The Rupert app on this iPhone sends these as notifications. Manage them in iPhone Settings → Notifications → Rupert.
+ <% else %> + <%= render 'shared/push_subscribe', vapid_public_key: @vapid_public_key %> + <% end %> + <% if @devices.any? %> +<%= number_with_precision(@summary.daily_hours(day), precision: 2, strip_insignificant_zeros: true) %>h
<% elsif @summary.clock_hours(day).positive? %><%= number_with_precision(@summary.clock_hours(day), precision: 2, strip_insignificant_zeros: true) %>h
<% end %> <% @summary.daily_requests(day).each do |leave| %><%= t("time.time_off.short.#{leave.leave_type}") %><%= leave.requested? ? t('time.time_off.status.requested') : t('time.time_off.status.approved') %>
<% end %> diff --git a/web/app/views/layouts/employee.html.erb b/web/app/views/layouts/employee.html.erb index 6ed2e4cae..887852436 100644 --- a/web/app/views/layouts/employee.html.erb +++ b/web/app/views/layouts/employee.html.erb @@ -1,11 +1,13 @@ - + <%= render "layouts/favicon" %><%= notice %>
<% end %> <% if alert %><%= alert %>
<% end %> <% if @preview %>Staff preview · Example data only. Browse freely; saving, clocking and sending are disabled. <%= link_to 'Close preview', employee_app_path, class: 'underline' %>
<% end %> <%= yield %> + <%# Page help is a quiet line under the content (docs/ui-standards.md §2), never above the clock. %> + <%= render 'shared/workspace_help' if Current.user && !@preview %>Get schedule, approval and clock-out notifications on this device.
+ +Push notifications for the web app are not set up yet. The bell at the top still shows everything.
+<% end %> diff --git a/web/bin/check-a11y b/web/bin/check-a11y new file mode 100755 index 000000000..f26ecbfb8 --- /dev/null +++ b/web/bin/check-a11y @@ -0,0 +1,61 @@ +#!/usr/bin/env bash +# Accessibility audit of the staff (Time tab) pages with axe-core, at phone width, light and dark. +# Fails on any serious or critical violation. Nothing is installed into the repo: Playwright and +# axe-core go into a scratch folder ($A11Y_DIR, default a temp dir) with npm. +# +# bin/check-a11y # against http://127.0.0.1:3000 as the demo worker +# BASE=http://127.0.0.1:3005 EMAIL=… PASSWORD=… bin/check-a11y /employee /employee/schedule +# +# Needs a running Rails server with the review demo seeded (REVIEW_PASSWORD=… bin/rails rupert:app_review_demo) +# unless EMAIL/PASSWORD point at another worker account. +set -euo pipefail + +BASE=${BASE:-http://127.0.0.1:3000} +EMAIL=${EMAIL:-sam.okafor@juniper-pine.example} +PASSWORD=${PASSWORD:-${REVIEW_PASSWORD:-}} +A11Y_DIR=${A11Y_DIR:-$(mktemp -d)} +[ -n "$PASSWORD" ] || { echo "Set PASSWORD (or REVIEW_PASSWORD) for $EMAIL" >&2; exit 2; } + +PAGES=("$@") +[ ${#PAGES[@]} -gt 0 ] || PAGES=(/employee /employee/schedule /employee/time-off /employee/pay /employee/notifications/settings /employee/devices /time_clock /notifications) + +if [ ! -d "$A11Y_DIR/node_modules/playwright" ]; then + (cd "$A11Y_DIR" && npm init -y >/dev/null && npm install --no-audit --no-fund playwright@1.58.0 axe-core@4.11.0 >/dev/null && npx playwright install chromium >/dev/null) +fi + +cat >"$A11Y_DIR/audit.mjs" <<'EOF' +import { chromium } from "playwright"; +import { readFileSync } from "node:fs"; +import { createRequire } from "node:module"; +const require = createRequire(import.meta.url); +const axeSource = readFileSync(require.resolve("axe-core/axe.min.js"), "utf8"); +const [base, email, password, ...pages] = process.argv.slice(2); +const browser = await chromium.launch(); +let failures = 0; +for (const scheme of ["light", "dark"]) { + const ctx = await browser.newContext({ viewport: { width: 390, height: 844 }, isMobile: true, hasTouch: true, colorScheme: scheme }); + const page = await ctx.newPage(); + await page.goto(`${base}/login`, { waitUntil: "networkidle" }); + await page.evaluate(() => document.querySelector("details.login-password")?.setAttribute("open", "")); + await page.fill("input[name=email]", email); + await page.fill("input[name=password]", password); + await Promise.all([page.waitForURL((u) => !u.pathname.startsWith("/login")), page.click("input[type=submit], button[type=submit]")]); + for (const path of pages) { + await page.goto(base + path, { waitUntil: "networkidle" }); + await page.addScriptTag({ content: axeSource }); + const result = await page.evaluate(async () => await window.axe.run(document, { runOnly: { type: "tag", values: ["wcag2a", "wcag2aa", "wcag21aa", "best-practice"] } })); + const bad = result.violations.filter((v) => ["serious", "critical"].includes(v.impact)); + const minor = result.violations.length - bad.length; + console.log(`${scheme.padEnd(5)} ${path.padEnd(36)} ${bad.length} serious/critical, ${minor} other`); + for (const v of bad) { + failures++; + console.log(` ${v.impact.toUpperCase()} ${v.id}: ${v.help} (${v.nodes.length} nodes)`); + for (const node of v.nodes.slice(0, 3)) console.log(` ${node.target.join(" ")}`); + } + } + await ctx.close(); +} +await browser.close(); +process.exit(failures ? 1 : 0); +EOF +cd "$A11Y_DIR" && node audit.mjs "$BASE" "$EMAIL" "$PASSWORD" "${PAGES[@]}" diff --git a/web/config/locales/es.yml b/web/config/locales/es.yml new file mode 100644 index 000000000..a947698f4 --- /dev/null +++ b/web/config/locales/es.yml @@ -0,0 +1,52 @@ +# Spanish for the staff-facing pages (a worker's People::Employee#locale). Rails dates, times and +# common model messages here; each time & pay screen keeps its own strings in time_*.es.yml. +# Management pages stay in English (ApplicationController#switch_locale). +es: + date: + abbr_day_names: [dom, lun, mar, mié, jue, vie, sáb] + abbr_month_names: [~, ene, feb, mar, abr, may, jun, jul, ago, sep, oct, nov, dic] + day_names: [domingo, lunes, martes, miércoles, jueves, viernes, sábado] + month_names: [~, enero, febrero, marzo, abril, mayo, junio, julio, agosto, septiembre, octubre, noviembre, diciembre] + formats: + default: "%d/%m/%Y" + long: "%-d de %B de %Y" + short: "%-d %b" + order: + - :day + - :month + - :year + time: + am: am + pm: pm + formats: + default: "%a, %-d %b %Y %H:%M" + short: "%-d %b %H:%M" + long: "%A, %-d de %B de %Y" + time: "%-I:%M %p" + datetime: "%A, %-d %b %Y · %-I:%M %p" + number: + format: + delimiter: "," + separator: "." + currency: + format: + format: "%u%n" + unit: "$" + errors: + messages: + blank: "no puede estar en blanco" + invalid: "no es válido" + taken: "ya está en uso" + too_long: "es demasiado largo (máximo %{count} caracteres)" + not_a_number: "no es un número" + greater_than: "debe ser mayor que %{count}" + less_than_or_equal_to: "debe ser menor o igual que %{count}" + helpers: + submit: + create: "Guardar" + update: "Guardar" + submit: "Guardar" + activerecord: + errors: + messages: + record_invalid: "La validación falló: %{errors}" diff --git a/web/config/routes.rb b/web/config/routes.rb index a111013d3..ed3e8845d 100644 --- a/web/config/routes.rb +++ b/web/config/routes.rb @@ -156,6 +156,16 @@ defaults: { format: :json } post '/native/session', to: 'native/sessions#create', as: :native_session + # ---- time & pay: ios ---- + # The iPhone app's APNs token, the installed web app's Web Push subscription, and a person's own notification choices. + post '/native/push_devices', to: 'native/push_devices#create', as: :native_push_devices + delete '/native/push_devices/:token_digest', to: 'native/push_devices#destroy', as: :native_push_device + get '/employee/notifications/settings', to: 'employee_notifications#settings', as: :employee_notification_settings + patch '/employee/notifications/settings', to: 'employee_notifications#update_settings' + post '/employee/push_subscriptions', to: 'employee_notifications#subscribe', as: :employee_push_subscriptions + post '/employee/push_subscriptions/:id/unsubscribe', to: 'employee_notifications#unsubscribe', as: :unsubscribe_employee_push + # ---- end time & pay: ios ---- + get '/workspace', to: 'workspaces#show', as: :workspace post '/workspace/session', to: 'workspaces#session_start', as: :workspace_session get '/instance/health', to: 'instance_health#show' diff --git a/web/lib/tasks/app_review_demo.rake b/web/lib/tasks/app_review_demo.rake index 575d8b7c1..d34040edc 100644 --- a/web/lib/tasks/app_review_demo.rake +++ b/web/lib/tasks/app_review_demo.rake @@ -30,8 +30,12 @@ module AppReviewDemo PEOPLE = [ { key: :maya, email: 'maya.chen@juniper-pine.example', name: 'Maya Chen', role: 'admin' }, { key: :theo, email: 'theo.alvarez@juniper-pine.example', name: 'Theo Alvarez', role: 'admin' }, - { key: :priya, email: 'priya.shah@juniper-pine.example', name: 'Priya Shah', role: 'cashier' } + { key: :priya, email: 'priya.shah@juniper-pine.example', name: 'Priya Shah', role: 'cashier' }, + # The hourly worker the reviewer can also sign in as (Time tab): their password is REVIEW_WORKER_PASSWORD, + # or the review password when that is not set. Never printed. + { key: :worker, email: 'sam.okafor@juniper-pine.example', name: 'Sam Okafor', role: 'employee' } ].freeze + WORKER_PIN = '2580' # handle, product title, variant title, type, price, shop shelf, back stockroom CATALOG = [ @@ -61,7 +65,7 @@ module AppReviewDemo module_function - def run!(password:, reset: false, now: Time.current) + def run!(password:, reset: false, now: Time.current, worker_password: nil) raise ArgumentError, "REVIEW_PASSWORD must be at least #{MIN_PASSWORD} characters" if password.to_s.length < MIN_PASSWORD tenant = ensure_tenant! @@ -69,6 +73,7 @@ module AppReviewDemo Current.set(tenant: tenant, user: user) do wipe!(tenant) if reset people = ensure_people!(tenant).merge(sam: user) + people[:worker].update!(password: worker_password.presence || password) locations = ensure_locations! variants = ensure_catalog!(locations, now) orders = ensure_sales!(variants, locations[:shop], now) @@ -76,6 +81,7 @@ module AppReviewDemo tasks = ensure_tasks!(people, now) ensure_notifications!(user, people, tasks, count, now) ensure_chat!(people, now) + ensure_time!(people, locations[:shop], now) DataCache.bump! settle_reviewer!(user) { tenant: tenant, user: user, orders: orders, count: count } @@ -296,6 +302,150 @@ module AppReviewDemo end # Deletes the demo workspace's rows, table by table, matching only its tenant id. + # ---- Time & pay (the Time tab) ------------------------------------------------------------- + # Staff records for Maya (manager, admin: no tip share), Priya and the worker, hourly rates, the + # worker's clock PIN, two weeks of punches with a meal break, next week's published shifts, time + # off (one approved, one waiting), this week's tips and a submitted timesheet. Keyed so a second + # run changes nothing it already made. + def ensure_time!(people, shop, now) + staff = { + maya: staff!(people[:maya], 'Maya', 'Chen', 2600, number: '1001'), + priya: staff!(people[:priya], 'Priya', 'Shah', 1900, number: '1002'), + worker: staff!(people[:worker], 'Sam', 'Okafor', 1850, number: '1003') + } + staff[:worker].set_pin!(WORKER_PIN) unless staff[:worker].pin_set? + staff.each_value { |employee| employee.update!(location_ids: [shop.id]) if employee.location_ids.empty? } + ensure_punches!(staff, shop, now) + ensure_shifts!(staff, shop, now) + ensure_time_off!(staff, people[:maya], now) + ensure_tips!(staff, shop, now) + ensure_timesheet!(staff[:worker], now) + end + + def staff!(user, first, last, rate_cents, number:) + employee = People::Employee.find_or_initialize_by(user_id: user.id) + if employee.new_record? + employee.assign_attributes(first_name: first, last_name: last, email: user.email, employee_number: number, + employment_type: 'part_time', hire_date: Date.new(2025, 3, 3)) + employee.save! + end + People::PayRate.find_or_create_by!(employee_id: employee.id, pay_type: 'hourly', effective_on: Date.new(2025, 3, 3)) do |rate| + rate.hourly_rate_cents = rate_cents + rate.pay_frequency = 'weekly' + end + employee + end + + # Weekday shifts over the last two weeks, 9 to 5 with a 30-minute meal; yesterday has a rest break too. + def ensure_punches!(staff, shop, now) + zone = BusinessClock.zone(tenant: Current.tenant, location: shop) + (1..14).each do |days_ago| + day = now.in_time_zone(zone).to_date - days_ago + next if day.saturday? || day.sunday? + + { worker: [9, 17], priya: [10, 18] }.each do |key, (from, to)| + employee = staff[key] + token = "demo-#{key}-#{day.iso8601}" + next if ClockShift.exists?(request_token: token) + + started = zone.local(day.year, day.month, day.day, from, [2, 0, 4, 1][days_ago % 4]) + ended = zone.local(day.year, day.month, day.day, to, [1, 6, 0, 3][days_ago % 4]) + shift = ClockShift.create!(user: employee.user, employee: employee, employee_key: employee.id.to_s, employee_name: employee.name, + employment_type: employee.employment_type, request_token: token, started_at: started, ended_at: ended, + source: 'pos', location_id: shop.id, register_name: 'Front register', device_label: 'Front register') + shift.breaks.create!(kind: 'meal', paid: false, started_at: started + 4.hours, ended_at: started + 4.hours + 30.minutes) + shift.breaks.create!(kind: 'rest', paid: true, started_at: started + 2.hours, ended_at: started + 2.hours + 10.minutes) if days_ago == 1 + end + end + end + + # Next week's shifts, published, plus one open shift to pick up. + def ensure_shifts!(staff, shop, now) + zone = BusinessClock.zone(tenant: Current.tenant, location: shop) + week = (now.in_time_zone(zone).to_date + 7).beginning_of_week + pattern = { worker: [[0, 9, 17], [1, 9, 17], [3, 12, 20], [4, 9, 17]], priya: [[0, 10, 18], [2, 10, 18], [3, 9, 17], [5, 10, 16]], maya: [[1, 8, 16], [2, 8, 16], [4, 8, 16]] } + pattern.each do |key, days| + days.each do |(offset, from, to)| + day = week + offset + starts_at = zone.local(day.year, day.month, day.day, from) + next if People::ScheduledShift.exists?(employee_id: staff[key].id, starts_at: starts_at) + + People::ScheduledShift.create!(employee: staff[key], starts_at: starts_at, ends_at: zone.local(day.year, day.month, day.day, to), + role_label: key == :maya ? 'Manager' : 'Counter', location_id: shop.id, break_minutes: 30, published_at: now - 2.days, created_by: staff[:maya].user) + end + end + saturday = week + 5 + open_start = zone.local(saturday.year, saturday.month, saturday.day, 12) + unless People::ScheduledShift.exists?(employee_id: nil, starts_at: open_start) + People::ScheduledShift.create!(employee: nil, starts_at: open_start, ends_at: open_start + 6.hours, role_label: 'Counter', + location_id: shop.id, break_minutes: 0, published_at: now - 2.days, created_by: staff[:maya].user, notes: 'Holiday market weekend: extra hands at the counter.') + end + People::SchedulePublication.find_or_create_by!(location_id: shop.id, week_start: week) do |publication| + publication.published_at = now - 2.days + publication.published_by = staff[:maya].user + publication.shift_count = People::ScheduledShift.between(week, week + 6).count + end + end + + def ensure_time_off!(staff, maya, now) + worker = staff[:worker] + approved = People::LeaveRequest.find_or_initialize_by(employee_id: worker.id, request_key: 'demo-worker-approved') + if approved.new_record? + approved.assign_attributes(leave_type: 'vacation', starts_on: now.to_date + 21, ends_on: now.to_date + 23, hours: 24, reason: 'Long weekend away.') + approved.save! + approved.approve! + approved.update!(reviewed_by: maya.id, reviewed_at: now - 1.day) + end + pending = People::LeaveRequest.find_or_initialize_by(employee_id: worker.id, request_key: 'demo-worker-pending') + if pending.new_record? + pending.assign_attributes(leave_type: 'personal', starts_on: now.to_date + 10, ends_on: now.to_date + 10, hours: 8, reason: 'Dentist in the morning.') + pending.save! + end + worker.leave_balance('vacation').tap { |b| b.update!(used_hours: 24) if b.used_hours.zero? } + end + + # Card tips shared between the two staff on shift and a cash tip the worker declared, this week. + def ensure_tips!(staff, shop, now) + zone = BusinessClock.zone(tenant: Current.tenant, location: shop) + (1..5).each do |days_ago| + day = now.in_time_zone(zone).to_date - days_ago + next if day.saturday? || day.sunday? + + ref = "demo-tip-#{day.iso8601}" + next if TipAllocation.exists?(source_ref: ref) + + at = zone.local(day.year, day.month, day.day, 13, 15) + gross = 1200 + (days_ago * 325) + %i[worker priya].each_with_index do |key, index| + employee = staff[key] + shift = ClockShift.find_by(employee_id: employee.id, request_token: "demo-#{key}-#{day.iso8601}") + TipAllocation.create!(employee: employee, clock_shift: shift, location_id: shop.id, source_kind: 'manual', source_ref: ref, + tip_method: 'pool', status: days_ago > 2 ? 'settled' : 'estimated', amount_cents: (gross / 2) + (index.zero? ? gross % 2 : 0), + gross_tip_cents: gross, share_count: 2, occurred_at: at, business_date: day, evidence: 'time_register', + settled_at: days_ago > 2 ? at + 1.day : nil, note: 'Card tips from the front register, shared evenly.') + end + next unless days_ago == 1 + + TipAllocation.create!(employee: staff[:worker], location_id: shop.id, source_kind: 'declared', source_ref: "#{ref}-cash", tip_method: 'cash', + status: 'settled', amount_cents: 1400, occurred_at: at + 4.hours, business_date: day, evidence: 'declared', created_by: staff[:worker].user, + note: 'Cash tips declared at clock-out.') + end + end + + # Last week's timesheet, built from the punches and sent for review. + def ensure_timesheet!(worker, now) + rules = PayRules.current + period_start, period_end = rules.period_range(now.to_date - 7) + return if People::Timesheet.exists?(employee_id: worker.id, period_start: period_start) + + sheet = People::Timesheet.create!(employee: worker, period_start: period_start, period_end: period_end, notes: 'Covered the Thursday delivery.') + ClockShift.where(employee_id: worker.id).where.not(ended_at: nil).where(started_at: period_start.in_time_zone..(period_end + 1).in_time_zone).find_each do |shift| + sheet.entries.create!(worked_on: shift.started_at.to_date, hours: shift.paid_hours.round(2), work_type: 'regular', clock_shift_id: shift.id) + end + sheet.submit! if sheet.entries.any? + sheet.update!(submitted_at: now - 1.day) if sheet.submitted? + end + def wipe!(tenant) connection = ActiveRecord::Base.connection tables = connection.tables.reject { |table| KEEP_ON_RESET.include?(table) } @@ -320,10 +470,11 @@ namespace :rupert do abort("Set REVIEW_PASSWORD to the review account's password (at least #{AppReviewDemo::MIN_PASSWORD} characters).") end - result = AppReviewDemo.run!(password: password, reset: ENV['REVIEW_DEMO_RESET'].present?) + result = AppReviewDemo.run!(password: password, reset: ENV['REVIEW_DEMO_RESET'].present?, worker_password: ENV.fetch('REVIEW_WORKER_PASSWORD', nil)) puts "#{AppReviewDemo::NAME} ready (workspace #{AppReviewDemo::SUBDOMAIN})." puts "Sign in as #{result[:user].email} (admin of this workspace only) with the password you set." puts "Added #{result[:orders]} sample sales; draft count #{result[:count].id}." + puts "Worker sign-in for the Time tab: sam.okafor@juniper-pine.example (REVIEW_WORKER_PASSWORD, or the review password); clock PIN #{AppReviewDemo::WORKER_PIN}." rescue ArgumentError => e abort(e.message) end diff --git a/web/test/integration/employee_workspace_test.rb b/web/test/integration/employee_workspace_test.rb index 86c6b0bad..795682603 100644 --- a/web/test/integration/employee_workspace_test.rb +++ b/web/test/integration/employee_workspace_test.rb @@ -91,7 +91,7 @@ def sign_in(user = @user) sign_in get employee_time_off_path, params: { month: '2026-10', employee_id: @other.id } assert_response :success - assert_select '[role="table"][aria-label="Your calendar"]' + assert_select '[role="list"][aria-label="Your calendar"]' assert_includes response.body, 'My vacation' assert_select '[data-balance="vacation"]', '40 h' refute_includes response.body, 'PRIVATE OTHER LEAVE' diff --git a/web/test/integration/native_app_test.rb b/web/test/integration/native_app_test.rb index 9aae08f42..a5a181fb4 100644 --- a/web/test/integration/native_app_test.rb +++ b/web/test/integration/native_app_test.rb @@ -56,6 +56,17 @@ def handed_off(name) assert_not_includes response.body, 'class="min-h-full native-app"' end + test 'every layout the Time tab shows tells the app whether the person is signed in' do + native = { 'User-Agent' => 'Mozilla/5.0 (iPhone) Hotwire Native iOS; Turbo Native iOS; bridge-components: []' } + get employee_app_path, headers: native + assert_includes response.body, '' + post login_path, params: { email: @admin.email, password: 'password123' } + get employee_app_path, headers: native + assert_includes response.body, '' + get employee_app_path + assert_not_includes response.body, 'rupert-session', 'browsers do not get the tag' + end + test 'Google in the sheet hands a one-time code to the app, not a session' do sign_in_through_sheet code = handed_off('code') diff --git a/web/test/integration/notification_settings_test.rb b/web/test/integration/notification_settings_test.rb new file mode 100644 index 000000000..f5dd888c4 --- /dev/null +++ b/web/test/integration/notification_settings_test.rb @@ -0,0 +1,43 @@ +# frozen_string_literal: true + +require 'test_helper' + +# A person's own notification choices: every kind on by default, turned off per kind, honoured by +# TimeNotifier so a muted kind reaches neither the bell nor a phone. +class NotificationSettingsTest < ActionDispatch::IntegrationTest + setup do + @tenant = tenants(:default_tenant) + Current.tenant = @tenant + @worker_user = User.create!(tenant: @tenant, name: 'Quiet Worker', email: 'quiet-worker@example.com', role: 'employee', password: 'password123') + People::Employee.create!(user: @worker_user, first_name: 'Quiet', last_name: 'Worker', employment_type: 'part_time') + sign_in @worker_user + end + + teardown { Current.reset } + + test 'an employee opens the settings page and turns a kind off' do + get employee_notification_settings_path + assert_response :success + assert_select 'h1', 'Notifications' + assert_select 'input[name^="prefs["][type=checkbox][checked]', User::NOTIFICATION_KINDS.size + assert_select 'form[action=?]', employee_notification_settings_path + patch employee_notification_settings_path, params: { prefs: { break_due: '0', schedule_posted: '1' } } + assert_redirected_to employee_notification_settings_path + prefs = @worker_user.reload.notification_prefs + assert_equal false, prefs['break_due'] + assert_equal true, prefs['schedule_posted'] + assert_equal true, prefs['approvals'], 'a kind the form did not mention keeps its default (the form always sends every kind)' + end + + test 'a muted kind is not delivered' do + @worker_user.update!(notification_prefs: { 'break_due' => '0' }) + Current.reset + Current.tenant = @tenant + assert_no_difference -> { Notification.where(user_id: @worker_user.id).count } do + TimeNotifier.break_due(@worker_user, shift: Struct.new(:id).new(1), kind: 'meal', url: '/employee') + end + assert_difference -> { Notification.where(user_id: @worker_user.id).count }, 1 do + TimeNotifier.schedule_posted(@worker_user, week_start: Date.current, url: '/employee/schedule', shift_count: 2) + end + end +end diff --git a/web/test/integration/push_devices_test.rb b/web/test/integration/push_devices_test.rb new file mode 100644 index 000000000..5723ff6e5 --- /dev/null +++ b/web/test/integration/push_devices_test.rb @@ -0,0 +1,72 @@ +# frozen_string_literal: true + +require 'test_helper' + +# The iPhone app's APNs token and the installed web app's Web Push subscription are tied to the +# signed-in person's session; they are addresses, so sign-out and account deletion drop them. +class PushDevicesTest < ActionDispatch::IntegrationTest + setup do + @tenant = tenants(:default_tenant) + Current.tenant = @tenant + @worker_user = User.create!(tenant: @tenant, name: 'Push Worker', email: 'push-worker@example.com', role: 'employee', password: 'password123') + @worker = People::Employee.create!(user: @worker_user, first_name: 'Push', last_name: 'Worker', employment_type: 'part_time') + @worker.set_pin!('2580') + end + + teardown { Current.reset } + + test 'the app registers its token for the signed-in person and forgets it on sign-out' do + post native_push_devices_path, params: { platform: 'ios', token: 'abc123' }, as: :json + assert_redirected_to login_path + assert_equal 0, PushDevice.count, 'needs a session' + sign_in @worker_user + post native_push_devices_path, params: { platform: 'ios', token: 'abc123', environment: 'sandbox', app_version: '1.1.0 (20)' }, as: :json + assert_response :created + body = response.parsed_body + device = PushDevice.find(body['id']) + assert_equal @worker_user.id, device.user_id + assert_equal 'sandbox', device.environment + assert_equal false, body['push_configured'] + post native_push_devices_path, params: { platform: 'ios', token: 'abc123' }, as: :json + assert_equal 1, PushDevice.where(user_id: @worker_user.id).count, 'registering again updates in place' + delete native_push_device_path(body['token_digest']) + assert_response :no_content + assert_equal 'signed out', device.reload.failure_reason + post native_push_devices_path, params: { platform: 'android', token: 'x' }, as: :json + assert_response :unprocessable_entity + end + + test 'the web app subscribes with an endpoint and keys' do + sign_in @worker_user + post employee_push_subscriptions_path, params: { subscription: { endpoint: 'https://push.example/sub/1', keys: { p256dh: 'p', auth: 'a' } } }, as: :json + assert_response :created + device = PushDevice.find(response.parsed_body['id']) + assert_equal 'web', device.platform + assert_equal({ 'p256dh' => 'p', 'auth' => 'a' }, device.keys) + post employee_push_subscriptions_path, params: { subscription: { endpoint: 'http://insecure.example', keys: { p256dh: 'p', auth: 'a' } } }, as: :json + assert_response :unprocessable_entity + post unsubscribe_employee_push_path(device) + assert_redirected_to employee_notification_settings_path + assert device.reload.disabled_at.present? + end + + test 'deleting the account removes push devices and the clock PIN' do + sign_in @worker_user + PushDevice.register!(user: @worker_user, platform: 'ios', token: 'to-delete') + delete own_account_path, params: { confirmation: 'DELETE' } + assert_redirected_to login_path + assert_equal 0, PushDevice.unscoped.where(user_id: @worker_user.id).count + assert_not @worker.reload.pin_set? + end + + test 'nobody sees or disables another person’s device' do + other = User.create!(tenant: @tenant, name: 'Other', email: 'other-push-worker@example.com', role: 'employee', password: 'password123') + device = PushDevice.register!(user: other, platform: 'ios', token: 'theirs') + sign_in @worker_user + post unsubscribe_employee_push_path(device) + assert_nil device.reload.disabled_at + get employee_notification_settings_path + assert_response :success + assert_no_match 'last seen', response.body + end +end diff --git a/web/test/integration/square_timecard_history_test.rb b/web/test/integration/square_timecard_history_test.rb index 37fb29736..842c0a487 100644 --- a/web/test/integration/square_timecard_history_test.rb +++ b/web/test/integration/square_timecard_history_test.rb @@ -49,7 +49,7 @@ def source(id, team) assert_includes response.body, '8h' get employee_time_off_path, params: { month: '2026-10' } assert_response :success - assert_select '[role="cell"][aria-label="2026-10-05"]', text: /8h/ + assert_select '[role="listitem"][data-date="2026-10-05"]', text: /8h/ assert_no_difference ['SquareTimecard.count', 'SquareTimecardDay.count', 'People::TimesheetEntry.count'] do post people_square_timesheets_path assert_response :not_found diff --git a/web/test/integration/worker_locale_test.rb b/web/test/integration/worker_locale_test.rb new file mode 100644 index 000000000..38b9353fe --- /dev/null +++ b/web/test/integration/worker_locale_test.rb @@ -0,0 +1,43 @@ +# frozen_string_literal: true + +require 'test_helper' + +# A worker's language follows their staff record, never the request: Spanish staff pages render +# with lang="es" and Spanish dates; management pages and other people stay in English. +class WorkerLocaleTest < ActionDispatch::IntegrationTest + setup do + @tenant = tenants(:default_tenant) + Current.tenant = @tenant + @user = User.create!(tenant: @tenant, name: 'Lucía Ortiz', email: 'lucia@example.com', role: 'employee', password: 'password123') + @worker = People::Employee.create!(user: @user, first_name: 'Lucía', last_name: 'Ortiz', employment_type: 'part_time', locale: 'es') + end + + teardown { Current.reset } + + test 'the staff home renders in the worker language' do + sign_in @user + get employee_app_path + assert_response :success + assert_select 'html[lang=es]' + get employee_app_path, headers: { 'Accept-Language' => 'fr' } + assert_select 'html[lang=es]' # the request language never decides + end + + test 'a worker without a language and a manager stay in English' do + @worker.update!(locale: nil) + sign_in @user + get employee_app_path + assert_select 'html[lang=en]' + assert_equal :en, I18n.locale, 'the locale is restored after the request' + sign_in users(:regular_user) + get root_path + assert_select 'html[lang=en]' + end + + test 'an unknown language falls back to English' do + @worker.update!(locale: 'xx') + sign_in @user + get employee_app_path + assert_select 'html[lang=en]' + end +end diff --git a/web/test/lib/app_review_demo_task_test.rb b/web/test/lib/app_review_demo_task_test.rb index 17219e3c9..1d231f2a6 100644 --- a/web/test/lib/app_review_demo_task_test.rb +++ b/web/test/lib/app_review_demo_task_test.rb @@ -82,9 +82,32 @@ def in_demo(&) = Current.set(tenant: demo_tenant, &) end end + test 'the Time tab has a worker with a PIN, punches, shifts, time off, tips and a timesheet to review' do + output = run_task('REVIEW_PASSWORD' => PASSWORD, 'REVIEW_WORKER_PASSWORD' => "#{PASSWORD}-worker", 'REVIEW_DEMO_RESET' => nil) + assert_not_includes output, "#{PASSWORD}-worker" + worker_user = User.find_by!(email: 'sam.okafor@juniper-pine.example') + assert_equal 'employee', worker_user.role + assert worker_user.authenticate("#{PASSWORD}-worker") + in_demo do + worker = People::Employee.find_by!(user_id: worker_user.id) + assert worker.pin_set? + assert worker.verify_pin(AppReviewDemo::WORKER_PIN) + assert worker.current_pay_rate.hourly_rate_cents.positive? + assert_operator ClockShift.where(employee_id: worker.id).count, :>=, 8 + assert ClockShift.where(employee_id: worker.id).all? { |shift| shift.breaks.any? { |b| b.kind == 'meal' } } + assert People::ScheduledShift.published.where(employee_id: worker.id).exists? + assert People::ScheduledShift.open_shifts.exists?, 'an open shift to pick up' + assert_equal %w[approved requested].sort, People::LeaveRequest.where(employee_id: worker.id).pluck(:status).sort + assert TipAllocation.where(employee_id: worker.id, tip_method: 'pool').exists? + assert TipAllocation.where(employee_id: worker.id, tip_method: 'cash').exists? + assert_not TipAllocation.where(employee_id: People::Employee.where(user_id: User.where(role: 'admin').select(:id)).select(:id)).exists?, 'admins get no tip share' + assert People::Timesheet.where(employee_id: worker.id, status: 'submitted').exists? + end + end + test 'running again adds nothing and keeps the password it is given' do run_task('REVIEW_PASSWORD' => PASSWORD, 'REVIEW_DEMO_RESET' => nil) - counts = -> { in_demo { [User.where(tenant_id: demo_tenant.id).count, Location.count, ShopifyVariant.count, InventoryLevel.count, Core::Order.count, Core::OrderLine.count, InventoryCountItem.count, Projects::Task.count, Notification.count, TeamChat::Message.count, TeamChat::Room.count] } } + counts = -> { in_demo { [User.where(tenant_id: demo_tenant.id).count, Location.count, ShopifyVariant.count, InventoryLevel.count, Core::Order.count, Core::OrderLine.count, InventoryCountItem.count, Projects::Task.count, Notification.count, TeamChat::Message.count, TeamChat::Room.count, ClockShift.count, ClockBreak.count, People::ScheduledShift.count, People::LeaveRequest.count, TipAllocation.count, People::Timesheet.count] } } before = counts.call run_task('REVIEW_PASSWORD' => "#{PASSWORD}-new", 'REVIEW_DEMO_RESET' => nil) diff --git a/web/test/services/push_notifier_test.rb b/web/test/services/push_notifier_test.rb new file mode 100644 index 000000000..2a43ba586 --- /dev/null +++ b/web/test/services/push_notifier_test.rb @@ -0,0 +1,118 @@ +# frozen_string_literal: true + +require 'test_helper' + +# Push delivery to the iPhone app (APNs, stubbed at the apnotic connection) and the installed web +# app (Web Push, stubbed at the HTTP layer). Dead devices are disabled, never deleted. +class PushNotifierTest < ActiveSupport::TestCase + APNS_ENV = { 'APNS_KEY_ID' => 'ABC123DEFG', 'APNS_TEAM_ID' => 'TEAM123456', 'APNS_KEY_P8' => "-----BEGIN PRIVATE KEY-----\nMIGT\n-----END PRIVATE KEY-----", + 'APNS_TOPIC' => 'com.rupertpos.Rupert', 'APNS_ENVIRONMENT' => 'sandbox' }.freeze + VAPID_ENV = { 'VAPID_PUBLIC_KEY' => 'BDd3_hVL9fZi9Ybo2UUzA284WG5FZR30_95YeZJsiApwXKpNcF1rRPF3foIiBHXRdJI2Qhumhf6_LFTeZaNndIo', + 'VAPID_PRIVATE_KEY' => 'xx', 'VAPID_SUBJECT' => 'mailto:support@example.com' }.freeze + + FakeResponse = Struct.new(:status, :body) do + def ok? = status.to_s == '200' + end + + class FakeConnection + attr_reader :pushed + + def initialize(responses) + @responses = responses + @pushed = [] + end + + def push(notification) + @pushed << notification + @responses.shift + end + + def close; end + end + + setup do + @tenant = tenants(:default_tenant) + Current.tenant = @tenant + @user = users(:regular_user) + @notification = Notification.create!(user_id: @user.id, kind: 'schedule_posted', title: 'Your schedule is posted', body: '3 shifts', url: '/employee/schedule') + end + + teardown { Current.reset } + + test 'nothing is configured by default so the job is never enqueued' do + with_env(APNS_KEYS_BLANK) do + assert_not PushNotifier.configured? + assert_not PushDeliveryJob.enabled? + end + end + + test 'apns sends to every active iPhone and disables tokens the provider rejects for good' do + good = PushDevice.register!(user: @user, platform: 'ios', token: 'good-token') + dead = PushDevice.register!(user: @user, platform: 'ios', token: 'dead-token') + PushDevice.register!(user: @user, platform: 'ios', token: 'off-token').disable!('earlier') + connection = FakeConnection.new([FakeResponse.new('200', {}), FakeResponse.new('410', { 'reason' => 'Unregistered' })]) + with_env(APNS_ENV) do + assert PushNotifier.configured? + assert PushDeliveryJob.enabled? + Apnotic::Connection.expects(:development).returns(connection) + result = PushNotifier.deliver(@notification) + assert_equal 1, result.sent + assert_equal 1, result.disabled + assert_equal 0, result.failed + end + assert_equal 2, connection.pushed.size + push = connection.pushed.first + assert_equal 'com.rupertpos.Rupert', push.topic + assert_equal({ title: 'Your schedule is posted', body: '3 shifts' }, push.alert) + assert_equal '/employee/schedule', push.custom_payload[:url] + assert_equal 'schedule_posted', push.thread_id + assert_equal 1, push.badge, 'badge is the unread count' + assert_nil good.reload.disabled_at + assert_equal 'Unregistered', dead.reload.failure_reason + assert dead.disabled_at.present? + end + + test 'apns errors are counted as failures and never raise' do + PushDevice.register!(user: @user, platform: 'ios', token: 'any-token') + with_env(APNS_ENV) do + Apnotic::Connection.expects(:development).raises(SocketError.new('no route')) + result = PushNotifier.deliver(@notification) + assert_equal 1, result.failed + end + end + + test 'web push posts the payload to the subscription endpoint and drops gone subscriptions' do + alive = PushDevice.register!(user: @user, platform: 'web', token: 'https://push.example/alive', keys: { 'p256dh' => 'p', 'auth' => 'a' }) + gone = PushDevice.register!(user: @user, platform: 'web', token: 'https://push.example/gone', keys: { 'p256dh' => 'p', 'auth' => 'a' }) + with_env(VAPID_ENV) do + WebPush.expects(:payload_send).twice.with { |args| args[:endpoint] == alive.token || args[:endpoint] == gone.token } + .returns(nil).then.raises(WebPush::ExpiredSubscription.new(Struct.new(:code, :body).new('410', ''), 'push.example')) + result = PushNotifier.deliver(@notification) + assert_equal 1, result.sent + assert_equal 1, result.disabled + end + assert_nil alive.reload.disabled_at + assert_equal 'ExpiredSubscription', gone.reload.failure_reason + end + + test 'the delivery job runs inside the notification workspace' do + PushDevice.register!(user: @user, platform: 'ios', token: 'job-token') + with_env(APNS_ENV) do + Apnotic::Connection.expects(:development).returns(FakeConnection.new([FakeResponse.new('200', {})])) + Current.reset + PushDeliveryJob.perform_now(@notification.id) + end + end + + APNS_KEYS_BLANK = (PushNotifier::APNS_KEYS + PushNotifier::VAPID_KEYS).index_with { nil }.freeze + + private + + def with_env(values) + saved = values.keys.index_with { |key| ENV.fetch(key, nil) } + values.each { |key, value| value.nil? ? ENV.delete(key) : ENV[key] = value } + yield + ensure + saved.each { |key, value| value.nil? ? ENV.delete(key) : ENV[key] = value } + end +end