Bump the minor-updates group across 1 directory with 7 updates

Bumps the minor-updates group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brick/money](https://github.com/brick/money) | `0.15.1` | `0.15.2` |
| [dedoc/scramble](https://github.com/dedoc/scramble) | `0.13.45` | `0.13.47` |
| [filament/filament](https://github.com/filamentphp/panels) | `5.8.4` | `5.9.0` |
| [inertiajs/inertia-laravel](https://github.com/inertiajs/inertia-laravel) | `3.3.4` | `3.5.1` |
| [laravel/framework](https://github.com/laravel/framework) | `13.33.0` | `13.34.0` |
| [stechstudio/filament-impersonate](https://github.com/stechstudio/filament-impersonate) | `5.6.0` | `5.6.1` |
| [fumeapp/modeltyper](https://github.com/fumeapp/modeltyper) | `3.13.0` | `3.14.0` |



Updates `brick/money` from 0.15.1 to 0.15.2
- [Release notes](https://github.com/brick/money/releases)
- [Changelog](https://github.com/brick/money/blob/main/CHANGELOG.md)
- [Commits](https://github.com/brick/money/compare/0.15.1...0.15.2)

Updates `dedoc/scramble` from 0.13.45 to 0.13.47
- [Release notes](https://github.com/dedoc/scramble/releases)
- [Commits](https://github.com/dedoc/scramble/compare/v0.13.45...v0.13.47)

Updates `filament/filament` from 5.8.4 to 5.9.0
- [Commits](https://github.com/filamentphp/panels/compare/v5.8.4...v5.9.0)

Updates `inertiajs/inertia-laravel` from 3.3.4 to 3.5.1
- [Release notes](https://github.com/inertiajs/inertia-laravel/releases)
- [Changelog](https://github.com/inertiajs/inertia-laravel/blob/3.x/CHANGELOG.md)
- [Commits](https://github.com/inertiajs/inertia-laravel/compare/v3.3.4...v3.5.1)

Updates `laravel/framework` from 13.33.0 to 13.34.0
- [Release notes](https://github.com/laravel/framework/releases)
- [Changelog](https://github.com/laravel/framework/blob/13.x/CHANGELOG.md)
- [Commits](https://github.com/laravel/framework/compare/v13.33.0...v13.34.0)

Updates `stechstudio/filament-impersonate` from 5.6.0 to 5.6.1
- [Release notes](https://github.com/stechstudio/filament-impersonate/releases)
- [Commits](https://github.com/stechstudio/filament-impersonate/compare/v5.6.0...v5.6.1)

Updates `fumeapp/modeltyper` from 3.13.0 to 3.14.0
- [Release notes](https://github.com/fumeapp/modeltyper/releases)
- [Commits](https://github.com/fumeapp/modeltyper/compare/v3.13.0...v3.14.0)

---
updated-dependencies:
- dependency-name: brick/money
  dependency-version: 0.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: dedoc/scramble
  dependency-version: 0.13.47
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: filament/filament
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: inertiajs/inertia-laravel
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: laravel/framework
  dependency-version: 13.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: stechstudio/filament-impersonate
  dependency-version: 5.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: fumeapp/modeltyper
  dependency-version: 3.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/build-onpremise.yml

@@ -103,6 +103,8 @@ jobs:
           {
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
+            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout invoicing extension"
@@ -119,9 +121,26 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
+      - name: "Checkout auditing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
+          path: extensions/Auditing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
+
+      - name: "Install composer dependencies in auditing extension"
+        run: cd extensions/Auditing && composer install --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+
+      - name: "Install npm dependencies in auditing extension"
+        run: cd extensions/Auditing && npm ci
+
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
+      - name: "Activate auditing extension"
+        run: php artisan module:enable Auditing
+
       - name: "Install npm dependencies"
         run: npm ci
 

.github/workflows/build-private.yml

@@ -84,6 +84,8 @@ jobs:
             echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
+            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout billing extension"
@@ -145,6 +147,25 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
+      - name: "Checkout auditing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
+          path: extensions/Auditing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
+
+      - name: "Install composer dependencies in auditing extension"
+        uses: php-actions/composer@v6
+        with:
+          working_dir: "extensions/Auditing"
+          command: install
+          only_args: --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
+          php_version: 8.3
+
+      - name: "Install npm dependencies in auditing extension"
+        run: cd extensions/Auditing && npm ci
+
       - name: "Setup PHP with PECL extension"
         uses: shivammathur/setup-php@v2
         with:
@@ -168,6 +189,9 @@ jobs:
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
+      - name: "Activate auditing extension"
+        run: php artisan module:enable Auditing
+
       - name: "Install npm dependencies"
         run: npm ci
 

.github/workflows/npm-format-check.yml

@@ -1,6 +1,8 @@
 name: NPM Format Check
 
 on: [push]
+permissions:
+  contents: read
 
 jobs:
   format-check:

app/Filament/Resources/AuditResource.php

@@ -1,99 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources;
-
-use App\Filament\Resources\AuditResource\Pages\CreateAudit;
-use App\Filament\Resources\AuditResource\Pages\ListAudits;
-use App\Filament\Resources\AuditResource\Pages\ViewAudit;
-use App\Models\Audit;
-use Filament\Actions\ViewAction;
-use Filament\Forms\Components\Textarea;
-use Filament\Forms\Components\TextInput;
-use Filament\Resources\Resource;
-use Filament\Schemas\Schema;
-use Filament\Tables\Columns\IconColumn;
-use Filament\Tables\Columns\TextColumn;
-use Filament\Tables\Table;
-use Illuminate\Support\Str;
-use Novadaemon\FilamentPrettyJson\Form\PrettyJsonField;
-
-class AuditResource extends Resource
-{
-    protected static ?string $model = Audit::class;
-
-    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-archive-box';
-
-    protected static string|\UnitEnum|null $navigationGroup = 'System';
-
-    public static function form(Schema $schema): Schema
-    {
-        return $schema
-            ->components([
-                TextInput::make('user_type')
-                    ->maxLength(255),
-                TextInput::make('user_id'),
-                TextInput::make('event')
-                    ->required()
-                    ->maxLength(255),
-                TextInput::make('auditable_type')
-                    ->required()
-                    ->maxLength(255),
-                TextInput::make('auditable_id')
-                    ->required(),
-                PrettyJsonField::make('old_values'),
-                PrettyJsonField::make('new_values'),
-                Textarea::make('url'),
-                TextInput::make('ip_address'),
-                TextInput::make('user_agent')
-                    ->maxLength(1023),
-                TextInput::make('tags')
-                    ->maxLength(255),
-            ]);
-    }
-
-    public static function table(Table $table): Table
-    {
-        return $table
-            ->columns([
-                TextColumn::make('user.name'),
-                TextColumn::make('event'),
-                TextColumn::make('auditable_type'),
-                TextColumn::make('auditable_id'),
-                IconColumn::make('was_command')
-                    ->getStateUsing(fn (Audit $record) => Str::startsWith($record->url, 'artisan '))
-                    ->boolean(),
-                TextColumn::make('created_at')
-                    ->sortable()
-                    ->dateTime(),
-                TextColumn::make('updated_at')
-                    ->sortable()
-                    ->dateTime(),
-            ])
-            ->filters([
-                //
-            ])
-            ->recordActions([
-                ViewAction::make(),
-            ])
-            ->toolbarActions([
-            ])
-            ->defaultSort('created_at', 'desc');
-    }
-
-    public static function getRelations(): array
-    {
-        return [
-        ];
-    }
-
-    public static function getPages(): array
-    {
-        return [
-            'index' => ListAudits::route('/'),
-            'create' => CreateAudit::route('/create'),
-            'view' => ViewAudit::route('/{record}'),
-        ];
-    }
-}

app/Filament/Resources/AuditResource/Pages/CreateAudit.php

@@ -1,13 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\CreateRecord;
-
-class CreateAudit extends CreateRecord
-{
-    protected static string $resource = AuditResource::class;
-}

app/Filament/Resources/AuditResource/Pages/ListAudits.php

@@ -1,18 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\ListRecords;
-
-class ListAudits extends ListRecords
-{
-    protected static string $resource = AuditResource::class;
-
-    protected function getHeaderActions(): array
-    {
-        return [];
-    }
-}

app/Filament/Resources/AuditResource/Pages/ViewAudit.php

@@ -1,13 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Resources\AuditResource\Pages;
-
-use App\Filament\Resources\AuditResource;
-use Filament\Resources\Pages\ViewRecord;
-
-class ViewAudit extends ViewRecord
-{
-    protected static string $resource = AuditResource::class;
-}

app/Service/DeletionService.php

@@ -11,6 +11,7 @@ use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
+use App\Models\Passport\RefreshToken;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -169,6 +170,10 @@ class DeletionService
             }
         }
 
+        // Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
+        // Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
+        // which fails with a foreign key violation on oauth_access_tokens.user_id.
+        RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
         $user->accessTokens()->delete();
         $user->authCodes()->delete();
 

e2e/admin-panel.spec.ts

@@ -19,7 +19,6 @@ const resourcePages = [
     { path: '/admin/project-members', heading: 'Project Members' },
     { path: '/admin/tokens', heading: 'Tokens' },
     { path: '/admin/failed-jobs', heading: 'Failed Jobs' },
-    { path: '/admin/audits', heading: 'Audits' },
 ];
 
 test.describe('Admin Panel Access', () => {

extensions/manifest.json

@@ -1,7 +1,7 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "v0.0.7"
+        "ref": "v0.0.8"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",
@@ -10,5 +10,9 @@
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
         "ref": "v0.0.7"
+    },
+    "Auditing": {
+        "repository": "solidtime-io/extension-auditing",
+        "ref": "v0.0.2"
     }
 }

resources/js/packages/ui/src/FullCalendar/useEventResize.ts

@@ -111,6 +111,8 @@ export function useEventResize(params: {
         edge: 'start' | 'end',
         dayStr: string
     ) {
+        if (e.button !== 0) return;
+
         e.preventDefault();
         e.stopPropagation();
 

resources/js/packages/ui/src/TimeTracker/TimeTrackerEntryInput.vue

@@ -168,6 +168,10 @@ defineExpose({ submit, focusAfterStart });
         data-testid="time_entry_description"
         class="w-full rounded-l-lg py-4 sm:py-2.5 px-3.5 border-b border-b-card-background-separator @2xl:px-4 text-base text-text-primary bg-transparent border-none placeholder-text-secondary focus:ring-0 transition"
         type="text"
+        autocomplete="off"
+        data-1p-ignore
+        data-lpignore="true"
+        data-form-type="other"
         @keydown.enter="submit"
         @keydown.esc="showDropdown = false"
         @blur="updateTimeEntryDescription" />

resources/js/packages/ui/src/TimeTracker/TimeTrackerRangeSelector.vue

@@ -170,6 +170,10 @@ function closeAndFocusInput() {
                             : 'text-text-primary bg-card-background border-border-secondary border border-none'
                     "
                     type="text"
+                    autocomplete="off"
+                    data-1p-ignore
+                    data-lpignore="true"
+                    data-form-type="other"
                     @focusin="openModalOnTab"
                     @click="openModalOnClick"
                     @keydown.exact.tab="focusNextElement"

tests/Unit/Filament/Resources/AuditResourceTest.php

@@ -1,59 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\Filament\Resources;
-
-use App\Filament\Resources\AuditResource;
-use App\Models\Audit;
-use App\Models\TimeEntry;
-use App\Models\User;
-use Illuminate\Support\Facades\Config;
-use Illuminate\Support\Facades\DB;
-use Livewire\Livewire;
-use PHPUnit\Framework\Attributes\UsesClass;
-use Tests\Unit\Filament\FilamentTestCase;
-
-#[UsesClass(AuditResource::class)]
-class AuditResourceTest extends FilamentTestCase
-{
-    protected function setUp(): void
-    {
-        parent::setUp();
-        Config::set('auth.super_admins', ['admin@example.com']);
-        $user = User::factory()->withPersonalOrganization()->create([
-            'email' => 'admin@example.com',
-        ]);
-
-        $this->actingAs($user);
-    }
-
-    public function test_can_list_audits(): void
-    {
-        // Arrange
-        $user = $this->createUserWithPermission();
-        $timeEntry = TimeEntry::factory()->forMember($user->member)->create();
-        DB::table((new Audit)->getTable())->delete();
-        $audits = Audit::factory()->auditFor($timeEntry)->auditUser($user->user)->createMany(5);
-
-        // Act
-        $response = Livewire::test(AuditResource\Pages\ListAudits::class);
-
-        // Assert
-        $response->assertSuccessful();
-        $response->assertCanSeeTableRecords($audits);
-    }
-
-    public function test_can_see_view_page_of_audit(): void
-    {
-        // Arrange
-        DB::table((new Audit)->getTable())->delete();
-        $audit = Audit::factory()->create();
-
-        // Act
-        $response = Livewire::test(AuditResource\Pages\ViewAudit::class, ['record' => $audit->getKey()]);
-
-        // Assert
-        $response->assertSuccessful();
-    }
-}

tests/Unit/Service/DeletionServiceTest.php

@@ -10,6 +10,9 @@ use App\Exceptions\Api\CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembe
 use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
+use App\Models\Passport\Client as PassportClient;
+use App\Models\Passport\RefreshToken;
+use App\Models\Passport\Token;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -23,6 +26,7 @@ use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Tests\TestCaseWithDatabase;
 use TiMacDonald\Log\LogEntry;
@@ -424,4 +428,45 @@ class DeletionServiceTest extends TestCaseWithDatabase
             'role' => Role::Placeholder->value,
         ]);
     }
+
+    public function test_delete_user_deletes_access_tokens_and_their_refresh_tokens_but_does_not_delete_tokens_of_other_users(): void
+    {
+        // Arrange
+        $user = User::factory()->create();
+        $otherUser = User::factory()->create();
+        $passportClient = PassportClient::factory()->create();
+
+        $userToken = Token::factory()->forUser($user)->forClient($passportClient)->create();
+        $userRefreshToken = RefreshToken::query()->create([
+            'id' => Str::random(100),
+            'access_token_id' => $userToken->getKey(),
+            'revoked' => false,
+            'expires_at' => now()->addDays(30),
+        ]);
+
+        $otherUserToken = Token::factory()->forUser($otherUser)->forClient($passportClient)->create();
+        $otherUserRefreshToken = RefreshToken::query()->create([
+            'id' => Str::random(100),
+            'access_token_id' => $otherUserToken->getKey(),
+            'revoked' => false,
+            'expires_at' => now()->addDays(30),
+        ]);
+
+        // Act
+        $this->deletionService->deleteUser($user);
+
+        // Assert
+        $this->assertDatabaseMissing(Token::class, [
+            'id' => $userToken->getKey(),
+        ]);
+        $this->assertDatabaseMissing(RefreshToken::class, [
+            'id' => $userRefreshToken->getKey(),
+        ]);
+        $this->assertDatabaseHas(Token::class, [
+            'id' => $otherUserToken->getKey(),
+        ]);
+        $this->assertDatabaseHas(RefreshToken::class, [
+            'id' => $otherUserRefreshToken->getKey(),
+        ]);
+    }
 }