improve API docs

.github/workflows/playwright-extensions.yml

@@ -1,185 +0,0 @@
-name: Playwright Tests - Extensions
-on: push
-permissions:
-  contents: read
-jobs:
-  test:
-    name: test (${{ matrix.variant }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-
-    # Same extension sets as build-private.yml and build-onpremise.yml, so the extension specs run
-    # with and without Billing.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - variant: private
-            billing: true
-            extensions: Billing Services Invoicing
-          - variant: onpremise
-            billing: false
-            extensions: Invoicing
-
-    services:
-      mailpit:
-        image: 'axllent/mailpit:latest'
-        ports:
-          - 1025:1025
-          - 8025:8025
-      pgsql_test:
-        image: postgres:15
-        env:
-          PGPASSWORD: 'root'
-          POSTGRES_DB: 'laravel'
-          POSTGRES_USER: 'root'
-          POSTGRES_PASSWORD: 'root'
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      gotenberg:
-        image: gotenberg/gotenberg:8
-        ports:
-          - 3000:3000
-        options: >-
-          --health-cmd "curl --silent --fail http://localhost:3000/health"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - name: "Checkout code"
-        uses: actions/checkout@v7
-
-      - name: "Setup node"
-        uses: actions/setup-node@v7
-        with:
-          node-version: '20.x'
-
-      - name: "Setup PHP"
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
-          coverage: none
-
-      - name: "Read extension manifest"
-        id: extension-manifest
-        run: |
-          {
-            echo "billing_repository=$(jq -r '.Billing.repository' extensions/manifest.json)"
-            echo "billing_ref=$(jq -r '.Billing.ref' extensions/manifest.json)"
-            echo "services_repository=$(jq -r '.Services.repository' extensions/manifest.json)"
-            echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
-            echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
-            echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: "Checkout billing extension"
-        if: matrix.billing
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.billing_repository }}
-          ref: ${{ steps.extension-manifest.outputs.billing_ref }}
-          path: extensions/Billing
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_BILLING_EXTENSION }}
-
-      - name: "Install composer dependencies in billing extension"
-        if: matrix.billing
-        working-directory: extensions/Billing
-        env:
-          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "contact@solidtime.io", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
-        run: composer install -n --prefer-dist --ignore-platform-reqs
-
-      - name: "Install npm dependencies in billing extension"
-        if: matrix.billing
-        run: cd extensions/Billing && npm ci
-
-      - name: "Checkout services extension"
-        if: matrix.billing
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.services_repository }}
-          ref: ${{ steps.extension-manifest.outputs.services_ref }}
-          path: extensions/Services
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_SERVICES_EXTENSION }}
-
-      - name: "Install composer dependencies in services extension"
-        if: matrix.billing
-        working-directory: extensions/Services
-        run: composer install -n --prefer-dist --ignore-platform-reqs
-
-      - name: "Install npm dependencies in services extension"
-        if: matrix.billing
-        run: cd extensions/Services && npm ci
-
-      - name: "Checkout invoicing extension"
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.invoicing_repository }}
-          ref: ${{ steps.extension-manifest.outputs.invoicing_ref }}
-          path: extensions/Invoicing
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_INVOICING_EXTENSION }}
-
-      - name: "Install composer dependencies in invoicing extension"
-        working-directory: extensions/Invoicing
-        run: composer install -n --prefer-dist --ignore-platform-reqs
-
-      - name: "Install npm dependencies in invoicing extension"
-        run: cd extensions/Invoicing && npm ci
-
-      - name: "Run composer install"
-        run: composer install -n --prefer-dist
-
-      # Must run before `migrate` so the extensions' migrations are applied, and before the
-      # frontend build so vite collects the extensions' assets. It also writes
-      # modules_statuses.json, which playwright.config.ts reads to collect the extension specs.
-      - name: "Activate extensions"
-        run: |
-          for extension in ${{ matrix.extensions }}; do
-            php artisan module:enable "$extension"
-          done
-
-      - name: "Prepare Laravel Application"
-        run: |
-          cp .env.ci .env
-          php artisan key:generate
-          php artisan passport:keys
-          php artisan migrate --seed
-
-      - name: "Install dependencies"
-        run: npm ci
-
-      - name: "Build Frontend"
-        run: npm run build
-
-      - name: "Install FrankenPHP"
-        run: |
-          ARCH="$(uname -m)"
-          curl -fsSL "https://github.com/dunglas/frankenphp/releases/latest/download/frankenphp-linux-${ARCH}" -o /usr/local/bin/frankenphp
-          chmod +x /usr/local/bin/frankenphp
-
-      - name: "Run Laravel Octane Server"
-        run: php artisan octane:start --server=frankenphp --host=127.0.0.1 --port=8000 --workers=4 --max-requests=500 > /dev/null 2>&1 &
-        env:
-          OCTANE_SERVER: frankenphp
-
-      - name: "Install Playwright Browsers"
-        run: npx playwright install --with-deps
-
-      # Only the extension specs, the core specs run without extensions in playwright.yml
-      - name: "Run Playwright tests"
-        run: npx playwright test extensions/
-        env:
-          PLAYWRIGHT_BASE_URL: 'http://127.0.0.1:8000'
-          MAILPIT_BASE_URL: 'http://localhost:8025'
-
-      # No artifacts are uploaded on purpose. This repository is public, so every artifact is
-      # downloadable by anyone, and Playwright's reports carry the source of the specs that
-      # produced them (traces embed whole source files, error-context.md embeds a window of the
-      # spec). Those specs live in the private extension repositories. Failures are diagnosed from
-      # the job log; to inspect a trace, reproduce the failure locally with the extension checked out.

app/Http/Controllers/Api/V1/InvitationController.php

@@ -88,6 +88,8 @@ class InvitationController extends Controller
     /**
      * Remove a pending invitation
      *
+     * This revokes the invitation: the link in the invitation email stops working. Find the invitation ID with `GET /organizations/{organization}/invitations`.
+     *
      * @throws AuthorizationException
      *
      * @operationId removeInvitation

app/Http/Controllers/Api/V1/MemberController.php

@@ -145,6 +145,9 @@ class MemberController extends Controller
     /**
      * Merge one member into another
      *
+     * Only placeholder members (for example people created by an import) can be merged. All time entries and other data of the placeholder
+     * are reassigned to the member given in `member_id`, and the placeholder is removed. Find both member IDs with `GET /organizations/{organization}/members`.
+     *
      * @throws AuthorizationException
      * @throws OnlyPlaceholdersCanBeMergedIntoAnotherMember
      * @throws Throwable

app/Http/Controllers/Api/V1/ReportController.php

@@ -71,6 +71,8 @@ class ReportController extends Controller
     /**
      * Create report
      *
+     * A report is a saved set of filters. Set `is_public` to `true` to share it: the response then contains the `shareable_link` that can be opened without logging in.
+     *
      * @throws AuthorizationException
      *
      * @operationId createReport

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -109,9 +109,14 @@ class TimeEntryController extends Controller
     /**
      * Get time entries in organization
      *
-     * If you only need time entries for a specific user, you can filter by `member_id`.
+     * Without a member filter this returns the time entries of all members of the organization (for users who may view all time entries, such as owners and admins), not only your own.
+     * To get only your own time entries, pass your member ID as `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
      * Users with the permission `time-entries:view:own` can only use this endpoint with their own member ID in the member_id filter.
      *
+     * The `start` and `end` filters both apply to the start time of an entry, in UTC. Convert the user's local day boundaries to UTC first.
+     * Results are paginated with `limit` (default 100, max 500) and `offset`; check `meta.total` and fetch further pages when needed.
+     * To find the running timer, use `active=true` (or `GET /v1/users/me/time-entries/active`).
+     *
      * @return TimeEntryCollection<TimeEntryResource>
      *
      * @throws AuthorizationException
@@ -351,6 +356,11 @@ class TimeEntryController extends Controller
      * The parameters `group` and `sub_group` allow you to group the time entries by different criteria.
      * If the group parameters are all set to `null` or are all missing, the endpoint will aggregate all filtered time entries.
      *
+     * Durations are returned in `seconds` (divide by 3600 for hours) and amounts in `cost` as cents in the organization's currency (divide by 100 for money).
+     * Filter by member with `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
+     * Array filters use the query format `client_ids[]=<id>`.
+     * Example: billable hours per client for a period: `group=client&billable=true&start=...&end=...`.
+     *
      * @operationId getAggregatedTimeEntries
      *
      * @return array{
@@ -584,6 +594,12 @@ class TimeEntryController extends Controller
     /**
      * Create time entry
      *
+     * `billable` is not taken from the project. To match the web app, set it to the project's `is_billable` value (or `false` without a project).
+     *
+     * A member can only have one running time entry (an entry with `end` set to `null`). Creating a running entry while another one runs fails with `time_entry_still_running`.
+     * To start a new timer, first stop the running entry by updating its `end` to the current time, then create the new entry.
+     * To log past work, send both `start` and `end` (UTC). Create one entry per block of work.
+     *
      * @throws AuthorizationException
      * @throws TimeEntryStillRunningApiException
      *
@@ -634,6 +650,8 @@ class TimeEntryController extends Controller
     /**
      * Update time entry
      *
+     * To stop a running timer, set `end` to the stop time (UTC). Times the user gives in their own timezone must be converted to UTC first.
+     *
      * @throws AuthorizationException|TimeEntryCanNotBeRestartedApiException
      *
      * @operationId updateTimeEntry
@@ -702,6 +720,10 @@ class TimeEntryController extends Controller
     /**
      * Update multiple time entries
      *
+     * Applies the same `changes` to every entry in `ids`. To find the IDs, list entries with `GET /organizations/{organization}/time-entries`
+     * (filtered by `member_id`, the project and the other criteria), then send their IDs here.
+     * When `changes.project_id` moves entries to another project, also set `changes.task_id` to a task of the new project or to `null`, because tasks belong to a project.
+     *
      * @operationId updateMultipleTimeEntries
      *
      * @throws AuthorizationException

app/Http/Requests/V1/Member/MemberUpdateRequest.php

@@ -27,6 +27,7 @@ class MemberUpdateRequest extends BaseFormRequest
                 'string',
                 Rule::enum(Role::class),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Organization/OrganizationUpdateRequest.php

@@ -36,6 +36,7 @@ class OrganizationUpdateRequest extends BaseFormRequest
                 'string',
                 new CurrencyRule,
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectStoreRequest.php

@@ -55,6 +55,7 @@ class ProjectStoreRequest extends BaseFormRequest
                 'required',
                 'boolean',
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectUpdateRequest.php

@@ -68,6 +68,7 @@ class ProjectUpdateRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge([
                 'nullable',
             ],

app/Http/Requests/V1/ProjectMember/ProjectMemberStoreRequest.php

@@ -31,6 +31,7 @@ class ProjectMemberStoreRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/ProjectMember/ProjectMemberUpdateRequest.php

@@ -21,6 +21,7 @@ class ProjectMemberUpdateRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/TimeEntry/TimeEntryIndexRequest.php

@@ -35,7 +35,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // Filter by member ID
+            // Filter by member ID. Without it, users who may view all time entries (owners, admins) get the entries of every member; pass your own member ID (from GET /v1/users/me/memberships) to get only yours
             'member_id' => [
                 'string',
                 ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
@@ -155,7 +155,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
                 'string',
                 Rule::enum(TimeEntryType::class),
             ],
-            // Limit the number of returned time entries (default: 150)
+            // Limit the number of returned time entries (default: 100)
             'limit' => [
                 'integer',
                 'min:1',

app/Http/Requests/V1/TimeEntry/TimeEntryStoreRequest.php

@@ -32,7 +32,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // ID of the organization member that the time entry should belong to
+            // ID of the organization member that the time entry should belong to (a member ID from GET /v1/users/me/memberships or the members list, not a user ID)
             'member_id' => [
                 'required',
                 'string',
@@ -86,7 +86,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
                 'date_format:Y-m-d\TH:i:s\Z',
                 'after_or_equal:start',
             ],
-            // Whether time entry is billable
+            // Whether time entry is billable. Not derived from the project: set it to the project's is_billable value to match the web app
             'billable' => [
                 'required',
                 'boolean',

config/scramble.php

@@ -28,7 +28,30 @@ return [
         /*
          * Description rendered on the home page of the API documentation (`/docs/api`).
          */
-        'description' => '',
+        'description' => <<<'MD'
+## Getting started
+
+All organization endpoints live under `/v1/organizations/{organization}`, where `{organization}` is the organization's ID. Authenticate with `Authorization: Bearer <token>` and send `Accept: application/json`.
+
+**1. Find yourself.** Call `GET /v1/users/me/memberships`. Each membership contains the **organization ID** (use it as `{organization}` in paths) and your **member ID** in that organization (the membership `id`). Most endpoints filter by member ID, not by user ID.
+
+**2. Scope to your own data.** For owners and admins, `GET /time-entries` and `GET /time-entries/aggregate` return the whole organization's time entries unless you pass `member_id`. When acting for "me", always pass your member ID, both when reading and before changing entries.
+
+**3. Resolve names to IDs.** Look up projects, clients, tags, tasks and members by name with their list endpoints (`GET /projects`, `GET /clients`, `GET /tags`, `GET /tasks`, `GET /members`). Never guess IDs.
+
+**4. Use UTC.** All timestamps are sent and returned in UTC as `Y-m-d\TH:i:s\Z` (example: `2026-10-02T07:30:00Z`). Convert the user's local times and day boundaries to UTC before sending them.
+
+**5. Money is in cents.** Billable rates and costs are integers in cents of the organization's currency (`8000` means 80.00).
+
+## Common tasks
+
+- **Start a timer:** stop the running entry first (find it with `GET /v1/users/me/time-entries/active`, then `PUT` its `end`), then `POST /time-entries` with `start` and `end: null`. Only one entry can run per member.
+- **Log past work:** `POST /time-entries` once per block with `member_id`, `start`, `end`, `project_id` and `billable` set to the project's `is_billable` (it is not derived automatically).
+- **Fix or stop an entry:** `PUT /time-entries/{timeEntry}` with the new `start` or `end` in UTC.
+- **Move entries to another project:** list them with `member_id` and filters, then `PATCH /time-entries` with their `ids` and `changes.project_id`, plus `changes.task_id` set to a task of the new project or `null`.
+- **Totals and reports:** `GET /time-entries/aggregate` with `group` (for example `client` or `project`) and `start`/`end`; durations are in `seconds`, amounts in `cost` (cents).
+- **Share a report:** `POST /reports` with `is_public: true` and use the returned `shareable_link`.
+MD,
     ],
 
     /*

extensions/manifest.json

@@ -1,7 +1,7 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "main"
+        "ref": "v0.0.8"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",
@@ -9,7 +9,7 @@
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
-        "ref": "main"
+        "ref": "v0.0.7"
     },
     "Auditing": {
         "repository": "solidtime-io/extension-auditing",

playwright.config.ts

@@ -1,5 +1,4 @@
 import { defineConfig, devices } from '@playwright/test';
-import { existsSync, readFileSync } from 'node:fs';
 
 /**
  * Read environment variables from file.
@@ -7,57 +6,11 @@ import { existsSync, readFileSync } from 'node:fs';
  */
 // require('dotenv').config();
 
-/**
- * Extensions ship their e2e specs in extensions/<Name>/tests/e2e. Only the specs of extensions
- * that are enabled in modules_statuses.json (php artisan module:enable <Name>) are collected,
- * a checked out but disabled extension would fail its specs otherwise.
- */
-function enabledExtensions(): string[] {
-    const statusesFile = './modules_statuses.json';
-    if (!existsSync(statusesFile)) {
-        return [];
-    }
-    const statuses: Record<string, boolean> = JSON.parse(readFileSync(statusesFile, 'utf-8'));
-    return Object.entries(statuses)
-        .filter(([, enabled]) => enabled)
-        .map(([name]) => name);
-}
-
-/*
- * Every test root gets its own testDir (instead of testDir: '.') so playwright does not walk the
- * whole repository, including node_modules, vendor and nested worktrees, to find the specs.
- */
-const testRoots = [
-    { suffix: '', testDir: './e2e' },
-    ...enabledExtensions().map((name) => ({
-        suffix: '-' + name,
-        testDir: `./extensions/${name}/tests/e2e`,
-    })),
-];
-
-const browsers = [
-    {
-        name: 'chromium',
-        use: { ...devices['Desktop Chrome'] },
-    },
-
-    // Firefox only in CI to keep local runs fast
-    ...(process.env.CI
-        ? [
-              {
-                  name: 'firefox',
-                  use: { ...devices['Desktop Firefox'] },
-              },
-          ]
-        : []),
-];
-
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-    /* Resolves the @e2e/* and @e2e-support/* aliases that extension specs import core helpers with */
+    testDir: './e2e',
-    tsconfig: './tsconfig.json',
     /* Run tests in files in parallel */
     fullyParallel: true,
     /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -79,14 +32,23 @@ export default defineConfig({
 
     timeout: 20 * 1000,
 
-    /* Configure projects for major browsers, core specs keep the plain browser project name */
+    /* Configure projects for major browsers */
-    projects: browsers.flatMap((browser) =>
+    projects: [
-        testRoots.map((root) => ({
+        {
-            name: browser.name + root.suffix,
+            name: 'chromium',
-            testDir: root.testDir,
+            use: { ...devices['Desktop Chrome'] },
-            use: browser.use,
+        },
-        }))
+
-    ),
+        // Firefox only in CI to keep local runs fast
+        ...(process.env.CI
+            ? [
+                  {
+                      name: 'firefox',
+                      use: { ...devices['Desktop Firefox'] },
+                  },
+              ]
+            : []),
+    ],
 
     /* Run your local dev server before starting the tests */
     // webServer: {

tsconfig.json

@@ -6,9 +6,7 @@
   "compilerOptions": {
     "paths": {
       "@/*": ["./resources/js/*"],
-      "@solidtime/ui": ["./resources/js/packages/ui/src/index.ts"],
+      "@solidtime/ui": ["./resources/js/packages/ui/src/index.ts"]
-      "@e2e/*": ["./e2e/*"],
-      "@e2e-support/*": ["./playwright/*"]
     }
   },
   "skipLibCheck": true,