bump ui package version

app/Auth/ActiveUserProvider.php

@@ -1,37 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Auth;
-
-use Illuminate\Auth\EloquentUserProvider;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Model;
-
-/**
- * User provider that only resolves non-placeholder users.
- *
- * Placeholder users are created by imports and when members are removed from an
- * organization. They can share an email address with a real user, so resolving a user by
- * email can return a placeholder instead of the real account. The login flow filters them
- * out explicitly, but the password broker and the guard credential checks (for example the
- * password confirmation) resolve users through the configured user provider.
- *
- * Registered as the "eloquent" provider driver in the AuthServiceProvider, so it replaces the
- * built-in one for every provider in config/auth.php.
- */
-class ActiveUserProvider extends EloquentUserProvider
-{
-    /**
-     * @param  Model|null  $model
-     * @return Builder<Model>
-     */
-    #[\Override]
-    protected function newModelQuery($model = null): Builder
-    {
-        $query = parent::newModelQuery($model);
-        $query->getQuery()->where('is_placeholder', '=', false);
-
-        return $query;
-    }
-}

app/Http/Controllers/Api/V1/ChartController.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Enums\Role;
 use App\Models\Organization;
 use App\Service\DashboardService;
 use App\Service\PermissionStore;
@@ -158,7 +159,7 @@ class ChartController extends Controller
         $this->checkPermission($organization, 'charts:view:own');
         $user = $this->user();
 
-        $showBillableRate = $this->canSeeBillableRates($organization);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
         if (! $showBillableRate) {
             throw new AuthorizationException('You do not have permission to view billable rates.');
         }

app/Http/Controllers/Api/V1/Controller.php

@@ -4,8 +4,6 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
-use App\Enums\Role;
-use App\Exceptions\Api\FeatureIsNotAvailableInFreePlanApiException;
 use App\Models\Organization;
 use App\Service\BillingContract;
 use App\Service\PermissionStore;
@@ -51,30 +49,4 @@ class Controller extends \App\Http\Controllers\Controller
     {
         return app(BillingContract::class)->hasSubscription($organization) || app(BillingContract::class)->hasTrial($organization);
     }
-
-    protected function canUseBillableRates(Organization $organization): bool
-    {
-        return app(BillingContract::class)->canUseBillableRates($organization);
-    }
-
-    protected function canSeeBillableRates(Organization $organization): bool
-    {
-        if (! $this->canUseBillableRates($organization)) {
-            return false;
-        }
-
-        return $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
-    }
-
-    /**
-     * Organizations that can not use billable rates may keep or remove an existing rate, but not set a new one
-     *
-     * @throws FeatureIsNotAvailableInFreePlanApiException
-     */
-    protected function checkBillableRateChange(Organization $organization, ?int $oldBillableRate, ?int $newBillableRate): void
-    {
-        if ($newBillableRate !== null && $newBillableRate !== $oldBillableRate && ! $this->canUseBillableRates($organization)) {
-            throw new FeatureIsNotAvailableInFreePlanApiException;
-        }
-    }
 }

app/Http/Controllers/Api/V1/MemberController.php

@@ -83,7 +83,6 @@ class MemberController extends Controller
         $this->checkPermission($organization, 'members:update', $member);
 
         if ($request->has('billable_rate') && $member->billable_rate !== $request->getBillableRate()) {
-            $this->checkBillableRateChange($organization, $member->billable_rate, $request->getBillableRate());
             $member->billable_rate = $request->getBillableRate();
 
             $billableRateService->updateTimeEntriesBillableRateForMember($member);

app/Http/Controllers/Api/V1/OrganizationController.php

@@ -4,8 +4,8 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Enums\Role;
 use App\Events\AfterCreateOrganization;
-use App\Exceptions\Api\FeatureIsNotAvailableInFreePlanApiException;
 use App\Http\Requests\V1\Organization\OrganizationDestroyRequest;
 use App\Http\Requests\V1\Organization\OrganizationStoreRequest;
 use App\Http\Requests\V1\Organization\OrganizationUpdateRequest;
@@ -32,7 +32,7 @@ class OrganizationController extends Controller
     {
         $this->checkPermission($organization, 'organizations:view');
 
-        $showBillableRate = $this->canSeeBillableRates($organization);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         return new OrganizationResource($organization, $showBillableRate);
     }
@@ -54,10 +54,7 @@ class OrganizationController extends Controller
         if ($request->getCurrency() !== null) {
             $organization->currency = $request->getCurrency();
         }
-        if ($request->getEmployeesCanSeeBillableRates() !== null && $request->getEmployeesCanSeeBillableRates() !== $organization->employees_can_see_billable_rates) {
-            if (! $this->canUseBillableRates($organization)) {
-                throw new FeatureIsNotAvailableInFreePlanApiException;
-            }
+        if ($request->getEmployeesCanSeeBillableRates() !== null) {
             $organization->employees_can_see_billable_rates = $request->getEmployeesCanSeeBillableRates();
         }
         if ($request->getEmployeesCanManageTasks() !== null) {
@@ -86,7 +83,6 @@ class OrganizationController extends Controller
         }
         $hasBillableRate = $request->has('billable_rate');
         if ($hasBillableRate) {
-            $this->checkBillableRateChange($organization, $organization->billable_rate, $request->getBillableRate());
             $oldBillableRate = $organization->billable_rate;
             $organization->billable_rate = $request->getBillableRate();
         }

app/Http/Controllers/Api/V1/ProjectController.php

@@ -65,7 +65,7 @@ class ProjectController extends Controller
             ->orderBy('id')
             ->paginate(config('app.pagination_per_page_default'));
 
-        $showBillableRate = $this->canSeeBillableRates($organization);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         return new ProjectCollection($projects, $showBillableRate);
     }
@@ -99,7 +99,6 @@ class ProjectController extends Controller
     public function store(Organization $organization, ProjectStoreRequest $request): JsonResource
     {
         $this->checkPermission($organization, 'projects:create');
-        $this->checkBillableRateChange($organization, null, $request->getBillableRate());
         $project = new Project;
         $project->name = $request->input('name');
         $project->color = $request->input('color');
@@ -126,7 +125,6 @@ class ProjectController extends Controller
     public function update(Organization $organization, Project $project, ProjectUpdateRequest $request, BillableRateService $billableRateService): JsonResource
     {
         $this->checkPermission($organization, 'projects:update', $project);
-        $this->checkBillableRateChange($organization, $project->billable_rate, $request->getBillableRate());
         $project->name = $request->input('name');
         $project->color = $request->input('color');
         $project->is_billable = (bool) $request->input('is_billable');
@@ -141,17 +139,14 @@ class ProjectController extends Controller
         }
         $oldBillableRate = $project->billable_rate;
         $clientIdChanged = false;
-        // Organizations that can not use billable rates do not receive the rate of the project, so the incoming value is ignored to keep the existing rate
-        if ($this->canUseBillableRates($organization)) {
-            $project->billable_rate = $request->getBillableRate();
-        }
+        $project->billable_rate = $request->getBillableRate();
         if ($project->client_id !== $request->input('client_id')) {
             $project->client_id = $request->input('client_id');
             $clientIdChanged = true;
         }
         $project->save();
 
-        if ($oldBillableRate !== $project->billable_rate) {
+        if ($oldBillableRate !== $request->getBillableRate()) {
             $billableRateService->updateTimeEntriesBillableRateForProject($project);
         }
         if ($clientIdChanged) {

app/Http/Controllers/Api/V1/ProjectMemberController.php

@@ -65,7 +65,6 @@ class ProjectMemberController extends Controller
     public function store(Organization $organization, Project $project, ProjectMemberStoreRequest $request, BillableRateService $billableRateService): JsonResource
     {
         $this->checkPermission($organization, 'project-members:create', $project);
-        $this->checkBillableRateChange($organization, null, $request->getBillableRate());
 
         $member = Member::findOrFail((string) $request->input('member_id'));
         if ($member->user->is_placeholder) {
@@ -99,7 +98,6 @@ class ProjectMemberController extends Controller
     public function update(Organization $organization, ProjectMember $projectMember, ProjectMemberUpdateRequest $request, BillableRateService $billableRateService): JsonResource
     {
         $this->checkPermission($organization, 'project-members:update', projectMember: $projectMember);
-        $this->checkBillableRateChange($organization, $projectMember->billable_rate, $request->getBillableRate());
         $oldBillableRate = $projectMember->billable_rate;
         $projectMember->billable_rate = $request->getBillableRate();
         $projectMember->save();

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Api\V1;
 
 use App\Enums\ExportFormat;
+use App\Enums\Role;
 use App\Enums\TimeEntryType;
 use App\Exceptions\Api\FeatureIsNotAvailableInFreePlanApiException;
 use App\Exceptions\Api\OverlappingTimeEntryApiException;
@@ -239,7 +240,7 @@ class TimeEntryController extends Controller
         }
         $user = $this->user();
         $timezone = $user->timezone;
-        $showBillableRate = $this->canSeeBillableRates($organization);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
         $roundingType = $canAccessPremiumFeatures ? $request->getRoundingType() : null;
         $roundingMinutes = $canAccessPremiumFeatures ? $request->getRoundingMinutes() : null;
 
@@ -385,7 +386,7 @@ class TimeEntryController extends Controller
         }
         $canAccessPremiumFeatures = $this->canAccessPremiumFeatures($organization);
         $user = $this->user();
-        $showBillableRate = $this->canSeeBillableRates($organization);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         $group1Type = $request->getGroup();
         $group2Type = $request->getSubGroup();
@@ -440,7 +441,7 @@ class TimeEntryController extends Controller
         }
         $debug = $request->getDebug();
         $user = $this->user();
-        $showBillableRate = $this->canSeeBillableRates($organization);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         $group = $request->getGroup();
         $subGroup = $request->getSubGroup();

app/Http/Middleware/HandleInertiaRequests.php

@@ -57,7 +57,6 @@ class HandleInertiaRequests extends Middleware
                 'has_trial' => $billing->hasTrial($currentOrganization),
                 'trial_until' => $billing->getTrialUntil($currentOrganization)?->toIso8601ZuluString(),
                 'is_blocked' => $billing->isBlocked($currentOrganization),
-                'can_use_billable_rates' => $billing->canUseBillableRates($currentOrganization),
             ] : null,
             'flash' => [
                 'message' => fn () => $request->session()->get('message'),

app/Http/Requests/V1/Import/ImportRequest.php

@@ -24,7 +24,6 @@ class ImportRequest extends BaseFormRequest
             'data' => [
                 'required',
                 'string',
-                'max:'.config('import.max_data_size'),
             ],
         ];
     }

app/Models/User.php

@@ -38,10 +38,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property string|null $pending_email
  * @property Carbon|null $email_verified_at
  * @property string|null $password
- * @property string|null $remember_token
  * @property string|null $two_factor_secret
- * @property string|null $two_factor_recovery_codes
- * @property Carbon|null $two_factor_confirmed_at
  * @property string $timezone
  * @property bool $is_placeholder
  * @property Weekday $week_start
@@ -153,9 +150,7 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
 
     public function canAccessPanel(Panel $panel): bool
     {
-        return $this->is_placeholder === false
-            && in_array($this->email, config('auth.super_admins', []), true)
-            && $this->hasVerifiedEmail();
+        return in_array($this->email, config('auth.super_admins', []), true) && $this->hasVerifiedEmail();
     }
 
     public function isMemberOfOrganization(Organization $organization): bool

app/Providers/AuthServiceProvider.php

@@ -4,14 +4,11 @@ declare(strict_types=1);
 
 namespace App\Providers;
 
-use App\Auth\ActiveUserProvider;
 use App\Models\Passport\AuthCode;
 use App\Models\Passport\Client;
 use App\Models\Passport\RefreshToken;
 use App\Models\Passport\Token;
-use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
-use Illuminate\Support\Facades\Auth;
 use Laravel\Passport\Passport;
 
 class AuthServiceProvider extends ServiceProvider
@@ -29,13 +26,6 @@ class AuthServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        // Replaces the built-in eloquent user provider, so that no authentication flow can
-        // resolve a placeholder user. The driver name is kept, because Passport recognizes
-        // only providers that are configured with the driver "eloquent".
-        Auth::provider('eloquent', function (Application $app, array $config): ActiveUserProvider {
-            return new ActiveUserProvider($app->make('hash'), $config['model']);
-        });
-
         // define scopes for passport tokens
         Passport::tokensCan([
             'create' => 'Create resources',

app/Service/BillingContract.php

@@ -54,13 +54,4 @@ class BillingContract
     {
         return false;
     }
-
-    /**
-     * Check if the organization can set and see billable rates
-     * Without a billing system every organization can use billable rates
-     */
-    public function canUseBillableRates(Organization $organization): bool
-    {
-        return true;
-    }
 }

app/Service/Import/ImportService.php

@@ -9,8 +9,11 @@ use App\Service\Import\Importers\ImporterContract;
 use App\Service\Import\Importers\ImporterProvider;
 use App\Service\Import\Importers\ImportException;
 use App\Service\Import\Importers\ReportDto;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
 
 class ImportService
 {
@@ -22,6 +25,8 @@ class ImportService
         /** @var ImporterContract $importer */
         $importer = app(ImporterProvider::class)->getImporter($importerType);
         $importer->init($organization);
+        Storage::disk(config('filesystems.default'))
+            ->put('import/'.Carbon::now()->toDateString().'-'.$organization->getKey().'-'.Str::uuid(), $data);
 
         $lock = Cache::lock('import:'.$organization->getKey(), config('octane.max_execution_time', 60) + 1);
 

app/Service/Import/Importers/DefaultImporter.php

@@ -14,7 +14,6 @@ use App\Models\Tag;
 use App\Models\Task;
 use App\Models\User;
 use App\Service\BillableRateService;
-use App\Service\BillingContract;
 use App\Service\ColorService;
 use App\Service\Import\ImportDatabaseHelper;
 use App\Service\TimezoneService;
@@ -72,15 +71,9 @@ abstract class DefaultImporter implements ImporterContract
 
     protected BillableRateService $billableRateService;
 
-    /**
-     * Organizations that can not use billable rates import projects, members and project members without billable rates
-     */
-    protected bool $canUseBillableRates;
-
     public function init(Organization $organization): void
     {
         $this->organization = $organization;
-        $this->canUseBillableRates = app(BillingContract::class)->canUseBillableRates($organization);
         $this->userImportHelper = new ImportDatabaseHelper(User::class, ['email'], true, function (Builder $builder) {
             /** @var Builder<User> $builder */
             return $builder->belongsToOrganization($this->organization);
@@ -103,11 +96,7 @@ abstract class DefaultImporter implements ImporterContract
                 'string',
                 'in:placeholder',
             ],
-        ], beforeSave: function (Member $member): void {
-            if (! $this->canUseBillableRates) {
-                $member->billable_rate = null;
-            }
-        });
+        ]);
         $this->projectImportHelper = new ImportDatabaseHelper(Project::class, ['name', 'client_id', 'organization_id'], true, function (Builder $builder) {
             /** @var Builder<Project> $builder */
             return $builder->where('organization_id', $this->organization->id);
@@ -131,7 +120,7 @@ abstract class DefaultImporter implements ImporterContract
                 'uuid',
             ],
         ], beforeSave: function (Project $project): void {
-            if ($project->billable_rate === 0 || ! $this->canUseBillableRates) {
+            if ($project->billable_rate === 0) {
                 $project->billable_rate = null;
             }
         });
@@ -145,7 +134,7 @@ abstract class DefaultImporter implements ImporterContract
                 'max:2147483647',
             ],
         ], beforeSave: function (ProjectMember $projectMember): void {
-            if ($projectMember->billable_rate === 0 || ! $this->canUseBillableRates) {
+            if ($projectMember->billable_rate === 0) {
                 $projectMember->billable_rate = null;
             }
         });

app/Service/Import/Importers/SolidtimeImporter.php

@@ -16,6 +16,7 @@ use Illuminate\Support\Str;
 use League\Csv\Reader;
 use Override;
 use Spatie\TemporaryDirectory\TemporaryDirectory;
+use ZipArchive;
 
 class SolidtimeImporter extends DefaultImporter
 {
@@ -33,10 +34,16 @@ class SolidtimeImporter extends DefaultImporter
         $temporaryDirectoryZip = null;
         $temporaryDirectory = null;
         try {
+            $zip = new ZipArchive;
             $temporaryDirectoryZip = TemporaryDirectory::make();
             file_put_contents($temporaryDirectoryZip->path('import.zip'), $data);
+            $res = $zip->open($temporaryDirectoryZip->path('import.zip'), ZipArchive::RDONLY);
+            if ($res !== true) {
+                throw new ImportException('Invalid ZIP, error code: '.$res);
+            }
             $temporaryDirectory = TemporaryDirectory::make();
-            app(ZipImportHelper::class)->extract($temporaryDirectoryZip->path('import.zip'), $temporaryDirectory->path());
+            $zip->extractTo($temporaryDirectory->path());
+            $zip->close();
 
             if (! file_exists($temporaryDirectory->path('meta.json'))) {
                 throw new ImportException('File "meta.json" missing in ZIP');

app/Service/Import/Importers/TogglDataImporter.php

@@ -13,6 +13,7 @@ use Illuminate\Support\Str;
 use Override;
 use Spatie\TemporaryDirectory\TemporaryDirectory;
 use ValueError;
+use ZipArchive;
 
 class TogglDataImporter extends DefaultImporter
 {
@@ -25,10 +26,16 @@ class TogglDataImporter extends DefaultImporter
         $temporaryDirectoryZip = null;
         $temporaryDirectory = null;
         try {
+            $zip = new ZipArchive;
             $temporaryDirectoryZip = TemporaryDirectory::make();
             file_put_contents($temporaryDirectoryZip->path('import.zip'), $data);
+            $res = $zip->open($temporaryDirectoryZip->path('import.zip'), ZipArchive::RDONLY);
+            if ($res !== true) {
+                throw new ImportException('Invalid ZIP, error code: '.$res);
+            }
             $temporaryDirectory = TemporaryDirectory::make();
-            app(ZipImportHelper::class)->extract($temporaryDirectoryZip->path('import.zip'), $temporaryDirectory->path());
+            $zip->extractTo($temporaryDirectory->path());
+            $zip->close();
             if (! file_exists($temporaryDirectory->path('clients.json'))) {
                 throw new ImportException('File "clients.json" missing in ZIP');
             }

app/Service/Import/Importers/ZipImportHelper.php

@@ -1,129 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Service\Import\Importers;
-
-use ZipArchive;
-
-/**
- * Extracts uploaded ZIP archives with limits on file count, total uncompressed
- * size and entry paths, so a small malicious archive can not fill the disk
- * (decompression bomb) or write outside the target directory (zip slip).
- */
-class ZipImportHelper
-{
-    private const int CHUNK_SIZE = 1024 * 1024;
-
-    /**
-     * @throws ImportException
-     */
-    public function extract(string $zipPath, string $targetPath): void
-    {
-        $zip = new ZipArchive;
-        $res = $zip->open($zipPath, ZipArchive::RDONLY);
-        if ($res !== true) {
-            throw new ImportException('Invalid ZIP, error code: '.$res);
-        }
-
-        try {
-            $maxFiles = (int) config('import.zip_max_files');
-            $maxUncompressedSize = (int) config('import.zip_max_uncompressed_size');
-
-            if ($zip->numFiles > $maxFiles) {
-                throw new ImportException('ZIP contains too many files, maximum is '.$maxFiles);
-            }
-
-            // Check the sizes declared in the archive before writing anything to disk
-            $declaredSize = 0;
-            for ($index = 0; $index < $zip->numFiles; $index++) {
-                $stat = $zip->statIndex($index);
-                if ($stat === false) {
-                    throw new ImportException('Invalid ZIP entry');
-                }
-                $this->validateEntryName($stat['name']);
-                $declaredSize += $stat['size'];
-                if ($declaredSize > $maxUncompressedSize) {
-                    throw new ImportException('ZIP uncompressed size exceeds the maximum of '.$maxUncompressedSize.' bytes');
-                }
-            }
-
-            // The declared sizes can be forged, so the written bytes are counted as well
-            $writtenSize = 0;
-            for ($index = 0; $index < $zip->numFiles; $index++) {
-                $stat = $zip->statIndex($index);
-                if ($stat === false) {
-                    throw new ImportException('Invalid ZIP entry');
-                }
-                $name = $stat['name'];
-                $entryPath = $targetPath.DIRECTORY_SEPARATOR.$name;
-
-                if (str_ends_with($name, '/')) {
-                    $this->ensureDirectoryExists($entryPath);
-
-                    continue;
-                }
-                $this->ensureDirectoryExists(dirname($entryPath));
-
-                $stream = $zip->getStreamIndex($index);
-                if ($stream === false) {
-                    throw new ImportException('ZIP entry "'.$name.'" can not be read');
-                }
-                $target = fopen($entryPath, 'wb');
-                if ($target === false) {
-                    fclose($stream);
-                    throw new ImportException('ZIP entry "'.$name.'" can not be extracted');
-                }
-                try {
-                    while (! feof($stream)) {
-                        $chunk = fread($stream, self::CHUNK_SIZE);
-                        if ($chunk === false) {
-                            throw new ImportException('ZIP entry "'.$name.'" can not be read');
-                        }
-                        $writtenSize += strlen($chunk);
-                        if ($writtenSize > $maxUncompressedSize) {
-                            throw new ImportException('ZIP uncompressed size exceeds the maximum of '.$maxUncompressedSize.' bytes');
-                        }
-                        fwrite($target, $chunk);
-                    }
-                } finally {
-                    fclose($target);
-                    fclose($stream);
-                }
-            }
-        } finally {
-            $zip->close();
-        }
-    }
-
-    /**
-     * @throws ImportException
-     */
-    private function validateEntryName(string $name): void
-    {
-        if ($name === '' || str_contains($name, "\0") || str_contains($name, '\\') || str_starts_with($name, '/')) {
-            throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
-        }
-        if (preg_match('/^[a-zA-Z]:/', $name) === 1) {
-            throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
-        }
-        foreach (explode('/', rtrim($name, '/')) as $segment) {
-            if ($segment === '' || $segment === '..') {
-                throw new ImportException('ZIP contains an invalid file path: "'.$name.'"');
-            }
-        }
-    }
-
-    /**
-     * @throws ImportException
-     */
-    private function ensureDirectoryExists(string $path): void
-    {
-        if (is_dir($path)) {
-            return;
-        }
-        if (! mkdir($path, 0700, true) && ! is_dir($path)) {
-            throw new ImportException('Directory "'.$path.'" can not be created');
-        }
-    }
-}

app/Service/MemberService.php

@@ -218,16 +218,7 @@ class MemberService
 
         $placeholderUser = $user->replicate();
         $placeholderUser->is_placeholder = true;
-        // Reset authentication relevant properties on the placeholder user
-        $placeholderUser->password = null;
-        $placeholderUser->remember_token = null;
-        $placeholderUser->two_factor_secret = null;
-        $placeholderUser->two_factor_recovery_codes = null;
-        $placeholderUser->two_factor_confirmed_at = null;
-        $placeholderUser->email_verified_at = null;
-        $placeholderUser->pending_email = null;
-        $placeholderUser->current_team_id = null;
-        $placeholderUser->profile_photo_path = null;
+        $placeholderUser->current_team_id = $member->organization_id;
         $placeholderUser->save();
 
         $member->user()->associate($placeholderUser);

config/import.php

@@ -1,34 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-return [
-
-    /*
-    |--------------------------------------------------------------------------
-    | Import payload limit
-    |--------------------------------------------------------------------------
-    |
-    | Maximum length of the base64 encoded "data" field of an import request in
-    | bytes. Requests with a larger payload are rejected with a validation error.
-    |
-    */
-
-    'max_data_size' => (int) (env('IMPORT_MAX_DATA_SIZE') ?: 50 * 1024 * 1024),
-
-    /*
-    |--------------------------------------------------------------------------
-    | ZIP extraction limits
-    |--------------------------------------------------------------------------
-    |
-    | Limits applied to ZIP based importers before and during extraction to
-    | protect the instance against decompression bombs. The uncompressed size
-    | is the sum of all files in the archive in bytes.
-    |
-    */
-
-    'zip_max_files' => (int) (env('IMPORT_ZIP_MAX_FILES') ?: 100),
-
-    'zip_max_uncompressed_size' => (int) (env('IMPORT_ZIP_MAX_UNCOMPRESSED_SIZE') ?: 500 * 1024 * 1024),
-
-];

database/migrations/2026_09_16_000001_remove_credentials_from_placeholder_users.php

@@ -1,53 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Query\Builder;
-use Illuminate\Support\Facades\DB;
-
-return new class extends Migration
-{
-    /**
-     * Placeholder users used to be created as a full copy of the user they were made from,
-     * which included the credentials and the account state of that user. A placeholder is a
-     * stand-in for a person in one organization, not an account, and the row shares the email
-     * address with the real account, so these values are removed from the placeholders that
-     * already exist. The organization a placeholder belongs to is recorded on its member row.
-     */
-    public function up(): void
-    {
-        DB::table('users')
-            ->where('is_placeholder', '=', true)
-            ->where(function (Builder $builder): void {
-                $builder->whereNotNull('password')
-                    ->orWhereNotNull('remember_token')
-                    ->orWhereNotNull('two_factor_secret')
-                    ->orWhereNotNull('two_factor_recovery_codes')
-                    ->orWhereNotNull('two_factor_confirmed_at')
-                    ->orWhereNotNull('email_verified_at')
-                    ->orWhereNotNull('pending_email')
-                    ->orWhereNotNull('current_team_id')
-                    ->orWhereNotNull('profile_photo_path');
-            })
-            ->update([
-                'password' => null,
-                'remember_token' => null,
-                'two_factor_secret' => null,
-                'two_factor_recovery_codes' => null,
-                'two_factor_confirmed_at' => null,
-                'email_verified_at' => null,
-                'pending_email' => null,
-                'current_team_id' => null,
-                'profile_photo_path' => null,
-            ]);
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        //
-    }
-};

extensions/manifest.json

@@ -9,6 +9,6 @@
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
-        "ref": "v0.0.6"
+        "ref": "v0.0.5"
     }
 }

resources/js/Components/Common/Member/MemberEditModal.vue

@@ -21,7 +21,6 @@ import { getOrganizationCurrencyString } from '@/utils/money';
 import BillableIcon from '@/packages/ui/src/Icons/BillableIcon.vue';
 import { useOrganizationQuery } from '@/utils/useOrganizationQuery';
 import { getCurrentOrganizationId } from '@/utils/useUser';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 
 const { updateMember } = useMembersStore();
 const { organization } = useOrganizationQuery(getCurrentOrganizationId()!);
@@ -72,8 +71,6 @@ function saveWithChecks() {
     }
 }
 
-const { locked: billableRatesLocked } = useBillableRatesLock();
-
 const billableRateSelect = ref<MemberBillableKey>('default-rate');
 
 onMounted(() => {
@@ -162,12 +159,7 @@ const roleDescription = computed(() => {
                         <FieldLabel :icon="BillableIcon" for="billableRateType"
                             >Billable Rate</FieldLabel
                         >
-                        <BillableRateInput
-                            v-if="billableRatesLocked"
-                            v-model="displayedRate"
-                            :currency="getOrganizationCurrencyString()"
-                            name="memberBillableRate" />
-                        <div v-else class="grid grid-cols-1 sm:grid-cols-2 gap-2">
+                        <div class="grid grid-cols-1 sm:grid-cols-2 gap-2">
                             <Select v-model="billableRateSelect">
                                 <SelectTrigger id="billableRateType">
                                     <SelectValue />

resources/js/Components/Common/Member/MemberTableHeading.vue

@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import TableHeading from '@/Components/Common/TableHeading.vue';
 import SortableTableHeaderCell from '@/Components/Common/SortableTableHeaderCell.vue';
 import type { SortColumn, SortDirection } from '@/Components/Common/Member/MemberTable.vue';
@@ -14,8 +12,6 @@ const props = defineProps<{
 defineEmits<{
     sort: [column: SortColumn];
 }>();
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -37,10 +33,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
             column="billable_rate"
             v-bind="props"
             @sort="$emit('sort', $event)">
-            <span class="inline-flex items-center gap-2 whitespace-nowrap">
-                Billable Rate
-                <UpgradeLockedBadge v-if="billableRatesLocked" />
-            </span>
+            Billable Rate
         </SortableTableHeaderCell>
         <SortableTableHeaderCell column="status" v-bind="props" @sort="$emit('sort', $event)">
             Status

resources/js/Components/Common/Member/MemberTableRow.vue

@@ -1,5 +1,4 @@
 <script setup lang="ts">
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import type { Member, Organization } from '@/packages/api/src';
 import { api } from '@/packages/api/src';
 import { CheckCircleIcon, UserCircleIcon } from '@heroicons/vue/24/outline';
@@ -26,7 +25,6 @@ import MemberEditModal from '@/Components/Common/Member/MemberEditModal.vue';
 import MemberMergeModal from '@/Components/Common/Member/MemberMergeModal.vue';
 import MemberMakePlaceholderModal from '@/Components/Common/Member/MemberMakePlaceholderModal.vue';
 import MemberDeleteModal from '@/Components/Common/Member/MemberDeleteModal.vue';
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
 import { capitalizeFirstLetter } from '../../../utils/format';
 import { formatCents } from '../../../packages/ui/src/utils/money';
 import {
@@ -73,8 +71,6 @@ async function invitePlaceholder(id: string) {
 const userHasValidMailAddress = computed(() => {
     return !props.member.email.endsWith('@solidtime-import.test');
 });
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -94,8 +90,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
                     {{ capitalizeFirstLetter(member.role) }}
                 </div>
                 <div class="whitespace-nowrap px-3 py-4 text-sm text-text-primary">
-                    <UpgradeLockedBadge v-if="billableRatesLocked" />
-                    <span v-else-if="member.billable_rate">
+                    <span v-if="member.billable_rate">
                         {{
                             formatCents(
                                 member.billable_rate,

resources/js/Components/Common/Project/ProjectEditModal.vue

@@ -23,10 +23,8 @@ import ProjectVisibilitySelect from '@/packages/ui/src/Project/ProjectVisibility
 import { isAllowedToPerformPremiumAction } from '@/utils/billing';
 import { useOrganizationQuery } from '@/utils/useOrganizationQuery';
 import { getCurrentOrganizationId } from '@/utils/useUser';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 
 const { updateProject } = useProjectsStore();
-const { locked: billableRatesLocked } = useBillableRatesLock();
 const { clients } = useClientsQuery();
 const { organization } = useOrganizationQuery(getCurrentOrganizationId()!);
 const show = defineModel('show', { default: false });
@@ -50,11 +48,6 @@ const project = ref<CreateProjectBody>({
     is_public: props.originalProject.is_public,
 });
 
-// Locked organizations do not receive the rate of the project, so sending it back would remove the existing rate
-function getUpdateBody() {
-    const { billable_rate: billableRate, ...body } = project.value;
-    return billableRatesLocked.value ? body : { ...body, billable_rate: billableRate };
-}
 async function submit() {
     if (props.originalProject.billable_rate !== project.value.billable_rate) {
         // make sure that the alert modal is not immediately submitted when user presses enter
@@ -63,7 +56,7 @@ async function submit() {
         }, 0);
         return;
     }
-    await updateProject(props.originalProject.id, getUpdateBody());
+    await updateProject(props.originalProject.id, project.value);
     show.value = false;
 }
 
@@ -79,7 +72,7 @@ const currentClientName = computed(() => {
 });
 
 async function submitBillableRate() {
-    await updateProject(props.originalProject.id, getUpdateBody());
+    await updateProject(props.originalProject.id, project.value);
     show.value = false;
     showBillableRateModal.value = false;
 }

resources/js/Components/Common/Project/ProjectTableHeading.vue

@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import { computed } from 'vue';
 import TableHeading from '@/Components/Common/TableHeading.vue';
 import SortableTableHeaderCell from '@/Components/Common/SortableTableHeaderCell.vue';
@@ -27,8 +25,6 @@ const sortState = computed(() => ({
 function handleSort(column: SortColumn) {
     emit('sort', column);
 }
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -54,10 +50,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
             column="billable_rate"
             v-bind="sortState"
             @sort="handleSort">
-            <span class="inline-flex items-center gap-2 whitespace-nowrap">
-                Billable Rate
-                <UpgradeLockedBadge v-if="billableRatesLocked" />
-            </span>
+            Billable Rate
         </SortableTableHeaderCell>
         <SortableTableHeaderCell column="status" v-bind="sortState" @sort="handleSort">
             Status

resources/js/Components/Common/Project/ProjectTableRow.vue

@@ -1,5 +1,4 @@
 <script setup lang="ts">
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import ProjectMoreOptionsDropdown from '@/Components/Common/Project/ProjectMoreOptionsDropdown.vue';
 import type { Project } from '@/packages/api/src';
 import { computed, ref, inject, type ComputedRef } from 'vue';
@@ -16,7 +15,6 @@ import { useTasksQuery } from '@/utils/useTasksQuery';
 import { useProjectsStore } from '@/utils/useProjects';
 import TableRow from '@/Components/TableRow.vue';
 import ProjectEditModal from '@/Components/Common/Project/ProjectEditModal.vue';
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
 import { formatCents } from '@/packages/ui/src/utils/money';
 import { getOrganizationCurrencyString } from '@/utils/money';
 import EstimatedTimeProgress from '@/packages/ui/src/EstimatedTimeProgress.vue';
@@ -54,11 +52,8 @@ function deleteProject() {
 }
 
 function archiveProject() {
-    // Locked organizations do not receive the rate of the project, so sending it back would remove the existing rate
-    const { billable_rate: billableRate, ...project } = props.project;
     useProjectsStore().updateProject(props.project.id, {
-        ...project,
-        ...(billableRatesLocked.value ? {} : { billable_rate: billableRate }),
+        ...props.project,
         is_archived: !props.project.is_archived,
     });
 }
@@ -83,8 +78,6 @@ const billableRateInfo = computed(() => {
 });
 
 const showEditProjectModal = ref(false);
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -136,8 +129,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
                 <div
                     v-if="showBillableRate"
                     class="whitespace-nowrap px-3 py-4 text-sm text-text-primary">
-                    <UpgradeLockedBadge v-if="billableRatesLocked" />
-                    <span v-else-if="billableRateInfo">{{ billableRateInfo }}</span>
+                    <span v-if="billableRateInfo">{{ billableRateInfo }}</span>
                     <span v-else class="text-text-tertiary">--</span>
                 </div>
                 <div

resources/js/Components/Common/ProjectMember/ProjectMemberTableHeading.vue

@@ -1,9 +1,5 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import TableHeading from '@/Components/Common/TableHeading.vue';
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -11,10 +7,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
         <div class="py-1.5 pr-3 text-left text-text-tertiary pl-4 sm:pl-6 lg:pl-8 3xl:pl-12">
             Name
         </div>
-        <div class="px-3 py-1.5 text-left text-text-tertiary flex items-center gap-2">
-            Billable Rate
-            <UpgradeLockedBadge v-if="billableRatesLocked" />
-        </div>
+        <div class="px-3 py-1.5 text-left text-text-tertiary">Billable Rate</div>
         <div class="px-3 py-1.5 text-left text-text-tertiary">Role</div>
         <div class="relative py-1.5 pl-3 pr-4 sm:pr-6 lg:pr-8 3xl:pr-12">
             <span class="sr-only">Edit</span>

resources/js/Components/Common/ProjectMember/ProjectMemberTableRow.vue

@@ -1,5 +1,4 @@
 <script setup lang="ts">
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import type { ProjectMember } from '@/packages/api/src';
 import { computed, ref, inject, type ComputedRef } from 'vue';
 import TableRow from '@/Components/TableRow.vue';
@@ -11,7 +10,6 @@ import { capitalizeFirstLetter } from '@/utils/format';
 import ProjectMemberEditModal from '@/Components/Common/ProjectMember/ProjectMemberEditModal.vue';
 import { getOrganizationCurrencyString } from '@/utils/money';
 import type { Organization } from '@/packages/api/src';
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
 
 const props = defineProps<{
     projectMember: ProjectMember;
@@ -35,8 +33,6 @@ const member = computed(() => {
     return members.value.find((member) => member.id === props.projectMember.member_id);
 });
 const showEditModal = ref(false);
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -52,20 +48,17 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
             </span>
         </div>
         <div class="whitespace-nowrap px-3 py-4 text-sm text-text-secondary">
-            <UpgradeLockedBadge v-if="billableRatesLocked" />
-            <span v-else>
-                {{
-                    projectMember.billable_rate
-                        ? formatCents(
-                              projectMember.billable_rate,
-                              getOrganizationCurrencyString(),
-                              organization?.currency_format,
-                              organization?.currency_symbol,
-                              organization?.number_format
-                          )
-                        : '--'
-                }}
-            </span>
+            {{
+                projectMember.billable_rate
+                    ? formatCents(
+                          projectMember.billable_rate,
+                          getOrganizationCurrencyString(),
+                          organization?.currency_format,
+                          organization?.currency_symbol,
+                          organization?.number_format
+                      )
+                    : '--'
+            }}
         </div>
         <div class="whitespace-nowrap px-3 py-4 text-sm text-text-secondary">
             {{ capitalizeFirstLetter(member?.role ?? '') }}

resources/js/Components/Common/Reporting/ReportingOverview.vue

@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import {
     ChartBarIcon,
     ArrowDownTrayIcon,
@@ -292,8 +290,6 @@ const tableData = computed(() => {
         };
     });
 });
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -420,12 +416,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
                         <div class="text-right" :class="!showBillableRate ? 'pr-6' : ''">
                             Duration
                         </div>
-                        <div
-                            v-if="showBillableRate"
-                            class="flex items-center justify-end gap-2 pr-6">
-                            <UpgradeLockedBadge v-if="billableRatesLocked" />
-                            Cost
-                        </div>
+                        <div v-if="showBillableRate" class="text-right pr-6">Cost</div>
                     </div>
                     <template
                         v-if="

resources/js/Components/Common/StatCard.vue

@@ -9,7 +9,7 @@ defineProps<{
     <div class="rounded-lg bg-card-background border-card-border shadow-card border px-3.5 py-2.5">
         <dt class="font-medium text-sm text-text-secondary">{{ title }}</dt>
         <dd class="text-xl text-text-primary pt-1 font-medium">
-            <slot>{{ value ?? '--' }}</slot>
+            {{ value ?? '--' }}
         </dd>
     </div>
 </template>

resources/js/Components/Dashboard/ActivityGraphCard.vue

@@ -63,7 +63,7 @@ const max = computed(() => {
 });
 
 const backgroundColor = useCssVariable('--theme-color-card-background');
-const borderColor = useCssVariable('--color-border-secondary');
+const borderColor = useCssVariable('--color-border');
 const labelColor = useCssVariable('--color-text-secondary');
 const chartColorRaw = useCssVariable('--theme-color-chart');
 

resources/js/Components/Dashboard/ThisWeekOverview.vue

@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import { use } from 'echarts/core';
 import { CanvasRenderer } from 'echarts/renderers';
 import { BarChart } from 'echarts/charts';
@@ -103,8 +101,6 @@ const { data: totalWeeklyBillableTime } = useQuery({
     staleTime: 1000 * 30, // 30 seconds
 });
 
-const { locked: billableRatesLocked } = useBillableRatesLock();
-
 const { data: totalWeeklyBillableAmount } = useQuery({
     queryKey: ['totalWeeklyBillableAmount', organizationId],
     queryFn: () => {
@@ -114,7 +110,7 @@ const { data: totalWeeklyBillableAmount } = useQuery({
             },
         });
     },
-    enabled: computed(() => !!organizationId.value && !billableRatesLocked.value),
+    enabled: computed(() => !!organizationId.value),
     staleTime: 1000 * 30, // 30 seconds
 });
 
@@ -274,11 +270,7 @@ const option = computed(() => {
                           )
                         : '--'
                 " />
-            <StatCard v-if="billableRatesLocked" title="Billable Amount">
-                <UpgradeLockedBadge />
-            </StatCard>
             <StatCard
-                v-else
                 title="Billable Amount"
                 :value="
                     totalWeeklyBillableAmount

resources/js/Components/Dashboard/ThisWeekReportingTable.vue

@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import ReportingRow from '@/Components/Common/Reporting/ReportingRow.vue';
 import ReportingGroupBySelect from '@/Components/Common/Reporting/ReportingGroupBySelect.vue';
 import {
@@ -128,8 +126,6 @@ const showBillableRate = computed(() => {
         getCurrentRole() !== 'employee' || organization?.value?.employees_can_see_billable_rates
     );
 });
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -155,10 +151,7 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
                 class="contents [&>*]:border-card-background-separator [&>*]:border-b [&>*]:pb-1.5 [&>*]:pt-1 text-text-tertiary text-sm">
                 <div class="pl-6">Name</div>
                 <div class="text-right" :class="!showBillableRate ? 'pr-6' : ''">Duration</div>
-                <div v-if="showBillableRate" class="flex items-center justify-end gap-2 pr-6">
-                    <UpgradeLockedBadge v-if="billableRatesLocked" />
-                    Cost
-                </div>
+                <div v-if="showBillableRate" class="text-right pr-6">Cost</div>
             </div>
 
             <div

resources/js/Layouts/AppLayout.vue

@@ -23,7 +23,7 @@ import { PanelLeft } from '@lucide/vue';
 import NavigationSidebarItem from '@/Components/NavigationSidebarItem.vue';
 import UserSettingsIcon from '@/Components/UserSettingsIcon.vue';
 import MainContainer from '@/packages/ui/src/MainContainer.vue';
-import { computed, nextTick, onMounted, provide, ref } from 'vue';
+import { nextTick, onMounted, provide, ref } from 'vue';
 import NotificationContainer from '@/Components/NotificationContainer.vue';
 import { initializeStores } from '@/utils/init';
 import { useCurrentTimeEntryStore } from '@/utils/useCurrentTimeEntry';
@@ -37,9 +37,7 @@ import {
     canViewReport,
     canViewTags,
 } from '@/utils/permissions';
-import { canUseBillableRates, isBillingActivated, isInvoicingActivated } from '@/utils/billing';
-import UpgradeModal from '@/Components/Common/UpgradeModal.vue';
-import { billableRatesLockKey } from '@/packages/ui/src/utils/useBillableRatesLock';
+import { isBillingActivated, isInvoicingActivated } from '@/utils/billing';
 import type { User } from '@/types/models';
 import { ArrowsRightLeftIcon } from '@heroicons/vue/16/solid';
 import { fetchToken, isTokenValid } from '@/utils/session';
@@ -90,14 +88,6 @@ const { organization, isLoading: isOrganizationLoading } = useOrganizationQuery(
 
 provide('organization', organization);
 
-const showBillableRatesUpgradeModal = ref(false);
-provide(billableRatesLockKey, {
-    locked: computed(() => !canUseBillableRates()),
-    requestUpgrade: () => {
-        showBillableRatesUpgradeModal.value = true;
-    },
-});
-
 onMounted(async () => {
     useTheme();
     // make sure that the initial requests are only loaded once, this can be removed once we move away from inertia
@@ -387,7 +377,4 @@ const page = usePage<{
     <NotificationContainer></NotificationContainer>
     <UserTimezoneMismatchModal></UserTimezoneMismatchModal>
     <CommandPaletteProvider></CommandPaletteProvider>
-    <UpgradeModal v-model:show="showBillableRatesUpgradeModal">
-        <strong>Billable Rates</strong> are only available in solidtime Professional.
-    </UpgradeModal>
 </template>

resources/js/Pages/ProjectShow.vue

@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import UpgradeLockedBadge from '@/packages/ui/src/UpgradeLockedBadge.vue';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 import MainContainer from '@/packages/ui/src/MainContainer.vue';
 import AppLayout from '@/Layouts/AppLayout.vue';
 import { FolderIcon, PlusIcon } from '@heroicons/vue/20/solid';
@@ -82,8 +80,6 @@ const shownTasks = computed(() => {
         return task.project_id === projectId && task.is_done;
     });
 });
-
-const { locked: billableRatesLocked } = useBillableRatesLock();
 </script>
 
 <template>
@@ -121,17 +117,11 @@ const { locked: billableRatesLocked } = useBillableRatesLock();
                     </li>
                 </ol>
                 <div class="px-4 space-x-1">
-                    <UpgradeLockedBadge v-if="billableRatesLocked"
-                        >Billable Rates</UpgradeLockedBadge
-                    >
-                    <Badge v-else-if="project?.billable_rate">
+                    <Badge v-if="project?.billable_rate">
                         {{ billableRateFormatted }}
                         / h
                     </Badge>
-                    <Badge
-                        v-if="
-                            project?.is_billable && !project?.billable_rate && !billableRatesLocked
-                        ">
+                    <Badge v-if="project?.is_billable && !project?.billable_rate">
                         Default Rate
                     </Badge>
                     <Badge v-if="!project?.is_billable"> Non-Billable </Badge>

resources/js/Pages/Teams/Partials/OrganizationBillableRate.vue

@@ -10,12 +10,10 @@ import { storeToRefs } from 'pinia';
 import OrganizationBillableRateModal from '@/Components/Common/Organization/OrganizationBillableRateModal.vue';
 import { getOrganizationCurrencyString } from '@/utils/money';
 import { Checkbox } from '@/packages/ui/src';
-import { useBillableRatesLock } from '@/packages/ui/src/utils/useBillableRatesLock';
 
 const store = useOrganizationStore();
 const { fetchOrganization, updateOrganization } = store;
 const { organization } = storeToRefs(store);
-const { locked: billableRatesLocked, requestUpgrade } = useBillableRatesLock();
 const saving = ref(false);
 const organizationBody = ref<UpdateOrganizationBody>({
     name: '',
@@ -77,8 +75,9 @@ function checkForConfirmationModal() {
                     <Checkbox
                         v-if="organization"
                         id="organizationShowBillableRatesToEmployees"
-                        v-model:checked="organizationBody.employees_can_see_billable_rates"
-                        :disabled="billableRatesLocked"></Checkbox>
+                        v-model:checked="
+                            organizationBody.employees_can_see_billable_rates
+                        "></Checkbox>
                     <FieldLabel for="organizationShowBillableRatesToEmployees"
                         >Show Billable Rates to Employees</FieldLabel
                     >
@@ -86,10 +85,7 @@ function checkForConfirmationModal() {
             </div>
         </template>
         <template #actions>
-            <PrimaryButton v-if="billableRatesLocked" @click="requestUpgrade"
-                >Upgrade</PrimaryButton
-            >
-            <PrimaryButton v-else @click="checkForConfirmationModal">Save</PrimaryButton>
+            <PrimaryButton @click="checkForConfirmationModal">Save</PrimaryButton>
         </template>
     </FormSection>
 </template>

resources/js/packages/ui/src/CommandPalette/CommandPalette.vue

@@ -11,7 +11,6 @@ import {
     CommandShortcut,
 } from '../command';
 import { cn } from '../utils/cn';
-import { useDialogFocusRestore } from '../utils/useDialogFocusRestore';
 import type {
     CommandPaletteCommand,
     CommandPaletteGroup,
@@ -37,8 +36,6 @@ const emit = defineEmits<{
     select: [command: CommandPaletteCommand | EntitySearchResult];
 }>();
 
-const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
-
 // Non-empty groups for rendering
 const nonEmptyGroups = computed(() => props.groups.filter((g) => g.commands.length > 0));
 
@@ -74,9 +71,7 @@ watch(open, (isOpen) => {
                     )
                 ">
                 <DialogContent
-                    class="pointer-events-auto bg-default-background w-full max-w-lg border border-border-tertiary shadow-lg sm:rounded-lg outline-none overflow-hidden p-0 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95"
-                    @open-auto-focus="onOpenAutoFocus"
-                    @close-auto-focus="onCloseAutoFocus">
+                    class="pointer-events-auto bg-default-background w-full max-w-lg border border-border-tertiary shadow-lg sm:rounded-lg outline-none overflow-hidden p-0 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95">
                     <CommandRoot
                         v-model:search-term="searchTerm"
                         class="[&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group-heading]]:text-muted-foreground [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-group]]:px-2 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">

resources/js/packages/ui/src/Input/BillableRateInput.vue

@@ -8,8 +8,6 @@ import {
     NumberFieldIncrement,
     NumberFieldInput,
 } from '..';
-import UpgradeLockedField from './UpgradeLockedField.vue';
-import { useBillableRatesLock } from '../utils/useBillableRatesLock';
 
 const props = defineProps<{
     name: string;
@@ -22,8 +20,6 @@ const model = defineModel<number | null>({
     default: null,
 });
 
-const { locked } = useBillableRatesLock();
-
 const billableRateInput = ref<HTMLInputElement | null>(null);
 useFocus(billableRateInput, { initialValue: props.focus });
 
@@ -34,9 +30,7 @@ function formatValue(modelValue: number | null) {
 
 <template>
     <div class="relative">
-        <UpgradeLockedField v-if="locked" />
         <NumberField
-            v-else
             :id="name"
             ref="billableRateInput"
             :model-value="formatValue(model)"

resources/js/packages/ui/src/Input/UpgradeLockedField.vue

@@ -1,23 +0,0 @@
-<script setup lang="ts">
-import { LockClosedIcon } from '@heroicons/vue/20/solid';
-import { useBillableRatesLock } from '../utils/useBillableRatesLock';
-
-const { requestUpgrade } = useBillableRatesLock();
-</script>
-
-<template>
-    <button
-        type="button"
-        data-testid="billable_rates_locked"
-        class="flex h-9 w-full items-center justify-between gap-2 rounded-md border border-input-border bg-input-background px-3 text-left text-sm text-text-tertiary shadow-sm transition hover:border-border-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-        @click.prevent.stop="requestUpgrade">
-        <span class="flex min-w-0 items-center gap-2">
-            <LockClosedIcon class="w-3.5 shrink-0 text-icon-default" />
-            <span class="truncate"><slot>Billable rates</slot></span>
-        </span>
-        <span
-            class="shrink-0 rounded border border-border-secondary bg-secondary px-2 py-0.5 text-xs font-semibold text-text-secondary">
-            Upgrade
-        </span>
-    </button>
-</template>

resources/js/packages/ui/src/Project/ProjectEditBillableSection.vue

@@ -10,15 +10,12 @@ import {
 } from '@/packages/ui/src/tooltip';
 import { computed, onMounted, ref, watch } from 'vue';
 import BillableIcon from '@/packages/ui/src/Icons/BillableIcon.vue';
-import { useBillableRatesLock } from '../utils/useBillableRatesLock';
 
 const props = defineProps<{
     currency: string;
     organizationBillableRate: number | null;
 }>();
 
-const { locked: billableRatesLocked } = useBillableRatesLock();
-
 type RateType = 'default-rate' | 'custom-rate';
 
 const billableDefault = ref<'billable' | 'non-billable'>('non-billable');
@@ -94,12 +91,7 @@ const emit = defineEmits(['submit']);
     </Field>
     <Field>
         <FieldLabel :icon="BillableIcon" for="billableRateType">Billable Rate</FieldLabel>
-        <BillableRateInput
-            v-if="billableRatesLocked"
-            v-model="displayedRate"
-            :currency="currency"
-            name="billableRate" />
-        <div v-else class="grid grid-cols-1 sm:grid-cols-2 gap-2">
+        <div class="grid grid-cols-1 sm:grid-cols-2 gap-2">
             <Select v-model="rateType">
                 <SelectTrigger id="billableRateType">
                     <SelectValue />

resources/js/packages/ui/src/UpgradeLockedBadge.vue

@@ -1,17 +0,0 @@
-<script setup lang="ts">
-import { LockClosedIcon } from '@heroicons/vue/20/solid';
-import { useBillableRatesLock } from './utils/useBillableRatesLock';
-
-const { requestUpgrade } = useBillableRatesLock();
-</script>
-
-<template>
-    <button
-        type="button"
-        data-testid="billable_rates_locked_badge"
-        class="inline-flex items-center space-x-1 rounded border border-border-secondary bg-secondary px-2 py-1 hover:border-border-tertiary hover:bg-tertiary"
-        @click.prevent.stop="requestUpgrade">
-        <LockClosedIcon class="w-3 text-text-tertiary"></LockClosedIcon>
-        <span class="text-xs font-semibold text-text-secondary"><slot>Upgrade</slot></span>
-    </button>
-</template>

resources/js/packages/ui/src/dialog/DialogContent.vue

@@ -1,6 +1,5 @@
 <script setup lang="ts">
 import { cn } from '../utils/cn';
-import { useDialogFocusRestore } from '../utils/useDialogFocusRestore';
 import {
     DialogContent,
     type DialogContentEmits,
@@ -21,10 +20,6 @@ const delegatedProps = computed(() => {
 });
 
 const forwarded = useForwardPropsEmits(delegatedProps, emits);
-
-// Forwarded consumer listeners run first, so a consumer can still take over
-// by calling preventDefault() on close-auto-focus.
-const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
 </script>
 
 <template>
@@ -41,9 +36,7 @@ const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
                             'my-3 md:my-14 xl:my-24 bg-default-background grid w-full max-w-lg border border-border-tertiary shadow-lg duration-200 rounded-lg outline-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
                             props.class
                         )
-                    "
-                    @open-auto-focus="onOpenAutoFocus"
-                    @close-auto-focus="onCloseAutoFocus">
+                    ">
                     <slot />
                 </DialogContent>
             </div>

resources/js/packages/ui/src/dialog/DialogScrollContent.vue

@@ -1,6 +1,5 @@
 <script setup lang="ts">
 import { cn } from '../utils/cn';
-import { useDialogFocusRestore } from '../utils/useDialogFocusRestore';
 import { X } from '@lucide/vue';
 import {
     DialogClose,
@@ -23,10 +22,6 @@ const delegatedProps = computed(() => {
 });
 
 const forwarded = useForwardPropsEmits(delegatedProps, emits);
-
-// Forwarded consumer listeners run first, so a consumer can still take over
-// by calling preventDefault() on close-auto-focus.
-const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
 </script>
 
 <template>
@@ -41,8 +36,6 @@ const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
                     )
                 "
                 v-bind="forwarded"
-                @open-auto-focus="onOpenAutoFocus"
-                @close-auto-focus="onCloseAutoFocus"
                 @pointer-down-outside="
                     (event) => {
                         const originalEvent = event.detail.originalEvent;

resources/js/packages/ui/src/index.ts

@@ -21,8 +21,6 @@ export type { CalendarSettings } from './FullCalendar/calendarSettings';
 export type { ActivityPeriod } from './FullCalendar/activityTypes';
 export { cn } from './utils/cn';
 export { useCssVariable } from './utils/useCssVariable';
-export { billableRatesLockKey, useBillableRatesLock } from './utils/useBillableRatesLock';
-export type { BillableRatesLock } from './utils/useBillableRatesLock';
 
 import Badge from './Badge.vue';
 import Button from './Buttons/Button.vue';

resources/js/packages/ui/src/utils/useBillableRatesLock.ts

@@ -1,22 +0,0 @@
-import { computed, inject, type ComputedRef, type InjectionKey } from 'vue';
-
-export interface BillableRatesLock {
-    locked: ComputedRef<boolean>;
-    requestUpgrade: () => void;
-}
-
-export const billableRatesLockKey: InjectionKey<BillableRatesLock> = Symbol('billableRatesLock');
-
-/**
- * Whether billable rates are locked behind a plan upgrade for the current organization.
- *
- * The app layout provides the lock state and opens the upgrade dialog. Without a
- * provider (e.g. public report views or other consumers of this package) billable
- * rates count as unlocked.
- */
-export function useBillableRatesLock(): BillableRatesLock {
-    return inject(billableRatesLockKey, {
-        locked: computed(() => false),
-        requestUpgrade: () => {},
-    });
-}

resources/js/packages/ui/src/utils/useDialogFocusRestore.test.ts

@@ -1,87 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { useDialogFocusRestore } from './useDialogFocusRestore';
-
-function closeEvent() {
-    return new CustomEvent('focusScope.autoFocusOnUnmount', { cancelable: true });
-}
-
-describe('useDialogFocusRestore', () => {
-    it('restores focus to the element focused when the dialog opened', () => {
-        vi.useFakeTimers();
-        const button = document.createElement('button');
-        document.body.appendChild(button);
-        button.focus();
-
-        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
-        onOpenAutoFocus();
-        button.blur();
-
-        const event = closeEvent();
-        onCloseAutoFocus(event);
-        expect(event.defaultPrevented).toBe(true);
-        vi.runAllTimers();
-        expect(document.activeElement).toBe(button);
-
-        button.remove();
-        vi.useRealTimers();
-    });
-
-    it('focuses nothing when the dialog was opened with nothing focused', () => {
-        vi.useFakeTimers();
-        const stale = document.createElement('button');
-        document.body.appendChild(stale);
-        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
-
-        // First open from the button, then close
-        stale.focus();
-        onOpenAutoFocus();
-        onCloseAutoFocus(closeEvent());
-        vi.runAllTimers();
-        stale.blur();
-
-        // Second open from the body must not refocus the stale button
-        onOpenAutoFocus();
-        const event = closeEvent();
-        onCloseAutoFocus(event);
-        expect(event.defaultPrevented).toBe(true);
-        vi.runAllTimers();
-        expect(document.activeElement).toBe(document.body);
-
-        stale.remove();
-        vi.useRealTimers();
-    });
-
-    it('does not restore focus to an element that was removed', () => {
-        vi.useFakeTimers();
-        const button = document.createElement('button');
-        document.body.appendChild(button);
-        button.focus();
-        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
-        onOpenAutoFocus();
-        button.remove();
-
-        onCloseAutoFocus(closeEvent());
-        vi.runAllTimers();
-        expect(document.activeElement).toBe(document.body);
-        vi.useRealTimers();
-    });
-
-    it('leaves control to a consumer that already prevented the event', () => {
-        vi.useFakeTimers();
-        const button = document.createElement('button');
-        document.body.appendChild(button);
-        button.focus();
-        const { onOpenAutoFocus, onCloseAutoFocus } = useDialogFocusRestore();
-        onOpenAutoFocus();
-        button.blur();
-
-        const event = closeEvent();
-        event.preventDefault();
-        onCloseAutoFocus(event);
-        vi.runAllTimers();
-        expect(document.activeElement).toBe(document.body);
-
-        button.remove();
-        vi.useRealTimers();
-    });
-});

resources/js/packages/ui/src/utils/useDialogFocusRestore.ts

@@ -1,41 +0,0 @@
-/**
- * Restores focus to the element that was focused when a dialog opened.
- *
- * reka-ui remembers the active element at content mount as the dialog's
- * "trigger" (only when it is not the body) and refocuses it on every close,
- * but it never clears that value. A dialog opened while nothing is focused
- * (e.g. the command palette via Cmd+K from the body) therefore refocuses
- * whatever triggered a *previous* open. Bind these handlers to
- * `DialogContent`'s `open-auto-focus` / `close-auto-focus` events to restore
- * exactly the previously focused element, or nothing.
- *
- * A consumer handler that already called `preventDefault()` on
- * `close-auto-focus` keeps control; this composable then does nothing.
- */
-export function useDialogFocusRestore() {
-    let previouslyFocused: HTMLElement | null = null;
-
-    function onOpenAutoFocus() {
-        const active = document.activeElement;
-        previouslyFocused =
-            active instanceof HTMLElement && active !== document.body ? active : null;
-    }
-
-    function onCloseAutoFocus(event: Event) {
-        const target = previouslyFocused;
-        previouslyFocused = null;
-        if (event.defaultPrevented) {
-            return;
-        }
-        // Prevents both FocusScope's default restore and reka-ui's trigger refocus
-        event.preventDefault();
-        // Same tick reka-ui uses, so the dialog content is fully gone first
-        setTimeout(() => {
-            if (target?.isConnected) {
-                target.focus({ preventScroll: true });
-            }
-        }, 0);
-    }
-
-    return { onOpenAutoFocus, onCloseAutoFocus };
-}

resources/js/utils/billing.ts

@@ -70,13 +70,3 @@ export function isAllowedToPerformPremiumAction() {
         (isBillingActivated() && isInTrial())
     );
 }
-
-export function canUseBillableRates() {
-    const page = usePage<{
-        billing: {
-            can_use_billable_rates?: boolean;
-        } | null;
-    }>();
-
-    return !isBillingActivated() || page.props.billing?.can_use_billable_rates !== false;
-}

resources/js/utils/useCurrentTimeEntry.ts

@@ -1,5 +1,5 @@
 import { defineStore } from 'pinia';
-import { computed, ref, watch } from 'vue';
+import { computed, ref } from 'vue';
 import { api } from '@/packages/api/src';
 import type { TimeEntry } from '@/packages/api/src';
 import dayjs, { Dayjs } from 'dayjs';
@@ -57,6 +57,7 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
     const currentTimeEntry = ref<TimeEntry>({ ...emptyTimeEntry });
     const { handleApiRequestNotifications } = useNotificationsStore();
     const queryClient = useQueryClient();
+
     useLocalStorage('solidtime/current-time-entry', currentTimeEntry, {
         deep: true,
     });
@@ -88,12 +89,23 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
             try {
                 const timeEntriesResponse = await api.getMyActiveTimeEntry({});
                 if (timeEntriesResponse?.data) {
-                    currentTimeEntry.value = timeEntriesResponse.data;
-                } else if (currentTimeEntry.value.id !== '') {
-                    // No active time entry on server
-                    // Only reset if we had a previously started timer (has an ID)
-                    // Don't reset if user is preparing a new time entry (no ID yet)
-                    currentTimeEntry.value = { ...emptyTimeEntry };
+                    if (timeEntriesResponse.data) {
+                        currentTimeEntry.value = timeEntriesResponse.data;
+                        if (
+                            currentTimeEntry.value.start !== '' &&
+                            currentTimeEntry.value.end === null
+                        ) {
+                            startLiveTimer();
+                        }
+                    } else {
+                        // No active time entry on server
+                        // Only reset if we had a previously started timer (has an ID)
+                        // Don't reset if user is preparing a new time entry (no ID yet)
+                        if (currentTimeEntry.value.id !== '') {
+                            currentTimeEntry.value = { ...emptyTimeEntry };
+                            stopLiveTimer();
+                        }
+                    }
                 }
             } catch {
                 // API error (e.g., 404 when no active time entry)
@@ -101,6 +113,7 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
                 // Don't reset if user is preparing a new time entry (no ID yet)
                 if (currentTimeEntry.value.id !== '') {
                     currentTimeEntry.value = { ...emptyTimeEntry };
+                    stopLiveTimer();
                 }
             }
         } else {
@@ -281,18 +294,6 @@ export const useCurrentTimeEntryStore = defineStore('currentTimeEntry', () => {
         return isActive.value && currentTimeEntry.value.type === 'break';
     });
 
-    watch(
-        isActive,
-        (active) => {
-            if (active) {
-                startLiveTimer();
-            } else {
-                stopLiveTimer();
-            }
-        },
-        { immediate: true }
-    );
-
     async function setActiveState(newState: boolean) {
         if (newState) {
             startLiveTimer();

tests/Feature/PasswordConfirmationTest.php

@@ -6,7 +6,6 @@ namespace Tests\Feature;
 
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Hash;
 use Tests\TestCase;
 
 class PasswordConfirmationTest extends TestCase
@@ -44,43 +43,4 @@ class PasswordConfirmationTest extends TestCase
 
         $response->assertSessionHasErrors();
     }
-
-    public function test_password_can_be_confirmed_if_a_placeholder_user_with_the_same_email_exists(): void
-    {
-        // Arrange
-        // Placeholders created by an import have no password at all. The placeholder is created
-        // first so that it would be returned by an unordered lookup by email.
-        $email = 'shared@example.com';
-        User::factory()->placeholder()->create(['email' => $email, 'password' => null]);
-        $user = User::factory()->create(['email' => $email, 'password' => Hash::make('secret-password')]);
-
-        // Act
-        $response = $this->actingAs($user)->post('/user/confirm-password', [
-            'password' => 'secret-password',
-        ]);
-
-        // Assert
-        $response->assertRedirect();
-        $response->assertSessionHasNoErrors();
-        $this->assertTrue($this->app['session']->has('auth.password_confirmed_at'));
-    }
-
-    public function test_password_confirmation_ignores_the_password_of_a_placeholder_user_with_the_same_email(): void
-    {
-        // Arrange
-        // Placeholders created by removing a member copy the password hash as of the removal,
-        // so the placeholder holds a password that the real user has since replaced.
-        $email = 'shared@example.com';
-        User::factory()->placeholder()->create(['email' => $email, 'password' => Hash::make('outdated-password')]);
-        $user = User::factory()->create(['email' => $email, 'password' => Hash::make('current-password')]);
-
-        // Act
-        $response = $this->actingAs($user)->post('/user/confirm-password', [
-            'password' => 'outdated-password',
-        ]);
-
-        // Assert
-        $response->assertSessionHasErrors();
-        $this->assertFalse($this->app['session']->has('auth.password_confirmed_at'));
-    }
 }

tests/Feature/PasswordResetTest.php

@@ -7,7 +7,6 @@ namespace Tests\Feature;
 use App\Models\User;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Notification;
 use Laravel\Fortify\Features;
 use Tests\TestCase;
@@ -94,62 +93,4 @@ class PasswordResetTest extends TestCase
             return true;
         });
     }
-
-    public function test_password_reset_targets_the_real_user_when_a_placeholder_user_with_the_same_email_exists(): void
-    {
-
-        Notification::fake();
-
-        // The placeholder is created first so that it would be returned by an unordered lookup by email
-        $email = 'shared@example.com';
-        $placeholder = User::factory()->placeholder()->create(['email' => $email]);
-        $user = User::factory()->create(['email' => $email]);
-        $placeholderPasswordBefore = $placeholder->password;
-
-        $response = $this->post('/forgot-password', [
-            'email' => $email,
-        ]);
-
-        $response->assertSessionHasNoErrors();
-        Notification::assertNotSentTo($placeholder, ResetPassword::class);
-        Notification::assertSentTo($user, ResetPassword::class, function (ResetPassword $notification) use ($email) {
-            $response = $this->post('/reset-password', [
-                'token' => $notification->token,
-                'email' => $email,
-                'password' => 'new-password-123',
-                'password_confirmation' => 'new-password-123',
-            ]);
-
-            $response->assertSessionHasNoErrors();
-
-            return true;
-        });
-
-        $placeholder->refresh();
-        $user->refresh();
-        $this->assertSame($placeholderPasswordBefore, $placeholder->password);
-        $this->assertTrue(Hash::check('new-password-123', $user->password));
-
-        $response = $this->post('/login', [
-            'email' => $email,
-            'password' => 'new-password-123',
-        ]);
-
-        $response->assertSessionHasNoErrors();
-        $this->assertAuthenticatedAs($user);
-    }
-
-    public function test_password_reset_link_is_not_sent_if_only_a_placeholder_user_with_the_email_exists(): void
-    {
-        Notification::fake();
-
-        $placeholder = User::factory()->placeholder()->create();
-
-        $response = $this->post('/forgot-password', [
-            'email' => $placeholder->email,
-        ]);
-
-        $response->assertSessionHasErrors('email');
-        Notification::assertNothingSent();
-    }
 }

tests/TestCase.php

@@ -89,7 +89,6 @@ abstract class TestCase extends BaseTestCase
             $mock->shouldReceive('hasTrial')->andReturn(false);
             $mock->shouldReceive('getTrialUntil')->andReturn(null);
             $mock->shouldReceive('isBlocked')->andReturn(false);
-            $mock->shouldReceive('canUseBillableRates')->andReturn(true);
         });
     }
 
@@ -100,18 +99,6 @@ abstract class TestCase extends BaseTestCase
             $mock->shouldReceive('hasTrial')->andReturn(false);
             $mock->shouldReceive('getTrialUntil')->andReturn(null);
             $mock->shouldReceive('isBlocked')->andReturn(false);
-            $mock->shouldReceive('canUseBillableRates')->andReturn(true);
-        });
-    }
-
-    protected function actAsOrganizationWithoutBillableRates(): void
-    {
-        $this->mock(BillingContract::class, function (MockInterface $mock): void {
-            $mock->shouldReceive('hasSubscription')->andReturn(false);
-            $mock->shouldReceive('hasTrial')->andReturn(false);
-            $mock->shouldReceive('getTrialUntil')->andReturn(null);
-            $mock->shouldReceive('isBlocked')->andReturn(false);
-            $mock->shouldReceive('canUseBillableRates')->andReturn(false);
         });
     }
 }

tests/Unit/Auth/ActiveUserProviderTest.php

@@ -1,90 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\Auth;
-
-use App\Auth\ActiveUserProvider;
-use App\Models\User;
-use Illuminate\Support\Facades\Auth;
-use PHPUnit\Framework\Attributes\CoversClass;
-use Tests\TestCaseWithDatabase;
-
-#[CoversClass(ActiveUserProvider::class)]
-class ActiveUserProviderTest extends TestCaseWithDatabase
-{
-    public function test_password_broker_uses_the_active_user_provider(): void
-    {
-        // Act
-        $brokerProvider = Auth::createUserProvider(config('auth.passwords.users.provider'));
-
-        // Assert
-        $this->assertInstanceOf(ActiveUserProvider::class, $brokerProvider);
-    }
-
-    public function test_api_guard_uses_the_active_user_provider(): void
-    {
-        // Act
-        $guardProvider = Auth::createUserProvider(config('auth.guards.api.provider'));
-
-        // Assert
-        $this->assertInstanceOf(ActiveUserProvider::class, $guardProvider);
-    }
-
-    public function test_web_guard_uses_the_active_user_provider(): void
-    {
-        // Act
-        $guardProvider = Auth::createUserProvider(config('auth.guards.web.provider'));
-
-        // Assert
-        $this->assertInstanceOf(ActiveUserProvider::class, $guardProvider);
-    }
-
-    public function test_retrieve_by_credentials_ignores_placeholder_users_with_the_same_email(): void
-    {
-        // Arrange
-        $email = 'shared@example.com';
-        $placeholder = User::factory()->placeholder()->create(['email' => $email]);
-        $user = User::factory()->create(['email' => $email]);
-        $provider = Auth::createUserProvider('users');
-
-        // Act
-        $result = $provider->retrieveByCredentials(['email' => $email]);
-
-        // Assert
-        $this->assertInstanceOf(User::class, $result);
-        $this->assertTrue($user->is($result));
-        $this->assertFalse($placeholder->is($result));
-    }
-
-    public function test_retrieve_by_credentials_returns_null_if_only_a_placeholder_user_exists(): void
-    {
-        // Arrange
-        $email = 'placeholder-only@example.com';
-        User::factory()->placeholder()->create(['email' => $email]);
-        $provider = Auth::createUserProvider('users');
-
-        // Act
-        $result = $provider->retrieveByCredentials(['email' => $email]);
-
-        // Assert
-        $this->assertNull($result);
-    }
-
-    public function test_retrieve_by_id_returns_null_for_placeholder_users(): void
-    {
-        // Arrange
-        $placeholder = User::factory()->placeholder()->create();
-        $user = User::factory()->create();
-        $provider = Auth::createUserProvider('users');
-
-        // Act
-        $placeholderResult = $provider->retrieveById($placeholder->getKey());
-        $userResult = $provider->retrieveById($user->getKey());
-
-        // Assert
-        $this->assertNull($placeholderResult);
-        $this->assertInstanceOf(User::class, $userResult);
-        $this->assertTrue($user->is($userResult));
-    }
-}

tests/Unit/Endpoint/Api/V1/BillableRateRestrictionEndpointTest.php

@@ -1,286 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\Endpoint\Api\V1;
-
-use App\Http\Controllers\Api\V1\Controller;
-use App\Models\Member;
-use App\Models\Project;
-use App\Models\ProjectMember;
-use App\Models\TimeEntry;
-use App\Models\User;
-use Illuminate\Support\Carbon;
-use Laravel\Passport\Passport;
-use PHPUnit\Framework\Attributes\UsesClass;
-
-#[UsesClass(Controller::class)]
-class BillableRateRestrictionEndpointTest extends ApiEndpointTestAbstract
-{
-    public function test_project_store_fails_with_billable_rate_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'projects:create',
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => 'Project',
-            'color' => '#ef5350',
-            'client_id' => null,
-            'is_billable' => true,
-            'billable_rate' => 10000,
-        ]);
-
-        // Assert
-        $response->assertStatus(400);
-        $response->assertJsonPath('error', true);
-        $response->assertJsonPath('key', 'feature_is_not_available_in_free_plan');
-        $this->assertDatabaseMissing(Project::class, [
-            'name' => 'Project',
-        ]);
-    }
-
-    public function test_project_store_without_billable_rate_works_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'projects:create',
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.projects.store', [$data->organization->getKey()]), [
-            'name' => 'Project',
-            'color' => '#ef5350',
-            'client_id' => null,
-            'is_billable' => true,
-            'billable_rate' => null,
-        ]);
-
-        // Assert
-        $response->assertStatus(201);
-        $this->assertDatabaseHas(Project::class, [
-            'name' => 'Project',
-            'is_billable' => true,
-            'billable_rate' => null,
-        ]);
-    }
-
-    public function test_project_update_keeps_existing_billable_rate_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'projects:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->create([
-            'billable_rate' => 10000,
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $responseKeep = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => 'RenamedKeep',
-            'color' => $project->color,
-            'client_id' => null,
-            'is_billable' => true,
-            'billable_rate' => 10000,
-        ]);
-        $responseChange = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => 'RenamedChange',
-            'color' => $project->color,
-            'client_id' => null,
-            'is_billable' => true,
-            'billable_rate' => 20000,
-        ]);
-        $responseRemove = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => 'RenamedRemove',
-            'color' => $project->color,
-            'client_id' => null,
-            'is_billable' => true,
-            'billable_rate' => null,
-        ]);
-
-        // Assert
-        $responseKeep->assertStatus(200);
-        $responseKeep->assertJsonPath('data.name', 'RenamedKeep');
-        $responseChange->assertStatus(400);
-        $responseChange->assertJsonPath('key', 'feature_is_not_available_in_free_plan');
-        $responseRemove->assertStatus(200);
-        $project->refresh();
-        $this->assertSame('RenamedRemove', $project->name);
-        $this->assertSame(10000, $project->billable_rate);
-    }
-
-    public function test_project_update_without_billable_rate_does_not_change_project_rate_or_time_entries_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'projects:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->create([
-            'billable_rate' => 10000,
-            'is_billable' => true,
-        ]);
-        $timeEntry = TimeEntry::factory()->forOrganization($data->organization)->forMember($data->member)->forProject($project)->create([
-            'billable' => true,
-            'billable_rate' => 10000,
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.projects.update', [$data->organization->getKey(), $project->getKey()]), [
-            'name' => 'Renamed',
-            'color' => $project->color,
-            'client_id' => null,
-            'is_billable' => true,
-            'is_archived' => true,
-        ]);
-
-        // Assert
-        $response->assertStatus(200);
-        $project->refresh();
-        $this->assertSame('Renamed', $project->name);
-        $this->assertTrue($project->is_archived);
-        $this->assertSame(10000, $project->billable_rate);
-        $this->assertSame(10000, $timeEntry->refresh()->billable_rate);
-    }
-
-    public function test_organization_update_fails_to_set_billable_rate_or_employee_visibility_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'organizations:update',
-        ]);
-        $data->organization->employees_can_see_billable_rates = false;
-        $data->organization->save();
-        Passport::actingAs($data->user);
-
-        // Act
-        $responseRate = $this->putJson(route('api.v1.organizations.update', [$data->organization->getKey()]), [
-            'name' => 'Organization',
-            'billable_rate' => 10000,
-        ]);
-        $responseVisibility = $this->putJson(route('api.v1.organizations.update', [$data->organization->getKey()]), [
-            'name' => 'Organization',
-            'employees_can_see_billable_rates' => true,
-        ]);
-        $responseUnchanged = $this->putJson(route('api.v1.organizations.update', [$data->organization->getKey()]), [
-            'name' => 'Organization',
-            'billable_rate' => null,
-            'employees_can_see_billable_rates' => false,
-        ]);
-
-        // Assert
-        $responseRate->assertStatus(400);
-        $responseVisibility->assertStatus(400);
-        $responseUnchanged->assertStatus(200);
-        $data->organization->refresh();
-        $this->assertNull($data->organization->billable_rate);
-        $this->assertFalse($data->organization->employees_can_see_billable_rates);
-    }
-
-    public function test_member_update_fails_to_set_billable_rate_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'members:update',
-        ]);
-        $member = Member::factory()->forOrganization($data->organization)->forUser(User::factory()->create())->create([
-            'billable_rate' => null,
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.members.update', [$data->organization->getKey(), $member->getKey()]), [
-            'billable_rate' => 10000,
-        ]);
-
-        // Assert
-        $response->assertStatus(400);
-        $response->assertJsonPath('key', 'feature_is_not_available_in_free_plan');
-        $this->assertNull($member->refresh()->billable_rate);
-    }
-
-    public function test_project_member_store_and_update_fail_to_set_billable_rate_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'project-members:create',
-            'project-members:update',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->create();
-        $otherMember = Member::factory()->forOrganization($data->organization)->forUser(User::factory()->create())->create();
-        $projectMember = ProjectMember::factory()->forProject($project)->forMember($data->member)->create([
-            'billable_rate' => null,
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $responseStore = $this->postJson(route('api.v1.project-members.store', [$data->organization->getKey(), $project->getKey()]), [
-            'member_id' => $otherMember->getKey(),
-            'billable_rate' => 10000,
-        ]);
-        $responseUpdate = $this->putJson(route('api.v1.project-members.update', [$data->organization->getKey(), $projectMember->getKey()]), [
-            'billable_rate' => 10000,
-        ]);
-
-        // Assert
-        $responseStore->assertStatus(400);
-        $responseUpdate->assertStatus(400);
-        $this->assertNull($projectMember->refresh()->billable_rate);
-        $this->assertDatabaseMissing(ProjectMember::class, [
-            'member_id' => $otherMember->getKey(),
-        ]);
-    }
-
-    public function test_aggregate_endpoint_hides_cost_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'time-entries:view:all',
-        ]);
-        $start = Carbon::now()->timezone($data->user->timezone)->subDays(2);
-        TimeEntry::factory()->forOrganization($data->organization)->forMember($data->member)->startWithDuration($start, 3600)->create([
-            'billable' => true,
-            'billable_rate' => 10000,
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->getJson(route('api.v1.time-entries.aggregate', [
-            $data->organization->getKey(),
-        ]));
-
-        // Assert
-        $response->assertSuccessful();
-        $response->assertJsonPath('data.seconds', 3600);
-        $response->assertJsonPath('data.cost', null);
-    }
-
-    public function test_total_weekly_billable_amount_is_forbidden_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $data = $this->createUserWithPermission([
-            'charts:view:own',
-        ]);
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->getJson(route('api.v1.charts.total-weekly-billable-amount', [$data->organization->getKey()]));
-
-        // Assert
-        $response->assertForbidden();
-    }
-}

tests/Unit/Endpoint/Api/V1/ImportEndpointTest.php

@@ -97,29 +97,6 @@ class ImportEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
-    public function test_import_fails_if_data_exceeds_maximum_size(): void
-    {
-        // Arrange
-        config(['import.max_data_size' => 16]);
-        $user = $this->createUserWithPermission([
-            'import',
-        ]);
-        $this->mock(ImportService::class, function (MockInterface $mock): void {
-            $mock->shouldNotReceive('import');
-        });
-        Passport::actingAs($user->user);
-
-        // Act
-        $response = $this->postJson(route('api.v1.import.import', ['organization' => $user->organization->getKey()]), [
-            'type' => 'toggl_time_entries',
-            'data' => base64_encode(str_repeat('a', 15)),
-        ]);
-
-        // Assert
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['data']);
-    }
-
     public function test_import_return_error_message_if_import_fails(): void
     {
         // Arrange

tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php

@@ -105,9 +105,6 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         $this->assertDatabaseMissing(OrganizationInvitation::class, [
             'id' => $invitation->getKey(),
         ]);
-        // Joining sets the organization as the current one for the user, independently of the
-        // placeholders that were merged into them
-        $this->assertSame($user->organization->getKey(), $user2->user->fresh()->current_team_id);
     }
 
     public function test_accepting_invitation_while_logged_out_redirects_to_login(): void

tests/Unit/Middleware/HandleInertiaRequestsMiddlewareTest.php

@@ -35,7 +35,6 @@ class HandleInertiaRequestsMiddlewareTest extends MiddlewareTestAbstract
             $mock->shouldReceive('hasTrial')->andReturn(false);
             $mock->shouldReceive('getTrialUntil')->andReturn(null);
             $mock->shouldReceive('isBlocked')->andReturn(false);
-            $mock->shouldReceive('canUseBillableRates')->andReturn(true);
         });
         Passport::actingAs($user->user);
 
@@ -48,7 +47,6 @@ class HandleInertiaRequestsMiddlewareTest extends MiddlewareTestAbstract
             ->where('billing.has_trial', false)
             ->where('billing.trial_until', null)
             ->where('billing.is_blocked', false)
-            ->where('billing.can_use_billable_rates', true)
         );
     }
 
@@ -63,7 +61,6 @@ class HandleInertiaRequestsMiddlewareTest extends MiddlewareTestAbstract
             $mock->shouldReceive('hasTrial')->andReturn(true);
             $mock->shouldReceive('getTrialUntil')->andReturn($trialUntil);
             $mock->shouldReceive('isBlocked')->andReturn(false);
-            $mock->shouldReceive('canUseBillableRates')->andReturn(true);
         });
         Passport::actingAs($user->user);
 
@@ -76,7 +73,6 @@ class HandleInertiaRequestsMiddlewareTest extends MiddlewareTestAbstract
             ->where('billing.has_trial', true)
             ->where('billing.trial_until', $trialUntil->toIso8601ZuluString())
             ->where('billing.is_blocked', false)
-            ->where('billing.can_use_billable_rates', true)
         );
     }
 }

tests/Unit/Model/UserModelTest.php

@@ -53,23 +53,6 @@ class UserModelTest extends ModelTestAbstract
         $this->assertTrue($canAccess);
     }
 
-    public function test_placeholder_user_with_a_super_admin_email_can_not_access_admin_panel(): void
-    {
-        // Arrange
-        Config::set('auth.super_admins', ['some@email.test', 'other@email.test']);
-        $user = User::factory()->placeholder()->create([
-            'email' => 'some@email.test',
-        ]);
-        $panelProvider = new AdminPanelProvider(app());
-        $mainPanel = $panelProvider->panel(Panel::make());
-
-        // Act
-        $canAccess = $user->canAccessPanel($mainPanel);
-
-        // Assert
-        $this->assertFalse($canAccess);
-    }
-
     public function test_scope_belongs_to_organization_returns_only_users_of_organization_including_owners(): void
     {
         // Arrange

tests/Unit/Service/DeletionServiceTest.php

@@ -412,11 +412,10 @@ class DeletionServiceTest extends TestCaseWithDatabase
         $this->assertDatabaseHas(Organization::class, [
             'id' => $organizationOfA->getKey(),
         ]);
-        // The placeholder user should exist and must not reference the deleted organization,
-        // which is what caused the foreign key violation in #989
+        // The placeholder user should exist with current_team_id set to the org where they are a placeholder
         $placeholderUser = User::query()->where('is_placeholder', true)->first();
         $this->assertNotNull($placeholderUser);
-        $this->assertNull($placeholderUser->current_team_id);
+        $this->assertSame($organizationOfA->getKey(), $placeholderUser->current_team_id);
         $this->assertDatabaseHas(Member::class, [
             'id' => $memberBInOrgA->getKey(),
             'user_id' => $placeholderUser->getKey(),

tests/Unit/Service/Import/ImportServiceTest.php

@@ -41,7 +41,6 @@ class ImportServiceTest extends TestCase
         $this->assertSame(1, $report->usersCreated);
         $this->assertSame(2, $report->projectsCreated);
         $this->assertSame(1, $report->clientsCreated);
-        Storage::disk(config('filesystems.default'))->assertDirectoryEmpty('import');
     }
 
     public function test_import_releases_lock_if_an_exception_happens_during_the_import(): void

tests/Unit/Service/Import/Importers/SolidtimeImporterTest.php

@@ -8,8 +8,6 @@ use App\Enums\TimeEntryType;
 use App\Jobs\RecalculateSpentTimeForProject;
 use App\Jobs\RecalculateSpentTimeForTask;
 use App\Models\Organization;
-use App\Models\Project;
-use App\Models\ProjectMember;
 use App\Models\TimeEntry;
 use App\Service\Import\Importers\DefaultImporter;
 use App\Service\Import\Importers\ImportException;
@@ -44,31 +42,6 @@ class SolidtimeImporterTest extends ImporterTestAbstract
         $this->fail();
     }
 
-    public function test_import_throws_exception_if_zip_exceeds_uncompressed_size_limit(): void
-    {
-        // Arrange
-        config(['import.zip_max_uncompressed_size' => 10]);
-        $zipPath = $this->createTestZip('solidtime_import_test_1');
-        $timezone = 'Europe/Vienna';
-        $organization = Organization::factory()->create();
-        $importer = new SolidtimeImporter;
-        $importer->init($organization);
-        $data = file_get_contents($zipPath);
-
-        // Act
-        try {
-            $importer->importData($data, $timezone);
-        } catch (Exception $e) {
-            // Assert
-            $this->assertInstanceOf(ImportException::class, $e);
-            $this->assertSame('ZIP uncompressed size exceeds the maximum of 10 bytes', $e->getMessage());
-            $this->assertSame(0, $importer->getReport()->timeEntriesCreated);
-
-            return;
-        }
-        $this->fail();
-    }
-
     public function test_import_of_test_file_succeeds(): void
     {
         // Arrange
@@ -104,34 +77,6 @@ class SolidtimeImporterTest extends ImporterTestAbstract
         Queue::assertPushed(RecalculateSpentTimeForTask::class, 1);
     }
 
-    public function test_import_drops_billable_rates_if_organization_can_not_use_billable_rates(): void
-    {
-        // Arrange
-        $this->actAsOrganizationWithoutBillableRates();
-        $zipPath = $this->createTestZip('solidtime_import_test_1');
-        $timezone = 'Europe/Vienna';
-        $organization = Organization::factory()->create();
-        $importer = new SolidtimeImporter;
-        $importer->init($organization);
-        $data = file_get_contents($zipPath);
-        Queue::fake([
-            RecalculateSpentTimeForProject::class,
-            RecalculateSpentTimeForTask::class,
-        ]);
-
-        // Act
-        $importer->importData($data, $timezone);
-
-        // Assert
-        $this->assertSame(3, Project::query()->whereBelongsTo($organization, 'organization')->whereNull('billable_rate')->count());
-        $this->assertSame(1, ProjectMember::query()->whereBelongsToOrganization($organization)->whereNull('billable_rate')->count());
-        $timeEntries = TimeEntry::query()->whereBelongsTo($organization, 'organization')->get();
-        $this->assertCount(2, $timeEntries);
-        foreach ($timeEntries as $timeEntry) {
-            $this->assertNull($timeEntry->billable_rate);
-        }
-    }
-
     public function test_import_of_test_file_with_type_column_imports_breaks(): void
     {
         // Arrange

tests/Unit/Service/Import/Importers/TogglDataImporterTest.php

@@ -39,31 +39,6 @@ class TogglDataImporterTest extends ImporterTestAbstract
         $this->fail();
     }
 
-    public function test_import_throws_exception_if_zip_contains_too_many_files(): void
-    {
-        // Arrange
-        config(['import.zip_max_files' => 1]);
-        $zipPath = $this->createTestZip('toggl_data_import_test_1');
-        $timezone = 'Europe/Vienna';
-        $organization = Organization::factory()->create();
-        $importer = new TogglDataImporter;
-        $importer->init($organization);
-        $data = file_get_contents($zipPath);
-
-        // Act
-        try {
-            $importer->importData($data, $timezone);
-        } catch (Exception $e) {
-            // Assert
-            $this->assertInstanceOf(ImportException::class, $e);
-            $this->assertSame('ZIP contains too many files, maximum is 1', $e->getMessage());
-            $this->assertSame(0, $importer->getReport()->projectsCreated);
-
-            return;
-        }
-        $this->fail();
-    }
-
     public function test_import_of_test_file_succeeds(): void
     {
         // Arrange

tests/Unit/Service/Import/Importers/ZipImportHelperTest.php

@@ -1,254 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\Service\Import\Importers;
-
-use App\Service\Import\Importers\ImportException;
-use App\Service\Import\Importers\ZipImportHelper;
-use PHPUnit\Framework\Attributes\CoversClass;
-use Spatie\TemporaryDirectory\TemporaryDirectory;
-use Tests\TestCase;
-use ZipArchive;
-
-#[CoversClass(ZipImportHelper::class)]
-class ZipImportHelperTest extends TestCase
-{
-    private TemporaryDirectory $sourceDirectory;
-
-    private TemporaryDirectory $targetDirectory;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-        $this->sourceDirectory = TemporaryDirectory::make();
-        $this->targetDirectory = TemporaryDirectory::make();
-    }
-
-    protected function tearDown(): void
-    {
-        $this->sourceDirectory->delete();
-        $this->targetDirectory->delete();
-        parent::tearDown();
-    }
-
-    /**
-     * @param  array<string, string>  $files
-     */
-    private function createZip(array $files): string
-    {
-        $zipPath = $this->sourceDirectory->path('test.zip');
-        $zip = new ZipArchive;
-        $zip->open($zipPath, ZipArchive::CREATE);
-        foreach ($files as $name => $content) {
-            $zip->addFromString($name, $content);
-        }
-        $zip->close();
-
-        return $zipPath;
-    }
-
-    private function assertNothingExtracted(): void
-    {
-        $this->assertSame([], array_values(array_diff(scandir($this->targetDirectory->path()), ['.', '..'])));
-    }
-
-    public function test_extract_extracts_files_and_nested_directories(): void
-    {
-        // Arrange
-        $zipPath = $this->createZip([
-            'meta.json' => '{"version":"1.0"}',
-            'nested/dir/file.csv' => 'a,b',
-        ]);
-
-        // Act
-        app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-
-        // Assert
-        $this->assertSame('{"version":"1.0"}', file_get_contents($this->targetDirectory->path('meta.json')));
-        $this->assertSame('a,b', file_get_contents($this->targetDirectory->path('nested/dir/file.csv')));
-    }
-
-    public function test_extract_throws_exception_if_file_is_not_a_zip(): void
-    {
-        // Arrange
-        $path = $this->sourceDirectory->path('not-a-zip.txt');
-        file_put_contents($path, 'not a zip');
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($path, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('Invalid ZIP, error code: 19', $e->getMessage());
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_if_zip_contains_too_many_files(): void
-    {
-        // Arrange
-        config(['import.zip_max_files' => 2]);
-        $zipPath = $this->createZip([
-            'a.txt' => 'a',
-            'b.txt' => 'b',
-            'c.txt' => 'c',
-        ]);
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP contains too many files, maximum is 2', $e->getMessage());
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_before_writing_if_declared_uncompressed_size_exceeds_limit(): void
-    {
-        // Arrange
-        config(['import.zip_max_uncompressed_size' => 100]);
-        $zipPath = $this->createZip([
-            'a.txt' => str_repeat('a', 60),
-            'b.txt' => str_repeat('b', 60),
-        ]);
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP uncompressed size exceeds the maximum of 100 bytes', $e->getMessage());
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_if_actual_uncompressed_size_exceeds_limit_despite_forged_headers(): void
-    {
-        // Arrange
-        config(['import.zip_max_uncompressed_size' => 1000]);
-        $zipPath = $this->createZip([
-            'bomb.bin' => str_repeat("\0", 100000),
-        ]);
-        // Forge the uncompressed size in the local file header (offset 22) and central directory header (offset 24)
-        $content = file_get_contents($zipPath);
-        $forgedSize = pack('V', 10);
-        $localHeaderOffset = strpos($content, "PK\x03\x04");
-        $centralHeaderOffset = strpos($content, "PK\x01\x02");
-        $this->assertNotFalse($localHeaderOffset);
-        $this->assertNotFalse($centralHeaderOffset);
-        $content = substr_replace($content, $forgedSize, $localHeaderOffset + 22, 4);
-        $content = substr_replace($content, $forgedSize, $centralHeaderOffset + 24, 4);
-        file_put_contents($zipPath, $content);
-        $zip = new ZipArchive;
-        $this->assertTrue($zip->open($zipPath, ZipArchive::RDONLY));
-        $this->assertSame(10, $zip->statIndex(0)['size']);
-        $zip->close();
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP uncompressed size exceeds the maximum of 1000 bytes', $e->getMessage());
-            $extracted = $this->targetDirectory->path('bomb.bin');
-            if (file_exists($extracted)) {
-                $this->assertLessThanOrEqual(1000, filesize($extracted));
-            }
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_if_zip_contains_path_traversal(): void
-    {
-        // Arrange
-        $zipPath = $this->createZip([
-            '../evil.txt' => 'evil',
-        ]);
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP contains an invalid file path: "../evil.txt"', $e->getMessage());
-            $this->assertFileDoesNotExist(dirname($this->targetDirectory->path()).'/evil.txt');
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_if_zip_contains_nested_path_traversal(): void
-    {
-        // Arrange
-        $zipPath = $this->createZip([
-            'sub/../../evil.txt' => 'evil',
-        ]);
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP contains an invalid file path: "sub/../../evil.txt"', $e->getMessage());
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_if_zip_contains_absolute_path(): void
-    {
-        // Arrange
-        $zipPath = $this->createZip([
-            '/tmp/evil.txt' => 'evil',
-        ]);
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP contains an invalid file path: "/tmp/evil.txt"', $e->getMessage());
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-
-    public function test_extract_throws_exception_if_zip_contains_backslash_path(): void
-    {
-        // Arrange
-        $zipPath = $this->createZip([
-            '..\\evil.txt' => 'evil',
-        ]);
-
-        // Act
-        try {
-            app(ZipImportHelper::class)->extract($zipPath, $this->targetDirectory->path());
-        } catch (ImportException $e) {
-            // Assert
-            $this->assertSame('ZIP contains an invalid file path: "..\\evil.txt"', $e->getMessage());
-            $this->assertNothingExtracted();
-
-            return;
-        }
-        $this->fail();
-    }
-}

tests/Unit/Service/MemberServiceTest.php

@@ -13,7 +13,6 @@ use App\Models\TimeEntry;
 use App\Models\User;
 use App\Service\MemberService;
 use App\Service\UserService;
-use Illuminate\Support\Facades\Hash;
 use InvalidArgumentException;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Tests\TestCaseWithDatabase;
@@ -65,48 +64,6 @@ class MemberServiceTest extends TestCaseWithDatabase
         $this->assertSame(Role::Admin->value, $oldOwnerMember->refresh()->role);
     }
 
-    public function test_make_member_to_placeholder_does_not_copy_the_credentials_and_account_state_of_the_user(): void
-    {
-        // Arrange
-        $user = User::factory()->create([
-            'password' => Hash::make('secret-password'),
-            'remember_token' => 'remember-me-token',
-            'two_factor_secret' => 'two-factor-secret',
-            'two_factor_recovery_codes' => 'two-factor-recovery-codes',
-            'two_factor_confirmed_at' => '2026-09-16 10:00:00',
-            'email_verified_at' => '2026-09-16 09:00:00',
-            'pending_email' => 'pending@example.com',
-            'profile_photo_path' => 'profile-photos/photo.png',
-        ]);
-        $organization = Organization::factory()->create();
-        $member = Member::factory()->forOrganization($organization)->forUser($user)->role(Role::Employee)->create();
-
-        // Act
-        $this->memberService->makeMemberToPlaceholder($member);
-
-        // Assert
-        $member->refresh();
-        $placeholderUser = $member->user;
-        $this->assertTrue($placeholderUser->is_placeholder);
-        $this->assertSame($user->email, $placeholderUser->email);
-        $this->assertNull($placeholderUser->password);
-        $this->assertNull($placeholderUser->remember_token);
-        $this->assertNull($placeholderUser->two_factor_secret);
-        $this->assertNull($placeholderUser->two_factor_recovery_codes);
-        $this->assertNull($placeholderUser->two_factor_confirmed_at);
-        $this->assertNull($placeholderUser->email_verified_at);
-        $this->assertNull($placeholderUser->pending_email);
-        $this->assertNull($placeholderUser->current_team_id);
-        $this->assertNull($placeholderUser->profile_photo_path);
-        // the user the placeholder was created from keeps their own credentials and state
-        $user->refresh();
-        $this->assertTrue(Hash::check('secret-password', (string) $user->password));
-        $this->assertSame('two-factor-secret', $user->two_factor_secret);
-        $this->assertNotNull($user->email_verified_at);
-        $this->assertSame('pending@example.com', $user->pending_email);
-        $this->assertSame('profile-photos/photo.png', $user->profile_photo_path);
-    }
-
     public function test_make_member_to_placeholder_creates_new_user_based_on_member_and_changes_member_to_placeholder(): void
     {
         // Arrange