coastal_timesheet/CHANGELOG.md

Changelog

All notable changes to Coastal Timesheet will be documented in this file.

[2.1.0] - 2026-02-15

Added

• Copy Previous Week — One-tap button to duplicate last week's entries into the current week. Shifts dates automatically, skips deactivated homeowners. Shows on empty weeks only.
• Bulk Approve / Reject — Admin Reviews tab now supports multi-select with "Select All" checkbox and bulk action buttons. Process 40+ timesheets in one click instead of one-by-one.
• Overtime Tracking — New admin "Overtime" tab with per-employee weekly breakdown, total/regular/OT summary cards, and date range filtering. Employee timesheet page shows real-time amber warning banner when hours exceed 40h/week (FLSA threshold).
• Homeowner Filter on Reports — Admin Reports tab now includes a homeowner dropdown filter to see all time logged at a specific property.
• Homeowner Address Field — Homeowners now have a separate address field. House numbers split from names into dedicated address column.
• Homeowner Edit/Search — Full inline editing for homeowner name and address, search bar, toggle active/inactive with "Show inactive" filter.
• Employee Edit/Delete — Admin Users tab now has role dropdown (employee/admin), deactivate button (soft-delete preserving history), and reactivate option.
• Reopen Timesheet — PUT /api/admin/timesheets/:id/reopen endpoint allows admins to unlock approved/rejected timesheets for corrections.
• Timesheet History — GET /api/timesheets/history endpoint returns all user timesheets for the History page.
• Public Homeowners API — GET /api/homeowners endpoint for authenticated users (used by timesheet entry form).

Fixed

• Timezone bug — new Date("YYYY-MM-DD") parsed as UTC, causing wrong day names in US timezones. All date parsing now uses local time.
• CORS policy violation — Added Tailscale IP to allowed CORS origins.
• Approve button 400 error — Frontend now sends {} body on approve (validation required an object).
• PDF download silent failure — Frontend was using timesheet.id but API returns timesheetId. Fixed field mapping.
• Auto-save errors on incomplete entries — Auto-save now only fires when all required fields (homeowner, hours, description) are filled. Incomplete entries show amber border indicator.
• History page crash — .map is not a function when API returned object instead of array. Added dedicated history endpoint.
• Rate limit too aggressive — Auth endpoint bumped from 5 to 50 attempts per 15 min for development.

API Endpoints Added

Method	Endpoint	Description
POST	/api/entries/copy-week	Copy entries from one week to another
POST	/api/admin/timesheets/bulk-approve	Approve multiple timesheets
POST	/api/admin/timesheets/bulk-reject	Reject multiple timesheets
GET	/api/admin/overtime	Overtime report with filters
GET	/api/timesheets/overtime	Employee's own overtime for a week
PUT	/api/admin/timesheets/:id/reopen	Reopen locked timesheet
DELETE	/api/admin/users/:id	Deactivate employee (soft-delete)
GET	/api/timesheets/history	All user timesheets
GET	/api/homeowners	Public homeowner list

[2.0.0] - 2026-02-15

Added

• Complete rewrite from static HTML to production-grade stack
• React 18 + Vite + Tailwind CSS (mobile-first design)
• Express + Prisma + PostgreSQL backend
• JWT authentication with role-based access (employee, admin, super_admin)
• Weekly Mon–Sun timesheets with auto-save (800ms debounce)
• Multiple homeowner entries per day
• Submit → Approve/Reject workflow
• Server-side PDF generation (@react-pdf/renderer)
• SMTP email integration with branded HTML templates
• Admin panel with employee/homeowner management
• Reporting with employee, status, and date range filters
• Dark mode (system-aware + manual toggle)
• Docker Compose single-command deployment
• Non-root containers, Helmet security headers, bcrypt, Zod validation
• Rate limiting on auth endpoints
• 46 homeowners seeded from v1 data