| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741 |
- <?php
- declare(strict_types=1);
- namespace App\Controllers;
- use App\Auth\SessionGuard;
- use App\Domain\User;
- use App\Http\Request;
- use App\Http\Response;
- use App\Http\View;
- use App\Repositories\SprintRepository;
- use App\Repositories\SprintWeekRepository;
- use App\Repositories\SprintWorkerDayRepository;
- use App\Repositories\SprintWorkerRepository;
- use App\Repositories\UserRepository;
- use App\Repositories\WorkerRepository;
- use App\Services\AuditLogger;
- use App\Services\CapacityCalculator;
- use DateTimeImmutable;
- use PDO;
- use PDOException;
- use Throwable;
- final class SprintController
- {
- public function __construct(
- private readonly PDO $pdo,
- private readonly UserRepository $users,
- private readonly SprintRepository $sprints,
- private readonly SprintWeekRepository $weeks,
- private readonly SprintWorkerRepository $sprintWorkers,
- private readonly SprintWorkerDayRepository $days,
- private readonly WorkerRepository $workers,
- private readonly AuditLogger $audit,
- private readonly View $view,
- ) {
- }
- /** GET /sprints/new — admin-only form. */
- public function newForm(Request $req): Response
- {
- $actor = SessionGuard::requireAdmin($this->users);
- if ($actor instanceof Response) {
- return $actor;
- }
- return Response::html($this->view->render('sprints/new', [
- 'title' => 'New sprint',
- 'currentUser' => $actor,
- 'csrfToken' => SessionGuard::csrfToken(),
- 'error' => $req->queryString('error'),
- 'form' => [
- 'name' => '',
- 'start_date' => '',
- 'end_date' => '',
- 'reserve_fraction' => '20',
- 'n_weeks' => '4',
- ],
- ]));
- }
- /** POST /sprints — create sprint + materialise weeks in one tx. */
- public function create(Request $req): Response
- {
- $actor = SessionGuard::requireAdmin($this->users);
- if ($actor instanceof Response) {
- return $actor;
- }
- if (!SessionGuard::verifyCsrf($req)) {
- return Response::text('CSRF token invalid', 403);
- }
- $name = trim($req->postString('name'));
- $start = $req->postString('start_date');
- $end = $req->postString('end_date');
- // reserve_fraction submitted as a percentage (0..100) from the form.
- $reservePct = $req->postString('reserve_fraction');
- $nWeeksStr = $req->postString('n_weeks');
- if ($name === '') {
- return Response::redirect('/sprints/new?error=name_required');
- }
- $startD = DateTimeImmutable::createFromFormat('Y-m-d', $start);
- $endD = DateTimeImmutable::createFromFormat('Y-m-d', $end);
- if ($startD === false || $endD === false) {
- return Response::redirect('/sprints/new?error=dates_invalid');
- }
- if ($endD < $startD) {
- return Response::redirect('/sprints/new?error=dates_order');
- }
- if (!is_numeric($reservePct)) {
- return Response::redirect('/sprints/new?error=reserve_invalid');
- }
- $reserve = ((float) $reservePct) / 100.0;
- if ($reserve < 0.0 || $reserve > 1.0) {
- return Response::redirect('/sprints/new?error=reserve_out_of_range');
- }
- if (!ctype_digit($nWeeksStr)) {
- return Response::redirect('/sprints/new?error=n_weeks_invalid');
- }
- $nWeeks = (int) $nWeeksStr;
- if ($nWeeks < 1 || $nWeeks > 26) {
- return Response::redirect('/sprints/new?error=n_weeks_range');
- }
- $this->pdo->beginTransaction();
- try {
- $sprint = $this->sprints->create(
- name: $name,
- startDate: $startD->format('Y-m-d'),
- endDate: $endD->format('Y-m-d'),
- reserveFraction: $reserve,
- );
- $this->audit->recordForRequest(
- action: 'CREATE',
- entityType: 'sprint',
- entityId: $sprint->id,
- before: null,
- after: $sprint->toAuditSnapshot(),
- req: $req,
- actor: $actor,
- );
- $weeks = $this->sprints->materializeWeeks(
- $sprint->id,
- $startD->format('Y-m-d'),
- $nWeeks,
- );
- foreach ($weeks as $w) {
- $this->audit->recordForRequest(
- action: 'CREATE',
- entityType: 'sprint_week',
- entityId: $w['id'],
- before: null,
- after: ['sprint_id' => $sprint->id] + $w,
- req: $req,
- actor: $actor,
- );
- }
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::redirect('/sprints/new?error=db_error');
- }
- return Response::redirect('/sprints/' . $sprint->id);
- }
- /** GET /sprints/{id} — main planning view (Section A Arbeitstage; tasks land in Phase 6). */
- public function show(Request $req, array $params): Response
- {
- $actor = SessionGuard::requireAuth($this->users);
- if ($actor instanceof Response) {
- return $actor;
- }
- $id = (int) $params['id'];
- $sprint = $this->sprints->find($id);
- if ($sprint === null) {
- return Response::text('Not Found', 404);
- }
- $weeks = $this->weeks->allForSprint($id);
- $sprintWorkers = $this->sprintWorkers->allForSprint($id);
- $grid = $this->days->grid($id);
- // Seed initial capacity server-side so the page is meaningful without JS
- // and the JS has the same numbers to compare against.
- $capacity = [];
- foreach ($sprintWorkers as $sw) {
- $wkDays = $grid[$sw->id] ?? [];
- $ressourcen = array_sum($wkDays);
- $capacity[$sw->id] = CapacityCalculator::forWorker(
- $ressourcen,
- $sprint->reserveFraction,
- 0.0, // prio-1 commitments come with Phase 6
- );
- }
- return Response::html($this->view->render('sprints/show', [
- 'title' => $sprint->name,
- 'currentUser' => $actor,
- 'csrfToken' => SessionGuard::csrfToken(),
- 'sprint' => $sprint,
- 'weeks' => $weeks,
- 'sprintWorkers' => $sprintWorkers,
- 'grid' => $grid,
- 'capacity' => $capacity,
- ]));
- }
- // -----------------------------------------------------------------------
- // Phase 4 — settings page + JSON mutation endpoints.
- // -----------------------------------------------------------------------
- /** GET /sprints/{id}/settings — admin-only. */
- public function settings(Request $req, array $params): Response
- {
- $actor = SessionGuard::requireAdmin($this->users);
- if ($actor instanceof Response) {
- return $actor;
- }
- $id = (int) $params['id'];
- $sprint = $this->sprints->find($id);
- if ($sprint === null) {
- return Response::text('Not Found', 404);
- }
- return Response::html($this->view->render('sprints/settings', [
- 'title' => "Settings — {$sprint->name}",
- 'currentUser' => $actor,
- 'csrfToken' => SessionGuard::csrfToken(),
- 'sprint' => $sprint,
- 'weeks' => $this->weeks->allForSprint($id),
- 'sprintWorkers' => $this->sprintWorkers->allForSprint($id),
- 'availableWorkers' => $this->workers->activeNotInSprint($id),
- ]));
- }
- /** PATCH /sprints/{id} — JSON — update name / dates / reserve_fraction. */
- public function updateMeta(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $id = (int) $params['id'];
- $sprint = $this->sprints->find($id);
- if ($sprint === null) {
- return Response::err('not_found', 'Sprint not found', 404);
- }
- $body = $req->json() ?? [];
- $changes = [];
- if (array_key_exists('name', $body)) {
- $name = is_string($body['name']) ? trim($body['name']) : '';
- if ($name === '') {
- return Response::err('validation', 'Name cannot be empty', 422, ['field' => 'name']);
- }
- $changes['name'] = $name;
- }
- if (array_key_exists('start_date', $body)) {
- if (!is_string($body['start_date']) || !self::isIsoDate($body['start_date'])) {
- return Response::err('validation', 'Invalid start_date', 422, ['field' => 'start_date']);
- }
- $changes['start_date'] = $body['start_date'];
- }
- if (array_key_exists('end_date', $body)) {
- if (!is_string($body['end_date']) || !self::isIsoDate($body['end_date'])) {
- return Response::err('validation', 'Invalid end_date', 422, ['field' => 'end_date']);
- }
- $changes['end_date'] = $body['end_date'];
- }
- if (array_key_exists('reserve_fraction', $body)) {
- if (!is_numeric($body['reserve_fraction'])) {
- return Response::err('validation', 'reserve_fraction must be numeric', 422);
- }
- $rf = (float) $body['reserve_fraction'];
- if ($rf < 0.0 || $rf > 1.0) {
- return Response::err('validation', 'reserve_fraction must be 0..1', 422);
- }
- $changes['reserve_fraction'] = $rf;
- }
- $effectiveStart = $changes['start_date'] ?? $sprint->startDate;
- $effectiveEnd = $changes['end_date'] ?? $sprint->endDate;
- if ($effectiveEnd < $effectiveStart) {
- return Response::err('validation', 'end_date must be on or after start_date', 422);
- }
- if ($changes === []) {
- return Response::ok(['sprint' => $sprint->toAuditSnapshot()]);
- }
- $this->pdo->beginTransaction();
- try {
- $result = $this->sprints->update($id, $changes);
- $this->audit->recordForRequest(
- 'UPDATE', 'sprint', $id,
- $result['before']->toAuditSnapshot(),
- $result['after']->toAuditSnapshot(),
- $req, $actor,
- );
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not save sprint', 500);
- }
- return Response::ok(['sprint' => $result['after']->toAuditSnapshot()]);
- }
- /** POST /sprints/{id}/weeks — JSON — resize the week set. */
- public function replaceWeeks(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $id = (int) $params['id'];
- $sprint = $this->sprints->find($id);
- if ($sprint === null) {
- return Response::err('not_found', 'Sprint not found', 404);
- }
- $body = $req->json() ?? [];
- if (!isset($body['n_weeks']) || !is_int($body['n_weeks']) || $body['n_weeks'] < 1 || $body['n_weeks'] > 26) {
- return Response::err('validation', 'n_weeks must be an integer in 1..26', 422);
- }
- $this->pdo->beginTransaction();
- try {
- $diff = $this->weeks->syncCount($id, $sprint->startDate, (int) $body['n_weeks']);
- foreach ($diff['added'] as $w) {
- $this->audit->recordForRequest(
- 'CREATE', 'sprint_week', $w->id,
- null, $w->toAuditSnapshot(),
- $req, $actor,
- );
- }
- foreach ($diff['removed'] as $w) {
- $this->audit->recordForRequest(
- 'DELETE', 'sprint_week', $w->id,
- $w->toAuditSnapshot(), null,
- $req, $actor,
- );
- }
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not update weeks', 500);
- }
- return Response::ok([
- 'weeks' => array_map(
- fn($w) => $w->toAuditSnapshot(),
- $this->weeks->allForSprint($id)
- ),
- 'added' => count($diff['added']),
- 'removed' => count($diff['removed']),
- ]);
- }
- /** POST /sprints/{id}/workers — JSON — add a worker to the sprint. */
- public function addWorker(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $sprintId = (int) $params['id'];
- if ($this->sprints->find($sprintId) === null) {
- return Response::err('not_found', 'Sprint not found', 404);
- }
- $body = $req->json() ?? [];
- if (!isset($body['worker_id']) || !is_int($body['worker_id'])) {
- return Response::err('validation', 'worker_id required', 422);
- }
- $workerId = (int) $body['worker_id'];
- $worker = $this->workers->find($workerId);
- if ($worker === null) {
- return Response::err('validation', 'Unknown worker', 422, ['field' => 'worker_id']);
- }
- if (!$worker->isActive) {
- return Response::err('validation', 'Worker is inactive', 422, ['field' => 'worker_id']);
- }
- $rtb = $worker->defaultRtb;
- if (isset($body['rtb'])) {
- if (!is_numeric($body['rtb']) || (float) $body['rtb'] < 0.0 || (float) $body['rtb'] > 1.0) {
- return Response::err('validation', 'rtb must be 0..1', 422);
- }
- $rtb = (float) $body['rtb'];
- }
- $this->pdo->beginTransaction();
- try {
- $sw = $this->sprintWorkers->add($sprintId, $workerId, $rtb);
- $this->audit->recordForRequest(
- 'CREATE', 'sprint_worker', $sw->id,
- null, $sw->toAuditSnapshot(),
- $req, $actor,
- );
- $this->pdo->commit();
- } catch (PDOException $e) {
- $this->pdo->rollBack();
- if (str_contains(strtolower($e->getMessage()), 'unique')) {
- return Response::err('conflict', 'Worker already in sprint', 409);
- }
- return Response::err('db_error', 'Could not add worker', 500);
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not add worker', 500);
- }
- return Response::ok([
- 'sprint_worker' => $sw->toAuditSnapshot() + ['worker_name' => $sw->workerName],
- ]);
- }
- /** DELETE /sprints/{id}/workers/{sw_id} — JSON — remove a worker from the sprint. */
- public function removeWorker(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $sprintId = (int) $params['id'];
- $swId = (int) $params['sw_id'];
- $existing = $this->sprintWorkers->find($swId);
- if ($existing === null || $existing->sprintId !== $sprintId) {
- return Response::err('not_found', 'sprint_worker not found in this sprint', 404);
- }
- $this->pdo->beginTransaction();
- try {
- $removed = $this->sprintWorkers->remove($swId);
- if ($removed !== null) {
- $this->audit->recordForRequest(
- 'DELETE', 'sprint_worker', $removed->id,
- $removed->toAuditSnapshot(), null,
- $req, $actor,
- );
- }
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not remove worker', 500);
- }
- return Response::ok(['removed_id' => $swId]);
- }
- /** POST /sprints/{id}/workers/reorder — JSON — apply an ordering. */
- public function reorderWorkers(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $sprintId = (int) $params['id'];
- if ($this->sprints->find($sprintId) === null) {
- return Response::err('not_found', 'Sprint not found', 404);
- }
- $body = $req->json();
- if (!is_array($body) || !array_is_list($body)) {
- return Response::err('validation', 'body must be a list of {sprint_worker_id, sort_order}', 422);
- }
- $ordering = [];
- $seenOrder = [];
- foreach ($body as $row) {
- if (!is_array($row) || !isset($row['sprint_worker_id'], $row['sort_order'])) {
- return Response::err('validation', 'each entry needs sprint_worker_id and sort_order', 422);
- }
- $sw = (int) $row['sprint_worker_id'];
- $order = (int) $row['sort_order'];
- if ($sw <= 0 || $order < 1) {
- return Response::err('validation', 'ids/orders must be positive', 422);
- }
- if (isset($seenOrder[$order])) {
- return Response::err('validation', 'duplicate sort_order', 422);
- }
- $seenOrder[$order] = true;
- $ordering[] = ['sprint_worker_id' => $sw, 'sort_order' => $order];
- }
- $this->pdo->beginTransaction();
- try {
- $diffs = $this->sprintWorkers->reorder($sprintId, $ordering);
- foreach ($diffs as $d) {
- $this->audit->recordForRequest(
- 'UPDATE', 'sprint_worker', $d['after']->id,
- $d['before']->toAuditSnapshot(),
- $d['after']->toAuditSnapshot(),
- $req, $actor,
- );
- }
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not reorder', 500);
- }
- return Response::ok(['moved' => count($diffs)]);
- }
- /** PATCH /sprints/{id}/workers/{sw_id} — JSON — edit RTB. */
- public function updateWorker(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $sprintId = (int) $params['id'];
- $swId = (int) $params['sw_id'];
- $existing = $this->sprintWorkers->find($swId);
- if ($existing === null || $existing->sprintId !== $sprintId) {
- return Response::err('not_found', 'sprint_worker not found in this sprint', 404);
- }
- $body = $req->json() ?? [];
- if (!isset($body['rtb']) || !is_numeric($body['rtb'])) {
- return Response::err('validation', 'rtb required', 422);
- }
- $rtb = (float) $body['rtb'];
- if ($rtb < 0.0 || $rtb > 1.0) {
- return Response::err('validation', 'rtb must be 0..1', 422);
- }
- $this->pdo->beginTransaction();
- try {
- $result = $this->sprintWorkers->setRtb($swId, $rtb);
- $this->audit->recordForRequest(
- 'UPDATE', 'sprint_worker', $swId,
- $result['before']->toAuditSnapshot(),
- $result['after']->toAuditSnapshot(),
- $req, $actor,
- );
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not update worker', 500);
- }
- return Response::ok(['sprint_worker' => $result['after']->toAuditSnapshot()]);
- }
- /** PATCH /sprints/{id}/week-cells — JSON — batch upsert of sprint_worker_days. */
- public function updateWeekCells(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $sprintId = (int) $params['id'];
- $sprint = $this->sprints->find($sprintId);
- if ($sprint === null) {
- return Response::err('not_found', 'Sprint not found', 404);
- }
- $body = $req->json();
- if (!is_array($body) || !array_is_list($body)) {
- return Response::err('validation', 'body must be a list of {sprint_worker_id, sprint_week_id, days}', 422);
- }
- if ($body === []) {
- return Response::ok(['applied' => 0, 'noop' => 0, 'per_worker' => new \stdClass()]);
- }
- // Cross-check every cell belongs to this sprint.
- $validSw = array_column(
- array_map(fn($sw) => ['id' => $sw->id], $this->sprintWorkers->allForSprint($sprintId)),
- 'id',
- );
- $validSw = array_flip($validSw);
- $validWk = array_column(
- array_map(fn($w) => ['id' => $w->id], $this->weeks->allForSprint($sprintId)),
- 'id',
- );
- $validWk = array_flip($validWk);
- $cells = [];
- foreach ($body as $i => $row) {
- if (!is_array($row) || !isset($row['sprint_worker_id'], $row['sprint_week_id'], $row['days'])) {
- return Response::err('validation', "cell[{$i}] needs sprint_worker_id, sprint_week_id, days", 422);
- }
- $swId = (int) $row['sprint_worker_id'];
- $wkId = (int) $row['sprint_week_id'];
- $daysN = $row['days'];
- if (!is_numeric($daysN)) {
- return Response::err('validation', "cell[{$i}] days must be numeric", 422);
- }
- $days = (float) $daysN;
- if (!isset($validSw[$swId])) {
- return Response::err('validation', "cell[{$i}] sprint_worker {$swId} not in sprint", 422);
- }
- if (!isset($validWk[$wkId])) {
- return Response::err('validation', "cell[{$i}] sprint_week {$wkId} not in sprint", 422);
- }
- if (!CapacityCalculator::isHalfStep($days, 0.0, 5.0)) {
- return Response::err('validation', "cell[{$i}] days must be 0..5 in 0.5 steps", 422);
- }
- $cells[] = ['sw_id' => $swId, 'week_id' => $wkId, 'days' => $days];
- }
- $applied = 0;
- $noop = 0;
- $touchedWorkers = [];
- $this->pdo->beginTransaction();
- try {
- foreach ($cells as $c) {
- $result = $this->days->upsert($c['sw_id'], $c['week_id'], $c['days']);
- if ($result['action'] === 'NOOP') {
- $noop++;
- continue;
- }
- $applied++;
- $touchedWorkers[$c['sw_id']] = true;
- $this->audit->recordForRequest(
- action: $result['action'],
- entityType: 'sprint_worker_days',
- entityId: $result['after']?->id ?? $result['before']?->id,
- before: $result['before']?->toAuditSnapshot(),
- after: $result['after']?->toAuditSnapshot(),
- req: $req,
- actor: $actor,
- );
- }
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not save cells', 500);
- }
- // Recompute capacity for every worker whose row changed.
- $grid = $this->days->grid($sprintId);
- $perWorker = [];
- foreach (array_keys($touchedWorkers) as $swId) {
- $ressourcen = array_sum($grid[$swId] ?? []);
- $perWorker[(string) $swId] = CapacityCalculator::forWorker(
- $ressourcen,
- $sprint->reserveFraction,
- 0.0,
- );
- }
- return Response::ok([
- 'applied' => $applied,
- 'noop' => $noop,
- 'per_worker' => $perWorker === [] ? new \stdClass() : $perWorker,
- ]);
- }
- /** PATCH /sprints/{id}/week/{week_id} — JSON — edit max_working_days for one week. */
- public function updateWeekMax(Request $req, array $params): Response
- {
- $gate = $this->gateJsonAdmin($req);
- if ($gate instanceof Response) {
- return $gate;
- }
- $actor = $gate;
- $sprintId = (int) $params['id'];
- $weekId = (int) $params['week_id'];
- $week = $this->weeks->find($weekId);
- if ($week === null || $week->sprintId !== $sprintId) {
- return Response::err('not_found', 'sprint_week not found in this sprint', 404);
- }
- $body = $req->json() ?? [];
- if (!isset($body['max_working_days']) || !is_numeric($body['max_working_days'])) {
- return Response::err('validation', 'max_working_days required', 422);
- }
- $maxDays = (float) $body['max_working_days'];
- if (!CapacityCalculator::isHalfStep($maxDays, 0.0, 5.0)) {
- return Response::err('validation', 'max_working_days must be 0..5 in 0.5 steps', 422);
- }
- if (abs($week->maxWorkingDays - $maxDays) < 1e-9) {
- return Response::ok(['sprint_week' => $week->toAuditSnapshot()]);
- }
- $this->pdo->beginTransaction();
- try {
- $result = $this->weeks->setMaxWorkingDays($weekId, $maxDays);
- $this->audit->recordForRequest(
- 'UPDATE', 'sprint_week', $weekId,
- $result['before']->toAuditSnapshot(),
- $result['after']->toAuditSnapshot(),
- $req, $actor,
- );
- $this->pdo->commit();
- } catch (Throwable) {
- $this->pdo->rollBack();
- return Response::err('db_error', 'Could not update week', 500);
- }
- return Response::ok(['sprint_week' => $result['after']->toAuditSnapshot()]);
- }
- // ------------------------------------------------------------------
- // Shared helpers
- // ------------------------------------------------------------------
- /**
- * Admin gate for JSON endpoints. Returns the signed-in User on success,
- * or an `Response::err(...)` JSON envelope on failure. Also enforces CSRF.
- */
- private function gateJsonAdmin(Request $req): User|Response
- {
- $user = SessionGuard::currentUser($this->users);
- if ($user === null) {
- return Response::err('unauthenticated', 'Sign in required', 401);
- }
- if (!$user->isAdmin) {
- return Response::err('forbidden', 'Admin access required', 403);
- }
- if (!SessionGuard::verifyCsrf($req)) {
- return Response::err('csrf', 'CSRF token invalid', 403);
- }
- return $user;
- }
- private static function isIsoDate(string $s): bool
- {
- $d = DateTimeImmutable::createFromFormat('Y-m-d', $s);
- return $d !== false && $d->format('Y-m-d') === $s;
- }
- }
|