Updated Laravel to v13

- Default INERTIA_SSR_ENABLED to false to match .env.example, .env.ci and
  .env.production, so existing setups keep the previous behaviour.
- Stop tracking the published Filament assets under /public/fonts/filament and
  add them to .gitignore, as recommended by the Filament docs. They are
  regenerated by filament:assets via the filament:upgrade post-autoload-dump
  hook. /public/css and /public/js are already ignored.
- Drop the now dead theme.css filter from the Vite asset list in app.blade.php,
  since the custom Filament theme was removed along with viteTheme().

.github/workflows/build-onpremise.yml

@@ -103,8 +103,6 @@ jobs:
           {
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
-            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
-            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout invoicing extension"
@@ -121,26 +119,9 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
-      - name: "Checkout auditing extension"
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
-          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
-          path: extensions/Auditing
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
-
-      - name: "Install composer dependencies in auditing extension"
-        run: cd extensions/Auditing && composer install --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
-
-      - name: "Install npm dependencies in auditing extension"
-        run: cd extensions/Auditing && npm ci
-
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
-      - name: "Activate auditing extension"
-        run: php artisan module:enable Auditing
-
       - name: "Install npm dependencies"
         run: npm ci
 

.github/workflows/build-private.yml

@@ -84,8 +84,6 @@ jobs:
             echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
             echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
             echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
-            echo "auditing_repository=$(jq -r '.Auditing.repository' extensions/manifest.json)"
-            echo "auditing_ref=$(jq -r '.Auditing.ref' extensions/manifest.json)"
           } >> "$GITHUB_OUTPUT"
 
       - name: "Checkout billing extension"
@@ -147,25 +145,6 @@ jobs:
       - name: "Install npm dependencies in invoicing extension"
         run: cd extensions/Invoicing && npm ci
 
-      - name: "Checkout auditing extension"
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.auditing_repository }}
-          ref: ${{ steps.extension-manifest.outputs.auditing_ref }}
-          path: extensions/Auditing
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_AUDITING_EXTENSION }}
-
-      - name: "Install composer dependencies in auditing extension"
-        uses: php-actions/composer@v6
-        with:
-          working_dir: "extensions/Auditing"
-          command: install
-          only_args: --no-dev --no-ansi --no-interaction --prefer-dist --ignore-platform-reqs --classmap-authoritative
-          php_version: 8.3
-
-      - name: "Install npm dependencies in auditing extension"
-        run: cd extensions/Auditing && npm ci
-
       - name: "Setup PHP with PECL extension"
         uses: shivammathur/setup-php@v2
         with:
@@ -189,9 +168,6 @@ jobs:
       - name: "Activate invoicing extension"
         run: php artisan module:enable Invoicing
 
-      - name: "Activate auditing extension"
-        run: php artisan module:enable Auditing
-
       - name: "Install npm dependencies"
         run: npm ci
 

.github/workflows/npm-format-check.yml

@@ -1,8 +1,6 @@
 name: NPM Format Check
 
 on: [push]
-permissions:
-  contents: read
 
 jobs:
   format-check:

.github/workflows/playwright-extensions.yml

@@ -1,185 +0,0 @@
-name: Playwright Tests - Extensions
-on: push
-permissions:
-  contents: read
-jobs:
-  test:
-    name: test (${{ matrix.variant }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-
-    # Same extension sets as build-private.yml and build-onpremise.yml, so the extension specs run
-    # with and without Billing.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - variant: private
-            billing: true
-            extensions: Billing Services Invoicing
-          - variant: onpremise
-            billing: false
-            extensions: Invoicing
-
-    services:
-      mailpit:
-        image: 'axllent/mailpit:latest'
-        ports:
-          - 1025:1025
-          - 8025:8025
-      pgsql_test:
-        image: postgres:15
-        env:
-          PGPASSWORD: 'root'
-          POSTGRES_DB: 'laravel'
-          POSTGRES_USER: 'root'
-          POSTGRES_PASSWORD: 'root'
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      gotenberg:
-        image: gotenberg/gotenberg:8
-        ports:
-          - 3000:3000
-        options: >-
-          --health-cmd "curl --silent --fail http://localhost:3000/health"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - name: "Checkout code"
-        uses: actions/checkout@v7
-
-      - name: "Setup node"
-        uses: actions/setup-node@v7
-        with:
-          node-version: '20.x'
-
-      - name: "Setup PHP"
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.3'
-          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv
-          coverage: none
-
-      - name: "Read extension manifest"
-        id: extension-manifest
-        run: |
-          {
-            echo "billing_repository=$(jq -r '.Billing.repository' extensions/manifest.json)"
-            echo "billing_ref=$(jq -r '.Billing.ref' extensions/manifest.json)"
-            echo "services_repository=$(jq -r '.Services.repository' extensions/manifest.json)"
-            echo "services_ref=$(jq -r '.Services.ref' extensions/manifest.json)"
-            echo "invoicing_repository=$(jq -r '.Invoicing.repository' extensions/manifest.json)"
-            echo "invoicing_ref=$(jq -r '.Invoicing.ref' extensions/manifest.json)"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: "Checkout billing extension"
-        if: matrix.billing
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.billing_repository }}
-          ref: ${{ steps.extension-manifest.outputs.billing_ref }}
-          path: extensions/Billing
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_BILLING_EXTENSION }}
-
-      - name: "Install composer dependencies in billing extension"
-        if: matrix.billing
-        working-directory: extensions/Billing
-        env:
-          COMPOSER_AUTH: '{"http-basic": {"spark.laravel.com": {"username": "contact@solidtime.io", "password": "${{ secrets.LARAVEL_SPARK_API_KEY }}"}}}'
-        run: composer install -n --prefer-dist --ignore-platform-reqs
-
-      - name: "Install npm dependencies in billing extension"
-        if: matrix.billing
-        run: cd extensions/Billing && npm ci
-
-      - name: "Checkout services extension"
-        if: matrix.billing
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.services_repository }}
-          ref: ${{ steps.extension-manifest.outputs.services_ref }}
-          path: extensions/Services
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_SERVICES_EXTENSION }}
-
-      - name: "Install composer dependencies in services extension"
-        if: matrix.billing
-        working-directory: extensions/Services
-        run: composer install -n --prefer-dist --ignore-platform-reqs
-
-      - name: "Install npm dependencies in services extension"
-        if: matrix.billing
-        run: cd extensions/Services && npm ci
-
-      - name: "Checkout invoicing extension"
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ steps.extension-manifest.outputs.invoicing_repository }}
-          ref: ${{ steps.extension-manifest.outputs.invoicing_ref }}
-          path: extensions/Invoicing
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_INVOICING_EXTENSION }}
-
-      - name: "Install composer dependencies in invoicing extension"
-        working-directory: extensions/Invoicing
-        run: composer install -n --prefer-dist --ignore-platform-reqs
-
-      - name: "Install npm dependencies in invoicing extension"
-        run: cd extensions/Invoicing && npm ci
-
-      - name: "Run composer install"
-        run: composer install -n --prefer-dist
-
-      # Must run before `migrate` so the extensions' migrations are applied, and before the
-      # frontend build so vite collects the extensions' assets. It also writes
-      # modules_statuses.json, which playwright.config.ts reads to collect the extension specs.
-      - name: "Activate extensions"
-        run: |
-          for extension in ${{ matrix.extensions }}; do
-            php artisan module:enable "$extension"
-          done
-
-      - name: "Prepare Laravel Application"
-        run: |
-          cp .env.ci .env
-          php artisan key:generate
-          php artisan passport:keys
-          php artisan migrate --seed
-
-      - name: "Install dependencies"
-        run: npm ci
-
-      - name: "Build Frontend"
-        run: npm run build
-
-      - name: "Install FrankenPHP"
-        run: |
-          ARCH="$(uname -m)"
-          curl -fsSL "https://github.com/dunglas/frankenphp/releases/latest/download/frankenphp-linux-${ARCH}" -o /usr/local/bin/frankenphp
-          chmod +x /usr/local/bin/frankenphp
-
-      - name: "Run Laravel Octane Server"
-        run: php artisan octane:start --server=frankenphp --host=127.0.0.1 --port=8000 --workers=4 --max-requests=500 > /dev/null 2>&1 &
-        env:
-          OCTANE_SERVER: frankenphp
-
-      - name: "Install Playwright Browsers"
-        run: npx playwright install --with-deps
-
-      # Only the extension specs, the core specs run without extensions in playwright.yml
-      - name: "Run Playwright tests"
-        run: npx playwright test extensions/
-        env:
-          PLAYWRIGHT_BASE_URL: 'http://127.0.0.1:8000'
-          MAILPIT_BASE_URL: 'http://localhost:8025'
-
-      # No artifacts are uploaded on purpose. This repository is public, so every artifact is
-      # downloadable by anyone, and Playwright's reports carry the source of the specs that
-      # produced them (traces embed whole source files, error-context.md embeds a window of the
-      # spec). Those specs live in the private extension repositories. Failures are diagnosed from
-      # the job log; to inspect a trace, reproduce the failure locally with the extension checked out.

app/Extensions/Scramble/PaginatedResourceCollectionTypeToSchema.php

@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Extensions\Scramble;
+
+use App\Http\Resources\PaginatedResourceCollection;
+use App\Http\Resources\V1\TimeEntry\TimeEntryCollection;
+use Dedoc\Scramble\Extensions\TypeToSchemaExtension;
+use Dedoc\Scramble\Support\Generator\Response;
+use Dedoc\Scramble\Support\Generator\Schema;
+use Dedoc\Scramble\Support\Generator\Types\ArrayType;
+use Dedoc\Scramble\Support\Generator\Types\BooleanType;
+use Dedoc\Scramble\Support\Generator\Types\IntegerType;
+use Dedoc\Scramble\Support\Generator\Types\ObjectType as OpenApiObjectType;
+use Dedoc\Scramble\Support\Generator\Types\StringType;
+use Dedoc\Scramble\Support\Type\Generic;
+use Dedoc\Scramble\Support\Type\ObjectType;
+use Dedoc\Scramble\Support\Type\Type;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class PaginatedResourceCollectionTypeToSchema extends TypeToSchemaExtension
+{
+    public function shouldHandle(Type $type): bool
+    {
+        return $type instanceof ObjectType
+            && $type->isInstanceOf(PaginatedResourceCollection::class);
+    }
+
+    public function toSchema(Type $type): ?OpenApiObjectType
+    {
+        /** @var Type|null $collectingClassType */
+        $collectingClassType = $type->templateTypes[0] ?? null;
+
+        if (! $collectingClassType instanceof ObjectType) {
+            return null;
+        }
+
+        if (! $collectingClassType->isInstanceOf(JsonResource::class) && ! $collectingClassType->isInstanceOf(Model::class)) {
+            return null;
+        }
+
+        $collectingType = $this->openApiTransformer->transform($collectingClassType);
+
+        $newType = new OpenApiObjectType;
+        $newType->addProperty('data', (new ArrayType)->setItems($collectingType));
+        if ($type instanceof ObjectType && $type->isInstanceOf(TimeEntryCollection::class)) {
+            $newType->addProperty(
+                'meta',
+                (new OpenApiObjectType)
+                    ->addProperty('total', (new IntegerType)->setDescription('Total number of items being paginated.'))
+                    ->setRequired(['total'])
+            );
+            $newType->setRequired(['data', 'meta']);
+        } else {
+            $newType->addProperty(
+                'links',
+                (new OpenApiObjectType)
+                    ->addProperty('first', (new StringType)->nullable(true))
+                    ->addProperty('last', (new StringType)->nullable(true))
+                    ->addProperty('prev', (new StringType)->nullable(true))
+                    ->addProperty('next', (new StringType)->nullable(true))
+                    ->setRequired(['first', 'last', 'prev', 'next'])
+            );
+            $newType->addProperty(
+                'meta',
+                (new OpenApiObjectType)
+                    ->addProperty('current_page', new IntegerType)
+                    ->addProperty('from', (new IntegerType)->nullable(true))
+                    ->addProperty('last_page', new IntegerType)
+                    ->addProperty('links', (new ArrayType)->setItems(
+                        (new OpenApiObjectType)
+                            ->addProperty('url', (new StringType)->nullable(true))
+                            ->addProperty('label', new StringType)
+                            ->addProperty('active', new BooleanType)
+                            ->setRequired(['url', 'label', 'active'])
+                    )->setDescription('Generated paginator links.'))
+                    ->addProperty('path', (new StringType)->nullable(true)->setDescription('Base path for paginator generated URLs.'))
+                    ->addProperty('per_page', (new IntegerType)->setDescription('Number of items shown per page.'))
+                    ->addProperty('to', (new IntegerType)->nullable(true)->setDescription('Number of the last item in the slice.'))
+                    ->addProperty('total', (new IntegerType)->setDescription('Total number of items being paginated.'))
+                    ->setRequired(['current_page', 'from', 'last_page', 'links', 'path', 'per_page', 'to', 'total'])
+            );
+            $newType->setRequired(['data', 'links', 'meta']);
+        }
+
+        return $newType;
+    }
+
+    /**
+     * @param  Generic  $type
+     */
+    public function toResponse(Type $type): ?Response
+    {
+        /** @var ObjectType|null $collectingClassType */
+        $collectingClassType = $type->templateTypes[0] ?? null;
+        if (! $collectingClassType instanceof ObjectType) {
+            return null;
+        }
+        $type = $this->toSchema($type);
+
+        return Response::make(200)
+            ->description('Paginated set of `'.$this->components->uniqueSchemaName($collectingClassType->name).'`')
+            ->setContent('application/json', Schema::fromType($type));
+    }
+}

app/Filament/Resources/AuditResource.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\AuditResource\Pages\CreateAudit;
+use App\Filament\Resources\AuditResource\Pages\ListAudits;
+use App\Filament\Resources\AuditResource\Pages\ViewAudit;
+use App\Models\Audit;
+use Filament\Actions\ViewAction;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Support\Str;
+use Novadaemon\FilamentPrettyJson\Form\PrettyJsonField;
+
+class AuditResource extends Resource
+{
+    protected static ?string $model = Audit::class;
+
+    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-archive-box';
+
+    protected static string|\UnitEnum|null $navigationGroup = 'System';
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                TextInput::make('user_type')
+                    ->maxLength(255),
+                TextInput::make('user_id'),
+                TextInput::make('event')
+                    ->required()
+                    ->maxLength(255),
+                TextInput::make('auditable_type')
+                    ->required()
+                    ->maxLength(255),
+                TextInput::make('auditable_id')
+                    ->required(),
+                PrettyJsonField::make('old_values'),
+                PrettyJsonField::make('new_values'),
+                Textarea::make('url'),
+                TextInput::make('ip_address'),
+                TextInput::make('user_agent')
+                    ->maxLength(1023),
+                TextInput::make('tags')
+                    ->maxLength(255),
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('user.name'),
+                TextColumn::make('event'),
+                TextColumn::make('auditable_type'),
+                TextColumn::make('auditable_id'),
+                IconColumn::make('was_command')
+                    ->getStateUsing(fn (Audit $record) => Str::startsWith($record->url, 'artisan '))
+                    ->boolean(),
+                TextColumn::make('created_at')
+                    ->sortable()
+                    ->dateTime(),
+                TextColumn::make('updated_at')
+                    ->sortable()
+                    ->dateTime(),
+            ])
+            ->filters([
+                //
+            ])
+            ->recordActions([
+                ViewAction::make(),
+            ])
+            ->toolbarActions([
+            ])
+            ->defaultSort('created_at', 'desc');
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListAudits::route('/'),
+            'create' => CreateAudit::route('/create'),
+            'view' => ViewAudit::route('/{record}'),
+        ];
+    }
+}

app/Filament/Resources/AuditResource/Pages/CreateAudit.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\AuditResource\Pages;
+
+use App\Filament\Resources\AuditResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateAudit extends CreateRecord
+{
+    protected static string $resource = AuditResource::class;
+}

app/Filament/Resources/AuditResource/Pages/ListAudits.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\AuditResource\Pages;
+
+use App\Filament\Resources\AuditResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListAudits extends ListRecords
+{
+    protected static string $resource = AuditResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/AuditResource/Pages/ViewAudit.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\AuditResource\Pages;
+
+use App\Filament\Resources\AuditResource;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewAudit extends ViewRecord
+{
+    protected static string $resource = AuditResource::class;
+}

app/Http/Controllers/Api/FallbackController.php

@@ -1,21 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Controllers\Api;
-
-use App\Http\Controllers\Controller;
-use Dedoc\Scramble\Attributes\ExcludeAllRoutesFromDocs;
-use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
-
-/**
- * Fallback for unknown /api/* routes, to prevent a rendered HTML page
- */
-#[ExcludeAllRoutesFromDocs]
-class FallbackController extends Controller
-{
-    public function __invoke(): never
-    {
-        throw new NotFoundHttpException('API resource not found');
-    }
-}

app/Http/Controllers/Api/V1/ClientController.php

@@ -29,6 +29,8 @@ class ClientController extends Controller
     /**
      * Get clients
      *
+     * @return ClientCollection<ClientResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getClients

app/Http/Controllers/Api/V1/InvitationController.php

@@ -9,6 +9,7 @@ use App\Exceptions\Api\UserIsAlreadyMemberOfOrganizationApiException;
 use App\Http\Requests\V1\Invitation\InvitationIndexRequest;
 use App\Http\Requests\V1\Invitation\InvitationStoreRequest;
 use App\Http\Resources\V1\Invitation\InvitationCollection;
+use App\Http\Resources\V1\Invitation\InvitationResource;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
 use App\Service\InvitationService;
@@ -29,6 +30,8 @@ class InvitationController extends Controller
     /**
      * List all invitations of an organization
      *
+     * @return InvitationCollection<InvitationResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getInvitations
@@ -85,8 +88,6 @@ class InvitationController extends Controller
     /**
      * Remove a pending invitation
      *
-     * This revokes the invitation: the link in the invitation email stops working. Find the invitation ID with `GET /organizations/{organization}/invitations`.
-     *
      * @throws AuthorizationException
      *
      * @operationId removeInvitation

app/Http/Controllers/Api/V1/MemberController.php

@@ -48,6 +48,8 @@ class MemberController extends Controller
     /**
      * List all members of an organization
      *
+     * @return MemberCollection<MemberResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getMembers
@@ -143,9 +145,6 @@ class MemberController extends Controller
     /**
      * Merge one member into another
      *
-     * Only placeholder members (for example people created by an import) can be merged. All time entries and other data of the placeholder
-     * are reassigned to the member given in `member_id`, and the placeholder is removed. Find both member IDs with `GET /organizations/{organization}/members`.
-     *
      * @throws AuthorizationException
      * @throws OnlyPlaceholdersCanBeMergedIntoAnotherMember
      * @throws Throwable

app/Http/Controllers/Api/V1/ProjectController.php

@@ -35,6 +35,8 @@ class ProjectController extends Controller
     /**
      * Get projects visible to the current user
      *
+     * @return ProjectCollection<ProjectResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getProjects

app/Http/Controllers/Api/V1/ProjectMemberController.php

@@ -36,6 +36,8 @@ class ProjectMemberController extends Controller
     /**
      * Get project members for project
      *
+     * @return ProjectMemberCollection<ProjectMemberResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getProjectMembers

app/Http/Controllers/Api/V1/ReportController.php

@@ -10,6 +10,7 @@ use App\Http\Requests\V1\Report\ReportStoreRequest;
 use App\Http\Requests\V1\Report\ReportUpdateRequest;
 use App\Http\Resources\V1\Report\DetailedReportResource;
 use App\Http\Resources\V1\Report\ReportCollection;
+use App\Http\Resources\V1\Report\ReportResource;
 use App\Models\Organization;
 use App\Models\Report;
 use App\Service\Dto\ReportPropertiesDto;
@@ -34,6 +35,8 @@ class ReportController extends Controller
     /**
      * Get reports
      *
+     * @return ReportCollection<ReportResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getReports
@@ -68,8 +71,6 @@ class ReportController extends Controller
     /**
      * Create report
      *
-     * A report is a saved set of filters. Set `is_public` to `true` to share it: the response then contains the `shareable_link` that can be opened without logging in.
-     *
      * @throws AuthorizationException
      *
      * @operationId createReport

app/Http/Controllers/Api/V1/TagController.php

@@ -29,6 +29,8 @@ class TagController extends Controller
     /**
      * Get tags
      *
+     * @return TagCollection<TagResource>
+     *
      * @operationId getTags
      *
      * @throws AuthorizationException

app/Http/Controllers/Api/V1/TaskController.php

@@ -51,6 +51,8 @@ class TaskController extends Controller
     /**
      * Get tasks
      *
+     * @return TaskCollection<TaskResource>
+     *
      * @throws AuthorizationException
      *
      * @operationId getTasks

app/Http/Controllers/Api/V1/TimeEntryController.php

@@ -109,13 +109,10 @@ class TimeEntryController extends Controller
     /**
      * Get time entries in organization
      *
-     * Without a member filter this returns the time entries of all members of the organization (for users who may view all time entries, such as owners and admins), not only your own.
-     * To get only your own time entries, pass your member ID as `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
+     * If you only need time entries for a specific user, you can filter by `member_id`.
      * Users with the permission `time-entries:view:own` can only use this endpoint with their own member ID in the member_id filter.
      *
-     * The `start` and `end` filters both apply to the start time of an entry, in UTC. Convert the user's local day boundaries to UTC first.
-     * Results are paginated with `limit` (default 100, max 500) and `offset`; check `meta.total` and fetch further pages when needed.
-     * To find the running timer, use `active=true` (or `GET /v1/users/me/time-entries/active`).
+     * @return TimeEntryCollection<TimeEntryResource>
      *
      * @throws AuthorizationException
      *
@@ -354,11 +351,6 @@ class TimeEntryController extends Controller
      * The parameters `group` and `sub_group` allow you to group the time entries by different criteria.
      * If the group parameters are all set to `null` or are all missing, the endpoint will aggregate all filtered time entries.
      *
-     * Durations are returned in `seconds` (divide by 3600 for hours) and amounts in `cost` as cents in the organization's currency (divide by 100 for money).
-     * Filter by member with `member_id`. Your member ID is the `id` returned for this organization by `GET /v1/users/me/memberships`; it is not your user ID.
-     * Array filters use the query format `client_ids[]=<id>`.
-     * Example: billable hours per client for a period: `group=client&billable=true&start=...&end=...`.
-     *
      * @operationId getAggregatedTimeEntries
      *
      * @return array{
@@ -592,12 +584,6 @@ class TimeEntryController extends Controller
     /**
      * Create time entry
      *
-     * `billable` is not taken from the project. To match the web app, set it to the project's `is_billable` value (or `false` without a project).
-     *
-     * A member can only have one running time entry (an entry with `end` set to `null`). Creating a running entry while another one runs fails with `time_entry_still_running`.
-     * To start a new timer, first stop the running entry by updating its `end` to the current time, then create the new entry.
-     * To log past work, send both `start` and `end` (UTC). Create one entry per block of work.
-     *
      * @throws AuthorizationException
      * @throws TimeEntryStillRunningApiException
      *
@@ -648,8 +634,6 @@ class TimeEntryController extends Controller
     /**
      * Update time entry
      *
-     * To stop a running timer, set `end` to the stop time (UTC). Times the user gives in their own timezone must be converted to UTC first.
-     *
      * @throws AuthorizationException|TimeEntryCanNotBeRestartedApiException
      *
      * @operationId updateTimeEntry
@@ -718,10 +702,6 @@ class TimeEntryController extends Controller
     /**
      * Update multiple time entries
      *
-     * Applies the same `changes` to every entry in `ids`. To find the IDs, list entries with `GET /organizations/{organization}/time-entries`
-     * (filtered by `member_id`, the project and the other criteria), then send their IDs here.
-     * When `changes.project_id` moves entries to another project, also set `changes.task_id` to a task of the new project or to `null`, because tasks belong to a project.
-     *
      * @operationId updateMultipleTimeEntries
      *
      * @throws AuthorizationException

app/Http/Requests/V1/Member/MemberUpdateRequest.php

@@ -27,7 +27,6 @@ class MemberUpdateRequest extends BaseFormRequest
                 'string',
                 Rule::enum(Role::class),
             ],
-            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Organization/OrganizationUpdateRequest.php

@@ -36,7 +36,6 @@ class OrganizationUpdateRequest extends BaseFormRequest
                 'string',
                 new CurrencyRule,
             ],
-            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectStoreRequest.php

@@ -55,7 +55,6 @@ class ProjectStoreRequest extends BaseFormRequest
                 'required',
                 'boolean',
             ],
-            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/Project/ProjectUpdateRequest.php

@@ -68,7 +68,6 @@ class ProjectUpdateRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
-            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge([
                 'nullable',
             ],

app/Http/Requests/V1/ProjectMember/ProjectMemberStoreRequest.php

@@ -31,7 +31,6 @@ class ProjectMemberStoreRequest extends BaseFormRequest
                     return $builder->whereBelongsTo($this->organization, 'organization');
                 })->uuid(),
             ],
-            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/ProjectMember/ProjectMemberUpdateRequest.php

@@ -21,7 +21,6 @@ class ProjectMemberUpdateRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // Billable rate in cents per hour (example: 8000 means 80.00 in the organization's currency)
             'billable_rate' => array_merge(
                 [
                     'nullable',

app/Http/Requests/V1/TimeEntry/TimeEntryIndexRequest.php

@@ -35,7 +35,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // Filter by member ID. Without it, users who may view all time entries (owners, admins) get the entries of every member; pass your own member ID (from GET /v1/users/me/memberships) to get only yours
+            // Filter by member ID
             'member_id' => [
                 'string',
                 ExistsEloquent::make(Member::class, null, function (Builder $builder): Builder {
@@ -155,7 +155,7 @@ class TimeEntryIndexRequest extends BaseFormRequest
                 'string',
                 Rule::enum(TimeEntryType::class),
             ],
-            // Limit the number of returned time entries (default: 100)
+            // Limit the number of returned time entries (default: 150)
             'limit' => [
                 'integer',
                 'min:1',

app/Http/Requests/V1/TimeEntry/TimeEntryStoreRequest.php

@@ -32,7 +32,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
     public function rules(): array
     {
         return [
-            // ID of the organization member that the time entry should belong to (a member ID from GET /v1/users/me/memberships or the members list, not a user ID)
+            // ID of the organization member that the time entry should belong to
             'member_id' => [
                 'required',
                 'string',
@@ -86,7 +86,7 @@ class TimeEntryStoreRequest extends BaseFormRequest
                 'date_format:Y-m-d\TH:i:s\Z',
                 'after_or_equal:start',
             ],
-            // Whether time entry is billable. Not derived from the project: set it to the project's is_billable value to match the web app
+            // Whether time entry is billable
             'billable' => [
                 'required',
                 'boolean',

app/Http/Resources/PaginatedResourceCollection.php

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Resources;
+
+interface PaginatedResourceCollection {}

app/Http/Resources/V1/Client/ClientCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Client;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ClientCollection extends ResourceCollection
+class ClientCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Invitation/InvitationCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Invitation;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class InvitationCollection extends ResourceCollection
+class InvitationCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Member/MemberCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Member;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class MemberCollection extends ResourceCollection
+class MemberCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Member/PersonalMembershipCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Member;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class PersonalMembershipCollection extends ResourceCollection
+class PersonalMembershipCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Project/ProjectCollection.php

@@ -4,11 +4,12 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Project;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use App\Models\Project;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ProjectCollection extends ResourceCollection
+class ProjectCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     private bool $showBillableRates;
 

app/Http/Resources/V1/ProjectMember/ProjectMemberCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\ProjectMember;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ProjectMemberCollection extends ResourceCollection
+class ProjectMemberCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Report/ReportCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Report;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class ReportCollection extends ResourceCollection
+class ReportCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Tag/TagCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Tag;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TagCollection extends ResourceCollection
+class TagCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/Task/TaskCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\Task;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TaskCollection extends ResourceCollection
+class TaskCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Http/Resources/V1/TimeEntry/TimeEntryCollection.php

@@ -4,9 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Resources\V1\TimeEntry;
 
+use App\Http\Resources\PaginatedResourceCollection;
 use Illuminate\Http\Resources\Json\ResourceCollection;
 
-class TimeEntryCollection extends ResourceCollection
+class TimeEntryCollection extends ResourceCollection implements PaginatedResourceCollection
 {
     /**
      * The resource that this resource collects.

app/Models/Audit.php

@@ -4,19 +4,15 @@ declare(strict_types=1);
 
 namespace App\Models;
 
-use App\Models\Concerns\AuditableWithoutOwner;
 use Database\Factories\AuditFactory;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Carbon;
 use OwenIt\Auditing\Models\Audit as PackageAuditModel;
 
 /**
  * @property int $id
- * @property string|null $actor_type
- * @property string|null $actor_id
+ * @property string|null $user_type
+ * @property string|null $user_id
  * @property string $event
  * @property string $auditable_type
  * @property string $auditable_id
@@ -26,71 +22,13 @@ use OwenIt\Auditing\Models\Audit as PackageAuditModel;
  * @property string|null $ip_address
  * @property string|null $user_agent
  * @property string|null $tags
- * @property string|null $owner_user_id
- * @property string|null $owner_organization_id
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
- * @property-read User|null $ownerUser
- * @property-read Organization|null $ownerOrganization
  *
  * @method static AuditFactory factory()
- * @method static Builder<Audit> whereMissingOwner()
  */
 class Audit extends PackageAuditModel
 {
     /** @use HasFactory<AuditFactory> */
     use HasFactory;
-
-    /**
-     * @return BelongsTo<User, $this>
-     */
-    public function ownerUser(): BelongsTo
-    {
-        return $this->belongsTo(User::class, 'owner_user_id');
-    }
-
-    /**
-     * @return BelongsTo<Organization, $this>
-     */
-    public function ownerOrganization(): BelongsTo
-    {
-        return $this->belongsTo(Organization::class, 'owner_organization_id');
-    }
-
-    /**
-     * Whether audits of the given auditable type intentionally have no owner (see AuditableWithoutOwner).
-     */
-    public static function isAuditableTypeWithoutOwner(string $auditableType): bool
-    {
-        $modelClass = Relation::getMorphedModel($auditableType) ?? $auditableType;
-
-        return is_subclass_of($modelClass, AuditableWithoutOwner::class);
-    }
-
-    /**
-     * Auditable types (morph aliases) whose audits intentionally have no owner (see AuditableWithoutOwner).
-     *
-     * @return array<int, string>
-     */
-    public static function getAuditableTypesWithoutOwner(): array
-    {
-        return collect(Relation::morphMap())
-            ->filter(fn (string $modelClass): bool => is_subclass_of($modelClass, AuditableWithoutOwner::class))
-            ->keys()
-            ->values()
-            ->all();
-    }
-
-    /**
-     * Audits that have neither an owner organization nor an owner user, although their auditable type should have one.
-     * These are audits whose owner no longer exists or could not be determined (yet).
-     *
-     * @param  Builder<Audit>  $builder
-     */
-    public function scopeWhereMissingOwner(Builder $builder): void
-    {
-        $builder->whereNull('owner_organization_id')
-            ->whereNull('owner_user_id')
-            ->whereNotIn('auditable_type', self::getAuditableTypesWithoutOwner());
-    }
 }

app/Models/Concerns/AuditableThroughParent.php

@@ -1,22 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Models\Concerns;
-
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\BelongsTo;
-
-/**
- * Marks an auditable model whose audits are owned by the owner of its parent model,
- * because the model itself has no organization_id (for example a project member belongs to an organization via its project).
- * The parent model has to have an organization_id column.
- * This is used to set the owner of new audits (CustomAuditable) and to backfill the owner of existing audits.
- */
-interface AuditableThroughParent
-{
-    /**
-     * @return BelongsTo<covariant Model, covariant Model>
-     */
-    public function getAuditParentRelation(): BelongsTo;
-}

app/Models/Concerns/AuditableWithoutOwner.php

@@ -1,14 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Models\Concerns;
-
-/**
- * Marks an auditable model whose audits intentionally have no owner (neither an organization nor a user),
- * either because the model belongs to neither of them, or because the model and its audits have to be kept
- * when its organization or user is deleted (for example billing records).
- * Audits of these models are not deleted together with an organization or user,
- * and are not considered as missing an owner (for example by the audit backfill command).
- */
-interface AuditableWithoutOwner {}

app/Models/Concerns/CustomAuditable.php

@@ -4,8 +4,6 @@ declare(strict_types=1);
 
 namespace App\Models\Concerns;
 
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Support\Facades\Config;
 use OwenIt\Auditing\Auditable;
 
 trait CustomAuditable
@@ -21,92 +19,4 @@ trait CustomAuditable
     {
         $this->auditEvents = [];
     }
-
-    /**
-     * The organization that owns the audited model.
-     * The audits of the model are deleted (via foreign key cascade) when the organization is deleted.
-     */
-    public function getAuditOwnerOrganizationId(): ?string
-    {
-        if ($this instanceof AuditableThroughParent) {
-            $relation = $this->getAuditParentRelation();
-            $parentId = $this->getAttributes()[$relation->getForeignKeyName()] ?? null;
-            if ($parentId === null) {
-                return null;
-            }
-
-            // Note: The loaded parent is only used if it still matches the foreign key and was loaded with the organization
-            $relationName = $relation->getRelationName();
-            if ($this->relationLoaded($relationName)) {
-                $parent = $this->getRelation($relationName);
-                if ($parent instanceof Model
-                    && $parent->getAttribute($relation->getOwnerKeyName()) === $parentId
-                    && array_key_exists('organization_id', $parent->getAttributes())) {
-                    /** @var string|null $organizationId */
-                    $organizationId = $parent->getAttributes()['organization_id'];
-
-                    return $organizationId;
-                }
-            }
-
-            /** @var string|null $organizationId */
-            $organizationId = $relation->getRelated()->newQuery()
-                ->toBase()
-                ->where($relation->getOwnerKeyName(), $parentId)
-                ->value('organization_id');
-
-            return $organizationId;
-        }
-
-        return $this->getAttributes()['organization_id'] ?? null;
-    }
-
-    /**
-     * The user that owns the audited model.
-     * The audits of the model are deleted (via foreign key cascade) when the user is deleted.
-     */
-    public function getAuditOwnerUserId(): ?string
-    {
-        return null;
-    }
-
-    /**
-     * Models that are the owner of their own audits can not record the deletion audit,
-     * since the audit would reference the already deleted model and therefore violate the foreign key.
-     */
-    protected function isAuditOwnerOfItself(): bool
-    {
-        return false;
-    }
-
-    /**
-     * @return array<int|string, string>
-     */
-    public function getAuditEvents(): array
-    {
-        $events = $this->auditEvents ?? Config::get('audit.events', [
-            'created',
-            'updated',
-            'deleted',
-            'restored',
-        ]);
-
-        if ($this->isAuditOwnerOfItself()) {
-            $events = array_filter($events, fn (string $value, int|string $key): bool => (is_int($key) ? $value : $key) !== 'deleted', ARRAY_FILTER_USE_BOTH);
-        }
-
-        return $events;
-    }
-
-    /**
-     * @param  array<string, mixed>  $data
-     * @return array<string, mixed>
-     */
-    public function transformAudit(array $data): array
-    {
-        $data['owner_organization_id'] = $this->getAuditOwnerOrganizationId();
-        $data['owner_user_id'] = $this->getAuditOwnerUserId();
-
-        return $data;
-    }
 }

app/Models/Organization.php

@@ -96,16 +96,6 @@ class Organization extends Model implements AuditableContract
     protected $attributes = [
     ];
 
-    public function getAuditOwnerOrganizationId(): ?string
-    {
-        return $this->getKey();
-    }
-
-    protected function isAuditOwnerOfItself(): bool
-    {
-        return true;
-    }
-
     /**
      * Get all the users that belong to the team.
      *

app/Models/ProjectMember.php

@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace App\Models;
 
-use App\Models\Concerns\AuditableThroughParent;
 use App\Models\Concerns\CustomAuditable;
 use App\Models\Concerns\HasUuids;
 use Database\Factories\ProjectMemberFactory;
@@ -30,7 +29,7 @@ use OwenIt\Auditing\Contracts\Auditable as AuditableContract;
  * @method static Builder<ProjectMember> whereBelongsToOrganization(Organization $organization)
  * @method static ProjectMemberFactory factory()
  */
-class ProjectMember extends Model implements AuditableContract, AuditableThroughParent
+class ProjectMember extends Model implements AuditableContract
 {
     use CustomAuditable;
 
@@ -83,12 +82,4 @@ class ProjectMember extends Model implements AuditableContract, AuditableThrough
             $query->whereBelongsTo($organization, 'organization');
         });
     }
-
-    /**
-     * @return BelongsTo<Project, $this>
-     */
-    public function getAuditParentRelation(): BelongsTo
-    {
-        return $this->project();
-    }
 }

app/Models/User.php

@@ -124,16 +124,6 @@ class User extends Authenticatable implements AuditableContract, FilamentUser, M
         'send_time_entry_still_running_email' => true,
     ];
 
-    public function getAuditOwnerUserId(): ?string
-    {
-        return $this->getKey();
-    }
-
-    protected function isAuditOwnerOfItself(): bool
-    {
-        return true;
-    }
-
     /**
      * Get the URL to the user's profile photo.
      *

app/Service/DeletionService.php

@@ -11,7 +11,6 @@ use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
 use App\Models\OrganizationInvitation;
-use App\Models\Passport\RefreshToken;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -170,10 +169,6 @@ class DeletionService
             }
         }
 
-        // Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
-        // Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
-        // which fails with a foreign key violation on oauth_access_tokens.user_id.
-        RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
         $user->accessTokens()->delete();
         $user->authCodes()->delete();
 

app/Service/Import/Importers/ClockifyTimeEntriesImporter.php

@@ -229,6 +229,7 @@ class ClockifyTimeEntriesImporter extends DefaultImporter
             'Project',
             'Description',
             'User',
+            'Group',
             'Email',
             'Tags',
             'Start Date',

composer.lock

@@ -429,24 +429,23 @@
         },
         {
             "name": "brick/math",
-            "version": "1.0.0",
+            "version": "0.19.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/brick/math.git",
-                "reference": "2effe05d2177c451b86c6a073196a4034c02f211"
+                "reference": "a89bc96a7cf3d7b59e725afe57ccb95eb03cf6ce"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/brick/math/zipball/2effe05d2177c451b86c6a073196a4034c02f211",
-                "reference": "2effe05d2177c451b86c6a073196a4034c02f211",
+                "url": "https://api.github.com/repos/brick/math/zipball/a89bc96a7cf3d7b59e725afe57ccb95eb03cf6ce",
+                "reference": "a89bc96a7cf3d7b59e725afe57ccb95eb03cf6ce",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.2"
             },
             "require-dev": {
-                "phpstan/phpstan": "2.2.13",
-                "phpstan/phpstan-phpunit": "2.0.18",
+                "phpstan/phpstan": "2.1.22",
                 "phpunit/phpunit": "^11.5"
             },
             "type": "library",
@@ -477,7 +476,7 @@
             ],
             "support": {
                 "issues": "https://github.com/brick/math/issues",
-                "source": "https://github.com/brick/math/tree/1.0.0"
+                "source": "https://github.com/brick/math/tree/0.19.1"
             },
             "funding": [
                 {
@@ -485,7 +484,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-09-12T10:28:18+00:00"
+            "time": "2026-08-08T23:03:16+00:00"
         },
         {
             "name": "brick/money",
@@ -4219,16 +4218,16 @@
         },
         {
             "name": "laravel/fortify",
-            "version": "v1.40.0",
+            "version": "v1.39.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/fortify.git",
-                "reference": "fe0fce8814660317df0684f2c7be3b573def67d3"
+                "reference": "b1fc50707bbe007fd92165d8b7d460ab549b355a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/fortify/zipball/fe0fce8814660317df0684f2c7be3b573def67d3",
-                "reference": "fe0fce8814660317df0684f2c7be3b573def67d3",
+                "url": "https://api.github.com/repos/laravel/fortify/zipball/b1fc50707bbe007fd92165d8b7d460ab549b355a",
+                "reference": "b1fc50707bbe007fd92165d8b7d460ab549b355a",
                 "shasum": ""
             },
             "require": {
@@ -4279,24 +4278,24 @@
                 "issues": "https://github.com/laravel/fortify/issues",
                 "source": "https://github.com/laravel/fortify"
             },
-            "time": "2026-09-10T11:52:08+00:00"
+            "time": "2026-08-23T07:46:41+00:00"
         },
         {
             "name": "laravel/framework",
-            "version": "v13.33.0",
+            "version": "v13.32.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/framework.git",
-                "reference": "91188a17ceaa3dbace6e8a5f7abd0d042e466359"
+                "reference": "cdd8b33c246719acdd118c705ce8c7ab5ef48a96"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/91188a17ceaa3dbace6e8a5f7abd0d042e466359",
-                "reference": "91188a17ceaa3dbace6e8a5f7abd0d042e466359",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/cdd8b33c246719acdd118c705ce8c7ab5ef48a96",
+                "reference": "cdd8b33c246719acdd118c705ce8c7ab5ef48a96",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
+                "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19",
                 "composer-runtime-api": "^2.2",
                 "doctrine/inflector": "^2.0.5",
                 "dragonmantank/cron-expression": "^3.4",
@@ -4510,20 +4509,20 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2026-09-22T14:12:33+00:00"
+            "time": "2026-09-15T14:55:30+00:00"
         },
         {
             "name": "laravel/octane",
-            "version": "v2.20.0",
+            "version": "v2.19.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/octane.git",
-                "reference": "df4c38dcddc5f51e36e7f1d788841130c4fb8f45"
+                "reference": "68a2516a0318baba0de0e4648f61e335c5e69dca"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/octane/zipball/df4c38dcddc5f51e36e7f1d788841130c4fb8f45",
-                "reference": "df4c38dcddc5f51e36e7f1d788841130c4fb8f45",
+                "url": "https://api.github.com/repos/laravel/octane/zipball/68a2516a0318baba0de0e4648f61e335c5e69dca",
+                "reference": "68a2516a0318baba0de0e4648f61e335c5e69dca",
                 "shasum": ""
             },
             "require": {
@@ -4599,7 +4598,7 @@
                 "issues": "https://github.com/laravel/octane/issues",
                 "source": "https://github.com/laravel/octane"
             },
-            "time": "2026-08-23T17:25:20+00:00"
+            "time": "2026-08-13T13:58:52+00:00"
         },
         {
             "name": "laravel/passkeys",
@@ -4805,16 +4804,16 @@
         },
         {
             "name": "laravel/serializable-closure",
-            "version": "v2.1.0",
+            "version": "v2.0.16",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/serializable-closure.git",
-                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5"
+                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/2d5869a838bbcf37e0d8b0568fc41914e81374b5",
-                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5",
+                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
+                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
                 "shasum": ""
             },
             "require": {
@@ -4862,7 +4861,7 @@
                 "issues": "https://github.com/laravel/serializable-closure/issues",
                 "source": "https://github.com/laravel/serializable-closure"
             },
-            "time": "2026-09-22T14:32:34+00:00"
+            "time": "2026-08-18T20:28:54+00:00"
         },
         {
             "name": "laravel/tinker",
@@ -15338,16 +15337,16 @@
         },
         {
             "name": "laravel/sail",
-            "version": "v1.68.0",
+            "version": "v1.67.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/sail.git",
-                "reference": "2bc304083d515065b03944e425e62cb3c526c33e"
+                "reference": "639e03ac12cf23def171770bcab05758045b2642"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/sail/zipball/2bc304083d515065b03944e425e62cb3c526c33e",
-                "reference": "2bc304083d515065b03944e425e62cb3c526c33e",
+                "url": "https://api.github.com/repos/laravel/sail/zipball/639e03ac12cf23def171770bcab05758045b2642",
+                "reference": "639e03ac12cf23def171770bcab05758045b2642",
                 "shasum": ""
             },
             "require": {
@@ -15397,7 +15396,7 @@
                 "issues": "https://github.com/laravel/sail/issues",
                 "source": "https://github.com/laravel/sail"
             },
-            "time": "2026-09-18T14:34:46+00:00"
+            "time": "2026-08-12T13:55:56+00:00"
         },
         {
             "name": "laravel/sentinel",
@@ -15457,16 +15456,16 @@
         },
         {
             "name": "laravel/telescope",
-            "version": "v5.25.0",
+            "version": "v5.24.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/telescope.git",
-                "reference": "65fe6724f8688de01dfa74b28a0edc191bc3caa8"
+                "reference": "50cbcf4553ddfd8d4bd456b04f97dfed923007d9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/telescope/zipball/65fe6724f8688de01dfa74b28a0edc191bc3caa8",
-                "reference": "65fe6724f8688de01dfa74b28a0edc191bc3caa8",
+                "url": "https://api.github.com/repos/laravel/telescope/zipball/50cbcf4553ddfd8d4bd456b04f97dfed923007d9",
+                "reference": "50cbcf4553ddfd8d4bd456b04f97dfed923007d9",
                 "shasum": ""
             },
             "require": {
@@ -15519,9 +15518,9 @@
                 "monitoring"
             ],
             "support": {
-                "source": "https://github.com/laravel/telescope/tree/v5.25.0"
+                "source": "https://github.com/laravel/telescope/tree/v5.24.0"
             },
-            "time": "2026-09-09T14:16:19+00:00"
+            "time": "2026-09-08T16:15:16+00:00"
         },
         {
             "name": "mockery/mockery",

config/audit.php

@@ -32,7 +32,7 @@ return [
     */
 
     'user' => [
-        'morph_prefix' => 'actor',
+        'morph_prefix' => 'user',
         'guards' => [
             'web',
             'api',

config/database.php

@@ -35,7 +35,7 @@ return [
 
         'sqlite' => [
             'driver' => 'sqlite',
-            'url' => env('DB_URL', env('DATABASE_URL')),
+            'url' => env('DB_URL'),
             'database' => env('DB_DATABASE', database_path('database.sqlite')),
             'prefix' => '',
             'foreign_key_constraints' => env('DB_FOREIGN_KEYS', true),
@@ -47,7 +47,7 @@ return [
 
         'pgsql' => [
             'driver' => 'pgsql',
-            'url' => env('DB_URL', env('DATABASE_URL')),
+            'url' => env('DB_URL'),
             'host' => env('DB_HOST', '127.0.0.1'),
             'port' => env('DB_PORT', '5432'),
             'database' => env('DB_DATABASE', 'forge'),
@@ -57,12 +57,12 @@ return [
             'prefix' => '',
             'prefix_indexes' => true,
             'search_path' => 'public',
-            'sslmode' => env('DB_SSL_MODE', 'prefer'),
+            'sslmode' => env('DB_SSLMODE', 'prefer'),
         ],
 
         'pgsql_test' => [
             'driver' => 'pgsql',
-            'url' => env('DB_URL', env('DATABASE_URL')),
+            'url' => env('DB_URL'),
             'host' => env('DB_TEST_HOST', '127.0.0.1'),
             'port' => env('DB_TEST_PORT', '5432'),
             'database' => env('DB_TEST_DATABASE', 'forge'),
@@ -72,12 +72,12 @@ return [
             'prefix' => '',
             'prefix_indexes' => true,
             'search_path' => 'public',
-            'sslmode' => env('DB_SSL_MODE', 'prefer'),
+            'sslmode' => env('DB_SSLMODE', 'prefer'),
         ],
 
         'sqlsrv' => [
             'driver' => 'sqlsrv',
-            'url' => env('DB_URL', env('DATABASE_URL')),
+            'url' => env('DB_URL'),
             'host' => env('DB_HOST', 'localhost'),
             'port' => env('DB_PORT', '1433'),
             'database' => env('DB_DATABASE', 'laravel'),

config/scramble.php

@@ -3,6 +3,7 @@
 declare(strict_types=1);
 
 use App\Extensions\Scramble\ApiExceptionTypeToSchema;
+use App\Extensions\Scramble\PaginatedResourceCollectionTypeToSchema;
 use Dedoc\Scramble\Http\Middleware\RestrictedDocsAccess;
 
 return [
@@ -27,30 +28,7 @@ return [
         /*
          * Description rendered on the home page of the API documentation (`/docs/api`).
          */
-        'description' => <<<'MD'
-## Getting started
-
-All organization endpoints live under `/v1/organizations/{organization}`, where `{organization}` is the organization's ID. Authenticate with `Authorization: Bearer <token>` and send `Accept: application/json`.
-
-**1. Find yourself.** Call `GET /v1/users/me/memberships`. Each membership contains the **organization ID** (use it as `{organization}` in paths) and your **member ID** in that organization (the membership `id`). Most endpoints filter by member ID, not by user ID.
-
-**2. Scope to your own data.** For owners and admins, `GET /time-entries` and `GET /time-entries/aggregate` return the whole organization's time entries unless you pass `member_id`. When acting for "me", always pass your member ID, both when reading and before changing entries.
-
-**3. Resolve names to IDs.** Look up projects, clients, tags, tasks and members by name with their list endpoints (`GET /projects`, `GET /clients`, `GET /tags`, `GET /tasks`, `GET /members`). Never guess IDs.
-
-**4. Use UTC.** All timestamps are sent and returned in UTC as `Y-m-d\TH:i:s\Z` (example: `2026-10-02T07:30:00Z`). Convert the user's local times and day boundaries to UTC before sending them.
-
-**5. Money is in cents.** Billable rates and costs are integers in cents of the organization's currency (`8000` means 80.00).
-
-## Common tasks
-
-- **Start a timer:** stop the running entry first (find it with `GET /v1/users/me/time-entries/active`, then `PUT` its `end`), then `POST /time-entries` with `start` and `end: null`. Only one entry can run per member.
-- **Log past work:** `POST /time-entries` once per block with `member_id`, `start`, `end`, `project_id` and `billable` set to the project's `is_billable` (it is not derived automatically).
-- **Fix or stop an entry:** `PUT /time-entries/{timeEntry}` with the new `start` or `end` in UTC.
-- **Move entries to another project:** list them with `member_id` and filters, then `PATCH /time-entries` with their `ids` and `changes.project_id`, plus `changes.task_id` set to a task of the new project or `null`.
-- **Totals and reports:** `GET /time-entries/aggregate` with `group` (for example `client` or `project`) and `start`/`end`; durations are in `seconds`, amounts in `cost` (cents).
-- **Share a report:** `POST /reports` with `is_public: true` and use the returned `shareable_link`.
-MD,
+        'description' => '',
     ],
 
     /*
@@ -100,5 +78,6 @@ MD,
 
     'extensions' => [
         ApiExceptionTypeToSchema::class,
+        PaginatedResourceCollectionTypeToSchema::class,
     ],
 ];

database/factories/UserFactory.php

@@ -91,7 +91,7 @@ class UserFactory extends Factory
 
     public function withProfilePicture(): static
     {
-        $profilePhoto = $this->generateProfilePhoto();
+        $profilePhoto = $this->faker->image(null, 500, 500);
         /** @see FileHelpers::hashName */
         $path = 'profile-photos/'.Str::random(40).'.png';
         Storage::disk(config('filesystems.public'))->put($path, $profilePhoto);
@@ -103,21 +103,6 @@ class UserFactory extends Factory
         });
     }
 
-    /**
-     * Generates a PNG image with a random background color.
-     * Note: The image is generated locally, since downloading a placeholder image (Faker image()) depends on an external service.
-     */
-    private function generateProfilePhoto(): string
-    {
-        $image = imagecreatetruecolor(500, 500);
-        $color = imagecolorallocate($image, $this->faker->numberBetween(0, 255), $this->faker->numberBetween(0, 255), $this->faker->numberBetween(0, 255));
-        imagefill($image, 0, 0, $color);
-        ob_start();
-        imagepng($image);
-
-        return (string) ob_get_clean();
-    }
-
     /**
      * Indicate that the user should have a personal team.
      */

database/migrations/2024_09_02_094105_create_audits_table.php

@@ -18,8 +18,7 @@ class CreateAuditsTable extends Migration
 
         Schema::connection($connection)->create($table, function (Blueprint $table): void {
 
-            // Note: The morph prefix is hardcoded, since the columns are renamed in a later migration
-            $morphPrefix = 'user';
+            $morphPrefix = config('audit.user.morph_prefix', 'user');
 
             $table->bigIncrements('id');
             $table->string($morphPrefix.'_type')->nullable();

database/migrations/2026_10_06_000001_add_owner_columns_to_audits_table.php

@@ -1,42 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     *
-     * Note: Renaming columns and adding nullable columns without default are metadata-only operations in PostgreSQL,
-     * so this migration is fast even for a large audits table.
-     * The indexes and foreign keys for the new columns are added in a separate non-transactional migration.
-     */
-    public function up(): void
-    {
-        Schema::table('audits', function (Blueprint $table): void {
-            $table->renameColumn('user_type', 'actor_type');
-            $table->renameColumn('user_id', 'actor_id');
-            $table->renameIndex('audits_user_id_user_type_index', 'audits_actor_id_actor_type_index');
-            $table->uuid('owner_user_id')->nullable();
-            $table->uuid('owner_organization_id')->nullable();
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('audits', function (Blueprint $table): void {
-            $table->dropColumn('owner_user_id');
-            $table->dropColumn('owner_organization_id');
-            $table->renameIndex('audits_actor_id_actor_type_index', 'audits_user_id_user_type_index');
-            $table->renameColumn('actor_type', 'user_type');
-            $table->renameColumn('actor_id', 'user_id');
-        });
-    }
-};

database/migrations/2026_10_06_000002_add_owner_foreign_keys_to_audits_table.php

@@ -1,94 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Support\Facades\DB;
-
-return new class extends Migration
-{
-    /**
-     * PostgreSQL cannot build an index concurrently inside a transaction.
-     * Keeping this migration non-transactional prevents long write locks on the (large) audits table in production.
-     * Every step is idempotent, so the migration can be re-run if it fails halfway.
-     *
-     * @var bool
-     */
-    public $withinTransaction = false;
-
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        $this->createIndex('audits_owner_user_id_index', 'owner_user_id');
-        $this->createIndex('audits_owner_organization_id_index', 'owner_organization_id');
-
-        $this->createForeignKey('audits_owner_user_id_foreign', 'owner_user_id', 'users');
-        $this->createForeignKey('audits_owner_organization_id_foreign', 'owner_organization_id', 'organizations');
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        DB::statement('ALTER TABLE audits DROP CONSTRAINT IF EXISTS audits_owner_user_id_foreign');
-        DB::statement('ALTER TABLE audits DROP CONSTRAINT IF EXISTS audits_owner_organization_id_foreign');
-        DB::statement('DROP INDEX'.$this->concurrently().' IF EXISTS audits_owner_user_id_index');
-        DB::statement('DROP INDEX'.$this->concurrently().' IF EXISTS audits_owner_organization_id_index');
-    }
-
-    private function createIndex(string $index, string $column): void
-    {
-        $state = DB::selectOne(
-            <<<'SQL'
-                SELECT pg_index.indisvalid::int AS valid
-                FROM pg_index
-                JOIN pg_class ON pg_class.oid = pg_index.indexrelid
-                JOIN pg_namespace ON pg_namespace.oid = pg_class.relnamespace
-                WHERE pg_namespace.nspname = current_schema()
-                  AND pg_class.relname = ?
-                SQL,
-            [$index],
-        );
-
-        if ($state !== null && (bool) $state->valid) {
-            return;
-        }
-
-        // A failed concurrent index build leaves an invalid index behind, that needs to be dropped before rebuilding
-        if ($state !== null) {
-            DB::statement('DROP INDEX'.$this->concurrently().' '.$index);
-        }
-
-        DB::statement('CREATE INDEX'.$this->concurrently().' '.$index.' ON audits ('.$column.')');
-    }
-
-    private function createForeignKey(string $constraint, string $column, string $referencedTable): void
-    {
-        $exists = DB::selectOne(
-            <<<'SQL'
-                SELECT 1
-                FROM pg_constraint
-                JOIN pg_namespace ON pg_namespace.oid = pg_constraint.connamespace
-                WHERE pg_namespace.nspname = current_schema()
-                  AND pg_constraint.conname = ?
-                SQL,
-            [$constraint],
-        ) !== null;
-
-        // Note: Adding the constraint as NOT VALID only needs a short lock, the validation of the existing rows
-        // afterward does not block reads or writes on the audits table.
-        if (! $exists) {
-            DB::statement('ALTER TABLE audits ADD CONSTRAINT '.$constraint.' FOREIGN KEY ('.$column.') REFERENCES '.$referencedTable.' (id) ON DELETE CASCADE NOT VALID');
-        }
-
-        DB::statement('ALTER TABLE audits VALIDATE CONSTRAINT '.$constraint);
-    }
-
-    private function concurrently(): string
-    {
-        return DB::transactionLevel() === 0 ? ' CONCURRENTLY' : '';
-    }
-};

e2e/admin-panel.spec.ts

@@ -19,6 +19,7 @@ const resourcePages = [
     { path: '/admin/project-members', heading: 'Project Members' },
     { path: '/admin/tokens', heading: 'Tokens' },
     { path: '/admin/failed-jobs', heading: 'Failed Jobs' },
+    { path: '/admin/audits', heading: 'Audits' },
 ];
 
 test.describe('Admin Panel Access', () => {

extensions/manifest.json

@@ -1,18 +1,14 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "v0.0.9"
+        "ref": "v0.0.7"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",
-        "ref": "v0.0.4"
+        "ref": "v0.0.3"
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",
-        "ref": "v0.0.8"
-    },
-    "Auditing": {
-        "repository": "solidtime-io/extension-auditing",
-        "ref": "v0.0.4"
+        "ref": "v0.0.7"
     }
 }

playwright.config.ts

@@ -1,5 +1,4 @@
 import { defineConfig, devices } from '@playwright/test';
-import { existsSync, readFileSync } from 'node:fs';
 
 /**
  * Read environment variables from file.
@@ -7,57 +6,11 @@ import { existsSync, readFileSync } from 'node:fs';
  */
 // require('dotenv').config();
 
-/**
- * Extensions ship their e2e specs in extensions/<Name>/tests/e2e. Only the specs of extensions
- * that are enabled in modules_statuses.json (php artisan module:enable <Name>) are collected,
- * a checked out but disabled extension would fail its specs otherwise.
- */
-function enabledExtensions(): string[] {
-    const statusesFile = './modules_statuses.json';
-    if (!existsSync(statusesFile)) {
-        return [];
-    }
-    const statuses: Record<string, boolean> = JSON.parse(readFileSync(statusesFile, 'utf-8'));
-    return Object.entries(statuses)
-        .filter(([, enabled]) => enabled)
-        .map(([name]) => name);
-}
-
-/*
- * Every test root gets its own testDir (instead of testDir: '.') so playwright does not walk the
- * whole repository, including node_modules, vendor and nested worktrees, to find the specs.
- */
-const testRoots = [
-    { suffix: '', testDir: './e2e' },
-    ...enabledExtensions().map((name) => ({
-        suffix: '-' + name,
-        testDir: `./extensions/${name}/tests/e2e`,
-    })),
-];
-
-const browsers = [
-    {
-        name: 'chromium',
-        use: { ...devices['Desktop Chrome'] },
-    },
-
-    // Firefox only in CI to keep local runs fast
-    ...(process.env.CI
-        ? [
-              {
-                  name: 'firefox',
-                  use: { ...devices['Desktop Firefox'] },
-              },
-          ]
-        : []),
-];
-
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-    /* Resolves the @e2e/* and @e2e-support/* aliases that extension specs import core helpers with */
-    tsconfig: './tsconfig.json',
+    testDir: './e2e',
     /* Run tests in files in parallel */
     fullyParallel: true,
     /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -79,14 +32,23 @@ export default defineConfig({
 
     timeout: 20 * 1000,
 
-    /* Configure projects for major browsers, core specs keep the plain browser project name */
-    projects: browsers.flatMap((browser) =>
-        testRoots.map((root) => ({
-            name: browser.name + root.suffix,
-            testDir: root.testDir,
-            use: browser.use,
-        }))
-    ),
+    /* Configure projects for major browsers */
+    projects: [
+        {
+            name: 'chromium',
+            use: { ...devices['Desktop Chrome'] },
+        },
+
+        // Firefox only in CI to keep local runs fast
+        ...(process.env.CI
+            ? [
+                  {
+                      name: 'firefox',
+                      use: { ...devices['Desktop Firefox'] },
+                  },
+              ]
+            : []),
+    ],
 
     /* Run your local dev server before starting the tests */
     // webServer: {

resources/js/packages/ui/src/FullCalendar/useEventResize.ts

@@ -111,8 +111,6 @@ export function useEventResize(params: {
         edge: 'start' | 'end',
         dayStr: string
     ) {
-        if (e.button !== 0) return;
-
         e.preventDefault();
         e.stopPropagation();
 

resources/js/packages/ui/src/TimeTracker/TimeTrackerEntryInput.vue

@@ -168,10 +168,6 @@ defineExpose({ submit, focusAfterStart });
         data-testid="time_entry_description"
         class="w-full rounded-l-lg py-4 sm:py-2.5 px-3.5 border-b border-b-card-background-separator @2xl:px-4 text-base text-text-primary bg-transparent border-none placeholder-text-secondary focus:ring-0 transition"
         type="text"
-        autocomplete="off"
-        data-1p-ignore
-        data-lpignore="true"
-        data-form-type="other"
         @keydown.enter="submit"
         @keydown.esc="showDropdown = false"
         @blur="updateTimeEntryDescription" />

resources/js/packages/ui/src/TimeTracker/TimeTrackerRangeSelector.vue

@@ -170,10 +170,6 @@ function closeAndFocusInput() {
                             : 'text-text-primary bg-card-background border-border-secondary border border-none'
                     "
                     type="text"
-                    autocomplete="off"
-                    data-1p-ignore
-                    data-lpignore="true"
-                    data-form-type="other"
                     @focusin="openModalOnTab"
                     @click="openModalOnClick"
                     @keydown.exact.tab="focusNextElement"

resources/js/packages/ui/styles.css

@@ -66,13 +66,13 @@
 :root.light {
     --color-bg-primary: #ffffff;
     --color-bg-secondary: #fcfcfc;
-    --color-bg-tertiary: #eeeeee;
-    --color-bg-quaternary: #e1e1e1;
+    --color-bg-tertiary: #eeeeef;
+    --color-bg-quaternary: #e1e1e3;
     --color-bg-background: #f5f5f5;
-    --color-text-primary: #181818;
-    --color-text-secondary: #404040;
-    --color-text-tertiary: #575757;
-    --color-text-quaternary: #a2a2a2;
+    --color-text-primary: #18181b;
+    --color-text-secondary: #3f3f46;
+    --color-text-tertiary: #57575c;
+    --color-text-quaternary: #a1a1aa;
     --color-border-primary: #e7e7e7;
     --color-border-secondary: #e5e5e5;
     --color-border-tertiary: #dfdfdf;

routes/api.php

@@ -2,7 +2,6 @@
 
 declare(strict_types=1);
 
-use App\Http\Controllers\Api\FallbackController;
 use App\Http\Controllers\Api\V1\ApiTokenController;
 use App\Http\Controllers\Api\V1\ChartController;
 use App\Http\Controllers\Api\V1\ClientController;
@@ -24,6 +23,7 @@ use App\Http\Controllers\Api\V1\UserController;
 use App\Http\Controllers\Api\V1\UserMembershipController;
 use App\Http\Controllers\Api\V1\UserTimeEntryController;
 use Illuminate\Support\Facades\Route;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /*
 |--------------------------------------------------------------------------
@@ -200,5 +200,9 @@ Route::prefix('v1')->name('v1.')->group(static function (): void {
  * Fallback routes, to prevent a rendered HTML page in /api/* routes
  * The / route is also included since the fallback is not triggered on the root route
  */
-Route::get('/', FallbackController::class);
-Route::fallback(FallbackController::class);
+Route::get('/', function (): void {
+    throw new NotFoundHttpException('API resource not found');
+});
+Route::fallback(function (): void {
+    throw new NotFoundHttpException('API resource not found');
+});

tests/Unit/ApiDocs/ApiDocsExportTest.php

@@ -1,113 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\ApiDocs;
-
-use App\Http\Controllers\Api\FallbackController;
-use Dedoc\Scramble\Infer\Context;
-use Illuminate\Console\Command;
-use Illuminate\Support\Facades\File;
-use PHPUnit\Framework\Attributes\CoversClass;
-use Tests\TestCase;
-
-#[CoversClass(FallbackController::class)]
-class ApiDocsExportTest extends TestCase
-{
-    private string $path;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-        // Scramble keeps its inference context in a static property, which would otherwise outlive the refreshed application
-        Context::reset();
-        $this->path = storage_path('framework/testing/api-docs-'.uniqid().'.json');
-        File::ensureDirectoryExists(dirname($this->path));
-    }
-
-    protected function tearDown(): void
-    {
-        File::delete($this->path);
-        parent::tearDown();
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    private function exportApiDocs(): array
-    {
-        $exitCode = $this->withoutMockingConsoleOutput()->artisan('scramble:export', [
-            '--path' => $this->path,
-        ]);
-        $this->assertSame(Command::SUCCESS, $exitCode);
-        $this->assertFileExists($this->path);
-
-        return json_decode(File::get($this->path), true, flags: JSON_THROW_ON_ERROR);
-    }
-
-    /**
-     * @param  array<string, mixed>  $docs
-     * @param  array<string, mixed>  $schema
-     * @return array<string, mixed>
-     */
-    private function resolveSchema(array $docs, array $schema): array
-    {
-        if (isset($schema['$ref'])) {
-            $name = str_replace('#/components/schemas/', '', $schema['$ref']);
-
-            return $this->resolveSchema($docs, $docs['components']['schemas'][$name]);
-        }
-
-        return $schema;
-    }
-
-    public function test_api_docs_can_be_exported(): void
-    {
-        // Act
-        $docs = $this->exportApiDocs();
-
-        // Assert
-        $this->assertArrayHasKey('paths', $docs);
-        $this->assertNotEmpty($docs['paths']);
-    }
-
-    public function test_paginated_endpoints_are_documented_with_pagination(): void
-    {
-        // Act
-        $docs = $this->exportApiDocs();
-
-        // Assert
-        $tagsSchema = $docs['paths']['/v1/organizations/{organization}/tags']['get']['responses']['200']['content']['application/json']['schema'];
-        $this->assertSame(['data', 'links', 'meta'], $tagsSchema['required']);
-        $tagsData = $this->resolveSchema($docs, $tagsSchema['properties']['data']);
-        $this->assertSame('array', $tagsData['type']);
-        $this->assertSame('#/components/schemas/TagResource', $tagsData['items']['$ref']);
-
-        $timeEntriesSchema = $docs['paths']['/v1/organizations/{organization}/time-entries']['get']['responses']['200']['content']['application/json']['schema'];
-        $this->assertSame(['data', 'meta'], $timeEntriesSchema['required']);
-        $this->assertSame(['total'], $timeEntriesSchema['properties']['meta']['required']);
-    }
-
-    public function test_fallback_routes_are_excluded_from_api_docs(): void
-    {
-        // Act
-        $docs = $this->exportApiDocs();
-
-        // Assert
-        $this->assertArrayNotHasKey('/', $docs['paths']);
-        $this->assertArrayNotHasKey('/{fallbackPlaceholder}', $docs['paths']);
-    }
-
-    public function test_fallback_routes_return_not_found(): void
-    {
-        // Act
-        $rootResponse = $this->getJson('/api');
-        $unknownResponse = $this->getJson('/api/does-not-exist');
-
-        // Assert
-        $rootResponse->assertNotFound();
-        $rootResponse->assertJsonPath('message', 'API resource not found');
-        $unknownResponse->assertNotFound();
-        $unknownResponse->assertJsonPath('message', 'API resource not found');
-    }
-}

tests/Unit/Filament/Resources/AuditResourceTest.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Filament\Resources;
+
+use App\Filament\Resources\AuditResource;
+use App\Models\Audit;
+use App\Models\TimeEntry;
+use App\Models\User;
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\DB;
+use Livewire\Livewire;
+use PHPUnit\Framework\Attributes\UsesClass;
+use Tests\Unit\Filament\FilamentTestCase;
+
+#[UsesClass(AuditResource::class)]
+class AuditResourceTest extends FilamentTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Config::set('auth.super_admins', ['admin@example.com']);
+        $user = User::factory()->withPersonalOrganization()->create([
+            'email' => 'admin@example.com',
+        ]);
+
+        $this->actingAs($user);
+    }
+
+    public function test_can_list_audits(): void
+    {
+        // Arrange
+        $user = $this->createUserWithPermission();
+        $timeEntry = TimeEntry::factory()->forMember($user->member)->create();
+        DB::table((new Audit)->getTable())->delete();
+        $audits = Audit::factory()->auditFor($timeEntry)->auditUser($user->user)->createMany(5);
+
+        // Act
+        $response = Livewire::test(AuditResource\Pages\ListAudits::class);
+
+        // Assert
+        $response->assertSuccessful();
+        $response->assertCanSeeTableRecords($audits);
+    }
+
+    public function test_can_see_view_page_of_audit(): void
+    {
+        // Arrange
+        DB::table((new Audit)->getTable())->delete();
+        $audit = Audit::factory()->create();
+
+        // Act
+        $response = Livewire::test(AuditResource\Pages\ViewAudit::class, ['record' => $audit->getKey()]);
+
+        // Assert
+        $response->assertSuccessful();
+    }
+}

tests/Unit/Middleware/TrustHostsTest.php

@@ -50,8 +50,7 @@ class TrustHostsTest extends TestCase
         $this->middleware()->handle($request, fn (Request $request): Response => new Response('passed'));
 
         try {
-            // Note: Throws an exception if the host is not trusted
-            $request->getHost();
+            dump($request->getHost());
 
             return true;
         } catch (\Throwable) {

tests/Unit/Model/AuditModelTest.php

@@ -1,209 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Tests\Unit\Model;
-
-use App\Models\Audit;
-use App\Models\Concerns\AuditableWithoutOwner;
-use App\Models\Member;
-use App\Models\Organization;
-use App\Models\Project;
-use App\Models\ProjectMember;
-use App\Models\TimeEntry;
-use App\Models\User;
-use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\Relation;
-use Illuminate\Support\Facades\DB;
-use PHPUnit\Framework\Attributes\CoversClass;
-
-#[CoversClass(Audit::class)]
-class AuditModelTest extends ModelTestAbstract
-{
-    public function test_it_belongs_to_an_owner_organization(): void
-    {
-        // Arrange
-        $organization = Organization::factory()->create();
-        $audit = Audit::factory()->create([
-            'owner_organization_id' => $organization->getKey(),
-        ]);
-
-        // Act
-        $audit->refresh();
-        $ownerOrganizationRel = $audit->ownerOrganization;
-
-        // Assert
-        $this->assertNotNull($ownerOrganizationRel);
-        $this->assertTrue($ownerOrganizationRel->is($organization));
-    }
-
-    public function test_it_belongs_to_an_owner_user(): void
-    {
-        // Arrange
-        $user = User::factory()->create();
-        $audit = Audit::factory()->create([
-            'owner_user_id' => $user->getKey(),
-        ]);
-
-        // Act
-        $audit->refresh();
-        $ownerUserRel = $audit->ownerUser;
-
-        // Assert
-        $this->assertNotNull($ownerUserRel);
-        $this->assertTrue($ownerUserRel->is($user));
-    }
-
-    public function test_audits_of_models_with_organization_have_the_organization_as_owner(): void
-    {
-        // Arrange
-        $organization = Organization::factory()->create();
-        $member = Member::factory()->forOrganization($organization)->create();
-
-        // Act
-        $timeEntry = TimeEntry::factory()->forOrganization($organization)->forMember($member)->create();
-
-        // Assert
-        $audit = Audit::query()->where('auditable_id', $timeEntry->getKey())->sole();
-        $this->assertSame($organization->getKey(), $audit->owner_organization_id);
-        $this->assertNull($audit->owner_user_id);
-    }
-
-    public function test_audits_of_project_members_have_the_organization_of_the_project_as_owner(): void
-    {
-        // Arrange
-        $organization = Organization::factory()->create();
-        $project = Project::factory()->forOrganization($organization)->create();
-        $member = Member::factory()->forOrganization($organization)->create();
-
-        // Act
-        $projectMember = ProjectMember::factory()->forProject($project)->forMember($member)->create();
-
-        // Assert
-        $audit = Audit::query()->where('auditable_id', $projectMember->getKey())->sole();
-        $this->assertSame($organization->getKey(), $audit->owner_organization_id);
-        $this->assertNull($audit->owner_user_id);
-    }
-
-    public function test_owner_organization_through_parent_uses_the_loaded_parent_without_query(): void
-    {
-        // Arrange
-        $organization = Organization::factory()->create();
-        $project = Project::factory()->forOrganization($organization)->create();
-        $projectMember = ProjectMember::factory()->forProject($project)->forMember(Member::factory()->forOrganization($organization)->create())->create();
-        $projectMember->load('project');
-        DB::enableQueryLog();
-
-        // Act
-        $ownerOrganizationId = $projectMember->getAuditOwnerOrganizationId();
-
-        // Assert
-        $this->assertSame($organization->getKey(), $ownerOrganizationId);
-        $this->assertCount(0, DB::getQueryLog());
-    }
-
-    public function test_owner_organization_through_parent_ignores_a_loaded_parent_that_does_not_match_the_foreign_key(): void
-    {
-        // Arrange
-        $organization = Organization::factory()->create();
-        $otherOrganization = Organization::factory()->create();
-        $project = Project::factory()->forOrganization($organization)->create();
-        $otherProject = Project::factory()->forOrganization($otherOrganization)->create();
-        $projectMember = ProjectMember::factory()->forProject($project)->forMember(Member::factory()->forOrganization($organization)->create())->create();
-        $projectMember->load('project');
-        $projectMember->project_id = $otherProject->getKey();
-
-        // Act
-        $ownerOrganizationId = $projectMember->getAuditOwnerOrganizationId();
-
-        // Assert
-        $this->assertSame($otherOrganization->getKey(), $ownerOrganizationId);
-    }
-
-    public function test_audits_of_an_organization_have_the_organization_itself_as_owner(): void
-    {
-        // Act
-        $organization = Organization::factory()->create();
-
-        // Assert
-        $audit = Audit::query()->where('auditable_id', $organization->getKey())->sole();
-        $this->assertSame($organization->getKey(), $audit->owner_organization_id);
-        $this->assertNull($audit->owner_user_id);
-    }
-
-    public function test_audits_of_a_user_have_the_user_itself_as_owner(): void
-    {
-        // Act
-        $user = User::factory()->create();
-
-        // Assert
-        $audit = Audit::query()->where('auditable_id', $user->getKey())->sole();
-        $this->assertSame($user->getKey(), $audit->owner_user_id);
-        $this->assertNull($audit->owner_organization_id);
-    }
-
-    public function test_deleting_an_owner_deletes_its_audits_and_does_not_create_a_deletion_audit(): void
-    {
-        // Arrange
-        $user = User::factory()->create();
-        $organization = Organization::factory()->create();
-        $otherUser = User::factory()->create();
-
-        // Act
-        $user->delete();
-        $organization->delete();
-
-        // Assert
-        $this->assertSame(0, Audit::query()->where('auditable_id', $user->getKey())->count());
-        $this->assertSame(0, Audit::query()->where('auditable_id', $organization->getKey())->count());
-        $this->assertSame(1, Audit::query()->where('auditable_id', $otherUser->getKey())->count());
-    }
-
-    public function test_auditable_types_without_owner_are_determined_by_the_marker_interface(): void
-    {
-        // Arrange
-        $originalMorphMap = Relation::morphMap();
-        $modelWithoutOwner = new class extends Model implements AuditableWithoutOwner {};
-        Relation::morphMap(['model-without-owner' => $modelWithoutOwner::class]);
-
-        try {
-            // Act
-            $typesWithoutOwner = Audit::getAuditableTypesWithoutOwner();
-            $isWithoutOwner = Audit::isAuditableTypeWithoutOwner('model-without-owner');
-            $isTimeEntryWithoutOwner = Audit::isAuditableTypeWithoutOwner((new TimeEntry)->getMorphClass());
-
-            // Assert
-            $this->assertContains('model-without-owner', $typesWithoutOwner);
-            $this->assertNotContains((new TimeEntry)->getMorphClass(), $typesWithoutOwner);
-            $this->assertTrue($isWithoutOwner);
-            $this->assertFalse($isTimeEntryWithoutOwner);
-        } finally {
-            Relation::morphMap($originalMorphMap, false);
-        }
-    }
-
-    public function test_scope_where_missing_owner_only_returns_audits_without_owner_whose_type_should_have_one(): void
-    {
-        // Arrange
-        $originalMorphMap = Relation::morphMap();
-        $modelWithoutOwner = new class extends Model implements AuditableWithoutOwner {};
-        Relation::morphMap(['model-without-owner' => $modelWithoutOwner::class]);
-        $organization = Organization::factory()->create();
-        $user = User::factory()->create();
-        Audit::query()->delete();
-        $missingOwnerAudit = Audit::factory()->create(['auditable_type' => (new TimeEntry)->getMorphClass()]);
-        Audit::factory()->create(['auditable_type' => (new TimeEntry)->getMorphClass(), 'owner_organization_id' => $organization->getKey()]);
-        Audit::factory()->create(['owner_user_id' => $user->getKey()]);
-        Audit::factory()->create(['auditable_type' => 'model-without-owner']);
-
-        try {
-            // Act
-            $auditIds = Audit::query()->whereMissingOwner()->pluck('id')->all();
-
-            // Assert
-            $this->assertSame([$missingOwnerAudit->getKey()], $auditIds);
-        } finally {
-            Relation::morphMap($originalMorphMap, false);
-        }
-    }
-}

tests/Unit/Service/DeletionServiceTest.php

@@ -7,13 +7,9 @@ namespace Tests\Unit\Service;
 use App\Enums\Role;
 use App\Events\BeforeOrganizationDeletion;
 use App\Exceptions\Api\CanNotDeleteUserWhoIsOwnerOfOrganizationWithMultipleMembers;
-use App\Models\Audit;
 use App\Models\Client;
 use App\Models\Member;
 use App\Models\Organization;
-use App\Models\Passport\Client as PassportClient;
-use App\Models\Passport\RefreshToken;
-use App\Models\Passport\Token;
 use App\Models\Project;
 use App\Models\ProjectMember;
 use App\Models\Report;
@@ -27,7 +23,6 @@ use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
-use Illuminate\Support\Str;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Tests\TestCaseWithDatabase;
 use TiMacDonald\Log\LogEntry;
@@ -183,8 +178,6 @@ class DeletionServiceTest extends TestCaseWithDatabase
         // Assert
         $this->assertOrganizationDeleted($organization->organization);
         $this->assertOrganizationNothingDeleted($otherOrganization->organization);
-        $this->assertSame(0, Audit::query()->where('owner_organization_id', $organization->organization->getKey())->count());
-        $this->assertGreaterThan(0, Audit::query()->where('owner_organization_id', $otherOrganization->organization->getKey())->count());
         Log::assertLoggedTimes(fn (LogEntry $log) => $log->level === 'debug'
             && $log->message === 'Start deleting organization'
             && $log->context['organization_id'] === $organization->organization->getKey(),
@@ -321,10 +314,6 @@ class DeletionServiceTest extends TestCaseWithDatabase
         $this->assertDatabaseMissing(Member::class, [
             'user_id' => $user->getKey(),
         ]);
-        $this->assertSame(0, Audit::query()->where('owner_user_id', $user->getKey())->count());
-        $this->assertSame(0, Audit::query()->where('owner_organization_id', $user->current_team_id)->count());
-        $this->assertGreaterThan(0, Audit::query()->where('owner_user_id', $otherUser->getKey())->count());
-        $this->assertGreaterThan(0, Audit::query()->where('owner_organization_id', $otherUser->current_team_id)->count());
         Storage::disk(config('filesystems.public'))->assertMissing($user->profile_photo_path);
         Storage::disk(config('filesystems.public'))->assertExists($otherUser->profile_photo_path);
         Log::assertLoggedTimes(fn (LogEntry $log) => $log->level === 'debug'
@@ -339,24 +328,6 @@ class DeletionServiceTest extends TestCaseWithDatabase
         );
     }
 
-    public function test_delete_user_keeps_audits_of_other_organizations_where_the_user_is_the_actor(): void
-    {
-        // Arrange
-        $user = User::factory()->withPersonalOrganization()->create();
-        $otherOrganization = Organization::factory()->create();
-        $audit = Audit::factory()->auditUser($user)->auditFor($otherOrganization)->create([
-            'owner_organization_id' => $otherOrganization->getKey(),
-        ]);
-
-        // Act
-        $this->deletionService->deleteUser($user);
-
-        // Assert
-        $audit->refresh();
-        $this->assertSame($user->getKey(), $audit->actor_id);
-        $this->assertSame($otherOrganization->getKey(), $audit->owner_organization_id);
-    }
-
     public function test_delete_user_deletes_owned_organizations_that_have_only_one_member_and_makes_makes_the_user_placeholder_in_not_owned_organizations(): void
     {
         // Arrange
@@ -453,45 +424,4 @@ class DeletionServiceTest extends TestCaseWithDatabase
             'role' => Role::Placeholder->value,
         ]);
     }
-
-    public function test_delete_user_deletes_access_tokens_and_their_refresh_tokens_but_does_not_delete_tokens_of_other_users(): void
-    {
-        // Arrange
-        $user = User::factory()->create();
-        $otherUser = User::factory()->create();
-        $passportClient = PassportClient::factory()->create();
-
-        $userToken = Token::factory()->forUser($user)->forClient($passportClient)->create();
-        $userRefreshToken = RefreshToken::query()->create([
-            'id' => Str::random(100),
-            'access_token_id' => $userToken->getKey(),
-            'revoked' => false,
-            'expires_at' => now()->addDays(30),
-        ]);
-
-        $otherUserToken = Token::factory()->forUser($otherUser)->forClient($passportClient)->create();
-        $otherUserRefreshToken = RefreshToken::query()->create([
-            'id' => Str::random(100),
-            'access_token_id' => $otherUserToken->getKey(),
-            'revoked' => false,
-            'expires_at' => now()->addDays(30),
-        ]);
-
-        // Act
-        $this->deletionService->deleteUser($user);
-
-        // Assert
-        $this->assertDatabaseMissing(Token::class, [
-            'id' => $userToken->getKey(),
-        ]);
-        $this->assertDatabaseMissing(RefreshToken::class, [
-            'id' => $userRefreshToken->getKey(),
-        ]);
-        $this->assertDatabaseHas(Token::class, [
-            'id' => $otherUserToken->getKey(),
-        ]);
-        $this->assertDatabaseHas(RefreshToken::class, [
-            'id' => $otherUserRefreshToken->getKey(),
-        ]);
-    }
 }

tsconfig.json

@@ -6,9 +6,7 @@
   "compilerOptions": {
     "paths": {
       "@/*": ["./resources/js/*"],
-      "@solidtime/ui": ["./resources/js/packages/ui/src/index.ts"],
-      "@e2e/*": ["./e2e/*"],
-      "@e2e-support/*": ["./playwright/*"]
+      "@solidtime/ui": ["./resources/js/packages/ui/src/index.ts"]
     }
   },
   "skipLibCheck": true,