OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Domain/Timesheets/Controllers/AddTime.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace Leantime\Domain\Timesheets\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Clients\Services\Clients as ClientService;
+use Leantime\Domain\Projects\Services\Projects as ProjectService;
+use Leantime\Domain\Timesheets\Permissions\TimesheetsPermissions;
+use Leantime\Domain\Timesheets\Services\Timesheets as TimesheetService;
+use Symfony\Component\HttpFoundation\Response;
+
+class AddTime extends Controller
+{
+    private TimesheetService $timesheetService;
+
+    private ProjectService $projectService;
+
+    private ClientService $clientService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        TimesheetService $timesheetService,
+        ProjectService $projectService,
+        ClientService $clientService
+    ): void {
+        $this->timesheetService = $timesheetService;
+        $this->projectService = $projectService;
+        $this->clientService = $clientService;
+    }
+
+    /**
+     * Displays the add time form.
+     *
+     * This is the creation entry point, so it gates on CREATE (matching post()) rather than VIEW —
+     * a view-only role should not be able to load the time-logging form. Grant-equivalent for every
+     * built-in role (the set holding timesheets.create is exactly editor+, the prior authOrRedirect).
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::CREATE, global: true)]
+    public function get(array $params): Response
+    {
+        $this->tpl->assign('values', $this->timesheetService->getDefaultTimeValues());
+        $this->tpl->assign('info', '');
+        $this->assignTemplateVars();
+
+        return $this->tpl->display('timesheets.addTime');
+    }
+
+    /**
+     * Handles time entry creation.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::CREATE, global: true)]
+    public function post(array $params): Response
+    {
+        $info = '';
+        $values = $this->timesheetService->getDefaultTimeValues();
+
+        if (isset($_POST['save']) || isset($_POST['saveNew'])) {
+            $values = $this->timesheetService->parseAddTimePostValues($_POST, $values);
+            $info = $this->timesheetService->validateAndSaveTime($values);
+
+            if (isset($_POST['saveNew'])) {
+                $values = $this->timesheetService->getDefaultTimeValues();
+            }
+        }
+
+        $this->tpl->assign('values', $values);
+        $this->tpl->assign('info', $info);
+        $this->assignTemplateVars();
+
+        return $this->tpl->display('timesheets.addTime');
+    }
+
+    /**
+     * Assigns common template variables.
+     */
+    private function assignTemplateVars(): void
+    {
+        $this->tpl->assign('allClients', $this->clientService->getAll());
+        $this->tpl->assign('allProjects', $this->projectService->getAll(showClosedProjects: false));
+        // Scope the picker to the current user's own timesheets; an unscoped call would require
+        // timesheets.manage and over-fetch every user's entries.
+        $this->tpl->assign('allTickets', $this->timesheetService->getAll(
+            dateFrom: dtHelper()->userNow()->subYears(10)->setToDbTimezone(),
+            dateTo: dtHelper()->userNow()->addYears(10)->setToDbTimezone(),
+            userId: (int) session('userdata.id'),
+        ));
+        $this->tpl->assign('kind', $this->timesheetService->getLoggableHourTypes());
+    }
+}

app/Domain/Timesheets/Controllers/DelTime.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace Leantime\Domain\Timesheets\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller;
+use Leantime\Domain\Timesheets\Permissions\TimesheetsPermissions;
+use Leantime\Domain\Timesheets\Services\Timesheets as TimesheetService;
+use Symfony\Component\HttpFoundation\Response;
+
+class DelTime extends Controller
+{
+    private TimesheetService $timesheetService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(TimesheetService $timesheetService): void
+    {
+        $this->timesheetService = $timesheetService;
+    }
+
+    /**
+     * Displays the delete time confirmation dialog.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::DELETE, global: true)]
+    public function get(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->displayPartial('errors.error403');
+        }
+
+        $this->tpl->assign('id', (int) $params['id']);
+
+        return $this->tpl->displayPartial('timesheets.delTime');
+    }
+
+    /**
+     * Handles time entry deletion.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::DELETE, global: true, entityScoped: true)]
+    public function post(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->displayPartial('errors.error403');
+        }
+
+        $id = (int) $params['id'];
+
+        if (isset($_POST['del'])) {
+            $result = $this->timesheetService->deleteTime($id);
+
+            if ($result === true) {
+                $this->tpl->setNotification('notifications.time_deleted_successfully', 'success');
+
+                if (session()->exists('lastPage')) {
+                    return Frontcontroller::redirect(session('lastPage'));
+                }
+
+                return Frontcontroller::redirect(BASE_URL.'/timesheets/showMyList');
+            }
+
+            $this->tpl->setNotification('notifications.no_permission_delete', 'error');
+        }
+
+        $this->tpl->assign('id', $id);
+
+        return $this->tpl->displayPartial('timesheets.delTime');
+    }
+}

app/Domain/Timesheets/Controllers/EditTime.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace Leantime\Domain\Timesheets\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Clients\Services\Clients as ClientService;
+use Leantime\Domain\Projects\Services\Projects as ProjectService;
+use Leantime\Domain\Tickets\Services\Tickets as TicketService;
+use Leantime\Domain\Timesheets\Permissions\TimesheetsPermissions;
+use Leantime\Domain\Timesheets\Services\Timesheets as TimesheetService;
+use Symfony\Component\HttpFoundation\Response;
+
+class EditTime extends Controller
+{
+    private TimesheetService $timesheetService;
+
+    private ProjectService $projectService;
+
+    private TicketService $ticketService;
+
+    private ClientService $clientService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        TimesheetService $timesheetService,
+        ProjectService $projectService,
+        TicketService $ticketService,
+        ClientService $clientService
+    ): void {
+        $this->timesheetService = $timesheetService;
+        $this->projectService = $projectService;
+        $this->ticketService = $ticketService;
+        $this->clientService = $clientService;
+    }
+
+    /**
+     * Displays the edit time form.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::EDIT, global: true)]
+    public function get(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->displayPartial('errors.error403');
+        }
+
+        $id = (int) $params['id'];
+        // getTimesheetForEdit routes through the gated getTimesheet (own → view, another user's →
+        // manage), returning null for an entry the user may not access — this fences ownership,
+        // replacing the former manual role/owner check.
+        $values = $this->timesheetService->getTimesheetForEdit($id);
+
+        if ($values === null) {
+            return $this->tpl->displayPartial('errors.error403');
+        }
+
+        $this->tpl->assign('values', $values);
+        $this->tpl->assign('info', '');
+        $this->assignTemplateVars();
+
+        return $this->tpl->displayPartial('timesheets.editTime');
+    }
+
+    /**
+     * Handles time entry update.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::EDIT, global: true)]
+    public function post(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->displayPartial('errors.error403');
+        }
+
+        $id = (int) $params['id'];
+        // Fences ownership via the gated read; the save itself goes through the gated
+        // validateAndUpdateTime → updateTime (own → edit, another user's → manage).
+        $values = $this->timesheetService->getTimesheetForEdit($id);
+
+        if ($values === null) {
+            return $this->tpl->displayPartial('errors.error403');
+        }
+
+        if (isset($_POST['saveForm'])) {
+            $values = $this->timesheetService->applyEditTimePostUpdates($_POST, $values);
+            $values = $this->timesheetService->processEditTimeInvoiceFields($_POST, $values);
+
+            $result = $this->timesheetService->validateAndUpdateTime($id, $values);
+            $values = $result['values'];
+
+            if ($result['notification'] !== null) {
+                $this->tpl->setNotification($result['notification']['message'], $result['notification']['type']);
+            }
+        }
+
+        $this->tpl->assign('values', $values);
+        $this->tpl->assign('info', '');
+        $this->assignTemplateVars();
+
+        return $this->tpl->displayPartial('timesheets.editTime');
+    }
+
+    /**
+     * Assigns common template variables for the edit form.
+     */
+    private function assignTemplateVars(): void
+    {
+        $this->tpl->assign('allClients', $this->clientService->getAll());
+        $this->tpl->assign('allProjects', $this->projectService->getAll(showClosedProjects: false));
+        $this->tpl->assign('allTickets', $this->ticketService->getAll());
+        $this->tpl->assign('kind', $this->timesheetService->getLoggableHourTypes());
+    }
+}

app/Domain/Timesheets/Controllers/ShowAll.php

@@ -0,0 +1,164 @@
+<?php
+
+namespace Leantime\Domain\Timesheets\Controllers;
+
+use Carbon\CarbonInterface;
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Clients\Services\Clients as ClientService;
+use Leantime\Domain\Projects\Services\Projects as ProjectService;
+use Leantime\Domain\Tickets\Services\Tickets as TicketService;
+use Leantime\Domain\Timesheets\Permissions\TimesheetsPermissions;
+use Leantime\Domain\Timesheets\Services\Timesheets as TimesheetService;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+class ShowAll extends Controller
+{
+    private ProjectService $projectService;
+
+    private ClientService $clientService;
+
+    private TimesheetService $timesheetService;
+
+    private TicketService $ticketService;
+
+    private UserService $userService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        ProjectService $projectService,
+        TimesheetService $timesheetService,
+        ClientService $clientService,
+        TicketService $ticketService,
+        UserService $userService
+    ): void {
+        $this->timesheetService = $timesheetService;
+        $this->projectService = $projectService;
+        $this->clientService = $clientService;
+        $this->ticketService = $ticketService;
+        $this->userService = $userService;
+    }
+
+    /**
+     * Displays the list of all timesheets.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::MANAGE, global: true)]
+    public function get(array $params): Response
+    {
+        session(['lastPage' => BASE_URL.'/timesheets/showAll']);
+
+        $this->assignTemplateVars(
+            dateFrom: dtHelper()->userNow()->startOfWeek(CarbonInterface::MONDAY)->setToDbTimezone(),
+            dateTo: dtHelper()->userNow()->endOfMonth()->setToDbTimezone(),
+            kind: 'all',
+            userId: null,
+            invEmplCheck: '-1',
+            invCompCheck: '0',
+            paidCheck: '0',
+            projectFilter: -1,
+            ticketFilter: -1,
+            clientId: -1,
+        );
+
+        return $this->tpl->display('timesheets.showAll');
+    }
+
+    /**
+     * Handles timesheet filter changes and invoice saves.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::MANAGE, global: true)]
+    public function post(array $params): Response
+    {
+        session(['lastPage' => BASE_URL.'/timesheets/showAll']);
+
+        if (isset($_POST['saveInvoice'])) {
+            $this->timesheetService->updateInvoices(
+                $_POST['invoicedEmpl'] ?? [],
+                $_POST['invoicedComp'] ?? [],
+                $_POST['paid'] ?? []
+            );
+        }
+
+        $filters = $this->timesheetService->buildShowAllFilters($_POST);
+
+        $this->assignTemplateVars(
+            dateFrom: $filters['dateFrom'],
+            dateTo: $filters['dateTo'],
+            kind: $filters['kind'],
+            userId: $filters['userId'],
+            invEmplCheck: $filters['invEmplCheck'],
+            invCompCheck: $filters['invCompCheck'],
+            paidCheck: $filters['paidCheck'],
+            projectFilter: $filters['projectFilter'],
+            ticketFilter: $filters['ticketFilter'],
+            clientId: $filters['clientId'],
+        );
+
+        return $this->tpl->display('timesheets.showAll');
+    }
+
+    /**
+     * Assigns common template variables for the timesheet list view.
+     */
+    private function assignTemplateVars(
+        CarbonInterface $dateFrom,
+        CarbonInterface $dateTo,
+        string $kind,
+        ?int $userId,
+        string $invEmplCheck,
+        string $invCompCheck,
+        string $paidCheck,
+        int|string $projectFilter,
+        int|string $ticketFilter,
+        int|string $clientId,
+    ): void {
+        $selectedTicketProjectId = null;
+        if ($ticketFilter != '' && $ticketFilter != -1) {
+            $selectedTicket = $this->ticketService->getTicket($ticketFilter);
+            if ($selectedTicket) {
+                $selectedTicketProjectId = $selectedTicket->projectId;
+            }
+        }
+
+        $resolvedTicketFilter = $this->timesheetService->resolveShowAllTicketFilter(
+            $projectFilter,
+            $ticketFilter,
+            $selectedTicketProjectId
+        );
+
+        $this->tpl->assign('employeeFilter', $userId);
+        $this->tpl->assign('employees', $this->userService->getAll());
+        $this->tpl->assign('dateFrom', $dateFrom);
+        $this->tpl->assign('dateTo', $dateTo);
+        $this->tpl->assign('actKind', $kind);
+        $this->tpl->assign('kind', $this->timesheetService->getBookedHourTypes());
+        $this->tpl->assign('invComp', $invCompCheck);
+        $this->tpl->assign('invEmpl', $invEmplCheck);
+        $this->tpl->assign('paid', $paidCheck);
+        $this->tpl->assign('allProjects', $this->projectService->getAll());
+        $this->tpl->assign('projectFilter', $projectFilter);
+        $this->tpl->assign('allTickets', ($projectFilter == -1) ? [] : $this->ticketService->getAll(['currentProject' => $projectFilter]));
+        $this->tpl->assign('ticketFilter', $ticketFilter);
+        $this->tpl->assign('clientFilter', $clientId);
+        $this->tpl->assign('allClients', $this->clientService->getAll());
+        $this->tpl->assign('allTimesheets', $this->timesheetService->getAll(
+            $dateFrom,
+            $dateTo,
+            (int) $projectFilter,
+            $kind,
+            $userId,
+            $invEmplCheck,
+            $invCompCheck,
+            $resolvedTicketFilter,
+            $paidCheck,
+            $clientId
+        ));
+    }
+}

app/Domain/Timesheets/Controllers/ShowMy.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace Leantime\Domain\Timesheets\Controllers;
+
+use Carbon\CarbonInterface;
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Projects\Services\Projects as ProjectService;
+use Leantime\Domain\Timesheets\Permissions\TimesheetsPermissions;
+use Leantime\Domain\Timesheets\Services\Timesheets as TimesheetService;
+use Symfony\Component\HttpFoundation\Response;
+
+class ShowMy extends Controller
+{
+    private TimesheetService $timesheetService;
+
+    private ProjectService $projectService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        TimesheetService $timesheetService,
+        ProjectService $projectService
+    ): void {
+        $this->timesheetService = $timesheetService;
+        $this->projectService = $projectService;
+    }
+
+    /**
+     * Displays the weekly timesheet view.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::VIEW, global: true)]
+    public function get(array $params): Response
+    {
+        $fromDate = dtHelper()->userNow()->startOfWeek(CarbonInterface::MONDAY)->setToDbTimezone();
+
+        $this->assignTemplateVars($fromDate);
+
+        return $this->tpl->display('timesheets.showMy');
+    }
+
+    /**
+     * Handles weekly timesheet search and save operations.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::CREATE, global: true)]
+    public function post(array $params): Response
+    {
+        $fromDate = dtHelper()->userNow()->startOfWeek(CarbonInterface::MONDAY)->setToDbTimezone();
+
+        if (isset($_POST['search']) && ! empty($_POST['startDate'])) {
+            $parsed = $this->timesheetService->parseWeeklyStartDate($_POST['startDate'], $fromDate);
+            $fromDate = $parsed['date'];
+
+            if ($parsed['failed']) {
+                $this->tpl->setNotification('Could not parse date', 'error', 'save_timesheet');
+            }
+        }
+
+        if (isset($_POST['saveTimeSheet'])) {
+            $notifications = $this->timesheetService->saveWeeklyTimesheetEntries($_POST);
+            foreach ($notifications as $notification) {
+                $this->tpl->setNotification($notification['message'], $notification['type'], 'save_timesheet');
+            }
+        }
+
+        $this->assignTemplateVars($fromDate);
+
+        return $this->tpl->display('timesheets.showMy');
+    }
+
+    /**
+     * Assigns common template variables for the weekly timesheet view.
+     */
+    private function assignTemplateVars(CarbonInterface $fromDate): void
+    {
+        $weekly = $this->timesheetService->getWeeklyTimesheetsWithTicketIds(-1, $fromDate, session('userdata.id'));
+
+        $this->tpl->assign('existingTicketIds', $weekly['existingTicketIds']);
+        $this->tpl->assign('dateFrom', $fromDate);
+        $this->tpl->assign('actKind', 'all');
+        $this->tpl->assign('kind', $this->timesheetService->getLoggableHourTypes());
+        $this->tpl->assign('allProjects', $this->projectService->getProjectsAssignedToUser(
+            userId: session('userdata.id'),
+            projectTypes: 'project'
+        ));
+        $this->tpl->assign('allTickets', $this->timesheetService->getUsersTickets(
+            userId: session('userdata.id'),
+            limit: -1
+        ));
+        $this->tpl->assign('allTimesheets', $weekly['timesheets']);
+    }
+}

app/Domain/Timesheets/Controllers/ShowMyList.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace Leantime\Domain\Timesheets\Controllers;
+
+use Carbon\CarbonInterface;
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Timesheets\Permissions\TimesheetsPermissions;
+use Leantime\Domain\Timesheets\Services\Timesheets as TimesheetService;
+use Symfony\Component\HttpFoundation\Response;
+
+class ShowMyList extends Controller
+{
+    private TimesheetService $timesheetService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(TimesheetService $timesheetService): void
+    {
+        $this->timesheetService = $timesheetService;
+        session(['lastPage' => BASE_URL.'/timesheets/showMyList']);
+    }
+
+    /**
+     * Displays the user's timesheet list.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::VIEW, global: true)]
+    public function get(array $params): Response
+    {
+        $kind = 'all';
+        $dateFrom = dtHelper()->userNow()->startOfWeek(CarbonInterface::MONDAY)->setToDbTimezone();
+        $dateTo = dtHelper()->userNow()->endOfWeek()->setToDbTimezone();
+
+        $this->assignTemplateVars($dateFrom, $dateTo, $kind);
+
+        return $this->tpl->display('timesheets.showMyList');
+    }
+
+    /**
+     * Handles timesheet list filter changes.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(TimesheetsPermissions::VIEW, global: true)]
+    public function post(array $params): Response
+    {
+        $kind = ! empty($_POST['kind']) ? $_POST['kind'] : 'all';
+
+        $dateFrom = dtHelper()->userNow()->startOfWeek(CarbonInterface::MONDAY)->setToDbTimezone();
+        $dateTo = dtHelper()->userNow()->endOfWeek()->setToDbTimezone();
+
+        if (! empty($_POST['dateFrom'])) {
+            $dateFrom = dtHelper()->parseUserDateTime($_POST['dateFrom'])->setToDbTimezone();
+        }
+
+        if (! empty($_POST['dateTo'])) {
+            $dateTo = dtHelper()->parseUserDateTime($_POST['dateTo'])->setToDbTimezone();
+        }
+
+        $this->assignTemplateVars($dateFrom, $dateTo, $kind);
+
+        return $this->tpl->display('timesheets.showMyList');
+    }
+
+    /**
+     * Assigns common template variables.
+     */
+    private function assignTemplateVars(CarbonInterface $dateFrom, CarbonInterface $dateTo, string $kind): void
+    {
+        $this->tpl->assign('dateFrom', $dateFrom);
+        $this->tpl->assign('dateTo', $dateTo);
+        $this->tpl->assign('actKind', $kind);
+        $this->tpl->assign('kind', $this->timesheetService->getLoggableHourTypes());
+        $this->tpl->assign('allTimesheets', $this->timesheetService->getAll(
+            dateFrom: $dateFrom,
+            dateTo: $dateTo,
+            projectId: -1,
+            kind: $kind,
+            userId: session('userdata.id'),
+            invEmpl: '-1',
+            invComp: '-1',
+            paid: '-1'
+        ));
+    }
+}