Pin PHP 8.3.36 in prod Dockerfile

The comparison used != which evaluates to NULL when the time entry has no
project, so entries that kept their task after the project was removed
were not reported.

.github/workflows/generate-api-docs.yml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 permissions:
   contents: read
 
@@ -57,10 +58,9 @@ jobs:
           name: api-docs.json
           path: build/api-docs.json
 
-      - name: "Download Fastfront CLI"
-        run: curl https://fastfront-cli.s3.fr-par.scw.cloud/fastfront-cli.phar -o fastfront-cli.phar
-
-      - name: "Deploy with Fastfront"
-        run: php fastfront-cli.phar deploy 9beab6cf-f459-446b-85f1-38ec007cf457 ./build
-        env:
-          FASTFRONT_API_KEY: ${{ secrets.FASTFRONT_API_DOCS_API_KEY }}
+      - name: "Deploy with FastFront"
+        uses: fastfront-io/deploy-action@v0.0.1
+        with:
+          folder: './build'
+          environment: ${{ vars.FASTFRONT_API_DOCS_STAGE }}
+          api_key: ${{ secrets.FASTFRONT_API_DOCS_STAGE_KEY }}

.github/workflows/phpunit-extensions.yml

@@ -5,7 +5,7 @@ permissions:
 jobs:
   phpunit-extensions:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
     strategy:
       matrix:
         postgres_version: [ 15, 16, 17 ]
@@ -132,5 +132,8 @@ jobs:
           php artisan key:generate
           php artisan passport:keys
 
-      - name: "Run PHPUnit"
+      - name: "Run PHPUnit (extensions)"
         run: php artisan test extensions/Billing/tests extensions/Services/tests extensions/Invoicing/tests --stop-on-failure
+
+      - name: "Run PHPUnit (core)"
+        run: php artisan test --testsuite=Unit,Feature --stop-on-failure

.github/workflows/playwright-extensions.yml

@@ -0,0 +1,185 @@
+name: Playwright Tests - Extensions
+on: push
+permissions:
+  contents: read
+jobs:
+  test:
+    name: test (${{ matrix.variant }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    # Same extension sets as build-private.yml and build-onpremise.yml, so the extension specs run
+    # with and without Billing.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: private
+            billing: true
+            extensions: Billing Services Invoicing
+          - variant: onpremise
+            billing: false
+            extensions: Invoicing
+
+    services:
+      mailpit:
+        image: 'axllent/mailpit:latest'
+        ports:
+          - 1025:1025
+          - 8025:8025
+      pgsql_test:
+        image: postgres:15
+        env:
+          PGPASSWORD: 'root'
+          POSTGRES_DB: 'laravel'
+          POSTGRES_USER: 'root'
+          POSTGRES_PASSWORD: 'root'
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      gotenberg:
+        image: gotenberg/gotenberg:8
+        ports:
+          - 3000:3000
+        options: >-
+          --health-cmd "curl --silent --fail http://localhost:3000/health"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+
+      - name: "Setup node"
+        uses: actions/setup-node@v7
+        with:
+          node-version: '20.x'
+
+      - name: "Setup PHP"
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
+          coverage: none
+
+      - name: "Read extension manifest"
+        id: extension-manifest
+        run: |
+          {
+            echo "billing_repository=$(jq -r '.Billing.repository' extensions/manifest.json)"
+            echo "billing_ref=$(jq -r '.Billing.ref' extensions/manifest.json)"
+            echo "services_repository=$(jq -r '.Services.repository' extensions/manifest.json)"
+            echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
+            echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
+            echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: "Checkout billing extension"
+        if: matrix.billing
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.billing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.billing_ref }}
+          path: extensions/Billing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_BILLING_EXTENSION }}
+
+      - name: "Install composer dependencies in billing extension"
+        if: matrix.billing
+        working-directory: extensions/Billing
+        env:
+          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "contact@solidtime.io", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in billing extension"
+        if: matrix.billing
+        run: cd extensions/Billing && npm ci
+
+      - name: "Checkout services extension"
+        if: matrix.billing
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.services_repository }}
+          ref: ${{ steps.extension-manifest.outputs.services_ref }}
+          path: extensions/Services
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_SERVICES_EXTENSION }}
+
+      - name: "Install composer dependencies in services extension"
+        if: matrix.billing
+        working-directory: extensions/Services
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in services extension"
+        if: matrix.billing
+        run: cd extensions/Services && npm ci
+
+      - name: "Checkout invoicing extension"
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ steps.extension-manifest.outputs.invoicing_repository }}
+          ref: ${{ steps.extension-manifest.outputs.invoicing_ref }}
+          path: extensions/Invoicing
+          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_INVOICING_EXTENSION }}
+
+      - name: "Install composer dependencies in invoicing extension"
+        working-directory: extensions/Invoicing
+        run: composer install -n --prefer-dist --ignore-platform-reqs
+
+      - name: "Install npm dependencies in invoicing extension"
+        run: cd extensions/Invoicing && npm ci
+
+      - name: "Run composer install"
+        run: composer install -n --prefer-dist
+
+      # Must run before `migrate` so the extensions' migrations are applied, and before the
+      # frontend build so vite collects the extensions' assets. It also writes
+      # modules_statuses.json, which playwright.config.ts reads to collect the extension specs.
+      - name: "Activate extensions"
+        run: |
+          for extension in ${{ matrix.extensions }}; do
+            php artisan module:enable "$extension"
+          done
+
+      - name: "Prepare Laravel Application"
+        run: |
+          cp .env.ci .env
+          php artisan key:generate
+          php artisan passport:keys
+          php artisan migrate --seed
+
+      - name: "Install dependencies"
+        run: npm ci
+
+      - name: "Build Frontend"
+        run: npm run build
+
+      - name: "Install FrankenPHP"
+        run: |
+          ARCH="$(uname -m)"
+          curl -fsSL "https://github.com/dunglas/frankenphp/releases/latest/download/frankenphp-linux-${ARCH}" -o /usr/local/bin/frankenphp
+          chmod +x /usr/local/bin/frankenphp
+
+      - name: "Run Laravel Octane Server"
+        run: php artisan octane:start --server=frankenphp --host=127.0.0.1 --port=8000 --workers=4 --max-requests=500 > /dev/null 2>&1 &
+        env:
+          OCTANE_SERVER: frankenphp
+
+      - name: "Install Playwright Browsers"
+        run: npx playwright install --with-deps
+
+      # Only the extension specs, the core specs run without extensions in playwright.yml
+      - name: "Run Playwright tests"
+        run: npx playwright test extensions/
+        env:
+          PLAYWRIGHT_BASE_URL: 'http://127.0.0.1:8000'
+          MAILPIT_BASE_URL: 'http://localhost:8025'
+
+      # No artifacts are uploaded on purpose. This repository is public, so every artifact is
+      # downloadable by anyone, and Playwright's reports carry the source of the specs that
+      # produced them (traces embed whole source files, error-context.md embeds a window of the
+      # spec). Those specs live in the private extension repositories. Failures are diagnosed from
+      # the job log; to inspect a trace, reproduce the failure locally with the extension checked out.

.oss-scanner/Dockerfile

@@ -0,0 +1,86 @@
+# Build environment for Anthropic's OSS Scanner (https://github.com/anthropics/oss-scanner).
+# The scanner builds this image with the repository root as the build context and then audits it without network
+# access, so everything needed to run the app and its test suite (PHP + Composer deps, Node deps + built frontend,
+# a local PostgreSQL and a local Gotenberg for PDF rendering) is installed here.
+#
+# The base image is the FrankenPHP image the production image (docker/prod/Dockerfile) is built on: in production the
+# app runs as long-lived Laravel Octane workers in FrankenPHP worker mode, not as one PHP process per request.
+#
+# Inside the finished image:
+#   .oss-scanner/start-postgres.sh    start the local PostgreSQL server (required for tests and the app)
+#   .oss-scanner/start-gotenberg.sh   start the local Gotenberg server (required for PDF exports)
+#   php artisan test                  run the PHPUnit suite (needs PostgreSQL and Gotenberg running)
+#   .oss-scanner/start-octane.sh      run the app like production on http://127.0.0.1:8000 (starts everything above)
+
+ARG FRANKENPHP_VERSION=1.11
+ARG PHP_VERSION=8.3
+
+FROM node:20-trixie-slim AS node
+
+FROM gotenberg/gotenberg:8 AS gotenberg
+
+FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-php${PHP_VERSION}
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    COMPOSER_ALLOW_SUPERUSER=1 \
+    COMPOSER_NO_INTERACTION=1 \
+    OCTANE_SERVER=frankenphp \
+    TZ=UTC
+
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+# PostgreSQL 17 (Debian trixie default) is one of the versions solidtime is tested against in CI.
+# chromium, qpdf and exiftool are what Gotenberg needs for HTML to PDF rendering.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git unzip curl ca-certificates postgresql postgresql-client \
+        chromium fonts-liberation qpdf libimage-exiftool-perl \
+    && install-php-extensions pdo_pgsql pgsql intl gd zip bcmath exif pcntl sockets soap apcu \
+    && rm -rf /var/lib/apt/lists/* \
+    && echo "memory_limit=2G" > "$PHP_INI_DIR/conf.d/99-oss-scanner.ini"
+
+# Gotenberg 8 (the PDF renderer, same image as in CI). solidtime only uses its Chromium HTML to PDF route, so LibreOffice
+# and pdftk are not installed: Gotenberg only checks at startup that their binaries exist, start-gotenberg.sh disables
+# the LibreOffice routes and the Chromium route does not use pdftk.
+COPY --from=gotenberg /usr/bin/gotenberg /usr/local/bin/gotenberg
+COPY --from=gotenberg /usr/bin/pdfcpu /usr/local/bin/pdfcpu
+COPY --from=gotenberg /opt/gotenberg /opt/gotenberg
+ENV CHROMIUM_BIN_PATH=/usr/bin/chromium \
+    CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data \
+    GOTENBERG_VERSIONS_DIR_PATH=/opt/gotenberg/versions \
+    QPDF_BIN_PATH=/usr/bin/qpdf \
+    EXIFTOOL_BIN_PATH=/usr/bin/exiftool \
+    PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu \
+    LIBREOFFICE_BIN_PATH=/bin/false \
+    UNOCONVERTER_BIN_PATH=/bin/false \
+    PDFTK_BIN_PATH=/bin/false
+
+# Database matching .env.ci: user root / password root, database laravel.
+RUN pg_ctlcluster 17 main start \
+    && runuser -u postgres -- psql -c "CREATE ROLE root WITH LOGIN SUPERUSER PASSWORD 'root';" \
+    && runuser -u postgres -- createdb -O root laravel \
+    && pg_ctlcluster 17 main stop
+
+# scanner contract: the checkout lives inside the image, at /src
+COPY . /src
+WORKDIR /src
+
+RUN composer install --prefer-dist \
+    && npm ci \
+    && npm run build
+
+RUN cp .env.ci .env \
+    && php artisan key:generate \
+    && php artisan passport:keys --force \
+    && php artisan octane:install --server=frankenphp --no-interaction \
+    && chmod +x .oss-scanner/*.sh
+
+# Run the test suite so the image is known to work, but do not fail the build on test failures.
+RUN .oss-scanner/start-postgres.sh \
+    && .oss-scanner/start-gotenberg.sh \
+    && (php artisan test || echo "WARNING: PHPUnit reported failures") \
+    && kill "$(cat /tmp/gotenberg.pid)" \
+    && pg_ctlcluster 17 main stop

.oss-scanner/Dockerfile.dockerignore

@@ -0,0 +1,18 @@
+# Used instead of the root .dockerignore when building .oss-scanner/Dockerfile. The root one is tailored to the
+# production image and excludes tests, phpunit.xml etc., which the scanner needs.
+node_modules
+extensions/*/node_modules
+vendor
+.env
+public/build
+public/hot
+storage/*.key
+storage/logs/*
+coverage
+test-results
+playwright-report
+.phpunit.cache
+.phpunit.result.cache
+auth.json
+.DS_Store
+.idea

.oss-scanner/start-gotenberg.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Start the local Gotenberg server (PDF rendering) on 127.0.0.1:3000, matching GOTENBERG_URL in .env.ci.
+# Only the Chromium routes are needed by solidtime, see .oss-scanner/Dockerfile. Stop: kill "$(cat /tmp/gotenberg.pid)"
+set -euo pipefail
+
+if ! curl -fs http://127.0.0.1:3000/health >/dev/null; then
+    nohup gotenberg \
+        --api-port=3000 \
+        --libreoffice-disable-routes \
+        --libreoffice-auto-start=false \
+        --log-level=warn \
+        >/tmp/gotenberg.log 2>&1 &
+    echo $! >/tmp/gotenberg.pid
+    until curl -fs http://127.0.0.1:3000/health >/dev/null; do sleep 0.5; done
+fi
+echo "Gotenberg is running on http://127.0.0.1:3000 (log: /tmp/gotenberg.log)"

.oss-scanner/start-octane.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Run the app the way production does: Laravel Octane on FrankenPHP in worker mode, with the production Caddyfile.
+# A worker boots the app once and then serves many requests, so state kept in memory (static properties, singletons,
+# changed config, ...) survives from one request to the next. With a single worker, consecutive requests always hit the
+# same worker, so such leaks between requests (e.g. between users of different organizations) reproduce reliably.
+#
+# Usage: .oss-scanner/start-octane.sh    (OCTANE_WORKERS and OCTANE_MAX_REQUESTS can be overridden)
+# Stop:  php artisan octane:stop
+# After changing PHP code, run `php artisan octane:reload`: workers keep the code they booted with.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+.oss-scanner/start-postgres.sh
+.oss-scanner/start-gotenberg.sh
+
+php artisan migrate --force
+if [ "$(PGPASSWORD=root psql -h 127.0.0.1 -U root -d laravel -tAc 'SELECT count(*) FROM users')" = "0" ]; then
+    php artisan db:seed --force
+fi
+php artisan optimize:clear >/dev/null
+
+nohup php artisan octane:frankenphp \
+    --host=127.0.0.1 \
+    --port=8000 \
+    --workers="${OCTANE_WORKERS:-1}" \
+    --max-requests="${OCTANE_MAX_REQUESTS:-10000}" \
+    --caddyfile=docker/prod/deployment/octane/FrankenPHP/Caddyfile \
+    >/tmp/octane.log 2>&1 &
+
+until curl -fs -o /dev/null http://127.0.0.1:8000/login; do
+    if ! kill -0 $! 2>/dev/null; then
+        cat /tmp/octane.log
+        exit 1
+    fi
+    sleep 0.5
+done
+echo "solidtime is running on http://127.0.0.1:8000 with Octane/FrankenPHP (log: /tmp/octane.log)"

.oss-scanner/start-postgres.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Start the local PostgreSQL server used by the test suite and the app (see .oss-scanner/Dockerfile).
+set -euo pipefail
+
+pg_ctlcluster 17 main start 2>/dev/null || true
+until pg_isready -h 127.0.0.1 -p 5432 -q; do sleep 0.5; done
+echo "PostgreSQL is running on 127.0.0.1:5432 (user root, password root, database laravel)"

.oss-scanner/threat_model.md

@@ -0,0 +1,122 @@
+# Threat model
+
+## What this project does
+
+solidtime is an open-source, multi-tenant time tracking web application (Laravel backend, Vue 3 + Inertia frontend,
+PostgreSQL). It runs as a hosted SaaS (solidtime.io) and is self-hosted by many organisations. Users belong to one or
+more **organizations**; inside an organization each member has a role: `owner`, `admin`, `manager`, `employee` or
+`placeholder` (an imported, non-login member). What each role may do is defined in `app/Service/PermissionStore.php`.
+
+The most important security property is **isolation**: a user must never read or modify data of an organization they
+are not a member of, and within an organization a member must not exceed the permissions of their role (e.g. an
+employee must not see other members' time entries, billable rates, or manage members, unless the organization settings
+explicitly allow it).
+
+## Trust boundaries
+
+- **Super admins are fully trusted.** They are the instance operators, configured via the `SUPER_ADMINS` env
+  variable, and have access to the Filament admin panel (`app/Filament`), which can view and change data of every
+  organization and impersonate users. Anything a super admin can do through the panel (including XSS, SQL injection,
+  SSRF or file access that is only reachable from the panel) is not a vulnerability.
+- What **is** in scope: a user who is not a super admin reaching the admin panel, or any of its actions, at all.
+- Operators of a self-hosted instance (shell, database, environment, filesystem access) are trusted.
+- Everyone else, including organization owners and admins when acting outside their own organization, is untrusted.
+
+## Runtime: long-lived Octane workers
+
+In production (the hosted SaaS and the official Docker image, `docker/prod/`) the app does **not** run as one PHP
+process per request. It runs on Laravel Octane with FrankenPHP in worker mode: each worker boots the application once
+and then serves many requests from different users and organizations. Anything kept in memory survives from one request
+to the next unless Octane resets it (`config/octane.php` lists what is reset). This includes static properties and
+static caches, container bindings registered with `singleton()` instead of `scoped()` (see
+`app/Providers/AppServiceProvider.php`), objects captured by those singletons, runtime `config()` / locale / timezone
+changes, macros and event listeners registered during a request, and state in third-party packages.
+
+Request A leaving state behind that request B (another user, possibly of another organization) then sees or is
+affected by is in scope, rated by its impact like any other issue (see severity below). The PHPUnit suite cannot
+show this class of bug, because it boots a fresh application for every test. It has to be reproduced over HTTP against
+the Octane server, see "How to exercise it".
+
+## Where untrusted input enters
+
+All authenticated users, including employees of any organization and anyone who self-registers (registration is open
+by default), are untrusted.
+
+- **JSON API** `routes/api.php` (`/api/v1/...`), authenticated via Passport (session cookie or personal access token).
+  Most routes are scoped by `{organization}` and authorised in the controllers / form requests.
+- **Public, unauthenticated** endpoints: `GET /api/v1/public/reports` (shared reports, accessed by a secret), login,
+  registration, password reset, email verification, organization invitation acceptance (`routes/web.php`).
+- **Web / Inertia routes** `routes/web.php` and Fortify/Jetstream actions in `app/Actions`.
+- **Imports** (`app/Service/Import/Importers`): user-uploaded CSV and ZIP files from Toggl, Clockify, Harvest,
+  generic CSV and solidtime's own export format. ZIP handling is in `ZipImportHelper.php`.
+- **Exports / reports** (`app/Service/Export`, `app/Service/ReportExport`): CSV/XLSX/ODS and PDF. PDFs are rendered by
+  sending HTML to a Gotenberg (headless Chromium) service, so user-controlled content in that HTML matters.
+- **OAuth** (Passport) authorization and token endpoints.
+- **Filament admin panel** (`app/Filament`): only its access control is in scope (see Trust boundaries).
+
+## Components that matter most / least
+
+Most important: organization scoping and role checks in the API controllers, form requests (`app/Http/Requests`),
+`PermissionStore`, public report sharing, invitations and member management (role changes, ownership transfer, member
+merge), authentication flows (Fortify, 2FA, email change, API tokens), import parsing.
+
+Less important / out of scope:
+- `extensions/` is empty in this repository (proprietary modules are not part of the open-source code).
+- `docker/`, `k8s/`, `e2e/`, `playwright/`, `docs/` and developer tooling.
+- Third-party dependencies in `vendor/` and `node_modules/`, unless solidtime uses them in an unsafe way.
+
+## How to exercise it
+
+- `.oss-scanner/start-postgres.sh` starts the local PostgreSQL server (user `root`, password `root`, db `laravel`).
+- `.oss-scanner/start-gotenberg.sh` starts the local Gotenberg server (PDF rendering via headless Chromium) on
+  http://127.0.0.1:3000, so the PDF export code path, including what Chromium does with the rendered HTML, can be
+  exercised.
+- `php artisan test` runs the PHPUnit suite (start PostgreSQL and Gotenberg first); all tests are expected to pass. Endpoint tests in `tests/Unit/Endpoint/Api/V1/` show how to create users,
+  organizations and members with factories and call the API with a given role; they are the quickest way to write a
+  reproducer. Example: `php artisan test --filter=TimeEntryEndpointTest`.
+- To run the app like production: `.oss-scanner/start-octane.sh` (http://127.0.0.1:8000). It starts PostgreSQL and
+  Gotenberg, migrates (and seeds an empty database, see `database/seeders/DatabaseSeeder.php` for the users) and runs
+  Octane/FrankenPHP with the production Caddyfile and a **single worker**, so consecutive requests always hit the same
+  worker and leaks between requests reproduce reliably. Workers keep the code they booted with: after changing PHP
+  code run `php artisan octane:reload`. Stop it with `php artisan octane:stop`. Note that the test suite and the app
+  share the same database, so `php artisan test` wipes the app's data.
+- A reproducer for a leak between requests is a script that sends request A (e.g. as a member of organization X) and
+  then request B (as a user of organization Y) to the running Octane server and shows that B observes A's state. API
+  requests can be authenticated with a personal access token, e.g. created with
+  `php artisan tinker --execute="echo App\Models\User::where('email', '...')->first()->createToken('t')->accessToken;"`.
+- There is no network: mail delivery is not available (mail uses the `array` driver in tests), and remote resources
+  referenced by PDF templates (e.g. fonts from fonts.bunny.net) fail to load, so PDFs fall back to local fonts.
+
+## How we rate severity
+
+- **Critical**: unauthenticated access to other users' data or accounts; authentication bypass; remote code execution;
+  SQL injection reachable by any registered user; reading or writing data of an organization the attacker is not a
+  member of, including through state leaking between requests in an Octane worker.
+- **High**: privilege escalation within an organization (e.g. employee to admin/owner, or performing admin-only
+  actions); access to data the role must not see (other members' time entries, billable rates, member emails) when
+  the organization settings do not allow it; stored XSS that executes in another user's session; SSRF via PDF
+  rendering or imports; account takeover requiring user interaction.
+- **Medium**: information disclosure with limited impact, CSRF on state-changing endpoints, issues requiring an
+  unusual but realistic configuration, denial of service by a single authenticated request (e.g. pathological
+  import file).
+- **Low**: everything else with real security impact.
+
+## Anything to leave alone
+
+Please do not report (see also `SECURITY.md`):
+- Theoretical findings without a working reproducer.
+- Missing or weak security headers in isolation; TLS / mail DNS configuration.
+- Self-XSS; CSRF on non-state-changing endpoints (logout, theme).
+- CSV / spreadsheet formula injection in exports.
+- Owners or admins acting destructively within their own organization.
+- Anything requiring direct DB, shell or filesystem access on a self-hosted instance.
+- Anything that requires being a super admin, including issues inside the Filament admin panel.
+- Missing OAuth scope enforcement (not implemented yet).
+- Rate-limit tuning and generic DoS through volume of requests.
+
+## Reports and patches
+
+Please include the affected endpoint or code path, the attacker's role and the victim, a PHPUnit test (in the style of
+`tests/Unit/Endpoint/Api/V1/`) that reproduces the issue (for leaks between requests: a script against
+`.oss-scanner/start-octane.sh` instead), and a minimal patch that follows the existing patterns
+(authorisation in form requests/controllers via `PermissionStore`).

CONTRIBUTING.md

@@ -6,7 +6,19 @@ Contributions are greatly apprecited, please make sure to read the rules and vis
 
 ### Issues for Bugs, Discussions for Feature requests
 
-In order to keep the issues of the repository clean we decided to only use them for bugs. Feature Requests and enhancement are handled in discussions. This also helps us to see which feature requests are popular as they can be upvoted. 
+In order to keep the issues of the repository clean we decided to only use them for bugs. Feature Requests and enhancements are handled in discussions. This also helps us to see which feature requests are popular as they can be upvoted. 
+
+### Do not use AI-generated text in issues, discussions and PR descriptions
+
+We are human, so please write in natural language in your issues, discussions, and PR descriptions. 
+Don't be a meatproxy. We will ban people who repeatedly violate this rule from further communication on our repositories. 
+
+### Before you contribute, ask yourself what value you add
+
+We much prefer reading your thoughts on features or issues you encountered than reading through hundreds of lines of code changes produced by your agent. 
+Consider that the maintainers of this project have the same access to LLMs and more knowledge about the project itself. 
+Prompting a feature into existence without further consideration or discussion is mostly a burden for maintainers. 
+If we want to, we can burn the tokens ourselves. 
 
 ### Only work on approved issues
 

README.md

@@ -30,8 +30,16 @@ If you do not want to self-host solidtime or try it out you can sign up for [sol
 
 ## Issues & Feature Requests
 
-If you find any **bugs in solidtime**, please feel free to [**open an issue**](https://github.com/solidtime-io/solidtime/issues/new) in this repository, with instructions on how to reproduce the bug. 
-If you have a **feature request**, please [**create a discussion**](https://github.com/solidtime-io/solidtime/discussions/new?category=feature-requests) in this repository.
+If you 
+* find any **bugs in solidtime**, please feel free to [**open an issue**](https://github.com/solidtime-io/solidtime/issues/new) in this repository, with instructions on how to reproduce the bug. 
+* have a **feature request**, please [**create a discussion**](https://github.com/solidtime-io/solidtime/discussions/new?category=feature-requests) in this repository.
+
+
+> **Do not use AI-generated text in issues, discussions and PR descriptions.**
+>
+> We are human, so please write in natural language in your issues, discussions, and PR descriptions.
+> Don't be a meatproxy. We will ban people who repeatedly violate this rule from further communication on our repositories.
+
 
 ## Contributing
 

app/Console/Commands/Correction/CorrectionDeleteTimeEntriesWithEndBeforeStartCommand.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands\Correction;
+
+use App\Jobs\RecalculateSpentTimeForProject;
+use App\Jobs\RecalculateSpentTimeForTask;
+use App\Models\TimeEntry;
+use Illuminate\Console\Command;
+
+class CorrectionDeleteTimeEntriesWithEndBeforeStartCommand extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'correction:delete-time-entries-with-end-before-start '.
+        ' { --dry-run : Do not actually save anything to the database, just output what would happen }';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Deletes all time entries where the end is before the start';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(): int
+    {
+        $this->comment('Deletes all time entries where the end is before the start...');
+        $dryRun = (bool) $this->option('dry-run');
+        if ($dryRun) {
+            $this->comment('Running in dry-run mode. Nothing will be saved to the database.');
+        }
+
+        $timeEntries = TimeEntry::query()
+            ->whereNotNull('end')
+            ->whereColumn('end', '<', 'start')
+            ->with(['project', 'task'])
+            ->get();
+        foreach ($timeEntries as $timeEntry) {
+            /** @var TimeEntry $timeEntry */
+            if (! $dryRun) {
+                // Delete via Eloquent, so that the deletion is audited
+                $timeEntry->delete();
+                if ($timeEntry->project !== null) {
+                    RecalculateSpentTimeForProject::dispatch($timeEntry->project);
+                }
+                if ($timeEntry->task !== null) {
+                    RecalculateSpentTimeForTask::dispatch($timeEntry->task);
+                }
+            }
+            $this->line('Deleted time entry (id='.$timeEntry->getKey().', start='.$timeEntry->start->toIso8601ZuluString().', end='.$timeEntry->end?->toIso8601ZuluString().')');
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SelfHost/SelfHostDatabaseConsistency.php

@@ -39,7 +39,7 @@ class SelfHostDatabaseConsistency extends Command
         $problems = DB::table('time_entries')
             ->select(['time_entries.id as id'])
             ->join('tasks', 'time_entries.task_id', '=', 'tasks.id')
-            ->where('tasks.project_id', '!=', DB::raw('time_entries.project_id'))
+            ->whereRaw('tasks.project_id is distinct from time_entries.project_id')
             ->get();
         $this->logProblems($problems, 'Time entries have a task that does not belong to the project of the time entry', $hadAProblem);
 
@@ -59,6 +59,14 @@ class SelfHostDatabaseConsistency extends Command
             ->get();
         $this->logProblems($problems, 'Time entries have a client but no project', $hadAProblem);
 
+        // End of time entries can not be before the start
+        $problems = DB::table('time_entries')
+            ->select(['id'])
+            ->whereNotNull('end')
+            ->whereColumn('end', '<', 'start')
+            ->get();
+        $this->logProblems($problems, 'Time entries have an end that is before the start', $hadAProblem);
+
         // Every user needs to be a member of at least one organization
         $problems = DB::table('users')
             ->select(['users.id as id'])

app/Enums/GoalComparison.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Datomatic\LaravelEnumHelper\LaravelEnumHelper;
+
+enum GoalComparison: string
+{
+    use LaravelEnumHelper;
+
+    /**
+     * The goal is reached when at least the target amount of time was tracked in the period.
+     */
+    case AtLeast = 'at_least';
+
+    /**
+     * The goal is reached when less than the target amount of time was tracked in the period.
+     */
+    case LessThan = 'less_than';
+}

app/Enums/GoalPeriod.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Datomatic\LaravelEnumHelper\LaravelEnumHelper;
+
+enum GoalPeriod: string
+{
+    use LaravelEnumHelper;
+
+    case Day = 'day';
+    case Week = 'week';
+    case Month = 'month';
+}

app/Enums/GoalStatus.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Datomatic\LaravelEnumHelper\LaravelEnumHelper;
+
+enum GoalStatus: string
+{
+    use LaravelEnumHelper;
+
+    /**
+     * "At least" goal, the target has not been reached yet in the current period.
+     */
+    case InProgress = 'in_progress';
+
+    /**
+     * "At least" goal, the target has been reached in the current period.
+     */
+    case Achieved = 'achieved';
+
+    /**
+     * "Less than" goal, the tracked time is still below the limit.
+     */
+    case OnTrack = 'on_track';
+
+    /**
+     * "Less than" goal, the tracked time reached or exceeded the limit.
+     */
+    case Exceeded = 'exceeded';
+}

app/Enums/GoalType.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Datomatic\LaravelEnumHelper\LaravelEnumHelper;
+
+enum GoalType: string
+{
+    use LaravelEnumHelper;
+
+    /**
+     * A goal a member set for themselves. Only that member can see and manage it, no permission reaches it.
+     */
+    case Personal = 'personal';
+
+    /**
+     * A goal the organization set for a member or for the whole organization.
+     * Managed by the members that may manage goals, visible to them and to the member the goal is for.
+     * Requires the team goals extension.
+     */
+    case Organization = 'organization';
+}

app/Exceptions/Api/TimeEntryMemberCanNotBeChangedWhileRunningApiException.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\Api;
+
+class TimeEntryMemberCanNotBeChangedWhileRunningApiException extends ApiException
+{
+    public const string KEY = 'time_entry_member_can_not_be_changed_while_running';
+
+    public function report(): bool
+    {
+        return true;
+    }
+}

app/Extensions/Scramble/PaginatedResourceCollectionTypeToSchema.php

@@ -1,107 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Extensions\Scramble;
-
-use App\Http\Resources\PaginatedResourceCollection;
-use App\Http\Resources\V1\TimeEntry\TimeEntryCollection;
-use Dedoc\Scramble\Extensions\TypeToSchemaExtension;
-use Dedoc\Scramble\Support\Generator\Response;
-use Dedoc\Scramble\Support\Generator\Schema;
-use Dedoc\Scramble\Support\Generator\Types\ArrayType;
-use Dedoc\Scramble\Support\Generator\Types\BooleanType;
-use Dedoc\Scramble\Support\Generator\Types\IntegerType;
-use Dedoc\Scramble\Support\Generator\Types\ObjectType as OpenApiObjectType;
-use Dedoc\Scramble\Support\Generator\Types\StringType;
-use Dedoc\Scramble\Support\Type\Generic;
-use Dedoc\Scramble\Support\Type\ObjectType;
-use Dedoc\Scramble\Support\Type\Type;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Http\Resources\Json\JsonResource;
-
-class PaginatedResourceCollectionTypeToSchema extends TypeToSchemaExtension
-{
-    public function shouldHandle(Type $type): bool
-    {
-        return $type instanceof ObjectType
-            && $type->isInstanceOf(PaginatedResourceCollection::class);
-    }
-
-    public function toSchema(Type $type): ?OpenApiObjectType
-    {
-        /** @var Type|null $collectingClassType */
-        $collectingClassType = $type->templateTypes[0] ?? null;
-
-        if (! $collectingClassType instanceof ObjectType) {
-            return null;
-        }
-
-        if (! $collectingClassType->isInstanceOf(JsonResource::class) && ! $collectingClassType->isInstanceOf(Model::class)) {
-            return null;
-        }
-
-        $collectingType = $this->openApiTransformer->transform($collectingClassType);
-
-        $newType = new OpenApiObjectType;
-        $newType->addProperty('data', (new ArrayType)->setItems($collectingType));
-        if ($type instanceof ObjectType && $type->isInstanceOf(TimeEntryCollection::class)) {
-            $newType->addProperty(
-                'meta',
-                (new OpenApiObjectType)
-                    ->addProperty('total', (new IntegerType)->setDescription('Total number of items being paginated.'))
-                    ->setRequired(['total'])
-            );
-            $newType->setRequired(['data', 'meta']);
-        } else {
-            $newType->addProperty(
-                'links',
-                (new OpenApiObjectType)
-                    ->addProperty('first', (new StringType)->nullable(true))
-                    ->addProperty('last', (new StringType)->nullable(true))
-                    ->addProperty('prev', (new StringType)->nullable(true))
-                    ->addProperty('next', (new StringType)->nullable(true))
-                    ->setRequired(['first', 'last', 'prev', 'next'])
-            );
-            $newType->addProperty(
-                'meta',
-                (new OpenApiObjectType)
-                    ->addProperty('current_page', new IntegerType)
-                    ->addProperty('from', (new IntegerType)->nullable(true))
-                    ->addProperty('last_page', new IntegerType)
-                    ->addProperty('links', (new ArrayType)->setItems(
-                        (new OpenApiObjectType)
-                            ->addProperty('url', (new StringType)->nullable(true))
-                            ->addProperty('label', new StringType)
-                            ->addProperty('active', new BooleanType)
-                            ->setRequired(['url', 'label', 'active'])
-                    )->setDescription('Generated paginator links.'))
-                    ->addProperty('path', (new StringType)->nullable(true)->setDescription('Base path for paginator generated URLs.'))
-                    ->addProperty('per_page', (new IntegerType)->setDescription('Number of items shown per page.'))
-                    ->addProperty('to', (new IntegerType)->nullable(true)->setDescription('Number of the last item in the slice.'))
-                    ->addProperty('total', (new IntegerType)->setDescription('Total number of items being paginated.'))
-                    ->setRequired(['current_page', 'from', 'last_page', 'links', 'path', 'per_page', 'to', 'total'])
-            );
-            $newType->setRequired(['data', 'links', 'meta']);
-        }
-
-        return $newType;
-    }
-
-    /**
-     * @param  Generic  $type
-     */
-    public function toResponse(Type $type): ?Response
-    {
-        /** @var ObjectType|null $collectingClassType */
-        $collectingClassType = $type->templateTypes[0] ?? null;
-        if (! $collectingClassType instanceof ObjectType) {
-            return null;
-        }
-        $type = $this->toSchema($type);
-
-        return Response::make(200)
-            ->description('Paginated set of `'.$this->components->uniqueSchemaName($collectingClassType->name).'`')
-            ->setContent('application/json', Schema::fromType($type));
-    }
-}

app/Filament/Resources/GoalResource.php

@@ -0,0 +1,174 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Enums\GoalComparison;
+use App\Enums\GoalPeriod;
+use App\Enums\GoalType;
+use App\Enums\Weekday;
+use App\Filament\Resources\GoalResource\Pages;
+use App\Models\Goal;
+use App\Service\Dto\GoalFiltersDto;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ViewAction;
+use Filament\Forms;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Novadaemon\FilamentPrettyJson\Form\PrettyJsonField;
+
+class GoalResource extends Resource
+{
+    protected static ?string $model = Goal::class;
+
+    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-viewfinder-circle';
+
+    protected static string|\UnitEnum|null $navigationGroup = 'Timetracking';
+
+    protected static ?int $navigationSort = 8;
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema
+            ->columns(1)
+            ->components([
+                Forms\Components\TextInput::make('name')
+                    ->label('Name')
+                    ->required()
+                    ->maxLength(255),
+                Forms\Components\Select::make('type')
+                    ->label('Type')
+                    ->options(collect(GoalType::cases())->mapWithKeys(fn (GoalType $type): array => [$type->value => $type->name])->all())
+                    ->disabled()
+                    ->required(),
+                Forms\Components\Select::make('comparison')
+                    ->label('Comparison')
+                    ->options(collect(GoalComparison::cases())->mapWithKeys(fn (GoalComparison $comparison): array => [$comparison->value => $comparison->name])->all())
+                    ->required(),
+                Forms\Components\TextInput::make('target_seconds')
+                    ->label('Target (seconds)')
+                    ->numeric()
+                    ->minValue(1)
+                    ->required(),
+                Forms\Components\Select::make('period')
+                    ->label('Period')
+                    ->options(collect(GoalPeriod::cases())->mapWithKeys(fn (GoalPeriod $period): array => [$period->value => $period->name])->all())
+                    ->required(),
+                Forms\Components\Select::make('timezone')
+                    ->label('Timezone')
+                    ->options(fn (): array => collect(\DateTimeZone::listIdentifiers())->mapWithKeys(fn (string $timezone): array => [$timezone => $timezone])->all())
+                    ->searchable()
+                    ->required(),
+                Forms\Components\Select::make('week_start')
+                    ->label('Week start')
+                    ->options(collect(Weekday::cases())->mapWithKeys(fn (Weekday $weekday): array => [$weekday->value => $weekday->name])->all())
+                    ->required(),
+                DateTimePicker::make('archived_at')
+                    ->label('Archived At'),
+                Forms\Components\Select::make('organization_id')
+                    ->label('Organization')
+                    ->relationship(name: 'organization', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->disabled()
+                    ->required(),
+                Forms\Components\Select::make('member_id')
+                    ->label('Member (empty = every member)')
+                    ->relationship(name: 'member', titleAttribute: 'id')
+                    ->disabled(),
+                PrettyJsonField::make('filters')
+                    ->formatStateUsing(function (GoalFiltersDto $state, Goal $record): string {
+                        return $record->getRawOriginal('filters');
+                    })
+                    ->disabled(),
+                DateTimePicker::make('created_at')
+                    ->label('Created At')
+                    ->hiddenOn(['create'])
+                    ->disabled(),
+                DateTimePicker::make('updated_at')
+                    ->label('Updated At')
+                    ->hiddenOn(['create'])
+                    ->disabled(),
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('name')
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('comparison')
+                    ->sortable(),
+                TextColumn::make('target_seconds')
+                    ->label('Target')
+                    ->formatStateUsing(fn (int $state): string => sprintf('%dh %02dm', intdiv($state, 3600), intdiv($state % 3600, 60)))
+                    ->sortable(),
+                TextColumn::make('period')
+                    ->sortable(),
+                TextColumn::make('type')
+                    ->sortable(),
+                TextColumn::make('member.user.email')
+                    ->label('Member')
+                    ->placeholder('Every member')
+                    ->searchable(),
+                TextColumn::make('archived_at')
+                    ->dateTime()
+                    ->placeholder('Not archived')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('organization.name')
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('created_at')
+                    ->dateTime()
+                    ->sortable(),
+                TextColumn::make('updated_at')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                SelectFilter::make('type')
+                    ->label('Type')
+                    ->options(collect(GoalType::cases())->mapWithKeys(fn (GoalType $type): array => [$type->value => $type->name])->all()),
+                SelectFilter::make('organization')
+                    ->label('Organization')
+                    ->relationship('organization', 'name')
+                    ->searchable(),
+                SelectFilter::make('organization_id')
+                    ->label('Organization ID')
+                    ->relationship('organization', 'id')
+                    ->searchable(),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => Pages\ListGoals::route('/'),
+            'edit' => Pages\EditGoal::route('/{record}/edit'),
+            'view' => Pages\ViewGoal::route('/{record}'),
+        ];
+    }
+}

app/Filament/Resources/GoalResource/Pages/EditGoal.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\GoalResource\Pages;
+
+use App\Filament\Resources\GoalResource;
+use Filament\Actions;
+use Filament\Resources\Pages\EditRecord;
+
+class EditGoal extends EditRecord
+{
+    protected static string $resource = GoalResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\DeleteAction::make()
+                ->icon('heroicon-m-trash'),
+        ];
+    }
+}

app/Filament/Resources/GoalResource/Pages/ListGoals.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\GoalResource\Pages;
+
+use App\Filament\Resources\GoalResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListGoals extends ListRecords
+{
+    protected static string $resource = GoalResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Filament/Resources/GoalResource/Pages/ViewGoal.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\GoalResource\Pages;
+
+use App\Filament\Resources\GoalResource;
+use Filament\Actions\EditAction;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewGoal extends ViewRecord
+{
+    protected static string $resource = GoalResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            EditAction::make('edit')
+                ->icon('heroicon-s-pencil'),
+        ];
+    }
+}

app/Filament/Resources/OrganizationResource.php

@@ -183,7 +183,7 @@ class OrganizationResource extends Resource
                     ->action(function (Organization $record, array $data): void {
                         try {
                             try {
-                                $file = Storage::disk(config('filament.default_filesystem_disk'))->get($data['file']);
+                                $file = Storage::disk(config('filesystems.private'))->get($data['file']);
                             } catch (UnableToReadFile) {
                                 $file = null;
                             }
@@ -220,12 +220,17 @@ class OrganizationResource extends Resource
                                 ->body('Message: '.$exception->getMessage())
                                 ->persistent()
                                 ->send();
+                        } finally {
+                            Storage::disk(config('filesystems.private'))->delete($data['file']);
                         }
                     })
                     ->tooltip(fn (Organization $record): string => 'Import into '.$record->name)
                     ->schema([
                         FileUpload::make('file')
                             ->label('File')
+                            ->disk(config('filesystems.private'))
+                            ->directory('admin-import-uploads')
+                            ->visibility('private')
                             ->required(),
                         Select::make('type')
                             ->required()

app/Http/Controllers/Api/FallbackController.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use Dedoc\Scramble\Attributes\ExcludeAllRoutesFromDocs;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Fallback for unknown /api/* routes, to prevent a rendered HTML page
+ */
+#[ExcludeAllRoutesFromDocs]
+class FallbackController extends Controller
+{
+    public function __invoke(): never
+    {
+        throw new NotFoundHttpException('API resource not found');
+    }
+}

app/Http/Controllers/Api/V1/ChartController.php

@@ -4,8 +4,8 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
-use App\Enums\Role;
 use App\Models\Organization;
+use App\Service\BillableRateService;
 use App\Service\DashboardService;
 use App\Service\PermissionStore;
 use Illuminate\Auth\Access\AuthorizationException;
@@ -154,12 +154,12 @@ class ChartController extends Controller
      *
      * @response array{value: int, currency: string}
      */
-    public function totalWeeklyBillableAmount(Organization $organization, DashboardService $dashboardService): JsonResponse
+    public function totalWeeklyBillableAmount(Organization $organization, DashboardService $dashboardService, BillableRateService $billableRateService): JsonResponse
     {
         $this->checkPermission($organization, 'charts:view:own');
         $user = $this->user();
 
-        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        $showBillableRate = $billableRateService->canSeeBillableRates($organization, $this->member($organization));
         if (! $showBillableRate) {
             throw new AuthorizationException('You do not have permission to view billable rates.');
         }

app/Http/Controllers/Api/V1/ClientController.php

@@ -29,8 +29,6 @@ class ClientController extends Controller
     /**
      * Get clients
      *
-     * @return ClientCollection<ClientResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getClients

app/Http/Controllers/Api/V1/Controller.php

@@ -49,4 +49,9 @@ class Controller extends \App\Http\Controllers\Controller
     {
         return app(BillingContract::class)->hasSubscription($organization) || app(BillingContract::class)->hasTrial($organization);
     }
+
+    protected function canUseBillableRates(Organization $organization): bool
+    {
+        return app(BillingContract::class)->canUseBillableRates($organization);
+    }
 }

app/Http/Controllers/Api/V1/GoalController.php

@@ -0,0 +1,241 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Enums\GoalType;
+use App\Exceptions\Api\FeatureIsNotAvailableInFreePlanApiException;
+use App\Http\Requests\V1\Goal\GoalIndexRequest;
+use App\Http\Requests\V1\Goal\GoalStoreRequest;
+use App\Http\Requests\V1\Goal\GoalUpdateRequest;
+use App\Http\Resources\V1\Goal\GoalCollection;
+use App\Http\Resources\V1\Goal\GoalResource;
+use App\Models\Goal;
+use App\Models\Organization;
+use App\Service\BillingContract;
+use App\Service\GoalProgressService;
+use App\Service\GoalsContract;
+use App\Service\TimezoneService;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Carbon;
+
+class GoalController extends Controller
+{
+    /**
+     * @throws AuthorizationException
+     */
+    protected function checkPermission(Organization $organization, string $permission, ?Goal $goal = null): void
+    {
+        parent::checkPermission($organization, $permission);
+        if ($goal !== null) {
+            $this->checkGoalBelongsToOrganization($organization, $goal);
+        }
+    }
+
+    /**
+     * @throws AuthorizationException
+     */
+    private function checkGoalBelongsToOrganization(Organization $organization, Goal $goal): void
+    {
+        if ($goal->organization_id !== $organization->id) {
+            throw new AuthorizationException('Goal does not belong to organization');
+        }
+    }
+
+    /**
+     * Enforces the goal limit provided by the BillingContract, if any. Archived goals count toward the limit.
+     *
+     * @throws FeatureIsNotAvailableInFreePlanApiException
+     */
+    private function checkGoalLimit(Organization $organization): void
+    {
+        $limit = app(BillingContract::class)->getGoalLimit($organization);
+        if ($limit === null) {
+            return;
+        }
+        $goals = Goal::query()
+            ->whereBelongsTo($organization, 'organization')
+            ->count();
+        if ($goals >= $limit) {
+            throw new FeatureIsNotAvailableInFreePlanApiException;
+        }
+    }
+
+    /**
+     * Get goals
+     *
+     * Returns the goals the current member is allowed to see, including the progress in the current period.
+     *
+     * @throws AuthorizationException
+     *
+     * @operationId getGoals
+     */
+    public function index(Organization $organization, GoalIndexRequest $request, GoalsContract $access, GoalProgressService $progressService): GoalCollection
+    {
+        // An organization goal is visible to the member it is for, who does not hold the :organization-type permission.
+        // Either permission is enough, the access contract decides which goals come back.
+        $this->checkAnyPermission($organization, ['goals:view:own', 'goals:view:organization-type']);
+        $member = $this->member($organization);
+
+        $query = Goal::query()
+            ->whereBelongsTo($organization, 'organization')
+            ->with(['member.user'])
+            ->orderBy('created_at', 'desc')
+            ->orderBy('id');
+        $query = $access->scopeVisibleGoals($query, $member);
+        if ($request->getType() !== null) {
+            $query->where('type', '=', $request->getType()->value);
+        }
+        if ($request->getArchivedFilter() === 'true') {
+            $query->archived();
+        } elseif ($request->getArchivedFilter() === 'false') {
+            $query->notArchived();
+        }
+
+        $goals = $query->paginate(config('app.pagination_per_page_default'));
+        $progressByGoalId = $progressService->getCurrentProgressForGoals($goals->getCollection(), Carbon::now());
+
+        return new GoalCollection($goals, $progressByGoalId);
+    }
+
+    /**
+     * Get goal
+     *
+     * @throws AuthorizationException
+     *
+     * @operationId getGoal
+     */
+    public function show(Organization $organization, Goal $goal, GoalsContract $access, GoalProgressService $progressService): GoalResource
+    {
+        // Either permission is enough, see index
+        $this->checkAnyPermission($organization, ['goals:view:own', 'goals:view:organization-type']);
+        $this->checkGoalBelongsToOrganization($organization, $goal);
+        $member = $this->member($organization);
+        if (! $access->canViewGoal($member, $goal)) {
+            throw new AuthorizationException;
+        }
+        $goal->load('member.user');
+
+        return new GoalResource($goal, $progressService->getCurrentProgress($goal, Carbon::now()));
+    }
+
+    /**
+     * Create goal
+     *
+     * @throws AuthorizationException|FeatureIsNotAvailableInFreePlanApiException
+     *
+     * @operationId createGoal
+     */
+    public function store(Organization $organization, GoalStoreRequest $request, GoalsContract $access, GoalProgressService $progressService): JsonResponse
+    {
+        if ($request->getType() === GoalType::Personal) {
+            $this->checkPermission($organization, 'goals:create:own');
+        } else {
+            $this->checkPermission($organization, 'goals:create:organization-type');
+        }
+        $member = $this->member($organization);
+
+        $type = $request->getType();
+        $targetMemberId = $request->hasMemberId() ? $request->getMemberId() : $member->getKey();
+        if (! $access->canCreateGoal($member, $type, $targetMemberId)) {
+            throw new AuthorizationException;
+        }
+        $this->checkGoalLimit($organization);
+
+        $user = $member->user;
+        $goal = new Goal;
+        $goal->name = $request->getName();
+        $goal->type = $type;
+        $goal->comparison = $request->getComparison();
+        $goal->target_seconds = $request->getTargetSeconds();
+        $goal->period = $request->getPeriod();
+        $goal->filters = $request->getFilters();
+        $goal->timezone = $request->getTimezone() ?? app(TimezoneService::class)->getTimezoneFromUser($user)->getName();
+        $goal->week_start = $request->getWeekStart() ?? $user->week_start;
+        $goal->organization()->associate($organization);
+        $goal->member_id = $targetMemberId;
+        $goal->save();
+        $goal->load('member.user');
+
+        return (new GoalResource($goal, $progressService->getCurrentProgress($goal, Carbon::now())))
+            ->response()
+            ->setStatusCode(201);
+    }
+
+    /**
+     * Update goal
+     *
+     * The type of a goal and the member it is for can not be changed after creation.
+     *
+     * @throws AuthorizationException
+     *
+     * @operationId updateGoal
+     */
+    public function update(Organization $organization, Goal $goal, GoalUpdateRequest $request, GoalsContract $access, GoalProgressService $progressService): GoalResource
+    {
+        if ($goal->type === GoalType::Personal) {
+            $this->checkPermission($organization, 'goals:update:own', $goal);
+        } else {
+            $this->checkPermission($organization, 'goals:update:organization-type', $goal);
+        }
+        $member = $this->member($organization);
+        if (! $access->canUpdateGoal($member, $goal)) {
+            throw new AuthorizationException;
+        }
+        if ($request->has('filters')) {
+            $goal->filters = $request->getFilters();
+        }
+
+        if ($request->has('name')) {
+            $goal->name = $request->getName();
+        }
+        if ($request->has('comparison')) {
+            $goal->comparison = $request->getComparison();
+        }
+        if ($request->has('target_seconds')) {
+            $goal->target_seconds = $request->getTargetSeconds();
+        }
+        if ($request->has('period')) {
+            $goal->period = $request->getPeriod();
+        }
+        if ($request->has('timezone')) {
+            $goal->timezone = $request->getTimezone();
+        }
+        if ($request->has('week_start')) {
+            $goal->week_start = $request->getWeekStart();
+        }
+        if ($request->has('is_archived')) {
+            $goal->archived_at = $request->getIsArchived() ? Carbon::now() : null;
+        }
+        $goal->save();
+        $goal->load('member.user');
+
+        return new GoalResource($goal, $progressService->getCurrentProgress($goal, Carbon::now()));
+    }
+
+    /**
+     * Delete goal
+     *
+     * @throws AuthorizationException
+     *
+     * @operationId deleteGoal
+     */
+    public function destroy(Organization $organization, Goal $goal, GoalsContract $access): JsonResponse
+    {
+        if ($goal->type === GoalType::Personal) {
+            $this->checkPermission($organization, 'goals:delete:own', $goal);
+        } else {
+            $this->checkPermission($organization, 'goals:delete:organization-type', $goal);
+        }
+        $member = $this->member($organization);
+        if (! $access->canDeleteGoal($member, $goal)) {
+            throw new AuthorizationException;
+        }
+
+        $goal->delete();
+
+        return response()->json(null, 204);
+    }
+}

app/Http/Controllers/Api/V1/InvitationController.php

@@ -9,7 +9,6 @@ use App\Exceptions\Api\UserIsAlreadyMemberOfOrganizationApiException;
 use App\Http\Requests\V1\Invitation\InvitationIndexRequest;
 use App\Http\Requests\V1\Invitation\InvitationStoreRequest;
 use App\Http\Resources\V1\Invitation\InvitationCollection;
-use App\Http\Resources\V1\Invitation\InvitationResource;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
 use App\Service\InvitationService;
@@ -30,8 +29,6 @@ class InvitationController extends Controller
     /**
      * List all invitations of an organization
      *
-     * @return InvitationCollection<InvitationResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getInvitations
@@ -88,6 +85,8 @@ class InvitationController extends Controller
     /**
      * Remove a pending invitation
      *
+     * This revokes the invitation: the link in the invitation email stops working. Find the invitation ID with `GET /organizations/{organization}/invitations`.
+     *
      * @throws AuthorizationException
      *
      * @operationId removeInvitation

app/Http/Controllers/Api/V1/MemberController.php

@@ -48,8 +48,6 @@ class MemberController extends Controller
     /**
      * List all members of an organization
      *
-     * @return MemberCollection<MemberResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getMembers
@@ -83,10 +81,9 @@ class MemberController extends Controller
     {
         $this->checkPermission($organization, 'members:update', $member);
 
-        if ($request->has('billable_rate') && $member->billable_rate !== $request->getBillableRate()) {
+        $oldBillableRate = $member->billable_rate;
+        if ($request->has('billable_rate') && $this->canUseBillableRates($organization)) {
             $member->billable_rate = $request->getBillableRate();
-
-            $billableRateService->updateTimeEntriesBillableRateForMember($member);
         }
         if ($request->has('role') && $member->role !== $request->getRole()->value) {
             $newRole = $request->getRole();
@@ -95,6 +92,10 @@ class MemberController extends Controller
         }
         $member->save();
 
+        if ($oldBillableRate !== $member->billable_rate) {
+            $billableRateService->updateTimeEntriesBillableRateForMember($member);
+        }
+
         return new MemberResource($member);
     }
 
@@ -145,6 +146,9 @@ class MemberController extends Controller
     /**
      * Merge one member into another
      *
+     * Only placeholder members (for example people created by an import) can be merged. All time entries and other data of the placeholder
+     * are reassigned to the member given in `member_id`, and the placeholder is removed. Find both member IDs with `GET /organizations/{organization}/members`.
+     *
      * @throws AuthorizationException
      * @throws OnlyPlaceholdersCanBeMergedIntoAnotherMember
      * @throws Throwable

app/Http/Controllers/Api/V1/OrganizationController.php

@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
-use App\Enums\Role;
 use App\Events\AfterCreateOrganization;
 use App\Http\Requests\V1\Organization\OrganizationDestroyRequest;
 use App\Http\Requests\V1\Organization\OrganizationStoreRequest;
@@ -28,11 +27,11 @@ class OrganizationController extends Controller
      *
      * @throws AuthorizationException
      */
-    public function show(Organization $organization): OrganizationResource
+    public function show(Organization $organization, BillableRateService $billableRateService): OrganizationResource
     {
         $this->checkPermission($organization, 'organizations:view');
 
-        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        $showBillableRate = $billableRateService->canSeeBillableRates($organization, $this->member($organization));
 
         return new OrganizationResource($organization, $showBillableRate);
     }
@@ -47,6 +46,7 @@ class OrganizationController extends Controller
     public function update(Organization $organization, OrganizationUpdateRequest $request, BillableRateService $billableRateService): OrganizationResource
     {
         $this->checkPermission($organization, 'organizations:update');
+        $canUseBillableRates = $this->canUseBillableRates($organization);
 
         if ($request->getName() !== null) {
             $organization->name = $request->getName();
@@ -54,7 +54,8 @@ class OrganizationController extends Controller
         if ($request->getCurrency() !== null) {
             $organization->currency = $request->getCurrency();
         }
-        if ($request->getEmployeesCanSeeBillableRates() !== null) {
+        // Organizations that can not use billable rates can keep or remove the visibility for employees, but not enable it
+        if ($request->getEmployeesCanSeeBillableRates() !== null && ($canUseBillableRates || ! $request->getEmployeesCanSeeBillableRates())) {
             $organization->employees_can_see_billable_rates = $request->getEmployeesCanSeeBillableRates();
         }
         if ($request->getEmployeesCanManageTasks() !== null) {
@@ -81,14 +82,13 @@ class OrganizationController extends Controller
         if ($request->getBreaksEnabled() !== null) {
             $organization->breaks_enabled = $request->getBreaksEnabled();
         }
-        $hasBillableRate = $request->has('billable_rate');
-        if ($hasBillableRate) {
-            $oldBillableRate = $organization->billable_rate;
+        $oldBillableRate = $organization->billable_rate;
+        if ($request->has('billable_rate') && $canUseBillableRates) {
             $organization->billable_rate = $request->getBillableRate();
         }
         $organization->save();
 
-        if ($hasBillableRate && $oldBillableRate !== $request->getBillableRate()) {
+        if ($oldBillableRate !== $organization->billable_rate) {
             $billableRateService->updateTimeEntriesBillableRateForOrganization($organization);
         }
 

app/Http/Controllers/Api/V1/ProjectController.php

@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
-use App\Enums\Role;
 use App\Exceptions\Api\EntityStillInUseApiException;
 use App\Http\Requests\V1\Project\ProjectIndexRequest;
 use App\Http\Requests\V1\Project\ProjectStoreRequest;
@@ -35,13 +34,11 @@ class ProjectController extends Controller
     /**
      * Get projects visible to the current user
      *
-     * @return ProjectCollection<ProjectResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getProjects
      */
-    public function index(Organization $organization, ProjectIndexRequest $request): ProjectCollection
+    public function index(Organization $organization, ProjectIndexRequest $request, BillableRateService $billableRateService): ProjectCollection
     {
         $this->checkPermission($organization, 'projects:view');
         $canViewAllProjects = $this->hasPermission($organization, 'projects:view:all');
@@ -65,7 +62,7 @@ class ProjectController extends Controller
             ->orderBy('id')
             ->paginate(config('app.pagination_per_page_default'));
 
-        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        $showBillableRate = $billableRateService->canSeeBillableRates($organization, $this->member($organization));
 
         return new ProjectCollection($projects, $showBillableRate);
     }
@@ -99,11 +96,12 @@ class ProjectController extends Controller
     public function store(Organization $organization, ProjectStoreRequest $request): JsonResource
     {
         $this->checkPermission($organization, 'projects:create');
+        $canUseBillableRates = $this->canUseBillableRates($organization);
         $project = new Project;
         $project->name = $request->input('name');
         $project->color = $request->input('color');
-        $project->is_billable = (bool) $request->input('is_billable');
-        $project->billable_rate = $request->getBillableRate();
+        $project->is_billable = $canUseBillableRates && $request->boolean('is_billable');
+        $project->billable_rate = $canUseBillableRates ? $request->getBillableRate() : null;
         $project->client_id = $request->input('client_id');
         $project->is_public = $request->getIsPublic();
         if ($this->canAccessPremiumFeatures($organization) && $request->has('estimated_time')) {
@@ -125,9 +123,13 @@ class ProjectController extends Controller
     public function update(Organization $organization, Project $project, ProjectUpdateRequest $request, BillableRateService $billableRateService): JsonResource
     {
         $this->checkPermission($organization, 'projects:update', $project);
+        $canUseBillableRates = $this->canUseBillableRates($organization);
         $project->name = $request->input('name');
         $project->color = $request->input('color');
-        $project->is_billable = (bool) $request->input('is_billable');
+        // Organizations that can not use billable rates can keep or remove the billable flag, but not set it
+        if ($canUseBillableRates || ! $request->boolean('is_billable')) {
+            $project->is_billable = $request->boolean('is_billable');
+        }
         if ($request->has('is_archived')) {
             $project->archived_at = $request->getIsArchived() ? Carbon::now() : null;
         }
@@ -139,14 +141,16 @@ class ProjectController extends Controller
         }
         $oldBillableRate = $project->billable_rate;
         $clientIdChanged = false;
-        $project->billable_rate = $request->getBillableRate();
+        if ($request->has('billable_rate') && $canUseBillableRates) {
+            $project->billable_rate = $request->getBillableRate();
+        }
         if ($project->client_id !== $request->input('client_id')) {
             $project->client_id = $request->input('client_id');
             $clientIdChanged = true;
         }
         $project->save();
 
-        if ($oldBillableRate !== $request->getBillableRate()) {
+        if ($oldBillableRate !== $project->billable_rate) {
             $billableRateService->updateTimeEntriesBillableRateForProject($project);
         }
         if ($clientIdChanged) {

app/Http/Controllers/Api/V1/ProjectMemberController.php

@@ -36,8 +36,6 @@ class ProjectMemberController extends Controller
     /**
      * Get project members for project
      *
-     * @return ProjectMemberCollection<ProjectMemberResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getProjectMembers
@@ -75,13 +73,13 @@ class ProjectMemberController extends Controller
         }
 
         $projectMember = new ProjectMember;
-        $projectMember->billable_rate = $request->getBillableRate();
+        $projectMember->billable_rate = $this->canUseBillableRates($organization) ? $request->getBillableRate() : null;
         $projectMember->member()->associate($member);
         $projectMember->user()->associate($member->user);
         $projectMember->project()->associate($project);
         $projectMember->save();
 
-        if ($request->getBillableRate() !== null) {
+        if ($projectMember->billable_rate !== null) {
             $billableRateService->updateTimeEntriesBillableRateForProjectMember($projectMember);
         }
 
@@ -99,10 +97,12 @@ class ProjectMemberController extends Controller
     {
         $this->checkPermission($organization, 'project-members:update', projectMember: $projectMember);
         $oldBillableRate = $projectMember->billable_rate;
-        $projectMember->billable_rate = $request->getBillableRate();
+        if ($this->canUseBillableRates($organization)) {
+            $projectMember->billable_rate = $request->getBillableRate();
+        }
         $projectMember->save();
 
-        if ($oldBillableRate !== $request->getBillableRate()) {
+        if ($oldBillableRate !== $projectMember->billable_rate) {
             $billableRateService->updateTimeEntriesBillableRateForProjectMember($projectMember);
         }
 

app/Http/Controllers/Api/V1/ReportController.php

@@ -10,7 +10,6 @@ use App\Http\Requests\V1\Report\ReportStoreRequest;
 use App\Http\Requests\V1\Report\ReportUpdateRequest;
 use App\Http\Resources\V1\Report\DetailedReportResource;
 use App\Http\Resources\V1\Report\ReportCollection;
-use App\Http\Resources\V1\Report\ReportResource;
 use App\Models\Organization;
 use App\Models\Report;
 use App\Service\Dto\ReportPropertiesDto;
@@ -35,8 +34,6 @@ class ReportController extends Controller
     /**
      * Get reports
      *
-     * @return ReportCollection<ReportResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getReports
@@ -71,6 +68,8 @@ class ReportController extends Controller
     /**
      * Create report
      *
+     * A report is a saved set of filters. Set `is_public` to `true` to share it: the response then contains the `shareable_link` that can be opened without logging in.
+     *
      * @throws AuthorizationException
      *
      * @operationId createReport

app/Http/Controllers/Api/V1/TagController.php

@@ -29,8 +29,6 @@ class TagController extends Controller
     /**
      * Get tags
      *
-     * @return TagCollection<TagResource>
-     *
      * @operationId getTags
      *
      * @throws AuthorizationException

app/Http/Controllers/Api/V1/TaskController.php

@@ -51,8 +51,6 @@ class TaskController extends Controller
     /**
      * Get tasks
      *
-     * @return TaskCollection<TaskResource>
-     *
      * @throws AuthorizationException
      *
      * @operationId getTasks

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -5,12 +5,12 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Api\V1;
 
 use App\Enums\ExportFormat;
-use App\Enums\Role;
 use App\Enums\TimeEntryType;
 use App\Exceptions\Api\FeatureIsNotAvailableInFreePlanApiException;
 use App\Exceptions\Api\OverlappingTimeEntryApiException;
 use App\Exceptions\Api\PdfRendererIsNotConfiguredException;
 use App\Exceptions\Api\TimeEntryCanNotBeRestartedApiException;
+use App\Exceptions\Api\TimeEntryMemberCanNotBeChangedWhileRunningApiException;
 use App\Exceptions\Api\TimeEntryStillRunningApiException;
 use App\Http\Requests\V1\TimeEntry\TimeEntryAggregateExportRequest;
 use App\Http\Requests\V1\TimeEntry\TimeEntryAggregateRequest;
@@ -29,6 +29,7 @@ use App\Models\Organization;
 use App\Models\Project;
 use App\Models\Task;
 use App\Models\TimeEntry;
+use App\Service\BillableRateService;
 use App\Service\LocalizationService;
 use App\Service\ReportExport\TimeEntriesDetailedCsvExport;
 use App\Service\ReportExport\TimeEntriesDetailedExport;
@@ -51,6 +52,7 @@ use Illuminate\Support\Carbon;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
@@ -109,10 +111,13 @@ class TimeEntryController extends Controller
     /**
      * Get time entries in organization
      *
-     * If you only need time entries for a specific user, you can filter by `member_id`.
+     * Without a member filter this returns the time entries of all members of the organization (for users who may view all time entries, such as owners and admins), not only your own.
+     * To get only your own time entries, pass your member ID as `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
      * Users with the permission `time-entries:view:own` can only use this endpoint with their own member ID in the member_id filter.
      *
-     * @return TimeEntryCollection<TimeEntryResource>
+     * The `start` and `end` filters both apply to the start time of an entry, in UTC. Convert the user's local day boundaries to UTC first.
+     * Results are paginated with `limit` (default 100, max 500) and `offset`; check `meta.total` and fetch further pages when needed.
+     * To find the running timer, use `active=true` (or `GET /v1/users/me/time-entries/active`).
      *
      * @throws AuthorizationException
      *
@@ -224,7 +229,7 @@ class TimeEntryController extends Controller
      *
      * @operationId exportTimeEntries
      */
-    public function indexExport(Organization $organization, TimeEntryIndexExportRequest $request, TimeEntryAggregationService $timeEntryAggregationService): JsonResponse
+    public function indexExport(Organization $organization, TimeEntryIndexExportRequest $request, TimeEntryAggregationService $timeEntryAggregationService, BillableRateService $billableRateService): JsonResponse
     {
         $member = $this->member($organization);
         /** @var Member|null $memberFilter */
@@ -242,7 +247,7 @@ class TimeEntryController extends Controller
         }
         $user = $this->user();
         $timezone = $user->timezone;
-        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        $showBillableRate = $billableRateService->canSeeBillableRates($organization, $this->member($organization));
         $roundingType = $canAccessPremiumFeatures ? $request->getRoundingType() : null;
         $roundingMinutes = $canAccessPremiumFeatures ? $request->getRoundingMinutes() : null;
 
@@ -351,6 +356,11 @@ class TimeEntryController extends Controller
      * The parameters `group` and `sub_group` allow you to group the time entries by different criteria.
      * If the group parameters are all set to `null` or are all missing, the endpoint will aggregate all filtered time entries.
      *
+     * Durations are returned in `seconds` (divide by 3600 for hours) and amounts in `cost` as cents in the organization's currency (divide by 100 for money).
+     * Filter by member with `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
+     * Array filters use the query format `client_ids[]=<id>`.
+     * Example: billable hours per client for a period: `group=client&billable=true&start=...&end=...`.
+     *
      * @operationId getAggregatedTimeEntries
      *
      * @return array{
@@ -376,7 +386,7 @@ class TimeEntryController extends Controller
      *
      * @throws AuthorizationException
      */
-    public function aggregate(Organization $organization, TimeEntryAggregateRequest $request, TimeEntryAggregationService $timeEntryAggregationService): array
+    public function aggregate(Organization $organization, TimeEntryAggregateRequest $request, TimeEntryAggregationService $timeEntryAggregationService, BillableRateService $billableRateService): array
     {
         $member = $this->member($organization);
         /** @var Member|null $memberFilter */
@@ -388,7 +398,7 @@ class TimeEntryController extends Controller
         }
         $canAccessPremiumFeatures = $this->canAccessPremiumFeatures($organization);
         $user = $this->user();
-        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        $showBillableRate = $billableRateService->canSeeBillableRates($organization, $this->member($organization));
 
         $group1Type = $request->getGroup();
         $group2Type = $request->getSubGroup();
@@ -426,7 +436,7 @@ class TimeEntryController extends Controller
      * @throws NoOutputFileInResponse
      * @throws FeatureIsNotAvailableInFreePlanApiException
      */
-    public function aggregateExport(Organization $organization, TimeEntryAggregateExportRequest $request, TimeEntryAggregationService $timeEntryAggregationService): JsonResponse
+    public function aggregateExport(Organization $organization, TimeEntryAggregateExportRequest $request, TimeEntryAggregationService $timeEntryAggregationService, BillableRateService $billableRateService): JsonResponse
     {
         $member = $this->member($organization);
         /** @var Member|null $memberFilter */
@@ -443,7 +453,7 @@ class TimeEntryController extends Controller
         }
         $debug = $request->getDebug();
         $user = $this->user();
-        $showBillableRate = $this->member($organization)->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+        $showBillableRate = $billableRateService->canSeeBillableRates($organization, $this->member($organization));
 
         $group = $request->getGroup();
         $subGroup = $request->getSubGroup();
@@ -584,6 +594,12 @@ class TimeEntryController extends Controller
     /**
      * Create time entry
      *
+     * `billable` is not taken from the project. To match the web app, set it to the project's `is_billable` value (or `false` without a project).
+     *
+     * A member can only have one running time entry (an entry with `end` set to `null`). Creating a running entry while another one runs fails with `time_entry_still_running`.
+     * To start a new timer, first stop the running entry by updating its `end` to the current time, then create the new entry.
+     * To log past work, send both `start` and `end` (UTC). Create one entry per block of work.
+     *
      * @throws AuthorizationException
      * @throws TimeEntryStillRunningApiException
      *
@@ -599,7 +615,24 @@ class TimeEntryController extends Controller
             $this->checkPermission($organization, 'time-entries:create:all');
         }
 
-        if ($request->input('end') === null && TimeEntry::query()->whereBelongsTo($member, 'member')->where('end', null)->exists()) {
+        // Lock the creation of running time entries per user, so that concurrent requests can not create more than one running time entry
+        $lock = $request->input('end') === null ? Cache::lock('time-entries:running:'.$member->user_id, 10) : null;
+        $lock?->block(5);
+
+        try {
+            return $this->storeTimeEntry($organization, $member, $request);
+        } finally {
+            $lock?->release();
+        }
+    }
+
+    /**
+     * @throws TimeEntryStillRunningApiException
+     */
+    private function storeTimeEntry(Organization $organization, Member $member, TimeEntryStoreRequest $request): JsonResource
+    {
+        // A user can only have one running time entry, across all organizations
+        if ($request->input('end') === null && TimeEntry::query()->where('user_id', $member->user_id)->whereNull('end')->exists()) {
             throw new TimeEntryStillRunningApiException;
         }
 
@@ -614,6 +647,10 @@ class TimeEntryController extends Controller
 
         $timeEntry = new TimeEntry;
         $timeEntry->fill($request->validated());
+        // Organizations that can not use billable rates can not create billable time entries
+        if ($timeEntry->billable && ! $this->canUseBillableRates($organization)) {
+            $timeEntry->billable = false;
+        }
         $timeEntry->client()->associate($client);
         $timeEntry->user_id = $member->user_id;
         $timeEntry->description = $request->input('description') ?? '';
@@ -634,7 +671,9 @@ class TimeEntryController extends Controller
     /**
      * Update time entry
      *
-     * @throws AuthorizationException|TimeEntryCanNotBeRestartedApiException
+     * To stop a running timer, set `end` to the stop time (UTC). Times the user gives in their own timezone must be converted to UTC first.
+     *
+     * @throws AuthorizationException|TimeEntryCanNotBeRestartedApiException|TimeEntryMemberCanNotBeChangedWhileRunningApiException
      *
      * @operationId updateTimeEntry
      */
@@ -660,6 +699,11 @@ class TimeEntryController extends Controller
         $effectiveEnd = $request->has('end') ? ($request->input('end') !== null ? Carbon::parse($request->input('end')) : null) : $timeEntry->end;
         $this->assertNoOverlap($organization, $effectiveMember, $effectiveStart, $effectiveEnd, $timeEntry);
 
+        // The new member could already have a running time entry
+        if ($effectiveEnd === null && $newMember !== null && $newMember->getKey() !== $timeEntry->member_id) {
+            throw new TimeEntryMemberCanNotBeChangedWhileRunningApiException;
+        }
+
         $oldProject = $timeEntry->project;
         $oldTask = $timeEntry->task;
 
@@ -674,11 +718,20 @@ class TimeEntryController extends Controller
             $task = $request->input('task_id') !== null ? Task::findOrFail((string) $request->input('task_id')) : null;
         }
 
+        $wasBillable = $timeEntry->billable;
         $timeEntry->fill($request->validated());
+        // Organizations that can not use billable rates can keep or remove the billable flag, but not set it
+        if ($timeEntry->billable && ! $wasBillable && ! $this->canUseBillableRates($organization)) {
+            $timeEntry->billable = false;
+        }
         if ($newMember !== null) {
             $timeEntry->member()->associate($newMember);
             $timeEntry->user()->associate($newMember->user);
         }
+        // If project is changed, but task is not, we remove the old task from the time entry
+        if ($request->has('project_id') && ! $request->has('task_id') && $oldTask !== null && $oldTask->project_id !== $project?->getKey()) {
+            $timeEntry->task()->disassociate();
+        }
         $timeEntry->description = $request->input('description', $timeEntry->description) ?? '';
         $timeEntry->setComputedAttributeValue('billable_rate');
         $timeEntry->save();
@@ -702,6 +755,10 @@ class TimeEntryController extends Controller
     /**
      * Update multiple time entries
      *
+     * Applies the same `changes` to every entry in `ids`. To find the IDs, list entries with `GET /organizations/{organization}/time-entries`
+     * (filtered by `member_id`, the project and the other criteria), then send their IDs here.
+     * When `changes.project_id` moves entries to another project, also set `changes.task_id` to a task of the new project or to `null`, because tasks belong to a project.
+     *
      * @operationId updateMultipleTimeEntries
      *
      * @throws AuthorizationException
@@ -724,6 +781,7 @@ class TimeEntryController extends Controller
             ->get();
 
         $changes = $request->validated('changes');
+        $canUseBillableRates = $this->canUseBillableRates($organization);
 
         if ($request->has('changes.description')) {
             $changes['description'] = $request->input('changes.description') ?? '';
@@ -781,16 +839,27 @@ class TimeEntryController extends Controller
 
                 continue;
             }
+            // The new member could already have a running time entry
+            if ($newMember !== null && $timeEntry->end === null && $newMember->getKey() !== $timeEntry->member_id) {
+                $error->push($id);
+
+                continue;
+            }
             $oldProject = $timeEntry->project;
             $oldTask = $timeEntry->task;
+            $wasBillable = $timeEntry->billable;
 
             $timeEntry->fill($changes);
+            // Organizations that can not use billable rates can keep or remove the billable flag, but not set it
+            if (! $wasBillable && ! $canUseBillableRates) {
+                $timeEntry->billable = false;
+            }
             if ($newMember !== null) {
                 $timeEntry->member()->associate($newMember);
                 $timeEntry->user_id = $newMember->user_id;
             }
             // If project is changed, but task is not, we remove the old task from the time entry
-            if ($oldProject !== null && $project !== null && $oldProject->isNot($project) && $task === null) {
+            if ($request->has('changes.project_id') && ! $request->has('changes.task_id') && $oldTask !== null && $oldTask->project_id !== $project?->getKey()) {
                 $timeEntry->task()->disassociate();
             }
             if ($overwriteClient) {

app/Http/Controllers/Api/V1/TimeZoneController.php

@@ -12,7 +12,7 @@ class TimeZoneController extends Controller
     /**
      * Get all timezones
      *
-     * @response object{key: string}[]
+     * @response array{key: string}[]
      *
      * @operationId getTimezones
      */

app/Http/Controllers/Web/UserProfileController.php

@@ -4,9 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Web;
 
-use App\Enums\Weekday;
 use App\Service\Dto\UserAgentDto;
-use App\Service\TimezoneService;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
 use Illuminate\Support\Carbon;
@@ -94,8 +92,6 @@ class UserProfileController extends Controller
         $this->validateTwoFactorAuthenticationState($request);
 
         return Inertia::render('Profile/Show', [
-            'timezones' => app(TimezoneService::class)->getSelectOptions(),
-            'weekdays' => Weekday::toSelectArray(),
             'confirmsTwoFactorAuthentication' => Features::optionEnabled(Features::twoFactorAuthentication(), 'confirm'),
             'sessions' => $this->sessions($request),
         ]);

app/Http/Middleware/HandleInertiaRequests.php

@@ -42,6 +42,7 @@ class HandleInertiaRequests extends Middleware
         $hasBilling = Module::has('Billing') && Module::isEnabled('Billing');
         $hasInvoicing = Module::has('Invoicing') && Module::isEnabled('Invoicing');
         $hasServices = Module::has('Services') && Module::isEnabled('Services');
+        $hasGoals = Module::has('Goals') && Module::isEnabled('Goals');
 
         /** @var BillingContract $billing */
         $billing = app(BillingContract::class);
@@ -52,11 +53,14 @@ class HandleInertiaRequests extends Middleware
             'has_billing_extension' => $hasBilling,
             'has_invoicing_extension' => $hasInvoicing,
             'has_services_extension' => $hasServices,
+            'has_goals_extension' => $hasGoals,
             'billing' => $currentOrganization !== null ? [
                 'has_subscription' => $billing->hasSubscription($currentOrganization),
                 'has_trial' => $billing->hasTrial($currentOrganization),
                 'trial_until' => $billing->getTrialUntil($currentOrganization)?->toIso8601ZuluString(),
                 'is_blocked' => $billing->isBlocked($currentOrganization),
+                'goal_limit' => $billing->getGoalLimit($currentOrganization),
+                'can_use_billable_rates' => $billing->canUseBillableRates($currentOrganization),
             ] : null,
             'flash' => [
                 'message' => fn () => $request->session()->get('message'),

app/Http/Requests/V1/Goal/GoalFilterRules.php

@@ -0,0 +1,144 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\Goal;
+
+use App\Enums\Role;
+use App\Enums\TagMatchType;
+use App\Enums\TimeEntryType;
+use App\Models\Client;
+use App\Models\Member;
+use App\Models\Organization;
+use App\Models\Project;
+use App\Models\Tag;
+use App\Models\Task;
+use App\Service\Dto\GoalFiltersDto;
+use App\Service\TimeEntryFilter;
+use Illuminate\Contracts\Validation\Rule as LegacyValidationRule;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Rules\ProhibitedIf;
+use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
+
+/**
+ * Shared validation rules for the filters of a goal.
+ *
+ * @property Organization $organization Organization from model binding
+ */
+trait GoalFilterRules
+{
+    /**
+     * @param  \Closure(): bool  $forEveryMember  Whether the goal counts every member instead of one member, evaluated during validation
+     * @return array<string, array<string|ValidationRule|LegacyValidationRule|\Closure|ProhibitedIf>>
+     */
+    protected function filterRules(\Closure $forEveryMember): array
+    {
+        return [
+            'filters' => [
+                'sometimes',
+                'array',
+            ],
+            // Filter by member IDs, member IDs are OR combined. Only for goals that count every member, null means every member.
+            'filters.member_ids' => [
+                'nullable',
+                'array',
+                // "prohibited" still lets null and an empty array through, both mean "no restriction"
+                Rule::prohibitedIf(fn (): bool => ! $forEveryMember()),
+            ],
+            'filters.member_ids.*' => [
+                'string',
+                'distinct',
+                ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
+                    /** @var Builder<Member> $builder */
+                    return $builder->whereBelongsTo($this->organization, 'organization')
+                        ->where('role', '!=', Role::Placeholder->value);
+                })->uuid(),
+            ],
+            // Filter by project IDs, project IDs are OR combined, "none" matches entries without a project
+            'filters.project_ids' => [
+                'nullable',
+                'array',
+            ],
+            'filters.project_ids.*' => [
+                'string',
+                $this->idOrNoneExistsInOrganization(Project::class),
+            ],
+            // Filter by task IDs, task IDs are OR combined, "none" matches entries without a task
+            'filters.task_ids' => [
+                'nullable',
+                'array',
+            ],
+            'filters.task_ids.*' => [
+                'string',
+                $this->idOrNoneExistsInOrganization(Task::class),
+            ],
+            // Filter by tag IDs, tag IDs are OR combined, "none" matches entries without tags
+            'filters.tag_ids' => [
+                'nullable',
+                'array',
+            ],
+            'filters.tag_ids.*' => [
+                'string',
+                $this->idOrNoneExistsInOrganization(Tag::class),
+            ],
+            'filters.tag_match_type' => [
+                'nullable',
+                'string',
+                Rule::enum(TagMatchType::class),
+            ],
+            // Filter by client IDs, client IDs are OR combined, "none" matches entries without a client
+            'filters.client_ids' => [
+                'nullable',
+                'array',
+            ],
+            'filters.client_ids.*' => [
+                'string',
+                $this->idOrNoneExistsInOrganization(Client::class),
+            ],
+            // Filter by billable status, null means both
+            'filters.billable' => [
+                'nullable',
+                'boolean',
+            ],
+            // Filter by time entry type, null means both
+            'filters.time_entry_type' => [
+                'nullable',
+                'string',
+                Rule::enum(TimeEntryType::class),
+            ],
+        ];
+    }
+
+    /**
+     * @param  class-string<Project|Task|Tag|Client>  $modelClass
+     */
+    private function idOrNoneExistsInOrganization(string $modelClass): \Closure
+    {
+        return function (string $attribute, mixed $value, \Closure $fail) use ($modelClass): void {
+            if ($value === TimeEntryFilter::NONE_VALUE) {
+                return;
+            }
+            ExistsEloquent::make($modelClass, null, function (Builder $builder): Builder {
+                /** @var Builder<Project|Task|Tag|Client> $builder */
+                return $builder->whereBelongsTo($this->organization, 'organization');
+            })->uuid()->validate($attribute, $value, $fail);
+        };
+    }
+
+    public function getFilters(): GoalFiltersDto
+    {
+        $filters = new GoalFiltersDto;
+        $filters->setMemberIds($this->input('filters.member_ids'));
+        $filters->setProjectIds($this->input('filters.project_ids'));
+        $filters->setTaskIds($this->input('filters.task_ids'));
+        $filters->setTagIds($this->input('filters.tag_ids'));
+        $filters->tagMatchType = $this->input('filters.tag_match_type') !== null ? TagMatchType::from($this->input('filters.tag_match_type')) : null;
+        $filters->setClientIds($this->input('filters.client_ids'));
+        $filters->billable = $this->input('filters.billable') !== null ? (bool) $this->input('filters.billable') : null;
+        $filters->timeEntryType = $this->input('filters.time_entry_type') !== null ? TimeEntryType::from($this->input('filters.time_entry_type')) : null;
+
+        return $filters;
+    }
+}

app/Http/Requests/V1/Goal/GoalIndexRequest.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\Goal;
+
+use App\Enums\GoalType;
+use App\Http\Requests\V1\BaseFormRequest;
+use App\Models\Organization;
+use Illuminate\Contracts\Validation\Rule as LegacyValidationRule;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Validation\Rule;
+
+/**
+ * @property Organization $organization Organization from model binding
+ */
+class GoalIndexRequest extends BaseFormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<string|ValidationRule|LegacyValidationRule|\Closure>>
+     */
+    public function rules(): array
+    {
+        return [
+            // Only return goals of this type (personal, organization)
+            'type' => [
+                'nullable',
+                'string',
+                Rule::enum(GoalType::class),
+            ],
+            // Filter by archived status, "true" only archived, "false" only not archived (default), "all" both
+            'archived' => [
+                'nullable',
+                'string',
+                'in:true,false,all',
+            ],
+            'page' => [
+                'nullable',
+                'integer',
+                'min:1',
+                'max:2147483647',
+            ],
+        ];
+    }
+
+    public function getType(): ?GoalType
+    {
+        if ($this->input('type') === null) {
+            return null;
+        }
+
+        return GoalType::from($this->input('type'));
+    }
+
+    public function getArchivedFilter(): string
+    {
+        return (string) $this->input('archived', 'false');
+    }
+}

app/Http/Requests/V1/Goal/GoalStoreRequest.php

@@ -0,0 +1,168 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\Goal;
+
+use App\Enums\GoalComparison;
+use App\Enums\GoalPeriod;
+use App\Enums\GoalType;
+use App\Enums\Role;
+use App\Enums\Weekday;
+use App\Http\Requests\V1\BaseFormRequest;
+use App\Models\Member;
+use App\Models\Organization;
+use Illuminate\Contracts\Validation\Rule as LegacyValidationRule;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Rules\In;
+use Illuminate\Validation\Rules\ProhibitedIf;
+use Korridor\LaravelModelValidationRules\Rules\ExistsEloquent;
+
+/**
+ * @property Organization $organization Organization from model binding
+ */
+class GoalStoreRequest extends BaseFormRequest
+{
+    use GoalFilterRules;
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<string|ValidationRule|LegacyValidationRule|In|ProhibitedIf|\Closure>>
+     */
+    public function rules(): array
+    {
+        $memberExistsInOrganization = ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
+            /** @var Builder<Member> $builder */
+            return $builder->whereBelongsTo($this->organization, 'organization')
+                ->where('role', '!=', Role::Placeholder->value);
+        })->uuid();
+
+        return array_merge([
+            'name' => [
+                'required',
+                'string',
+                'max:255',
+            ],
+            // personal: a goal for yourself that nobody else can see, organization: a goal of the organization for a member or for every member. Organization goals require the team goals extension.
+            'type' => [
+                'required',
+                'string',
+                Rule::enum(GoalType::class),
+            ],
+            // Whether the goal is reached when "at least" or "less than" the target time is tracked in the period
+            'comparison' => [
+                'required',
+                'string',
+                Rule::enum(GoalComparison::class),
+            ],
+            // Target time in seconds
+            'target_seconds' => [
+                'required',
+                'integer',
+                'min:1',
+                'max:2147483647',
+            ],
+            // The recurring time frame in which the target has to be reached
+            'period' => [
+                'required',
+                'string',
+                Rule::enum(GoalPeriod::class),
+            ],
+            // ID of the member whose time entries count towards the goal, defaults to the current member. Send null for a goal that counts every member (organization goals only).
+            'member_id' => $this->input('type') === GoalType::Personal->value
+                // A personal goal is always for the current member, it can not count every member
+                ? [
+                    'sometimes',
+                    'filled',
+                    'string',
+                    Rule::in([$this->currentMemberId()]),
+                ]
+                : [
+                    'nullable',
+                    'string',
+                    $memberExistsInOrganization,
+                ],
+            // Timezone that defines the periods of the goal, defaults to the timezone of the current user
+            'timezone' => [
+                'nullable',
+                'timezone:all',
+            ],
+            // Week start that defines weekly periods, defaults to the week start of the current user
+            'week_start' => [
+                'nullable',
+                'string',
+                Rule::enum(Weekday::class),
+            ],
+        ], $this->filterRules(
+            // Without a member_id the goal is for the current member
+            fn (): bool => $this->has('member_id') && $this->input('member_id') === null,
+        ));
+    }
+
+    private function currentMemberId(): ?string
+    {
+        /** @var string|null $memberId */
+        $memberId = Member::query()
+            ->whereBelongsTo($this->organization, 'organization')
+            ->where('user_id', $this->user()?->getKey())
+            ->value('id');
+
+        return $memberId;
+    }
+
+    public function getName(): string
+    {
+        return (string) $this->input('name');
+    }
+
+    public function getType(): GoalType
+    {
+        return GoalType::from($this->input('type'));
+    }
+
+    public function getComparison(): GoalComparison
+    {
+        return GoalComparison::from($this->input('comparison'));
+    }
+
+    public function getTargetSeconds(): int
+    {
+        return (int) $this->input('target_seconds');
+    }
+
+    public function getPeriod(): GoalPeriod
+    {
+        return GoalPeriod::from($this->input('period'));
+    }
+
+    public function hasMemberId(): bool
+    {
+        return $this->has('member_id');
+    }
+
+    public function getMemberId(): ?string
+    {
+        return $this->input('member_id');
+    }
+
+    public function getTimezone(): ?string
+    {
+        if (! $this->has('timezone') || $this->input('timezone') === null) {
+            return null;
+        }
+
+        return (string) $this->input('timezone');
+    }
+
+    public function getWeekStart(): ?Weekday
+    {
+        if (! $this->has('week_start') || $this->input('week_start') === null) {
+            return null;
+        }
+
+        return Weekday::from($this->input('week_start'));
+    }
+}

app/Http/Requests/V1/Goal/GoalUpdateRequest.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\V1\Goal;
+
+use App\Enums\GoalComparison;
+use App\Enums\GoalPeriod;
+use App\Enums\Weekday;
+use App\Http\Requests\V1\BaseFormRequest;
+use App\Models\Goal;
+use App\Models\Organization;
+use Illuminate\Contracts\Validation\Rule as LegacyValidationRule;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Rules\ProhibitedIf;
+
+/**
+ * @property Organization $organization Organization from model binding
+ */
+class GoalUpdateRequest extends BaseFormRequest
+{
+    use GoalFilterRules;
+
+    /**
+     * Get the validation rules that apply to the request.
+     * The type of a goal and the member it is for can not be changed after creation.
+     *
+     * @return array<string, array<string|ValidationRule|LegacyValidationRule|ProhibitedIf|\Closure>>
+     */
+    public function rules(): array
+    {
+        /** @var Goal $goal */
+        $goal = $this->route('goal');
+
+        return array_merge([
+            'name' => [
+                'sometimes',
+                'string',
+                'max:255',
+            ],
+            // Whether the goal is reached when "at least" or "less than" the target time is tracked in the period
+            'comparison' => [
+                'sometimes',
+                'string',
+                Rule::enum(GoalComparison::class),
+            ],
+            // Target time in seconds
+            'target_seconds' => [
+                'sometimes',
+                'integer',
+                'min:1',
+                'max:2147483647',
+            ],
+            // The recurring time frame in which the target has to be reached
+            'period' => [
+                'sometimes',
+                'string',
+                Rule::enum(GoalPeriod::class),
+            ],
+            // Timezone that defines the periods of the goal
+            'timezone' => [
+                'sometimes',
+                'timezone:all',
+            ],
+            // Week start that defines weekly periods
+            'week_start' => [
+                'sometimes',
+                'string',
+                Rule::enum(Weekday::class),
+            ],
+            // Archived goals are hidden from the goal list by default, their progress is still calculated
+            'is_archived' => [
+                'sometimes',
+                'boolean',
+            ],
+            // Only allowed if it matches the current type of the goal
+            'type' => [
+                function (string $attribute, mixed $value, \Closure $fail) use ($goal): void {
+                    if ($value !== $goal->type->value) {
+                        $fail('The '.$attribute.' of a goal can not be changed.');
+                    }
+                },
+            ],
+            // Only allowed if it matches the current member of the goal
+            'member_id' => [
+                function (string $attribute, mixed $value, \Closure $fail) use ($goal): void {
+                    if ($value !== $goal->member_id) {
+                        $fail('The '.$attribute.' of a goal can not be changed.');
+                    }
+                },
+            ],
+        ], $this->filterRules(fn (): bool => $goal->member_id === null));
+    }
+
+    public function getName(): string
+    {
+        return (string) $this->input('name');
+    }
+
+    public function getComparison(): GoalComparison
+    {
+        return GoalComparison::from($this->input('comparison'));
+    }
+
+    public function getTargetSeconds(): int
+    {
+        return (int) $this->input('target_seconds');
+    }
+
+    public function getPeriod(): GoalPeriod
+    {
+        return GoalPeriod::from($this->input('period'));
+    }
+
+    public function getTimezone(): string
+    {
+        return (string) $this->input('timezone');
+    }
+
+    public function getWeekStart(): Weekday
+    {
+        return Weekday::from($this->input('week_start'));
+    }
+
+    public function getIsArchived(): bool
+    {
+        return (bool) $this->input('is_archived');
+    }
+}

app/Http/Requests/V1/Member/MemberUpdateRequest.php

@@ -27,6 +27,7 @@ class MemberUpdateRequest extends BaseFormRequest
                 'string',
                 Rule::enum(Role::class),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Organization/OrganizationUpdateRequest.php

@@ -36,6 +36,7 @@ class OrganizationUpdateRequest extends BaseFormRequest
                 'string',
                 new CurrencyRule,
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectStoreRequest.php

@@ -55,6 +55,7 @@ class ProjectStoreRequest extends BaseFormRequest
                 'required',
                 'boolean',
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectUpdateRequest.php

@@ -68,6 +68,7 @@ class ProjectUpdateRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency), the current rate is kept if the field is omitted
             'billable_rate' => array_merge([
                 'nullable',
             ],

app/Http/Requests/V1/ProjectMember/ProjectMemberStoreRequest.php

@@ -31,6 +31,7 @@ class ProjectMemberStoreRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/ProjectMember/ProjectMemberUpdateRequest.php

@@ -21,6 +21,7 @@ class ProjectMemberUpdateRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
+            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/TimeEntry/TimeEntryIndexRequest.php

@@ -35,7 +35,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // Filter by member ID
+            // Filter by member ID. Without it, users who may view all time entries (owners, admins) get the entries of every member; pass your own member ID (from GET /v1/users/me/memberships) to get only yours
             'member_id' => [
                 'string',
                 ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
@@ -155,7 +155,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
                 'string',
                 Rule::enum(TimeEntryType::class),
             ],
-            // Limit the number of returned time entries (default: 150)
+            // Limit the number of returned time entries (default: 100)
             'limit' => [
                 'integer',
                 'min:1',

app/Http/Requests/V1/TimeEntry/TimeEntryStoreRequest.php

@@ -32,7 +32,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // ID of the organization member that the time entry should belong to
+            // ID of the organization member that the time entry should belong to (a member ID from GET /v1/users/me/memberships or the members list, not a user ID)
             'member_id' => [
                 'required',
                 'string',
@@ -86,7 +86,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
                 'date_format:Y-m-d\TH:i:s\Z',
                 'after_or_equal:start',
             ],
-            // Whether time entry is billable
+            // Whether time entry is billable. Not derived from the project: set it to the project's is_billable value to match the web app
             'billable' => [
                 'required',
                 'boolean',

app/Http/Requests/V1/TimeEntry/TimeEntryUpdateRequest.php

@@ -13,9 +13,11 @@ use App\Models\Tag;
 use App\Models\Task;
 use App\Models\TimeEntry;
 use App\Service\PermissionStore;
+use Carbon\Exceptions\InvalidFormatException;
 use Closure;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Validation\ConditionalRules;
 use Illuminate\Validation\Rule;
@@ -90,12 +92,32 @@ class TimeEntryUpdateRequest extends BaseFormRequest
             // Start of time entry (Format: "Y-m-d\TH:i:s\Z", UTC timezone, Example: "2000-02-22T14:58:59Z")
             'start' => [
                 'date_format:Y-m-d\TH:i:s\Z',
+                function (string $attribute, mixed $value, Closure $fail) use ($timeEntry): void {
+                    // If the payload does not contain an end, the start needs to be validated against the persisted end
+                    if ($this->has('end') || $timeEntry?->end === null) {
+                        return;
+                    }
+                    $start = $this->parseDate($value);
+                    if ($start !== null && $start->gt($timeEntry->end)) {
+                        $fail('The start field must be a date before or equal to end.');
+                    }
+                },
             ],
             // End of time entry (Format: "Y-m-d\TH:i:s\Z", UTC timezone, Example: "2000-02-22T14:58:59Z")
             'end' => [
                 'nullable',
                 'date_format:Y-m-d\TH:i:s\Z',
                 'after_or_equal:start',
+                function (string $attribute, mixed $value, Closure $fail) use ($timeEntry): void {
+                    // If the payload does not contain a start, the end needs to be validated against the persisted start
+                    if ($this->has('start') || $timeEntry === null) {
+                        return;
+                    }
+                    $end = $this->parseDate($value);
+                    if ($end !== null && $end->lt($timeEntry->start)) {
+                        $fail('The end field must be a date after or equal to start.');
+                    }
+                },
             ],
             // Whether time entry is billable
             'billable' => [
@@ -137,4 +159,16 @@ class TimeEntryUpdateRequest extends BaseFormRequest
             ],
         ];
     }
+
+    private function parseDate(mixed $value): ?Carbon
+    {
+        if (! is_string($value)) {
+            return null;
+        }
+        try {
+            return Carbon::createFromFormat('Y-m-d\TH:i:s\Z', $value, 'UTC');
+        } catch (InvalidFormatException) {
+            return null;
+        }
+    }
 }

app/Http/Requests/V1/User/UserUpdateRequest.php

@@ -43,9 +43,10 @@ class UserUpdateRequest extends BaseFormRequest
             'email' => [
                 'email:rfc,strict',
                 'max:255',
-                UniqueEloquent::make(User::class, 'email')->ignore($this->user->id)->query(function (Builder $query) {
+                UniqueEloquent::make(User::class, 'email')->query(function (Builder $query) {
                     /** @var Builder<User> $query */
-                    return $query->where('is_placeholder', '=', false);
+                    return $query->where('is_placeholder', '=', false)
+                        ->whereKeyNot($this->user->getKey());
                 }),
             ],
             'photo' => [

app/Http/Resources/PaginatedResourceCollection.php

@@ -1,7 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Resources;
-
-interface PaginatedResourceCollection {}

app/Http/Resources/V1/ApiToken/ApiTokenResource.php

@@ -21,15 +21,15 @@ class ApiTokenResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of the API token, this ID is NOT a UUID */
+            /** ID of the API token, this ID is NOT a UUID */
             'id' => $this->resource->id,
             /** @var string $name Name of the API token */
             'name' => $this->resource->name,
-            /** @var bool $revoked Whether the API token is revoked */
+            /** Whether the API token is revoked */
             'revoked' => $this->resource->revoked,
-            /** @var array<string> $scopes List of scopes that the API token has */
+            /** List of scopes that the API token has */
             'scopes' => $this->resource->scopes,
-            /** @var string $created_at When the API token was created (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
+            /** When the API token was created (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
             'created_at' => $this->formatDateTime($this->resource->created_at),
             /** @var string|null $expires_at At what time the API token expires (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
             'expires_at' => $this->formatDateTime($this->resource->expires_at),

app/Http/Resources/V1/ApiToken/ApiTokenWithAccessTokenResource.php

@@ -29,15 +29,15 @@ class ApiTokenWithAccessTokenResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of the API token, this ID is NOT a UUID */
+            /** ID of the API token, this ID is NOT a UUID */
             'id' => $this->resource->id,
             /** @var string $name Name of the API token */
             'name' => $this->resource->name,
-            /** @var bool $revoked Whether the API token is revoked */
+            /** Whether the API token is revoked */
             'revoked' => $this->resource->revoked,
-            /** @var array<string> $scopes List of scopes that the API token has */
+            /** List of scopes that the API token has */
             'scopes' => $this->resource->scopes,
-            /** @var string $created_at When the API token was created (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
+            /** When the API token was created (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
             'created_at' => $this->formatDateTime($this->resource->created_at),
             /** @var string|null $expires_at At what time the API token expires (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z) */
             'expires_at' => $this->formatDateTime($this->resource->expires_at),

app/Http/Resources/V1/Client/ClientCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Client;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ClientCollection extends ResourceCollection implements PaginatedResourceCollection
+class ClientCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Client/ClientResource.php

@@ -21,15 +21,15 @@ class ClientResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID */
+            /** ID */
             'id' => $this->resource->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var bool $is_archived Whether the client is archived */
+            /** Whether the client is archived */
             'is_archived' => $this->resource->is_archived,
-            /** @var string $created_at When the tag was created */
+            /** When the tag was created */
             'created_at' => $this->formatDateTime($this->resource->created_at),
-            /** @var string $updated_at When the tag was last updated */
+            /** When the tag was last updated */
             'updated_at' => $this->formatDateTime($this->resource->updated_at),
         ];
     }

app/Http/Resources/V1/Goal/GoalCollection.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\Goal;
+
+use App\Models\Goal;
+use App\Service\Dto\GoalProgressDto;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+class GoalCollection extends ResourceCollection
+{
+    /**
+     * @var array<string, GoalProgressDto>
+     */
+    private array $progressByGoalId;
+
+    /**
+     * @param  array<string, GoalProgressDto>  $progressByGoalId
+     */
+    public function __construct($resource, array $progressByGoalId)
+    {
+        parent::__construct($resource);
+        $this->progressByGoalId = $progressByGoalId;
+    }
+
+    protected function collects(): ?string
+    {
+        return null;
+    }
+
+    /**
+     * Transform the resource collection into an array.
+     *
+     * @return array<array<string, string|bool|int|null|array<string, string|bool|int|null|array<int, string>>>>
+     */
+    public function toArray(Request $request): array
+    {
+        return $this->collection->map(function (Goal $goal) use ($request): array {
+            return (new GoalResource($goal, $this->progressByGoalId[$goal->getKey()]))
+                ->toArray($request);
+        })->all();
+    }
+}

app/Http/Resources/V1/Goal/GoalResource.php

@@ -0,0 +1,90 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources\V1\Goal;
+
+use App\Http\Resources\V1\BaseResource;
+use App\Models\Goal;
+use App\Service\Dto\GoalProgressDto;
+use Illuminate\Http\Request;
+
+/**
+ * @property Goal $resource
+ */
+class GoalResource extends BaseResource
+{
+    private GoalProgressDto $progress;
+
+    public function __construct(Goal $resource, GoalProgressDto $progress)
+    {
+        parent::__construct($resource);
+
+        $this->progress = $progress;
+    }
+
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, string|bool|int|null|array<string, string|bool|int|null|array<int, string>>>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            /** ID of the goal */
+            'id' => $this->resource->id,
+            /** Name */
+            'name' => $this->resource->name,
+            /** personal: a goal a member set for themselves, organization: a goal of the organization (team goals extension) */
+            'type' => $this->resource->type->value,
+            /** Whether the goal is reached with "at least" or "less than" the target time (at_least, less_than) */
+            'comparison' => $this->resource->comparison->value,
+            /** Target time in seconds */
+            'target_seconds' => $this->resource->target_seconds,
+            /** Recurring time frame (day, week, month) */
+            'period' => $this->resource->period->value,
+            /** ID of the member whose time entries count towards the goal, null if every member counts */
+            'member_id' => $this->resource->member_id,
+            /** Name of the member whose time entries count towards the goal, null if every member counts */
+            'member_name' => $this->resource->member?->user->name,
+            /** Timezone that defines the periods of the goal */
+            'timezone' => $this->resource->timezone,
+            /** Week start that defines weekly periods */
+            'week_start' => $this->resource->week_start->value,
+            /** Whether the goal is archived */
+            'is_archived' => $this->resource->is_archived,
+            'filters' => [
+                /** @var array<string>|null $member_ids Filter by member IDs, member IDs are OR combined, only for goals that count every member */
+                'member_ids' => $this->resource->filters->memberIds?->toArray(),
+                /** @var array<string>|null $project_ids Filter by project IDs, project IDs are OR combined */
+                'project_ids' => $this->resource->filters->projectIds?->toArray(),
+                /** @var array<string>|null $task_ids Filter by task IDs, task IDs are OR combined */
+                'task_ids' => $this->resource->filters->taskIds?->toArray(),
+                /** @var array<string>|null $tag_ids Filter by tag IDs, tag IDs are OR combined */
+                'tag_ids' => $this->resource->filters->tagIds?->toArray(),
+                /** Tag match type (contains, not_contains) */
+                'tag_match_type' => $this->resource->filters->tagMatchType?->value,
+                /** @var array<string>|null $client_ids Filter by client IDs, client IDs are OR combined */
+                'client_ids' => $this->resource->filters->clientIds?->toArray(),
+                /** Filter by billable status */
+                'billable' => $this->resource->filters->billable,
+                /** Filter by time entry type (work, break) */
+                'time_entry_type' => $this->resource->filters->timeEntryType?->value,
+            ],
+            'progress' => [
+                /** Start of the current period (inclusive) */
+                'period_start' => $this->formatDateTime($this->progress->periodStart),
+                /** End of the current period (exclusive) */
+                'period_end' => $this->formatDateTime($this->progress->periodEnd),
+                /** Seconds tracked in the current period that match the filters, incl. the running time entry */
+                'tracked_seconds' => $this->progress->trackedSeconds,
+                /** Status in the current period (in_progress, achieved, on_track, exceeded) */
+                'status' => $this->progress->status->value,
+            ],
+            /** Date when the goal was created */
+            'created_at' => $this->formatDateTime($this->resource->created_at),
+            /** Date when the goal was last updated */
+            'updated_at' => $this->formatDateTime($this->resource->updated_at),
+        ];
+    }
+}

app/Http/Resources/V1/Invitation/InvitationCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Invitation;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class InvitationCollection extends ResourceCollection implements PaginatedResourceCollection
+class InvitationCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Invitation/InvitationResource.php

@@ -21,11 +21,11 @@ class InvitationResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of the invitation */
+            /** ID of the invitation */
             'id' => $this->resource->id,
-            /** @var string $email Email */
+            /** Email */
             'email' => $this->resource->email,
-            /** @var string $role Role */
+            /** Role */
             'role' => $this->resource->role,
         ];
     }

app/Http/Resources/V1/Member/MemberCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Member;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class MemberCollection extends ResourceCollection implements PaginatedResourceCollection
+class MemberCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Member/MemberResource.php

@@ -22,19 +22,19 @@ class MemberResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of membership */
+            /** ID of membership */
             'id' => $this->resource->id,
-            /** @var string $id ID of user */
+            /** ID of user */
             'user_id' => $this->resource->user->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->user->name,
-            /** @var string $email Email */
+            /** Email */
             'email' => $this->resource->user->email,
-            /** @var string $role Role */
+            /** Role */
             'role' => $this->resource->role,
-            /** @var bool $is_placeholder Placeholder user for imports, user might not really exist and does not know about this placeholder membership */
+            /** Placeholder user for imports, user might not really exist and does not know about this placeholder membership */
             'is_placeholder' => $this->resource->user->is_placeholder,
-            /** @var int|null $billable_rate Billable rate in cents per hour */
+            /** Billable rate in cents per hour */
             'billable_rate' => $this->resource->billable_rate,
         ];
     }

app/Http/Resources/V1/Member/PersonalMembershipCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Member;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class PersonalMembershipCollection extends ResourceCollection implements PaginatedResourceCollection
+class PersonalMembershipCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Member/PersonalMembershipResource.php

@@ -21,17 +21,17 @@ class PersonalMembershipResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of membership */
+            /** ID of membership */
             'id' => $this->resource->id,
             'organization' => [
-                /** @var string $id ID of organization */
+                /** ID of organization */
                 'id' => $this->resource->organization->id,
-                /** @var string $name Name of organization */
+                /** Name of organization */
                 'name' => $this->resource->organization->name,
-                /** @var string $currency Currency code (ISO 4217) of organization */
+                /** Currency code (ISO 4217) of organization */
                 'currency' => $this->resource->organization->currency,
             ],
-            /** @var string $role Role */
+            /** Role */
             'role' => $this->resource->role,
         ];
     }

app/Http/Resources/V1/Organization/OrganizationResource.php

@@ -11,6 +11,7 @@ use App\Enums\NumberFormat;
 use App\Enums\TimeFormat;
 use App\Http\Resources\V1\BaseResource;
 use App\Models\Organization;
+use App\Service\BillingContract;
 use App\Service\CurrencyService;
 use Illuminate\Http\Request;
 
@@ -43,23 +44,25 @@ class OrganizationResource extends BaseResource
         $currencyService = app(CurrencyService::class);
 
         return [
-            /** @var string $id ID */
+            /** ID */
             'id' => $this->resource->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var bool $color Personal organizations automatically created after registration */
+            /** Personal organizations automatically created after registration */
             'is_personal' => $this->resource->personal_team,
-            /** @var int|null $billable_rate Billable rate in cents per hour */
+            /** Billable rate in cents per hour */
             'billable_rate' => $this->showBillableRate ? $this->resource->billable_rate : null,
-            /** @var bool $employees_can_see_billable_rates Can members of the organization with role "employee" see the billable rates */
+            /** Whether the organization's plan allows billable flags and rates */
+            'can_use_billable_rates' => app(BillingContract::class)->canUseBillableRates($this->resource),
+            /** Can members of the organization with role "employee" see the billable rates */
             'employees_can_see_billable_rates' => $this->resource->employees_can_see_billable_rates,
-            /** @var bool $employees_can_manage_tasks Can members of the organization with role "employee" manage tasks in public projects and projects they are assigned to */
+            /** Can members of the organization with role "employee" manage tasks in public projects and projects they are assigned to */
             'employees_can_manage_tasks' => $this->resource->employees_can_manage_tasks,
-            /** @var bool $prevent_overlapping_time_entries Prevent creating overlapping time entries (only new entries) */
+            /** Prevent creating overlapping time entries (only new entries) */
             'prevent_overlapping_time_entries' => $this->resource->prevent_overlapping_time_entries,
-            /** @var bool $breaks_enabled Whether members of the organization can track breaks */
+            /** Whether members of the organization can track breaks */
             'breaks_enabled' => $this->resource->breaks_enabled,
-            /** @var string $currency Currency code (ISO 4217) */
+            /** Currency code (ISO 4217) */
             'currency' => $this->resource->currency,
             /** @var string $currency_symbol Currency symbol */
             'currency_symbol' => $currencyService->getCurrencySymbol($this->resource->currency),

app/Http/Resources/V1/Project/ProjectCollection.php

@@ -4,12 +4,11 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Project;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use App\Models\Project;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ProjectCollection extends ResourceCollection implements PaginatedResourceCollection
+class ProjectCollection extends ResourceCollection
 {
     private bool $showBillableRates;
 

app/Http/Resources/V1/Project/ProjectResource.php

@@ -30,25 +30,25 @@ class ProjectResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of project */
+            /** ID of project */
             'id' => $this->resource->id,
-            /** @var string $name Name of project */
+            /** Name of project */
             'name' => $this->resource->name,
-            /** @var string $color Color of project */
+            /** Color of project */
             'color' => $this->resource->color,
             /** @var string|null $client_id ID of client */
             'client_id' => $this->resource->client_id,
-            /** @var bool $is_archived Whether the client is archived */
+            /** Whether the client is archived */
             'is_archived' => $this->resource->is_archived,
-            /** @var int|null $billable_rate Billable rate in cents per hour */
+            /** Billable rate in cents per hour */
             'billable_rate' => $this->showBillableRate ? $this->resource->billable_rate : null,
-            /** @var bool $is_billable Project time entries billable default */
+            /** Project time entries billable default */
             'is_billable' => $this->resource->is_billable,
-            /** @var int|null $estimated_time Estimated time in seconds */
+            /** Estimated time in seconds */
             'estimated_time' => $this->resource->estimated_time,
-            /** @var int $spent_time Spent time on this project in seconds (sum of the duration of all associated time entries, excl. still running time entries) */
+            /** Spent time on this project in seconds (sum of the duration of all associated time entries, excl. still running time entries) */
             'spent_time' => $this->resource->spent_time,
-            /** @var bool $is_public Whether the project is public */
+            /** Whether the project is public */
             'is_public' => $this->resource->is_public,
         ];
     }

app/Http/Resources/V1/ProjectMember/ProjectMemberCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\ProjectMember;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ProjectMemberCollection extends ResourceCollection implements PaginatedResourceCollection
+class ProjectMemberCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/ProjectMember/ProjectMemberResource.php

@@ -21,13 +21,13 @@ class ProjectMemberResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of project member */
+            /** ID of project member */
             'id' => $this->resource->id,
-            /** @var int|null $billable_rate Billable rate in cents per hour */
+            /** Billable rate in cents per hour */
             'billable_rate' => $this->resource->billable_rate,
-            /** @var string $member_id ID of the organization member */
+            /** ID of the organization member */
             'member_id' => $this->resource->member_id,
-            /** @var string $project_id ID of the project */
+            /** ID of the project */
             'project_id' => $this->resource->project_id,
         ];
     }

app/Http/Resources/V1/Report/DetailedReportResource.php

@@ -21,36 +21,36 @@ class DetailedReportResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of the report */
+            /** ID of the report */
             'id' => $this->resource->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var string|null $email Description */
+            /** Description */
             'description' => $this->resource->description,
-            /** @var bool $is_public Whether the report can be accessed via an external link */
+            /** Whether the report can be accessed via an external link */
             'is_public' => $this->resource->is_public,
             /** @var string|null $public_until Date until the report is public */
             'public_until' => $this->formatDateTime($this->resource->public_until),
             /** @var string|null $shareable_link Get link to access the report externally, not set if the report is private */
             'shareable_link' => $this->resource->getShareableLink(),
             'properties' => [
-                /** @var string $group Type of first grouping */
+                /** Type of first grouping */
                 'group' => $this->resource->properties->group->value,
-                /** @var string $sub_group Type of second grouping */
+                /** Type of second grouping */
                 'sub_group' => $this->resource->properties->subGroup->value,
-                /** @var string $history_group Type of grouping of the historic aggregation (time chart) */
+                /** Type of grouping of the historic aggregation (time chart) */
                 'history_group' => $this->resource->properties->historyGroup->value,
-                /** @var string $start Start date of the report */
+                /** Start date of the report */
                 'start' => $this->formatDateTime($this->resource->properties->start),
-                /** @var string $end End date of the report */
+                /** End date of the report */
                 'end' => $this->formatDateTime($this->resource->properties->end),
-                /** @var bool|null $active Whether the report is active */
+                /** Whether the report is active */
                 'active' => $this->resource->properties->active,
                 /** @var array<string>|null $member_ids Filter by multiple member IDs, member IDs are OR combined */
                 'member_ids' => $this->resource->properties->memberIds?->toArray(),
-                /** @var bool|null $billable Filter by billable status */
+                /** Filter by billable status */
                 'billable' => $this->resource->properties->billable,
-                /** @var string|null $time_entry_type Filter by time entry type */
+                /** Filter by time entry type */
                 'time_entry_type' => $this->resource->properties->timeEntryType?->value,
                 /** @var array<string>|null $client_ids Filter by client IDs, client IDs are OR combined */
                 'client_ids' => $this->resource->properties->clientIds?->toArray(),
@@ -58,18 +58,18 @@ class DetailedReportResource extends BaseResource
                 'project_ids' => $this->resource->properties->projectIds?->toArray(),
                 /** @var array<string>|null $tags_ids Filter by tag IDs, tag IDs are OR combined */
                 'tag_ids' => $this->resource->properties->tagIds?->toArray(),
-                /** @var string|null $tag_match_type Tag match type */
+                /** Tag match type */
                 'tag_match_type' => $this->resource->properties->tagMatchType?->value,
                 /** @var array<string>|null $task_ids Filter by task IDs, task IDs are OR combined */
                 'task_ids' => $this->resource->properties->taskIds?->toArray(),
-                /** @var string|null $rounding_type Rounding type for time entries */
+                /** Rounding type for time entries */
                 'rounding_type' => $this->resource->properties->roundingType?->value,
-                /** @var int|null $rounding_minutes Rounding minutes for time entries */
+                /** Rounding minutes for time entries */
                 'rounding_minutes' => $this->resource->properties->roundingMinutes,
             ],
-            /** @var string $created_at Date when the report was created */
+            /** Date when the report was created */
             'created_at' => $this->formatDateTime($this->resource->created_at),
-            /** @var string $updated_at Date when the report was last updated */
+            /** Date when the report was last updated */
             'updated_at' => $this->formatDateTime($this->resource->updated_at),
         ];
     }

app/Http/Resources/V1/Report/DetailedWithDataReportResource.php

@@ -73,13 +73,13 @@ class DetailedWithDataReportResource extends BaseResource
         $currencyService = app(CurrencyService::class);
 
         return [
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var string|null $email Description */
+            /** Description */
             'description' => $this->resource->description,
             /** @var string|null $public_until Date until the report is public */
             'public_until' => $this->formatDateTime($this->resource->public_until),
-            /** @var string $currency Currency code (ISO 4217) */
+            /** Currency code (ISO 4217) */
             'currency' => $this->resource->organization->currency,
             /** @var NumberFormat $number_format Number format */
             'number_format' => $this->resource->organization->number_format->value,
@@ -94,15 +94,15 @@ class DetailedWithDataReportResource extends BaseResource
             /** @var TimeFormat $time_format Time format */
             'time_format' => $this->resource->organization->time_format->value,
             'properties' => [
-                /** @var string $group Type of first grouping */
+                /** Type of first grouping */
                 'group' => $this->resource->properties->group->value,
-                /** @var string $sub_group Type of second grouping */
+                /** Type of second grouping */
                 'sub_group' => $this->resource->properties->subGroup->value,
-                /** @var string $history_group Type of grouping of the historic aggregation (time chart) */
+                /** Type of grouping of the historic aggregation (time chart) */
                 'history_group' => $this->resource->properties->historyGroup->value,
-                /** @var string $start Start date of the report */
+                /** Start date of the report */
                 'start' => $this->formatDateTime($this->resource->properties->start),
-                /** @var string $end End date of the report */
+                /** End date of the report */
                 'end' => $this->formatDateTime($this->resource->properties->end),
             ],
             /** @var array{

app/Http/Resources/V1/Report/ReportCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Report;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ReportCollection extends ResourceCollection implements PaginatedResourceCollection
+class ReportCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Report/ReportResource.php

@@ -21,21 +21,21 @@ class ReportResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of the report */
+            /** ID of the report */
             'id' => $this->resource->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var string|null $email Description */
+            /** Description */
             'description' => $this->resource->description,
-            /** @var bool $is_public Whether the report can be accessed via an external link */
+            /** Whether the report can be accessed via an external link */
             'is_public' => $this->resource->is_public,
             /** @var string|null $public_until Date until the report is public */
             'public_until' => $this->formatDateTime($this->resource->public_until),
             /** @var string|null $shareable_link Get link to access the report externally, not set if the report is private */
             'shareable_link' => $this->resource->getShareableLink(),
-            /** @var string $created_at Date when the report was created */
+            /** Date when the report was created */
             'created_at' => $this->formatDateTime($this->resource->created_at),
-            /** @var string $updated_at Date when the report was last updated */
+            /** Date when the report was last updated */
             'updated_at' => $this->formatDateTime($this->resource->updated_at),
         ];
     }

app/Http/Resources/V1/Tag/TagCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Tag;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TagCollection extends ResourceCollection implements PaginatedResourceCollection
+class TagCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Tag/TagResource.php

@@ -21,13 +21,13 @@ class TagResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID */
+            /** ID */
             'id' => $this->resource->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var string $created_at When the tag was created */
+            /** When the tag was created */
             'created_at' => $this->formatDateTime($this->resource->created_at),
-            /** @var string $updated_at When the tag was last updated */
+            /** When the tag was last updated */
             'updated_at' => $this->formatDateTime($this->resource->updated_at),
         ];
     }

app/Http/Resources/V1/Task/TaskCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Task;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TaskCollection extends ResourceCollection implements PaginatedResourceCollection
+class TaskCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Task/TaskResource.php

@@ -22,21 +22,21 @@ class TaskResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID */
+            /** ID */
             'id' => $this->resource->id,
-            /** @var string $name Name */
+            /** Name */
             'name' => $this->resource->name,
-            /** @var bool $is_done Whether the task is done */
+            /** Whether the task is done */
             'is_done' => $this->resource->is_done,
-            /** @var string $project_id ID of the project */
+            /** ID of the project */
             'project_id' => $this->resource->project_id,
-            /** @var int|null $estimated_time Estimated time in seconds */
+            /** Estimated time in seconds */
             'estimated_time' => $this->resource->estimated_time,
-            /** @var int $spent_time Spent time on this task in seconds (sum of the duration of all associated time entries, excl. still running time entries) */
+            /** Spent time on this task in seconds (sum of the duration of all associated time entries, excl. still running time entries) */
             'spent_time' => $this->resource->spent_time,
-            /** @var string $created_at When the tag was created */
+            /** When the tag was created */
             'created_at' => $this->formatDateTime($this->resource->created_at),
-            /** @var string $updated_at When the tag was last updated */
+            /** When the tag was last updated */
             'updated_at' => $this->formatDateTime($this->resource->updated_at),
         ];
     }

app/Http/Resources/V1/TimeEntry/TimeEntryCollection.php

@@ -4,10 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\TimeEntry;
 
-use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TimeEntryCollection extends ResourceCollection implements PaginatedResourceCollection
+class TimeEntryCollection extends ResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/TimeEntry/TimeEntryResource.php

@@ -21,10 +21,10 @@ class TimeEntryResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of time entry */
+            /** ID of time entry */
             'id' => $this->resource->id,
             /**
-             * @var string $start Start of time entry (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z)
+             * Start of time entry (ISO 8601 format, UTC timezone, example: 2024-02-26T17:17:17Z)
              */
             'start' => $this->formatDateTime($this->resource->start),
             /**
@@ -35,19 +35,19 @@ class TimeEntryResource extends BaseResource
             'duration' => (int) $this->resource->getDuration()?->totalSeconds,
             /** @var string|null $description Description of time entry */
             'description' => $this->resource->description,
-            /** @var string|null $task_id ID of task */
+            /** ID of task */
             'task_id' => $this->resource->task_id,
-            /** @var string|null $project_id ID of project */
+            /** ID of project */
             'project_id' => $this->resource->project_id,
-            /** @var string $organization_id ID of organization */
+            /** ID of organization */
             'organization_id' => $this->resource->organization_id,
-            /** @var string $user_id ID of user */
+            /** ID of user */
             'user_id' => $this->resource->user_id,
-            /** @var array<string> $tags List of tag IDs */
+            /** List of tag IDs */
             'tags' => $this->resource->tags ?? [],
-            /** @var bool $billable Whether time entry is billable */
+            /** Whether time entry is billable */
             'billable' => $this->resource->billable,
-            /** @var string $type Type of the time entry (`work` time or a `break`) */
+            /** Type of the time entry (`work` time or a `break`) */
             'type' => $this->resource->type->value,
         ];
     }

app/Http/Resources/V1/User/UserResource.php

@@ -22,21 +22,21 @@ class UserResource extends BaseResource
     public function toArray(Request $request): array
     {
         return [
-            /** @var string $id ID of user */
+            /** ID of user */
             'id' => $this->resource->id,
-            /** @var string $name Name of user */
+            /** Name of user */
             'name' => $this->resource->name,
-            /** @var string $email Email of user */
+            /** Email of user */
             'email' => $this->resource->email,
-            /** @var string|null $pending_email Email address awaiting verification (set when the user has requested an email change but not yet verified the new address) */
+            /** Email address awaiting verification (set when the user has requested an email change but not yet verified the new address) */
             'pending_email' => $this->resource->pending_email,
-            /** @var string $profile_photo_url Profile photo URL */
+            /** Profile photo URL */
             'profile_photo_url' => $this->resource->profile_photo_url,
-            /** @var string $timezone Timezone (f.e. Europe/Berlin or America/New_York) */
+            /** Timezone (f.e. Europe/Berlin or America/New_York) */
             'timezone' => $this->resource->timezone,
             /** @var Weekday $week_start Starting day of the week */
             'week_start' => $this->resource->week_start->value,
-            /** @var bool $send_time_entry_still_running_email Whether to email the user when a time entry has been running for more than 8 hours */
+            /** Whether to email the user when a time entry has been running for more than 8 hours */
             'send_time_entry_still_running_email' => $this->resource->send_time_entry_still_running_email,
         ];
     }

app/Models/Audit.php

@@ -4,15 +4,19 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Concerns\AuditableWithoutOwner;
 use Database\Factories\AuditFactory;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Carbon;
 use OwenIt\Auditing\Models\Audit as PackageAuditModel;
 
 /**
  * @property int $id
- * @property string|null $user_type
- * @property string|null $user_id
+ * @property string|null $actor_type
+ * @property string|null $actor_id
  * @property string $event
  * @property string $auditable_type
  * @property string $auditable_id
@@ -22,13 +26,71 @@ use OwenIt\Auditing\Models\Audit as PackageAuditModel;
  * @property string|null $ip_address
  * @property string|null $user_agent
  * @property string|null $tags
+ * @property string|null $owner_user_id
+ * @property string|null $owner_organization_id
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
+ * @property-read User|null $ownerUser
+ * @property-read Organization|null $ownerOrganization
  *
  * @method static AuditFactory factory()
+ * @method static Builder<Audit> whereMissingOwner()
  */
 class Audit extends PackageAuditModel
 {
     /** @use HasFactory<AuditFactory> */
     use HasFactory;
+
+    /**
+     * @return BelongsTo<User, $this>
+     */
+    public function ownerUser(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'owner_user_id');
+    }
+
+    /**
+     * @return BelongsTo<Organization, $this>
+     */
+    public function ownerOrganization(): BelongsTo
+    {
+        return $this->belongsTo(Organization::class, 'owner_organization_id');
+    }
+
+    /**
+     * Whether audits of the given auditable type intentionally have no owner (see AuditableWithoutOwner).
+     */
+    public static function isAuditableTypeWithoutOwner(string $auditableType): bool
+    {
+        $modelClass = Relation::getMorphedModel($auditableType) ?? $auditableType;
+
+        return is_subclass_of($modelClass, AuditableWithoutOwner::class);
+    }
+
+    /**
+     * Auditable types (morph aliases) whose audits intentionally have no owner (see AuditableWithoutOwner).
+     *
+     * @return array<int, string>
+     */
+    public static function getAuditableTypesWithoutOwner(): array
+    {
+        return collect(Relation::morphMap())
+            ->filter(fn (string $modelClass): bool => is_subclass_of($modelClass, AuditableWithoutOwner::class))
+            ->keys()
+            ->values()
+            ->all();
+    }
+
+    /**
+     * Audits that have neither an owner organization nor an owner user, although their auditable type should have one.
+     * These are audits whose owner no longer exists or could not be determined (yet).
+     *
+     * @param  Builder<Audit>  $builder
+     */
+    public function scopeWhereMissingOwner(Builder $builder): void
+    {
+        $builder->whereNull('owner_organization_id')
+            ->whereNull('owner_user_id')
+            ->whereNotIn('auditable_type', self::getAuditableTypesWithoutOwner());
+    }
 }

app/Models/Concerns/AuditableThroughParent.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Concerns;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Marks an auditable model whose audits are owned by the owner of its parent model,
+ * because the model itself has no organization_id (for example a project member belongs to an organization via its project).
+ * The parent model has to have an organization_id column.
+ * This is used to set the owner of new audits (CustomAuditable) and to backfill the owner of existing audits.
+ */
+interface AuditableThroughParent
+{
+    /**
+     * @return BelongsTo<covariant Model, covariant Model>
+     */
+    public function getAuditParentRelation(): BelongsTo;
+}

app/Models/Concerns/AuditableWithoutOwner.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Concerns;
+
+/**
+ * Marks an auditable model whose audits intentionally have no owner (neither an organization nor a user),
+ * either because the model belongs to neither of them, or because the model and its audits have to be kept
+ * when its organization or user is deleted (for example billing records).
+ * Audits of these models are not deleted together with an organization or user,
+ * and are not considered as missing an owner (for example by the audit backfill command).
+ */
+interface AuditableWithoutOwner {}

app/Models/Concerns/CustomAuditable.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Models\Concerns;
 
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Config;
 use OwenIt\Auditing\Auditable;
 
 trait CustomAuditable
@@ -19,4 +21,92 @@ trait CustomAuditable
     {
         $this->auditEvents = [];
     }
+
+    /**
+     * The organization that owns the audited model.
+     * The audits of the model are deleted (via foreign key cascade) when the organization is deleted.
+     */
+    public function getAuditOwnerOrganizationId(): ?string
+    {
+        if ($this instanceof AuditableThroughParent) {
+            $relation = $this->getAuditParentRelation();
+            $parentId = $this->getAttributes()[$relation->getForeignKeyName()] ?? null;
+            if ($parentId === null) {
+                return null;
+            }
+
+            // Note: The loaded parent is only used if it still matches the foreign key and was loaded with the organization
+            $relationName = $relation->getRelationName();
+            if ($this->relationLoaded($relationName)) {
+                $parent = $this->getRelation($relationName);
+                if ($parent instanceof Model
+                    && $parent->getAttribute($relation->getOwnerKeyName()) === $parentId
+                    && array_key_exists('organization_id', $parent->getAttributes())) {
+                    /** @var string|null $organizationId */
+                    $organizationId = $parent->getAttributes()['organization_id'];
+
+                    return $organizationId;
+                }
+            }
+
+            /** @var string|null $organizationId */
+            $organizationId = $relation->getRelated()->newQuery()
+                ->toBase()
+                ->where($relation->getOwnerKeyName(), $parentId)
+                ->value('organization_id');
+
+            return $organizationId;
+        }
+
+        return $this->getAttributes()['organization_id'] ?? null;
+    }
+
+    /**
+     * The user that owns the audited model.
+     * The audits of the model are deleted (via foreign key cascade) when the user is deleted.
+     */
+    public function getAuditOwnerUserId(): ?string
+    {
+        return null;
+    }
+
+    /**
+     * Models that are the owner of their own audits can not record the deletion audit,
+     * since the audit would reference the already deleted model and therefore violate the foreign key.
+     */
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return false;
+    }
+
+    /**
+     * @return array<int|string, string>
+     */
+    public function getAuditEvents(): array
+    {
+        $events = $this->auditEvents ?? Config::get('audit.events', [
+            'created',
+            'updated',
+            'deleted',
+            'restored',
+        ]);
+
+        if ($this->isAuditOwnerOfItself()) {
+            $events = array_filter($events, fn (string $value, int|string $key): bool => (is_int($key) ? $value : $key) !== 'deleted', ARRAY_FILTER_USE_BOTH);
+        }
+
+        return $events;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    public function transformAudit(array $data): array
+    {
+        $data['owner_organization_id'] = $this->getAuditOwnerOrganizationId();
+        $data['owner_user_id'] = $this->getAuditOwnerUserId();
+
+        return $data;
+    }
 }

app/Models/Goal.php

@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use App\Enums\GoalComparison;
+use App\Enums\GoalPeriod;
+use App\Enums\GoalType;
+use App\Enums\Weekday;
+use App\Models\Concerns\HasUuids;
+use App\Service\Dto\GoalFiltersDto;
+use Database\Factories\GoalFactory;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Casts\Attribute;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Carbon;
+
+/**
+ * @property string $id
+ * @property string $name
+ * @property GoalType $type
+ * @property GoalComparison $comparison
+ * @property int $target_seconds
+ * @property GoalPeriod $period
+ * @property GoalFiltersDto $filters
+ * @property string $timezone
+ * @property Weekday $week_start
+ * @property Carbon|null $archived_at
+ * @property-read bool $is_archived
+ * @property string $organization_id
+ * @property string|null $member_id
+ * @property Carbon|null $created_at
+ * @property Carbon|null $updated_at
+ * @property-read Organization $organization
+ * @property-read Member|null $member
+ *
+ * @method static GoalFactory factory()
+ */
+class Goal extends Model
+{
+    /** @use HasFactory<GoalFactory> */
+    use HasFactory;
+
+    use HasUuids;
+
+    /**
+     * The attributes that should be cast.
+     *
+     * @var array<string, string>
+     */
+    protected $casts = [
+        'type' => GoalType::class,
+        'comparison' => GoalComparison::class,
+        'target_seconds' => 'int',
+        'period' => GoalPeriod::class,
+        'filters' => GoalFiltersDto::class,
+        'week_start' => Weekday::class,
+        'archived_at' => 'datetime',
+    ];
+
+    /**
+     * @return BelongsTo<Organization, $this>
+     */
+    public function organization(): BelongsTo
+    {
+        return $this->belongsTo(Organization::class, 'organization_id');
+    }
+
+    /**
+     * The member whose time entries count towards the goal, null for goals that count every member.
+     *
+     * @return BelongsTo<Member, $this>
+     */
+    public function member(): BelongsTo
+    {
+        return $this->belongsTo(Member::class, 'member_id');
+    }
+
+    public function isPersonalGoalOf(Member $member): bool
+    {
+        return $this->type === GoalType::Personal && $this->member_id === $member->getKey();
+    }
+
+    /**
+     * @return Attribute<bool, never>
+     */
+    protected function isArchived(): Attribute
+    {
+        return Attribute::make(
+            get: fn (mixed $value, array $attributes) => isset($attributes['archived_at']),
+        );
+    }
+
+    /**
+     * @param  Builder<Goal>  $builder
+     * @return Builder<Goal>
+     */
+    public function scopeArchived(Builder $builder): Builder
+    {
+        return $builder->whereNotNull('archived_at');
+    }
+
+    /**
+     * @param  Builder<Goal>  $builder
+     * @return Builder<Goal>
+     */
+    public function scopeNotArchived(Builder $builder): Builder
+    {
+        return $builder->whereNull('archived_at');
+    }
+}

app/Models/Member.php

@@ -28,6 +28,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @property-read User $user
  * @property-read Collection<int, ProjectMember> $projectMembers
  * @property-read Collection<int, TimeEntry> $timeEntries
+ * @property-read Collection<int, Goal> $goals
  *
  * @method static MemberFactory factory()
  */
@@ -78,4 +79,14 @@ class Member extends Pivot implements AuditableContract
     {
         return $this->hasMany(ProjectMember::class, 'member_id');
     }
+
+    /**
+     * Goals whose progress counts the time entries of this member.
+     *
+     * @return HasMany<Goal, $this>
+     */
+    public function goals(): HasMany
+    {
+        return $this->hasMany(Goal::class, 'member_id');
+    }
 }

app/Models/Organization.php

@@ -96,6 +96,16 @@ class Organization extends Model implements AuditableContract
     protected $attributes = [
     ];
 
+    public function getAuditOwnerOrganizationId(): ?string
+    {
+        return $this->getKey();
+    }
+
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return true;
+    }
+
     /**
      * Get all the users that belong to the team.
      *

app/Models/ProjectMember.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Models\Concerns\AuditableThroughParent;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
 use Database\Factories\ProjectMemberFactory;
@@ -29,7 +30,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @method static Builder<ProjectMember> whereBelongsToOrganization(Organization $organization)
  * @method static ProjectMemberFactory factory()
  */
-class ProjectMember extends Model implements AuditableContract
+class ProjectMember extends Model implements AuditableContract, AuditableThroughParent
 {
     use CustomAuditable;
 
@@ -82,4 +83,12 @@ class ProjectMember extends Model implements AuditableContract
             $query->whereBelongsTo($organization, 'organization');
         });
     }
+
+    /**
+     * @return BelongsTo<Project, $this>
+     */
+    public function getAuditParentRelation(): BelongsTo
+    {
+        return $this->project();
+    }
 }

app/Models/User.php

@@ -124,6 +124,16 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
         'send_time_entry_still_running_email' => true,
     ];
 
+    public function getAuditOwnerUserId(): ?string
+    {
+        return $this->getKey();
+    }
+
+    protected function isAuditOwnerOfItself(): bool
+    {
+        return true;
+    }
+
     /**
      * Get the URL to the user's profile photo.
      *

app/Providers/AppServiceProvider.php

@@ -17,6 +17,7 @@ use App\Models\Task;
 use App\Models\TimeEntry;
 use App\Models\User;
 use App\Service\BillingContract;
+use App\Service\GoalsContract;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\IpLookup\NoIpLookupService;
 use App\Service\PermissionStore;
@@ -103,6 +104,7 @@ class AppServiceProvider extends ServiceProvider
         // Extensions
         $this->app->bind(IpLookupServiceContract::class, NoIpLookupService::class);
         $this->app->bind(BillingContract::class);
+        $this->app->bind(GoalsContract::class);
 
         // Storage
         // The local driver ignores the ResponseContentDisposition option of temporaryUrl,

app/Service/BillableRateService.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Service;
 
+use App\Enums\Role;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\Project;
@@ -13,6 +14,24 @@ use Illuminate\Database\Eloquent\Builder;
 
 class BillableRateService
 {
+    public function __construct(
+        private BillingContract $billing,
+    ) {}
+
+    public function canUseBillableRates(Organization $organization): bool
+    {
+        return $this->billing->canUseBillableRates($organization);
+    }
+
+    public function canSeeBillableRates(Organization $organization, Member $member): bool
+    {
+        if (! $this->canUseBillableRates($organization)) {
+            return false;
+        }
+
+        return $member->role !== Role::Employee->value || $organization->employees_can_see_billable_rates;
+    }
+
     public function updateTimeEntriesBillableRateForProjectMember(ProjectMember $projectMember): void
     {
         TimeEntry::query()

app/Service/BillingContract.php

@@ -43,6 +43,15 @@ class BillingContract
         return null;
     }
 
+    /**
+     * The maximum number of goals the organization can have; null means unlimited.
+     * Archived goals count toward the limit.
+     */
+    public function getGoalLimit(Organization $organization): ?int
+    {
+        return null;
+    }
+
     /**
      * Check if the organization is blocked
      * A blocked organization is an organization that has more than 1 non-placeholder member but no subscription/trial
@@ -54,4 +63,13 @@ class BillingContract
     {
         return false;
     }
+
+    /**
+     * Check if the organization can set and see billable rates
+     * Without a billing system every organization can use billable rates
+     */
+    public function canUseBillableRates(Organization $organization): bool
+    {
+        return true;
+    }
 }

app/Service/DeletionService.php

@@ -8,9 +8,11 @@ use App\Enums\Role;
 use App\Events\BeforeOrganizationDeletion;
 use App\Exceptions\Api\CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembers;
 use App\Models\Client;
+use App\Models\Goal;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
+use App\Models\Passport\RefreshToken;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -75,6 +77,9 @@ class DeletionService
         // Delete all reports
         Report::query()->whereBelongsTo($organization, 'organization')->delete();
 
+        // Delete all goals
+        Goal::query()->whereBelongsTo($organization, 'organization')->delete();
+
         // Reset the current organization
         $organization->owner()
             ->where('current_team_id', $organization->getKey())
@@ -169,6 +174,10 @@ class DeletionService
             }
         }
 
+        // Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
+        // Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
+        // which fails with a foreign key violation on oauth_access_tokens.user_id.
+        RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
         $user->accessTokens()->delete();
         $user->authCodes()->delete();
 

app/Service/Dto/GoalFiltersDto.php

@@ -0,0 +1,169 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service\Dto;
+
+use App\Enums\TagMatchType;
+use App\Enums\TimeEntryType;
+use App\Service\TimeEntryFilter;
+use Illuminate\Contracts\Database\Eloquent\Castable;
+use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+
+/**
+ * Persisted filter set of a goal. Defines which time entries count towards the goal.
+ * A null value means "no restriction" for that dimension. The ID setters store an empty array as null,
+ * so "no restriction" has a single representation.
+ */
+class GoalFiltersDto implements Castable
+{
+    /**
+     * Members whose time entries count. Only used by goals that count every member, null means every member.
+     *
+     * @var Collection<int, string>|null
+     */
+    public ?Collection $memberIds = null;
+
+    /**
+     * @var Collection<int, string>|null
+     */
+    public ?Collection $projectIds = null;
+
+    /**
+     * @var Collection<int, string>|null
+     */
+    public ?Collection $taskIds = null;
+
+    /**
+     * @var Collection<int, string>|null
+     */
+    public ?Collection $tagIds = null;
+
+    public ?TagMatchType $tagMatchType = null;
+
+    /**
+     * @var Collection<int, string>|null
+     */
+    public ?Collection $clientIds = null;
+
+    public ?bool $billable = null;
+
+    public ?TimeEntryType $timeEntryType = null;
+
+    /**
+     * Get the caster class to use when casting from / to this cast target.
+     *
+     * @param  array<string, mixed>  $arguments
+     * @return CastsAttributes<GoalFiltersDto, GoalFiltersDto>
+     */
+    public static function castUsing(array $arguments): CastsAttributes
+    {
+        return new class implements CastsAttributes
+        {
+            private const array REQUIRED_PROPERTIES = [
+                'memberIds',
+                'projectIds',
+                'taskIds',
+                'tagIds',
+                'tagMatchType',
+                'clientIds',
+                'billable',
+                'timeEntryType',
+            ];
+
+            public function get(Model $model, string $key, mixed $value, array $attributes): GoalFiltersDto
+            {
+                if (! is_string($value)) {
+                    throw new \InvalidArgumentException('The given value is not a string');
+                }
+                $data = json_decode($value, false);
+                if (! is_object($data)) {
+                    throw new \InvalidArgumentException('The given value is not a JSON object string');
+                }
+                foreach (self::REQUIRED_PROPERTIES as $property) {
+                    if (! property_exists($data, $property)) {
+                        throw new \InvalidArgumentException('The given JSON string does not contain the required property "'.$property.'"');
+                    }
+                }
+                $dto = new GoalFiltersDto;
+                $dto->setMemberIds(isset($data->memberIds) ? (array) $data->memberIds : null);
+                $dto->setProjectIds(isset($data->projectIds) ? (array) $data->projectIds : null);
+                $dto->setTaskIds(isset($data->taskIds) ? (array) $data->taskIds : null);
+                $dto->setTagIds(isset($data->tagIds) ? (array) $data->tagIds : null);
+                $dto->tagMatchType = isset($data->tagMatchType) ? TagMatchType::from($data->tagMatchType) : null;
+                $dto->setClientIds(isset($data->clientIds) ? (array) $data->clientIds : null);
+                $dto->billable = isset($data->billable) ? (bool) $data->billable : null;
+                $dto->timeEntryType = isset($data->timeEntryType) ? TimeEntryType::from($data->timeEntryType) : null;
+
+                return $dto;
+            }
+
+            public function set(Model $model, string $key, mixed $value, array $attributes): string
+            {
+                if (! ($value instanceof GoalFiltersDto)) {
+                    throw new \InvalidArgumentException('The given value is not an instance of GoalFiltersDto');
+                }
+
+                $data = (object) [
+                    'memberIds' => $value->memberIds?->toArray(),
+                    'projectIds' => $value->projectIds?->toArray(),
+                    'taskIds' => $value->taskIds?->toArray(),
+                    'tagIds' => $value->tagIds?->toArray(),
+                    'tagMatchType' => $value->tagMatchType?->value,
+                    'clientIds' => $value->clientIds?->toArray(),
+                    'billable' => $value->billable,
+                    'timeEntryType' => $value->timeEntryType?->value,
+                ];
+
+                $jsonString = json_encode($data);
+                if ($jsonString === false) {
+                    throw new \InvalidArgumentException('Could not encode the given data to a JSON string');
+                }
+
+                return $jsonString;
+            }
+        };
+    }
+
+    /**
+     * @param  array<mixed>|null  $memberIds
+     */
+    public function setMemberIds(?array $memberIds): void
+    {
+        $this->memberIds = $memberIds !== null && count($memberIds) > 0 ? TimeEntryFilter::idArrayToCollection($memberIds) : null;
+    }
+
+    /**
+     * @param  array<mixed>|null  $projectIds
+     */
+    public function setProjectIds(?array $projectIds): void
+    {
+        $this->projectIds = $projectIds !== null && count($projectIds) > 0 ? TimeEntryFilter::idArrayToCollection($projectIds) : null;
+    }
+
+    /**
+     * @param  array<mixed>|null  $taskIds
+     */
+    public function setTaskIds(?array $taskIds): void
+    {
+        $this->taskIds = $taskIds !== null && count($taskIds) > 0 ? TimeEntryFilter::idArrayToCollection($taskIds) : null;
+    }
+
+    /**
+     * @param  array<mixed>|null  $tagIds
+     */
+    public function setTagIds(?array $tagIds): void
+    {
+        $this->tagIds = $tagIds !== null && count($tagIds) > 0 ? TimeEntryFilter::idArrayToCollection($tagIds) : null;
+    }
+
+    /**
+     * @param  array<mixed>|null  $clientIds
+     */
+    public function setClientIds(?array $clientIds): void
+    {
+        $this->clientIds = $clientIds !== null && count($clientIds) > 0 ? TimeEntryFilter::idArrayToCollection($clientIds) : null;
+    }
+}

app/Service/Dto/GoalProgressDto.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service\Dto;
+
+use App\Enums\GoalStatus;
+use Illuminate\Support\Carbon;
+
+readonly class GoalProgressDto
+{
+    /**
+     * @param  Carbon  $periodStart  Start of the period in UTC (inclusive)
+     * @param  Carbon  $periodEnd  End of the period in UTC (exclusive)
+     */
+    public function __construct(
+        public Carbon $periodStart,
+        public Carbon $periodEnd,
+        public int $trackedSeconds,
+        public GoalStatus $status,
+    ) {}
+}

app/Service/Dto/ReportPropertiesDto.php

@@ -16,7 +16,6 @@ use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Collection;
-use Illuminate\Support\Str;
 use InvalidArgumentException;
 
 class ReportPropertiesDto implements Castable
@@ -117,13 +116,13 @@ class ReportPropertiesDto implements Castable
                 $dto->end = $data->end !== null ? Carbon::createFromFormat('Y-m-d\TH:i:s\Z', $data->end) : null;
                 $dto->start = $data->start !== null ? Carbon::createFromFormat('Y-m-d\TH:i:s\Z', $data->start) : null;
                 $dto->active = $data->active;
-                $dto->memberIds = $data->memberIds !== null ? ReportPropertiesDto::idArrayToCollection($data->memberIds) : null;
+                $dto->setMemberIds($data->memberIds !== null ? (array) $data->memberIds : null);
                 $dto->billable = $data->billable;
-                $dto->clientIds = $data->clientIds !== null ? ReportPropertiesDto::idArrayToCollection($data->clientIds) : null;
-                $dto->projectIds = $data->projectIds !== null ? ReportPropertiesDto::idArrayToCollection($data->projectIds) : null;
-                $dto->tagIds = $data->tagIds !== null ? ReportPropertiesDto::idArrayToCollection($data->tagIds) : null;
+                $dto->setClientIds($data->clientIds !== null ? (array) $data->clientIds : null);
+                $dto->setProjectIds($data->projectIds !== null ? (array) $data->projectIds : null);
+                $dto->setTagIds($data->tagIds !== null ? (array) $data->tagIds : null);
                 $dto->tagMatchType = isset($data->tagMatchType) ? TagMatchType::from($data->tagMatchType) : null;
-                $dto->taskIds = $data->taskIds ? ReportPropertiesDto::idArrayToCollection($data->taskIds) : null;
+                $dto->setTaskIds($data->taskIds !== null ? (array) $data->taskIds : null);
                 $dto->group = TimeEntryAggregationType::from($data->group);
                 $dto->subGroup = TimeEntryAggregationType::from($data->subGroup);
                 $dto->historyGroup = TimeEntryAggregationTypeInterval::from($data->historyGroup);
@@ -180,32 +179,12 @@ class ReportPropertiesDto implements Castable
         };
     }
 
-    /**
-     * @param  array<mixed>  $ids
-     * @return Collection<int, string>
-     */
-    public static function idArrayToCollection(array $ids): Collection
-    {
-        $collection = new Collection;
-        foreach ($ids as $id) {
-            if (! is_string($id)) {
-                throw new InvalidArgumentException('The given ID is not a string');
-            }
-            if ($id !== TimeEntryFilter::NONE_VALUE && ! Str::isUuid($id)) {
-                throw new InvalidArgumentException('The given ID is not a valid UUID');
-            }
-            $collection->push($id);
-        }
-
-        return $collection;
-    }
-
     /**
      * @param  array<mixed>|null  $memberIds
      */
     public function setMemberIds(?array $memberIds): void
     {
-        $this->memberIds = $memberIds !== null ? ReportPropertiesDto::idArrayToCollection($memberIds) : null;
+        $this->memberIds = $memberIds !== null && count($memberIds) > 0 ? TimeEntryFilter::idArrayToCollection($memberIds) : null;
     }
 
     /**
@@ -213,7 +192,7 @@ class ReportPropertiesDto implements Castable
      */
     public function setClientIds(?array $clientIds): void
     {
-        $this->clientIds = $clientIds !== null ? ReportPropertiesDto::idArrayToCollection($clientIds) : null;
+        $this->clientIds = $clientIds !== null && count($clientIds) > 0 ? TimeEntryFilter::idArrayToCollection($clientIds) : null;
     }
 
     /**
@@ -221,7 +200,7 @@ class ReportPropertiesDto implements Castable
      */
     public function setProjectIds(?array $projectIds): void
     {
-        $this->projectIds = $projectIds !== null ? ReportPropertiesDto::idArrayToCollection($projectIds) : null;
+        $this->projectIds = $projectIds !== null && count($projectIds) > 0 ? TimeEntryFilter::idArrayToCollection($projectIds) : null;
     }
 
     /**
@@ -229,7 +208,7 @@ class ReportPropertiesDto implements Castable
      */
     public function setTagIds(?array $tagIds): void
     {
-        $this->tagIds = $tagIds !== null ? ReportPropertiesDto::idArrayToCollection($tagIds) : null;
+        $this->tagIds = $tagIds !== null && count($tagIds) > 0 ? TimeEntryFilter::idArrayToCollection($tagIds) : null;
     }
 
     public function setTagMatchType(?TagMatchType $tagMatchType): void
@@ -242,6 +221,6 @@ class ReportPropertiesDto implements Castable
      */
     public function setTaskIds(?array $taskIds): void
     {
-        $this->taskIds = $taskIds !== null ? ReportPropertiesDto::idArrayToCollection($taskIds) : null;
+        $this->taskIds = $taskIds !== null && count($taskIds) > 0 ? TimeEntryFilter::idArrayToCollection($taskIds) : null;
     }
 }