alldigital/PSA
2
0
Fork 0
Code Issues Pull Requests Actions 15 Packages Projects Releases Wiki Activity
PSA/ee/docs/plans/2026-05-21-timesheet-self-approval-default/SCRATCHPAD.md
Hermes 284313f908
Some checks are pending
Bidi Control Character Guard / bidi-control-guard (push) Waiting to run
Details
Circular Dependency Check / Check for new circular dependencies (push) Waiting to run
Details
Citus Migration Smoke / Combined migrations on single-node Citus (push) Waiting to run
Details
E2E Fresh Install Tests / fresh-install-e2e (push) Waiting to run
Details
ext-v2 guardrails / Run ext-v2 guard and ESLint (push) Waiting to run
Details
Integration Tests / Check for relevant changes (push) Waiting to run
Details
Integration Tests / ${{ (github.event_name == 'schedule' || github.event.inputs.suite == 'full') && 'Full integration suite' || 'Tier-1 integration subset' }} (push) Blocked by required conditions
Details
Mobile checks / Mobile lint + typecheck (push) Waiting to run
Details
Mobile checks / Mobile unit tests (push) Waiting to run
Details
Mobile checks / Mobile dependency audit (report) (push) Waiting to run
Details
Mobile checks / Mobile reproducibility checks (push) Waiting to run
Details
Secrets guard (env backups) / Ensure no tracked env backup files (push) Waiting to run
Details
Temporal Readiness / fast-readiness (push) Waiting to run
Details
Temporal Readiness / docker-parity (push) Waiting to run
Details
TypeScript Type Check / Nx affected typecheck (push) Waiting to run
Details
Unit Tests / Skipped-test budget (push) Waiting to run
Details
Unit Tests / Nx affected unit tests (push) Waiting to run
Details
Unit Tests / Server unit coverage (informational) (push) Waiting to run
Details
Validate Tenant Management Schema / Check for relevant changes (push) Waiting to run
Details
Validate Tenant Management Schema / Validate Tenant Management Schema (push) Blocked by required conditions
Details
EE Workflows Build Guard / ee-workflows-build-guard (push) Waiting to run
Details
Initial import of AlgaPSA codebase from PSA server 
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz

Source: /opt/alga-psa on psa.joliet.tech
2026-06-22 16:12:17 -05:00

2.4 KiB
Raw Permalink Blame History

Scratchpad — Timesheet Self-Approval Defaults

2026-05-21

  • User confirmed desired default: any user with timesheet:approve may approve their own time.
  • Investigation found unconditional denial in packages/scheduling/src/actions/timeEntryDelegationAuth.ts and shared/workflow/runtime/actions/businessOperations/timeDomain.ts.
  • Decision: default RBAC permits self-approval; premium ABAC not_self_approver remains tenant-configured opt-in separation of duties.
  • Constraint: workflow shared code should not depend on the full authorization kernel, so it needs a direct DB check for active assigned bundle rules.
  • Existing user changes before implementation: .env.localtest, package-lock.json; do not touch.

Implementation notes

  • Removed the built-in mutation guard from assertCanApproveSubject; bundle narrowing/mutation evaluation remains responsible for not_self_approver.
  • Added hasAssignedNotSelfApproverBundleRuleForWorkflowTime in timeDomain.ts to query active assigned bundles directly for workflow approval self-checks.
  • Updated the EE bundle simulator so its built-in self-approval guard remains billing-only; time approval simulation now relies on configured bundle rules.
  • Updated static/contract tests for server approval wiring, workflow ABAC self-approval behavior, and simulator guard scope.

Validation

  • PASS: npx tsc --noEmit -p shared/tsconfig.json --pretty false
  • PASS: npm run typecheck --workspace packages/scheduling -- --pretty false
  • PASS: npm test --workspace server -- --run src/test/unit/scheduling/workflowTimeSelfApproval.contract.test.ts src/test/unit/scheduling/approvalBehavior.test.ts src/test/unit/authorization/bundleSimulatorSelfApproval.contract.test.ts
  • PARTIAL: npm test --workspace packages/scheduling -- timeEntryDelegationAuth.authorization.test.ts timeDelegationSweep.contract.test.ts runs timeDelegationSweep successfully but timeEntryDelegationAuth.authorization.test.ts fails before executing tests because Vitest cannot resolve @alga-psa/authorization/kernel from the package test harness.
  • PRE-EXISTING HARNESS FAILURE OBSERVED: npm test --workspace server -- --run src/test/unit/authorization/bundleSimulatorAction.test.ts fails in existing tests with knex(...).leftJoin is not a function before simulator assertions run.
  • LIMITATION: npm run typecheck --workspace server -- --pretty false OOMs near the Node heap limit after ~8 GB; narrower shared/scheduling typechecks passed.