Stage

[evereq]

PR

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value?

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

---

---

Summary by cubic

Adds plugin tenant user access management (allow/deny/unassign, bulk actions, smarter UI) and adds JWT secret setup for the desktop local server. Also fixes desktop server startup, refreshes expired avatar URLs in timesheet stats, and defaults admin users to allow manual/modify/delete time.

• New Features

  • Manage plugin tenant users: allow, deny, unassign, bulk enable/disable; new counts and Smart Table UI with per-row actions.
  • Sync local plugin access with server; deactivate plugins when access is revoked; honor tenant-level tenantEnabled flag; new IPC plugins::update-tenant-enabled.
  • Desktop Setup: add JWT secret and refresh token fields; pass to local API via JWT_SECRET and JWT_REFRESH_TOKEN_SECRET; new env keys DESKTOP_JWT_SECRET, DESKTOP_JWT_REFRESH_TOKEN_SECRET.
  • Default admin permissions: admins get manual/modify/delete time enabled on creation and in seeds.
  • Angular init cleanup: replace APP_INITIALIZER with provideAppInitializer; provide plugin effects at module level; adjust overlay defaults to avoid top-layer popovers; add @ngneat/effects-ng.

• Migration

  • Desktop app: run the new offline DB migration for plugin user scope (added automatically via the desktop DB migrations).
  • Configure secrets: in Setup → Server API, set JWT Secret and JWT Refresh Token Secret (or provide via env DESKTOP_JWT_SECRET / DESKTOP_JWT_REFRESH_TOKEN_SECRET). Restart desktop/server to apply.

^{Written for commit 4392c16. Summary will update on new commits.}

[cursor]

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 7.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 007cdff2-96d3-4bb3-b08c-6ab0832b0929

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​fs-extra@​5.0.2
	bcryptjs@​3.0.3

View full report

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
4 out of 5 committers have signed the CLA.

✅ evereq
✅ rahul-rocket
✅ adkif
✅ syns2191
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.6% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4392c164b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid persisting user revocation as tenant-wide disable

In syncActivePlugins, a single failed access check deactivates the plugin locally and writes tenantEnabled = false via updateTenantEnabled. PluginManager.loadPlugins() uses that flag to skip activation entirely, so one user's revoked access can leave the plugin permanently disabled for later sessions/users on the same installation even when tenant-level access is still valid. This should remain a local user/session deactivation, not a tenant-wide persisted disable.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Restore shared loading signal for assign flow completion

This effect now toggles only operations.assigning, but PluginUserManagementComponent.onAssignUsers() waits on loadingAssignedUsers$ (backed by query.loading$) to detect completion before clearing submitting and reloading assignments. Since loading is no longer set for this path, the completion branch can trigger immediately, allowing repeat submissions and racey reloads before the API finishes. Keep loading in sync for this flow or update the component to await the new operation flags.

Useful? React with 👍 / 👎.

[cubic-dev-ai]

12 issues found across 103 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/desktop-lib/src/lib/plugin-system/events/plugin.event.ts">

<violation number="1" location="packages/desktop-lib/src/lib/plugin-system/events/plugin.event.ts:89">
P2: Destructuring the IPC payload in the function parameter can throw before `try/catch`, causing unhandled invocation failures for missing/malformed payloads.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/plugin-marketplace-item/tabs/user-management-tab/user-management-tab.component.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/plugin-marketplace-item/tabs/user-management-tab/user-management-tab.component.ts:31">
P2: Duplicate `PluginUserRow` interface — identical definition exists in `plugin-user-management.component.ts`. Extract it to a shared types file (e.g., alongside the table service or in a `models/` folder) and import from both components to avoid drift.</violation>
</file>

<file name=".scripts/electron-desktop-environment/concrete-environment-content/desktop-server-environment-content.ts">

<violation number="1" location=".scripts/electron-desktop-environment/concrete-environment-content/desktop-server-environment-content.ts:33">
P2: Serialize/escape JWT secret values before embedding them in the generated template; raw single-quoted interpolation can break generated config syntax for valid secret characters.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/secret/secret.component.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/secret/secret.component.ts:32">
P2: The IPC listener registered in ngOnInit is never removed. If this component is destroyed and recreated, listeners accumulate and can cause duplicate updates and memory leaks. Add teardown in ngOnDestroy (removeListener or use fromEvent with subscription cleanup).</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/secret/secret.component.html">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/secret/secret.component.html:6">
P2: JWT secret should use a masked password input and a matching `id` for the existing label `for` attribute.</violation>

<violation number="2" location="packages/desktop-ui-lib/src/lib/settings/secret/secret.component.html:13">
P2: Refresh token secret should use a masked password input and a matching `id` for the existing label `for` attribute.</violation>
</file>

<file name=".scripts/electron-desktop-environment/concrete-environment-content/desktop-environment-content.ts">

<violation number="1" location=".scripts/electron-desktop-environment/concrete-environment-content/desktop-environment-content.ts:33">
P0: Do not embed JWT signing secrets in desktop environment content; this exposes credentials in client-distributed configuration.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/secret/secret.module.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/secret/secret.module.ts:22">
P1: Use `NbMenuModule` (without `forRoot`) in this feature module to avoid re-initializing menu root providers.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/setup/setup.component.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/setup/setup.component.ts:621">
P2: Update `secretConfig` in `onChangeSecretConfig`; otherwise `saveAndRun()` may send stale/default secrets instead of the latest user-edited values.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/plugin-user-management/render/user-cell/user-cell.component.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/plugin-user-management/render/user-cell/user-cell.component.ts:19">
P2: `imports` is only valid on standalone components. Add `standalone: true` to this component metadata to avoid an Angular compilation error.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/plugins/services/plugin-access-sync.service.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/plugins/services/plugin-access-sync.service.ts:72">
P1: Do not persist `tenantEnabled = false` when a single user's access check fails. This is a tenant-wide activation flag used during plugin loading, so writing it here can keep the plugin disabled for subsequent sessions/users on the installation.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/+state/effects/plugin-user-assignment.effects.ts">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/+state/effects/plugin-user-assignment.effects.ts:168">
P2: Keep the shared `loading` signal consistent for the assign-user flow, or migrate callers to wait on `operations.assigning`. With only operation flags toggled here, consumers that await `query.loading$` can treat the request as complete before the assignment API call finishes.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P0: Do not embed JWT signing secrets in desktop environment content; this exposes credentials in client-distributed configuration.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .scripts/electron-desktop-environment/concrete-environment-content/desktop-environment-content.ts, line 33:

<comment>Do not embed JWT signing secrets in desktop environment content; this exposes credentials in client-distributed configuration.</comment>

<file context>
@@ -29,7 +29,9 @@ export class DesktopEnvironmentContent implements IContentGenerator {
 			IS_SERVER: ${false},
-			IS_SERVER_API: ${false}
+			IS_SERVER_API: ${false},
+			JWT_SECRET: '${variable.DESKTOP_JWT_SECRET || ''}',
+			JWT_REFRESH_TOKEN_SECRET: '${variable.DESKTOP_JWT_REFRESH_TOKEN_SECRET || ''}'
 		`;
</file context>

[cubic-dev-ai]

P1: Use NbMenuModule (without forRoot) in this feature module to avoid re-initializing menu root providers.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/secret/secret.module.ts, line 22:

<comment>Use `NbMenuModule` (without `forRoot`) in this feature module to avoid re-initializing menu root providers.</comment>

<file context>
@@ -0,0 +1,39 @@
+@NgModule({
+	imports: [
+		CommonModule,
+		NbMenuModule.forRoot(),
+		NbCardModule,
+		NbIconModule,
</file context>

[cubic-dev-ai]

P1: Do not persist tenantEnabled = false when a single user's access check fails. This is a tenant-wide activation flag used during plugin loading, so writing it here can keep the plugin disabled for subsequent sessions/users on the installation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/plugins/services/plugin-access-sync.service.ts, line 72:

<comment>Do not persist `tenantEnabled = false` when a single user's access check fails. This is a tenant-wide activation flag used during plugin loading, so writing it here can keep the plugin disabled for subsequent sessions/users on the installation.</comment>

<file context>
@@ -0,0 +1,83 @@
+						const deactivations$ = revoked.map(({ plugin }) => {
+							console.info(`Access revoked for plugin "${plugin.name}" — deactivating locally`);
+							this.pluginElectronService.deactivate(plugin);
+							return from(this.pluginElectronService.updateTenantEnabled(plugin.marketplaceId, false)).pipe(
+								catchError(() => of(void 0))
+							);
</file context>

[cubic-dev-ai]

P2: Destructuring the IPC payload in the function parameter can throw before try/catch, causing unhandled invocation failures for missing/malformed payloads.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-lib/src/lib/plugin-system/events/plugin.event.ts, line 89:

<comment>Destructuring the IPC payload in the function parameter can throw before `try/catch`, causing unhandled invocation failures for missing/malformed payloads.</comment>

<file context>
@@ -84,6 +84,19 @@ class ElectronPluginListener {
 
+		ipcMain.handle(
+			PluginHandlerChannel.UPDATE_TENANT_ENABLED,
+			async (_, { marketplaceId, tenantEnabled }: { marketplaceId: ID; tenantEnabled: boolean }) => {
+				try {
+					await this.pluginManager.updateTenantEnabled(marketplaceId, tenantEnabled);
</file context>

Suggested change

	async (_, { marketplaceId, tenantEnabled }: { marketplaceId: ID; tenantEnabled: boolean }) => {
	try {
	await this.pluginManager.updateTenantEnabled(marketplaceId, tenantEnabled);
	async (_, payload: { marketplaceId: ID; tenantEnabled: boolean } | undefined) => {
	try {
	const { marketplaceId, tenantEnabled } = payload ?? ({} as { marketplaceId?: ID; tenantEnabled?: boolean });
	if (!marketplaceId || typeof tenantEnabled !== 'boolean') {
	return { success: false, error: 'Invalid payload' };
	}
	await this.pluginManager.updateTenantEnabled(marketplaceId, tenantEnabled);

[cubic-dev-ai]

P2: Duplicate PluginUserRow interface — identical definition exists in plugin-user-management.component.ts. Extract it to a shared types file (e.g., alongside the table service or in a models/ folder) and import from both components to avoid drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/plugin-marketplace-item/tabs/user-management-tab/user-management-tab.component.ts, line 31:

<comment>Duplicate `PluginUserRow` interface — identical definition exists in `plugin-user-management.component.ts`. Extract it to a shared types file (e.g., alongside the table service or in a `models/` folder) and import from both components to avoid drift.</comment>

<file context>
@@ -1,18 +1,38 @@
+import { PluginAssignedUsersTableService } from '../../../plugin-user-management/services/plugin-assigned-users-table.service';
+
+/** Row data representing a user toggle action */
+export interface PluginUserRow {
+	userId?: string;
+	newState: boolean;
</file context>

[cubic-dev-ai]

P2: Refresh token secret should use a masked password input and a matching id for the existing label for attribute.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/secret/secret.component.html, line 13:

<comment>Refresh token secret should use a masked password input and a matching `id` for the existing label `for` attribute.</comment>

<file context>
@@ -0,0 +1,16 @@
+		<label class="secret-label" for="refresh_secret">{{
+			'TIMER_TRACKER.SETUP.JWT_REFRESH_TOKEN_SECRET' | translate
+			}}</label>
+		<input [(ngModel)]="config.secret.refresh_token" (ngModelChange)="onUpdate()" type="text" nbInput fullWidth
+			status="basic" [placeholder]="'TIMER_TRACKER.SETUP.JWT_REFRESH_TOKEN_SECRET_PLACEHOLDER' | translate" />
+	</div>
</file context>

[cubic-dev-ai]

P2: JWT secret should use a masked password input and a matching id for the existing label for attribute.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/secret/secret.component.html, line 6:

<comment>JWT secret should use a masked password input and a matching `id` for the existing label `for` attribute.</comment>

<file context>
@@ -0,0 +1,16 @@
+		<label class="secret-label" for="jwt-secret">{{
+			'TIMER_TRACKER.SETUP.JWT_SECRET' | translate
+			}}</label>
+		<input [(ngModel)]="config.secret.jwt" (ngModelChange)="onUpdate()" type="text" nbInput fullWidth status="basic"
+			[placeholder]="'TIMER_TRACKER.SETUP.JWT_SECRET_PLACEHOLDER' | translate" />
+	</div>
</file context>

[cubic-dev-ai]

P2: Update secretConfig in onChangeSecretConfig; otherwise saveAndRun() may send stale/default secrets instead of the latest user-edited values.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/setup/setup.component.ts, line 621:

<comment>Update `secretConfig` in `onChangeSecretConfig`; otherwise `saveAndRun()` may send stale/default secrets instead of the latest user-edited values.</comment>

<file context>
@@ -597,4 +617,10 @@ export class SetupComponent implements OnInit, OnDestroy {
 		});
 	}
+
+	public onChangeSecretConfig(config: IDesktopSecret) {
+		this.electronService.ipcRenderer.send('update_server_config', {
+			secret: config.secret
</file context>

Suggested change

	public onChangeSecretConfig(config: IDesktopSecret) {
	this.electronService.ipcRenderer.send('update_server_config', {
	secret: config.secret
	});
	}
	public onChangeSecretConfig(config: IDesktopSecret) {
	this.secretConfig = config;
	this.electronService.ipcRenderer.send('update_server_config', {
	secret: config.secret
	});
	}

[cubic-dev-ai]

P2: imports is only valid on standalone components. Add standalone: true to this component metadata to avoid an Angular compilation error.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/plugin-user-management/render/user-cell/user-cell.component.ts, line 19:

<comment>`imports` is only valid on standalone components. Add `standalone: true` to this component metadata to avoid an Angular compilation error.</comment>

<file context>
@@ -0,0 +1,38 @@
+		<nb-user [picture]="picture()" [name]="name()" [title]="email()" size="small"></nb-user>
+	`,
+	changeDetection: ChangeDetectionStrategy.OnPush,
+	imports: [NbUserModule]
+})
+export class UserCellComponent {
</file context>

[cubic-dev-ai]

P2: Keep the shared loading signal consistent for the assign-user flow, or migrate callers to wait on operations.assigning. With only operation flags toggled here, consumers that await query.loading$ can treat the request as complete before the assignment API call finishes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-marketplace/+state/effects/plugin-user-assignment.effects.ts, line 168:

<comment>Keep the shared `loading` signal consistent for the assign-user flow, or migrate callers to wait on `operations.assigning`. With only operation flags toggled here, consumers that await `query.loading$` can treat the request as complete before the assignment API call finishes.</comment>

<file context>
@@ -165,7 +165,7 @@ export class PluginUserAssignmentEffects {
 			return this.actions$.pipe(
 				ofType(PluginUserAssignmentActions.assignUsers),
-				tap(() => this.store.setLoading(true)),
+				tap(() => this.store.setOperation({ assigning: true })),
 				switchMap(({ pluginId, userIds, reason }) =>
 					// First, get or create the plugin tenant
</file context>

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 4392c16

Command	Status	Duration	Result
nx build desktop --configuration=production --b...	✅ Succeeded	1m 33s	View ↗
nx build desktop-api --configuration=production...	✅ Succeeded	25s	View ↗
nx run api:desktop-api	✅ Succeeded	49s	View ↗
nx build gauzy -c=production --prod --verbose	✅ Succeeded	4m 17s	View ↗
nx run gauzy:desktop-ui --base-href ./	✅ Succeeded	3m 52s	View ↗
nx run-many -t build -c development -p constant...	✅ Succeeded	3m 15s	View ↗
nx run-many -t build -c production -p constants...	✅ Succeeded	3m 17s	View ↗
nx build api -c=production --prod	✅ Succeeded	2m 8s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-03-12 11:21:40 UTC