[techmore]

What this is

An end-to-end audit of the time-keeping system for more than one workspace, the fixes it led to, and per-workspace switches for each part of the time system. Full write-up: docs/audits/2026-11-10-time-multi-tenant-audit.md.

No cross-workspace read was found: every time & pay model is TenantScoped, and ids from another workspace 404 on the web, the staff API, exports and the PIN clock (now proven by tests). The findings are at the edges.

Findings and fixes

Sev	Area	What was wrong	Fix
High	Payroll	Timesheets imported gross punch hours; the Pay page, overtime checks and accrual use paid hours. The payroll export paid unpaid meal breaks.	ClockShift#paid_hours_between; TimesheetWorkflow import and staleness checks use it.
High	Time zones	Day/week/pay-period boundaries, the midnight split on import and displayed times all used the instance zone (Eastern).	tenants.time_zone (blank = unchanged). Web, staff API, kiosk and jobs run on the workspace's clock (Current.with_tenant, use_business_zone).
High	Push	A phone's token was unique per workspace and could not be forgotten after sign-out, so the previous person's notifications kept arriving.	PushDevice.register! moves the token across workspaces; forget_token! needs no session; iPhone sign-out, offboarding and deactivated accounts stop delivery.
Med	PIN clock	An anonymous browser could tell a real PIN from a wrong one; lockout keyed on the session cookie.	Refused before the digits are read; a signed-in phone is compared with its own PIN only; lockout per device or network address.
Med	Privacy	Team schedule showed everyone's hours to any linked account; the punch report showed pay rates to reviewers without payroll access.	Reviewer/own-row scoping; rates need payroll.read.
Med	Store scope	Store-limited managers could decide punch fixes, timesheets and time off for other stores by id.	People::StoreScope.covers? in the service and policies.
Med	iPhone app	Handoff trusted any control origin; a notification could name another workspace; no way to leave a workspace.	Control-plane check, path-only notification links, Switch workspace, explicit session cookie on push registration.
Med	Jobs	Sync schedulers stopped at the first failing workspace; leave accrual used one "today" for all; caches carried between workspaces.	Per-workspace rescue, per-workspace date, Current.with_tenant.
Low	Misc	/clock/workers 500 when anonymous; client-chosen punch source; Expo builds prefilled one workspace; unclear refusal for an email used in another workspace; settings audit lacked values.	Fixed.

Known limits left for later are listed in the audit document (one zone per workspace, Eastern cron times, the .ics feed, cross-store trades as a warning).

What administrators can now turn on and off

Settings → Time rules (/settings/time_rules, needs settings.write), for the whole workspace:

• Workspace time zone
• What is turned on: clock from the web, clock from the phone apps, register PIN, clock kiosk, breaks and meals, scheduling, shift trades, time-off requests, tips for staff, pay estimates for staff, punch fixes by staff, self-submitted timesheets, missed clock-out reminders (break reminders already existed per store)
• Punch logging: device and register name, a detailed punch audit trail (time_clock.* activity lines), the network address, and how long the trail is kept (3, 4 or 7 years)

Every switch defaults to what Rupert did before, so the live workspace is unchanged until someone opens the page. Off is refused server-side (pages redirect with a message, the staff API answers 403 feature_disabled, the PIN clock refuses) and hidden from menus. Every change is an activity-log line with who, when and old → new.

Migration

One additive migration: tenants.time_zone (nullable) and a short-named index on push_devices.token_digest.

Tests

• time_multi_tenant_isolation_test.rb: two workspaces with the same staff name, employee number and PIN (pages, staff API, PIN clock, exports, jobs, clock zone, settings, push, setup links).
• time_features_settings_test.rb: defaults, permission, audit, every switch on web + API + PIN clock, logging, retention, and a brand-new worker in a brand-new workspace from setup link to payroll export.
• iOS package tests (notification links, cookie scoping, leaving a workspace): 19 pass on the Simulator.
• Local: full Rails suite 4043 runs, 0 failures; RuboCop clean; fresh-database migration check passes.

Behaviour changes to know about

• A timesheet imported before this change that includes an unpaid meal will ask for a re-import at submit (its hours were gross). Approved sheets are not rewritten.
• A signed-in phone typing a colleague's PIN is told "That isn't your PIN. On this device only your own PIN works" for any digits that are not its own (it used to confirm the PIN belonged to someone else).
• Shift leads no longer see pay rates in the punch report; non-reviewers see only their own row in Team schedule.

🤖 Generated with Claude Code