ad4d3c9976
Replaces two independent Smartsheet configs (water log + time tracking) with one brand-level workbook connection that owns the encrypted API token. Per-feature configs keep their sheet_id + column_mapping + frequency + sync_enabled. Schema (migration 0096): - NEW smartsheet_workspace: one row per brand. Holds encrypted_api_token + token_iv + token_auth_tag (AES-256-GCM, same key), default_sheet_id, connection_enabled (master switch), last_test_*, audit columns. RLS brand-scoped. - Backfill: water_smartsheet_config rows copy into workspace first; time_tracking_smartsheet_config fills in only brands with no workspace row yet. Idempotent (NOT EXISTS + ON CONFLICT DO NOTHING). - DROP encrypted_api_token + token_iv + token_auth_tag from both feature configs (destructive — bytes are copied to workspace first). - Drop unused bytea customType from both schemas (no longer needed). Actions: - NEW src/actions/smartsheet/workspace.ts: getSmartsheetWorkspace, saveSmartsheetWorkspace, testSmartsheetWorkspaceConnection, disableSmartsheetWorkspace. Permission: can_manage_settings + platform_admin. - NEW src/services/workspace-token.ts (server-only): resolveWorkspaceToken helper. Lives outside the 'use server' file so the plaintext token is not exposed as an RPC surface — only callable from server-side sync engines. - MODIFIED water-log + time-tracking smartsheet actions: refactored to read token via resolveWorkspaceToken; save* no longer accepts a token; test* falls through to the workspace token if no token given. - MODIFIED both sync services: load token from resolveWorkspaceToken instead of decrypting the per-feature config. 'connection_disabled' now skips cleanly (no retry, no failed log row) — pausing the workspace at the hub level no longer floods Recent Activity with 'disabled' failures. UI: - NEW src/components/admin/water-log/SmartsheetHub.tsx: top-level hub card. Owns the token + Test Connection + connection enabled toggle + default sheet ID + last-verified badge. Permission gated. - MODIFIED SmartsheetIntegrationCard.tsx (water): rewritten without token UI. Reads masked token from workspace. Sheet ID + column mapping + frequency + enabled + backfill + recent activity. - MODIFIED TimeTrackingSmartsheetCard.tsx: same treatment. - MODIFIED /admin/water-log/settings/page: collapses §05 + §06 into a single Smartsheet section with the hub on top + both feature cards as siblings underneath. Tuxedo-only throughout (TUXEDO_BRAND_ID hardcoded in the settings page; matches existing single-tenant /water convention). Security fixes from pr-reviewer: - resolveWorkspaceToken extracted from 'use server' file to a server-only service module — was reachable as an RPC, would have returned the plaintext token to any authenticated admin. - getSmartsheetWorkspace now actually checks the auth result instead of calling requireManageSettings() and discarding the return value. Diff: -1742 / +597 lines (net -1100 from the simpler per-feature card).
309 lines
9.7 KiB
TypeScript
309 lines
9.7 KiB
TypeScript
/**
|
|
* Time Tracking. Source: `db/migrations/0001_init.sql` and the
|
|
* Cycle-5 Smartsheet scaffold (`db/migrations/0095_*.sql`).
|
|
*
|
|
* Cycle 7: the encrypted token columns on
|
|
* `time_tracking_smartsheet_config` moved to `smartsheet_workspace`
|
|
* (see `db/schema/smartsheet-workspace.ts`).
|
|
*/
|
|
import {
|
|
pgTable,
|
|
uuid,
|
|
text,
|
|
numeric,
|
|
integer,
|
|
boolean,
|
|
timestamp,
|
|
index,
|
|
jsonb,
|
|
} from "drizzle-orm/pg-core";
|
|
import { brands } from "./brands";
|
|
|
|
export const timeTrackingSettings = pgTable(
|
|
"time_tracking_settings",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.unique()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
payPeriodStartDay: integer("pay_period_start_day").notNull().default(0),
|
|
payPeriodLengthDays: integer("pay_period_length_days")
|
|
.notNull()
|
|
.default(7),
|
|
dailyOvertimeThreshold: numeric("daily_overtime_threshold", {
|
|
precision: 5,
|
|
scale: 2,
|
|
}).notNull().default("8.0"),
|
|
weeklyOvertimeThreshold: numeric("weekly_overtime_threshold", {
|
|
precision: 5,
|
|
scale: 2,
|
|
}).notNull().default("40.0"),
|
|
overtimeMultiplier: numeric("overtime_multiplier", {
|
|
precision: 3,
|
|
scale: 2,
|
|
}).notNull().default("1.50"),
|
|
overtimeNotifications: boolean("overtime_notifications")
|
|
.notNull()
|
|
.default(true),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
updatedAt: timestamp("updated_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
);
|
|
|
|
export const timeTrackingWorkers = pgTable(
|
|
"time_tracking_workers",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
name: text("name").notNull(),
|
|
role: text("role", { enum: ["worker", "time_admin"] })
|
|
.notNull()
|
|
.default("worker"),
|
|
lang: text("lang").notNull().default("en"),
|
|
pin: text("pin").notNull(),
|
|
active: boolean("active").notNull().default(true),
|
|
lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
(t) => ({
|
|
brandIdx: index("time_tracking_workers_brand_idx").on(t.brandId),
|
|
}),
|
|
);
|
|
|
|
export const timeTrackingTasks = pgTable(
|
|
"time_tracking_tasks",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
name: text("name").notNull(),
|
|
nameEs: text("name_es"),
|
|
unit: text("unit", { enum: ["hours", "pieces", "units"] })
|
|
.notNull()
|
|
.default("hours"),
|
|
sortOrder: integer("sort_order").notNull().default(0),
|
|
active: boolean("active").notNull().default(true),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
(t) => ({
|
|
brandIdx: index("time_tracking_tasks_brand_idx").on(t.brandId),
|
|
}),
|
|
);
|
|
|
|
export const timeTrackingLogs = pgTable(
|
|
"time_tracking_logs",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
workerId: uuid("worker_id")
|
|
.notNull()
|
|
.references(() => timeTrackingWorkers.id, { onDelete: "cascade" }),
|
|
taskId: uuid("task_id").references(() => timeTrackingTasks.id, {
|
|
onDelete: "set null",
|
|
}),
|
|
taskName: text("task_name").notNull(),
|
|
clockIn: timestamp("clock_in", { withTimezone: true }).notNull(),
|
|
clockOut: timestamp("clock_out", { withTimezone: true }),
|
|
lunchBreakMinutes: integer("lunch_break_minutes").notNull().default(0),
|
|
notes: text("notes"),
|
|
submittedVia: text("submitted_via", {
|
|
enum: ["manual", "field", "import"],
|
|
}).notNull().default("manual"),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
(t) => ({
|
|
brandIdx: index("time_tracking_logs_brand_idx").on(t.brandId),
|
|
workerIdx: index("time_tracking_logs_worker_idx").on(t.workerId),
|
|
clockInIdx: index("time_tracking_logs_clock_in_idx").on(t.clockIn),
|
|
}),
|
|
);
|
|
|
|
export const timeTrackingNotificationLog = pgTable(
|
|
"time_tracking_notification_log",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
workerId: uuid("worker_id").references(
|
|
() => timeTrackingWorkers.id,
|
|
{ onDelete: "set null" },
|
|
),
|
|
notificationType: text("notification_type").notNull(),
|
|
recipient: text("recipient").notNull(),
|
|
subject: text("subject"),
|
|
body: text("body").notNull(),
|
|
status: text("status", {
|
|
enum: ["pending", "sent", "failed"],
|
|
}).notNull().default("pending"),
|
|
sentAt: timestamp("sent_at", { withTimezone: true }),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
);
|
|
|
|
export type TimeTrackingSettings = typeof timeTrackingSettings.$inferSelect;
|
|
export type TimeTrackingWorker = typeof timeTrackingWorkers.$inferSelect;
|
|
export type TimeTrackingTask = typeof timeTrackingTasks.$inferSelect;
|
|
export type TimeTrackingLog = typeof timeTrackingLogs.$inferSelect;
|
|
export type TimeTrackingNotificationLog =
|
|
typeof timeTrackingNotificationLog.$inferSelect;
|
|
|
|
// ── Smartsheet sync (Cycle 5) ──────────────────────────────────────────────
|
|
|
|
/**
|
|
* Allowed sync frequencies. Mirrors the water-log smartsheet
|
|
* pattern (see `db/schema/water-log.ts` SMARTSHEET_FREQUENCIES).
|
|
*/
|
|
export const TT_SMARTSHEET_FREQUENCIES = [
|
|
"realtime",
|
|
"every_15_minutes",
|
|
"hourly",
|
|
] as const;
|
|
export type TTSmartsheetFrequency = (typeof TT_SMARTSHEET_FREQUENCIES)[number];
|
|
|
|
/**
|
|
* Time-tracking fields a brand can map to their Smartsheet columns.
|
|
* `log_id` and `clock_in` are required (used for dedup).
|
|
*/
|
|
export type TTSmartsheetColumnKey =
|
|
| "log_id"
|
|
| "clock_in"
|
|
| "clock_out"
|
|
| "worker"
|
|
| "task"
|
|
| "hours"
|
|
| "lunch_minutes"
|
|
| "notes";
|
|
export const TT_SMARTSHEET_COLUMN_KEYS: readonly TTSmartsheetColumnKey[] = [
|
|
"log_id",
|
|
"clock_in",
|
|
"clock_out",
|
|
"worker",
|
|
"task",
|
|
"hours",
|
|
"lunch_minutes",
|
|
"notes",
|
|
] as const;
|
|
|
|
/**
|
|
* Shape stored in `time_tracking_smartsheet_config.column_mapping`.
|
|
* Required: log_id + clock_in (for dedup). All others nullable.
|
|
*/
|
|
export type TTSmartsheetColumnMapping = {
|
|
log_id: string;
|
|
clock_in: string;
|
|
clock_out: string | null;
|
|
worker: string | null;
|
|
task: string | null;
|
|
hours: string | null;
|
|
lunch_minutes: string | null;
|
|
notes: string | null;
|
|
};
|
|
|
|
export const timeTrackingSmartsheetConfig = pgTable(
|
|
"time_tracking_smartsheet_config",
|
|
{
|
|
brandId: uuid("brand_id")
|
|
.primaryKey()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
sheetId: text("sheet_id").notNull(),
|
|
// Cycle 7: encrypted token columns moved to smartsheet_workspace.
|
|
// See migration 0096_smartsheet_workbook_hub.sql.
|
|
columnMapping: jsonb("column_mapping")
|
|
.$type<TTSmartsheetColumnMapping>()
|
|
.notNull(),
|
|
syncFrequency: text("sync_frequency")
|
|
.$type<TTSmartsheetFrequency>()
|
|
.notNull()
|
|
.default("hourly"),
|
|
syncEnabled: boolean("sync_enabled").notNull().default(false),
|
|
lastSyncAt: timestamp("last_sync_at", { withTimezone: true }),
|
|
lastSyncError: text("last_sync_error"),
|
|
createdBy: text("created_by"),
|
|
updatedBy: text("updated_by"),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
updatedAt: timestamp("updated_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
);
|
|
|
|
export const timeTrackingSmartsheetSyncQueue = pgTable(
|
|
"time_tracking_smartsheet_sync_queue",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
logId: uuid("log_id")
|
|
.notNull()
|
|
.references(() => timeTrackingLogs.id, { onDelete: "cascade" }),
|
|
smartsheetRowId: text("smartsheet_row_id"),
|
|
status: text("status", {
|
|
enum: ["pending", "syncing", "synced", "failed"],
|
|
})
|
|
.notNull()
|
|
.default("pending"),
|
|
attempts: integer("attempts").notNull().default(0),
|
|
lastError: text("last_error"),
|
|
nextAttemptAt: timestamp("next_attempt_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
syncedAt: timestamp("synced_at", { withTimezone: true }),
|
|
},
|
|
);
|
|
|
|
export const timeTrackingSmartsheetSyncLog = pgTable(
|
|
"time_tracking_smartsheet_sync_log",
|
|
{
|
|
id: uuid("id").primaryKey().defaultRandom(),
|
|
brandId: uuid("brand_id")
|
|
.notNull()
|
|
.references(() => brands.id, { onDelete: "cascade" }),
|
|
logId: uuid("log_id").references(() => timeTrackingLogs.id, {
|
|
onDelete: "set null",
|
|
}),
|
|
smartsheetRowId: text("smartsheet_row_id"),
|
|
action: text("action", {
|
|
enum: ["sync", "retry", "skip", "queue"],
|
|
}).notNull(),
|
|
success: boolean("success").notNull(),
|
|
error: text("error"),
|
|
durationMs: integer("duration_ms"),
|
|
createdAt: timestamp("created_at", { withTimezone: true })
|
|
.notNull()
|
|
.defaultNow(),
|
|
},
|
|
);
|
|
|
|
export type TimeTrackingSmartsheetConfig =
|
|
typeof timeTrackingSmartsheetConfig.$inferSelect;
|
|
export type TimeTrackingSmartsheetConfigInsert =
|
|
typeof timeTrackingSmartsheetConfig.$inferInsert;
|
|
export type TimeTrackingSmartsheetSyncQueue =
|
|
typeof timeTrackingSmartsheetSyncQueue.$inferSelect;
|
|
export type TimeTrackingSmartsheetSyncLog =
|
|
typeof timeTrackingSmartsheetSyncLog.$inferSelect; |