    public function hasPendingInvitationForEmail(string $email): bool
-    {
-        return OrganizationInvitation::query()
-            ->whereRaw('lower(email) = ?', [strtolower($email)])
-            ->whereNull('accepted_at')
-            ->exists();
-    }
-
     /**
      * @throws UserIsAlreadyMemberOfOrganizationApiException|InvitationForTheEmailAlreadyExistsApiException
      */

app/Service/LocalizationService.php

@@ -8,14 +8,12 @@ use App\Enums\CurrencyFormat;
 use App\Enums\DateFormat;
 use App\Enums\IntervalFormat;
 use App\Enums\NumberFormat;
-use App\Enums\TimeEntryAggregationType;
 use App\Enums\TimeFormat;
 use App\Models\Organization;
 use Brick\Math\BigDecimal;
 use Brick\Money\Money;
 use Carbon\CarbonInterface;
 use Carbon\CarbonInterval;
-use Illuminate\Support\Carbon;
 
 class LocalizationService
 {
@@ -154,38 +152,6 @@ class LocalizationService
         return $date->format($this->dateFormat->toCarbonFormat());
     }
 
-    /**
-     * Time group types have no server-side descriptor; their keys are ISO dates and are
-     * formatted here instead. A Week key is the first day of that week, so it renders as the
-     * range it covers. A Year key is already a bare year, so it is returned unchanged - it must
-     * not be parsed, Carbon reads a four digit string as a time of day.
-     */
-    public function formatTimeGroupKey(?string $key, TimeEntryAggregationType $groupType): ?string
-    {
-        if ($key === null) {
-            return null;
-        }
-
-        if ($groupType === TimeEntryAggregationType::Day) {
-            return $this->formatDate(Carbon::parse($key));
-        }
-
-        if ($groupType === TimeEntryAggregationType::Week) {
-            $weekStart = Carbon::parse($key);
-
-            return $this->formatDate($weekStart).' - '.$this->formatDate($weekStart->copy()->addDays(6));
-        }
-
-        if ($groupType === TimeEntryAggregationType::Month) {
-            // Note: the leading "!" resets all fields the format does not name. Without it the
-            // day of the month is taken from today, and a day that the parsed month does not
-            // have overflows the date into the next month.
-            return Carbon::createFromFormat('!Y-m', $key)->format('F Y');
-        }
-
-        return $key;
-    }
-
     public function setDateFormat(DateFormat $dateFormat): void
     {
         $this->dateFormat = $dateFormat;

app/Service/MemberService.php

@@ -218,16 +218,7 @@ class MemberService
 
         $placeholderUser = $user->replicate();
         $placeholderUser->is_placeholder = true;
-        // Reset authentication relevant properties on the placeholder user
+        $placeholderUser->current_team_id = $member->organization_id;
-        $placeholderUser->password = null;
-        $placeholderUser->remember_token = null;
-        $placeholderUser->two_factor_secret = null;
-        $placeholderUser->two_factor_recovery_codes = null;
-        $placeholderUser->two_factor_confirmed_at = null;
-        $placeholderUser->email_verified_at = null;
-        $placeholderUser->pending_email = null;
-        $placeholderUser->current_team_id = null;
-        $placeholderUser->profile_photo_path = null;
         $placeholderUser->save();
 
         $member->user()->associate($placeholderUser);

app/Service/PermissionStore.php

@@ -80,10 +80,6 @@ class PermissionStore
                 'invoices:update',
                 'invoices:download',
                 'invoices:delete',
-                'invoice-recipients:view',
-                'invoice-recipients:create',
-                'invoice-recipients:update',
-                'invoice-recipients:delete',
                 'invoice-settings:view',
                 'invoice-settings:update',
             ],
@@ -151,10 +147,6 @@ class PermissionStore
                 'invoices:update',
                 'invoices:download',
                 'invoices:delete',
-                'invoice-recipients:view',
-                'invoice-recipients:create',
-                'invoice-recipients:update',
-                'invoice-recipients:delete',
                 'invoice-settings:view',
                 'invoice-settings:update',
             ],
@@ -211,10 +203,6 @@ class PermissionStore
                 'invoices:update',
                 'invoices:download',
                 'invoices:delete',
-                'invoice-recipients:view',
-                'invoice-recipients:create',
-                'invoice-recipients:update',
-                'invoice-recipients:delete',
                 'invoice-settings:view',
                 'invoice-settings:update',
             ],

app/Service/ReportExport/TimeEntriesReportExport.php

@@ -6,7 +6,6 @@ namespace App\Service\ReportExport;
 
 use App\Enums\ExportFormat;
 use App\Enums\TimeEntryAggregationType;
-use App\Service\LocalizationService;
 use Illuminate\View\View;
 use Maatwebsite\Excel\Concerns\Exportable;
 use Maatwebsite\Excel\Concerns\FromView;
@@ -49,8 +48,6 @@ class TimeEntriesReportExport implements FromView, ShouldAutoSize, WithCustomCsv
 
     private bool $showBillableRate;
 
-    private LocalizationService $localization;
-
     /**
      * @param array{
      *         grouped_type: string|null,
@@ -71,7 +68,7 @@ class TimeEntriesReportExport implements FromView, ShouldAutoSize, WithCustomCsv
      *         cost: int|null
      *   } $data
      */
-    public function __construct(array $data, ExportFormat $exportFormat, string $currency, TimeEntryAggregationType $group, TimeEntryAggregationType $subGroup, bool $showBillableRate, LocalizationService $localization)
+    public function __construct(array $data, ExportFormat $exportFormat, string $currency, TimeEntryAggregationType $group, TimeEntryAggregationType $subGroup, bool $showBillableRate)
     {
         $this->data = $data;
         $this->exportFormat = $exportFormat;
@@ -79,7 +76,6 @@ class TimeEntriesReportExport implements FromView, ShouldAutoSize, WithCustomCsv
         $this->group = $group;
         $this->subGroup = $subGroup;
         $this->showBillableRate = $showBillableRate;
-        $this->localization = $localization;
     }
 
     public function view(): View
@@ -91,7 +87,6 @@ class TimeEntriesReportExport implements FromView, ShouldAutoSize, WithCustomCsv
             'subGroup' => $this->subGroup,
             'exportFormat' => $this->exportFormat,
             'showBillableRate' => $this->showBillableRate,
-            'localization' => $this->localization,
         ]);
     }
 

config/app.php

@@ -100,7 +100,7 @@ return [
 
     'force_https' => (bool) env('APP_FORCE_HTTPS', false),
 
-    'enable_registration' => env('APP_ENABLE_REGISTRATION', 'off'),
+    'enable_registration' => (bool) env('APP_ENABLE_REGISTRATION', false),
 
     'local_email_verification' => (bool) env('APP_LOCAL_EMAIL_VERIFICATION', false),
 
@@ -158,21 +158,6 @@ return [
 
     'pagination_per_page_default' => (int) env('PAGINATION_PER_PAGE_DEFAULT', 15),
 
-    /*
-    |--------------------------------------------------------------------------
-    | API Rate Limiting
-    |--------------------------------------------------------------------------
-    |
-    | The number of API requests allowed per minute, counted per user for
-    | authenticated requests and per IP address for guest requests. These
-    | limits are only enforced when the application runs in production.
-    |
-    */
-
-    'api_rate_limit_authenticated_per_minute' => (int) (env('API_RATE_LIMIT_AUTH_PER_MINUTE') ?: 200),
-
-    'api_rate_limit_guest_per_minute' => (int) (env('API_RATE_LIMIT_GUEST_PER_MINUTE') ?: 60),
-
     /*
     |--------------------------------------------------------------------------
     | Encryption Key

config/import.php

@@ -1,34 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-return [
-
-    /*
-    |--------------------------------------------------------------------------
-    | Import payload limit
-    |--------------------------------------------------------------------------
-    |
-    | Maximum length of the base64 encoded "data" field of an import request in
-    | bytes. Requests with a larger payload are rejected with a validation error.
-    |
-    */
-
-    'max_data_size' => (int) (env('IMPORT_MAX_DATA_SIZE') ?: 50 * 1024 * 1024),
-
-    /*
-    |--------------------------------------------------------------------------
-    | ZIP extraction limits
-    |--------------------------------------------------------------------------
-    |
-    | Limits applied to ZIP based importers before and during extraction to
-    | protect the instance against decompression bombs. The uncompressed size
-    | is the sum of all files in the archive in bytes.
-    |
-    */
-
-    'zip_max_files' => (int) (env('IMPORT_ZIP_MAX_FILES') ?: 100),
-
-    'zip_max_uncompressed_size' => (int) (env('IMPORT_ZIP_MAX_UNCOMPRESSED_SIZE') ?: 500 * 1024 * 1024),
-
-];

database/migrations/2026_08_24_000001_add_application_query_indexes.php

@@ -1,230 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-
-use function Laravel\Prompts\info as consoleInfo;
-
-return new class extends Migration
-{
-    /**
-     * PostgreSQL cannot build or drop an index concurrently inside a transaction.
-     * Keeping this migration non-transactional prevents long write locks in production.
-     *
-     * @var bool
-     */
-    public $withinTransaction = false;
-
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        // Tenant-scoped client pagination ordered by newest first; also covers the organization FK.
-        $this->runIndexOperation('create', 'clients_organization_created_id_index', 'CREATE INDEX CONCURRENTLY clients_organization_created_id_index ON clients (organization_id, created_at DESC, id)');
-
-        // Tenant-scoped project pagination ordered by newest first; also covers the organization FK.
-        $this->runIndexOperation('create', 'projects_organization_created_id_index', 'CREATE INDEX CONCURRENTLY projects_organization_created_id_index ON projects (organization_id, created_at DESC, id)');
-        // Speeds client relationship loads and the FK check when a client is deleted or its ID changes.
-        $this->runIndexOperation('create', 'projects_client_id_index', 'CREATE INDEX CONCURRENTLY projects_client_id_index ON projects (client_id)');
-
-        // Tenant-scoped task pagination ordered by newest first; also covers the organization FK.
-        $this->runIndexOperation('create', 'tasks_organization_created_id_index', 'CREATE INDEX CONCURRENTLY tasks_organization_created_id_index ON tasks (organization_id, created_at DESC, id)');
-        // Speeds project task lists and the FK check when a project is deleted or its ID changes.
-        $this->runIndexOperation('create', 'tasks_project_id_index', 'CREATE INDEX CONCURRENTLY tasks_project_id_index ON tasks (project_id)');
-
-        // Tenant-scoped tag pagination ordered by newest first; also covers the organization FK.
-        $this->runIndexOperation('create', 'tags_organization_created_id_index', 'CREATE INDEX CONCURRENTLY tags_organization_created_id_index ON tags (organization_id, created_at DESC, id)');
-
-        // Tenant-scoped report pagination ordered by newest first; also covers the organization FK.
-        $this->runIndexOperation('create', 'reports_organization_created_id_index', 'CREATE INDEX CONCURRENTLY reports_organization_created_id_index ON reports (organization_id, created_at DESC, id)');
-
-        // Tenant-scoped member pagination; the existing (organization_id, user_id) unique index remains for membership lookup.
-        $this->runIndexOperation('create', 'members_organization_created_id_index', 'CREATE INDEX CONCURRENTLY members_organization_created_id_index ON members (organization_id, created_at DESC, id)');
-        // Supports reverse user-to-membership lookups and the FK check when a user is deleted or its ID changes.
-        $this->runIndexOperation('create', 'members_user_id_index', 'CREATE INDEX CONCURRENTLY members_user_id_index ON members (user_id)');
-
-        // The existing (project_id, user_id) unique index covers project_id, but member_id and legacy user_id need reverse indexes.
-        $this->runIndexOperation('create', 'project_members_member_id_index', 'CREATE INDEX CONCURRENTLY project_members_member_id_index ON project_members (member_id)');
-        $this->runIndexOperation('create', 'project_members_user_id_index', 'CREATE INDEX CONCURRENTLY project_members_user_id_index ON project_members (user_id)');
-
-        // Supports organization deletion/current-team cleanup and the FK check on users.current_team_id.
-        $this->runIndexOperation('create', 'users_current_team_id_index', 'CREATE INDEX CONCURRENTLY users_current_team_id_index ON users (current_team_id)');
-
-        // Filament loads the newest audits first; this avoids scanning and sorting the large append-only audit table.
-        $this->runIndexOperation('create', 'audits_created_at_index', 'CREATE INDEX CONCURRENTLY audits_created_at_index ON audits (created_at DESC)');
-
-        // Main tenant time-entry range/pagination path, including its start DESC, id ordering; also covers the organization FK.
-        $this->runIndexOperation('create', 'time_entries_organization_start_id_index', 'CREATE INDEX CONCURRENTLY time_entries_organization_start_id_index ON time_entries (organization_id, start DESC, id)');
-        // Filament lists time entries globally by creation time, so the tenant-prefixed index cannot provide this ordering.
-        $this->runIndexOperation('create', 'time_entries_created_at_index', 'CREATE INDEX CONCURRENTLY time_entries_created_at_index ON time_entries (created_at DESC)');
-        // Dashboard history is consistently filtered by user and organization, then bounded by start; user first also covers its FK.
-        $this->runIndexOperation('create', 'time_entries_user_organization_start_index', 'CREATE INDEX CONCURRENTLY time_entries_user_organization_start_index ON time_entries (user_id, organization_id, start)');
-        // Member timelines, overlap checks, and billable-rate updates start with member_id; also covers its FK.
-        $this->runIndexOperation('create', 'time_entries_member_start_index', 'CREATE INDEX CONCURRENTLY time_entries_member_start_index ON time_entries (member_id, start)');
-        // These relationship/filter indexes also prevent full scans for FK checks when parent rows change or are deleted.
-        $this->runIndexOperation('create', 'time_entries_project_id_index', 'CREATE INDEX CONCURRENTLY time_entries_project_id_index ON time_entries (project_id)');
-        $this->runIndexOperation('create', 'time_entries_task_id_index', 'CREATE INDEX CONCURRENTLY time_entries_task_id_index ON time_entries (task_id)');
-        $this->runIndexOperation('create', 'time_entries_client_id_index', 'CREATE INDEX CONCURRENTLY time_entries_client_id_index ON time_entries (client_id)');
-        // Active-timer checks touch only open entries, so a partial index stays small while serving the hot member_id lookup.
-        $this->runIndexOperation('create', 'time_entries_active_member_index', 'CREATE INDEX CONCURRENTLY time_entries_active_member_index ON time_entries (member_id) WHERE "end" IS NULL');
-        // whereJsonContains(tags, tag_id) compiles to JSONB containment, which is supported by a GIN index.
-        $this->runIndexOperation('create', 'time_entries_tags_gin_index', 'CREATE INDEX CONCURRENTLY time_entries_tags_gin_index ON time_entries USING GIN (tags)');
-
-        // Passport already indexes user_id; these indexes cover the other FK used during OAuth client deletion/update.
-        $this->runIndexOperation('create', 'oauth_access_tokens_client_id_index', 'CREATE INDEX CONCURRENTLY oauth_access_tokens_client_id_index ON oauth_access_tokens (client_id)');
-        $this->runIndexOperation('create', 'oauth_auth_codes_client_id_index', 'CREATE INDEX CONCURRENTLY oauth_auth_codes_client_id_index ON oauth_auth_codes (client_id)');
-
-        // owner_id is already the leading column of oauth_clients_owner_id_owner_type_index.
-        $this->runIndexOperation('drop', 'oauth_clients_user_id_index', 'DROP INDEX CONCURRENTLY oauth_clients_user_id_index');
-        // Public report lookup starts with the unique share_secret index; no query filters only by this boolean.
-        $this->runIndexOperation('drop', 'reports_is_public_index', 'DROP INDEX CONCURRENTLY reports_is_public_index');
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        $indexes = [
-            'clients_organization_created_id_index',
-            'projects_organization_created_id_index',
-            'projects_client_id_index',
-            'tasks_organization_created_id_index',
-            'tasks_project_id_index',
-            'tags_organization_created_id_index',
-            'reports_organization_created_id_index',
-            'members_organization_created_id_index',
-            'members_user_id_index',
-            'project_members_member_id_index',
-            'project_members_user_id_index',
-            'users_current_team_id_index',
-            'audits_created_at_index',
-            'time_entries_organization_start_id_index',
-            'time_entries_created_at_index',
-            'time_entries_user_organization_start_index',
-            'time_entries_member_start_index',
-            'time_entries_project_id_index',
-            'time_entries_task_id_index',
-            'time_entries_client_id_index',
-            'time_entries_active_member_index',
-            'time_entries_tags_gin_index',
-            'oauth_access_tokens_client_id_index',
-            'oauth_auth_codes_client_id_index',
-        ];
-
-        $concurrently = DB::transactionLevel() === 0 ? ' CONCURRENTLY' : '';
-        foreach ($indexes as $index) {
-            $this->runIndexOperation('drop', $index, 'DROP INDEX'.$concurrently.' IF EXISTS '.$index);
-        }
-
-        $this->runIndexOperation('create', 'oauth_clients_user_id_index', 'CREATE INDEX'.$concurrently.' oauth_clients_user_id_index ON oauth_clients (owner_id)');
-        $this->runIndexOperation('create', 'reports_is_public_index', 'CREATE INDEX'.$concurrently.' reports_is_public_index ON reports (is_public)');
-    }
-
-    private function runIndexOperation(string $operation, string $index, string $statement): void
-    {
-        $indexState = $this->indexState($index);
-
-        if ($operation === 'create' && $indexState === ['valid' => true, 'ready' => true]) {
-            $this->writeProgress(sprintf('Skipping index [%s] because it already exists and is valid', $index));
-
-            return;
-        }
-
-        if ($operation === 'drop' && $indexState === null) {
-            $this->writeProgress(sprintf('Skipping index [%s] because it does not exist', $index));
-
-            return;
-        }
-
-        if ($operation === 'create' && $indexState !== null) {
-            $this->writeProgress(sprintf(
-                'Index [%s] exists but is incomplete (valid=%s, ready=%s); dropping it before rebuilding',
-                $index,
-                $indexState['valid'] ? 'true' : 'false',
-                $indexState['ready'] ? 'true' : 'false',
-            ));
-            $this->executeIndexStatement(
-                'drop incomplete',
-                $index,
-                (DB::transactionLevel() === 0 ? 'DROP INDEX CONCURRENTLY ' : 'DROP INDEX ').$this->quoteIdentifier($index),
-            );
-        }
-
-        $this->executeIndexStatement($operation, $index, $statement);
-    }
-
-    private function executeIndexStatement(string $operation, string $index, string $statement): void
-    {
-        $startedAt = microtime(true);
-        $this->writeProgress(sprintf('Starting to %s index [%s]', $operation, $index));
-
-        try {
-            DB::statement($statement);
-        } catch (Throwable $exception) {
-            $this->writeProgress(sprintf(
-                'Failed to %s index [%s] after %.2f seconds: %s',
-                $operation,
-                $index,
-                microtime(true) - $startedAt,
-                $exception->getMessage(),
-            ));
-
-            throw $exception;
-        }
-
-        $this->writeProgress(sprintf(
-            'Finished %s index [%s] in %.2f seconds',
-            $operation === 'create' ? 'creating' : 'dropping',
-            $index,
-            microtime(true) - $startedAt,
-        ));
-    }
-
-    /**
-     * @return array{valid: bool, ready: bool}|null
-     */
-    private function indexState(string $index): ?array
-    {
-        $state = DB::selectOne(
-            <<<'SQL'
-                SELECT pg_index.indisvalid::int AS valid, pg_index.indisready::int AS ready
-                FROM pg_index
-                JOIN pg_class ON pg_class.oid = pg_index.indexrelid
-                JOIN pg_namespace ON pg_namespace.oid = pg_class.relnamespace
-                WHERE pg_namespace.nspname = current_schema()
-                  AND pg_class.relname = ?
-                SQL,
-            [$index],
-        );
-
-        if ($state === null) {
-            return null;
-        }
-
-        return [
-            'valid' => (bool) $state->valid,
-            'ready' => (bool) $state->ready,
-        ];
-    }
-
-    private function quoteIdentifier(string $identifier): string
-    {
-        return DB::connection()->getQueryGrammar()->wrap($identifier);
-    }
-
-    private function writeProgress(string $message): void
-    {
-        if (app()->runningUnitTests()) {
-            return;
-        }
-
-        $message = sprintf('[%s] %s', date(DATE_ATOM), $message);
-        Log::info($message);
-        consoleInfo($message);
-    }
-};

database/migrations/2026_08_31_000001_add_send_time_entry_still_running_email_to_users_table.php

@@ -1,24 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    public function up(): void
-    {
-        Schema::table('users', function (Blueprint $table): void {
-            $table->boolean('send_time_entry_still_running_email')->default(true)->after('week_start');
-        });
-    }
-
-    public function down(): void
-    {
-        Schema::table('users', function (Blueprint $table): void {
-            $table->dropColumn('send_time_entry_still_running_email');
-        });
-    }
-};

database/migrations/2026_09_16_000001_remove_credentials_from_placeholder_users.php

@@ -1,53 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Query\Builder;
-use Illuminate\Support\Facades\DB;
-
-return new class extends Migration
-{
-    /**
-     * Placeholder users used to be created as a full copy of the user they were made from,
-     * which included the credentials and the account state of that user. A placeholder is a
-     * stand-in for a person in one organization, not an account, and the row shares the email
-     * address with the real account, so these values are removed from the placeholders that
-     * already exist. The organization a placeholder belongs to is recorded on its member row.
-     */
-    public function up(): void
-    {
-        DB::table('users')
-            ->where('is_placeholder', '=', true)
-            ->where(function (Builder $builder): void {
-                $builder->whereNotNull('password')
-                    ->orWhereNotNull('remember_token')
-                    ->orWhereNotNull('two_factor_secret')
-                    ->orWhereNotNull('two_factor_recovery_codes')
-                    ->orWhereNotNull('two_factor_confirmed_at')
-                    ->orWhereNotNull('email_verified_at')
-                    ->orWhereNotNull('pending_email')
-                    ->orWhereNotNull('current_team_id')
-                    ->orWhereNotNull('profile_photo_path');
-            })
-            ->update([
-                'password' => null,
-                'remember_token' => null,
-                'two_factor_secret' => null,
-                'two_factor_recovery_codes' => null,
-                'two_factor_confirmed_at' => null,
-                'email_verified_at' => null,
-                'pending_email' => null,
-                'current_team_id' => null,
-                'profile_photo_path' => null,
-            ]);
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        //
-    }
-};

e2e/calendar.spec.ts

@@ -252,19 +252,19 @@ test('test that calendar page loads and displays time entries', async ({ page, c
 test('test that calendar navigation buttons work', async ({ page }) => {
     await goToCalendar(page);
     await expect(page.locator('.fc')).toBeVisible();
-    await expect(page.getByTestId('calendar-title')).toContainText('This Week');
 
-    // Navigate between named periods.
+    // Click the "next" button to navigate forward
+    await page.getByRole('button', { name: 'Next' }).click();
+    await expect(page.locator('.fc')).toBeVisible();
+
+    // Click the "prev" button to navigate back
     await page.getByRole('button', { name: 'Previous' }).click();
-    await expect(page.getByTestId('calendar-title')).toContainText('Last Week');
+    await expect(page.locator('.fc')).toBeVisible();
-    await page.getByRole('button', { name: 'Next' }).click();
-    await expect(page.getByTestId('calendar-title')).toContainText('This Week');
 
-    // Navigate forward first, then use the range button to return to today.
+    // Navigate forward first, then click today
     await page.getByRole('button', { name: 'Next' }).click();
-    await expect(page.getByTestId('calendar-title')).toContainText('Next Week');
     await page.getByRole('button', { name: 'today' }).click();
-    await expect(page.getByTestId('calendar-title')).toContainText('This Week');
+    await expect(page.locator('.fc')).toBeVisible();
 });
 
 test('test that editing time entry description via calendar modal works', async ({ page, ctx }) => {

e2e/clients.spec.ts

@@ -8,7 +8,7 @@ import {
     createProjectViaApi,
     createPublicProjectViaApi,
 } from './utils/api';
-import { clearTableState, getTableRowNames } from './utils/table';
+import { getTableRowNames } from './utils/table';
 
 async function goToClientsOverview(page: Page) {
     await page.goto(PLAYWRIGHT_BASE_URL + '/clients');
@@ -210,12 +210,18 @@ test('test that client context menu delete deletes the client', async ({ page, c
 // Sorting Tests
 // =============================================
 
+async function clearClientTableState(page: Page) {
+    await page.evaluate(() => {
+        localStorage.removeItem('client-table-state');
+    });
+}
+
 test('test that sorting clients by name and status works', async ({ page, ctx }) => {
     await createClientViaApi(ctx, { name: 'AAA SortClient' });
     await createClientViaApi(ctx, { name: 'ZZZ SortClient' });
 
     await goToClientsOverview(page);
-    await clearTableState(page, 'client-table-state');
+    await clearClientTableState(page);
     await page.reload();
 
     const table = page.getByTestId('client_table');
@@ -247,7 +253,7 @@ test('test that sorting clients by project count works', async ({ page, ctx }) =
     await createProjectViaApi(ctx, { name: 'Proj2', client_id: clientWithMany.id });
 
     await goToClientsOverview(page);
-    await clearTableState(page, 'client-table-state');
+    await clearClientTableState(page);
     await page.reload();
 
     const table = page.getByTestId('client_table');
@@ -268,7 +274,7 @@ test('test that sorting clients by project count works', async ({ page, ctx }) =
 
 test('test that client sort state persists after page reload', async ({ page }) => {
     await goToClientsOverview(page);
-    await clearTableState(page, 'client-table-state');
+    await clearClientTableState(page);
     await page.reload();
 
     const table = page.getByTestId('client_table');
@@ -391,7 +397,7 @@ test.describe('Clients Pagination', () => {
         );
 
         await goToClientsOverview(page);
-        await clearTableState(page, 'client-table-state');
+        await clearClientTableState(page);
         await page.reload();
 
         // Default sort is name asc; first 15 clients (00–14) on page 1.
@@ -444,7 +450,7 @@ test.describe('Clients Pagination', () => {
         );
 
         await goToClientsOverview(page);
-        await clearTableState(page, 'client-table-state');
+        await clearClientTableState(page);
         await page.reload();
 
         await expect(page.getByTestId('client_table')).toBeVisible();
@@ -464,7 +470,7 @@ test.describe('Clients Pagination', () => {
         );
 
         await goToClientsOverview(page);
-        await clearTableState(page, 'client-table-state');
+        await clearClientTableState(page);
         await page.reload();
 
         await expect(page.getByText(prefix + '00')).toBeVisible({ timeout: 10000 });

e2e/invitation-registration-prefill.spec.ts

@@ -1,32 +0,0 @@
-import { expect, test } from '../playwright/fixtures';
-import { PLAYWRIGHT_BASE_URL } from '../playwright/config';
-import { getInvitationAcceptUrl } from './utils/mailpit';
-
-test('prefills the registration email after accepting an invitation', async ({ page, browser }) => {
-    const memberId = `${Date.now()}-${Math.floor(Math.random() * 100000)}`;
-    const memberEmail = `prefill-${memberId}@invitation.test`;
-
-    await page.goto(PLAYWRIGHT_BASE_URL + '/members');
-    await page.getByRole('button', { name: 'Invite Member' }).click();
-    await page.getByPlaceholder('Member Email').fill(memberEmail);
-    await page.getByRole('button', { name: 'Employee' }).click();
-    await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/invitations') &&
-                response.request().method() === 'POST' &&
-                response.status() === 204
-        ),
-        page.getByRole('button', { name: 'Invite Member', exact: true }).click(),
-    ]);
-
-    const inviteeContext = await browser.newContext();
-    const inviteePage = await inviteeContext.newPage();
-    const acceptUrl = await getInvitationAcceptUrl(inviteePage.request, memberEmail);
-    await inviteePage.goto(acceptUrl);
-    await inviteePage.waitForURL(/\/register$/);
-
-    await expect(inviteePage.getByLabel('Email')).toHaveValue(memberEmail);
-
-    await inviteeContext.close();
-});

e2e/members.spec.ts

@@ -11,7 +11,7 @@ import {
     updateMemberBillableRateViaApi,
     updateOrganizationSettingViaApi,
 } from './utils/api';
-import { clearTableState, getTableRowNames } from './utils/table';
+import { getTableRowNames } from './utils/table';
 
 // Tests that invite + accept members need more time
 test.describe.configure({ timeout: 45000 });
@@ -779,18 +779,20 @@ test('test that accepted invitation disappears from invitations tab', async ({ p
 // Sorting Tests
 // =============================================
 
+// Helper to clear localStorage before tests that check sorting
+async function clearMemberTableState(page: Page) {
+    await page.evaluate(() => {
+        localStorage.removeItem('member-table-state');
+    });
+}
+
 test('test that sorting members by name, role, and status works', async ({ page, ctx }) => {
-    // Create two placeholder members with names that sort predictably around "John Doe".
+    // Create two placeholder members with names that sort predictably around "John Doe"
-    // Seeded alphabetically a second apart: created_at only has second precision and
-    // same-second rows fall back to a random UUID order. The spacing is what makes the
-    // API order (created_at desc: ZZZ, AAA, John) deterministic, so the tie-break
-    // assertions below are testing the tie-break rather than a coin flip.
     await createPlaceholderMemberViaImportApi(ctx, 'AAA SortFirst');
-    await page.waitForTimeout(1100);
     await createPlaceholderMemberViaImportApi(ctx, 'ZZZ SortLast');
 
     await goToMembersPage(page);
-    await clearTableState(page, 'member-table-state');
+    await clearMemberTableState(page);
     await page.reload();
 
     const table = page.getByTestId('member_table');
@@ -812,24 +814,20 @@ test('test that sorting members by name, role, and status works', async ({ page,
     const ownerIdx = names.indexOf('John Doe');
     const placeholderIdx = names.indexOf('AAA SortFirst');
     expect(ownerIdx).toBeLessThan(placeholderIdx);
-    expect(names.indexOf('AAA SortFirst')).toBeLessThan(names.indexOf('ZZZ SortLast'));
 
     await roleHeader.click(); // desc: Placeholder first
     names = await getTableRowNames(table);
     expect(names.indexOf('AAA SortFirst')).toBeLessThan(names.indexOf('John Doe'));
-    expect(names.indexOf('AAA SortFirst')).toBeLessThan(names.indexOf('ZZZ SortLast'));
 
     // -- Status sorting --
     const statusHeader = table.getByText('Status').first();
     await statusHeader.click(); // asc: Active(0) < Inactive(1)
     names = await getTableRowNames(table);
     expect(names.indexOf('John Doe')).toBeLessThan(names.indexOf('AAA SortFirst'));
-    expect(names.indexOf('AAA SortFirst')).toBeLessThan(names.indexOf('ZZZ SortLast'));
 
     await statusHeader.click(); // desc: Inactive first
     names = await getTableRowNames(table);
     expect(names.indexOf('AAA SortFirst')).toBeLessThan(names.indexOf('John Doe'));
-    expect(names.indexOf('AAA SortFirst')).toBeLessThan(names.indexOf('ZZZ SortLast'));
 
     // -- Email: just verify sort indicator appears --
     const emailHeader = table.getByText('Email').first();
@@ -839,7 +837,7 @@ test('test that sorting members by name, role, and status works', async ({ page,
 
 test('test that member sort state persists after page reload', async ({ page }) => {
     await goToMembersPage(page);
-    await clearTableState(page, 'member-table-state');
+    await clearMemberTableState(page);
     await page.reload();
 
     const table = page.getByTestId('member_table');
@@ -877,7 +875,7 @@ test('test that sorting members by billable rate works', async ({ page, ctx }) =
     await updateMemberBillableRateViaApi(ctx, lowRateMember!.id, 5000);
 
     await goToMembersPage(page);
-    await clearTableState(page, 'member-table-state');
+    await clearMemberTableState(page);
     await page.reload();
 
     const table = page.getByTestId('member_table');

e2e/profile.spec.ts

@@ -20,12 +20,6 @@ function profileInformationForm(page: Page) {
         .locator('xpath=ancestor::*[descendant::form][1]');
 }
 
-function notificationSettingsForm(page: Page) {
-    return page
-        .getByRole('heading', { name: 'Notifications', exact: true })
-        .locator('xpath=ancestor::*[descendant::form][1]');
-}
-
 async function saveProfileForm(page: Page): Promise<void> {
     const form = profileInformationForm(page);
     await form.getByRole('button', { name: 'Save' }).click();
@@ -56,22 +50,6 @@ test('week-start change persists across reload', async ({ page }) => {
     await expect(page.getByLabel('Start of the week')).toHaveValue('sunday');
 });
 
-test('still-running email notification setting persists across reload', async ({ page }) => {
-    await goToProfilePage(page);
-    const form = notificationSettingsForm(page);
-    const checkbox = form.getByLabel('Still-running time entry reminders');
-
-    await expect(checkbox).toBeChecked();
-    await checkbox.uncheck();
-    await form.getByRole('button', { name: 'Save' }).click();
-    await expect(form.getByText('Saved.', { exact: true })).toBeVisible();
-
-    await page.reload();
-    await expect(
-        notificationSettingsForm(page).getByLabel('Still-running time entry reminders')
-    ).not.toBeChecked();
-});
-
 test('profile photo can be uploaded, persists across reload, and can be removed', async ({
     page,
 }) => {

e2e/projects.spec.ts

@@ -13,12 +13,18 @@ import {
     archiveProjectViaApi,
     updateOrganizationSettingViaApi,
 } from './utils/api';
-import { clearTableState, getSeededRowOrder } from './utils/table';
 
 async function goToProjectsOverview(page: Page) {
     await page.goto(PLAYWRIGHT_BASE_URL + '/projects');
 }
 
+// Helper to clear localStorage before tests that check persistence
+async function clearProjectTableState(page: Page) {
+    await page.evaluate(() => {
+        localStorage.removeItem('project-table-state');
+    });
+}
+
 // Create new project via modal
 test('test that creating and deleting a new project via the modal works', async ({ page }) => {
     const newProjectName = 'New Project ' + Math.floor(1 + Math.random() * 10000);
@@ -78,7 +84,7 @@ test('test that archiving and unarchiving projects works', async ({ page, ctx })
     await createProjectViaApi(ctx, { name: newProjectName });
 
     await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
+    await clearProjectTableState(page);
     await page.reload();
     await expect(page.getByText(newProjectName)).toBeVisible({ timeout: 10000 });
 
@@ -474,7 +480,7 @@ test('test that sorting projects by all columns works', async ({ page, ctx }) =>
     });
 
     await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
+    await clearProjectTableState(page);
     await page.reload();
     await expect(page.getByTestId('project_table')).toBeVisible();
     await expect(page.getByText('AAA Project')).toBeVisible();
@@ -603,7 +609,7 @@ test('test that filtering projects by status works', async ({ page, ctx }) => {
     await createProjectViaApi(ctx, { name: newProjectName });
 
     await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
+    await clearProjectTableState(page);
     await page.reload();
     await expect(page.getByText(newProjectName)).toBeVisible({ timeout: 10000 });
 
@@ -634,7 +640,7 @@ test('test that filtering projects by status works', async ({ page, ctx }) => {
 
 test('test that filter state persists after page reload', async ({ page }) => {
     await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
+    await clearProjectTableState(page);
     await page.reload();
 
     // Apply Active status filter
@@ -650,96 +656,9 @@ test('test that filter state persists after page reload', async ({ page }) => {
     await expect(page.getByTestId('status-filter-badge')).toBeVisible();
 });
 
-test('test that projects without a client or estimate are ordered by name at the bottom', async ({
-    page,
-    ctx,
-}) => {
-    // Seeded a second apart: created_at only has second precision and same-second rows
-    // fall back to a random UUID order. The spacing makes the API order of the clientless
-    // rows (created_at desc: ZZZ, AAA) deterministic and different from the alphabetical
-    // order the name tie-break should produce.
-    await createProjectViaApi(ctx, { name: 'AAA Tiebreak Project' });
-    await page.waitForTimeout(1100);
-    await createProjectViaApi(ctx, { name: 'ZZZ Tiebreak Project' });
-
-    const clientAardvark = await createClientViaApi(ctx, { name: 'Aardvark Co' });
-    const clientZulu = await createClientViaApi(ctx, { name: 'Zulu Co' });
-    const projectM = await createProjectViaApi(ctx, {
-        name: 'MMM Tiebreak Project',
-        client_id: clientAardvark.id,
-        estimated_time: 36000, // 10h, 1h tracked below = 10%
-    });
-    await createTimeEntryViaApi(ctx, { duration: '1h', projectId: projectM.id });
-    const projectN = await createProjectViaApi(ctx, {
-        name: 'NNN Tiebreak Project',
-        client_id: clientZulu.id,
-        estimated_time: 14400, // 4h, 2h tracked below = 50%
-    });
-    await createTimeEntryViaApi(ctx, { duration: '2h', projectId: projectN.id });
-
-    await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
-    await page.reload();
-
-    const table = page.getByTestId('project_table');
-    await expect(table).toBeVisible();
-
-    const seeded = [
-        'AAA Tiebreak Project',
-        'MMM Tiebreak Project',
-        'NNN Tiebreak Project',
-        'ZZZ Tiebreak Project',
-    ];
-    const getOrder = () => getSeededRowOrder(table, seeded);
-
-    // -- Client: empty rows last in both directions, alphabetical among themselves --
-    const clientHeader = table.locator('.select-none', { hasText: 'Client' }).first();
-    await clientHeader.click();
-    await expect
-        .poll(getOrder)
-        .toEqual([
-            'MMM Tiebreak Project',
-            'NNN Tiebreak Project',
-            'AAA Tiebreak Project',
-            'ZZZ Tiebreak Project',
-        ]);
-
-    await clientHeader.click();
-    await expect
-        .poll(getOrder)
-        .toEqual([
-            'NNN Tiebreak Project',
-            'MMM Tiebreak Project',
-            'AAA Tiebreak Project',
-            'ZZZ Tiebreak Project',
-        ]);
-
-    // -- Progress: same, and the first click sorts highest first --
-    const progressHeader = table.locator('.select-none', { hasText: 'Progress' }).first();
-    await progressHeader.click();
-    await expect
-        .poll(getOrder)
-        .toEqual([
-            'NNN Tiebreak Project',
-            'MMM Tiebreak Project',
-            'AAA Tiebreak Project',
-            'ZZZ Tiebreak Project',
-        ]);
-
-    await progressHeader.click();
-    await expect
-        .poll(getOrder)
-        .toEqual([
-            'MMM Tiebreak Project',
-            'NNN Tiebreak Project',
-            'AAA Tiebreak Project',
-            'ZZZ Tiebreak Project',
-        ]);
-});
-
 test('test that sort state persists after page reload', async ({ page }) => {
     await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
+    await clearProjectTableState(page);
     await page.reload();
 
     // Click on Name header twice to sort descending
@@ -1195,7 +1114,7 @@ test.describe('Projects Pagination', () => {
         );
 
         await goToProjectsOverview(page);
-        await clearTableState(page, 'project-table-state');
+        await clearProjectTableState(page);
         await page.reload();
 
         // Default sort is name asc; first 15 projects (00–14) should be on page 1.
@@ -1249,7 +1168,7 @@ test.describe('Projects Pagination', () => {
         );
 
         await goToProjectsOverview(page);
-        await clearTableState(page, 'project-table-state');
+        await clearProjectTableState(page);
         await page.reload();
 
         await expect(page.getByTestId('project_table')).toBeVisible();
@@ -1266,7 +1185,7 @@ test.describe('Projects Pagination', () => {
         );
 
         await goToProjectsOverview(page);
-        await clearTableState(page, 'project-table-state');
+        await clearProjectTableState(page);
         await page.reload();
 
         await expect(page.getByText(prefix + '00')).toBeVisible({ timeout: 10000 });
@@ -1288,36 +1207,3 @@ test.describe('Projects Pagination', () => {
         await expect(page.getByText(prefix + '00')).not.toBeVisible();
     });
 });
-
-test('test that searching projects by name works', async ({ page, ctx }) => {
-    const suffix = Math.floor(1 + Math.random() * 10000);
-    const matchingProjectName = 'Searchable Project ' + suffix;
-    const otherProjectName = 'Unrelated Work ' + suffix;
-    await createProjectViaApi(ctx, { name: matchingProjectName });
-    await createProjectViaApi(ctx, { name: otherProjectName });
-
-    await goToProjectsOverview(page);
-    await clearTableState(page, 'project-table-state');
-    await page.reload();
-    await expect(page.getByText(matchingProjectName)).toBeVisible({ timeout: 10000 });
-    await expect(page.getByText(otherProjectName)).toBeVisible();
-
-    const searchInput = page.getByRole('searchbox', { name: 'Search projects' });
-
-    // Searching is case insensitive and matches part of the name
-    await searchInput.fill('SEARCHABLE');
-    await expect(page.getByText(matchingProjectName)).toBeVisible();
-    await expect(page.getByText(otherProjectName)).not.toBeVisible();
-
-    // A term that matches nothing empties the table
-    await searchInput.fill('no project has this name');
-    await expect(page.getByText(matchingProjectName)).not.toBeVisible();
-    await expect(page.getByText(otherProjectName)).not.toBeVisible();
-    await expect(page.getByText('No matching projects')).toBeVisible();
-    await expect(page.getByRole('button', { name: 'Create your First Project' })).not.toBeVisible();
-
-    // Clearing the search restores both projects
-    await searchInput.fill('');
-    await expect(page.getByText(matchingProjectName)).toBeVisible();
-    await expect(page.getByText(otherProjectName)).toBeVisible();
-});

e2e/reporting.spec.ts

@@ -10,7 +10,6 @@ import {
     createTimeEntryWithTagViaApi,
     createTimeEntryWithBillableStatusViaApi,
     createBareTimeEntryViaApi,
-    createTimeEntryOnDateViaApi,
     createPublicProjectViaApi,
     updateOrganizationSettingViaApi,
 } from './utils/api';
@@ -18,25 +17,6 @@ import {
 // Each test registers a new user and creates test data via API
 test.describe.configure({ timeout: 30000 });
 
-test('date range picker labels and navigates reporting periods', async ({ page }) => {
-    await goToReporting(page);
-
-    const range = page.getByTestId('date_range_picker_display');
-    const previous = page.getByTestId('date_range_picker_previous');
-    const next = page.getByTestId('date_range_picker_next');
-
-    await expect(range).toContainText('Last 14 Days');
-    await expect(next).toBeDisabled();
-
-    await Promise.all([waitForReportingUpdate(page), previous.click()]);
-    await expect(range).not.toContainText('Last 14 Days');
-
-    // The initial reporting range is still fresh in Vue Query's cache, so returning to it
-    // does not necessarily trigger another aggregate request.
-    await next.click();
-    await expect(range).toContainText('Last 14 Days');
-});
-
 // ──────────────────────────────────────────────────
 // Project Multiselect Dropdown Tests
 // ──────────────────────────────────────────────────
@@ -861,127 +841,6 @@ test('test that setting group by to current sub group triggers sub group fallbac
     await expect(groupBySelects.filter({ hasText: 'Members' }).first()).toBeVisible();
 });
 
-test('test that group by date groups the report by day and formats the date labels with organization settings', async ({
-    page,
-    ctx,
-}) => {
-    await updateOrganizationSettingViaApi(ctx, { date_format: 'point-separated-d-m-yyyy' });
-
-    await createTimeEntryViaApi(ctx, {
-        description: 'Entry for group by date',
-        duration: '1h',
-    });
-
-    // Go to reporting page
-    await goToReporting(page);
-    await expect(page.getByRole('button', { name: 'Export' })).toBeVisible();
-
-    // Find the "Group by" selects within the reporting table
-    const groupBySelects = page.locator('[data-testid="reporting_view"]').getByRole('combobox');
-
-    // Default state: group=Project
-    await groupBySelects.filter({ hasText: 'Project' }).first().click();
-
-    const [aggregateResponse] = await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/time-entries/aggregate') &&
-                response.url().includes('group=day') &&
-                response.status() === 200
-        ),
-        page.getByRole('option', { name: 'Date', exact: true }).click(),
-    ]);
-
-    // Verify the API request contains the correct group parameter
-    const requestUrl = new URL(aggregateResponse.url());
-    expect(requestUrl.searchParams.get('group')).toBe('day');
-
-    // The row label is rendered in the organization date format (D.M.YYYY)
-    await expect(
-        page.getByTestId('reporting_view').getByText(/^\d{1,2}\.\d{1,2}\.\d{4}$/)
-    ).toBeVisible();
-    await expect(page.getByTestId('reporting_view').getByText(/^\d{4}-\d{2}-\d{2}$/)).toHaveCount(
-        0
-    );
-});
-
-test('test that group by week requests week grouping and does not leak the raw group key', async ({
-    page,
-    ctx,
-}) => {
-    await createTimeEntryViaApi(ctx, {
-        description: 'Entry for group by week',
-        duration: '1h',
-    });
-
-    await goToReporting(page);
-    await expect(page.getByRole('button', { name: 'Export' })).toBeVisible();
-
-    const groupBySelects = page.locator('[data-testid="reporting_view"]').getByRole('combobox');
-    await groupBySelects.filter({ hasText: 'Project' }).first().click();
-
-    const [aggregateResponse] = await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/time-entries/aggregate') &&
-                response.url().includes('group=week') &&
-                response.status() === 200
-        ),
-        page.getByRole('option', { name: 'Week', exact: true }).click(),
-    ]);
-
-    const requestUrl = new URL(aggregateResponse.url());
-    expect(requestUrl.searchParams.get('group')).toBe('week');
-
-    // The raw group key is the first day of the week and must not leak through.
-    await expect(page.getByTestId('reporting_view').getByText(/^\d{4}-\d{2}-\d{2}$/)).toHaveCount(
-        0
-    );
-});
-
-test('test that group by week labels a week spanning new year with a range crossing the year', async ({
-    page,
-    ctx,
-}) => {
-    await updateOrganizationSettingViaApi(ctx, { date_format: 'slash-separated-dd-mm-yyyy' });
-
-    for (const day of ['2025-12-22', '2025-12-29', '2026-01-05']) {
-        await createTimeEntryOnDateViaApi(ctx, {
-            date: new Date(`${day}T09:00:00Z`),
-            duration: '1h',
-            description: `Entry for ${day}`,
-        });
-    }
-
-    // The reporting page keeps its range in session storage, so seed a range spanning new year
-    // rather than driving the date picker.
-    await page.addInitScript(() => {
-        window.sessionStorage.setItem('reporting-start-date', '2025-12-15');
-        window.sessionStorage.setItem('reporting-end-date', '2026-01-15');
-    });
-
-    await goToReporting(page);
-    await expect(page.getByRole('button', { name: 'Export' })).toBeVisible();
-
-    const groupBySelects = page.locator('[data-testid="reporting_view"]').getByRole('combobox');
-    await groupBySelects.filter({ hasText: 'Project' }).first().click();
-    await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/time-entries/aggregate') &&
-                response.url().includes('group=week') &&
-                response.status() === 200
-        ),
-        page.getByRole('option', { name: 'Week', exact: true }).click(),
-    ]);
-
-    const reportingView = page.getByTestId('reporting_view');
-    await expect(reportingView.getByText('22/12/2025 - 28/12/2025', { exact: true })).toBeVisible();
-    await expect(reportingView.getByText('29/12/2025 - 04/01/2026', { exact: true })).toBeVisible();
-    await expect(reportingView.getByText('05/01/2026 - 11/01/2026', { exact: true })).toBeVisible();
-    await expect(reportingView.getByText(/^\d{4}-\d{2}-\d{2}$/)).toHaveCount(0);
-});
-
 // ──────────────────────────────────────────────────
 // Export Tests
 // ──────────────────────────────────────────────────

e2e/shared-reports.spec.ts

@@ -16,7 +16,6 @@ import {
     createTimeEntryWithBillableStatusViaApi,
     createTagViaApi,
     createReportViaApi,
-    updateOrganizationSettingViaApi,
 } from './utils/api';
 import {
     goToReporting,
@@ -69,42 +68,6 @@ test('test that saving a report creates a shared report and its shareable link s
     await expect(page.getByText('Total')).toBeVisible();
 });
 
-test('test that a shared report grouped by date shows date labels formatted by the organization setting', async ({
-    page,
-    ctx,
-}) => {
-    const reportName = 'DateGroupReport ' + Math.floor(Math.random() * 10000);
-
-    await updateOrganizationSettingViaApi(ctx, { date_format: 'point-separated-d-m-yyyy' });
-    await createTimeEntryViaApi(ctx, {
-        description: 'Entry for date grouping',
-        duration: '1h',
-    });
-
-    await goToReporting(page);
-
-    // Switch the grouping to "Date"
-    const groupBySelects = page.locator('[data-testid="reporting_view"]').getByRole('combobox');
-    await groupBySelects.filter({ hasText: 'Project' }).first().click();
-    await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/time-entries/aggregate') &&
-                response.url().includes('group=day') &&
-                response.status() === 200
-        ),
-        page.getByRole('option', { name: 'Date', exact: true }).click(),
-    ]);
-
-    const { shareableLink } = await saveAsSharedReport(page, reportName);
-
-    // Verify row labels are formatted correctly
-    await page.goto(shareableLink);
-    await expect(page.getByText('Total')).toBeVisible();
-    await expect(page.getByText(/^\d{1,2}\.\d{1,2}\.\d{4}$/)).toBeVisible();
-    await expect(page.getByText(/^\d{4}-\d{2}-\d{2}$/)).toHaveCount(0);
-});
-
 test('test that shared report with invalid secret shows no data', async ({ page }) => {
     await page.goto(PLAYWRIGHT_BASE_URL + '/shared-report#invalid-secret-value');
     await expect(page.getByText('No time entries found').first()).toBeVisible();

e2e/tags.spec.ts

@@ -3,7 +3,7 @@ import type { Page } from '@playwright/test';
 import { PLAYWRIGHT_BASE_URL } from '../playwright/config';
 import { test } from '../playwright/fixtures';
 import { createTagViaApi } from './utils/api';
-import { clearTableState, getTableRowNames } from './utils/table';
+import { getTableRowNames } from './utils/table';
 
 async function goToTagsOverview(page: Page) {
     await page.goto(PLAYWRIGHT_BASE_URL + '/tags');
@@ -147,12 +147,18 @@ test('test that tag context menu delete deletes the tag', async ({ page, ctx })
 // Sorting Tests
 // =============================================
 
+async function clearTagTableState(page: Page) {
+    await page.evaluate(() => {
+        localStorage.removeItem('tag-table-state');
+    });
+}
+
 test('test that sorting tags by name works', async ({ page, ctx }) => {
     await createTagViaApi(ctx, { name: 'AAA SortTag' });
     await createTagViaApi(ctx, { name: 'ZZZ SortTag' });
 
     await goToTagsOverview(page);
-    await clearTableState(page, 'tag-table-state');
+    await clearTagTableState(page);
     await page.reload();
 
     const table = page.getByTestId('tag_table');
@@ -170,7 +176,7 @@ test('test that sorting tags by name works', async ({ page, ctx }) => {
 
 test('test that tag sort state persists after page reload', async ({ page }) => {
     await goToTagsOverview(page);
-    await clearTableState(page, 'tag-table-state');
+    await clearTagTableState(page);
     await page.reload();
 
     const table = page.getByTestId('tag_table');

e2e/tasks.spec.ts

@@ -7,56 +7,13 @@ import {
     createPublicProjectViaApi,
     createTaskViaApi,
     createClientViaApi,
-    createTimeEntryViaApi,
     updateOrganizationSettingViaApi,
-    type TestContext,
 } from './utils/api';
-import { clearTableState, getTableRowNames } from './utils/table';
 
 async function goToProjectsOverview(page: Page) {
     await page.goto(PLAYWRIGHT_BASE_URL + '/projects');
 }
 
-async function createSortableTasks(ctx: TestContext) {
-    const project = await createProjectViaApi(ctx, { name: 'Task Sorting Project' });
-    const taskA = await createTaskViaApi(ctx, {
-        name: 'AAA Sorting Task',
-        project_id: project.id,
-        estimated_time: 36000,
-    });
-    const taskB = await createTaskViaApi(ctx, {
-        name: 'BBB Sorting Task',
-        project_id: project.id,
-        estimated_time: 14400,
-    });
-    const taskC = await createTaskViaApi(ctx, {
-        name: 'CCC Sorting Task',
-        project_id: project.id,
-    });
-
-    expect(taskA.estimated_time).toBe(36000);
-    expect(taskB.estimated_time).toBe(14400);
-    expect(taskC.estimated_time).toBeNull();
-
-    await createTimeEntryViaApi(ctx, {
-        duration: '1h',
-        projectId: project.id,
-        taskId: taskA.id,
-    });
-    await createTimeEntryViaApi(ctx, {
-        duration: '2h',
-        projectId: project.id,
-        taskId: taskB.id,
-    });
-    await createTimeEntryViaApi(ctx, {
-        duration: '3h',
-        projectId: project.id,
-        taskId: taskC.id,
-    });
-
-    return { project, taskA, taskB, taskC };
-}
-
 test('test that creating and deleting a new task in a new project works', async ({ page }) => {
     const newProjectName = 'New Project ' + Math.floor(1 + Math.random() * 10000);
     await goToProjectsOverview(page);
@@ -344,59 +301,6 @@ test('test that creating a new project from the task create modal project dropdo
     await expect(page.getByTestId('task_table')).toContainText(newTaskName);
 });
 
-// =============================================
-// Sorting Tests
-// =============================================
-
-test('test that sorting tasks by name, total time and progress works', async ({ page, ctx }) => {
-    const { project, taskA, taskB, taskC } = await createSortableTasks(ctx);
-    await goToProjectsOverview(page);
-    await clearTableState(page, 'task-table-state');
-    await page.goto(PLAYWRIGHT_BASE_URL + '/projects/' + project.id);
-    const table = page.getByTestId('task_table');
-    await expect(table).toBeVisible();
-
-    // This project contains only the seeded tasks, so assert the complete order.
-    const expectOrder = async (expected: string[]) => {
-        await expect.poll(() => getTableRowNames(table)).toEqual(expected);
-    };
-    const clickHeader = async (headerText: string) => {
-        await table.getByText(headerText).first().click();
-    };
-
-    await expectOrder([taskA.name, taskB.name, taskC.name]);
-    await clickHeader('Task Name');
-    await expectOrder([taskC.name, taskB.name, taskA.name]);
-    await clickHeader('Task Name');
-    await expectOrder([taskA.name, taskB.name, taskC.name]);
-
-    await clickHeader('Total Time');
-    await expectOrder([taskC.name, taskB.name, taskA.name]);
-    await clickHeader('Total Time');
-    await expectOrder([taskA.name, taskB.name, taskC.name]);
-
-    await clickHeader('Progress');
-    await expectOrder([taskB.name, taskA.name, taskC.name]);
-    await clickHeader('Progress');
-    await expectOrder([taskA.name, taskB.name, taskC.name]);
-});
-
-test('test that task sort state persists after page reload', async ({ page, ctx }) => {
-    const { project, taskA, taskB, taskC } = await createSortableTasks(ctx);
-    await goToProjectsOverview(page);
-    await clearTableState(page, 'task-table-state');
-    await page.goto(PLAYWRIGHT_BASE_URL + '/projects/' + project.id);
-    const table = page.getByTestId('task_table');
-    await expect(table).toBeVisible();
-
-    await table.getByText('Progress').first().click();
-    await expect.poll(() => getTableRowNames(table)).toEqual([taskB.name, taskA.name, taskC.name]);
-    await page.reload();
-
-    // Verify the persisted row order, not just the sort indicator.
-    await expect.poll(() => getTableRowNames(table)).toEqual([taskB.name, taskA.name, taskC.name]);
-});
-
 // =============================================
 // Employee Permission Tests
 // =============================================

e2e/timesheet.spec.ts

@@ -409,20 +409,20 @@ test('navigating to previous week shows entries from that week', async ({ page,
 test('can navigate forward and return to current week', async ({ page }) => {
     await Promise.all([goToTimesheet(page), waitForTimesheetLoad(page)]);
 
-    // Should show "This Week"
+    // Should show "This week"
-    await expect(page.getByTestId('timesheet_week_display')).toContainText('This Week');
+    await expect(page.getByTestId('timesheet_week_display')).toContainText('This week');
 
     // Go to next week — the text assertions below auto-retry until the
     // header label flips.
     await page.getByTestId('timesheet_next_week').click();
 
-    // Should no longer show "This Week"
+    // Should no longer show "This week"
-    await expect(page.getByTestId('timesheet_week_display')).not.toContainText('This Week');
+    await expect(page.getByTestId('timesheet_week_display')).not.toContainText('This week');
 
     // Go back to this week
     await page.getByTestId('timesheet_week_display').click();
 
-    await expect(page.getByTestId('timesheet_week_display')).toContainText('This Week');
+    await expect(page.getByTestId('timesheet_week_display')).toContainText('This week');
 });
 
 // ──────────────────────────────────────────────────

e2e/timezone-mismatch.spec.ts

@@ -1,89 +0,0 @@
-import { test, expect } from '../playwright/fixtures';
-import { PLAYWRIGHT_BASE_URL } from '../playwright/config';
-import type { Page, TestContext } from '../playwright/fixtures';
-import { getCurrentUserViaApi, updateUserProfileViaApi } from './utils/api';
-
-const BROWSER_TIMEZONE = 'Europe/Vienna';
-const MISMATCHED_TIMEZONE = 'America/New_York';
-
-test.use({ timezoneId: BROWSER_TIMEZONE });
-
-function mismatchModal(page: Page) {
-    return page.getByRole('dialog').filter({ hasText: 'Timezone mismatch detected' });
-}
-
-async function openPageWithTimezoneMismatch(page: Page, ctx: TestContext) {
-    await updateUserProfileViaApi(ctx, { timezone: MISMATCHED_TIMEZONE });
-    await page.goto(PLAYWRIGHT_BASE_URL + '/dashboard');
-    await expect(mismatchModal(page)).toBeVisible();
-}
-
-test('timezone mismatch modal saves the device timezone through the users API', async ({
-    page,
-    ctx,
-}) => {
-    await openPageWithTimezoneMismatch(page, ctx);
-
-    await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/api/v1/users/') &&
-                response.request().method() === 'PUT' &&
-                response.status() === 200
-        ),
-        mismatchModal(page).getByRole('button', { name: 'Update timezone' }).click(),
-    ]);
-    await expect(mismatchModal(page)).toBeHidden();
-
-    const user = await getCurrentUserViaApi(ctx);
-    expect(user.timezone).toBe(BROWSER_TIMEZONE);
-
-    // After the automatic reload the timezones match again, so the modal stays gone.
-    await page.waitForLoadState('load');
-    await page.goto(PLAYWRIGHT_BASE_URL + '/dashboard');
-    await expect(mismatchModal(page)).toBeHidden();
-});
-
-test('timezone mismatch modal does not open for a different timezone with the same time', async ({
-    page,
-    ctx,
-}) => {
-    // Berlin and Vienna share the same offset and DST rules, so the times match.
-    await updateUserProfileViaApi(ctx, { timezone: 'Europe/Berlin' });
-    await page.goto(PLAYWRIGHT_BASE_URL + '/dashboard');
-
-    // Wait until the dashboard is rendered so the modal had its chance to mount.
-    await expect(page.getByTestId('dashboard_view')).toBeVisible();
-    await expect(mismatchModal(page)).toBeHidden();
-});
-
-test('timezone mismatch modal stays open when the update fails', async ({ page, ctx }) => {
-    await openPageWithTimezoneMismatch(page, ctx);
-
-    await page.route('**/api/v1/users/*', (route) => {
-        if (route.request().method() === 'PUT') {
-            return route.fulfill({
-                status: 500,
-                contentType: 'application/json',
-                body: JSON.stringify({ message: 'Server error' }),
-            });
-        }
-        return route.fallback();
-    });
-
-    await Promise.all([
-        page.waitForResponse(
-            (response) =>
-                response.url().includes('/api/v1/users/') &&
-                response.request().method() === 'PUT' &&
-                response.status() === 500
-        ),
-        mismatchModal(page).getByRole('button', { name: 'Update timezone' }).click(),
-    ]);
-
-    await expect(mismatchModal(page)).toBeVisible();
-    await expect(page.getByText('Failed to update profile')).toBeVisible();
-
-    const user = await getCurrentUserViaApi(ctx);
-    expect(user.timezone).toBe(MISMATCHED_TIMEZONE);
-});

e2e/utils/api.ts

@@ -357,7 +357,7 @@ export async function createProjectWithClientViaApi(
 
 export async function createTaskViaApi(
     ctx: TestContext,
-    data: { name: string; project_id: string; estimated_time?: number }
+    data: { name: string; project_id: string }
 ) {
     const response = await ctx.request.post(
         `${PLAYWRIGHT_BASE_URL}/api/v1/organizations/${ctx.orgId}/tasks`,
@@ -365,20 +365,12 @@ export async function createTaskViaApi(
             data: {
                 name: data.name,
                 project_id: data.project_id,
-                ...(data.estimated_time !== undefined
-                    ? { estimated_time: data.estimated_time }
-                    : {}),
             },
         }
     );
     expect(response.status()).toBe(201);
     const body = await response.json();
-    return body.data as {
+    return body.data as { id: string; name: string; project_id: string };
-        id: string;
-        name: string;
-        project_id: string;
-        estimated_time: number | null;
-    };
 }
 
 export async function markTaskDoneViaApi(ctx: TestContext, task: { id: string; name: string }) {

e2e/utils/table.ts

@@ -1,4 +1,4 @@
-import type { Locator, Page } from '@playwright/test';
+import type { Locator } from '@playwright/test';
 
 /**
  * Extract the first cell's text content from each row in a table.
@@ -14,22 +14,3 @@ export async function getTableRowNames(table: Locator): Promise<string[]> {
     }
     return names;
 }
-
-/**
- * The visual order of the given seeded names within the table, ignoring any other rows.
- */
-export async function getSeededRowOrder(table: Locator, seeded: string[]): Promise<string[]> {
-    const rowNames = await getTableRowNames(table);
-    return rowNames
-        .map((rowName) => seeded.find((name) => rowName.includes(name)))
-        .filter((name): name is string => Boolean(name));
-}
-
-/**
- * Drop a table's persisted sort/filter state so a test starts from the defaults.
- */
-export async function clearTableState(page: Page, key: string) {
-    await page.evaluate((storageKey) => {
-        localStorage.removeItem(storageKey);
-    }, key);
-}

extensions/manifest.json

@@ -1,14 +1,14 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "v0.0.6"
+        "ref": "v0.0.3"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",
-        "ref": "v0.0.2"
+        "ref": "v0.0.1"
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
-        "ref": "v0.0.6"
+        "ref": "v0.0.2"
     }
 }

package.json

@@ -57,7 +57,7 @@
         "@floating-ui/core": "^1.7.5",
         "@floating-ui/vue": "^1.1.11",
         "@heroicons/vue": "^2.2.0",
-        "@lucide/vue": "^1.28.0",
+        "@lucide/vue": "^1.14.0",
         "@rushstack/eslint-patch": "^1.16.1",
         "@tailwindcss/container-queries": "^0.1.1",
         "@tanstack/vue-form": "^1.32.0",
@@ -67,7 +67,7 @@
         "@tanstack/vue-virtual": "^3.13.24",
         "@vue/eslint-config-prettier": "^10.2.0",
         "@vue/eslint-config-typescript": "^14.7.0",
-        "@vueuse/core": "^14.4.0",
+        "@vueuse/core": "^14.3.0",
         "@vueuse/integrations": "^14.3.0",
         "@zodios/core": "^10.9.6",
         "chroma-js": "^3.2.0",
@@ -79,7 +79,7 @@
         "parse-duration": "^2.1.6",
         "pinia": "^3.0.4",
         "radix-vue": "^1.9.17",
-        "reka-ui": "^2.10.1",
+        "reka-ui": "^2.9.7",
         "tailwind-merge": "^2.6.1",
         "tailwindcss-animate": "^1.0.7",
         "vue-draggable-plus": "^0.6.1",

resources/js/Components/Common/Client/ClientTable.vue

@@ -7,17 +7,18 @@ import { type Client } from '@/packages/api/src';
 import ClientTableRow from '@/Components/Common/Client/ClientTableRow.vue';
 import ClientCreateModal from '@/Components/Common/Client/ClientCreateModal.vue';
 import ClientTableHeading from '@/Components/Common/Client/ClientTableHeading.vue';
-import Pagination from '@/packages/ui/src/Pagination.vue';
+import Pagination from '@/Components/Common/Pagination.vue';
 import { canCreateClients } from '@/utils/permissions';
 import { useProjectsQuery } from '@/utils/useProjectsQuery';
 import {
-    useSortableTable,
+    useVueTable,
-    type SortableColumnDef,
+    getCoreRowModel,
-    type SortDirection,
+    getSortedRowModel,
-} from '@/utils/useSortableTable';
+    type SortingState,
+} from '@tanstack/vue-table';
 
 export type SortColumn = 'name' | 'projects_count' | 'status';
-export type { SortDirection } from '@/utils/useSortableTable';
+export type SortDirection = 'asc' | 'desc';
 
 const props = defineProps<{
     clients: Client[];
@@ -43,7 +44,17 @@ const projectCountMap = computed(() => {
     return map;
 });
 
-const columns = computed<SortableColumnDef<Client, SortColumn>[]>(() => [
+// Name is always the secondary sort so rows with equal values render
+// alphabetically instead of in API (created_at) order.
+const sorting = computed<SortingState>(() => [
+    {
+        id: props.sortColumn,
+        desc: props.sortDirection === 'desc',
+    },
+    ...(props.sortColumn !== 'name' ? [{ id: 'name', desc: false }] : []),
+]);
+
+const columns = computed(() => [
     {
         id: 'name',
         accessorFn: (row: Client) => row.name.toLowerCase(),
@@ -59,22 +70,41 @@ const columns = computed<SortableColumnDef<Client, SortColumn>[]>(() => [
     },
 ]);
 
-const {
+const descFirstColumns = new Set<SortColumn>(
-    sortedRows: sortedClients,
+    columns.value
-    descFirstColumns,
+        .filter((c) => 'sortDescFirst' in c && c.sortDescFirst)
-    nextDirection,
+        .map((c) => c.id as SortColumn)
-} = useSortableTable({
+);
-    data: () => props.clients,
-    columns: () => columns.value,
-    sortColumn: () => props.sortColumn,
-    sortDirection: () => props.sortDirection,
-    tieBreakColumn: 'name',
-});
 
 function handleSort(column: SortColumn) {
-    emit('sort', column, nextDirection(column));
+    if (props.sortColumn === column) {
+        emit('sort', column, props.sortDirection === 'asc' ? 'desc' : 'asc');
+    } else {
+        emit('sort', column, descFirstColumns.has(column) ? 'desc' : 'asc');
+    }
 }
 
+const table = useVueTable({
+    get data() {
+        return props.clients;
+    },
+    get columns() {
+        return columns.value;
+    },
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    state: {
+        get sorting() {
+            return sorting.value;
+        },
+    },
+    manualSorting: false,
+});
+
+const sortedClients = computed(() => {
+    return table.getRowModel().rows.map((row) => row.original);
+});
+
 // Client-side pagination: the full list is in memory, only one page is mounted at a time.
 const PAGE_SIZE = 15;
 const currentPage = ref(1);

resources/js/Components/Common/Client/ClientTableHeading.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import TableHeading from '@/Components/Common/TableHeading.vue';
-import SortableTableHeaderCell from '@/Components/Common/SortableTableHeaderCell.vue';
+import { ChevronUpIcon, ChevronDownIcon } from '@heroicons/vue/16/solid';
 import type { SortColumn, SortDirection } from '@/Components/Common/Client/ClientTable.vue';
 
 const props = defineProps<{
@@ -9,29 +9,57 @@ const props = defineProps<{
     descFirstColumns: ReadonlySet<SortColumn>;
 }>();
 
-defineEmits<{
+const emit = defineEmits<{
     sort: [column: SortColumn];
 }>();
+
+function handleSort(column: SortColumn) {
+    emit('sort', column);
+}
+
+function isSorted(column: SortColumn): boolean {
+    return props.sortColumn === column;
+}
+
+function isChevronDown(column: SortColumn): boolean {
+    if (!isSorted(column)) return false;
+    return props.descFirstColumns.has(column)
+        ? props.sortDirection === 'desc'
+        : props.sortDirection === 'asc';
+}
+
+function isChevronUp(column: SortColumn): boolean {
+    if (!isSorted(column)) return false;
+    return !isChevronDown(column);
+}
 </script>
 
 <template>
     <TableHeading>
-        <SortableTableHeaderCell
+        <div
-            class="pr-3 pl-4 sm:pl-6 lg:pl-8 3xl:pl-12"
+            class="py-1.5 pr-3 text-left text-text-tertiary pl-4 sm:pl-6 lg:pl-8 3xl:pl-12 cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
-            column="name"
+            @click="handleSort('name')">
-            v-bind="props"
-            @sort="$emit('sort', $event)">
             Name
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('name')" class="w-4 h-4" />
-        <SortableTableHeaderCell
+            <ChevronUpIcon v-else-if="isChevronUp('name')" class="w-4 h-4" />
-            column="projects_count"
+            <span v-else class="w-4 h-4"></span>
-            v-bind="props"
+        </div>
-            @sort="$emit('sort', $event)">
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('projects_count')">
             Projects
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('projects_count')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="status" v-bind="props" @sort="$emit('sort', $event)">
+            <ChevronUpIcon v-else-if="isChevronUp('projects_count')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('status')">
             Status
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('status')" class="w-4 h-4" />
+            <ChevronUpIcon v-else-if="isChevronUp('status')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
         <div class="relative py-1.5 pl-3 pr-4 sm:pr-6 lg:pr-8 3xl:pr-12">
             <span class="sr-only">Edit</span>
         </div>

resources/js/Components/Common/Member/MemberTable.vue

@@ -3,14 +3,16 @@ import MemberTableHeading from '@/Components/Common/Member/MemberTableHeading.vu
 import MemberTableRow from '@/Components/Common/Member/MemberTableRow.vue';
 import { useMembersQuery } from '@/utils/useMembersQuery';
 import type { Member } from '@/packages/api/src';
+import { computed } from 'vue';
 import {
-    useSortableTable,
+    useVueTable,
-    type SortableColumnDef,
+    getCoreRowModel,
-    type SortDirection,
+    getSortedRowModel,
-} from '@/utils/useSortableTable';
+    type SortingState,
+} from '@tanstack/vue-table';
 
 export type SortColumn = 'name' | 'email' | 'role' | 'billable_rate' | 'status';
-export type { SortDirection } from '@/utils/useSortableTable';
+export type SortDirection = 'asc' | 'desc';
 
 const props = defineProps<{
     sortColumn: SortColumn;
@@ -31,7 +33,14 @@ const roleOrder: Record<string, number> = {
     placeholder: 4,
 };
 
-const columns: SortableColumnDef<Member, SortColumn>[] = [
+const sorting = computed<SortingState>(() => [
+    {
+        id: props.sortColumn,
+        desc: props.sortDirection === 'desc',
+    },
+]);
+
+const columns = [
     {
         id: 'name',
         accessorFn: (row: Member) => row.name.toLowerCase(),
@@ -47,6 +56,7 @@ const columns: SortableColumnDef<Member, SortColumn>[] = [
     {
         id: 'billable_rate',
         sortDescFirst: true,
+        sortUndefined: 'last' as const,
         accessorFn: (row: Member) => {
             if (row.billable_rate === null) return undefined;
             return row.billable_rate;
@@ -58,21 +68,36 @@ const columns: SortableColumnDef<Member, SortColumn>[] = [
     },
 ];
 
-const {
+const descFirstColumns = new Set<SortColumn>(
-    sortedRows: sortedMembers,
+    columns.filter((c) => c.sortDescFirst).map((c) => c.id as SortColumn)
-    descFirstColumns,
+);
-    nextDirection,
-} = useSortableTable({
-    data: () => members.value,
-    columns: () => columns,
-    sortColumn: () => props.sortColumn,
-    sortDirection: () => props.sortDirection,
-    tieBreakColumn: 'name',
-});
 
 function handleSort(column: SortColumn) {
-    emit('sort', column, nextDirection(column));
+    if (props.sortColumn === column) {
+        emit('sort', column, props.sortDirection === 'asc' ? 'desc' : 'asc');
+    } else {
+        emit('sort', column, descFirstColumns.has(column) ? 'desc' : 'asc');
+    }
 }
+
+const table = useVueTable({
+    get data() {
+        return members.value;
+    },
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    state: {
+        get sorting() {
+            return sorting.value;
+        },
+    },
+    manualSorting: false,
+});
+
+const sortedMembers = computed(() => {
+    return table.getRowModel().rows.map((row) => row.original);
+});
 </script>
 
 <template>

resources/js/Components/Common/Member/MemberTableHeading.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import TableHeading from '@/Components/Common/TableHeading.vue';
-import SortableTableHeaderCell from '@/Components/Common/SortableTableHeaderCell.vue';
+import { ChevronUpIcon, ChevronDownIcon } from '@heroicons/vue/16/solid';
 import type { SortColumn, SortDirection } from '@/Components/Common/Member/MemberTable.vue';
 
 const props = defineProps<{
@@ -9,35 +9,73 @@ const props = defineProps<{
     descFirstColumns: ReadonlySet<SortColumn>;
 }>();
 
-defineEmits<{
+const emit = defineEmits<{
     sort: [column: SortColumn];
 }>();
+
+function handleSort(column: SortColumn) {
+    emit('sort', column);
+}
+
+function isSorted(column: SortColumn): boolean {
+    return props.sortColumn === column;
+}
+
+function isChevronDown(column: SortColumn): boolean {
+    if (!isSorted(column)) return false;
+    return props.descFirstColumns.has(column)
+        ? props.sortDirection === 'desc'
+        : props.sortDirection === 'asc';
+}
+
+function isChevronUp(column: SortColumn): boolean {
+    if (!isSorted(column)) return false;
+    return !isChevronDown(column);
+}
 </script>
 
 <template>
     <TableHeading>
-        <SortableTableHeaderCell
+        <div
-            class="pr-3 pl-4 sm:pl-6 lg:pl-8 3xl:pl-12"
+            class="py-1.5 pr-3 text-left text-text-tertiary pl-4 sm:pl-6 lg:pl-8 3xl:pl-12 cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
-            column="name"
+            @click="handleSort('name')">
-            v-bind="props"
-            @sort="$emit('sort', $event)">
             Name
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('name')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="email" v-bind="props" @sort="$emit('sort', $event)">
+            <ChevronUpIcon v-else-if="isChevronUp('name')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('email')">
             Email
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('email')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="role" v-bind="props" @sort="$emit('sort', $event)">
+            <ChevronUpIcon v-else-if="isChevronUp('email')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('role')">
             Role
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('role')" class="w-4 h-4" />
-        <SortableTableHeaderCell
+            <ChevronUpIcon v-else-if="isChevronUp('role')" class="w-4 h-4" />
-            column="billable_rate"
+            <span v-else class="w-4 h-4"></span>
-            v-bind="props"
+        </div>
-            @sort="$emit('sort', $event)">
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('billable_rate')">
             Billable Rate
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('billable_rate')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="status" v-bind="props" @sort="$emit('sort', $event)">
+            <ChevronUpIcon v-else-if="isChevronUp('billable_rate')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('status')">
             Status
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('status')" class="w-4 h-4" />
+            <ChevronUpIcon v-else-if="isChevronUp('status')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
         <div class="relative py-1.5 pl-3 pr-4 sm:pr-6 lg:pr-8 3xl:pr-12 bg-row-heading-background">
             <span class="sr-only">Edit</span>
         </div>

resources/js/Components/Common/Pagination.vue

@@ -16,8 +16,8 @@ import {
     ChevronRightIcon,
     EllipsisHorizontalIcon,
 } from '@heroicons/vue/20/solid';
-import { buttonVariants } from './Buttons/index';
+import { buttonVariants } from '@/packages/ui/src';
-import { cn } from './utils/cn';
+import { cn } from '@/lib/utils';
 import { computed, watch } from 'vue';
 
 const page = defineModel<number>('page', { default: 1 });

resources/js/Components/Common/Project/ProjectTable.vue

@@ -6,12 +6,17 @@ import { computed, ref, watch } from 'vue';
 import ProjectCreateModal from '@/packages/ui/src/Project/ProjectCreateModal.vue';
 import ProjectTableHeading from '@/Components/Common/Project/ProjectTableHeading.vue';
 import ProjectTableRow from '@/Components/Common/Project/ProjectTableRow.vue';
-import Pagination from '@/packages/ui/src/Pagination.vue';
+import Pagination from '@/Components/Common/Pagination.vue';
-import LoadingSpinner from '@/packages/ui/src/LoadingSpinner.vue';
 
 export type SortColumn =
-    'name' | 'client_name' | 'spent_time' | 'progress' | 'billable_rate' | 'status' | 'visibility';
+    | 'name'
-export type { SortDirection } from '@/utils/useSortableTable';
+    | 'client_name'
+    | 'spent_time'
+    | 'progress'
+    | 'billable_rate'
+    | 'status'
+    | 'visibility';
+export type SortDirection = 'asc' | 'desc';
 import { canCreateProjects } from '@/utils/permissions';
 import type { CreateProjectBody, Project, Client, CreateClientBody } from '@/packages/api/src';
 import { useProjectsStore } from '@/utils/useProjects';
@@ -22,24 +27,20 @@ import { isAllowedToPerformPremiumAction } from '@/utils/billing';
 import { useOrganizationQuery } from '@/utils/useOrganizationQuery';
 import { getCurrentOrganizationId } from '@/utils/useUser';
 import {
-    useSortableTable,
+    useVueTable,
-    type SortableColumnDef,
+    getCoreRowModel,
-    type SortDirection,
+    getSortedRowModel,
-} from '@/utils/useSortableTable';
+    type SortingState,
+} from '@tanstack/vue-table';
 
 const { organization } = useOrganizationQuery(getCurrentOrganizationId()!);
 
-const props = withDefaults(
+const props = defineProps<{
-    defineProps<{
+    projects: Project[];
-        projects: Project[];
+    showBillableRate: boolean;
-        showBillableRate: boolean;
+    sortColumn: SortColumn;
-        sortColumn: SortColumn;
+    sortDirection: SortDirection;
-        sortDirection: SortDirection;
+}>();
-        isFiltered?: boolean;
-        isLoading?: boolean;
-    }>(),
-    { isFiltered: false, isLoading: false }
-);
 
 const emit = defineEmits<{
     sort: [column: SortColumn, direction: SortDirection];
@@ -56,16 +57,28 @@ const clientNameMap = computed(() => {
     return map;
 });
 
+// Convert sort props to TanStack Table format.
+// Name is always the secondary sort so rows with equal values render
+// alphabetically instead of in API (created_at) order.
+const sorting = computed<SortingState>(() => [
+    {
+        id: props.sortColumn,
+        desc: props.sortDirection === 'desc',
+    },
+    ...(props.sortColumn !== 'name' ? [{ id: 'name', desc: false }] : []),
+]);
+
 // Define column accessors for sorting.
 // Numeric columns use sortDescFirst so that the first click (chevron down) sorts highest-first,
 // while text columns default to ascending (A-Z) on first click (chevron down).
-const columns = computed<SortableColumnDef<Project, SortColumn>[]>(() => [
+const columns = computed(() => [
     {
         id: 'name',
         accessorFn: (row: Project) => row.name.toLowerCase(),
     },
     {
         id: 'client_name',
+        sortUndefined: 'last' as const,
         accessorFn: (row: Project) => {
             if (!row.client_id) return undefined;
             return (clientNameMap.value.get(row.client_id) ?? '').toLowerCase();
@@ -74,11 +87,12 @@ const columns = computed<SortableColumnDef<Project, SortColumn>[]>(() => [
     {
         id: 'spent_time',
         sortDescFirst: true,
-        accessorFn: (row: Project) => row.spent_time,
+        accessorFn: (row: Project) => row.spent_time ?? 0,
     },
     {
         id: 'progress',
         sortDescFirst: true,
+        sortUndefined: 'last' as const,
         accessorFn: (row: Project) => {
             if (!row.estimated_time) return undefined;
             return (row.spent_time / row.estimated_time) * 100;
@@ -87,7 +101,7 @@ const columns = computed<SortableColumnDef<Project, SortColumn>[]>(() => [
     {
         id: 'billable_rate',
         sortDescFirst: true,
-        accessorFn: (row: Project) => row.billable_rate,
+        accessorFn: (row: Project) => row.billable_rate ?? 0,
     },
     {
         id: 'status',
@@ -99,22 +113,40 @@ const columns = computed<SortableColumnDef<Project, SortColumn>[]>(() => [
     },
 ]);
 
-const {
+// Columns with sortDescFirst get desc as default direction on first click.
-    sortedRows: sortedProjects,
+const descFirstColumns = new Set<SortColumn>(
-    descFirstColumns,
+    columns.value.filter((c) => c.sortDescFirst).map((c) => c.id as SortColumn)
-    nextDirection,
+);
-} = useSortableTable({
-    data: () => props.projects,
-    columns: () => columns.value,
-    sortColumn: () => props.sortColumn,
-    sortDirection: () => props.sortDirection,
-    tieBreakColumn: 'name',
-});
 
 function handleSort(column: SortColumn) {
-    emit('sort', column, nextDirection(column));
+    if (props.sortColumn === column) {
+        emit('sort', column, props.sortDirection === 'asc' ? 'desc' : 'asc');
+    } else {
+        emit('sort', column, descFirstColumns.has(column) ? 'desc' : 'asc');
+    }
 }
 
+const table = useVueTable({
+    get data() {
+        return props.projects;
+    },
+    get columns() {
+        return columns.value;
+    },
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    state: {
+        get sorting() {
+            return sorting.value;
+        },
+    },
+    manualSorting: false,
+});
+
+const sortedProjects = computed(() => {
+    return table.getRowModel().rows.map((row) => row.original);
+});
+
 // Client-side pagination: the full list is in memory, only one page is mounted at a time.
 const PAGE_SIZE = 15;
 const currentPage = ref(1);
@@ -128,28 +160,6 @@ const paginatedProjects = computed(() => {
     return sortedProjects.value.slice(start, start + PAGE_SIZE);
 });
 
-const emptyState = computed(() => {
-    if (props.isFiltered) {
-        return {
-            title: 'No matching projects',
-            description: 'Try a different search term or adjust your filters.',
-            showCreateButton: false,
-        };
-    }
-    if (!canCreateProjects()) {
-        return {
-            title: 'You are not a member of any projects',
-            description: 'Ask your manager to add you to a project as a team member.',
-            showCreateButton: false,
-        };
-    }
-    return {
-        title: 'No projects found',
-        description: 'Create your first project now!',
-        showCreateButton: true,
-    };
-});
-
 const showCreateProjectModal = ref(false);
 
 async function createProject(project: CreateProjectBody): Promise<Project | undefined> {
@@ -183,21 +193,24 @@ const gridTemplate = computed(() => {
                     :sort-direction="props.sortDirection"
                     :desc-first-columns="descFirstColumns"
                     @sort="handleSort"></ProjectTableHeading>
-                <div
+                <div v-if="sortedProjects.length === 0" class="col-span-full py-24 text-center">
-                    v-if="props.isLoading"
-                    class="col-span-full flex justify-center items-center py-24">
-                    <LoadingSpinner></LoadingSpinner>
-                </div>
-                <div
-                    v-else-if="sortedProjects.length === 0"
-                    class="col-span-full py-24 text-center">
                     <FolderPlusIcon class="w-8 text-icon-default inline pb-2"></FolderPlusIcon>
-                    <h3 class="text-text-primary font-semibold">{{ emptyState.title }}</h3>
+                    <h3 class="text-text-primary font-semibold">
+                        {{
+                            canCreateProjects()
+                                ? 'No projects found'
+                                : 'You are not a member of any projects'
+                        }}
+                    </h3>
                     <p class="pb-5 max-w-md mx-auto text-sm pt-1">
-                        {{ emptyState.description }}
+                        {{
+                            canCreateProjects()
+                                ? 'Create your first project now!'
+                                : 'Ask your manager to add you to a project as a team member.'
+                        }}
                     </p>
                     <SecondaryButton
-                        v-if="emptyState.showCreateButton"
+                        v-if="canCreateProjects()"
                         :icon="PlusIcon"
                         @click="showCreateProjectModal = true"
                         >Create your First Project

resources/js/Components/Common/Project/ProjectTableHeading.vue

@@ -1,7 +1,6 @@
 <script setup lang="ts">
-import { computed } from 'vue';
 import TableHeading from '@/Components/Common/TableHeading.vue';
-import SortableTableHeaderCell from '@/Components/Common/SortableTableHeaderCell.vue';
+import { ChevronUpIcon, ChevronDownIcon } from '@heroicons/vue/16/solid';
 import type { SortColumn, SortDirection } from '@/Components/Common/Project/ProjectTable.vue';
 
 const props = defineProps<{
@@ -15,51 +14,90 @@ const emit = defineEmits<{
     sort: [column: SortColumn];
 }>();
 
-// Bound once per cell instead of repeating the three sort props on every column.
-const sortState = computed(() => ({
-    sortColumn: props.sortColumn,
-    sortDirection: props.sortDirection,
-    descFirstColumns: props.descFirstColumns,
-}));
-
 function handleSort(column: SortColumn) {
     emit('sort', column);
 }
+
+function isSorted(column: SortColumn): boolean {
+    return props.sortColumn === column;
+}
+
+function isChevronDown(column: SortColumn): boolean {
+    if (!isSorted(column)) return false;
+    return props.descFirstColumns.has(column)
+        ? props.sortDirection === 'desc'
+        : props.sortDirection === 'asc';
+}
+
+function isChevronUp(column: SortColumn): boolean {
+    if (!isSorted(column)) return false;
+    return !isChevronDown(column);
+}
 </script>
 
 <template>
     <TableHeading>
-        <SortableTableHeaderCell
+        <div
-            class="pr-3 pl-2 sm:pl-4 lg:pl-6"
+            class="py-1.5 pr-3 text-left text-text-tertiary pl-4 sm:pl-6 lg:pl-8 3xl:pl-12 cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
-            column="name"
+            @click="handleSort('name')">
-            v-bind="sortState"
-            @sort="handleSort">
             Name
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('name')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="client_name" v-bind="sortState" @sort="handleSort">
+            <ChevronUpIcon v-else-if="isChevronUp('name')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('client_name')">
             Client
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('client_name')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="spent_time" v-bind="sortState" @sort="handleSort">
+            <ChevronUpIcon v-else-if="isChevronUp('client_name')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('spent_time')">
             Total Time
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('spent_time')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="progress" v-bind="sortState" @sort="handleSort">
+            <ChevronUpIcon v-else-if="isChevronUp('spent_time')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('progress')">
             Progress
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('progress')" class="w-4 h-4" />
-        <SortableTableHeaderCell
+            <ChevronUpIcon v-else-if="isChevronUp('progress')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
             v-if="showBillableRate"
-            column="billable_rate"
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
-            v-bind="sortState"
+            @click="handleSort('billable_rate')">
-            @sort="handleSort">
             Billable Rate
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('billable_rate')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="status" v-bind="sortState" @sort="handleSort">
+            <ChevronUpIcon v-else-if="isChevronUp('billable_rate')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('status')">
             Status
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('status')" class="w-4 h-4" />
-        <SortableTableHeaderCell column="visibility" v-bind="sortState" @sort="handleSort">
+            <ChevronUpIcon v-else-if="isChevronUp('status')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div
+            class="px-3 py-1.5 text-left text-text-tertiary cursor-pointer hover:bg-secondary hover:text-text-primary transition-colors select-none flex items-center gap-1"
+            @click="handleSort('visibility')">
             Visibility
-        </SortableTableHeaderCell>
+            <ChevronDownIcon v-if="isChevronDown('visibility')" class="w-4 h-4" />
-        <div class="relative py-1.5 pl-3 pr-2 sm:pr-4 lg:pr-6">
+            <ChevronUpIcon v-else-if="isChevronUp('visibility')" class="w-4 h-4" />
+            <span v-else class="w-4 h-4"></span>
+        </div>
+        <div class="relative py-1.5 pl-3 pr-4 sm:pr-6 lg:pr-8 3xl:pr-12">
             <span class="sr-only">Edit</span>
         </div>
     </TableHeading>
 </template>
+
+<style scoped></style>

resources/js/Components/Common/Project/ProjectTableRow.vue

@@ -88,13 +88,13 @@ const showEditProjectModal = ref(false);
         <ContextMenuTrigger as-child>
             <TableRow :href="route('projects.show', { project: project.id })">
                 <div
-                    class="whitespace-nowrap min-w-0 flex items-center space-x-5 py-4 pr-3 text-sm font-medium text-text-primary pl-2 sm:pl-4 lg:pl-6">
+                    class="whitespace-nowrap min-w-0 flex items-center space-x-5 3xl:pl-12 py-4 pr-3 text-sm font-medium text-text-primary pl-4 sm:pl-6 lg:pl-8 3xl:pl-12">
                     <div
                         :style="{
                             backgroundColor: project.color,
                             boxShadow: `var(--tw-ring-inset) 0 0 0 calc(4px + var(--tw-ring-offset-width)) ${project.color}30`,
                         }"
-                        class="w-3 h-3 ml-1 rounded-full"></div>
+                        class="w-3 h-3 rounded-full"></div>
                     <span class="overflow-ellipsis overflow-hidden">
                         {{ project.name }}
                     </span>
@@ -155,7 +155,7 @@ const showEditProjectModal = ref(false);
                     </template>
                 </div>
                 <div
-                    class="relative whitespace-nowrap flex items-center pl-3 text-right text-sm font-medium pr-2 sm:pr-4 lg:pr-6">
+                    class="relative whitespace-nowrap flex items-center pl-3 text-right text-sm font-medium pr-4 sm:pr-6 lg:pr-8 3xl:pr-12">
                     <ProjectMoreOptionsDropdown
                         :project="project"
                         @edit="showEditProjectModal = true"

resources/js/Components/Common/Project/ProjectsFilterDropdown.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref } from 'vue';
+import { computed, ref } from 'vue';
 import { UserGroupIcon, CheckCircleIcon, GlobeAltIcon } from '@heroicons/vue/16/solid';
 import ListFilterIcon from '@/packages/ui/src/Icons/ListFilterIcon.vue';
 import {
@@ -81,18 +81,23 @@ function toggleNoClient() {
         clientIds,
     });
 }
+
+const hasActiveFilters = computed(() => {
+    return (
+        props.filters.status !== 'all' ||
+        props.filters.visibility !== 'all' ||
+        props.filters.clientIds.length > 0
+    );
+});
 </script>
 
 <template>
     <DropdownMenu v-model:open="open">
         <DropdownMenuTrigger as-child>
-            <!-- -ml-1.5 cancels the icon's inset inside the button so it sits flush with the toolbar's left padding -->
+            <Button variant="ghost" size="xs" aria-label="Filter projects">
-            <Button
+                <ListFilterIcon
-                variant="ghost"
+                    :class="[hasActiveFilters ? '' : '-ml-0.5', 'h-4 w-4 text-icon-default']" />
-                size="icon"
+                <span v-if="!hasActiveFilters" class="text-nowrap">Filter</span>
-                class="-ml-1.5 h-7 w-7 flex-shrink-0"
-                aria-label="Filter projects">
-                <ListFilterIcon class="h-4 w-4 text-icon-default" />
             </Button>
         </DropdownMenuTrigger>
         <DropdownMenuContent align="start" class="w-56">

resources/js/Components/Common/Reporting/ReportingExportModal.vue

@@ -9,7 +9,7 @@ const showExportModal = defineModel('show', { default: false });
 
 function downloadCurrentExport() {
     if (props.exportUrl) {
-        window.open(props.exportUrl, '_self');
+        window.open(props.exportUrl, '_blank')?.focus();
     }
 }
 </script>

resources/js/Components/Common/Reporting/ReportingOverview.vue

@@ -57,7 +57,7 @@ const { handleApiRequestNotifications } = useNotificationsStore();
 
 const startDate = useSessionStorage<string>(
     'reporting-start-date',
-    getLocalizedDayJs(getDayJsInstance()().format()).subtract(13, 'd').format()
+    getLocalizedDayJs(getDayJsInstance()().format()).subtract(14, 'd').format()
 );
 const endDate = useSessionStorage<string>(
     'reporting-end-date',
@@ -240,8 +240,7 @@ const groupedPieChartData = computed(() => {
         aggregatedTableTimeEntries.value?.grouped_data?.map((entry) => {
             const name = getNameForReportingRowEntry(
                 entry.key,
-                aggregatedTableTimeEntries.value?.grouped_type ?? null,
+                aggregatedTableTimeEntries.value?.grouped_type ?? null
-                organization?.value?.date_format
             );
             let color = getRandomColorWithSeed(entry.key ?? 'none');
             if (
@@ -256,7 +255,11 @@ const groupedPieChartData = computed(() => {
             }
             return {
                 value: entry.seconds,
-                name: name ?? '',
+                name:
+                    getNameForReportingRowEntry(
+                        entry.key,
+                        aggregatedTableTimeEntries.value?.grouped_type ?? null
+                    ) ?? '',
                 color: color,
             };
         }) ?? []
@@ -266,25 +269,18 @@ const groupedPieChartData = computed(() => {
 const tableData = computed(() => {
     return aggregatedTableTimeEntries.value?.grouped_data?.map((entry) => {
         return {
-            key: entry.key,
             seconds: entry.seconds,
             cost: entry.cost,
             description: getNameForReportingRowEntry(
                 entry.key,
-                aggregatedTableTimeEntries.value?.grouped_type ?? null,
+                aggregatedTableTimeEntries.value?.grouped_type ?? null
-                organization?.value?.date_format
             ),
             grouped_data:
                 entry.grouped_data?.map((el) => {
                     return {
-                        key: el.key,
                         seconds: el.seconds,
                         cost: el.cost,
-                        description: getNameForReportingRowEntry(
+                        description: getNameForReportingRowEntry(el.key, entry.grouped_type),
-                            el.key,
-                            entry.grouped_type,
-                            organization?.value?.date_format
-                        ),
                     };
                 }) ?? [],
         };
@@ -425,8 +421,9 @@ const tableData = computed(() => {
                         ">
                         <ReportingRow
                             v-for="entry in tableData"
-                            :key="entry.key ?? 'none'"
+                            :key="entry.description ?? 'none'"
                             :currency="getOrganizationCurrencyString()"
+                            :type="aggregatedTableTimeEntries.grouped_type"
                             :show-cost="showBillableRate"
                             :entry="entry"></ReportingRow>
                         <div class="contents [&>*]:transition text-text-tertiary [&>*]:h-[50px]">