Attachments, entitlement import, manager-absence escalation, integration tests

[karlitschek]

Follow-up to #53 — the next four items from the improvement list, developed and verified end-to-end on the devel instance.

📎 Attachments (doctor's notes) — §3.8

Files on a leave request. Metadata in absence_attachments; bytes in the app's own appdata storage, never in anybody's Files — so the API is the only door. It opens for HR and the employee only (including on HR-recorded sick leave, exactly where a doctor's note belongs); the manager deliberately gets nothing, and confidential requests (§5.7) hide attachments even from the employee. 10 MB / 10 files per request, names sanitized, bytes stored by row id (no client input near a path), nosniff downloads. Adds/removals hit the always-on audit log but never the manager-visible history timeline. GDPR purge removes rows and bytes. Sidebar UI with upload/download/remove.

Verified live: employee uploads to own sick record ✓, HR downloads ✓, manager gets 403 and an empty list ✓.

⏰ Manager-absence-aware escalation — §5.4a

The app manages the decider's leave too, so it should act on it: a request whose manager is on approved leave today is escalated to HR at submission ("Manager is away — routed to HR"), and the hourly job escalates pending requests early when the manager's absence outlasts the request's own escalation deadline. Both paths use the race-safe conditional flip from #53, so a manager deciding at that second is never clobbered. Deliberately not delegated to the manager's replacement — deciding leave means reading reasons and balances.

📥 Entitlement import — §6.3

occ absence:import-entitlements balances.csv [--year N] [--dry-run] — the onboarding path from the spreadsheet. uid or e-mail, comma or semicolon separated (German Excel), BOM tolerated, and all-or-nothing: every broken line reported, nothing written. Writes go through EntitlementService, so the entitlement history records the import like any HR edit.

🧪 Integration tests on a real database

New composer test:integration — the existing phpunit-mysql workflow picks it up automatically. Covers exactly what mocked mappers cannot: the balance SQL aggregation, markEscalated's flip-exactly-once semantics, the covering-absence query, badge counts, and single/batch balance parity including the netting rule — plus a query-budget guard (tests/Integration/base-query-count.txt) so the batch path's fixed query count can't regress one innocent lookup at a time. tests/bootstrap.php now honors NEXTCLOUD_ROOT and tolerates packaged servers (symlinked dev setups can run the suite). Ran green against a real MySQL before pushing.

Gates: 229 unit tests / 678 assertions (+14 new), 6 integration tests, psalm clean, php-cs clean, 43 frontend tests, eslint clean. Version bump intentionally left out.

🤖 Generated with Claude Code