fix vertical alignment of dropdown triggers (time entry row more)

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.3.1 to 5.4.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v5.3.1...v5.4.0)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.env.ci

@@ -1,10 +1,11 @@
+# Application
 APP_NAME=solidtime
 APP_ENV=local
 APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost
 APP_FORCE_HTTPS=false
-SESSION_SECURE_COOKIE=false
+APP_ENABLE_REGISTRATION=true
 
 # Logging
 LOG_CHANNEL=stack
@@ -19,35 +20,39 @@ DB_TEST_DATABASE=laravel
 DB_TEST_USERNAME=root
 DB_TEST_PASSWORD=root
 
-BROADCAST_DRIVER=log
+# Broadcasting
+BROADCAST_DRIVER=null
+
+# Cache
 CACHE_DRIVER=file
+
+# Queue
 QUEUE_CONNECTION=sync
+
+# Session
 SESSION_DRIVER=database
 SESSION_LIFETIME=120
 
 # Mail
 MAIL_MAILER=log
-MAIL_FROM_ADDRESS="hello@example.com"
-MAIL_FROM_NAME="${APP_NAME}"
+MAIL_FROM_ADDRESS="no-reply@solidtime.test"
+MAIL_FROM_NAME="solidtime"
+MAIL_REPLY_TO_ADDRESS="hello@solidtime.test"
+MAIL_REPLY_TO_NAME="solidtime"
 
 # Filesystems
 FILESYSTEM_DISK=local
 PUBLIC_FILESYSTEM_DISK=public
 
+# Passport
+PASSPORT_PERSONAL_ACCESS_CLIENT_ID="9e27f54d-5dfb-4dde-99d7-834518236c92"
+PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET="EL5mXp3aF8ITjcwoOXRpbSK7zGrWhW4zTDpQXTkf"
+
+# Auditing
+AUDITING_ENABLED=true
+
+# Telescope
+TELESCOPE_ENABLED=false
+
 # Services
 GOTENBERG_URL=http://0.0.0.0:3000
-
-PUSHER_APP_ID=
-PUSHER_APP_KEY=
-PUSHER_APP_SECRET=
-PUSHER_HOST=
-PUSHER_PORT=443
-PUSHER_SCHEME=https
-PUSHER_APP_CLUSTER=mt1
-
-VITE_APP_NAME="${APP_NAME}"
-VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
-VITE_PUSHER_HOST="${PUSHER_HOST}"
-VITE_PUSHER_PORT="${PUSHER_PORT}"
-VITE_PUSHER_SCHEME="${PUSHER_SCHEME}"
-VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

.env.example

@@ -1,10 +1,13 @@
+# Application
 APP_NAME=solidtime
 APP_ENV=local
 APP_KEY=base64:UNQNf1SXeASNkWux01Rj8EnHYx8FO0kAxWNDwktclkk=
 APP_DEBUG=true
 APP_URL=https://solidtime.test
-AUDITING_ENABLED=true
+APP_FORCE_HTTPS=false
+APP_ENABLE_REGISTRATION=true
 SUPER_ADMINS=admin@example.com
+PAGINATION_PER_PAGE_DEFAULT=500
 
 # Logging
 LOG_CHANNEL=single
@@ -25,9 +28,16 @@ DB_TEST_DATABASE=laravel
 DB_TEST_USERNAME=root
 DB_TEST_PASSWORD=root
 
-BROADCAST_DRIVER=log
+# Broadcasting
+BROADCAST_DRIVER=null
+
+# Cache
 CACHE_DRIVER=file
+
+# Queue
 QUEUE_CONNECTION=sync
+
+# Session
 SESSION_DRIVER=database
 SESSION_LIFETIME=120
 
@@ -39,15 +49,9 @@ MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_ENCRYPTION=null
 MAIL_FROM_ADDRESS="no-reply@solidtime.test"
-MAIL_FROM_NAME="${APP_NAME}"
-
-PUSHER_APP_ID=
-PUSHER_APP_KEY=
-PUSHER_APP_SECRET=
-PUSHER_HOST=
-PUSHER_PORT=443
-PUSHER_SCHEME=https
-PUSHER_APP_CLUSTER=mt1
+MAIL_FROM_NAME="solidtime"
+MAIL_REPLY_TO_ADDRESS="hello@solidtime.test"
+MAIL_REPLY_TO_NAME="solidtime"
 
 # Filesystems
 FILESYSTEM_DISK=s3
@@ -60,21 +64,24 @@ S3_URL=http://storage.solidtime.test/local
 S3_ENDPOINT=http://storage.solidtime.test
 S3_USE_PATH_STYLE_ENDPOINT=true
 
+# Passport
+PASSPORT_PERSONAL_ACCESS_CLIENT_ID="9e27f54d-5dfb-4dde-99d7-834518236c92"
+PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET="EL5mXp3aF8ITjcwoOXRpbSK7zGrWhW4zTDpQXTkf"
+
+# Auditing
+AUDITING_ENABLED=true
+
+# Telescope
+TELESCOPE_ENABLED=false
+
 # Services
 GOTENBERG_URL=http://gotenberg:3000
 
-VITE_HOST_NAME=vite.solidtime.test
-VITE_APP_NAME="${APP_NAME}"
-VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
-VITE_PUSHER_HOST="${PUSHER_HOST}"
-VITE_PUSHER_PORT="${PUSHER_PORT}"
-VITE_PUSHER_SCHEME="${PUSHER_SCHEME}"
-VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
-
+# Local setup
 NGINX_HOST_NAME=solidtime.test
 NETWORK_NAME=reverse-proxy-docker-traefik_routing
-
 FORWARD_DB_PORT=5432
 FORWARD_WEB_PORT=8083
-
-PAGINATION_PER_PAGE_DEFAULT=500
+VITE_HOST_NAME=vite.solidtime.test
+VITE_APP_NAME="${APP_NAME}"
+#SAIL_XDEBUG_MODE=develop,debug,coverage

.env.production

@@ -5,7 +5,6 @@ VITE_APP_NAME=solidtime
 APP_ENV=production
 APP_DEBUG=false
 APP_FORCE_HTTPS=true
-SESSION_SECURE_COOKIE=true
 OCTANE_SERVER=frankenphp
 PAGINATION_PER_PAGE_DEFAULT=500
 

.eslintrc.cjs

@@ -1,13 +0,0 @@
-/* eslint-env node */
-require("@rushstack/eslint-patch/modern-module-resolution")
-
-module.exports = {
-    extends: ['plugin:vue/vue3-essential', '@vue/eslint-config-typescript/recommended', '@vue/eslint-config-prettier'],
-    rules: {
-        'vue/multi-word-component-names': 'off',
-        "@typescript-eslint/no-unused-vars": "off",
-        "unused-imports/no-unused-imports": "error",
-        "unused-imports/no-unused-vars": "error",
-    },
-    plugins: ['unused-imports'],
-}

.github/ISSUE_TEMPLATE/1_bug_report.yml

@@ -0,0 +1,47 @@
+name: Bug Report
+description: "Report a bug"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before creating a new bug report, please check that there isn't already a similar issue.
+
+  - type: textarea
+    attributes:
+      label: Description
+      description: A clear and concise description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: "Steps To Reproduce"
+      description: How do you trigger this bug? Please walk us through it step by step.
+      value: |
+        1.
+        2.
+        3.
+        ...
+    validations:
+      required: false
+
+  - type: dropdown
+    attributes:
+      label: "Self-hosted or Cloud?"
+      options:
+        - Self-Hosted
+        - solidtime Cloud
+        - Both
+
+  - type: input
+    attributes:
+      label: "Version of solidtime: (for self-hosted)"
+    validations:
+      required: false
+
+  - type: input
+    attributes:
+      label: "solidtime self-hosting guide: (for self-hosted)"
+      description: "Did you use the official guide to self-host solidtime? If yes, which one?"
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 🚀 Feature Request
+    url: https://github.com/solidtime-io/solidtime/discussions/new?category=feature-requests
+    about: Share ideas for new features
+  - name: ❓ Ask a Question
+    url: https://github.com/solidtime-io/solidtime/discussions/new?category=general
+    about: Ask the community for help

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,8 @@
+<!--
+This project is early stage. The structure and APIs are still subject to change and not stable.
+Therefore, we do not currently accept any contributions, unless you are a member of the team.
+
+As soon as we feel comfortable enough that the application structure is stable enough, we will open up the project for contributions.
+
+We do accept contributions in the [documentation repository](https://github.com/solidtime-io/docs) f.e. to add new self-hosting guides.
+-->

.github/workflows/build-public.yml

@@ -11,10 +11,21 @@ on:
       - 'docker/prod/**'
   workflow_dispatch:
 
+env:
+  DOCKERHUB_REPO: solidtime/solidtime
+  GHCR_REPO: ghcr.io/solidtime-io/solidtime
+
 name: Build - Public
 jobs:
   build:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - runs-on: "ubuntu-24.04-arm"
+            platform: "linux/arm64"
+          - runs-on: "ubuntu-24.04"
+            platform: "linux/amd64"
+    runs-on: ${{ matrix.runs-on }}
     permissions:
       packages: write
       contents: read
@@ -29,7 +40,7 @@ jobs:
           fetch-depth: 0 # Required for WyriHaximus/github-action-get-previous-tag
 
       - name: "Get build"
-        id: build
+        id: release-build
         run: echo "build=$(git rev-parse --short=8 HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: "Get Previous tag (normal push)"
@@ -40,7 +51,7 @@ jobs:
           prefix: "v"
 
       - name: "Get version"
-        id: version
+        id: release-version
         run: |
           if ${{ !startsWith(github.ref, 'refs/tags/v') }}; then
             if ${{ startsWith(steps.previoustag.outputs.tag, 'v') }}; then
@@ -61,21 +72,23 @@ jobs:
           rm .env.production .env.ci .env.example
 
       - name: "Add version to .env"
-        run: sed -i 's/APP_VERSION=0.0.0/APP_VERSION=${{ steps.version.outputs.app_version }}/g' .env
+        run: sed -i 's/APP_VERSION=0.0.0/APP_VERSION=${{ steps.release-version.outputs.app_version }}/g' .env
 
       - name: "Add build to .env"
-        run: sed -i 's/APP_BUILD=0/APP_BUILD=${{ steps.build.outputs.build }}/g' .env
+        run: sed -i 's/APP_BUILD=0/APP_BUILD=${{ steps.release-build.outputs.build }}/g' .env
 
       - name: "Output .env"
         run: cat .env
 
-      - name: "Install dependencies"
-        uses: php-actions/composer@v6
-        if: steps.cache-vendor.outputs.cache-hit != 'true' # Skip if cache hit
+      - name: "Setup PHP with PECL extension"
+        uses: shivammathur/setup-php@v2
         with:
-          command: install
-          only_args: --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
-          php_version: 8.3
+          php-version: '8.3'
+          extensions: mbstring, dom, fileinfo, pgsql
+
+      - name: "Install dependencies"
+        run: composer install --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+        if: steps.cache-vendor.outputs.cache-hit != 'true' # Skip if cache hit
 
       - name: "Use Node.js"
         uses: actions/setup-node@v4
@@ -88,29 +101,31 @@ jobs:
       - name: "Build"
         run: npm run build
 
-      - name: "Login to GitHub Container Registry"
+      - name: "Prepare"
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: "Docker meta"
+        id: "meta"
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.DOCKERHUB_REPO }}
+            ${{ env.GHCR_REPO }}
+
+      - name: "Login to Docker Hub Container Registry"
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: "Login to GitHub Container Registry"
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: "Docker meta"
-        id: "meta"
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            solidtime/solidtime
-            ghcr.io/${{ github.repository }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
 
       - name: "Set up QEMU"
         uses: docker/setup-qemu-action@v3
@@ -118,16 +133,90 @@ jobs:
       - name: "Set up Docker Buildx"
         uses: docker/setup-buildx-action@v3
 
-      - name: "Build and push"
+      - name: "Build and push by digest"
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
           file: docker/prod/Dockerfile
           build-args: |
             DOCKER_FILES_BASE_PATH=docker/prod/
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,"name=${{ env.DOCKERHUB_REPO }},${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: "Export digest"
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: "Upload digest"
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+    timeout-minutes: 90
+    needs:
+      - build
+    steps:
+      - name: "Download digests"
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: "Login to Docker Hub"
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: "Login to GHCR"
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Set up Docker Buildx"
+        uses: docker/setup-buildx-action@v3
+
+      - name: "Docker meta"
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.DOCKERHUB_REPO }}
+            ${{ env.GHCR_REPO }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: "Create manifest list and push"
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.DOCKERHUB_REPO }}@sha256:%s ' *)
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+
+      - name: "Inspect image"
+        run: |
+          docker buildx imagetools inspect ${{ env.DOCKERHUB_REPO }}:${{ steps.meta.outputs.version }}
+          docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ steps.meta.outputs.version }}

.github/workflows/npm-publish-api.yml

@@ -8,7 +8,8 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - name: "Checkout code"
+        uses: actions/checkout@v4
       # Setup .npmrc file to publish to npm
       - name: Install root project dependencies
         run: npm ci

.github/workflows/npm-publish-ui.yml

@@ -8,7 +8,8 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - name: "Checkout code"
+        uses: actions/checkout@v4
       # Setup .npmrc file to publish to npm
       - uses: actions/setup-node@v4
         with:

.github/workflows/phpunit.yml

@@ -63,7 +63,7 @@ jobs:
         run: php artisan test --stop-on-failure --coverage-text --coverage-clover=coverage.xml
 
       - name: "Upload coverage reports to Codecov"
-        uses: codecov/codecov-action@v4.5.0
+        uses: codecov/codecov-action@v5.4.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: solidtime-io/solidtime

.github/workflows/pint.yml

@@ -10,6 +10,6 @@ jobs:
         uses: actions/checkout@v4
 
       - name: "Check code style"
-        uses: aglipanci/laravel-pint-action@2.4
+        uses: aglipanci/laravel-pint-action@2.5
         with:
           configPath: "pint.json"

.github/workflows/playwright.yml

@@ -27,45 +27,47 @@ jobs:
       - name: "Checkout code"
         uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - name: "Setup node"
+        uses: actions/setup-node@v4
         with:
           node-version: '20.x'
 
-      - name: Setup PHP
+      - name: "Setup PHP"
         uses: shivammathur/setup-php@v2
         with:
           php-version: '8.3'
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
           coverage: none
 
-      - name: Run composer install
+      - name: "Run composer install"
         run: composer install -n --prefer-dist
 
-      - name: Prepare Laravel Application
+      - name: "Prepare Laravel Application"
         run: |
           cp .env.ci .env
           php artisan key:generate
-          php artisan migrate --seed
           php artisan passport:keys
+          php artisan migrate --seed
 
-      - name: Install dependencies
+      - name: "Install dependencies"
         run: npm ci
 
-      - name: Build Frontend
+      - name: "Build Frontend"
         run: npm run build
 
-      - name: Run Laravel Server
+      - name: "Run Laravel Server"
         run: php artisan serve > /dev/null 2>&1 &
 
-      - name: Install Playwright Browsers
+      - name: "Install Playwright Browsers"
         run: npx playwright install --with-deps
 
-      - name: Run Playwright tests
+      - name: "Run Playwright tests"
         run: npx playwright test
         env:
           PLAYWRIGHT_BASE_URL: 'http://127.0.0.1:8000'
 
-      - uses: actions/upload-artifact@v4
+      - name: "Upload test results"
+        uses: actions/upload-artifact@v4
         if: always()
         with:
           name: test-results

app/Actions/Fortify/CreateNewUser.php

@@ -4,16 +4,14 @@ declare(strict_types=1);
 
 namespace App\Actions\Fortify;
 
-use App\Enums\Role;
 use App\Enums\Weekday;
 use App\Events\NewsletterRegistered;
-use App\Models\Organization;
 use App\Models\User;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\TimezoneService;
+use App\Service\UserService;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\ValidationException;
 use Korridor\LaravelModelValidationRules\Rules\UniqueEloquent;
@@ -34,6 +32,12 @@ class CreateNewUser implements CreatesNewUsers
      */
     public function create(array $input): User
     {
+        if (! config('app.enable_registration')) {
+            throw ValidationException::withMessages([
+                'email' => [__('Registration is disabled.')],
+            ]);
+        }
+
         Validator::make($input, [
             'name' => [
                 'required',
@@ -81,30 +85,16 @@ class CreateNewUser implements CreatesNewUsers
             $currency = $ipLookupResponse->currency;
         }
         $user = null;
-        $organization = null;
-        DB::transaction(function () use (&$user, &$organization, $input, $timezone, $startOfWeek, $currency): void {
-            $user = User::create([
-                'name' => $input['name'],
-                'email' => $input['email'],
-                'password' => Hash::make($input['password']),
-                'timezone' => $timezone ?? 'UTC',
-                'week_start' => $startOfWeek,
-            ]);
-
-            $organization = new Organization;
-            $organization->name = explode(' ', $user->name, 2)[0]."'s Organization";
-            $organization->personal_team = true;
-            $organization->currency = $currency ?? 'EUR';
-            $organization->owner()->associate($user);
-            $organization->save();
-
-            $organization->users()->attach(
-                $user, [
-                    'role' => Role::Owner->value,
-                ]
+        DB::transaction(function () use (&$user, $input, $timezone, $startOfWeek, $currency): void {
+            $userService = app(UserService::class);
+            $user = $userService->createUser(
+                $input['name'],
+                $input['email'],
+                $input['password'],
+                $timezone ?? 'UTC',
+                $startOfWeek,
+                $currency ?? 'EUR',
             );
-
-            $user->ownedTeams()->save($organization);
         });
 
         $newsletterConsent = isset($input['newsletter_consent']) && (bool) $input['newsletter_consent'];

app/Actions/Jetstream/AddOrganizationMember.php

@@ -7,18 +7,16 @@ namespace App\Actions\Jetstream;
 use App\Enums\Role;
 use App\Models\Organization;
 use App\Models\User;
+use App\Service\MemberService;
 use Closure;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\Rules\In;
 use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
 use Laravel\Jetstream\Contracts\AddsTeamMembers;
-use Laravel\Jetstream\Events\AddingTeamMember;
-use Laravel\Jetstream\Events\TeamMemberAdded;
 
 class AddOrganizationMember implements AddsTeamMembers
 {
@@ -36,15 +34,7 @@ class AddOrganizationMember implements AddsTeamMembers
             ->where('is_placeholder', '=', false)
             ->firstOrFail();
 
-        AddingTeamMember::dispatch($organization, $newOrganizationMember);
-
-        DB::transaction(function () use ($organization, $newOrganizationMember, $role): void {
-            $organization->users()->attach(
-                $newOrganizationMember, ['role' => $role]
-            );
-        });
-
-        TeamMemberAdded::dispatch($organization, $newOrganizationMember);
+        app(MemberService::class)->addMember($newOrganizationMember, $organization, Role::from($role));
     }
 
     /**

app/Console/Commands/Admin/UserCreateCommand.php

@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands\Admin;
+
+use App\Enums\Weekday;
+use App\Models\Organization;
+use App\Models\User;
+use App\Service\UserService;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\DB;
+use LogicException;
+
+class UserCreateCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'admin:user:create
+                { name : The name of the user }
+                { email : The email of the user }
+                { --ask-for-password : Ask for the password, otherwise the command will generate a random one }
+                { --verify-email : Verify the email address of the user }';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Create a new user';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(): int
+    {
+        $name = $this->argument('name');
+        $email = $this->argument('email');
+        $askForPassword = (bool) $this->option('ask-for-password');
+        $verifyEmail = (bool) $this->option('verify-email');
+
+        if (User::query()->where('email', $email)->where('is_placeholder', '=', false)->exists()) {
+            $this->error('User with email "'.$email.'" already exists.');
+
+            return self::FAILURE;
+        }
+
+        if ($askForPassword) {
+            $outputPassword = false;
+            $password = $this->secret('Enter the password');
+        } else {
+            $outputPassword = true;
+            $password = bin2hex(random_bytes(16));
+        }
+
+        $user = null;
+        DB::transaction(function () use (&$user, $name, $email, $password, $verifyEmail): void {
+            $user = app(UserService::class)->createUser(
+                $name,
+                $email,
+                $password,
+                'UTC',
+                Weekday::Monday,
+                'EUR',
+                $verifyEmail
+            );
+        });
+        /** @var Organization|null $organization */
+        $organization = $user->ownedTeams->first();
+        if ($organization === null) {
+            throw new LogicException('User does not have an organization');
+        }
+
+        $this->info('Created user "'.$name.'" ("'.$email.'")');
+        $this->line('ID: '.$user->getKey());
+        $this->line('Name: '.$name);
+        $this->line('Email: '.$email);
+        if ($outputPassword) {
+            $this->line('Password: '.$password);
+        }
+        $this->line('Timezone: '.$user->timezone);
+        $this->line('Week start: '.$user->week_start->value);
+
+        // Organization
+        $this->line('Currency: '.$organization->currency);
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/Admin/UserVerifyCommand.php

@@ -35,7 +35,9 @@ class UserVerifyCommand extends Command
         $this->info('Start verifying user with email "'.$email.'"');
 
         /** @var User|null $user */
-        $user = User::where('email', $email)->first();
+        $user = User::query()->where('email', $email)
+            ->where('is_placeholder', '=', false)
+            ->first();
 
         if ($user === null) {
             $this->error('User with email "'.$email.'" not found.');

app/Console/Commands/Correction/CorrectionPlaceholderMembersCommand.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands\Correction;
+
+use App\Enums\Role;
+use App\Models\Member;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Builder;
+
+class CorrectionPlaceholderMembersCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'correction:placeholder-members '.
+        ' { --dry-run : Do not actually save anything to the database, just output what would happen }';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Sets all members who belong to a placeholder user to role placeholder';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(): int
+    {
+        $this->comment('Sets all members who belong to a placeholder user to role placeholder...');
+        $dryRun = (bool) $this->option('dry-run');
+        if ($dryRun) {
+            $this->comment('Running in dry-run mode. Nothing will be saved to the database.');
+        }
+
+        $members = Member::query()
+            ->where('role', '!=', Role::Placeholder->value)
+            ->whereHas('user', function (Builder $builder): void {
+                /** @var Builder<User> $builder */
+                $builder->where('is_placeholder', '=', true);
+            })
+            ->get();
+        foreach ($members as $member) {
+            /** @var Member $member */
+            $member->role = Role::Placeholder->value;
+            if (! $dryRun) {
+                $member->save();
+            }
+            $this->line('Set role of member (id='.$member->getKey().') to placeholder');
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Exceptions/Api/ChangingRoleOfPlaceholderIsNotAllowed.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\Api;
+
+class ChangingRoleOfPlaceholderIsNotAllowed extends ApiException
+{
+    public const string KEY = 'changing_role_of_placeholder_is_not_allowed';
+}

app/Exceptions/Api/OnlyPlaceholdersCanBeMergedIntoAnotherMember.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\Api;
+
+class OnlyPlaceholdersCanBeMergedIntoAnotherMember extends ApiException
+{
+    public const string KEY = 'only_placeholders_can_be_merged_into_another_member';
+}

app/Exceptions/Api/PersonalAccessClientIsNotConfiguredException.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\Api;
+
+class PersonalAccessClientIsNotConfiguredException extends ApiException
+{
+    public const string KEY = 'personal_access_client_is_not_configured';
+}

app/Exceptions/Api/ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\Api;
+
+class ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException extends ApiException
+{
+    public const string KEY = 'this_placeholder_can_not_be_invited_use_the_merge_tool_instead_api_exception';
+}

app/Filament/Resources/ClientResource.php

@@ -60,8 +60,13 @@ class ClientResource extends Resource
             ->defaultSort('created_at', 'desc')
             ->filters([
                 SelectFilter::make('organization')
+                    ->label('Organization')
                     ->relationship('organization', 'name')
                     ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
             ])
             ->actions([
                 Tables\Actions\EditAction::make(),

app/Filament/Resources/ClientResource/Pages/EditClient.php

@@ -15,7 +15,8 @@ class EditClient extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
         ];
     }
 }

app/Filament/Resources/ClientResource/Pages/ListClients.php

@@ -15,7 +15,8 @@ class ListClients extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/OrganizationInvitationResource.php

@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Enums\Role;
+use App\Filament\Resources\OrganizationInvitationResource\Pages;
+use App\Models\OrganizationInvitation;
+use App\Service\OrganizationInvitationService;
+use Filament\Forms;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Form;
+use Filament\Resources\Resource;
+use Filament\Tables;
+use Filament\Tables\Table;
+use Illuminate\Support\Collection;
+
+class OrganizationInvitationResource extends Resource
+{
+    protected static ?string $model = OrganizationInvitation::class;
+
+    protected static ?string $label = 'Invitations';
+
+    protected static ?string $navigationIcon = 'heroicon-o-user-plus';
+
+    protected static ?string $navigationGroup = 'Users';
+
+    protected static ?int $navigationSort = 9;
+
+    public static function form(Form $form): Form
+    {
+        return $form
+            ->columns(1)
+            ->schema([
+                Forms\Components\TextInput::make('email')
+                    ->label('Email')
+                    ->disabledOn(['edit'])
+                    ->required(),
+                Select::make('role')
+                    ->options(Role::class),
+                Forms\Components\Select::make('organization_id')
+                    ->label('Organization')
+                    ->relationship(name: 'organization', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->disabledOn(['edit'])
+                    ->required(),
+                Forms\Components\DateTimePicker::make('created_at')
+                    ->label('Created At')
+                    ->hiddenOn(['create'])
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('updated_at')
+                    ->label('Updated At')
+                    ->hiddenOn(['create'])
+                    ->disabled(),
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                Tables\Columns\TextColumn::make('organization.name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('email')
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('role'),
+                Tables\Columns\TextColumn::make('created_at')
+                    ->label('Created At')
+                    ->dateTime()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('updated_at')
+                    ->label('Updated At')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                //
+            ])
+            ->actions([
+                Tables\Actions\EditAction::make(),
+                Tables\Actions\DeleteAction::make(),
+            ])
+            ->bulkActions([
+                Tables\Actions\BulkActionGroup::make([
+                    Tables\Actions\BulkAction::make('resend')
+                        ->label('Resend')
+                        ->action(function (Collection $records): void {
+                            foreach ($records as $organizationInvite) {
+                                app(OrganizationInvitationService::class)->resend($organizationInvite);
+                            }
+                        }),
+                ]),
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => Pages\ListOrganizationInvitations::route('/'),
+            'edit' => Pages\EditOrganizationInvitation::route('/{record}/edit'),
+            'view' => Pages\ViewOrganizationInvitation::route('/{record}'),
+        ];
+    }
+}

app/Filament/Resources/OrganizationInvitationResource/Pages/EditOrganizationInvitation.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\OrganizationInvitationResource\Pages;
+
+use App\Filament\Resources\OrganizationInvitationResource;
+use Filament\Actions;
+use Filament\Resources\Pages\EditRecord;
+
+class EditOrganizationInvitation extends EditRecord
+{
+    protected static string $resource = OrganizationInvitationResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
+        ];
+    }
+}

app/Filament/Resources/OrganizationInvitationResource/Pages/ListOrganizationInvitations.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\OrganizationInvitationResource\Pages;
+
+use App\Filament\Resources\OrganizationInvitationResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListOrganizationInvitations extends ListRecords
+{
+    protected static string $resource = OrganizationInvitationResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Filament/Resources/OrganizationInvitationResource/Pages/ViewOrganizationInvitation.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\OrganizationInvitationResource\Pages;
+
+use App\Filament\Resources\OrganizationInvitationResource;
+use Filament\Actions\EditAction;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewOrganizationInvitation extends ViewRecord
+{
+    protected static string $resource = OrganizationInvitationResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            EditAction::make('edit')
+                ->icon('heroicon-s-pencil'),
+        ];
+    }
+}

app/Filament/Resources/OrganizationResource.php

@@ -5,8 +5,10 @@ declare(strict_types=1);
 namespace App\Filament\Resources;
 
 use App\Filament\Resources\OrganizationResource\Pages;
+use App\Filament\Resources\OrganizationResource\RelationManagers\InvitationsRelationManager;
 use App\Filament\Resources\OrganizationResource\RelationManagers\UsersRelationManager;
 use App\Models\Organization;
+use App\Service\DeletionService;
 use App\Service\Export\ExportService;
 use App\Service\Import\Importers\ImporterProvider;
 use App\Service\Import\Importers\ImportException;
@@ -46,10 +48,13 @@ class OrganizationResource extends Resource
                     ->maxLength(255),
                 Forms\Components\Toggle::make('personal_team')
                     ->label('Is personal?')
+                    ->hiddenOn(['create'])
                     ->required(),
                 Forms\Components\Select::make('user_id')
+                    ->label('Owner')
                     ->relationship(name: 'owner', titleAttribute: 'email')
                     ->searchable(['name', 'email'])
+                    ->disabledOn(['edit'])
                     ->required(),
                 Forms\Components\Select::make('currency')
                     ->label('Currency')
@@ -62,6 +67,7 @@ class OrganizationResource extends Resource
 
                         return $select;
                     })
+                    ->required()
                     ->searchable(),
                 Forms\Components\TextInput::make('billable_rate')
                     ->label('Billable rate (in Cents)')
@@ -75,9 +81,11 @@ class OrganizationResource extends Resource
                     ->numeric(),
                 Forms\Components\DateTimePicker::make('created_at')
                     ->label('Created At')
+                    ->hiddenOn(['create'])
                     ->disabled(),
                 Forms\Components\DateTimePicker::make('updated_at')
                     ->label('Updated At')
+                    ->hiddenOn(['create'])
                     ->disabled(),
             ]);
     }
@@ -97,7 +105,7 @@ class OrganizationResource extends Resource
                     ->sortable(),
                 Tables\Columns\TextColumn::make('currency'),
                 TextColumn::make('billable_rate')
-                    ->money(fn (Organization $resource) => $resource->currency ?? 'EUR', divideBy: 100),
+                    ->money(fn (Organization $resource) => $resource->currency, divideBy: 100),
                 Tables\Columns\TextColumn::make('created_at')
                     ->dateTime()
                     ->sortable(),
@@ -112,6 +120,10 @@ class OrganizationResource extends Resource
             ])
             ->actions([
                 Tables\Actions\EditAction::make(),
+                Tables\Actions\DeleteAction::make()
+                    ->using(function (Organization $record): void {
+                        app(DeletionService::class)->deleteOrganization($record);
+                    }),
                 Action::make('Export')
                     ->icon('heroicon-o-arrow-down-tray')
                     ->action(function (Organization $record) {
@@ -199,8 +211,6 @@ class OrganizationResource extends Resource
                     ]),
             ])
             ->bulkActions([
-                Tables\Actions\BulkActionGroup::make([
-                ]),
             ]);
     }
 
@@ -208,6 +218,7 @@ class OrganizationResource extends Resource
     {
         return [
             UsersRelationManager::class,
+            InvitationsRelationManager::class,
         ];
     }
 

app/Filament/Resources/OrganizationResource/Actions/DeleteOrganization.php

@@ -15,7 +15,6 @@ class DeleteOrganization extends DeleteAction
     protected function setUp(): void
     {
         parent::setUp();
-        // TODO: check why setting the icon is necessary
         $this->icon('heroicon-m-trash');
         $this->action(function (): void {
             $result = $this->process(function (Organization $record): bool {

app/Filament/Resources/OrganizationResource/Pages/CreateOrganization.php

@@ -4,10 +4,33 @@ declare(strict_types=1);
 
 namespace App\Filament\Resources\OrganizationResource\Pages;
 
+use App\Enums\Role;
 use App\Filament\Resources\OrganizationResource;
+use App\Models\Organization;
 use Filament\Resources\Pages\CreateRecord;
 
 class CreateOrganization extends CreateRecord
 {
     protected static string $resource = OrganizationResource::class;
+
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        $data['personal_team'] = false;
+
+        return $data;
+    }
+
+    protected function afterCreate(): void
+    {
+        /** @var Organization $organization */
+        $organization = $this->record;
+
+        $user = $organization->owner;
+
+        $organization->users()->attach(
+            $user, [
+                'role' => Role::Owner->value,
+            ]
+        );
+    }
 }

app/Filament/Resources/OrganizationResource/Pages/ListOrganizations.php

@@ -15,7 +15,8 @@ class ListOrganizations extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/OrganizationResource/RelationManagers/InvitationsRelationManager.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\OrganizationResource\RelationManagers;
+
+use App\Enums\Role;
+use App\Filament\Resources\OrganizationInvitationResource;
+use App\Models\Organization;
+use App\Models\OrganizationInvitation;
+use App\Service\InvitationService;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Form;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables;
+use Filament\Tables\Actions\Action;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Validation\Rule;
+
+class InvitationsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'teamInvitations';
+
+    protected static ?string $title = 'Invitations';
+
+    public function form(Form $form): Form
+    {
+        return $form
+            ->schema([
+                TextInput::make('email')
+                    ->label('Email')
+                    ->disabledOn(['edit'])
+                    ->required(),
+                Select::make('role')
+                    ->options(Role::class)
+                    ->label('Role')
+                    ->rules([
+                        'required',
+                        'string',
+                        Rule::enum(Role::class)
+                            ->except([Role::Owner, Role::Placeholder]),
+                    ])
+                    ->required(),
+            ]);
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('email')
+            ->modelLabel('Invitation')
+            ->pluralModelLabel('Invitations')
+            ->columns([
+                Tables\Columns\TextColumn::make('email'),
+                Tables\Columns\TextColumn::make('role'),
+            ])
+            ->headerActions([
+                Tables\Actions\CreateAction::make()
+                    ->icon('heroicon-s-plus')
+                    ->using(function (array $data, string $model): Model {
+                        /** @var Organization $ownerRecord */
+                        $ownerRecord = $this->getOwnerRecord();
+
+                        return app(InvitationService::class)
+                            ->inviteUser($ownerRecord, $data['email'], Role::from($data['role']));
+                    }),
+            ])
+            ->actions([
+                Action::make('view')
+                    ->icon('heroicon-o-eye')
+                    ->color('gray')
+                    ->url(fn (OrganizationInvitation $record): string => OrganizationInvitationResource::getUrl('view', [
+                        'record' => $record->getKey(),
+                    ])),
+                Tables\Actions\EditAction::make(),
+                Tables\Actions\DeleteAction::make(),
+            ])
+            ->bulkActions([
+                Tables\Actions\BulkActionGroup::make([
+                    Tables\Actions\DetachBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/OrganizationResource/RelationManagers/UsersRelationManager.php

@@ -5,17 +5,24 @@ declare(strict_types=1);
 namespace App\Filament\Resources\OrganizationResource\RelationManagers;
 
 use App\Enums\Role;
+use App\Exceptions\Api\ApiException;
 use App\Filament\Resources\UserResource;
+use App\Models\Member;
+use App\Models\Organization;
 use App\Models\User;
+use App\Service\BillableRateService;
+use App\Service\MemberService;
 use Filament\Forms\Components\Select;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Form;
+use Filament\Notifications\Notification;
 use Filament\Resources\RelationManagers\RelationManager;
 use Filament\Tables;
 use Filament\Tables\Actions\Action;
 use Filament\Tables\Actions\AttachAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
+use Illuminate\Validation\Rule;
 
 class UsersRelationManager extends RelationManager
 {
@@ -36,20 +43,40 @@ class UsersRelationManager extends RelationManager
 
     public function table(Table $table): Table
     {
+        /** @var Organization $organization */
+        $organization = $this->getOwnerRecord();
+
         return $table
             ->recordTitleAttribute('name')
             ->columns([
                 Tables\Columns\TextColumn::make('name'),
                 Tables\Columns\TextColumn::make('role'),
                 TextColumn::make('billable_rate')
-                    ->money($this->getOwnerRecord()->currency ?? 'EUR', divideBy: 100),
+                    ->money($organization->currency, divideBy: 100),
             ])
             ->headerActions([
-                Tables\Actions\AttachAction::make()->form(fn (AttachAction $action): array => [
-                    $action->getRecordSelect(),
-                    Select::make('role')
-                        ->options(Role::class),
-                ]),
+                Tables\Actions\AttachAction::make()
+                    ->recordTitle(fn (User $record): string => "{$record->name} ({$record->email})")
+                    ->form(fn (AttachAction $action): array => [
+                        $action->getRecordSelect(),
+                        Select::make('role')
+                            ->required()
+                            ->options(Role::class)
+                            ->rule([
+                                'required',
+                                'string',
+                                Rule::enum(Role::class)
+                                    ->except([Role::Owner, Role::Placeholder]),
+                            ]),
+                    ])
+                    ->label('Add user')
+                    ->modalHeading('Add user')
+                    ->icon('heroicon-s-plus')
+                    ->using(function (User $record, array $data): void {
+                        /** @var Organization $organization */
+                        $organization = $this->getOwnerRecord();
+                        app(MemberService::class)->addMember($record, $organization, Role::from($data['role']), true);
+                    }),
             ])
             ->actions([
                 Action::make('view')
@@ -58,13 +85,55 @@ class UsersRelationManager extends RelationManager
                     ->url(fn (User $record): string => UserResource::getUrl('view', [
                         'record' => $record->getKey(),
                     ])),
-                Tables\Actions\EditAction::make(),
-                Tables\Actions\DetachAction::make(),
+                Tables\Actions\EditAction::make()
+                    ->using(function (User $record, array $data): User {
+                        /** @var Organization $organization */
+                        $organization = $this->getOwnerRecord();
+                        /** @var Member $member */
+                        $member = $record->getRelation('membership');
+
+                        if ($data['billable_rate'] !== $member->billable_rate) {
+                            $member->billable_rate = $data['billable_rate'];
+                            app(BillableRateService::class)->updateTimeEntriesBillableRateForMember($member);
+                        }
+
+                        if ($data['role'] !== $member->role) {
+                            try {
+                                app(MemberService::class)->changeRole($member, $organization, Role::from($data['role']), true);
+                            } catch (ApiException $exception) {
+                                Notification::make()
+                                    ->danger()
+                                    ->title('Update failed')
+                                    ->body($exception->getTranslatedMessage())
+                                    ->persistent()
+                                    ->send();
+                            }
+                        }
+                        $member->save();
+
+                        return $record;
+                    }),
+                Tables\Actions\DetachAction::make()
+                    ->using(function (User $record): void {
+                        /** @var Organization $organization */
+                        $organization = $this->getOwnerRecord();
+                        $member = Member::query()
+                            ->whereBelongsTo($record, 'user')
+                            ->whereBelongsTo($organization, 'organization')
+                            ->firstOrFail();
+                        try {
+                            app(MemberService::class)->removeMember($member, $organization);
+                        } catch (ApiException $exception) {
+                            Notification::make()
+                                ->danger()
+                                ->title('Delete failed')
+                                ->body($exception->getTranslatedMessage())
+                                ->persistent()
+                                ->send();
+                        }
+                    }),
             ])
             ->bulkActions([
-                Tables\Actions\BulkActionGroup::make([
-                    Tables\Actions\DetachBulkAction::make(),
-                ]),
             ]);
     }
 }

app/Filament/Resources/ProjectMemberResource/Pages/EditProjectMember.php

@@ -15,7 +15,8 @@ class EditProjectMember extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
         ];
     }
 }

app/Filament/Resources/ProjectMemberResource/Pages/ListProjectMembers.php

@@ -15,7 +15,8 @@ class ListProjectMembers extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/ProjectResource.php

@@ -72,8 +72,13 @@ class ProjectResource extends Resource
             ])
             ->filters([
                 SelectFilter::make('organization')
+                    ->label('Organization')
                     ->relationship('organization', 'name')
                     ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
             ])
             ->defaultSort('created_at', 'desc')
             ->actions([

app/Filament/Resources/ProjectResource/Pages/EditProject.php

@@ -15,7 +15,8 @@ class EditProject extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
         ];
     }
 }

app/Filament/Resources/ProjectResource/Pages/ListProjects.php

@@ -15,7 +15,8 @@ class ListProjects extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/ReportResource.php

@@ -0,0 +1,141 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\ReportResource\Pages;
+use App\Models\Report;
+use App\Service\Dto\ReportPropertiesDto;
+use Filament\Forms;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Toggle;
+use Filament\Forms\Form;
+use Filament\Resources\Resource;
+use Filament\Tables;
+use Filament\Tables\Actions\Action;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Columns\ToggleColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Novadaemon\FilamentPrettyJson\PrettyJson;
+
+class ReportResource extends Resource
+{
+    protected static ?string $model = Report::class;
+
+    protected static ?string $navigationIcon = 'heroicon-o-document-chart-bar';
+
+    protected static ?string $navigationGroup = 'Timetracking';
+
+    protected static ?int $navigationSort = 7;
+
+    public static function form(Form $form): Form
+    {
+        return $form
+            ->columns(1)
+            ->schema([
+                Forms\Components\TextInput::make('name')
+                    ->label('Name')
+                    ->required()
+                    ->maxLength(255),
+                Forms\Components\TextInput::make('description')
+                    ->label('Description')
+                    ->nullable()
+                    ->maxLength(255),
+                Toggle::make('is_public')
+                    ->label('Is public?')
+                    ->required(),
+                DateTimePicker::make('public_until')
+                    ->label('Public until')
+                    ->nullable(),
+                Forms\Components\Select::make('organization_id')
+                    ->label('Organization')
+                    ->relationship(name: 'organization', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->disabled()
+                    ->required(),
+                Forms\Components\TextInput::make('share_secret')
+                    ->label('Share Secret')
+                    ->nullable(),
+                PrettyJson::make('properties')
+                    ->formatStateUsing(function (ReportPropertiesDto $state, Report $record): string {
+                        return $record->getRawOriginal('properties');
+                    })
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('created_at')
+                    ->label('Created At')
+                    ->hiddenOn(['create'])
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('updated_at')
+                    ->label('Updated At')
+                    ->hiddenOn(['create'])
+                    ->disabled(),
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                Tables\Columns\TextColumn::make('name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('description')
+                    ->searchable()
+                    ->sortable(),
+                ToggleColumn::make('is_public')
+                    ->label('Is public?')
+                    ->sortable(),
+                TextColumn::make('organization.name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('created_at')
+                    ->dateTime()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('updated_at')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                SelectFilter::make('organization')
+                    ->label('Organization')
+                    ->relationship('organization', 'name')
+                    ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
+            ])
+            ->actions([
+                Action::make('public-view')
+                    ->label('Public')
+                    ->icon('heroicon-o-eye')
+                    ->color('gray')
+                    ->hidden(fn (Report $record): bool => $record->getShareableLink() === null)
+                    ->url(fn (Report $record): string => $record->getShareableLink(), true),
+                Tables\Actions\ViewAction::make(),
+                Tables\Actions\EditAction::make(),
+                Tables\Actions\DeleteAction::make(),
+            ])
+            ->bulkActions([
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => Pages\ListReports::route('/'),
+            'edit' => Pages\EditReport::route('/{record}/edit'),
+            'view' => Pages\ViewReport::route('/{record}'),
+        ];
+    }
+}

app/Filament/Resources/ReportResource/Pages/EditReport.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\ReportResource\Pages;
+
+use App\Filament\Resources\ReportResource;
+use Filament\Actions;
+use Filament\Resources\Pages\EditRecord;
+
+class EditReport extends EditRecord
+{
+    protected static string $resource = ReportResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
+        ];
+    }
+}

app/Filament/Resources/ReportResource/Pages/ListReports.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\ReportResource\Pages;
+
+use App\Filament\Resources\ReportResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListReports extends ListRecords
+{
+    protected static string $resource = ReportResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Filament/Resources/ReportResource/Pages/ViewReport.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\ReportResource\Pages;
+
+use App\Filament\Resources\ReportResource;
+use Filament\Actions\EditAction;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewReport extends ViewRecord
+{
+    protected static string $resource = ReportResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            EditAction::make('edit')
+                ->icon('heroicon-s-pencil'),
+        ];
+    }
+}

app/Filament/Resources/TagResource.php

@@ -60,8 +60,13 @@ class TagResource extends Resource
             ->defaultSort('created_at', 'desc')
             ->filters([
                 SelectFilter::make('organization')
+                    ->label('Organization')
                     ->relationship('organization', 'name')
                     ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
             ])
             ->actions([
                 Tables\Actions\EditAction::make(),

app/Filament/Resources/TagResource/Pages/EditTag.php

@@ -15,7 +15,8 @@ class EditTag extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
         ];
     }
 }

app/Filament/Resources/TagResource/Pages/ListTags.php

@@ -15,7 +15,8 @@ class ListTags extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/TaskResource.php

@@ -61,8 +61,13 @@ class TaskResource extends Resource
             ])
             ->filters([
                 SelectFilter::make('organization')
+                    ->label('Organization')
                     ->relationship('organization', 'name')
                     ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
             ])
             ->defaultSort('created_at', 'desc')
             ->actions([

app/Filament/Resources/TaskResource/Pages/EditTask.php

@@ -15,7 +15,8 @@ class EditTask extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
         ];
     }
 }

app/Filament/Resources/TaskResource/Pages/ListTasks.php

@@ -15,7 +15,8 @@ class ListTasks extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/TimeEntryResource.php

@@ -92,8 +92,13 @@ class TimeEntryResource extends Resource
             ])
             ->filters([
                 SelectFilter::make('organization')
+                    ->label('Organization')
                     ->relationship('organization', 'name')
                     ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
             ])
             ->defaultSort('created_at', 'desc')
             ->actions([

app/Filament/Resources/TimeEntryResource/Pages/EditTimeEntry.php

@@ -15,7 +15,8 @@ class EditTimeEntry extends EditRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
         ];
     }
 }

app/Filament/Resources/TimeEntryResource/Pages/ListTimeEntries.php

@@ -15,7 +15,8 @@ class ListTimeEntries extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/TokenResource.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\TokenResource\Pages;
+use App\Models\Passport\Client;
+use App\Models\Passport\Token;
+use Filament\Forms;
+use Filament\Forms\Form;
+use Filament\Resources\Resource;
+use Filament\Tables;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class TokenResource extends Resource
+{
+    protected static ?string $model = Token::class;
+
+    protected static ?string $navigationIcon = 'heroicon-o-key';
+
+    protected static ?string $navigationGroup = 'Auth';
+
+    protected static ?int $navigationSort = 6;
+
+    public static function form(Form $form): Form
+    {
+        return $form
+            ->columns(1)
+            ->schema([
+                Forms\Components\TextInput::make('id')
+                    ->label('ID')
+                    ->disabled()
+                    ->visibleOn(['update', 'show'])
+                    ->readOnly()
+                    ->maxLength(255),
+                Forms\Components\TextInput::make('name')
+                    ->label('Name')
+                    ->required()
+                    ->maxLength(255),
+                Forms\Components\Select::make('user_id')
+                    ->label('User')
+                    ->relationship(name: 'user', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->disabled()
+                    ->required(),
+                Forms\Components\Select::make('client_id')
+                    ->label('Client')
+                    ->relationship(name: 'client', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->required(),
+                Forms\Components\Toggle::make('revoked')
+                    ->label('Revoked')
+                    ->required(),
+                Forms\Components\DateTimePicker::make('expires_at')
+                    ->label('Expires At')
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('created_at')
+                    ->label('Created At')
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('updated_at')
+                    ->label('Updated At')
+                    ->disabled(),
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                Tables\Columns\TextColumn::make('name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('user.name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('client.name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\IconColumn::make('client.personal_access_client')
+                    ->boolean()
+                    ->label('API token?')
+                    ->sortable(),
+                Tables\Columns\IconColumn::make('revoked')
+                    ->boolean()
+                    ->label('Revoked?')
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('expires_at')
+                    ->dateTime()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('created_at')
+                    ->dateTime()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('updated_at')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                TernaryFilter::make('is_personal_access_client')
+                    ->queries(
+                        true: function (Builder $query) {
+                            /** @var Builder<Token> $query */
+                            return $query->whereHas('client', function (Builder $query) {
+                                /** @var Builder<Client> $query */
+                                return $query->where('personal_access_client', true);
+                            });
+                        },
+                        false: function (Builder $query) {
+                            /** @var Builder<Token> $query */
+                            return $query->whereHas('client', function (Builder $query) {
+                                /** @var Builder<Client> $query */
+                                return $query->where('personal_access_client', false);
+                            });
+                        },
+                        blank: function (Builder $query) {
+                            /** @var Builder<Token> $query */
+                            return $query;
+                        },
+                    )
+                    ->label('API token?'),
+                TernaryFilter::make('revoked')
+                    ->label('Revoked?'),
+            ])
+            ->actions([
+                Tables\Actions\ViewAction::make(),
+            ])
+            ->bulkActions([
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => Pages\ListTokens::route('/'),
+            'view' => Pages\ViewToken::route('/{record}'),
+        ];
+    }
+}

app/Filament/Resources/TokenResource/Pages/ListTokens.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\TokenResource\Pages;
+
+use App\Filament\Resources\TokenResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTokens extends ListRecords
+{
+    protected static string $resource = TokenResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Filament/Resources/TokenResource/Pages/ViewToken.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\TokenResource\Pages;
+
+use App\Filament\Resources\TokenResource;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewToken extends ViewRecord
+{
+    protected static string $resource = TokenResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Filament/Resources/UserResource.php

@@ -5,21 +5,27 @@ declare(strict_types=1);
 namespace App\Filament\Resources;
 
 use App\Enums\Weekday;
+use App\Exceptions\Api\ApiException;
 use App\Filament\Resources\UserResource\Pages;
 use App\Filament\Resources\UserResource\RelationManagers\OrganizationsRelationManager;
 use App\Filament\Resources\UserResource\RelationManagers\OwnedOrganizationsRelationManager;
 use App\Models\User;
+use App\Service\DeletionService;
 use App\Service\TimezoneService;
+use Brick\Money\ISOCurrencyProvider;
 use Exception;
 use Filament\Forms;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Form;
+use Filament\Notifications\Notification;
 use Filament\Resources\Resource;
 use Filament\Tables;
 use Filament\Tables\Filters\TernaryFilter;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
+use Korridor\LaravelModelValidationRules\Rules\UniqueEloquent;
 use STS\FilamentImpersonate\Tables\Actions\Impersonate;
 
 class UserResource extends Resource
@@ -34,6 +40,9 @@ class UserResource extends Resource
 
     public static function form(Form $form): Form
     {
+        /** @var User|null $record */
+        $record = $form->getRecord();
+
         return $form
             ->columns(1)
             ->schema([
@@ -50,12 +59,25 @@ class UserResource extends Resource
                 Forms\Components\TextInput::make('email')
                     ->label('Email')
                     ->required()
+                    ->rules($record?->is_placeholder ? [] : [
+                        UniqueEloquent::make(User::class, 'email')
+                            ->ignore($record?->getKey()),
+                    ])
+                    ->rule([
+                        'email',
+                    ])
                     ->maxLength(255),
                 Forms\Components\Toggle::make('is_placeholder')
-                    ->label('Is Placeholder'),
+                    ->label('Is Placeholder?')
+                    ->hiddenOn(['create'])
+                    ->disabledOn(['edit']),
                 Forms\Components\DateTimePicker::make('email_verified_at')
                     ->label('Email Verified At')
+                    ->hiddenOn(['create'])
                     ->nullable(),
+                Forms\Components\Toggle::make('is_email_verified')
+                    ->label('Email Verified?')
+                    ->visibleOn(['create']),
                 Forms\Components\Select::make('timezone')
                     ->label('Timezone')
                     ->options(fn (): array => app(TimezoneService::class)->getSelectOptions())
@@ -67,15 +89,39 @@ class UserResource extends Resource
                     ->required(),
                 TextInput::make('password')
                     ->password()
+                    ->label('Password')
                     ->dehydrateStateUsing(fn ($state) => Hash::make($state))
                     ->dehydrated(fn ($state) => filled($state))
+                    ->hiddenOn(['create'])
                     ->required(fn (string $context): bool => $context === 'create')
                     ->maxLength(255),
+                TextInput::make('password_create')
+                    ->password()
+                    ->label('Password')
+                    ->visibleOn(['create'])
+                    ->required(fn (string $context): bool => $context === 'create')
+                    ->maxLength(255),
+                Forms\Components\Select::make('currency')
+                    ->label('Currency (Personal Organization)')
+                    ->options(function (): array {
+                        $currencies = ISOCurrencyProvider::getInstance()->getAvailableCurrencies();
+                        $select = [];
+                        foreach ($currencies as $currency) {
+                            $select[$currency->getCurrencyCode()] = $currency->getName().' ('.$currency->getCurrencyCode().')';
+                        }
+
+                        return $select;
+                    })
+                    ->required()
+                    ->visibleOn(['create'])
+                    ->searchable(),
                 Forms\Components\DateTimePicker::make('created_at')
                     ->label('Created At')
+                    ->hiddenOn(['create'])
                     ->disabled(),
                 Forms\Components\DateTimePicker::make('updated_at')
                     ->label('Updated At')
+                    ->hiddenOn(['create'])
                     ->disabled(),
             ]);
     }
@@ -145,11 +191,22 @@ class UserResource extends Resource
                     }
                 }),
                 Tables\Actions\EditAction::make(),
+                Tables\Actions\DeleteAction::make()
+                    ->hidden(fn (User $record) => $record->is(Auth::user()))
+                    ->using(function (User $record): void {
+                        try {
+                            app(DeletionService::class)->deleteUser($record);
+                        } catch (ApiException $exception) {
+                            Notification::make()
+                                ->danger()
+                                ->title('Delete failed')
+                                ->body($exception->getTranslatedMessage())
+                                ->persistent()
+                                ->send();
+                        }
+                    }),
             ])
             ->bulkActions([
-                Tables\Actions\BulkActionGroup::make([
-                    Tables\Actions\DeleteBulkAction::make(),
-                ]),
             ]);
     }
 

app/Filament/Resources/UserResource/Pages/CreateUser.php

@@ -4,24 +4,29 @@ declare(strict_types=1);
 
 namespace App\Filament\Resources\UserResource\Pages;
 
+use App\Enums\Weekday;
 use App\Filament\Resources\UserResource;
-use App\Models\Organization;
 use App\Models\User;
+use App\Service\UserService;
 use Filament\Resources\Pages\CreateRecord;
 
 class CreateUser extends CreateRecord
 {
     protected static string $resource = UserResource::class;
 
-    protected function afterCreate(): void
+    protected function handleRecordCreation(array $data): User
     {
-        /** @var User $user */
-        $user = $this->record;
+        $userService = app(UserService::class);
+        $user = $userService->createUser(
+            $data['name'],
+            $data['email'],
+            $data['password_create'],
+            $data['timezone'],
+            Weekday::from($data['week_start']),
+            $data['currency'],
+            (bool) $data['is_email_verified']
+        );
 
-        $user->ownedTeams()->save(Organization::forceCreate([
-            'user_id' => $user->id,
-            'name' => explode(' ', $user->name, 2)[0]."'s Organization",
-            'personal_team' => true,
-        ]));
+        return $user;
     }
 }

app/Filament/Resources/UserResource/Pages/ListUsers.php

@@ -15,7 +15,8 @@ class ListUsers extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->icon('heroicon-s-plus'),
         ];
     }
 }

app/Filament/Resources/UserResource/Pages/ViewUser.php

@@ -7,6 +7,7 @@ namespace App\Filament\Resources\UserResource\Pages;
 use App\Filament\Resources\UserResource;
 use Filament\Actions\EditAction;
 use Filament\Resources\Pages\ViewRecord;
+use STS\FilamentImpersonate\Pages\Actions\Impersonate;
 
 class ViewUser extends ViewRecord
 {
@@ -15,6 +16,7 @@ class ViewUser extends ViewRecord
     protected function getHeaderActions(): array
     {
         return [
+            Impersonate::make()->record($this->getRecord()),
             EditAction::make('edit')
                 ->icon('heroicon-s-pencil'),
         ];

app/Filament/Resources/UserResource/RelationManagers/OrganizationsRelationManager.php

@@ -5,15 +5,18 @@ declare(strict_types=1);
 namespace App\Filament\Resources\UserResource\RelationManagers;
 
 use App\Enums\Role;
+use App\Exceptions\Api\ApiException;
 use App\Filament\Resources\OrganizationResource;
+use App\Models\Member;
 use App\Models\Organization;
+use App\Models\User;
+use App\Service\MemberService;
 use Filament\Forms\Components\Select;
-use Filament\Forms\Components\TextInput;
 use Filament\Forms\Form;
+use Filament\Notifications\Notification;
 use Filament\Resources\RelationManagers\RelationManager;
 use Filament\Tables;
 use Filament\Tables\Actions\Action;
-use Filament\Tables\Actions\AttachAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 
@@ -27,10 +30,6 @@ class OrganizationsRelationManager extends RelationManager
             ->schema([
                 Select::make('role')
                     ->options(Role::class),
-                TextInput::make('billable_rate')
-                    ->label('Billable rate (in Cents)')
-                    ->nullable()
-                    ->numeric(),
             ]);
     }
 
@@ -41,15 +40,11 @@ class OrganizationsRelationManager extends RelationManager
             ->columns([
                 TextColumn::make('name'),
                 TextColumn::make('role'),
-                TextColumn::make('billable_rate')
-                    ->money(fn (Organization $resource) => $resource->currency ?? 'EUR', divideBy: 100),
+                TextColumn::make('membership.billable_rate')
+                    ->label('Billable rate')
+                    ->money(fn (Organization $resource) => $resource->currency, divideBy: 100),
             ])
             ->headerActions([
-                Tables\Actions\AttachAction::make()->form(fn (AttachAction $action): array => [
-                    $action->getRecordSelect(),
-                    Select::make('role')
-                        ->options(Role::class),
-                ]),
             ])
             ->actions([
                 Action::make('view')
@@ -58,13 +53,48 @@ class OrganizationsRelationManager extends RelationManager
                     ->url(fn (Organization $record): string => OrganizationResource::getUrl('view', [
                         'record' => $record->getKey(),
                     ])),
-                Tables\Actions\EditAction::make(),
-                Tables\Actions\DetachAction::make(),
+                Tables\Actions\EditAction::make()
+                    ->using(function (Organization $record, array $data): Organization {
+                        /** @var Member $member */
+                        $member = $record->getRelation('membership');
+
+                        if ($data['role'] !== $member->role) {
+                            try {
+                                app(MemberService::class)->changeRole($member, $record, Role::from($data['role']), true);
+                            } catch (ApiException $exception) {
+                                Notification::make()
+                                    ->danger()
+                                    ->title('Update failed')
+                                    ->body($exception->getTranslatedMessage())
+                                    ->persistent()
+                                    ->send();
+                            }
+                        }
+                        $member->save();
+
+                        return $record;
+                    }),
+                Tables\Actions\DetachAction::make()
+                    ->using(function (Organization $record): void {
+                        /** @var User $user */
+                        $user = $this->getOwnerRecord();
+                        $member = Member::query()
+                            ->whereBelongsTo($user, 'user')
+                            ->whereBelongsTo($record, 'organization')
+                            ->firstOrFail();
+                        try {
+                            app(MemberService::class)->removeMember($member, $record);
+                        } catch (ApiException $exception) {
+                            Notification::make()
+                                ->danger()
+                                ->title('Delete failed')
+                                ->body($exception->getTranslatedMessage())
+                                ->persistent()
+                                ->send();
+                        }
+                    }),
             ])
             ->bulkActions([
-                Tables\Actions\BulkActionGroup::make([
-                    Tables\Actions\DetachBulkAction::make(),
-                ]),
             ]);
     }
 }

app/Http/Controllers/Api/V1/ApiTokenController.php

@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Exceptions\Api\PersonalAccessClientIsNotConfiguredException;
+use App\Http\Requests\V1\ApiToken\ApiTokenStoreRequest;
+use App\Http\Resources\V1\ApiToken\ApiTokenCollection;
+use App\Http\Resources\V1\ApiToken\ApiTokenWithAccessTokenResource;
+use App\Models\Passport\Token;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\JsonResponse;
+
+class ApiTokenController extends Controller
+{
+    /**
+     * List all api token of the currently authenticated user
+     *
+     * This endpoint is independent of organization.
+     *
+     * @operationId getApiTokens
+     *
+     * @throws AuthorizationException
+     */
+    public function index(): ApiTokenCollection
+    {
+        $user = $this->user();
+
+        $tokens = $user->tokens()
+            ->where('client_id', '=', config('passport.personal_access_client.id'))
+            ->get();
+
+        return new ApiTokenCollection($tokens);
+    }
+
+    /**
+     * Create a new api token for the currently authenticated user
+     *
+     * The response will contain the access token that can be used to send authenticated API requests.
+     * Please note that the access token is only shown in this response and cannot be retrieved later.
+     *
+     * @operationId createApiToken
+     *
+     * @throws AuthorizationException|PersonalAccessClientIsNotConfiguredException
+     */
+    public function store(ApiTokenStoreRequest $request): ApiTokenWithAccessTokenResource
+    {
+        $user = $this->user();
+
+        if (config('passport.personal_access_client.id') === null || config('passport.personal_access_client.secret') === null) {
+            throw new PersonalAccessClientIsNotConfiguredException;
+        }
+
+        $token = $user->createToken($request->getName(), ['*']);
+        /** @var Token $tokenModel */
+        $tokenModel = $token->token;
+
+        return new ApiTokenWithAccessTokenResource($tokenModel, $token->accessToken);
+    }
+
+    /**
+     * Revoke an api token
+     *
+     * @operationId revokeApiToken
+     *
+     * @throws AuthorizationException
+     * @throws PersonalAccessClientIsNotConfiguredException
+     */
+    public function revoke(Token $apiToken): JsonResponse
+    {
+        $user = $this->user();
+
+        if (config('passport.personal_access_client.id') === null || config('passport.personal_access_client.secret') === null) {
+            throw new PersonalAccessClientIsNotConfiguredException;
+        }
+        if ($apiToken->user_id !== $user->getKey()) {
+            throw new AuthorizationException('API token does not belong to user');
+        }
+        if ($apiToken->client_id !== config('passport.personal_access_client.id')) {
+            throw new AuthorizationException('API token is not a personal access token');
+        }
+
+        $apiToken->revoke();
+
+        return response()->json(null, 204);
+    }
+
+    /**
+     * Delete an api token
+     *
+     * @operationId deleteApiToken
+     *
+     * @throws AuthorizationException|PersonalAccessClientIsNotConfiguredException
+     */
+    public function destroy(Token $apiToken): JsonResponse
+    {
+        $user = $this->user();
+
+        if (config('passport.personal_access_client.id') === null || config('passport.personal_access_client.secret') === null) {
+            throw new PersonalAccessClientIsNotConfiguredException;
+        }
+        if ($apiToken->user_id !== $user->getKey()) {
+            throw new AuthorizationException('API token does not belong to user');
+        }
+        if ($apiToken->client_id !== config('passport.personal_access_client.id')) {
+            throw new AuthorizationException('API token is not a personal access token');
+        }
+
+        $apiToken->delete();
+
+        return response()->json(null, 204);
+    }
+}

app/Http/Controllers/Api/V1/ChartController.php

@@ -0,0 +1,172 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Enums\Role;
+use App\Models\Organization;
+use App\Service\DashboardService;
+use App\Service\PermissionStore;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\JsonResponse;
+
+class ChartController extends Controller
+{
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId weeklyProjectOverview
+     *
+     * @response array<int, array{value: int, name: string, color: string}>
+     */
+    public function weeklyProjectOverview(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $weeklyProjectOverview = $dashboardService->weeklyProjectOverview($user, $organization);
+
+        return response()->json($weeklyProjectOverview);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId latestTasks
+     *
+     * @response array<int, array{task_id: string, name: string, description: string|null, status: bool, time_entry_id: string|null}>
+     */
+    public function latestTasks(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $latestTasks = $dashboardService->latestTasks($user, $organization);
+
+        return response()->json($latestTasks);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId lastSevenDays
+     *
+     * @response array<int, array{ date: string, duration: int, history: array<int> }>
+     */
+    public function lastSevenDays(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $lastSevenDays = $dashboardService->lastSevenDays($user, $organization);
+
+        return response()->json($lastSevenDays);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId latestTeamActivity
+     *
+     * @response array<int, array{member_id: string, name: string, description: string|null, time_entry_id: string, task_id: string|null, status: bool }>
+     */
+    public function latestTeamActivity(Organization $organization, DashboardService $dashboardService, PermissionStore $permissionStore): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:all');
+
+        $latestTeamActivity = $dashboardService->latestTeamActivity($organization);
+
+        return response()->json($latestTeamActivity);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId dailyTrackedHours
+     *
+     * @response array<int, array{date: string, duration: int}>
+     */
+    public function dailyTrackedHours(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $dailyTrackedHours = $dashboardService->getDailyTrackedHours($user, $organization, 60);
+
+        return response()->json($dailyTrackedHours);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId totalWeeklyTime
+     *
+     * @response int
+     */
+    public function totalWeeklyTime(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $totalWeeklyTime = $dashboardService->totalWeeklyTime($user, $organization);
+
+        return response()->json($totalWeeklyTime);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId totalWeeklyBillableTime
+     *
+     * @response int
+     */
+    public function totalWeeklyBillableTime(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $totalWeeklyBillableTime = $dashboardService->totalWeeklyBillableTime($user, $organization);
+
+        return response()->json($totalWeeklyBillableTime);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId totalWeeklyBillableAmount
+     *
+     * @response array{value: int, currency: string}
+     */
+    public function totalWeeklyBillableAmount(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        if (! $showBillableRate) {
+            throw new AuthorizationException('You do not have permission to view billable rates.');
+        }
+
+        $totalWeeklyBillableAmount = $dashboardService->totalWeeklyBillableAmount($user, $organization);
+
+        return response()->json($totalWeeklyBillableAmount);
+    }
+
+    /**
+     * @throws AuthorizationException
+     *
+     * @operationId weeklyHistory
+     *
+     * @response array<int, array{date: string, duration: int}>
+     */
+    public function weeklyHistory(Organization $organization, DashboardService $dashboardService): JsonResponse
+    {
+        $this->checkPermission($organization, 'charts:view:own');
+        $user = $this->user();
+
+        $weeklyHistory = $dashboardService->getWeeklyHistory($user, $organization);
+
+        return response()->json($weeklyHistory);
+    }
+}

app/Http/Controllers/Api/V1/InvitationController.php

@@ -9,13 +9,12 @@ use App\Http\Requests\V1\Invitation\InvitationIndexRequest;
 use App\Http\Requests\V1\Invitation\InvitationStoreRequest;
 use App\Http\Resources\V1\Invitation\InvitationCollection;
 use App\Http\Resources\V1\Invitation\InvitationResource;
-use App\Mail\OrganizationInvitationMail;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
 use App\Service\InvitationService;
+use App\Service\OrganizationInvitationService;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\JsonResponse;
-use Illuminate\Support\Facades\Mail;
 
 class InvitationController extends Controller
 {
@@ -73,12 +72,11 @@ class InvitationController extends Controller
      *
      * @operationId resendInvitationEmail
      */
-    public function resend(Organization $organization, OrganizationInvitation $invitation): JsonResponse
+    public function resend(Organization $organization, OrganizationInvitation $invitation, OrganizationInvitationService $organizationInvitationService): JsonResponse
     {
         $this->checkPermission($organization, 'invitations:resend', $invitation);
 
-        Mail::to($invitation->email)
-            ->queue(new OrganizationInvitationMail($invitation));
+        $organizationInvitationService->resend($invitation);
 
         return response()->json(null, 204);
     }

app/Http/Controllers/Api/V1/MemberController.php

@@ -6,27 +6,31 @@ namespace App\Http\Controllers\Api\V1;
 
 use App\Enums\Role;
 use App\Events\MemberMadeToPlaceholder;
-use App\Events\MemberRemoved;
 use App\Exceptions\Api\CanNotRemoveOwnerFromOrganization;
+use App\Exceptions\Api\ChangingRoleOfPlaceholderIsNotAllowed;
 use App\Exceptions\Api\ChangingRoleToPlaceholderIsNotAllowed;
 use App\Exceptions\Api\EntityStillInUseApiException;
 use App\Exceptions\Api\OnlyOwnerCanChangeOwnership;
+use App\Exceptions\Api\OnlyPlaceholdersCanBeMergedIntoAnotherMember;
 use App\Exceptions\Api\OrganizationNeedsAtLeastOneOwner;
+use App\Exceptions\Api\ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException;
+use App\Exceptions\Api\UserIsAlreadyMemberOfOrganizationApiException;
 use App\Exceptions\Api\UserNotPlaceholderApiException;
 use App\Http\Requests\V1\Member\MemberIndexRequest;
+use App\Http\Requests\V1\Member\MemberMergeIntoRequest;
 use App\Http\Requests\V1\Member\MemberUpdateRequest;
 use App\Http\Resources\V1\Member\MemberCollection;
 use App\Http\Resources\V1\Member\MemberResource;
 use App\Models\Member;
 use App\Models\Organization;
-use App\Models\ProjectMember;
-use App\Models\TimeEntry;
 use App\Service\BillableRateService;
 use App\Service\InvitationService;
 use App\Service\MemberService;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
 
 class MemberController extends Controller
 {
@@ -66,6 +70,7 @@ class MemberController extends Controller
      * @throws OrganizationNeedsAtLeastOneOwner
      * @throws OnlyOwnerCanChangeOwnership
      * @throws ChangingRoleToPlaceholderIsNotAllowed
+     * @throws ChangingRoleOfPlaceholderIsNotAllowed
      *
      * @operationId updateMember
      */
@@ -80,22 +85,8 @@ class MemberController extends Controller
         }
         if ($request->has('role') && $member->role !== $request->getRole()->value) {
             $newRole = $request->getRole();
-            $oldRole = Role::from($member->role);
-            if ($oldRole === Role::Owner) {
-                throw new OrganizationNeedsAtLeastOneOwner;
-            }
-            if ($newRole === Role::Placeholder) {
-                throw new ChangingRoleToPlaceholderIsNotAllowed;
-            }
-            if ($newRole === Role::Owner) {
-                if ($this->hasPermission($organization, 'members:change-ownership')) {
-                    $memberService->changeOwnership($organization, $member);
-                } else {
-                    throw new OnlyOwnerCanChangeOwnership;
-                }
-            } else {
-                $member->role = $request->getRole()->value;
-            }
+            $allowOwnerChange = $this->hasPermission($organization, 'members:change-ownership');
+            $memberService->changeRole($member, $organization, $newRole, $allowOwnerChange);
         }
         $member->save();
 
@@ -109,22 +100,11 @@ class MemberController extends Controller
      *
      * @operationId removeMember
      */
-    public function destroy(Organization $organization, Member $member): JsonResponse
+    public function destroy(Organization $organization, Member $member, MemberService $memberService): JsonResponse
     {
         $this->checkPermission($organization, 'members:delete', $member);
 
-        if (TimeEntry::query()->where('user_id', $member->user_id)->whereBelongsTo($organization, 'organization')->exists()) {
-            throw new EntityStillInUseApiException('member', 'time_entry');
-        }
-        if (ProjectMember::query()->whereBelongsToOrganization($organization)->where('user_id', $member->user_id)->exists()) {
-            throw new EntityStillInUseApiException('member', 'project_member');
-        }
-        if ($member->role === Role::Owner->value) {
-            throw new CanNotRemoveOwnerFromOrganization;
-        }
-
-        $member->delete();
-        MemberRemoved::dispatch($member, $organization);
+        $memberService->removeMember($member, $organization);
 
         return response()
             ->json(null, 204);
@@ -133,7 +113,9 @@ class MemberController extends Controller
     /**
      * Make a member a placeholder member
      *
-     * @throws AuthorizationException|CanNotRemoveOwnerFromOrganization
+     * @throws AuthorizationException|CanNotRemoveOwnerFromOrganization|ChangingRoleOfPlaceholderIsNotAllowed
+     *
+     * @operationId makePlaceholder
      */
     public function makePlaceholder(Organization $organization, Member $member, MemberService $memberService): JsonResponse
     {
@@ -142,6 +124,9 @@ class MemberController extends Controller
         if ($member->role === Role::Owner->value) {
             throw new CanNotRemoveOwnerFromOrganization;
         }
+        if ($member->role === Role::Placeholder->value) {
+            throw new ChangingRoleOfPlaceholderIsNotAllowed;
+        }
 
         $memberService->makeMemberToPlaceholder($member);
 
@@ -150,10 +135,39 @@ class MemberController extends Controller
         return response()->json(null, 204);
     }
 
+    /**
+     * @throws AuthorizationException
+     * @throws OnlyPlaceholdersCanBeMergedIntoAnotherMember
+     * @throws \Throwable
+     *
+     * @operationId mergeMember
+     */
+    public function mergeInto(Organization $organization, Member $member, MemberMergeIntoRequest $request, MemberService $memberService): JsonResponse
+    {
+        $this->checkPermission($organization, 'members:merge-into', $member);
+
+        $user = $member->user;
+        if ($member->role !== Role::Placeholder->value || ! $user->is_placeholder) {
+            throw new OnlyPlaceholdersCanBeMergedIntoAnotherMember;
+        }
+        $memberTo = Member::findOrFail($request->getMemberId());
+
+        DB::transaction(function () use ($organization, $member, $user, $memberTo, $memberService): void {
+            $memberService->assignOrganizationEntitiesToDifferentMember($organization, $member, $memberTo);
+            $member->delete();
+            $user->delete();
+        });
+
+        return response()->json(null, 204);
+    }
+
     /**
      * Invite a placeholder member to become a real member of the organization
      *
-     * @throws AuthorizationException|UserNotPlaceholderApiException
+     * @throws AuthorizationException
+     * @throws UserNotPlaceholderApiException
+     * @throws UserIsAlreadyMemberOfOrganizationApiException
+     * @throws ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException
      *
      * @operationId invitePlaceholder
      */
@@ -166,6 +180,10 @@ class MemberController extends Controller
             throw new UserNotPlaceholderApiException;
         }
 
+        if (Str::endsWith($user->email, '@solidtime-import.test')) {
+            throw new ThisPlaceholderCanNotBeInvitedUseTheMergeToolInsteadException;
+        }
+
         $invitationService->inviteUser($organization, $user->email, Role::Employee);
 
         return response()->json(null, 204);

app/Http/Controllers/Api/V1/Public/ReportController.php

@@ -73,6 +73,7 @@ class ReportController extends Controller
             false,
             $report->properties->start,
             $report->properties->end,
+            true
         );
         $historyData = $timeEntryAggregationService->getAggregatedTimeEntriesWithDescriptions(
             $timeEntriesQuery->clone(),
@@ -83,6 +84,7 @@ class ReportController extends Controller
             true,
             $report->properties->start,
             $report->properties->end,
+            true
         );
 
         return new DetailedWithDataReportResource($report, $data, $historyData);

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Api\V1;
 
 use App\Enums\ExportFormat;
+use App\Enums\Role;
 use App\Exceptions\Api\FeatureIsNotAvailableInFreePlanApiException;
 use App\Exceptions\Api\PdfRendererIsNotConfiguredException;
 use App\Exceptions\Api\TimeEntryCanNotBeRestartedApiException;
@@ -180,6 +181,7 @@ class TimeEntryController extends Controller
         }
         $user = $this->user();
         $timezone = $user->timezone;
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         $timeEntriesQuery = $this->getTimeEntriesQuery($organization, $request, $member);
         $timeEntriesQuery->with([
@@ -211,7 +213,8 @@ class TimeEntryController extends Controller
                 $user->week_start,
                 false,
                 null,
-                null
+                null,
+                $showBillableRate
             );
             $html = Blade::render($viewFile, [
                 'timeEntries' => $timeEntriesQuery->get(),
@@ -285,18 +288,18 @@ class TimeEntryController extends Controller
      *          grouped_data: null|array<array{
      *              key: string|null,
      *              seconds: int,
-     *              cost: int,
+     *              cost: int|null,
      *              grouped_type: string|null,
      *              grouped_data: null|array<array{
      *                  key: string|null,
      *                  seconds: int,
-     *                  cost: int,
+     *                  cost: int|null,
      *                  grouped_type: null,
      *                  grouped_data: null
      *              }>
      *          }>,
      *          seconds: int,
-     *          cost: int
+     *          cost: int|null
      *      }
      * }
      *
@@ -312,6 +315,7 @@ class TimeEntryController extends Controller
             $this->checkPermission($organization, 'time-entries:view:all');
         }
         $user = $this->user();
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         $group1Type = $request->getGroup();
         $group2Type = $request->getSubGroup();
@@ -325,7 +329,8 @@ class TimeEntryController extends Controller
             $user->week_start,
             $request->getFillGapsInTimeGroups(),
             $request->getStart(),
-            $request->getEnd()
+            $request->getEnd(),
+            $showBillableRate
         );
 
         return [
@@ -359,6 +364,7 @@ class TimeEntryController extends Controller
         }
         $debug = $request->getDebug();
         $user = $this->user();
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
 
         $group = $request->getGroup();
         $subGroup = $request->getSubGroup();
@@ -372,7 +378,8 @@ class TimeEntryController extends Controller
             $user->week_start,
             false,
             $request->getStart(),
-            $request->getEnd()
+            $request->getEnd(),
+            $showBillableRate
         );
         $dataHistoryChart = $timeEntryAggregationService->getAggregatedTimeEntries(
             $timeEntriesAggregateQuery->clone(),
@@ -382,7 +389,8 @@ class TimeEntryController extends Controller
             $user->week_start,
             true,
             $request->getStart(),
-            $request->getEnd()
+            $request->getEnd(),
+            $showBillableRate
         );
         $currency = $organization->currency;
         $timezone = app(TimezoneService::class)->getTimezoneFromUser($this->user());

app/Http/Controllers/Web/DashboardController.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Web;
 
+use App\Enums\Role;
 use App\Service\DashboardService;
 use App\Service\PermissionStore;
 use Illuminate\Auth\Access\AuthorizationException;
@@ -19,30 +20,14 @@ class DashboardController extends Controller
     {
         $user = $this->user();
         $organization = $this->currentOrganization();
-        $dailyTrackedHours = $dashboardService->getDailyTrackedHours($user, $organization, 60);
-        $weeklyHistory = $dashboardService->getWeeklyHistory($user, $organization);
-        $totalWeeklyTime = $dashboardService->totalWeeklyTime($user, $organization);
-        $totalWeeklyBillableTime = $dashboardService->totalWeeklyBillableTime($user, $organization);
-        $totalWeeklyBillableAmount = $dashboardService->totalWeeklyBillableAmount($user, $organization);
-        $weeklyProjectOverview = $dashboardService->weeklyProjectOverview($user, $organization);
-        $latestTasks = $dashboardService->latestTasks($user, $organization);
-        $lastSevenDays = $dashboardService->lastSevenDays($user, $organization);
 
         $latestTeamActivity = null;
         if ($permissionStore->has($organization, 'time-entries:view:all')) {
             $latestTeamActivity = $dashboardService->latestTeamActivity($organization);
         }
 
-        return Inertia::render('Dashboard', [
-            'weeklyProjectOverview' => $weeklyProjectOverview,
-            'latestTasks' => $latestTasks,
-            'lastSevenDays' => $lastSevenDays,
-            'latestTeamActivity' => $latestTeamActivity,
-            'dailyTrackedHours' => $dailyTrackedHours,
-            'totalWeeklyTime' => $totalWeeklyTime,
-            'totalWeeklyBillableTime' => $totalWeeklyBillableTime,
-            'totalWeeklyBillableAmount' => $totalWeeklyBillableAmount,
-            'weeklyHistory' => $weeklyHistory,
-        ]);
+        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+
+        return Inertia::render('Dashboard');
     }
 }

app/Http/Controllers/Web/HealthCheckController.php

@@ -64,6 +64,7 @@ class HealthCheckController extends Controller
             $response['app_env'] = app()->environment();
             $response['app_timezone'] = config('app.timezone');
             $response['app_force_https'] = config('app.force_https');
+            $response['session_secure'] = config('session.secure');
             $response['trusted_proxies'] = config('trustedproxy.proxies');
             $headers = $request->headers->all();
             if (isset($headers['cookie'])) {

app/Http/Kernel.php

@@ -18,7 +18,7 @@ class Kernel extends HttpKernel
      * @var array<int, class-string|string>
      */
     protected $middleware = [
-        // \App\Http\Middleware\TrustHosts::class,
+        \App\Http\Middleware\ForceHttps::class,
         \App\Http\Middleware\TrustProxies::class,
         \Illuminate\Http\Middleware\HandleCors::class,
         \App\Http\Middleware\PreventRequestsDuringMaintenance::class,

app/Http/Middleware/ForceHttps.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\URL;
+use Symfony\Component\HttpFoundation\Response;
+
+class ForceHttps
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next, string ...$guards): Response
+    {
+        if (config('app.force_https', false)) {
+            URL::forceScheme('https');
+            $request->server->set('HTTPS', 'on');
+            $request->headers->set('X-Forwarded-Proto', 'https');
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/TrustHosts.php

@@ -1,22 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Illuminate\Http\Middleware\TrustHosts as Middleware;
-
-class TrustHosts extends Middleware
-{
-    /**
-     * Get the host patterns that should be trusted.
-     *
-     * @return array<int, string|null>
-     */
-    public function hosts(): array
-    {
-        return [
-            $this->allSubdomainsOfApplicationUrl(),
-        ];
-    }
-}

app/Http/Requests/V1/ApiToken/ApiTokenStoreRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\ApiToken;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ApiTokenStoreRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<string>>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => [
+                'required',
+                'string',
+                'min:1',
+                'max:255',
+            ],
+        ];
+    }
+
+    public function getName(): string
+    {
+        return $this->input('name');
+    }
+}

app/Http/Requests/V1/Member/MemberMergeIntoRequest.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\Member;
+
+use App\Models\Member;
+use App\Models\Organization;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Foundation\Http\FormRequest;
+use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
+
+/**
+ * @property Organization $organization
+ */
+class MemberMergeIntoRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<string|ValidationRule|\Illuminate\Contracts\Validation\Rule>>
+     */
+    public function rules(): array
+    {
+        return [
+            // ID of the member to which the data should be transferred (destination)
+            'member_id' => [
+                'string',
+                ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Member> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization');
+                })->uuid(),
+            ],
+        ];
+    }
+
+    public function getMemberId(): string
+    {
+        return (string) $this->input('member_id');
+    }
+}

app/Http/Resources/V1/ApiToken/ApiTokenCollection.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\ApiToken;
+
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+class ApiTokenCollection extends ResourceCollection
+{
+    /**
+     * The resource that this resource collects.
+     *
+     * @var string
+     */
+    public $collects = ApiTokenResource::class;
+}

app/Http/Resources/V1/ApiToken/ApiTokenResource.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\ApiToken;
+
+use App\Http\Resources\V1\BaseResource;
+use App\Models\Passport\Token;
+use Illuminate\Http\Request;
+
+/**
+ * @property-read Token $resource
+ */
+class ApiTokenResource extends BaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, string|bool|int|null|array<string>>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            /** @var string $id ID of the API token, this ID is NOT a UUID */
+            'id' => $this->resource->id,
+            /** @var string $name Name of the API token */
+            'name' => $this->resource->name,
+            /** @var bool $revoked Whether the API token is revoked */
+            'revoked' => $this->resource->revoked,
+            /** @var array<string> $scopes List of scopes that the API token has */
+            'scopes' => $this->resource->scopes,
+            /** @var string $created_at When the API token was created (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
+            'created_at' => $this->formatDateTime($this->resource->created_at),
+            /** @var string|null $expires_at At what time the API token expires (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
+            'expires_at' => $this->formatDateTime($this->resource->expires_at),
+        ];
+    }
+}

app/Http/Resources/V1/ApiToken/ApiTokenWithAccessTokenResource.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\ApiToken;
+
+use App\Http\Resources\V1\BaseResource;
+use App\Models\Passport\Token;
+use Illuminate\Http\Request;
+
+/**
+ * @property-read Token $resource
+ */
+class ApiTokenWithAccessTokenResource extends BaseResource
+{
+    private string $accessToken;
+
+    public function __construct(Token $resource, string $accessToken)
+    {
+        $this->accessToken = $accessToken;
+        parent::__construct($resource);
+    }
+
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, string|bool|int|null|array<string>>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            /** @var string $id ID of the API token, this ID is NOT a UUID */
+            'id' => $this->resource->id,
+            /** @var string $name Name of the API token */
+            'name' => $this->resource->name,
+            /** @var bool $revoked Whether the API token is revoked */
+            'revoked' => $this->resource->revoked,
+            /** @var array<string> $scopes List of scopes that the API token has */
+            'scopes' => $this->resource->scopes,
+            /** @var string $created_at When the API token was created (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
+            'created_at' => $this->formatDateTime($this->resource->created_at),
+            /** @var string|null $expires_at At what time the API token expires (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
+            'expires_at' => $this->formatDateTime($this->resource->expires_at),
+            // Additional fields
+            /** @var string $access_token Access token that can be used to authenticate requests */
+            'access_token' => $this->accessToken,
+        ];
+    }
+}

app/Http/Resources/V1/Report/DetailedWithDataReportResource.php

@@ -18,20 +18,20 @@ use Illuminate\Http\Request;
  *              description: string|null,
  *              color: string|null,
  *              seconds: int,
- *              cost: int,
+ *              cost: int|null,
  *              grouped_type: string|null,
  *              grouped_data: null|array<array{
  *                  key: string|null,
  *                  description: string|null,
  *                  color: string|null,
  *                  seconds: int,
- *                  cost: int,
+ *                  cost: int|null,
  *                  grouped_type: null,
  *                  grouped_data: null
  *              }>
  *          }>,
  *          seconds: int,
- *          cost: int
+ *          cost: int|null
  *    }
  */
 class DetailedWithDataReportResource extends BaseResource

app/Jobs/RecalculateSpentTimeForProject.php

@@ -7,12 +7,13 @@ namespace App\Jobs;
 use App\Models\Project;
 use Exception;
 use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Events\ShouldDispatchAfterCommit;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 
-class RecalculateSpentTimeForProject implements ShouldQueue
+class RecalculateSpentTimeForProject implements ShouldDispatchAfterCommit, ShouldQueue
 {
     use Dispatchable;
     use InteractsWithQueue;

app/Jobs/RecalculateSpentTimeForTask.php

@@ -7,12 +7,13 @@ namespace App\Jobs;
 use App\Models\Task;
 use Exception;
 use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Events\ShouldDispatchAfterCommit;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 
-class RecalculateSpentTimeForTask implements ShouldQueue
+class RecalculateSpentTimeForTask implements ShouldDispatchAfterCommit, ShouldQueue
 {
     use Dispatchable;
     use InteractsWithQueue;

app/Listeners/RemovePlaceholder.php

@@ -6,7 +6,7 @@ namespace App\Listeners;
 
 use App\Models\Member;
 use App\Models\User;
-use App\Service\UserService;
+use App\Service\MemberService;
 use Illuminate\Database\Eloquent\Builder;
 use Laravel\Jetstream\Events\TeamMemberAdded;
 
@@ -17,8 +17,11 @@ class RemovePlaceholder
      */
     public function handle(TeamMemberAdded $event): void
     {
-        /** @var UserService $userService */
-        $userService = app(UserService::class);
+        $memberService = app(MemberService::class);
+        $member = Member::query()
+            ->whereBelongsTo($event->team, 'organization')
+            ->whereBelongsTo($event->user, 'user')
+            ->firstOrFail();
         $placeholders = Member::query()
             ->whereHas('user', function (Builder $query) use ($event): void {
                 /** @var Builder<User> $query */
@@ -32,7 +35,7 @@ class RemovePlaceholder
         foreach ($placeholders as $placeholder) {
             /** @var Member $placeholder */
             $placeholderUser = $placeholder->user;
-            $userService->assignOrganizationEntitiesToDifferentUser($event->team, $placeholderUser, $event->user);
+            $memberService->assignOrganizationEntitiesToDifferentMember($event->team, $placeholder, $member);
             $placeholder->delete();
             $placeholderUser->delete();
         }

app/Models/Member.php

@@ -7,6 +7,7 @@ namespace App\Models;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
 use Database\Factories\MemberFactory;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -24,6 +25,8 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property Carbon|null $updated_at
  * @property-read Organization $organization
  * @property-read User $user
+ * @property-read Collection<ProjectMember> $projectMembers
+ * @property-read Collection<TimeEntry> $timeEntries
  *
  * @method static MemberFactory factory()
  */
@@ -59,6 +62,14 @@ class Member extends JetstreamMembership implements AuditableContract
         return $this->belongsTo(Organization::class, 'organization_id');
     }
 
+    /**
+     * @return HasMany<TimeEntry>
+     */
+    public function timeEntries(): HasMany
+    {
+        return $this->hasMany(TimeEntry::class, 'member_id');
+    }
+
     /**
      * @return HasMany<ProjectMember>
      */

app/Models/Passport/AuthCode.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Passport;
+
+use Laravel\Passport\AuthCode as PassportAuthCode;
+
+class AuthCode extends PassportAuthCode {}

app/Models/Passport/Client.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Passport;
+
+use Database\Factories\Passport\ClientFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Laravel\Passport\Client as PassportClient;
+
+/**
+ * @property string $id
+ * @property string|null $user_id
+ * @property string $name
+ * @property string|null $secret
+ * @property string|null $provider
+ * @property string $redirect
+ * @property bool $personal_access_client
+ * @property bool $password_client
+ * @property bool $revoked
+ */
+class Client extends PassportClient
+{
+    /** @use HasFactory<ClientFactory> */
+    use HasFactory;
+}

app/Models/Passport/PersonalAccessClient.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Passport;
+
+use Laravel\Passport\PersonalAccessClient as PassportPersonalAccessClient;
+
+class PersonalAccessClient extends PassportPersonalAccessClient {}

app/Models/Passport/RefreshToken.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Passport;
+
+use Laravel\Passport\RefreshToken as PassportRefreshToken;
+
+class RefreshToken extends PassportRefreshToken {}

app/Models/Passport/Token.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Passport;
+
+use Database\Factories\Passport\TokenFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Carbon;
+use Laravel\Passport\Token as PassportToken;
+
+/**
+ * @property string $id
+ * @property null|string $user_id
+ * @property string $client_id
+ * @property null|string $name
+ * @property array<string> $scopes
+ * @property bool $revoked
+ * @property Carbon|null $created_at
+ * @property Carbon|null $updated_at
+ * @property Carbon|null $expires_at
+ */
+class Token extends PassportToken
+{
+    /** @use HasFactory<TokenFactory> */
+    use HasFactory;
+
+    /**
+     * Get the client that the token belongs to.
+     *
+     * @return BelongsTo<Client, Token>
+     */
+    public function client(): BelongsTo
+    {
+        return $this->belongsTo(Client::class, 'client_id', 'id');
+    }
+}

app/Models/User.php

@@ -7,6 +7,7 @@ namespace App\Models;
 use App\Enums\Weekday;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
+use App\Models\Passport\Token;
 use Database\Factories\UserFactory;
 use Filament\Models\Contracts\FilamentUser;
 use Filament\Panel;
@@ -27,14 +28,13 @@ use Laravel\Jetstream\HasProfilePhoto;
 use Laravel\Jetstream\HasTeams;
 use Laravel\Passport\AuthCode;
 use Laravel\Passport\HasApiTokens;
-use Laravel\Passport\Token;
 use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
 
 /**
  * @property string $id
  * @property string $name
  * @property string $email
- * @property string|null $email_verified_at
+ * @property Carbon|null $email_verified_at
  * @property string|null $password
  * @property string|null $two_factor_secret
  * @property string $timezone
@@ -44,6 +44,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property-read Organization|null $currentOrganization
  * @property-read Organization|null $currentTeam
  * @property-read string $profile_photo_url
+ * @property-read Collection<int, Token> $tokens
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
  * @property string|null $current_team_id
@@ -196,6 +197,17 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
         return $this->hasMany(AuthCode::class);
     }
 
+    /**
+     * Get the access tokens for the user.
+     *
+     * @return HasMany<Token>
+     */
+    public function tokens(): HasMany
+    {
+        return $this->hasMany(Token::class, 'user_id')
+            ->orderBy('created_at', 'desc');
+    }
+
     /**
      * @param  Builder<User>  $builder
      */

app/Providers/AppServiceProvider.php

@@ -9,6 +9,7 @@ use App\Models\FailedJob;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
+use App\Models\Passport\Token;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Tag;
@@ -29,7 +30,6 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Foundation\Application;
 use Illuminate\Support\Facades\Route;
-use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -90,12 +90,6 @@ class AppServiceProvider extends ServiceProvider
             );
         });
 
-        if (config('app.force_https', false)) {
-            URL::forceScheme('https');
-            request()->server->set('HTTPS', 'on');
-            request()->headers->set('X-Forwarded-Proto', 'https');
-        }
-
         $this->app->scoped(PermissionStore::class, function (Application $app): PermissionStore {
             return new PermissionStore;
         });
@@ -107,5 +101,6 @@ class AppServiceProvider extends ServiceProvider
         // Routing
         Route::model('member', Member::class);
         Route::model('invitation', OrganizationInvitation::class);
+        Route::model('apiToken', Token::class);
     }
 }

app/Providers/AuthServiceProvider.php

@@ -5,6 +5,11 @@ declare(strict_types=1);
 namespace App\Providers;
 
 use App\Models\Organization;
+use App\Models\Passport\AuthCode;
+use App\Models\Passport\Client;
+use App\Models\Passport\PersonalAccessClient;
+use App\Models\Passport\RefreshToken;
+use App\Models\Passport\Token;
 use App\Policies\OrganizationPolicy;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
 use Laravel\Jetstream\Jetstream;
@@ -42,6 +47,16 @@ class AuthServiceProvider extends ServiceProvider
             // 'delete',
         ]);
 
+        Passport::useTokenModel(Token::class);
+        Passport::useRefreshTokenModel(RefreshToken::class);
+        Passport::useAuthCodeModel(AuthCode::class);
+        Passport::useClientModel(Client::class);
+        Passport::usePersonalAccessClientModel(PersonalAccessClient::class);
+
+        // Passport::tokensExpireIn(now()->addDays(15));
+        // Passport::refreshTokensExpireIn(now()->addDays(30));
+        Passport::personalAccessTokensExpireIn(now()->addMonths(12));
+
         // same as passport default above
         Jetstream::defaultApiTokenPermissions(['read']);
 

app/Providers/Filament/AdminPanelProvider.php

@@ -69,6 +69,9 @@ class AdminPanelProvider extends PanelProvider
                 NavigationGroup::make()
                     ->label('System')
                     ->collapsed(),
+                NavigationGroup::make()
+                    ->label('Auth')
+                    ->collapsed(),
             ])
             ->middleware([
                 EncryptCookies::class,

app/Providers/JetstreamServiceProvider.php

@@ -80,6 +80,8 @@ class JetstreamServiceProvider extends ServiceProvider
         Jetstream::defaultApiTokenPermissions([]);
 
         Jetstream::role(Role::Owner->value, 'Owner', [
+            'charts:view:own',
+            'charts:view:all',
             'projects:view',
             'projects:view:all',
             'projects:create',
@@ -123,6 +125,7 @@ class JetstreamServiceProvider extends ServiceProvider
             'members:invite-placeholder',
             'members:change-ownership',
             'members:make-placeholder',
+            'members:merge-into',
             'members:update',
             'members:delete',
             'billing',
@@ -133,6 +136,8 @@ class JetstreamServiceProvider extends ServiceProvider
         ])->description('Owner users can perform any action. There is only one owner per organization.');
 
         Jetstream::role(Role::Admin->value, 'Administrator', [
+            'charts:view:own',
+            'charts:view:all',
             'projects:view',
             'projects:view:all',
             'projects:create',
@@ -172,8 +177,10 @@ class JetstreamServiceProvider extends ServiceProvider
             'invitations:resend',
             'invitations:remove',
             'members:view',
-            'members:update',
             'members:invite-placeholder',
+            'members:make-placeholder',
+            'members:merge-into',
+            'members:update',
             'reports:view',
             'reports:create',
             'reports:update',
@@ -181,6 +188,8 @@ class JetstreamServiceProvider extends ServiceProvider
         ])->description('Administrator users can perform any action, except accessing the billing dashboard.');
 
         Jetstream::role(Role::Manager->value, 'Manager', [
+            'charts:view:own',
+            'charts:view:all',
             'projects:view',
             'projects:view:all',
             'projects:create',
@@ -221,6 +230,7 @@ class JetstreamServiceProvider extends ServiceProvider
         ])->description('Managers have full access to all projects, time entries, ect. but cannot manage the organization (add/remove member, edit the organization, ect.).');
 
         Jetstream::role(Role::Employee->value, 'Employee', [
+            'charts:view:own',
             'projects:view',
             'tags:view',
             'tasks:view',

app/Service/ColorService.php

@@ -33,6 +33,11 @@ class ColorService
 
     private const string VALID_REGEX = '/^#[0-9a-f]{6}$/';
 
+    public function isBuiltInColor(string $color): bool
+    {
+        return in_array($color, self::COLORS, true);
+    }
+
     public function getRandomColor(?string $seed = null): string
     {
         if ($seed !== null) {

app/Service/DeletionService.php

@@ -13,6 +13,7 @@ use App\Models\Organization;
 use App\Models\OrganizationInvitation;
 use App\Models\Project;
 use App\Models\ProjectMember;
+use App\Models\Report;
 use App\Models\Tag;
 use App\Models\Task;
 use App\Models\TimeEntry;
@@ -71,6 +72,9 @@ class DeletionService
         // Delete all clients
         Client::query()->whereBelongsTo($organization, 'organization')->delete();
 
+        // Delete all reports
+        Report::query()->whereBelongsTo($organization, 'organization')->delete();
+
         // Reset the current organization
         $organization->owner()
             ->where('current_team_id', $organization->getKey())

app/Service/Import/ImportDatabaseHelper.php

@@ -188,6 +188,18 @@ class ImportDatabaseHelper
         return $model;
     }
 
+    /**
+     * @return array<TModel>
+     */
+    public function getCachedModels(): array
+    {
+        if ($this->mapKeyToModel === null) {
+            return [];
+        }
+
+        return array_values($this->mapKeyToModel);
+    }
+
     /**
      * @param  array<string, mixed>  $identifierData
      * @return TModel|null

app/Service/Import/Importers/ClockifyProjectsImporter.php

@@ -43,6 +43,7 @@ class ClockifyProjectsImporter extends DefaultImporter
                         'color' => $this->colorService->getRandomColor(),
                         'is_billable' => $record['Billability'] === 'Yes',
                         'billable_rate' => $billableRateKey !== null && $record[$billableRateKey] !== '' ? (int) (((float) $record[$billableRateKey]) * 100) : null,
+                        'estimated_time' => $record['Estimated (h)'] !== '' && is_numeric($record['Estimated (h)']) ? (int) ($record['Estimated (h)'] * 3600) : null,
                     ]);
                 }
 

app/Service/Import/Importers/ClockifyTimeEntriesImporter.php

@@ -5,10 +5,13 @@ declare(strict_types=1);
 namespace App\Service\Import\Importers;
 
 use App\Enums\Role;
+use App\Jobs\RecalculateSpentTimeForProject;
+use App\Jobs\RecalculateSpentTimeForTask;
 use App\Models\TimeEntry;
 use Carbon\Exceptions\InvalidFormatException;
 use Exception;
 use Illuminate\Support\Carbon;
+use Illuminate\Support\Str;
 use League\Csv\Exception as CsvException;
 use League\Csv\Reader;
 
@@ -21,7 +24,7 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
      */
     private function getTags(string $tags): array
     {
-        if (trim($tags) === '') {
+        if (Str::trim($tags) === '') {
             return [];
         }
         $tagsParsed = explode(', ', $tags);
@@ -99,6 +102,7 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
                         'project_id' => $projectId,
                         'organization_id' => $this->organization->id,
                     ]);
+                    $this->taskImportHelper->getModelById($taskId);
                 }
                 $timeEntry = new TimeEntry;
                 $timeEntry->disableAuditing();
@@ -158,6 +162,12 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
                 $timeEntry->save();
                 $this->timeEntriesCreated++;
             }
+            foreach ($this->projectImportHelper->getCachedModels() as $usedProject) {
+                RecalculateSpentTimeForProject::dispatch($usedProject);
+            }
+            foreach ($this->taskImportHelper->getCachedModels() as $usedTask) {
+                RecalculateSpentTimeForTask::dispatch($usedTask);
+            }
         } catch (ImportException $exception) {
             throw $exception;
         } catch (CsvException $exception) {

app/Service/Import/Importers/GenericProjectsImporter.php

@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service\Import\Importers;
+
+use App\Service\ColorService;
+use Carbon\Exceptions\InvalidFormatException;
+use Exception;
+use Illuminate\Support\Carbon;
+use League\Csv\Exception as CsvException;
+use League\Csv\Reader;
+use Override;
+
+class GenericProjectsImporter extends DefaultImporter
+{
+    /**
+     * @var array<string>
+     */
+    private const array REQUIRED_FIELDS = [
+        'name',
+    ];
+
+    /**
+     * @throws ImportException
+     */
+    #[Override]
+    public function importData(string $data, string $timezone): void
+    {
+        try {
+            $reader = Reader::createFromString($data);
+            $reader->setHeaderOffset(0);
+            $reader->setDelimiter(',');
+            $reader->setEnclosure('"');
+            $reader->setEscape('');
+            $header = $reader->getHeader();
+            $this->validateHeader($header);
+            $records = $reader->getRecords();
+            foreach ($records as $record) {
+                $clientId = null;
+                if (isset($record['client']) && $record['client'] !== '') {
+                    $clientId = $this->clientImportHelper->getKey([
+                        'name' => $record['client'],
+                        'organization_id' => $this->organization->id,
+                    ]);
+                }
+                if ($record['name'] !== '') {
+                    $archivedAt = null;
+                    if (isset($record['archived_at']) && $record['archived_at'] !== '') {
+                        try {
+                            $archivedAt = Carbon::createFromFormat('Y-m-d\TH:i:s\Z', $record['archived_at'], 'UTC');
+                        } catch (InvalidFormatException) {
+                            throw new ImportException('Value of archived_at ("'.$record['archived_at'].'") is invalid');
+                        }
+                    }
+                    $this->projectImportHelper->getKey([
+                        'name' => $record['name'],
+                        'organization_id' => $this->organization->id,
+                    ], [
+                        'color' => isset($record['color']) && $record['color'] !== '' ? $record['color'] : app(ColorService::class)->getRandomColor(),
+                        'billable_rate' => isset($record['billable_rate']) && $record['billable_rate'] !== '' ? (int) $record['billable_rate'] : null,
+                        'is_public' => isset($record['is_public']) && $record['is_public'] === 'true',
+                        'client_id' => $clientId,
+                        'is_billable' => isset($record['billable_default']) && $record['billable_default'] === 'true',
+                        'estimated_time' => isset($record['estimated_time']) && $record['estimated_time'] !== '' && is_numeric($record['estimated_time']) && ((int) $record['estimated_time'] !== 0) ? (int) $record['estimated_time'] : null,
+                        'archived_at' => $archivedAt,
+                    ]);
+                }
+            }
+        } catch (ImportException $exception) {
+            throw $exception;
+        } catch (CsvException $exception) {
+            throw new ImportException('Invalid CSV data');
+        } catch (Exception $exception) {
+            report($exception);
+            throw new ImportException('Unknown error');
+        }
+    }
+
+    /**
+     * @param  array<string>  $header
+     *
+     * @throws ImportException
+     */
+    private function validateHeader(array $header): void
+    {
+        foreach (self::REQUIRED_FIELDS as $requiredField) {
+            if (! in_array($requiredField, $header, true)) {
+                throw new ImportException('Invalid CSV header, missing field: '.$requiredField);
+            }
+        }
+    }
+
+    #[Override]
+    public function getName(): string
+    {
+        return __('importer.generic_projects.name');
+    }
+
+    #[Override]
+    public function getDescription(): string
+    {
+        return __('importer.generic_projects.description');
+    }
+}

app/Service/Import/Importers/GenericTimeEntriesImporter.php

@@ -0,0 +1,208 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service\Import\Importers;
+
+use App\Enums\Role;
+use App\Jobs\RecalculateSpentTimeForProject;
+use App\Jobs\RecalculateSpentTimeForTask;
+use App\Models\TimeEntry;
+use Carbon\Exceptions\InvalidFormatException;
+use Exception;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Str;
+use League\Csv\Exception as CsvException;
+use League\Csv\Reader;
+
+class GenericTimeEntriesImporter extends DefaultImporter
+{
+    /**
+     * @var array<string>
+     */
+    private const array REQUIRED_FIELDS = [
+        'description',
+        'billable',
+        'client',
+        'project',
+        'tags',
+        'start',
+        'end',
+        'task',
+        'user_name',
+        'user_email',
+    ];
+
+    /**
+     * @return array<string>
+     *
+     * @throws ImportException
+     */
+    private function getTags(string $tags): array
+    {
+        if (Str::trim($tags) === '') {
+            return [];
+        }
+        $tagsParsed = explode(',', $tags);
+        $tagIds = [];
+        foreach ($tagsParsed as $tagParsed) {
+            $tagId = $this->tagImportHelper->getKey([
+                'name' => Str::trim($tagParsed),
+                'organization_id' => $this->organization->id,
+            ]);
+            $tagIds[] = $tagId;
+        }
+
+        return $tagIds;
+    }
+
+    /**
+     * @throws ImportException
+     */
+    #[\Override]
+    public function importData(string $data, string $timezone): void
+    {
+        try {
+            $reader = Reader::createFromString($data);
+            $reader->setHeaderOffset(0);
+            $reader->setDelimiter(',');
+            $reader->setEnclosure('"');
+            $reader->setEscape('');
+            $header = $reader->getHeader();
+            $this->validateHeader($header);
+            $records = $reader->getRecords();
+            foreach ($records as $record) {
+                $userId = $this->userImportHelper->getKey([
+                    'email' => $record['user_email'],
+                ], [
+                    'name' => $record['user_name'],
+                    'timezone' => 'UTC',
+                    'is_placeholder' => true,
+                ]);
+                $memberId = $this->memberImportHelper->getKey([
+                    'user_id' => $userId,
+                    'organization_id' => $this->organization->getKey(),
+                ], [
+                    'role' => Role::Placeholder->value,
+                ]);
+                $member = $this->memberImportHelper->getModelById($memberId);
+                $clientId = null;
+                if ($record['client'] !== '') {
+                    $clientId = $this->clientImportHelper->getKey([
+                        'name' => $record['client'],
+                        'organization_id' => $this->organization->id,
+                    ]);
+                }
+                $projectId = null;
+                $project = null;
+                $projectMember = null;
+                if ($record['project'] !== '') {
+                    $projectId = $this->projectImportHelper->getKey([
+                        'name' => $record['project'],
+                        'organization_id' => $this->organization->id,
+                    ], [
+                        'client_id' => $clientId,
+                        'is_billable' => false,
+                        'color' => $this->colorService->getRandomColor(),
+                    ]);
+                    $project = $this->projectImportHelper->getModelById($projectId);
+                    $projectMember = $this->projectMemberImportHelper->getModel([
+                        'project_id' => $projectId,
+                        'member_id' => $memberId,
+                    ]);
+                }
+                $taskId = null;
+                if ($record['task'] !== '') {
+                    $taskId = $this->taskImportHelper->getKey([
+                        'name' => $record['task'],
+                        'project_id' => $projectId,
+                        'organization_id' => $this->organization->id,
+                    ]);
+                    $this->taskImportHelper->getModelById($taskId);
+                }
+                $timeEntry = new TimeEntry;
+                $timeEntry->disableAuditing();
+                $timeEntry->user_id = $userId;
+                $timeEntry->member_id = $memberId;
+                $timeEntry->task_id = $taskId;
+                $timeEntry->project_id = $projectId;
+                $timeEntry->client_id = $clientId;
+                $timeEntry->organization_id = $this->organization->id;
+                $timeEntry->description = $record['description'];
+                if (! in_array($record['billable'], ['true', 'false'], true)) {
+                    throw new ImportException('Invalid billable value');
+                }
+                $timeEntry->billable = $record['billable'] === 'true';
+                $timeEntry->tags = $this->getTags($record['tags']);
+                $timeEntry->is_imported = true;
+                try {
+                    $start = Carbon::createFromFormat('Y-m-d\TH:i:s\Z', $record['start'], 'UTC');
+                } catch (InvalidFormatException) {
+                    throw new ImportException('Value of start ("'.$record['start'].'") is invalid');
+                }
+                if ($start === null) {
+                    throw new ImportException('Value of start ("'.$record['start'].'") is invalid');
+                }
+                $timeEntry->start = $start->utc();
+
+                try {
+                    $end = Carbon::createFromFormat('Y-m-d\TH:i:s\Z', $record['end'], 'UTC');
+                } catch (InvalidFormatException) {
+                    throw new ImportException('Value of end ("'.$record['end'].'") is invalid');
+                }
+                if ($end === null) {
+                    throw new ImportException('Value of end ("'.$record['end'].'") is invalid');
+                }
+                $timeEntry->end = $end->utc();
+                $timeEntry->billable_rate = $this->billableRateService->getBillableRateForTimeEntryWithGivenRelations(
+                    $timeEntry,
+                    $projectMember,
+                    $project,
+                    $member,
+                    $this->organization
+                );
+                $timeEntry->save();
+                $this->timeEntriesCreated++;
+            }
+            foreach ($this->projectImportHelper->getCachedModels() as $usedProject) {
+                RecalculateSpentTimeForProject::dispatch($usedProject);
+            }
+            foreach ($this->taskImportHelper->getCachedModels() as $usedTask) {
+                RecalculateSpentTimeForTask::dispatch($usedTask);
+            }
+        } catch (ImportException $exception) {
+            throw $exception;
+        } catch (CsvException $exception) {
+            throw new ImportException('Invalid CSV data');
+        } catch (Exception $exception) {
+            report($exception);
+            throw new ImportException('Unknown error');
+        }
+    }
+
+    /**
+     * @param  array<string>  $header
+     *
+     * @throws ImportException
+     */
+    private function validateHeader(array $header): void
+    {
+        foreach (self::REQUIRED_FIELDS as $requiredField) {
+            if (! in_array($requiredField, $header, true)) {
+                throw new ImportException('Invalid CSV header, missing field: '.$requiredField);
+            }
+        }
+    }
+
+    #[\Override]
+    public function getName(): string
+    {
+        return __('importer.generic_time_entries.name');
+    }
+
+    #[\Override]
+    public function getDescription(): string
+    {
+        return __('importer.generic_time_entries.description');
+    }
+}

app/Service/Import/Importers/HarvestClientsImporter.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service\Import\Importers;
+
+use Exception;
+use League\Csv\Exception as CsvException;
+use League\Csv\Reader;
+
+class HarvestClientsImporter extends DefaultImporter
+{
+    /**
+     * @var array<string>
+     */
+    private const array REQUIRED_FIELDS = [
+        'Client Name',
+    ];
+
+    /**
+     * @throws ImportException
+     */
+    #[\Override]
+    public function importData(string $data, string $timezone): void
+    {
+        try {
+            $reader = Reader::createFromString($data);
+            $reader->setHeaderOffset(0);
+            $reader->setDelimiter(',');
+            $reader->setEnclosure('"');
+            $reader->setEscape('');
+            $header = $reader->getHeader();
+            $this->validateHeader($header);
+            $records = $reader->getRecords();
+            foreach ($records as $record) {
+                $this->clientImportHelper->getKey([
+                    'name' => $record['Client Name'],
+                    'organization_id' => $this->organization->id,
+                ]);
+            }
+        } catch (ImportException $exception) {
+            throw $exception;
+        } catch (CsvException $exception) {
+            throw new ImportException('Invalid CSV data');
+        } catch (Exception $exception) {
+            report($exception);
+            throw new ImportException('Unknown error');
+        }
+    }
+
+    /**
+     * @param  array<string>  $header
+     *
+     * @throws ImportException
+     */
+    private function validateHeader(array $header): void
+    {
+        foreach (self::REQUIRED_FIELDS as $requiredField) {
+            if (! in_array($requiredField, $header, true)) {
+                throw new ImportException('Invalid CSV header, missing field: '.$requiredField);
+            }
+        }
+    }
+
+    #[\Override]
+    public function getName(): string
+    {
+        return __('importer.harvest_clients.name');
+    }
+
+    #[\Override]
+    public function getDescription(): string
+    {
+        return __('importer.harvest_clients.description');
+    }
+}