Add permission config to npm-format-check GitHub action

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -679,10 +679,6 @@ class TimeEntryController extends Controller
             $timeEntry->member()->associate($newMember);
             $timeEntry->user()->associate($newMember->user);
         }
-        // If project is changed, but task is not, we remove the old task from the time entry
-        if ($request->has('project_id') && ! $request->has('task_id') && $oldTask !== null && $oldTask->project_id !== $project?->getKey()) {
-            $timeEntry->task()->disassociate();
-        }
         $timeEntry->description = $request->input('description', $timeEntry->description) ?? '';
         $timeEntry->setComputedAttributeValue('billable_rate');
         $timeEntry->save();
@@ -794,7 +790,7 @@ class TimeEntryController extends Controller
                 $timeEntry->user_id = $newMember->user_id;
             }
             // If project is changed, but task is not, we remove the old task from the time entry
-            if ($request->has('changes.project_id') && ! $request->has('changes.task_id') && $oldTask !== null && $oldTask->project_id !== $project?->getKey()) {
+            if ($oldProject !== null && $project !== null && $oldProject->isNot($project) && $task === null) {
                 $timeEntry->task()->disassociate();
             }
             if ($overwriteClient) {

app/Service/DeletionService.php

@@ -11,7 +11,6 @@ use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
-use App\Models\Passport\RefreshToken;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -170,10 +169,6 @@ class DeletionService
             }
         }
 
-        // Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
-        // Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
-        // which fails with a foreign key violation on oauth_access_tokens.user_id.
-        RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
         $user->accessTokens()->delete();
         $user->authCodes()->delete();
 

composer.lock

@@ -429,24 +429,23 @@
         },
         {
             "name": "brick/math",
-            "version": "1.0.0",
+            "version": "0.19.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/brick/math.git",
-                "reference": "2effe05d2177c451b86c6a073196a4034c02f211"
+                "reference": "a89bc96a7cf3d7b59e725afe57ccb95eb03cf6ce"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/brick/math/zipball/2effe05d2177c451b86c6a073196a4034c02f211",
-                "reference": "2effe05d2177c451b86c6a073196a4034c02f211",
+                "url": "https://api.github.com/repos/brick/math/zipball/a89bc96a7cf3d7b59e725afe57ccb95eb03cf6ce",
+                "reference": "a89bc96a7cf3d7b59e725afe57ccb95eb03cf6ce",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.2"
             },
             "require-dev": {
-                "phpstan/phpstan": "2.2.13",
-                "phpstan/phpstan-phpunit": "2.0.18",
+                "phpstan/phpstan": "2.1.22",
                 "phpunit/phpunit": "^11.5"
             },
             "type": "library",
@@ -477,7 +476,7 @@
             ],
             "support": {
                 "issues": "https://github.com/brick/math/issues",
-                "source": "https://github.com/brick/math/tree/1.0.0"
+                "source": "https://github.com/brick/math/tree/0.19.1"
             },
             "funding": [
                 {
@@ -485,7 +484,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-09-12T10:28:18+00:00"
+            "time": "2026-08-08T23:03:16+00:00"
         },
         {
             "name": "brick/money",
@@ -4219,16 +4218,16 @@
         },
         {
             "name": "laravel/fortify",
-            "version": "v1.40.0",
+            "version": "v1.39.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/fortify.git",
-                "reference": "fe0fce8814660317df0684f2c7be3b573def67d3"
+                "reference": "b1fc50707bbe007fd92165d8b7d460ab549b355a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/fortify/zipball/fe0fce8814660317df0684f2c7be3b573def67d3",
-                "reference": "fe0fce8814660317df0684f2c7be3b573def67d3",
+                "url": "https://api.github.com/repos/laravel/fortify/zipball/b1fc50707bbe007fd92165d8b7d460ab549b355a",
+                "reference": "b1fc50707bbe007fd92165d8b7d460ab549b355a",
                 "shasum": ""
             },
             "require": {
@@ -4279,24 +4278,24 @@
                 "issues": "https://github.com/laravel/fortify/issues",
                 "source": "https://github.com/laravel/fortify"
             },
-            "time": "2026-09-10T11:52:08+00:00"
+            "time": "2026-08-23T07:46:41+00:00"
         },
         {
             "name": "laravel/framework",
-            "version": "v13.33.0",
+            "version": "v13.32.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/framework.git",
-                "reference": "91188a17ceaa3dbace6e8a5f7abd0d042e466359"
+                "reference": "cdd8b33c246719acdd118c705ce8c7ab5ef48a96"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/91188a17ceaa3dbace6e8a5f7abd0d042e466359",
-                "reference": "91188a17ceaa3dbace6e8a5f7abd0d042e466359",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/cdd8b33c246719acdd118c705ce8c7ab5ef48a96",
+                "reference": "cdd8b33c246719acdd118c705ce8c7ab5ef48a96",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
+                "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19",
                 "composer-runtime-api": "^2.2",
                 "doctrine/inflector": "^2.0.5",
                 "dragonmantank/cron-expression": "^3.4",
@@ -4510,20 +4509,20 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2026-09-22T14:12:33+00:00"
+            "time": "2026-09-15T14:55:30+00:00"
         },
         {
             "name": "laravel/octane",
-            "version": "v2.20.0",
+            "version": "v2.19.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/octane.git",
-                "reference": "df4c38dcddc5f51e36e7f1d788841130c4fb8f45"
+                "reference": "68a2516a0318baba0de0e4648f61e335c5e69dca"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/octane/zipball/df4c38dcddc5f51e36e7f1d788841130c4fb8f45",
-                "reference": "df4c38dcddc5f51e36e7f1d788841130c4fb8f45",
+                "url": "https://api.github.com/repos/laravel/octane/zipball/68a2516a0318baba0de0e4648f61e335c5e69dca",
+                "reference": "68a2516a0318baba0de0e4648f61e335c5e69dca",
                 "shasum": ""
             },
             "require": {
@@ -4599,7 +4598,7 @@
                 "issues": "https://github.com/laravel/octane/issues",
                 "source": "https://github.com/laravel/octane"
             },
-            "time": "2026-08-23T17:25:20+00:00"
+            "time": "2026-08-13T13:58:52+00:00"
         },
         {
             "name": "laravel/passkeys",
@@ -4805,16 +4804,16 @@
         },
         {
             "name": "laravel/serializable-closure",
-            "version": "v2.1.0",
+            "version": "v2.0.16",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/serializable-closure.git",
-                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5"
+                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/2d5869a838bbcf37e0d8b0568fc41914e81374b5",
-                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5",
+                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
+                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
                 "shasum": ""
             },
             "require": {
@@ -4862,7 +4861,7 @@
                 "issues": "https://github.com/laravel/serializable-closure/issues",
                 "source": "https://github.com/laravel/serializable-closure"
             },
-            "time": "2026-09-22T14:32:34+00:00"
+            "time": "2026-08-18T20:28:54+00:00"
         },
         {
             "name": "laravel/tinker",
@@ -15338,16 +15337,16 @@
         },
         {
             "name": "laravel/sail",
-            "version": "v1.68.0",
+            "version": "v1.67.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/sail.git",
-                "reference": "2bc304083d515065b03944e425e62cb3c526c33e"
+                "reference": "639e03ac12cf23def171770bcab05758045b2642"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/sail/zipball/2bc304083d515065b03944e425e62cb3c526c33e",
-                "reference": "2bc304083d515065b03944e425e62cb3c526c33e",
+                "url": "https://api.github.com/repos/laravel/sail/zipball/639e03ac12cf23def171770bcab05758045b2642",
+                "reference": "639e03ac12cf23def171770bcab05758045b2642",
                 "shasum": ""
             },
             "require": {
@@ -15397,7 +15396,7 @@
                 "issues": "https://github.com/laravel/sail/issues",
                 "source": "https://github.com/laravel/sail"
             },
-            "time": "2026-09-18T14:34:46+00:00"
+            "time": "2026-08-12T13:55:56+00:00"
         },
         {
             "name": "laravel/sentinel",
@@ -15457,16 +15456,16 @@
         },
         {
             "name": "laravel/telescope",
-            "version": "v5.25.0",
+            "version": "v5.24.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/telescope.git",
-                "reference": "65fe6724f8688de01dfa74b28a0edc191bc3caa8"
+                "reference": "50cbcf4553ddfd8d4bd456b04f97dfed923007d9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/telescope/zipball/65fe6724f8688de01dfa74b28a0edc191bc3caa8",
-                "reference": "65fe6724f8688de01dfa74b28a0edc191bc3caa8",
+                "url": "https://api.github.com/repos/laravel/telescope/zipball/50cbcf4553ddfd8d4bd456b04f97dfed923007d9",
+                "reference": "50cbcf4553ddfd8d4bd456b04f97dfed923007d9",
                 "shasum": ""
             },
             "require": {
@@ -15519,9 +15518,9 @@
                 "monitoring"
             ],
             "support": {
-                "source": "https://github.com/laravel/telescope/tree/v5.25.0"
+                "source": "https://github.com/laravel/telescope/tree/v5.24.0"
             },
-            "time": "2026-09-09T14:16:19+00:00"
+            "time": "2026-09-08T16:15:16+00:00"
         },
         {
             "name": "mockery/mockery",

extensions/manifest.json

@@ -1,7 +1,7 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "v0.0.8"
+        "ref": "v0.0.7"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",

resources/js/packages/ui/src/FullCalendar/useEventResize.ts

@@ -111,8 +111,6 @@ export function useEventResize(params: {
         edge: 'start' | 'end',
         dayStr: string
     ) {
-        if (e.button !== 0) return;
-
         e.preventDefault();
         e.stopPropagation();
 

resources/js/packages/ui/src/TimeTracker/TimeTrackerEntryInput.vue

@@ -168,10 +168,6 @@ defineExpose({ submit, focusAfterStart });
         data-testid="time_entry_description"
         class="w-full rounded-l-lg py-4 sm:py-2.5 px-3.5 border-b border-b-card-background-separator @2xl:px-4 text-base text-text-primary bg-transparent border-none placeholder-text-secondary focus:ring-0 transition"
         type="text"
-        autocomplete="off"
-        data-1p-ignore
-        data-lpignore="true"
-        data-form-type="other"
         @keydown.enter="submit"
         @keydown.esc="showDropdown = false"
         @blur="updateTimeEntryDescription" />

resources/js/packages/ui/src/TimeTracker/TimeTrackerRangeSelector.vue

@@ -170,10 +170,6 @@ function closeAndFocusInput() {
                             : 'text-text-primary bg-card-background border-border-secondary border border-none'
                     "
                     type="text"
-                    autocomplete="off"
-                    data-1p-ignore
-                    data-lpignore="true"
-                    data-form-type="other"
                     @focusin="openModalOnTab"
                     @click="openModalOnClick"
                     @keydown.exact.tab="focusNextElement"

resources/js/utils/notification.ts

@@ -19,7 +19,7 @@ export const useNotificationsStore = defineStore('notifications', () => {
     const showActionBlockedModal = ref(false);
 
     function addNotification(type: NotificationType, title: string, message?: string) {
-        const uuid = Math.random().toString(36).substring(7);
+        const uuid = crypto.randomUUID();
         notifications.value.push({ title, message, type, uuid });
 
         setTimeout(() => {

tests/Unit/Endpoint/Api/V1/TimeEntryEndpointTest.php

@@ -2780,90 +2780,6 @@ class TimeEntryEndpointTest extends ApiEndpointTestAbstract
         });
     }
 
-    public function test_update_endpoint_removes_task_if_project_is_changed_without_setting_a_new_task(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'time-entries:update:own',
-            'projects:view:all',
-        ]);
-        $project1 = Project::factory()->forOrganization($data->organization)->create();
-        $project2 = Project::factory()->forOrganization($data->organization)->create();
-        $task1 = Task::factory()->forProject($project1)->forOrganization($data->organization)->create();
-        $timeEntry = TimeEntry::factory()->forOrganization($data->organization)->forProject($project1)->forTask($task1)->forMember($data->member)->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.time-entries.update', [$data->organization->getKey(), $timeEntry->getKey()]), [
-            'project_id' => $project2->getKey(),
-        ]);
-
-        // Assert
-        $response->assertValid();
-        $this->assertResponseCode($response, 200);
-        $response->assertJsonPath('data.project_id', $project2->getKey());
-        $response->assertJsonPath('data.task_id', null);
-        $this->assertDatabaseHas(TimeEntry::class, [
-            'id' => $timeEntry->getKey(),
-            'project_id' => $project2->getKey(),
-            'task_id' => null,
-        ]);
-    }
-
-    public function test_update_endpoint_removes_task_if_project_is_removed_without_removing_the_task(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'time-entries:update:own',
-            'projects:view:all',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->create();
-        $task = Task::factory()->forProject($project)->forOrganization($data->organization)->create();
-        $timeEntry = TimeEntry::factory()->forOrganization($data->organization)->forProject($project)->forTask($task)->forMember($data->member)->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.time-entries.update', [$data->organization->getKey(), $timeEntry->getKey()]), [
-            'project_id' => null,
-        ]);
-
-        // Assert
-        $response->assertValid();
-        $this->assertResponseCode($response, 200);
-        $this->assertDatabaseHas(TimeEntry::class, [
-            'id' => $timeEntry->getKey(),
-            'project_id' => null,
-            'task_id' => null,
-        ]);
-    }
-
-    public function test_update_endpoint_keeps_task_if_project_is_set_to_the_project_of_the_task(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'time-entries:update:own',
-            'projects:view:all',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->create();
-        $task = Task::factory()->forProject($project)->forOrganization($data->organization)->create();
-        $timeEntry = TimeEntry::factory()->forOrganization($data->organization)->forProject($project)->forTask($task)->forMember($data->member)->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->putJson(route('api.v1.time-entries.update', [$data->organization->getKey(), $timeEntry->getKey()]), [
-            'project_id' => $project->getKey(),
-        ]);
-
-        // Assert
-        $response->assertValid();
-        $this->assertResponseCode($response, 200);
-        $this->assertDatabaseHas(TimeEntry::class, [
-            'id' => $timeEntry->getKey(),
-            'project_id' => $project->getKey(),
-            'task_id' => $task->getKey(),
-        ]);
-    }
-
     public function test_update_endpoint_fails_if_employee_tries_to_update_time_entry_to_private_project_without_access(): void
     {
         // Arrange
@@ -3891,44 +3807,6 @@ class TimeEntryEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
-    public function test_update_multiple_removes_task_from_time_entries_if_project_is_removed_without_removing_the_task(): void
-    {
-        // Arrange
-        $data = $this->createUserWithPermission([
-            'time-entries:update:own',
-            'projects:view:all',
-        ]);
-        $project = Project::factory()->forOrganization($data->organization)->create();
-        $task = Task::factory()->forProject($project)->forOrganization($data->organization)->create();
-        $timeEntry = TimeEntry::factory()->forOrganization($data->organization)->forProject($project)->forTask($task)->forMember($data->member)->create();
-        Passport::actingAs($data->user);
-
-        // Act
-        $response = $this->patchJson(route('api.v1.time-entries.update-multiple', [$data->organization->getKey()]), [
-            'ids' => [
-                $timeEntry->getKey(),
-            ],
-            'changes' => [
-                'project_id' => null,
-            ],
-        ]);
-
-        // Assert
-        $response->assertValid();
-        $this->assertResponseCode($response, 200);
-        $response->assertExactJson([
-            'success' => [
-                $timeEntry->getKey(),
-            ],
-            'error' => [],
-        ]);
-        $this->assertDatabaseHas(TimeEntry::class, [
-            'id' => $timeEntry->getKey(),
-            'project_id' => null,
-            'task_id' => null,
-        ]);
-    }
-
     public function test_update_multiple_updates_own_time_entries_and_fails_for_time_entries_of_other_users_and_and_other_organizations_with_own_time_entries_permission(): void
     {
         // Arrange

tests/Unit/Service/DeletionServiceTest.php

@@ -10,9 +10,6 @@ use App\Exceptions\Api\CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembe
 use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
-use App\Models\Passport\Client as PassportClient;
-use App\Models\Passport\RefreshToken;
-use App\Models\Passport\Token;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -26,7 +23,6 @@ use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
-use Illuminate\Support\Str;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Tests\TestCaseWithDatabase;
 use TiMacDonald\Log\LogEntry;
@@ -428,45 +424,4 @@ class DeletionServiceTest extends TestCaseWithDatabase
             'role' => Role::Placeholder->value,
         ]);
     }
-
-    public function test_delete_user_deletes_access_tokens_and_their_refresh_tokens_but_does_not_delete_tokens_of_other_users(): void
-    {
-        // Arrange
-        $user = User::factory()->create();
-        $otherUser = User::factory()->create();
-        $passportClient = PassportClient::factory()->create();
-
-        $userToken = Token::factory()->forUser($user)->forClient($passportClient)->create();
-        $userRefreshToken = RefreshToken::query()->create([
-            'id' => Str::random(100),
-            'access_token_id' => $userToken->getKey(),
-            'revoked' => false,
-            'expires_at' => now()->addDays(30),
-        ]);
-
-        $otherUserToken = Token::factory()->forUser($otherUser)->forClient($passportClient)->create();
-        $otherUserRefreshToken = RefreshToken::query()->create([
-            'id' => Str::random(100),
-            'access_token_id' => $otherUserToken->getKey(),
-            'revoked' => false,
-            'expires_at' => now()->addDays(30),
-        ]);
-
-        // Act
-        $this->deletionService->deleteUser($user);
-
-        // Assert
-        $this->assertDatabaseMissing(Token::class, [
-            'id' => $userToken->getKey(),
-        ]);
-        $this->assertDatabaseMissing(RefreshToken::class, [
-            'id' => $userRefreshToken->getKey(),
-        ]);
-        $this->assertDatabaseHas(Token::class, [
-            'id' => $otherUserToken->getKey(),
-        ]);
-        $this->assertDatabaseHas(RefreshToken::class, [
-            'id' => $otherUserRefreshToken->getKey(),
-        ]);
-    }
 }