From 32e3c6f7f7ad7762b02a112282400290a049337a Mon Sep 17 00:00:00 2001 From: Ochenstarik Date: Thu, 24 Sep 2026 16:32:30 +0700 Subject: [PATCH] feat: add manager employee and timesheet workflows --- api/openapi.yaml | 79 +++++++++++++++++ docs/DESIGN-BRIEF-MANAGER-PORTAL.md | 15 ++++ src/portal-ui.ts | 26 ++++-- src/portal.ts | 130 ++++++++++++++++++++++++++++ tests/integration/portal.test.ts | 73 +++++++++++++++- 5 files changed, 314 insertions(+), 9 deletions(-) create mode 100644 docs/DESIGN-BRIEF-MANAGER-PORTAL.md diff --git a/api/openapi.yaml b/api/openapi.yaml index c18a19e..25dea2c 100644 --- a/api/openapi.yaml +++ b/api/openapi.yaml @@ -87,6 +87,51 @@ paths: application/json: schema: { type: object } '403': { description: Недостаточно прав } + /employees: + post: + summary: Добавить сотрудника + operationId: createStaffEmployee + tags: [Employees] + security: [{ bearerAuth: [] }] + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/EmployeeCreate' + responses: + '201': + description: Сотрудник создан + content: + application/json: + schema: { $ref: '#/components/schemas/Employee' } + '403': { description: Недостаточно прав } + '409': { description: Табельный номер уже используется } + /employees/{employeeId}: + patch: + summary: Изменить карточку или статус сотрудника + operationId: updateStaffEmployee + tags: [Employees] + security: [{ bearerAuth: [] }] + parameters: + - in: path + name: employeeId + required: true + schema: { $ref: '#/components/schemas/Ulid' } + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/EmployeeUpdate' + responses: + '200': + description: Сотрудник изменён + content: + application/json: + schema: { $ref: '#/components/schemas/Employee' } + '403': { description: Недостаточно прав } + '404': { description: Сотрудник не найден } /attendance/events: post: summary: Принять идемпотентную отметку терминала @@ -165,6 +210,40 @@ components: required: [status] properties: status: { type: string } + Employee: + type: object + additionalProperties: false + required: [id, personnel_number, display_name, position, gender, status] + properties: + id: { $ref: '#/components/schemas/Ulid' } + core_user_id: + oneOf: + - { $ref: '#/components/schemas/Ulid' } + - { type: 'null' } + personnel_number: { type: string } + display_name: { type: string } + position: { type: string } + gender: { enum: ['', male, female] } + status: { enum: [active, blocked, dismissed] } + EmployeeCreate: + type: object + additionalProperties: false + required: [personnel_number, display_name] + properties: + personnel_number: { type: string, minLength: 1, maxLength: 80 } + display_name: { type: string, minLength: 1, maxLength: 240 } + position: { type: string, maxLength: 160 } + gender: { enum: ['', male, female] } + EmployeeUpdate: + type: object + additionalProperties: false + minProperties: 1 + properties: + personnel_number: { type: string, minLength: 1, maxLength: 80 } + display_name: { type: string, minLength: 1, maxLength: 240 } + position: { type: string, maxLength: 160 } + gender: { enum: ['', male, female] } + status: { enum: [active, blocked, dismissed] } Problem: type: object additionalProperties: false diff --git a/docs/DESIGN-BRIEF-MANAGER-PORTAL.md b/docs/DESIGN-BRIEF-MANAGER-PORTAL.md new file mode 100644 index 0000000..b129425 --- /dev/null +++ b/docs/DESIGN-BRIEF-MANAGER-PORTAL.md @@ -0,0 +1,15 @@ +# Design brief: кабинет руководителя + +- **Назначение:** ежедневный контроль присутствия, сотрудников и ручное заполнение табеля руководителем небольшой организации. +- **Контекст:** защищённый операционный кабинет, а не маркетинговая страница. +- **Направление:** спокойный плотный рабочий интерфейс с природной зелёной основой и золотым акцентом бренда Krona. +- **Отличительная идея:** хронология отметок и табель остаются главным рабочим полотном, а управление сотрудниками доступно рядом и не уводит на отдельную техническую страницу. +- **Ограничения:** существующий Fastify/PWA без нового frontend-фреймворка; адаптивность от мобильного браузера до рабочего монитора; клавиатурная навигация; reduced motion; никакой биометрии и секретов в браузере. + +## Локальная система + +- Цвета: тёплый рабочий фон, светлые поверхности, зелёный primary, золотой brand accent, семантические danger/info состояния. +- Типографика: Georgia для крупных смысловых заголовков, Segoe UI для плотных управляющих элементов и таблиц. +- Плотность: 44 px минимальная высота интерактивного элемента, компактные строки таблицы, адаптивный toolbar. +- Формы: явные подписи, видимый focus, диалог для карточки сотрудника, встроенная строка создания записи табеля. +- Движение: только короткие переходы состояния; полностью отключается через `prefers-reduced-motion`. diff --git a/src/portal-ui.ts b/src/portal-ui.ts index dbee8e5..085d781 100644 --- a/src/portal-ui.ts +++ b/src/portal-ui.ts @@ -43,20 +43,21 @@ export const portalHtml = `

Последние события

Отметки терминала

● в реальном времени
- +
-

Учёт времени

Табель за 40 дней

Изменения сохраняет руководитель
ДатаСотрудникЧасыСтатусПримечание
+

Учёт времени

Табель за 40 дней

Изменения сохраняет руководитель
ДатаСотрудникЧасыСтатусПримечание
+

Карточка команды

Новый сотрудник

 `; -export const portalCss = `:root{--bg:#EFE3CC;--workspace:#F3EAD7;--surface:#F8F2E6;--raised:#FCF8EF;--text:#302A23;--muted:#756A5B;--border:#D9C9AC;--primary:#657255;--gold:#B78335;--danger:#A44E3F;--info:#5F7480;--shadow:0 14px 40px rgba(48,42,35,.09);font-family:Inter,"Segoe UI",system-ui,sans-serif;color:var(--text);background:var(--workspace);font-synthesis:none}*{box-sizing:border-box}body{margin:0;min-height:100vh;background:radial-gradient(circle at 85% 0,rgba(183,131,53,.12),transparent 28rem),var(--workspace)}button,input,select{font:inherit}.topbar{height:72px;display:flex;align-items:center;justify-content:space-between;padding:0 max(20px,calc((100vw - 1240px)/2));background:rgba(248,242,230,.94);border-bottom:1px solid var(--border);position:sticky;top:0;z-index:5;backdrop-filter:blur(14px)}.brand{display:flex;align-items:center;gap:12px;color:var(--text);text-decoration:none;font-size:19px;letter-spacing:.01em}.mark{width:40px;height:40px;border-radius:12px;display:grid;place-items:center;background:linear-gradient(145deg,var(--gold),#8a642f);color:white;font-family:Georgia,serif;font-size:22px;box-shadow:0 6px 16px rgba(154,116,61,.22)}.actions{display:flex;align-items:center;gap:10px}.token{width:180px;min-height:44px;border:1px solid var(--border);border-radius:10px;background:var(--raised);padding:0 12px;color:var(--text)}.status{font-size:13px;color:var(--muted);margin-right:4px}.status.ok{color:var(--primary)}button{min-height:44px;padding:0 16px;border:0;border-radius:10px;background:var(--primary);color:white;font-weight:650;cursor:pointer}button:hover{filter:brightness(.95)}button:focus-visible,input:focus-visible,select:focus-visible{outline:3px solid rgba(95,116,128,.35);outline-offset:2px}.quiet{background:transparent;color:var(--primary);border:1px solid var(--border)}main{max-width:1240px;margin:auto;padding:36px 20px 56px}.hero{display:grid;grid-template-columns:1fr auto;gap:28px;align-items:end;padding:34px 38px;border-radius:16px;background:linear-gradient(120deg,#3b4536,#657255);color:#fff;box-shadow:var(--shadow)}.hero h1{margin:4px 0 10px;font:500 clamp(30px,4vw,52px)/1.04 Georgia,serif;max-width:720px}.hero p{margin:0;color:rgba(255,255,255,.75)}.eyebrow{text-transform:uppercase;letter-spacing:.13em;font-size:11px!important;font-weight:750;color:var(--gold)!important}.today{min-width:185px;padding:18px 20px;background:rgba(255,255,255,.09);border:1px solid rgba(255,255,255,.18);border-radius:12px}.today span,.today small{display:block;color:rgba(255,255,255,.7)}.today strong{display:block;font:500 25px/1.3 Georgia,serif;margin:3px 0}.message{margin-top:18px;padding:14px 16px;background:#fff1ee;border:1px solid #dfb2aa;border-radius:10px;color:#78382d}.stats{display:grid;grid-template-columns:repeat(3,1fr);gap:16px;margin:24px 0}.stats article,.panel{background:var(--surface);border:1px solid var(--border);border-radius:12px;box-shadow:0 5px 18px rgba(48,42,35,.045)}.stats article{padding:20px 22px}.stats span{display:block;color:var(--muted);font-size:13px}.stats strong{font:500 30px/1.2 Georgia,serif}.layout{display:grid;grid-template-columns:minmax(0,1.65fr) minmax(270px,.75fr);gap:18px}.panel{padding:22px}.panel-head{display:flex;justify-content:space-between;gap:16px;align-items:flex-start;margin-bottom:18px}.panel h2{font:500 25px/1.2 Georgia,serif;margin:2px 0}.panel-head span{font-size:12px;color:var(--muted)}.live{color:var(--primary)!important}.feed,.people{display:grid;gap:8px}.event,.person{display:grid;align-items:center;gap:12px;padding:13px 14px;border-radius:10px;background:var(--raised)}.event{grid-template-columns:42px 1fr auto}.person{grid-template-columns:38px 1fr}.avatar,.event-icon{width:38px;height:38px;border-radius:50%;display:grid;place-items:center;background:#e7dcc4;color:var(--gold);font-weight:750}.event-icon{border-radius:10px}.event.out .event-icon{background:#e4e7df;color:var(--primary)}.event strong,.person strong{display:block}.event small,.person small{color:var(--muted)}.event time{font-variant-numeric:tabular-nums;color:var(--muted);font-size:13px}.empty{padding:24px;text-align:center;color:var(--muted);background:var(--raised);border-radius:10px}.timesheet-panel{margin-top:18px}.table-wrap{overflow:auto}table{width:100%;border-collapse:collapse;min-width:760px}th,td{text-align:left;padding:12px 10px;border-bottom:1px solid var(--border);font-size:14px}th{color:var(--muted);font-size:12px;text-transform:uppercase;letter-spacing:.06em}td input,td select{width:100%;min-height:40px;border:1px solid var(--border);border-radius:8px;background:var(--raised);color:var(--text);padding:7px 9px}td button{min-height:40px}.tag{display:inline-flex;padding:5px 9px;border-radius:99px;background:#e5e8df;color:var(--primary);font-size:12px}footer{text-align:center;padding:24px;color:var(--muted);font-size:12px}@media(max-width:800px){.topbar{height:auto;min-height:68px;padding:12px 16px;flex-wrap:wrap}.actions{flex-wrap:wrap;justify-content:flex-end}.status,#notify{display:none}.token{width:150px}.hero{grid-template-columns:1fr;padding:26px 22px}.today{min-width:0}.stats{grid-template-columns:1fr 1fr}.stats article:last-child{grid-column:1/-1}.layout{grid-template-columns:1fr}.people-panel{order:-1}main{padding:22px 14px 42px}.panel{padding:18px}.panel-head{align-items:center}.live{display:none}}@media(prefers-reduced-motion:no-preference){.panel,.stats article{transition:transform .18s ease,box-shadow .18s ease}.panel:hover,.stats article:hover{transform:translateY(-1px);box-shadow:var(--shadow)}}`; +export const portalCss = `:root{--bg:#EFE3CC;--workspace:#F3EAD7;--surface:#F8F2E6;--raised:#FCF8EF;--text:#302A23;--muted:#756A5B;--border:#D9C9AC;--primary:#657255;--gold:#B78335;--danger:#A44E3F;--info:#5F7480;--shadow:0 14px 40px rgba(48,42,35,.09);font-family:Inter,"Segoe UI",system-ui,sans-serif;color:var(--text);background:var(--workspace);font-synthesis:none}*{box-sizing:border-box}body{margin:0;min-height:100vh;background:radial-gradient(circle at 85% 0,rgba(183,131,53,.12),transparent 28rem),var(--workspace)}button,input,select{font:inherit}.topbar{height:72px;display:flex;align-items:center;justify-content:space-between;padding:0 max(20px,calc((100vw - 1240px)/2));background:rgba(248,242,230,.94);border-bottom:1px solid var(--border);position:sticky;top:0;z-index:5;backdrop-filter:blur(14px)}.brand{display:flex;align-items:center;gap:12px;color:var(--text);text-decoration:none;font-size:19px;letter-spacing:.01em}.mark{width:40px;height:40px;border-radius:12px;display:grid;place-items:center;background:linear-gradient(145deg,var(--gold),#8a642f);color:white;font-family:Georgia,serif;font-size:22px;box-shadow:0 6px 16px rgba(154,116,61,.22)}.actions{display:flex;align-items:center;gap:10px}.token{width:180px;min-height:44px;border:1px solid var(--border);border-radius:10px;background:var(--raised);padding:0 12px;color:var(--text)}.status{font-size:13px;color:var(--muted);margin-right:4px}.status.ok{color:var(--primary)}button{min-height:44px;padding:0 16px;border:0;border-radius:10px;background:var(--primary);color:white;font-weight:650;cursor:pointer}button:hover{filter:brightness(.95)}button:focus-visible,input:focus-visible,select:focus-visible{outline:3px solid rgba(95,116,128,.35);outline-offset:2px}.quiet{background:transparent;color:var(--primary);border:1px solid var(--border)}.compact{min-height:38px;padding:0 12px}main{max-width:1240px;margin:auto;padding:36px 20px 56px}.hero{display:grid;grid-template-columns:1fr auto;gap:28px;align-items:end;padding:34px 38px;border-radius:16px;background:linear-gradient(120deg,#3b4536,#657255);color:#fff;box-shadow:var(--shadow)}.hero h1{margin:4px 0 10px;font:500 clamp(30px,4vw,52px)/1.04 Georgia,serif;max-width:720px}.hero p{margin:0;color:rgba(255,255,255,.75)}.eyebrow{text-transform:uppercase;letter-spacing:.13em;font-size:11px!important;font-weight:750;color:var(--gold)!important}.today{min-width:185px;padding:18px 20px;background:rgba(255,255,255,.09);border:1px solid rgba(255,255,255,.18);border-radius:12px}.today span,.today small{display:block;color:rgba(255,255,255,.7)}.today strong{display:block;font:500 25px/1.3 Georgia,serif;margin:3px 0}.message{margin-top:18px;padding:14px 16px;background:#fff1ee;border:1px solid #dfb2aa;border-radius:10px;color:#78382d}.stats{display:grid;grid-template-columns:repeat(3,1fr);gap:16px;margin:24px 0}.stats article,.panel{background:var(--surface);border:1px solid var(--border);border-radius:12px;box-shadow:0 5px 18px rgba(48,42,35,.045)}.stats article{padding:20px 22px}.stats span{display:block;color:var(--muted);font-size:13px}.stats strong{font:500 30px/1.2 Georgia,serif}.layout{display:grid;grid-template-columns:minmax(0,1.65fr) minmax(270px,.75fr);gap:18px}.panel{padding:22px}.panel-head{display:flex;justify-content:space-between;gap:16px;align-items:flex-start;margin-bottom:18px}.panel h2{font:500 25px/1.2 Georgia,serif;margin:2px 0}.panel-head span{font-size:12px;color:var(--muted)}.live{color:var(--primary)!important}.feed,.people{display:grid;gap:8px}.event,.person{display:grid;align-items:center;gap:12px;padding:13px 14px;border-radius:10px;background:var(--raised)}.event{grid-template-columns:42px 1fr auto}.person{grid-template-columns:38px 1fr auto}.avatar,.event-icon{width:38px;height:38px;border-radius:50%;display:grid;place-items:center;background:#e7dcc4;color:var(--gold);font-weight:750}.event-icon{border-radius:10px}.event.out .event-icon{background:#e4e7df;color:var(--primary)}.event strong,.person strong{display:block}.event small,.person small{color:var(--muted)}.event time{font-variant-numeric:tabular-nums;color:var(--muted);font-size:13px}.empty{padding:24px;text-align:center;color:var(--muted);background:var(--raised);border-radius:10px}.timesheet-panel{margin-top:18px}.timesheet-create{display:flex;align-items:end;gap:10px;padding:14px;margin-bottom:12px;background:var(--raised);border:1px solid var(--border);border-radius:10px}.timesheet-create label,.employee-dialog label{display:grid;gap:6px;color:var(--muted);font-size:12px;font-weight:700}.timesheet-create input,.timesheet-create select,.employee-dialog input,.employee-dialog select{min-height:42px;border:1px solid var(--border);border-radius:8px;background:#fffdf8;color:var(--text);padding:7px 9px}.timesheet-create .grow{flex:1}.table-wrap{overflow:auto}table{width:100%;border-collapse:collapse;min-width:760px}th,td{text-align:left;padding:12px 10px;border-bottom:1px solid var(--border);font-size:14px}th{color:var(--muted);font-size:12px;text-transform:uppercase;letter-spacing:.06em}td input,td select{width:100%;min-height:40px;border:1px solid var(--border);border-radius:8px;background:var(--raised);color:var(--text);padding:7px 9px}td button{min-height:40px}.tag{display:inline-flex;padding:5px 9px;border-radius:99px;background:#e5e8df;color:var(--primary);font-size:12px}.employee-dialog{width:min(92vw,560px);padding:0;border:1px solid var(--border);border-radius:16px;background:var(--surface);color:var(--text);box-shadow:0 28px 90px rgba(48,42,35,.25)}.employee-dialog::backdrop{background:rgba(34,31,27,.48);backdrop-filter:blur(3px)}.employee-dialog form{display:grid;gap:14px;padding:26px}.dialog-head{display:flex;align-items:flex-start;justify-content:space-between;margin-bottom:4px}.dialog-head h2{margin:2px 0;font:500 28px/1.15 Georgia,serif}.icon-button{min-width:42px;padding:0;background:transparent;border:1px solid var(--border);color:var(--text);font-size:24px}.dialog-actions{display:flex;justify-content:flex-end;gap:10px;margin-top:8px}footer{text-align:center;padding:24px;color:var(--muted);font-size:12px}@media(max-width:800px){.topbar{height:auto;min-height:68px;padding:12px 16px;flex-wrap:wrap}.actions{flex-wrap:wrap;justify-content:flex-end}.status,#notify{display:none}.token{width:150px}.hero{grid-template-columns:1fr;padding:26px 22px}.today{min-width:0}.stats{grid-template-columns:1fr 1fr}.stats article:last-child{grid-column:1/-1}.layout{grid-template-columns:1fr}.people-panel{order:-1}main{padding:22px 14px 42px}.panel{padding:18px}.panel-head{align-items:center}.live{display:none}.timesheet-create{display:grid;grid-template-columns:1fr 1fr}.timesheet-create .grow,.timesheet-create button{grid-column:1/-1}}@media(prefers-reduced-motion:no-preference){.panel,.stats article{transition:transform .18s ease,box-shadow .18s ease}.panel:hover,.stats article:hover{transform:translateY(-1px);box-shadow:var(--shadow)}}`; export const portalJs = `(() => { - const api = '/api/v1/staff'; let latestId = null; let viewerRole = 'employee'; + const api = '/api/v1/staff'; let latestId = null; let viewerRole = 'employee'; let employeesCache = []; const el = id => document.getElementById(id); const esc = value => String(value ?? '').replace(/[&<>"']/g, c => ({'&':'&','<':'<','>':'>','"':'"',"'":'''}[c])); const localDate = value => new Intl.DateTimeFormat('ru-RU',{day:'2-digit',month:'short',year:'numeric'}).format(new Date(value)); const localTime = value => new Intl.DateTimeFormat('ru-RU',{hour:'2-digit',minute:'2-digit'}).format(new Date(value)); @@ -65,13 +66,22 @@ export const portalJs = `(() => { function showLogin(message){el('app-shell').hidden=true;el('auth-screen').hidden=false;el('login-error').textContent=message||'';el('login-error').hidden=!message;setTimeout(()=>el('login-token').focus(),0);} function showApp(){el('auth-screen').hidden=true;el('app-shell').hidden=false;} async function load(notify){ try { const response=await fetch(api+'/portal',{credentials:'same-origin',cache:'no-store'}); if(response.status===401){showLogin('Введите ключ администратора.');return;} if(!response.ok) throw new Error('Сервер вернул '+response.status); const data=await response.json(); showApp(); render(data,notify); el('connection').textContent='Синхронизировано'; el('connection').className='status ok'; el('message').hidden=true; } catch(error){if(el('app-shell').hidden){showLogin('Сервер сейчас недоступен. Повторите попытку позже.');return;}el('connection').textContent='Нет связи';el('connection').className='status';el('message').textContent='Не удалось загрузить данные. Проверьте подключение.';el('message').hidden=false;} } - function render(data,notify){ viewerRole=data.viewer.role; el('viewer').textContent=viewerRole==='manager'?'Кабинет руководителя':'Кабинет сотрудника'; el('greeting').textContent=viewerRole==='manager'?'Команда и рабочее время':'Ваш рабочий день'; el('last-refresh').textContent='Обновлено '+localTime(data.refreshed_at); el('employees-count').textContent=data.employees.length; const today=new Date().toDateString(); const todayEvents=data.attendance.filter(x=>new Date(x.occurred_at).toDateString()===today); el('today-count').textContent=todayEvents.length; el('hours-count').textContent=(data.timesheet.reduce((sum,x)=>sum+Number(x.minutes_worked),0)/60).toLocaleString('ru-RU',{maximumFractionDigits:1}); + function render(data,notify){ viewerRole=data.viewer.role; employeesCache=data.employees; el('viewer').textContent=viewerRole==='manager'?'Кабинет руководителя':'Кабинет сотрудника'; el('greeting').textContent=viewerRole==='manager'?'Команда и рабочее время':'Ваш рабочий день'; el('last-refresh').textContent='Обновлено '+localTime(data.refreshed_at); el('employees-count').textContent=data.employees.length; const today=new Date().toDateString(); const todayEvents=data.attendance.filter(x=>new Date(x.occurred_at).toDateString()===today); el('today-count').textContent=todayEvents.length; el('hours-count').textContent=(data.timesheet.reduce((sum,x)=>sum+Number(x.minutes_worked),0)/60).toLocaleString('ru-RU',{maximumFractionDigits:1}); const first=data.attendance[0]; if(notify&&first&&latestId&&first.id!==latestId&&Notification.permission==='granted') new Notification('Krona Staff',{body:first.display_name+': '+(first.event_type==='check_in'?'приход':'уход')+' в '+localTime(first.occurred_at),tag:first.id}); if(first) latestId=first.id; el('attendance').innerHTML=data.attendance.length?data.attendance.slice(0,20).map(x=>'
'+(x.event_type==='check_in'?'↘':'↗')+'
'+esc(x.display_name)+''+(x.event_type==='check_in'?'Приход':'Уход')+' · '+esc(x.source)+'
').join(''):'
Отметок пока нет
'; - el('employees').innerHTML=data.employees.length?data.employees.map(x=>'
'+esc(x.display_name).slice(0,1).toUpperCase()+'
'+esc(x.display_name)+''+esc(x.position||'Должность не указана')+'
').join(''):'
Сотрудники не найдены
'; - el('timesheet-help').textContent=viewerRole==='manager'?'Можно редактировать и утверждать':'Только просмотр'; el('timesheet').innerHTML=data.timesheet.length?data.timesheet.map(row=>timesheetRow(row)).join(''):'Табель пока пуст'; bindSaves(); } + el('employees').innerHTML=data.employees.length?data.employees.map(x=>'
'+esc(x.display_name).slice(0,1).toUpperCase()+'
'+esc(x.display_name)+''+esc(x.position||'Должность не указана')+' · № '+esc(x.personnel_number)+'
'+(viewerRole==='manager'?'':'')+'
').join(''):'
Сотрудники не найдены
'; + el('add-employee').hidden=viewerRole!=='manager'; el('timesheet-create').hidden=viewerRole!=='manager'; el('new-time-employee').innerHTML=data.employees.map(x=>'').join(''); + el('timesheet-help').textContent=viewerRole==='manager'?'Можно добавлять, редактировать и утверждать':'Только просмотр'; el('timesheet').innerHTML=data.timesheet.length?data.timesheet.map(row=>timesheetRow(row)).join(''):'Табель пока пуст — добавьте первую строку выше'; bindSaves(); bindEmployeeEdits(); } function timesheetRow(row){const editable=viewerRole==='manager'; const statuses={draft:'Черновик',submitted:'На проверке',approved:'Утверждён',rejected:'Возвращён'}; return ''+localDate(row.work_date)+''+esc(row.display_name)+''+(editable?'':(Number(row.minutes_worked)/60).toLocaleString('ru-RU'))+''+(editable?'':''+esc(statuses[row.status]||row.status)+'')+''+(editable?'':esc(row.note||'—'))+''+(editable?'':'')+'';} function bindSaves(){document.querySelectorAll('.save').forEach(button=>button.addEventListener('click',async()=>{const row=button.closest('tr'); button.disabled=true; try{const body={minutes_worked:Math.round(Number(row.querySelector('.hours').value)*60),status:row.querySelector('.state').value,note:row.querySelector('.note').value};const response=await fetch(api+'/timesheets/'+row.dataset.employee+'/'+row.dataset.date,{method:'PUT',credentials:'same-origin',headers:jsonHeaders,body:JSON.stringify(body)});if(response.status===401){showLogin('Сессия завершена. Войдите снова.');return;}if(!response.ok)throw new Error();button.textContent='Сохранено';setTimeout(()=>button.textContent='Сохранить',1400);}catch{button.textContent='Ошибка';}finally{button.disabled=false;}}));} + function bindEmployeeEdits(){document.querySelectorAll('.edit-employee').forEach(button=>button.addEventListener('click',()=>openEmployee(employeesCache.find(x=>x.id===button.dataset.id))));} + function openEmployee(employee){const editing=Boolean(employee);el('employee-dialog-title').textContent=editing?'Редактирование сотрудника':'Новый сотрудник';el('employee-id').value=employee?.id||'';el('employee-number').value=employee?.personnel_number||'';el('employee-name').value=employee?.display_name||'';el('employee-position').value=employee?.position||'';el('employee-gender').value=employee?.gender||'';el('employee-status').value=employee?.status||'active';el('employee-status-wrap').hidden=!editing;el('employee-error').hidden=true;el('employee-dialog').showModal();setTimeout(()=>el('employee-number').focus(),0);} + el('new-time-date').value=new Date().toISOString().slice(0,10); + el('timesheet-create').addEventListener('submit',async event=>{event.preventDefault();const button=event.submitter;button.disabled=true;try{const employeeId=el('new-time-employee').value;const workDate=el('new-time-date').value;const body={minutes_worked:Math.round(Number(el('new-time-hours').value)*60),status:el('new-time-status').value,note:el('new-time-note').value};const response=await fetch(api+'/timesheets/'+employeeId+'/'+workDate,{method:'PUT',credentials:'same-origin',headers:jsonHeaders,body:JSON.stringify(body)});if(response.status===401){showLogin('Сессия завершена. Войдите снова.');return;}if(!response.ok)throw new Error();el('new-time-note').value='';await load(false);}catch{el('message').textContent='Не удалось добавить строку табеля.';el('message').hidden=false;}finally{button.disabled=false;}}); + el('add-employee').addEventListener('click',()=>openEmployee()); + el('employee-close').addEventListener('click',()=>el('employee-dialog').close()); + el('employee-cancel').addEventListener('click',()=>el('employee-dialog').close()); + el('employee-form').addEventListener('submit',async event=>{event.preventDefault();const employeeId=el('employee-id').value;const button=el('employee-save');const body={personnel_number:el('employee-number').value.trim(),display_name:el('employee-name').value.trim(),position:el('employee-position').value.trim(),gender:el('employee-gender').value};if(employeeId)body.status=el('employee-status').value;button.disabled=true;el('employee-error').hidden=true;try{const response=await fetch(api+'/employees'+(employeeId?'/'+employeeId:''),{method:employeeId?'PATCH':'POST',credentials:'same-origin',headers:jsonHeaders,body:JSON.stringify(body)});if(response.status===401){el('employee-dialog').close();showLogin('Сессия завершена. Войдите снова.');return;}if(!response.ok){const problem=await response.json().catch(()=>({}));throw new Error(problem.message||'Не удалось сохранить сотрудника.');}el('employee-dialog').close();await load(false);}catch(error){el('employee-error').textContent=error.message||'Не удалось сохранить сотрудника.';el('employee-error').hidden=false;}finally{button.disabled=false;}}); el('login-form').addEventListener('submit',async event=>{event.preventDefault();const button=el('login-submit');const token=el('login-token').value.trim();button.disabled=true;el('login-error').hidden=true;try{const response=await fetch(api+'/session',{method:'POST',credentials:'same-origin',headers:jsonHeaders,body:JSON.stringify({access_token:token})});if(!response.ok){showLogin(response.status===401||response.status===403?'Неверный ключ администратора.':'Не удалось выполнить вход.');return;}el('login-token').value='';await load(false);}catch{showLogin('Сервер сейчас недоступен.');}finally{button.disabled=false;}}); el('logout').addEventListener('click',async()=>{try{await fetch(api+'/session',{method:'DELETE',credentials:'same-origin'});}finally{latestId=null;showLogin('Вы вышли из кабинета.');}}); el('refresh').addEventListener('click',()=>load(false)); el('notify').addEventListener('click',async()=>{if(!('Notification' in window)){el('message').textContent='Этот браузер не поддерживает системные уведомления.';el('message').hidden=false;return;} const permission=await Notification.requestPermission(); el('notify').textContent=permission==='granted'?'Уведомления включены':'Уведомления запрещены';}); @@ -79,4 +89,4 @@ export const portalJs = `(() => { })();`; export const portalManifest = JSON.stringify({ name: 'Krona Staff', short_name: 'Staff', start_url: '/staff', display: 'standalone', background_color: '#F3EAD7', theme_color: '#657255', lang: 'ru' }); -export const portalServiceWorker = `const CACHE='krona-staff-v1';const ASSETS=['/staff','/staff/styles.css','/staff/app.js','/staff/manifest.webmanifest'];self.addEventListener('install',e=>e.waitUntil(caches.open(CACHE).then(c=>c.addAll(ASSETS))));self.addEventListener('activate',e=>e.waitUntil(caches.keys().then(keys=>Promise.all(keys.filter(k=>k!==CACHE).map(k=>caches.delete(k))))));self.addEventListener('fetch',e=>{if(e.request.method==='GET'&&new URL(e.request.url).pathname.startsWith('/staff'))e.respondWith(fetch(e.request).then(r=>{const copy=r.clone();caches.open(CACHE).then(c=>c.put(e.request,copy));return r;}).catch(()=>caches.match(e.request)));});`; +export const portalServiceWorker = `const CACHE='krona-staff-v2';const ASSETS=['/staff','/staff/styles.css','/staff/app.js','/staff/manifest.webmanifest'];self.addEventListener('install',e=>e.waitUntil(caches.open(CACHE).then(c=>c.addAll(ASSETS))));self.addEventListener('activate',e=>e.waitUntil(caches.keys().then(keys=>Promise.all(keys.filter(k=>k!==CACHE).map(k=>caches.delete(k))))));self.addEventListener('fetch',e=>{if(e.request.method==='GET'&&new URL(e.request.url).pathname.startsWith('/staff'))e.respondWith(fetch(e.request).then(r=>{const copy=r.clone();caches.open(CACHE).then(c=>c.put(e.request,copy));return r;}).catch(()=>caches.match(e.request)));});`; diff --git a/src/portal.ts b/src/portal.ts index 151ffdb..7e425c9 100644 --- a/src/portal.ts +++ b/src/portal.ts @@ -23,6 +23,21 @@ interface TimesheetBody { note?: string; } +interface EmployeeBody { + personnel_number: string; + display_name: string; + position?: string; + gender?: 'male' | 'female' | ''; +} + +interface EmployeePatchBody { + personnel_number?: string; + display_name?: string; + position?: string; + gender?: 'male' | 'female' | ''; + status?: 'active' | 'blocked' | 'dismissed'; +} + interface SessionBody { access_token: string; } @@ -115,6 +130,121 @@ export async function registerPortalRoutes( }); }); + api.post<{ Body: EmployeeBody }>('/employees', { + schema: { + body: { + type: 'object', additionalProperties: false, + required: ['personnel_number', 'display_name'], + properties: { + personnel_number: { type: 'string', minLength: 1, maxLength: 80 }, + display_name: { type: 'string', minLength: 1, maxLength: 240 }, + position: { type: 'string', maxLength: 160 }, + gender: { enum: ['', 'male', 'female'] }, + }, + }, + }, + }, async (request, reply) => { + assertCookieMutationOrigin(request); + const context = await requirePermission(identity, request, 'staff:employee:write'); + const employeeId = newUlid(); + const personnelNumber = request.body.personnel_number.trim(); + const displayName = request.body.display_name.trim(); + if (!personnelNumber || !displayName) return reply.badRequest('Табельный номер и имя обязательны.'); + + const employee = await database.tenantTransaction(context.tenantId, context.actorId, async (client) => { + const saved = await client.query( + `INSERT INTO staff_employees + (id, tenant_id, personnel_number, display_name, position, gender, status) + VALUES ($1, $2, $3, $4, $5, $6, 'active') + ON CONFLICT (tenant_id, personnel_number) DO NOTHING + RETURNING id, core_user_id, personnel_number, display_name, position, gender, status`, + [employeeId, context.tenantId, personnelNumber, displayName, + request.body.position?.trim() ?? '', request.body.gender ?? ''], + ); + if (saved.rowCount === 0) return null; + const result = saved.rows[0] as Record; + await client.query( + `INSERT INTO staff_audit_log + (id, tenant_id, actor_id, action, entity_type, entity_id, new_values, correlation_id) + VALUES ($1, $2, $3, 'employee.created', 'Employee', $4, $5, $6)`, + [newUlid(), context.tenantId, context.actorId, employeeId, result, context.correlationId], + ); + return result; + }); + if (!employee) return reply.conflict('Сотрудник с таким табельным номером уже существует.'); + return reply.code(201).send(employee); + }); + + api.patch<{ Params: { employeeId: string }; Body: EmployeePatchBody }>('/employees/:employeeId', { + schema: { + params: { type: 'object', required: ['employeeId'], properties: { + employeeId: { type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' }, + } }, + body: { + type: 'object', additionalProperties: false, minProperties: 1, + properties: { + personnel_number: { type: 'string', minLength: 1, maxLength: 80 }, + display_name: { type: 'string', minLength: 1, maxLength: 240 }, + position: { type: 'string', maxLength: 160 }, + gender: { enum: ['', 'male', 'female'] }, + status: { enum: ['active', 'blocked', 'dismissed'] }, + }, + }, + }, + }, async (request, reply) => { + assertCookieMutationOrigin(request); + const context = await requirePermission(identity, request, 'staff:employee:write'); + const employeeId = parseUlid(request.params.employeeId); + const personnelNumber = request.body.personnel_number?.trim(); + const displayName = request.body.display_name?.trim(); + if (personnelNumber === '' || displayName === '') return reply.badRequest('Табельный номер и имя не могут быть пустыми.'); + + const outcome = await database.tenantTransaction(context.tenantId, context.actorId, async (client) => { + const current = await client.query( + `SELECT id, core_user_id, personnel_number, display_name, position, gender, status + FROM staff_employees WHERE tenant_id = $1 AND id = $2 FOR UPDATE`, + [context.tenantId, employeeId], + ); + if (current.rowCount === 0) return { kind: 'missing' as const }; + if (personnelNumber) { + const duplicate = await client.query( + `SELECT id FROM staff_employees + WHERE tenant_id = $1 AND personnel_number = $2 AND id <> $3 LIMIT 1`, + [context.tenantId, personnelNumber, employeeId], + ); + if ((duplicate.rowCount ?? 0) > 0) return { kind: 'conflict' as const }; + } + const saved = await client.query( + `UPDATE staff_employees SET + personnel_number = COALESCE($3, personnel_number), + display_name = COALESCE($4, display_name), + position = COALESCE($5, position), + gender = COALESCE($6, gender), + status = COALESCE($7, status), + updated_at = now() + WHERE tenant_id = $1 AND id = $2 + RETURNING id, core_user_id, personnel_number, display_name, position, gender, status`, + [context.tenantId, employeeId, personnelNumber, displayName, + request.body.position?.trim(), request.body.gender, request.body.status], + ); + const result = saved.rows[0] as Record; + await client.query( + `INSERT INTO staff_audit_log + (id, tenant_id, actor_id, action, entity_type, entity_id, + old_values, new_values, correlation_id) + VALUES ($1, $2, $3, 'employee.updated', 'Employee', $4, $5, $6, $7)`, + [newUlid(), context.tenantId, context.actorId, employeeId, + current.rows[0], result, context.correlationId], + ); + return { kind: 'saved' as const, employee: result }; + }); + if (outcome.kind === 'missing') return reply.notFound('Сотрудник не найден.'); + if (outcome.kind === 'conflict') { + return reply.conflict('Сотрудник с таким табельным номером уже существует.'); + } + return reply.send(outcome.employee); + }); + api.post<{ Body: AttendanceBody }>('/attendance/events', { schema: { body: { diff --git a/tests/integration/portal.test.ts b/tests/integration/portal.test.ts index c5f6e52..1017539 100644 --- a/tests/integration/portal.test.ts +++ b/tests/integration/portal.test.ts @@ -21,7 +21,8 @@ function fakeDatabase(rows: Array>>) { const calls: Array<[string, readonly unknown[] | undefined]> = []; const query = async (sql: string, parameters?: readonly unknown[]) => { calls.push([sql, parameters]); - return { rows: rows.shift() ?? [], rowCount: 1 }; + const resultRows = rows.shift() ?? []; + return { rows: resultRows, rowCount: resultRows.length }; }; return { calls, @@ -134,4 +135,74 @@ describe('attendance portal', () => { expect(response.statusCode).toBe(403); await app.close(); }); + + it('allows a manager to create an employee and writes an audit record', async () => { + const employeeId = '01J00000000000000000000004'; + const { database, calls } = fakeDatabase([[{ + id: employeeId, + personnel_number: 'A-17', + display_name: 'Анна Орлова', + position: 'Администратор', + gender: 'female', + status: 'active', + }]]); + const app = await buildApp({ + config: loadConfig({ ...base, ...tokenConfig, STANDALONE_ACCESS: 'manager' }), + database, + }); + const response = await app.inject({ + method: 'POST', + url: '/api/v1/staff/employees', + headers: { authorization: `Bearer ${managerToken}` }, + payload: { + personnel_number: 'A-17', + display_name: 'Анна Орлова', + position: 'Администратор', + gender: 'female', + }, + }); + expect(response.statusCode).toBe(201); + expect(calls).toHaveLength(2); + expect(calls[0]?.[0]).toContain('INSERT INTO staff_employees'); + expect(calls[1]?.[0]).toContain('staff_audit_log'); + await app.close(); + }); + + it('does not allow an employee to create another employee', async () => { + const { database } = fakeDatabase([]); + const app = await buildApp({ + config: loadConfig({ ...base, STANDALONE_ACCESS: 'employee' }), + database, + }); + const response = await app.inject({ + method: 'POST', + url: '/api/v1/staff/employees', + payload: { personnel_number: 'A-18', display_name: 'Посторонний' }, + }); + expect(response.statusCode).toBe(403); + await app.close(); + }); + + it('updates an employee with before and after values in the audit trail', async () => { + const employeeId = '01J00000000000000000000004'; + const before = { id: employeeId, core_user_id: null, personnel_number: 'A-17', display_name: 'Анна Орлова', position: 'Администратор', gender: 'female', status: 'active' }; + const after = { ...before, position: 'Старший администратор' }; + const { database, calls } = fakeDatabase([[before], [after], []]); + const app = await buildApp({ + config: loadConfig({ ...base, ...tokenConfig, STANDALONE_ACCESS: 'manager' }), + database, + }); + const response = await app.inject({ + method: 'PATCH', + url: `/api/v1/staff/employees/${employeeId}`, + headers: { authorization: `Bearer ${managerToken}` }, + payload: { position: 'Старший администратор' }, + }); + expect(response.statusCode).toBe(200); + expect(calls).toHaveLength(3); + expect(calls[0]?.[0]).toContain('FOR UPDATE'); + expect(calls[2]?.[1]?.[4]).toEqual(before); + expect(calls[2]?.[1]?.[5]).toEqual(after); + await app.close(); + }); });