Merge pull request #29 from nextcloud/feat/noid/hr-sick-leave-overview

Feat/noid/hr sick leave overview

Author: karlitschek

.github/workflows/frontend-unit-tests.yml

@@ -0,0 +1,93 @@
+# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+#
+# App-specific workflow, deliberately not named after an organization template
+# (npm-test.yml et al) so the template sync in sync-workflow-templates.yml —
+# which copies over any file matching a template name — cannot silently replace
+# it. Runs the Vitest suite over the frontend helpers.
+
+name: Frontend unit tests
+
+on: pull_request
+
+permissions:
+  contents: read
+
+concurrency:
+  group: frontend-unit-tests-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest-low
+    permissions:
+      contents: read
+      pull-requests: read
+
+    outputs:
+      src: ${{ steps.changes.outputs.src}}
+
+    steps:
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        id: changes
+        continue-on-error: true
+        with:
+          filters: |
+            src:
+              - '.github/workflows/**'
+              - 'src/**'
+              - 'package.json'
+              - 'package-lock.json'
+              - '**.js'
+              - '**.vue'
+
+  test:
+    runs-on: ubuntu-latest
+
+    needs: changes
+    if: needs.changes.outputs.src != 'false'
+
+    name: Vitest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Read package.json node and npm engines version
+        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        id: versions
+        with:
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
+
+      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ steps.versions.outputs.nodeVersion }}
+
+      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+
+      - name: Install dependencies
+        env:
+          CYPRESS_INSTALL_BINARY: 0
+          PUPPETEER_SKIP_DOWNLOAD: true
+        run: npm ci
+
+      - name: Run tests
+        run: npm run test
+
+  summary:
+    permissions:
+      contents: none
+    runs-on: ubuntu-latest-low
+    needs: [changes, test]
+
+    if: always()
+
+    name: frontend-unit-tests
+
+    steps:
+      - name: Summary status
+        run: if ${{ needs.changes.outputs.src != 'false' && needs.test.result != 'success' }}; then exit 1; fi

js/absence-main.mjs

@@ -13,6 +13,7 @@
 use OCA\Absence\Service\PermissionService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IRequest;
 
@@ -30,11 +31,13 @@ public function __construct(
 	}
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 60, period: 60)]
 	public function mine(?int $year = null): DataResponse {
 		return $this->handle(fn () => $this->balanceService->getBalance((string)$this->userId, $year));
 	}
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 60, period: 60)]
 	public function forEmployee(string $uid, ?int $year = null): DataResponse {
 		return $this->handle(function () use ($uid, $year) {
 			if (!$this->permission->canViewBalanceOf((string)$this->userId, $uid)) {

js/absence-main.mjs.map

@@ -11,6 +11,7 @@
 use OCA\Absence\Service\CoverageService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IRequest;
 
@@ -27,6 +28,7 @@ public function __construct(
 	}
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 60, period: 60)]
 	public function index(string $from, string $to, string $scope = 'team'): DataResponse {
 		return $this->handle(function () use ($from, $to, $scope) {
 			$uids = $this->service->resolveScopeUids((string)$this->userId, $scope);

lib/Controller/BalanceController.php

@@ -14,6 +14,7 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\DataDownloadResponse;
 use OCP\AppFramework\Http\DataResponse;
@@ -33,6 +34,7 @@ public function __construct(
 
 	#[NoAdminRequired]
 	#[NoCSRFRequired]
+	#[UserRateLimit(limit: 10, period: 60)]
 	public function requests(string $from, string $to): DataResponse|DataDownloadResponse {
 		if (!$this->permission->isHr((string)$this->userId)) {
 			return new DataResponse(['message' => 'HR role required'], Http::STATUS_FORBIDDEN);
@@ -43,6 +45,7 @@ public function requests(string $from, string $to): DataResponse|DataDownloadRes
 
 	#[NoAdminRequired]
 	#[NoCSRFRequired]
+	#[UserRateLimit(limit: 10, period: 60)]
 	public function balances(?int $year = null): DataResponse|DataDownloadResponse {
 		if (!$this->permission->isHr((string)$this->userId)) {
 			return new DataResponse(['message' => 'HR role required'], Http::STATUS_FORBIDDEN);

lib/Controller/CoverageController.php

@@ -13,6 +13,7 @@
 use OCA\Absence\Service\ReportService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IRequest;
 
@@ -31,6 +32,7 @@ public function __construct(
 	}
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 30, period: 60)]
 	public function balances(?int $year = null, ?string $group = null): DataResponse {
 		return $this->handle(function () use ($year, $group) {
 			$this->permission->assertHr((string)$this->userId);
@@ -44,6 +46,7 @@ public function balances(?int $year = null, ?string $group = null): DataResponse
 	 * never visible to line managers.
 	 */
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 30, period: 60)]
 	public function sickLeave(?int $year = null, ?string $group = null, ?int $typeId = null): DataResponse {
 		return $this->handle(function () use ($year, $group, $typeId) {
 			$this->permission->assertHr((string)$this->userId);
@@ -52,6 +55,7 @@ public function sickLeave(?int $year = null, ?string $group = null, ?int $typeId
 	}
 
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 30, period: 60)]
 	public function trends(string $from, string $to): DataResponse {
 		return $this->handle(function () use ($from, $to) {
 			$this->permission->assertHr((string)$this->userId);

lib/Controller/ExportController.php

@@ -208,6 +208,31 @@ public function findAllForEmployee(string $employeeUid): array {
 		return $this->findEntities($qb);
 	}
 
+	/**
+	 * All requests (any status) for a set of employees, for computing many
+	 * balances at once. The single-employee {@see findAllForEmployee()} run in a
+	 * loop is one query per head, which an HR report over the whole company
+	 * cannot afford.
+	 *
+	 * @param string[] $employeeUids
+	 * @return array<string,LeaveRequest[]> keyed by employee uid
+	 */
+	public function findAllForEmployees(array $employeeUids): array {
+		if ($employeeUids === []) {
+			return [];
+		}
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from($this->getTableName())
+			->where($qb->expr()->in('employee_uid', $qb->createNamedParameter($employeeUids, IQueryBuilder::PARAM_STR_ARRAY)))
+			->orderBy('start_date', 'DESC');
+		$grouped = [];
+		foreach ($this->findEntities($qb) as $request) {
+			$grouped[$request->getEmployeeUid()][] = $request;
+		}
+		return $grouped;
+	}
+
 	/**
 	 * All requests overlapping a range across the whole instance (HR reporting).
 	 *

lib/Controller/ReportController.php

@@ -40,7 +40,17 @@ public function currentYear(): int {
 	 * @return array<int,array<int,array{used:float,pending:float}>> [typeId][year] => buckets
 	 */
 	private function computeUsage(string $employeeUid): array {
-		$requests = $this->requestMapper->findAllForEmployee($employeeUid);
+		return $this->usageFromRequests($this->requestMapper->findAllForEmployee($employeeUid));
+	}
+
+	/**
+	 * The usage half of {@see computeUsage()}, over requests already in memory, so
+	 * a batch report can load every employee's requests in one query.
+	 *
+	 * @param LeaveRequest[] $requests
+	 * @return array<int,array<int,array{used:float,pending:float}>> [typeId][year] => buckets
+	 */
+	private function usageFromRequests(array $requests): array {
 		$byId = [];
 		foreach ($requests as $request) {
 			$byId[$request->getId()] = $request;
@@ -84,19 +94,82 @@ private function computeUsage(string $employeeUid): array {
 	 */
 	public function getBalance(string $employeeUid, ?int $year = null): array {
 		$usage = $this->computeUsage($employeeUid);
+		$types = $this->typesById();
+
+		// Entitlements for this employee: restricted to the reported year when there
+		// is one, otherwise all of them, since they also decide which years to show.
+		$entitlements = [];
+		foreach ($this->entitlementMapper->findForEmployee($employeeUid, $year) as $ent) {
+			$entitlements[$ent->getYear()][$ent->getTypeId()] = $ent;
+		}
+
+		return [
+			'employeeUid' => $employeeUid,
+			'balances' => $this->assembleRows($employeeUid, $year, $usage, $types, $entitlements),
+		];
+	}
+
+	/**
+	 * Balances for many employees in one year, in a fixed number of queries
+	 * regardless of headcount.
+	 *
+	 * The obvious loop over {@see getBalance()} costs one request query, one leave
+	 * type query and one entitlement query *per leave type* for every employee —
+	 * several thousand queries for a mid-sized company, which is what made the HR
+	 * balances report unusable at scale.
+	 *
+	 * @param string[] $employeeUids
+	 * @return array<string,list<array<string,mixed>>> balance rows keyed by employee uid
+	 */
+	public function getBalancesForEmployees(array $employeeUids, int $year): array {
+		if ($employeeUids === []) {
+			return [];
+		}
+		$types = $this->typesById();
+		$requestsByEmployee = $this->requestMapper->findAllForEmployees($employeeUids);
+
+		$entitlementsByEmployee = [];
+		foreach ($this->entitlementMapper->findForYear($year) as $ent) {
+			$entitlementsByEmployee[$ent->getEmployeeUid()][$year][$ent->getTypeId()] = $ent;
+		}
+
+		$result = [];
+		foreach ($employeeUids as $uid) {
+			$usage = $this->usageFromRequests($requestsByEmployee[$uid] ?? []);
+			$result[$uid] = $this->assembleRows($uid, $year, $usage, $types, $entitlementsByEmployee[$uid] ?? []);
+		}
+		return $result;
+	}
+
+	/**
+	 * @return array<int,LeaveType>
+	 */
+	private function typesById(): array {
 		$types = [];
 		foreach ($this->leaveTypeMapper->findAll() as $type) {
 			$types[$type->getId()] = $type;
 		}
+		return $types;
+	}
 
+	/**
+	 * Turn precomputed usage, types and entitlements into balance rows. Shared by
+	 * the single-employee and batch paths so both produce identical output.
+	 *
+	 * @param array<int,array<int,array{used:float,pending:float}>> $usage
+	 * @param array<int,LeaveType> $types
+	 * @param array<int,array<int,Entitlement>> $entitlements [year][typeId]
+	 * @return list<array<string,mixed>>
+	 */
+	private function assembleRows(string $employeeUid, ?int $year, array $usage, array $types, array $entitlements): array {
 		// Determine which years to report.
 		$years = [];
 		if ($year !== null) {
 			$years[$year] = true;
 		} else {
 			$years[$this->currentYear()] = true;
-			foreach ($this->entitlementMapper->findForEmployee($employeeUid) as $ent) {
-				$years[$ent->getYear()] = true;
+			foreach (array_keys($entitlements) as $entYear) {
+				$years[$entYear] = true;
 			}
 			foreach ($usage as $perYear) {
 				foreach (array_keys($perYear) as $y) {
@@ -114,38 +187,39 @@ public function getBalance(string $employeeUid, ?int $year = null): array {
 				if (!$type->getCountsAgainstBalance() && $used === 0.0 && $pending === 0.0) {
 					continue;
 				}
-				$rows[] = $this->buildRow($employeeUid, $reportYear, $type, $used, $pending);
+				$rows[] = $this->buildRow($employeeUid, $reportYear, $type, $used, $pending, $entitlements[$reportYear][$typeId] ?? null);
 			}
 		}
 		// Newest year first, then sort_order.
 		usort($rows, static function (array $a, array $b): int {
 			return [$b['year'], $a['sortOrder']] <=> [$a['year'], $b['sortOrder']];
 		});
-
-		return [
-			'employeeUid' => $employeeUid,
-			'balances' => $rows,
-		];
+		return $rows;
 	}
 
 	/**
 	 * @return array<string,mixed>
 	 */
-	private function buildRow(string $employeeUid, int $year, LeaveType $type, float $used, float $pending): array {
+	/**
+	 * @param ?Entitlement $ent the stored entitlement, or null when none exists.
+	 *                          Passed in rather than looked up here so a batch
+	 *                          report can resolve every employee's rows from one
+	 *                          preloaded index instead of a query per row.
+	 */
+	private function buildRow(string $employeeUid, int $year, LeaveType $type, float $used, float $pending, ?Entitlement $ent): array {
 		$entitlement = null;
 		$base = 0.0;
 		$carry = 0.0;
 		$adjust = 0.0;
 		$entitlementId = null;
 		if ($type->getCountsAgainstBalance()) {
-			try {
-				$ent = $this->entitlementMapper->findFor($employeeUid, $year, $type->getId());
+			if ($ent !== null) {
 				$base = $ent->getBaseDays();
 				$carry = $ent->getCarryOverDays();
 				$adjust = $ent->getManualAdjustment();
 				$entitlement = $ent->getEntitlement();
 				$entitlementId = $ent->getId();
-			} catch (DoesNotExistException) {
+			} else {
 				// No row yet: only the primary annual type inherits the configured
 				// default allotment; other counting types start at zero until HR
 				// grants an entitlement (avoids fabricating balances, §6.1).

lib/Db/LeaveRequestMapper.php

@@ -60,6 +60,20 @@ public function serverYear(): int {
 		return (int)$this->serverNow()->format('Y');
 	}
 
+	/**
+	 * The current instant for a stored timestamp column (created_at, decided_at …).
+	 *
+	 * Deliberately UTC and not one of the two day-boundary methods above: a
+	 * timestamp records *when* something happened, which is the same moment for
+	 * everyone, so there is no user or server timezone to pick. It exists only so
+	 * the workflow's timestamps come from the same pinnable clock as everything
+	 * else — `new \DateTime()` cannot be frozen in a test. Mutable because the
+	 * entity setters take \DateTime.
+	 */
+	public function now(): \DateTime {
+		return \DateTime::createFromImmutable($this->at(new \DateTimeZone('UTC')));
+	}
+
 	public function userNow(): \DateTimeImmutable {
 		return $this->at($this->dateTimeZone->getTimeZone());
 	}