Release 2.0.8 (#3914)

* support parsing negative durations in JS * bump luxon dependency * make sure that 2FA is not required for session based API calls * show name of items to delete * fix permission issue for recent activity items
2023-03-13 01:48:53 +01:00
parent 1310285133
commit 8449eafcb6
20 changed files with 92 additions and 50 deletions
--- a/assets/js/plugins/KimaiDateUtils.js
+++ b/assets/js/plugins/KimaiDateUtils.js
@@ -295,6 +295,11 @@ export default class KimaiDateUtils extends KimaiPlugin {
            return new Duration({seconds: 0});
        }

+        // actually, the parsing above should be improved, but that works as well
+        if (duration[0] === '-' && luxonDuration.valueOf() > 0) {
+            return luxonDuration.negate();
+        }
+
        return luxonDuration;
    }

--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
    "eslint-webpack-plugin": "^3.0",
    "gridstack": "^7.1",
    "litepicker": "^2.0",
-    "luxon": "^3.0",
+    "luxon": "^3.3",
    "node-sass": "^8.0",
    "sass-loader": "^13.2",
    "tom-select": "^2.0",
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -6535,11 +6535,6 @@ parameters:
            count: 1
            path: src/Repository/TimesheetRepository.php

-        -
-            message: "#^Method App\\\\Repository\\\\TimesheetRepository\\:\\:addPermissionCriteria\\(\\) has parameter \\$teams with no value type specified in iterable type array\\.$#"
-            count: 1
-            path: src/Repository/TimesheetRepository.php
-
        -
            message: "#^Method App\\\\Repository\\\\TimesheetRepository\\:\\:findTimesheetsById\\(\\) should return array\\<App\\\\Entity\\\\Timesheet\\> but returns iterable\\<App\\\\Entity\\\\Timesheet\\>\\.$#"
            count: 1
--- a/public/build/app.952a9f98.js
+++ b/public/build/app.952a9f98.js
--- a/public/build/app.bd3fd9c1.js
+++ b/public/build/app.bd3fd9c1.js
--- a/public/build/app.bd3fd9c1.js.LICENSE.txt
+++ b/public/build/app.bd3fd9c1.js.LICENSE.txt
--- a/public/build/entrypoints.json
+++ b/public/build/entrypoints.json
@@ -3,7 +3,7 @@
    "app": {
      "js": [
        "/build/runtime.f0079159.js",
-        "/build/app.952a9f98.js"
+        "/build/app.bd3fd9c1.js"
      ],
      "css": [
        "/build/app.c429ff5b.css"
@@ -63,7 +63,7 @@
  },
  "integrity": {
    "/build/runtime.f0079159.js": "sha384-H22sAW1aTvyIPqvHOvGXWSWTxf0y6mptp+MsVmyXCfjx/WJjBbhX9gbUZ+qIuihV",
-    "/build/app.952a9f98.js": "sha384-qK3Hcem6As5Jy3ZiVz2rlABsJUIvNMQ0Dq6RfRBalbq1l88/zFfE5ZRXVMYtLP73",
+    "/build/app.bd3fd9c1.js": "sha384-lz7W4QdKZkFcM0r1sScURXhxrv/ezU2DXgjGgubQsorHuaQDcKKoucOvSK3yxW/U",
    "/build/app.c429ff5b.css": "sha384-m7RJ9g2fW3tENrf+oi/FsH8wTu6fsjuhvpDztfqr+YjNN0AvCapER6yvmGkqwp+I",
    "/build/export-pdf.587575e7.js": "sha384-J50GStmmfVwUTN4dIRQ02eg9hyzGFPSzpTtpPody92j0V6zCqw+s5l8+ZhVTugeW",
    "/build/export-pdf.d8a6c23b.css": "sha384-ztepocHE4rnGE9eKZ4kL6jTKaePUyiwiB9TjJjstjpf/ckcKg1HedrEOOk/8ElJg",
--- a/public/build/manifest.json
+++ b/public/build/manifest.json
@@ -1,6 +1,6 @@
 {
  "build/app.css": "/build/app.c429ff5b.css",
-  "build/app.js": "/build/app.952a9f98.js",
+  "build/app.js": "/build/app.bd3fd9c1.js",
  "build/export-pdf.css": "/build/export-pdf.d8a6c23b.css",
  "build/export-pdf.js": "/build/export-pdf.587575e7.js",
  "build/invoice.css": "/build/invoice.3c80ee80.css",
--- a/src/API/Authentication/SessionAuthenticator.php
+++ b/src/API/Authentication/SessionAuthenticator.php
@@ -9,6 +9,7 @@

 namespace App\API\Authentication;

+use Scheb\TwoFactorBundle\Security\Http\Authenticator\TwoFactorAuthenticator;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
@@ -24,6 +25,19 @@ final class SessionAuthenticator extends AbstractAuthenticator
    {
    }

+    public function createToken(Passport $passport, string $firewallName): TokenInterface
+    {
+        $token = parent::createToken($passport, $firewallName);
+
+        // this should not be necessary, as /api/ is excluded from 2FA process, but just to make sure this
+        // authenticator never triggers 2FA, we add the attribute to the token
+
+        // https://symfony.com/bundles/SchebTwoFactorBundle/6.x/custom_conditions.html
+        $token->setAttribute(TwoFactorAuthenticator::FLAG_2FA_COMPLETE, true);
+
+        return $token;
+    }
+
    public function supports(Request $request): ?bool
    {
        if (str_contains($request->getRequestUri(), '/api/')) {
--- a/src/Constants.php
+++ b/src/Constants.php
@@ -17,11 +17,11 @@ class Constants
    /**
     * The current release version
     */
-    public const VERSION = '2.0.7';
+    public const VERSION = '2.0.8';
    /**
     * The current release: major * 10000 + minor * 100 + patch
     */
-    public const VERSION_ID = 20007;
+    public const VERSION_ID = 20008;
    /**
     * The software name
     */
--- a/src/Repository/TimesheetRepository.php
+++ b/src/Repository/TimesheetRepository.php
@@ -358,7 +358,9 @@ class TimesheetRepository extends EntityRepository
     *
     * Should a teamlead:
     * 1. see all records of his team-members, even if they recorded times for projects invisible to him
-     * 2. only see records for projects which can be accessed by hom (current situation)
+     * 2. only see records for projects which can be accessed by him (current situation)
+     *
+     * @param array<Team> $teams
     */
    private function addPermissionCriteria(QueryBuilder $qb, ?User $user = null, array $teams = []): bool
    {
@@ -637,6 +639,7 @@ class TimesheetRepository extends EntityRepository
    public function getRecentActivities(User $user, DateTime $startFrom = null, int $limit = 10): array
    {
        return $this->findTimesheetsById(
+            $user,
            $this->getRecentActivityIds($user, $startFrom, $limit)
        );
    }
@@ -653,13 +656,11 @@ class TimesheetRepository extends EntityRepository

        // do NOT join the customer and do NOT check the customer visibility, as this
        // will dramatically increase the speed of this (otherwise slow) query
-        // ->join('p.customer', 'c')
        // ->andWhere($qb->expr()->eq('c.visible', ':visible'))

        // you might want to join activity and project to check their visibility
        // but for now this is way slower than simply fetching more items
        //
-        // ->join('t.project', 'p')
        // ->andWhere($qb->expr()->eq('p.visible', ':visible'))
        // ->join('t.activity', 'a')
        // ->andWhere($qb->expr()->eq('a.visible', ':visible'))
@@ -680,6 +681,11 @@ class TimesheetRepository extends EntityRepository
                ->setParameter('begin', $startFrom);
        }

+        $qb->join('t.project', 'p');
+        $qb->join('p.customer', 'c');
+
+        $this->addPermissionCriteria($qb, $user);
+
        $results = $qb->getQuery()->getScalarResult();

        if (empty($results)) {
@@ -690,10 +696,13 @@ class TimesheetRepository extends EntityRepository
    }

    /**
+     * @param User $user
     * @param array<int> $ids
+     * @param bool $fullyHydrated
+     * @param bool $basicHydrated
     * @return array<Timesheet>
     */
-    public function findTimesheetsById(array $ids, bool $fullyHydrated = false, bool $basicHydrated = true): array
+    public function findTimesheetsById(User $user, array $ids, bool $fullyHydrated = false, bool $basicHydrated = true): array
    {
        if (\count($ids) === 0) {
            return [];
@@ -706,6 +715,11 @@ class TimesheetRepository extends EntityRepository
            ->orderBy('t.end', 'DESC')
        ;

+        $qb->join('t.project', 'p');
+        $qb->join('p.customer', 'c');
+
+        $this->addPermissionCriteria($qb, $user);
+
        return $this->getHydratedResultsByQuery($qb, $fullyHydrated, $basicHydrated);
    }

--- a/src/Timesheet/FavoriteRecordService.php
+++ b/src/Timesheet/FavoriteRecordService.php
@@ -39,7 +39,7 @@ final class FavoriteRecordService
            $recentIds = $this->repository->getRecentActivityIds($user, null, $limit);
        }
        /** @var array<int> $ids */
-        $ids = \array_slice(array_unique(array_merge($favIds, $recentIds)), 0, $limit);
+        $ids = array_unique(array_merge($favIds, $recentIds));

        /** @var array<int, bool|FavoriteTimesheet> $favorites */
        $favorites = [];
@@ -49,7 +49,7 @@ final class FavoriteRecordService

        $all = [];
        if (\count($ids) > 0) {
-            $timesheets = $this->repository->findTimesheetsById($ids, false, false);
+            $timesheets = $this->repository->findTimesheetsById($user, $ids, false, false);
            foreach ($timesheets as $timesheet) {
                $id = $timesheet->getId();
                if ($id === null) {
@@ -69,7 +69,7 @@ final class FavoriteRecordService
            }
        }

-        return array_values($all);
+        return \array_slice(array_values($all), 0, $limit);
    }

    private function getBookmark(User $user): Bookmark
--- a/templates/activity/delete.html.twig
+++ b/templates/activity/delete.html.twig
@@ -8,6 +8,7 @@
    {{ include(kimai_context.modalRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
        'message': ("delete_warning.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
        'form': form,
+        'delete_item_name': activity.name,
        'used': (stats.counter > 0),
        'back': path('admin_activity')
    }) }}
--- a/templates/customer/delete.html.twig
+++ b/templates/customer/delete.html.twig
@@ -8,6 +8,7 @@
    {{ include(kimai_context.modalRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
        'message': ("delete_warning.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
        'form': form,
+        'delete_item_name': customer.name,
        'used': (stats.counter > 0),
        'back': path('admin_customer')
    }) }}
--- a/templates/default/_form_delete.html.twig
+++ b/templates/default/_form_delete.html.twig
@@ -7,6 +7,9 @@
    {% endblock %}
    {% block box_body %}
        {% block form_body %}
+            {% if delete_item_name is defined %}
+                <p><strong>{{ delete_item_name }}</strong></p>
+            {% endif %}
            {% if used is same as (false) %}
                {{ 'delete.not_in_use'|trans }}
                <div class="d-none">
--- a/templates/default/_form_delete_modal.html.twig
+++ b/templates/default/_form_delete_modal.html.twig
@@ -6,6 +6,9 @@
        {{ title|default('confirm.delete'|trans) }}
    {% endblock %}
    {% block modal_body %}
+        {% if delete_item_name is defined %}
+            <p><strong>{{ delete_item_name }}</strong></p>
+        {% endif %}
        {% if used is same as (false) %}
            {{ 'delete.not_in_use'|trans }}
            <div class="d-none">
--- a/templates/favorite/index.html.twig
+++ b/templates/favorite/index.html.twig
@@ -1,4 +1,4 @@
-{% set favorites = favorite_timesheets(app.user) %}
+{% set favorites = favorite_timesheets(app.user, 10) %}
 {% if favorites|length > 0 %}
    {% from 'macros/widgets.html.twig' import label_customer, label_project, label_activity %}
    {% set class = "btn-outline-white" %}
@@ -6,34 +6,38 @@
        {% set class = "btn-dark" %}
    {% endif %}
    <div class="list-group list-group-flush list-group-hoverable menu">
+        {% set counter = 0 %}
        {% for favorite in favorites %}
            {% set entry = favorite.getTimesheet() %}
-            <div class="list-group-item">
-                <div class="row align-items-center">
-                    <div class="col text-truncate" >
-                        <a class="api-link text-decoration-none text-body d-block" href="{{ path('restart_timesheet', {'id': entry.id}) }}"
-                           data-event="kimai.timesheetStart kimai.timesheetUpdate kimai.closeRemoteModal" data-method="PATCH" data-msg-error="timesheet.start.error"
-                           data-msg-success="timesheet.start.success">
-                            {{ label_activity(entry.activity) }}
-                            <div class="d-block text-truncate mt-n1">
-                                {{ label_project(entry.project) }}
-                                {{ label_customer(entry.project.customer) }}
-                            </div>
-                        </a>
-                    </div>
-                    <div class="col-auto">
-                        {% if favorite.isFavorite() %}
-                        <a href="{{ path('favorites_timesheets_remove', {'id': favorite.timesheet.id}) }}" class="list-group-item-actions show remote-modal-reload">
-                            <i class="text-yellow {{ 'bookmarked'|icon }}"></i>
-                        </a>
-                        {% else %}
-                        <a href="{{ path('favorites_timesheets_add', {'id': favorite.timesheet.id}) }}" class="list-group-item-actions remote-modal-reload">
-                            <i class="{{ 'bookmark'|icon }}"></i>
-                        </a>
-                        {% endif %}
+            {% if is_granted('start', entry) and counter < 7 %}
+                {% set counter = counter + 1 %}
+                <div class="list-group-item">
+                    <div class="row align-items-center">
+                        <div class="col text-truncate" >
+                            <a class="api-link text-decoration-none text-body d-block" href="{{ path('restart_timesheet', {'id': entry.id}) }}"
+                               data-event="kimai.timesheetStart kimai.timesheetUpdate kimai.closeRemoteModal" data-method="PATCH" data-msg-error="timesheet.start.error"
+                               data-msg-success="timesheet.start.success">
+                                {{ label_activity(entry.activity) }}
+                                <div class="d-block text-truncate mt-n1">
+                                    {{ label_project(entry.project) }}
+                                    {{ label_customer(entry.project.customer) }}
+                                </div>
+                            </a>
+                        </div>
+                        <div class="col-auto">
+                            {% if favorite.isFavorite() %}
+                            <a href="{{ path('favorites_timesheets_remove', {'id': favorite.timesheet.id}) }}" class="list-group-item-actions show remote-modal-reload">
+                                <i class="text-yellow {{ 'bookmarked'|icon }}"></i>
+                            </a>
+                            {% else %}
+                            <a href="{{ path('favorites_timesheets_add', {'id': favorite.timesheet.id}) }}" class="list-group-item-actions remote-modal-reload">
+                                <i class="{{ 'bookmark'|icon }}"></i>
+                            </a>
+                            {% endif %}
+                        </div>
                    </div>
                </div>
-            </div>
+            {% endif %}
        {% endfor %}
    </div>
 {% endif %}
--- a/templates/project/delete.html.twig
+++ b/templates/project/delete.html.twig
@@ -8,6 +8,7 @@
    {{ include(kimai_context.modalRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
        'message': ("delete_warning.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
        'form': form,
+        'delete_item_name': project.name,
        'used': (stats.counter > 0),
        'back': path('admin_project')
    }) }}
--- a/templates/user/delete.html.twig
+++ b/templates/user/delete.html.twig
@@ -13,6 +13,7 @@
    {{ include(kimai_context.modalRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
        'message': ("delete_warning.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
        'form': form,
+        'delete_item_name': user.displayName,
        'used': inUse,
        'back': path('admin_user')
    }) }}
--- a/yarn.lock
+++ b/yarn.lock
@@ -5159,7 +5159,7 @@ __metadata:
    eslint-webpack-plugin: ^3.0
    gridstack: ^7.1
    litepicker: ^2.0
-    luxon: ^3.0
+    luxon: ^3.3
    node-sass: ^8.0
    sass-loader: ^13.2
    tom-select: ^2.0
@@ -5311,10 +5311,10 @@ __metadata:
  languageName: node
  linkType: hard

-"luxon@npm:^3.0":
-  version: 3.1.0
-  resolution: "luxon@npm:3.1.0"
-  checksum: f8a850b759ba7a2e009d904c522ed7bc264bf4add57578f8948e52a0ed96b627b025b5aad8032295b570ae19fac41f0ffab91bdb128715fb0cc020798a7ba886
+"luxon@npm:^3.3":
+  version: 3.3.0
+  resolution: "luxon@npm:3.3.0"
+  checksum: 50cf17a0dc155c3dcacbeae8c0b7e80db425e0ba97b9cbdf12a7fc142d841ff1ab1560919f033af46240ed44e2f70c49f76e3422524c7fc8bb8d81ca47c66187
  languageName: node
  linkType: hard