2.2.0 Migrations

.env.example

@@ -1,3 +1,4 @@
-HOST=0.0.0.0
+DATA_DIR=./data
-PORT=4321
+ROOT_DIR=./data
-DATABASE_URL=chronus.db
+APP_PORT=4321
+IMAGE=git.atri.dad/atash/chronus:latest

.gitignore

@@ -1,5 +1,6 @@
 # build output
 dist/
+data/
 # generated types
 .astro/
 

Dockerfile

@@ -1,33 +1,35 @@
-FROM node:lts-alpine AS builder
+FROM node:lts-alpine AS base
 WORKDIR /app
-
 RUN npm i -g pnpm
+
+FROM base AS prod-deps
+WORKDIR /app
 RUN apk add --no-cache python3 make g++
-
 COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --prod --frozen-lockfile
 
-RUN pnpm install
+FROM base AS build-deps
+WORKDIR /app
+RUN apk add --no-cache python3 make g++
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
 
+FROM build-deps AS builder
+WORKDIR /app
 COPY . .
 RUN pnpm run build
 
-FROM node:lts-alpine AS runtime
+FROM base AS runtime
 WORKDIR /app
 
-RUN npm i -g pnpm
+COPY --from=prod-deps /app/node_modules ./node_modules
-
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/drizzle ./drizzle
 COPY --from=builder /app/scripts ./scripts
-COPY package.json pnpm-lock.yaml ./
+COPY package.json ./
-
-RUN pnpm install --prod
-
-RUN mkdir -p /app/data
 
 ENV HOST=0.0.0.0
 ENV PORT=4321
-ENV DATABASE_URL=/app/data/chronus.db
 EXPOSE 4321
 
-CMD ["sh", "-c", "pnpm run migrate && node ./dist/server/entry.mjs"]
+CMD ["sh", "-c", "npm run migrate && node ./dist/server/entry.mjs"]

README.md

@@ -1,2 +1,10 @@
 # Chronus
-A modern time tracking application built with Astro, Vue, and DaisyUI.
+A modern time tracking application built with Astro, Vue, and DaisyUI.
+
+## Stack
+- Framework: Astro
+- Runtime: Node
+- UI Library: Vue 3
+- CSS and Styles: DaisyUI + Tailwind CSS
+- Database: libSQL
+- ORM: Drizzle ORM

astro.config.mjs

@@ -1,24 +1,21 @@
 // @ts-check
-import { defineConfig } from 'astro/config';
+import { defineConfig } from "astro/config";
-import vue from '@astrojs/vue';
+import vue from "@astrojs/vue";
-import tailwindcss from '@tailwindcss/vite';
+import tailwindcss from "@tailwindcss/vite";
-import icon from 'astro-icon';
+import icon from "astro-icon";
 
-import node from '@astrojs/node';
+import node from "@astrojs/node";
 
 // https://astro.build/config
 export default defineConfig({
-  output: 'server',
+  output: "server",
   integrations: [vue(), icon()],
 
   vite: {
     plugins: [tailwindcss()],
-    ssr: {
-      external: ['better-sqlite3'],
-    },
   },
 
   adapter: node({
-    mode: 'standalone',
+    mode: "standalone",
   }),
-});
+});

docker-compose.yml

@@ -7,7 +7,7 @@ services:
       - NODE_ENV=production
       - HOST=0.0.0.0
       - PORT=4321
-      - DATABASE_URL=/app/data/chronus.db
+      - DATA_DIR=/app/data
     volumes:
       - ${ROOT_DIR}:/app/data
     restart: unless-stopped

drizzle.config.ts

@@ -1,10 +1,27 @@
-import { defineConfig } from 'drizzle-kit';
+import { defineConfig } from "drizzle-kit";
+import fs from "fs";
+import path from "path";
+import * as dotenv from "dotenv";
+
+dotenv.config();
+
+const dataDir = process.env.DATA_DIR;
+
+if (!dataDir) {
+  throw new Error("DATA_DIR environment variable is not set");
+}
+
+if (!fs.existsSync(dataDir)) {
+  fs.mkdirSync(dataDir, { recursive: true });
+}
+
+const dbUrl = `file:${path.join(dataDir, "chronus.db")}`;
 
 export default defineConfig({
-  schema: './src/db/schema.ts',
+  schema: "./src/db/schema.ts",
-  out: './drizzle',
+  out: "./drizzle",
-  dialect: 'sqlite',
+  dialect: "turso",
   dbCredentials: {
-    url: process.env.DATABASE_URL || 'chronus.db',
+    url: dbUrl,
   },
 });

drizzle/0000_motionless_king_cobra.sql

@@ -71,6 +71,7 @@ CREATE TABLE `members` (
 CREATE TABLE `organizations` (
 	`id` text PRIMARY KEY NOT NULL,
 	`name` text NOT NULL,
+	`logo_url` text,
 	`street` text,
 	`city` text,
 	`state` text,

drizzle/0001_lazy_roughhouse.sql

@@ -0,0 +1,6 @@
+ALTER TABLE `clients` ADD `phone` text;--> statement-breakpoint
+ALTER TABLE `clients` ADD `street` text;--> statement-breakpoint
+ALTER TABLE `clients` ADD `city` text;--> statement-breakpoint
+ALTER TABLE `clients` ADD `state` text;--> statement-breakpoint
+ALTER TABLE `clients` ADD `zip` text;--> statement-breakpoint
+ALTER TABLE `clients` ADD `country` text;

drizzle/0002_chilly_cyclops.sql

@@ -0,0 +1,16 @@
+CREATE INDEX `api_tokens_user_id_idx` ON `api_tokens` (`user_id`);--> statement-breakpoint
+CREATE INDEX `categories_organization_id_idx` ON `categories` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `clients_organization_id_idx` ON `clients` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `invoice_items_invoice_id_idx` ON `invoice_items` (`invoice_id`);--> statement-breakpoint
+CREATE INDEX `invoices_organization_id_idx` ON `invoices` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `invoices_client_id_idx` ON `invoices` (`client_id`);--> statement-breakpoint
+CREATE INDEX `members_user_id_idx` ON `members` (`user_id`);--> statement-breakpoint
+CREATE INDEX `members_organization_id_idx` ON `members` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `sessions_user_id_idx` ON `sessions` (`user_id`);--> statement-breakpoint
+CREATE INDEX `tags_organization_id_idx` ON `tags` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `time_entries_user_id_idx` ON `time_entries` (`user_id`);--> statement-breakpoint
+CREATE INDEX `time_entries_organization_id_idx` ON `time_entries` (`organization_id`);--> statement-breakpoint
+CREATE INDEX `time_entries_client_id_idx` ON `time_entries` (`client_id`);--> statement-breakpoint
+CREATE INDEX `time_entries_start_time_idx` ON `time_entries` (`start_time`);--> statement-breakpoint
+CREATE INDEX `time_entry_tags_time_entry_id_idx` ON `time_entry_tags` (`time_entry_id`);--> statement-breakpoint
+CREATE INDEX `time_entry_tags_tag_id_idx` ON `time_entry_tags` (`tag_id`);

drizzle/0003_amusing_wendigo.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `invoices` ADD `discount_value` real DEFAULT 0;--> statement-breakpoint
+ALTER TABLE `invoices` ADD `discount_type` text DEFAULT 'percentage';--> statement-breakpoint
+ALTER TABLE `invoices` ADD `discount_amount` integer DEFAULT 0;

drizzle/0004_happy_namorita.sql

@@ -0,0 +1,22 @@
+CREATE TABLE `passkey_challenges` (
+	`id` text PRIMARY KEY NOT NULL,
+	`challenge` text NOT NULL,
+	`user_id` text,
+	`expires_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `passkey_challenges_challenge_unique` ON `passkey_challenges` (`challenge`);--> statement-breakpoint
+CREATE TABLE `passkeys` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`public_key` text NOT NULL,
+	`counter` integer NOT NULL,
+	`device_type` text NOT NULL,
+	`backed_up` integer NOT NULL,
+	`transports` text,
+	`last_used_at` integer,
+	`created_at` integer,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE INDEX `passkeys_user_id_idx` ON `passkeys` (`user_id`);

drizzle/meta/0000_snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": "6",
   "dialect": "sqlite",
-  "id": "cfa98c92-215e-4dbc-b8d4-23a655684d1b",
+  "id": "e1e0fee4-786a-4f9f-9ebe-659aae0a55be",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "tables": {
     "api_tokens": {
@@ -513,6 +513,13 @@
           "notNull": true,
           "autoincrement": false
         },
+        "logo_url": {
+          "name": "logo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
         "street": {
           "name": "street",
           "type": "text",

drizzle/meta/_journal.json

@@ -5,8 +5,36 @@
     {
       "idx": 0,
       "version": "6",
-      "when": 1768609277648,
+      "when": 1768688193284,
-      "tag": "0000_mixed_morlocks",
+      "tag": "0000_motionless_king_cobra",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1768690333269,
+      "tag": "0001_lazy_roughhouse",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1768773436601,
+      "tag": "0002_chilly_cyclops",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1768842088321,
+      "tag": "0003_amusing_wendigo",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1768876902359,
+      "tag": "0004_happy_namorita",
       "breakpoints": true
     }
   ]

package.json

@@ -1,7 +1,7 @@
 {
   "name": "chronus",
   "type": "module",
-  "version": "1.2.0",
+  "version": "2.2.0",
   "scripts": {
     "dev": "astro dev",
     "build": "astro build",
@@ -16,25 +16,28 @@
     "@astrojs/node": "^9.5.2",
     "@astrojs/vue": "^5.1.4",
     "@ceereals/vue-pdf": "^0.2.1",
+    "@iconify/vue": "^5.0.0",
+    "@libsql/client": "^0.17.0",
+    "@simplewebauthn/browser": "^13.2.2",
+    "@simplewebauthn/server": "^13.2.2",
     "@tailwindcss/vite": "^4.1.18",
     "astro": "^5.16.11",
     "astro-icon": "^1.1.5",
     "bcryptjs": "^3.0.3",
-    "better-sqlite3": "^12.6.0",
     "chart.js": "^4.5.1",
     "daisyui": "^5.5.14",
+    "dotenv": "^17.2.3",
     "drizzle-orm": "0.45.1",
     "nanoid": "^5.1.6",
     "tailwindcss": "^4.1.18",
     "typescript": "^5.9.3",
-    "vue": "^3.5.26",
+    "vue": "^3.5.27",
     "vue-chartjs": "^5.3.3"
   },
   "devDependencies": {
     "@catppuccin/daisyui": "^2.1.1",
     "@iconify-json/heroicons": "^1.2.3",
     "@react-pdf/types": "^2.9.2",
-    "@types/better-sqlite3": "^7.6.13",
     "drizzle-kit": "0.31.8"
   }
 }

scripts/migrate.js

@@ -1,45 +1,40 @@
-import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/libsql";
-import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/libsql/migrator";
-import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import { createClient } from "@libsql/client";
 import path from "path";
 import fs from "fs";
 
-const runMigrations = () => {
+async function runMigrate() {
-  console.log("Starting database migrations...");
+  console.log("Running migrations...");
 
-  const dbUrl =
+  const dataDir = process.env.DATA_DIR;
-    process.env.DATABASE_URL || path.resolve(process.cwd(), "chronus.db");
-  const dbDir = path.dirname(dbUrl);
 
-  if (!fs.existsSync(dbDir)) {
+  if (!dataDir) {
-    console.log(`Creating directory for database: ${dbDir}`);
+    throw new Error("DATA_DIR environment variable is not set");
-    fs.mkdirSync(dbDir, { recursive: true });
   }
 
-  console.log(`Using database at: ${dbUrl}`);
+  if (!fs.existsSync(dataDir)) {
-
+    fs.mkdirSync(dataDir, { recursive: true });
-  const sqlite = new Database(dbUrl);
-  const db = drizzle(sqlite);
-
-  const migrationsFolder = path.resolve(process.cwd(), "drizzle");
-
-  if (!fs.existsSync(migrationsFolder)) {
-    console.error(`Migrations folder not found at: ${migrationsFolder}`);
-    console.error(
-      "Did you run `drizzle-kit generate` and copy the folder to the container?",
-    );
-    process.exit(1);
   }
 
+  const url = `file:${path.join(dataDir, "chronus.db")}`;
+  console.log(`Using database: ${url}`);
+
+  const client = createClient({
+    url,
+  });
+
+  const db = drizzle(client);
+
   try {
-    migrate(db, { migrationsFolder });
+    await migrate(db, { migrationsFolder: "./drizzle" });
     console.log("Migrations completed successfully");
   } catch (error) {
     console.error("Migration failed:", error);
     process.exit(1);
+  } finally {
+    client.close();
   }
+}
 
-  sqlite.close();
+runMigrate();
-};
-
-runMigrations();

src/components/Footer.astro

@@ -1,7 +0,0 @@
-<footer class="footer footer-center p-4 bg-base-200 text-base-content border-t border-base-300">
-  <aside>
-    <p class="text-sm">
-      Made with <span class="text-red-500">❤️</span> by <a href="https://github.com/atridad" target="_blank" rel="noopener noreferrer" class="link link-hover font-semibold">Atridad Lahiji</a>
-    </p>
-  </aside>
-</footer>

src/components/MemberChart.vue

@@ -1,12 +1,12 @@
 <template>
-  <div style="position: relative; height: 100%; width: 100%;">
+  <div style="position: relative; height: 100%; width: 100%">
     <Bar :data="chartData" :options="chartOptions" />
   </div>
 </template>
 
 <script setup lang="ts">
-import { computed } from 'vue';
+import { computed } from "vue";
-import { Bar } from 'vue-chartjs';
+import { Bar } from "vue-chartjs";
 import {
   Chart as ChartJS,
   BarElement,
@@ -14,10 +14,18 @@ import {
   LinearScale,
   Tooltip,
   Legend,
-  BarController
+  BarController,
-} from 'chart.js';
+  type ChartOptions,
+} from "chart.js";
 
-ChartJS.register(BarElement, CategoryScale, LinearScale, Tooltip, Legend, BarController);
+ChartJS.register(
+  BarElement,
+  CategoryScale,
+  LinearScale,
+  Tooltip,
+  Legend,
+  BarController,
+);
 
 interface MemberData {
   name: string;
@@ -29,58 +37,60 @@ const props = defineProps<{
 }>();
 
 const chartData = computed(() => ({
-  labels: props.members.map(m => m.name),
+  labels: props.members.map((m) => m.name),
-  datasets: [{
+  datasets: [
-    label: 'Time Tracked',
+    {
-    data: props.members.map(m => m.totalTime / (1000 * 60)), // Convert to minutes
+      label: "Time Tracked",
-    backgroundColor: '#10b981',
+      data: props.members.map((m) => m.totalTime / (1000 * 60)), // Convert to minutes
-    borderColor: '#059669',
+      backgroundColor: "#10b981",
-    borderWidth: 1,
+      borderColor: "#059669",
-  }]
+      borderWidth: 1,
+    },
+  ],
 }));
 
-const chartOptions = {
+const chartOptions: ChartOptions<"bar"> = {
-  indexAxis: 'y' as const,
+  indexAxis: "y" as const,
   responsive: true,
   maintainAspectRatio: false,
   scales: {
     x: {
       beginAtZero: true,
       ticks: {
-        color: '#e2e8f0',
+        color: "#e2e8f0",
-        callback: function(value: number) {
+        callback: function (value: any) {
           const hours = Math.floor(value / 60);
           const mins = value % 60;
           return hours > 0 ? `${hours}h ${mins}m` : `${mins}m`;
-        }
+        },
       },
       grid: {
-        color: '#334155'
+        color: "#334155",
-      }
+      },
     },
     y: {
       ticks: {
-        color: '#e2e8f0'
+        color: "#e2e8f0",
       },
       grid: {
-        display: false
+        display: false,
-      }
+      },
-    }
+    },
   },
   plugins: {
     legend: {
-      display: false
+      display: false,
     },
     tooltip: {
       callbacks: {
-        label: function(context: any) {
+        label: function (context: any) {
           const minutes = Math.round(context.raw);
           const hours = Math.floor(minutes / 60);
           const mins = minutes % 60;
           return ` ${hours}h ${mins}m`;
-        }
+        },
-      }
+      },
-    }
+    },
-  }
+  },
 };
 </script>

src/components/Timer.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { ref, onMounted, onUnmounted } from "vue";
+import { Icon } from "@iconify/vue";
 
 const props = defineProps<{
   initialRunningEntry: {
@@ -224,14 +225,16 @@ async function stopTimer() {
           @click="startTimer"
           class="btn btn-primary btn-lg min-w-40 shadow-lg shadow-primary/20 hover:shadow-xl hover:shadow-primary/30 transition-all"
         >
-          ▶️ Start Timer
+          <Icon icon="heroicons:play" class="w-5 h-5" />
+          Start Timer
         </button>
         <button
           v-else
           @click="stopTimer"
           class="btn btn-error btn-lg min-w-40 shadow-lg shadow-error/20 hover:shadow-xl hover:shadow-error/30 transition-all"
         >
-          ⏹️ Stop Timer
+          <Icon icon="heroicons:stop" class="w-5 h-5" />
+          Stop Timer
         </button>
       </div>
     </div>

src/components/settings/ApiTokenManager.vue

@@ -0,0 +1,222 @@
+<script setup lang="ts">
+import { ref } from 'vue';
+import { Icon } from '@iconify/vue';
+
+interface ApiToken {
+  id: string;
+  name: string;
+  lastUsedAt: string | null;
+  createdAt: string;
+}
+
+const props = defineProps<{
+  initialTokens: ApiToken[];
+}>();
+
+const tokens = ref<ApiToken[]>(props.initialTokens);
+const createModalOpen = ref(false);
+const showTokenModalOpen = ref(false);
+const newTokenName = ref('');
+const newTokenValue = ref('');
+const loading = ref(false);
+
+function formatDate(dateString: string | null) {
+  if (!dateString) return 'Never';
+  return new Date(dateString).toLocaleDateString();
+}
+
+async function createToken() {
+  if (!newTokenName.value) return;
+
+  loading.value = true;
+  try {
+    const response = await fetch('/api/user/tokens', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ name: newTokenName.value }),
+    });
+
+    if (response.ok) {
+      const data = await response.json();
+
+      const { token, ...tokenMeta } = data;
+
+      // Add to beginning of list
+      tokens.value.unshift({
+        id: tokenMeta.id,
+        name: tokenMeta.name,
+        lastUsedAt: tokenMeta.lastUsedAt,
+        createdAt: tokenMeta.createdAt
+      });
+
+      newTokenValue.value = token;
+      createModalOpen.value = false;
+      showTokenModalOpen.value = true;
+      newTokenName.value = '';
+    } else {
+        alert('Failed to create token');
+    }
+  } catch (error) {
+    console.error('Error creating token:', error);
+    alert('An error occurred');
+  } finally {
+    loading.value = false;
+  }
+}
+
+async function deleteToken(id: string) {
+  if (!confirm('Are you sure you want to revoke this token? Any applications using it will stop working.')) {
+    return;
+  }
+
+  try {
+    const response = await fetch(`/api/user/tokens/${id}`, {
+      method: 'DELETE'
+    });
+
+    if (response.ok) {
+      tokens.value = tokens.value.filter(t => t.id !== id);
+    } else {
+      alert('Failed to delete token');
+    }
+  } catch (error) {
+    console.error('Error deleting token:', error);
+    alert('An error occurred');
+  }
+}
+
+function copyToken() {
+  navigator.clipboard.writeText(newTokenValue.value);
+}
+
+function closeShowTokenModal() {
+  showTokenModalOpen.value = false;
+  newTokenValue.value = '';
+}
+</script>
+
+<template>
+  <div>
+    <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+      <div class="card-body p-4 sm:p-6">
+        <div class="flex justify-between items-center mb-6">
+          <h2 class="card-title text-lg sm:text-xl">
+            <Icon icon="heroicons:code-bracket-square" class="w-5 h-5 sm:w-6 sm:h-6" />
+            API Tokens
+          </h2>
+          <button class="btn btn-primary btn-sm" @click="createModalOpen = true">
+            <Icon icon="heroicons:plus" class="w-4 h-4" />
+            Create Token
+          </button>
+        </div>
+
+        <div class="overflow-x-auto">
+          <table class="table">
+            <thead>
+              <tr>
+                <th>Name</th>
+                <th>Last Used</th>
+                <th>Created</th>
+                <th>Actions</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr v-if="tokens.length === 0">
+                <td colspan="4" class="text-center text-base-content/60 py-4">
+                  No API tokens found. Create one to access the API.
+                </td>
+              </tr>
+              <tr v-else v-for="token in tokens" :key="token.id">
+                <td class="font-medium">{{ token.name }}</td>
+                <td class="text-sm">
+                  {{ formatDate(token.lastUsedAt) }}
+                </td>
+                <td class="text-sm">
+                  {{ formatDate(token.createdAt) }}
+                </td>
+                <td>
+                  <button
+                    class="btn btn-ghost btn-xs text-error"
+                    @click="deleteToken(token.id)"
+                  >
+                    <Icon icon="heroicons:trash" class="w-4 h-4" />
+                  </button>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+
+    <!-- Create Token Modal -->
+    <dialog class="modal" :class="{ 'modal-open': createModalOpen }">
+      <div class="modal-box">
+        <h3 class="font-bold text-lg">Create API Token</h3>
+        <p class="py-4 text-sm text-base-content/70">
+          API tokens allow you to authenticate with the API programmatically.
+          Give your token a descriptive name.
+        </p>
+
+        <form @submit.prevent="createToken" class="space-y-4">
+          <div class="form-control">
+            <label class="label pb-2">
+              <span class="label-text font-medium">Token Name</span>
+            </label>
+            <input
+              type="text"
+              v-model="newTokenName"
+              placeholder="e.g. CI/CD Pipeline"
+              class="input input-bordered w-full"
+              required
+            />
+          </div>
+
+          <div class="modal-action">
+            <button type="button" class="btn" @click="createModalOpen = false">Cancel</button>
+            <button type="submit" class="btn btn-primary" :disabled="loading">
+              <span v-if="loading" class="loading loading-spinner loading-sm"></span>
+              Generate Token
+            </button>
+          </div>
+        </form>
+      </div>
+      <form method="dialog" class="modal-backdrop" @click="createModalOpen = false">
+        <button>close</button>
+      </form>
+    </dialog>
+
+    <!-- Show Token Modal -->
+    <dialog class="modal" :class="{ 'modal-open': showTokenModalOpen }">
+      <div class="modal-box">
+        <h3 class="font-bold text-lg text-success flex items-center gap-2">
+          <Icon icon="heroicons:check-circle" class="w-6 h-6" />
+          Token Created
+        </h3>
+        <p class="py-4">
+          Make sure to copy your personal access token now. You won't be able to see it again!
+        </p>
+
+        <div class="bg-base-200 p-4 rounded-lg break-all font-mono text-sm relative group">
+          <span>{{ newTokenValue }}</span>
+          <button
+            class="absolute top-2 right-2 btn btn-xs btn-ghost opacity-0 group-hover:opacity-100 transition-opacity"
+            @click="copyToken"
+            title="Copy to clipboard"
+          >
+            <Icon icon="heroicons:clipboard" class="w-4 h-4" />
+          </button>
+        </div>
+
+        <div class="modal-action">
+          <button class="btn btn-primary" @click="closeShowTokenModal">Done</button>
+        </div>
+      </div>
+      <form method="dialog" class="modal-backdrop" @click="closeShowTokenModal">
+          <button>close</button>
+      </form>
+    </dialog>
+  </div>
+</template>

src/components/settings/PasskeyManager.vue

@@ -0,0 +1,157 @@
+<script setup lang="ts">
+import { ref } from 'vue';
+import { Icon } from '@iconify/vue';
+import { startRegistration } from '@simplewebauthn/browser';
+
+interface Passkey {
+  id: string;
+  deviceType: string;
+  backedUp: boolean;
+  lastUsedAt: string | null;
+  createdAt: string | null;
+}
+
+const props = defineProps<{
+  initialPasskeys: Passkey[];
+}>();
+
+const passkeys = ref<Passkey[]>(props.initialPasskeys);
+const loading = ref(false);
+
+function formatDate(dateString: string | null) {
+  if (!dateString) return 'N/A';
+  return new Date(dateString).toLocaleDateString();
+}
+
+async function registerPasskey() {
+  loading.value = true;
+  try {
+    // 1. Get options from server
+    const resp = await fetch("/api/auth/passkey/register/start");
+
+    if (!resp.ok) {
+        throw new Error("Failed to start registration");
+    }
+
+    const options = await resp.json();
+
+    // 2. Browser handles interaction
+    let attResp;
+    try {
+      attResp = await startRegistration(options);
+    } catch (error) {
+      if ((error as any).name === 'NotAllowedError') {
+          // User cancelled or timed out
+          return;
+      }
+      console.error(error);
+      alert('Failed to register passkey: ' + (error as any).message);
+      return;
+    }
+
+    // 3. Verify with server
+    const verificationResp = await fetch(
+      "/api/auth/passkey/register/finish",
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(attResp),
+      }
+    );
+
+    const verificationJSON = await verificationResp.json();
+    if (verificationJSON.verified) {
+      // Reload to show the new passkey since the API doesn't return the created object
+      // Ideally we would return the object and append it to 'passkeys' to avoid reload
+      window.location.reload();
+    } else {
+      alert("Passkey registration failed");
+    }
+  } catch (error) {
+    console.error('Error registering passkey:', error);
+    alert('An error occurred');
+  } finally {
+    loading.value = false;
+  }
+}
+
+async function deletePasskey(id: string) {
+  if (!confirm('Are you sure you want to remove this passkey?')) {
+    return;
+  }
+
+  try {
+    const response = await fetch(`/api/auth/passkey/delete?id=${id}`, {
+      method: 'DELETE'
+    });
+
+    if (response.ok) {
+      // Optimistically remove from list
+      passkeys.value = passkeys.value.filter(pk => pk.id !== id);
+    } else {
+      alert('Failed to delete passkey');
+    }
+  } catch (error) {
+    console.error('Error deleting passkey:', error);
+    alert('An error occurred');
+  }
+}
+</script>
+
+<template>
+  <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+    <div class="card-body p-4 sm:p-6">
+      <div class="flex justify-between items-center mb-6">
+        <h2 class="card-title text-lg sm:text-xl">
+          <Icon icon="heroicons:finger-print" class="w-5 h-5 sm:w-6 sm:h-6" />
+          Passkeys
+        </h2>
+        <button class="btn btn-primary btn-sm" @click="registerPasskey" :disabled="loading">
+          <span v-if="loading" class="loading loading-spinner loading-xs"></span>
+          <Icon v-else icon="heroicons:plus" class="w-4 h-4" />
+          Add Passkey
+        </button>
+      </div>
+
+      <div class="overflow-x-auto">
+        <table class="table">
+          <thead>
+            <tr>
+              <th>Device Type</th>
+              <th>Last Used</th>
+              <th>Created</th>
+              <th>Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr v-if="passkeys.length === 0">
+              <td colspan="4" class="text-center text-base-content/60 py-4">
+                No passkeys found. Add one to sign in without a password.
+              </td>
+            </tr>
+            <tr v-else v-for="pk in passkeys" :key="pk.id">
+              <td class="font-medium">
+                {{ pk.deviceType === 'singleDevice' ? 'This Device' : 'Cross-Platform (Phone/Key)' }}
+                <span v-if="pk.backedUp" class="badge badge-xs badge-info ml-2">Backed Up</span>
+              </td>
+              <td class="text-sm">
+                {{ pk.lastUsedAt ? formatDate(pk.lastUsedAt) : 'Never' }}
+              </td>
+              <td class="text-sm">
+                {{ formatDate(pk.createdAt) }}
+              </td>
+              <td>
+                <button
+                  class="btn btn-ghost btn-xs text-error"
+                  @click="deletePasskey(pk.id)"
+                >
+                  <Icon icon="heroicons:trash" class="w-4 h-4" />
+                </button>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+</template>

src/components/settings/PasswordForm.vue

@@ -0,0 +1,132 @@
+<script setup lang="ts">
+import { ref } from 'vue';
+import { Icon } from '@iconify/vue';
+
+const currentPassword = ref('');
+const newPassword = ref('');
+const confirmPassword = ref('');
+const loading = ref(false);
+const message = ref<{ type: 'success' | 'error'; text: string } | null>(null);
+
+async function changePassword() {
+  if (newPassword.value !== confirmPassword.value) {
+    message.value = { type: 'error', text: 'New passwords do not match' };
+    return;
+  }
+
+  if (newPassword.value.length < 8) {
+    message.value = { type: 'error', text: 'Password must be at least 8 characters' };
+    return;
+  }
+
+  loading.value = true;
+  message.value = null;
+
+  try {
+    const response = await fetch('/api/user/change-password', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        currentPassword: currentPassword.value,
+        newPassword: newPassword.value,
+        confirmPassword: confirmPassword.value,
+      }),
+    });
+
+    if (response.ok) {
+      message.value = { type: 'success', text: 'Password changed successfully!' };
+      // Reset form
+      currentPassword.value = '';
+      newPassword.value = '';
+      confirmPassword.value = '';
+
+      // Hide success message after 3 seconds
+      setTimeout(() => {
+        message.value = null;
+      }, 3000);
+    } else {
+      const data = await response.json().catch(() => ({}));
+      message.value = { type: 'error', text: data.error || 'Failed to change password' };
+    }
+  } catch (error) {
+    message.value = { type: 'error', text: 'An error occurred' };
+  } finally {
+    loading.value = false;
+  }
+}
+</script>
+
+<template>
+  <div>
+    <!-- Success/Error Message Display -->
+    <div v-if="message" :class="['alert mb-6', message.type === 'success' ? 'alert-success' : 'alert-error']">
+      <Icon :icon="message.type === 'success' ? 'heroicons:check-circle' : 'heroicons:exclamation-circle'" class="w-6 h-6 shrink-0" />
+      <span>{{ message.text }}</span>
+    </div>
+
+    <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+      <div class="card-body p-4 sm:p-6">
+        <h2 class="card-title mb-6 text-lg sm:text-xl">
+          <Icon icon="heroicons:key" class="w-5 h-5 sm:w-6 sm:h-6" />
+          Change Password
+        </h2>
+
+        <form @submit.prevent="changePassword" class="space-y-5">
+          <div class="form-control">
+            <label class="label pb-2">
+              <span class="label-text font-medium text-sm sm:text-base">Current Password</span>
+            </label>
+            <input
+              type="password"
+              v-model="currentPassword"
+              placeholder="Enter current password"
+              class="input input-bordered w-full"
+              required
+            />
+          </div>
+
+          <div class="form-control">
+            <label class="label pb-2">
+              <span class="label-text font-medium text-sm sm:text-base">New Password</span>
+            </label>
+            <input
+              type="password"
+              v-model="newPassword"
+              placeholder="Enter new password"
+              class="input input-bordered w-full"
+              required
+              minlength="8"
+            />
+            <div class="label pt-2">
+              <span class="label-text-alt text-base-content/60 text-xs sm:text-sm">Minimum 8 characters</span>
+            </div>
+          </div>
+
+          <div class="form-control">
+            <label class="label pb-2">
+              <span class="label-text font-medium text-sm sm:text-base">Confirm New Password</span>
+            </label>
+            <input
+              type="password"
+              v-model="confirmPassword"
+              placeholder="Confirm new password"
+              class="input input-bordered w-full"
+              required
+              minlength="8"
+            />
+          </div>
+
+          <div class="flex justify-end pt-4">
+            <button type="submit" class="btn btn-primary w-full sm:w-auto" :disabled="loading">
+              <span v-if="loading" class="loading loading-spinner loading-sm"></span>
+              <Icon v-else icon="heroicons:lock-closed" class="w-5 h-5" />
+              Update Password
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+</template>

src/components/settings/ProfileForm.vue

@@ -0,0 +1,103 @@
+<script setup lang="ts">
+import { ref } from 'vue';
+import { Icon } from '@iconify/vue';
+
+const props = defineProps<{
+  user: {
+    id: string;
+    name: string;
+    email: string;
+  };
+}>();
+
+const name = ref(props.user.name);
+const loading = ref(false);
+const message = ref<{ type: 'success' | 'error'; text: string } | null>(null);
+
+async function updateProfile() {
+  loading.value = true;
+  message.value = null;
+
+  try {
+    const response = await fetch('/api/user/update-profile', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ name: name.value }),
+    });
+
+    if (response.ok) {
+      message.value = { type: 'success', text: 'Profile updated successfully!' };
+      // Hide success message after 3 seconds
+      setTimeout(() => {
+        message.value = null;
+      }, 3000);
+    } else {
+      const data = await response.json().catch(() => ({}));
+      message.value = { type: 'error', text: data.error || 'Failed to update profile' };
+    }
+  } catch (error) {
+    message.value = { type: 'error', text: 'An error occurred' };
+  } finally {
+    loading.value = false;
+  }
+}
+</script>
+
+<template>
+  <div>
+    <!-- Success/Error Message Display -->
+    <div v-if="message" :class="['alert mb-6', message.type === 'success' ? 'alert-success' : 'alert-error']">
+      <Icon :icon="message.type === 'success' ? 'heroicons:check-circle' : 'heroicons:exclamation-circle'" class="w-6 h-6 shrink-0" />
+      <span>{{ message.text }}</span>
+    </div>
+
+    <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+      <div class="card-body p-4 sm:p-6">
+        <h2 class="card-title mb-6 text-lg sm:text-xl">
+          <Icon icon="heroicons:user-circle" class="w-5 h-5 sm:w-6 sm:h-6" />
+          Profile Information
+        </h2>
+
+        <form @submit.prevent="updateProfile" class="space-y-5">
+          <div class="form-control">
+            <label class="label pb-2">
+              <span class="label-text font-medium text-sm sm:text-base">Full Name</span>
+            </label>
+            <input
+              type="text"
+              v-model="name"
+              placeholder="Your full name"
+              class="input input-bordered w-full"
+              required
+            />
+          </div>
+
+          <div class="form-control">
+            <label class="label pb-2">
+              <span class="label-text font-medium text-sm sm:text-base">Email</span>
+            </label>
+            <input
+              type="email"
+              :value="props.user.email"
+              class="input input-bordered w-full"
+              disabled
+            />
+            <div class="label pt-2">
+              <span class="label-text-alt text-base-content/60 text-xs sm:text-sm">Email cannot be changed</span>
+            </div>
+          </div>
+
+          <div class="flex justify-end pt-4">
+            <button type="submit" class="btn btn-primary w-full sm:w-auto" :disabled="loading">
+              <span v-if="loading" class="loading loading-spinner loading-sm"></span>
+              <Icon v-else icon="heroicons:check" class="w-5 h-5" />
+              Save Changes
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+</template>

src/db/index.ts

@@ -1,22 +1,42 @@
-import Database from 'better-sqlite3';
+import { drizzle } from "drizzle-orm/libsql";
-import { drizzle } from 'drizzle-orm/better-sqlite3';
+import { createClient } from "@libsql/client";
-import * as schema from './schema';
+import * as schema from "./schema";
-import path from 'path';
+import path from "path";
+import fs from "fs";
 
-let _db: ReturnType<typeof drizzle> | null = null;
+// Define the database type based on the schema
+type Database = ReturnType<typeof drizzle<typeof schema>>;
 
-function initDb() {
+let _db: Database | null = null;
+
+function initDb(): Database {
   if (!_db) {
-    const dbUrl = process.env.DATABASE_URL || path.resolve(process.cwd(), 'chronus.db');
+    const dataDir = process.env.DATA_DIR
-    const sqlite = new Database(dbUrl, { readonly: false });
+      ? process.env.DATA_DIR
-    _db = drizzle(sqlite, { schema });
+      : import.meta.env.DATA_DIR;
+
+    if (!dataDir) {
+      throw new Error("DATA_DIR environment variable is not set");
+    }
+
+    if (!fs.existsSync(dataDir)) {
+      fs.mkdirSync(dataDir, { recursive: true });
+    }
+
+    const url = `file:${path.join(dataDir, "chronus.db")}`;
+
+    const client = createClient({
+      url,
+    });
+
+    _db = drizzle(client, { schema });
   }
   return _db;
 }
 
-export const db = new Proxy({} as ReturnType<typeof drizzle>, {
+export const db = new Proxy({} as Database, {
   get(_target, prop) {
     const database = initDb();
-    return database[prop as keyof typeof database];
+    return database[prop as keyof Database];
-  }
+  },
 });

src/db/schema.ts

@@ -5,6 +5,7 @@ import {
   real,
   primaryKey,
   foreignKey,
+  index,
 } from "drizzle-orm/sqlite-core";
 import { nanoid } from "nanoid";
 
@@ -26,6 +27,7 @@ export const organizations = sqliteTable("organizations", {
     .primaryKey()
     .$defaultFn(() => nanoid()),
   name: text("name").notNull(),
+  logoUrl: text("logo_url"),
   street: text("street"),
   city: text("city"),
   state: text("state"),
@@ -56,6 +58,10 @@ export const members = sqliteTable(
       columns: [table.organizationId],
       foreignColumns: [organizations.id],
     }),
+    userIdIdx: index("members_user_id_idx").on(table.userId),
+    organizationIdIdx: index("members_organization_id_idx").on(
+      table.organizationId,
+    ),
   }),
 );
 
@@ -68,6 +74,12 @@ export const clients = sqliteTable(
     organizationId: text("organization_id").notNull(),
     name: text("name").notNull(),
     email: text("email"),
+    phone: text("phone"),
+    street: text("street"),
+    city: text("city"),
+    state: text("state"),
+    zip: text("zip"),
+    country: text("country"),
     createdAt: integer("created_at", { mode: "timestamp" }).$defaultFn(
       () => new Date(),
     ),
@@ -77,6 +89,9 @@ export const clients = sqliteTable(
       columns: [table.organizationId],
       foreignColumns: [organizations.id],
     }),
+    organizationIdIdx: index("clients_organization_id_idx").on(
+      table.organizationId,
+    ),
   }),
 );
 
@@ -98,6 +113,9 @@ export const categories = sqliteTable(
       columns: [table.organizationId],
       foreignColumns: [organizations.id],
     }),
+    organizationIdIdx: index("categories_organization_id_idx").on(
+      table.organizationId,
+    ),
   }),
 );
 
@@ -136,6 +154,12 @@ export const timeEntries = sqliteTable(
       columns: [table.categoryId],
       foreignColumns: [categories.id],
     }),
+    userIdIdx: index("time_entries_user_id_idx").on(table.userId),
+    organizationIdIdx: index("time_entries_organization_id_idx").on(
+      table.organizationId,
+    ),
+    clientIdIdx: index("time_entries_client_id_idx").on(table.clientId),
+    startTimeIdx: index("time_entries_start_time_idx").on(table.startTime),
   }),
 );
 
@@ -157,6 +181,9 @@ export const tags = sqliteTable(
       columns: [table.organizationId],
       foreignColumns: [organizations.id],
     }),
+    organizationIdIdx: index("tags_organization_id_idx").on(
+      table.organizationId,
+    ),
   }),
 );
 
@@ -176,6 +203,10 @@ export const timeEntryTags = sqliteTable(
       columns: [table.tagId],
       foreignColumns: [tags.id],
     }),
+    timeEntryIdIdx: index("time_entry_tags_time_entry_id_idx").on(
+      table.timeEntryId,
+    ),
+    tagIdIdx: index("time_entry_tags_tag_id_idx").on(table.tagId),
   }),
 );
 
@@ -191,6 +222,7 @@ export const sessions = sqliteTable(
       columns: [table.userId],
       foreignColumns: [users.id],
     }),
+    userIdIdx: index("sessions_user_id_idx").on(table.userId),
   }),
 );
 
@@ -225,6 +257,7 @@ export const apiTokens = sqliteTable(
       columns: [table.userId],
       foreignColumns: [users.id],
     }),
+    userIdIdx: index("api_tokens_user_id_idx").on(table.userId),
   }),
 );
 
@@ -244,6 +277,9 @@ export const invoices = sqliteTable(
     notes: text("notes"),
     currency: text("currency").default("USD").notNull(),
     subtotal: integer("subtotal").notNull().default(0), // in cents
+    discountValue: real("discount_value").default(0),
+    discountType: text("discount_type").default("percentage"), // 'percentage' or 'fixed'
+    discountAmount: integer("discount_amount").default(0), // in cents
     taxRate: real("tax_rate").default(0), // percentage
     taxAmount: integer("tax_amount").notNull().default(0), // in cents
     total: integer("total").notNull().default(0), // in cents
@@ -260,6 +296,10 @@ export const invoices = sqliteTable(
       columns: [table.clientId],
       foreignColumns: [clients.id],
     }),
+    organizationIdIdx: index("invoices_organization_id_idx").on(
+      table.organizationId,
+    ),
+    clientIdIdx: index("invoices_client_id_idx").on(table.clientId),
   }),
 );
 
@@ -280,5 +320,39 @@ export const invoiceItems = sqliteTable(
       columns: [table.invoiceId],
       foreignColumns: [invoices.id],
     }),
+    invoiceIdIdx: index("invoice_items_invoice_id_idx").on(table.invoiceId),
   }),
 );
+
+export const passkeys = sqliteTable(
+  "passkeys",
+  {
+    id: text("id").primaryKey(), // The Credential ID
+    userId: text("user_id").notNull(),
+    publicKey: text("public_key").notNull(), // Base64 encoded public key
+    counter: integer("counter").notNull(),
+    deviceType: text("device_type").notNull(), // 'singleDevice' or 'multiDevice'
+    backedUp: integer("backed_up", { mode: "boolean" }).notNull(),
+    transports: text("transports"), // JSON stringified array
+    lastUsedAt: integer("last_used_at", { mode: "timestamp" }),
+    createdAt: integer("created_at", { mode: "timestamp" }).$defaultFn(
+      () => new Date(),
+    ),
+  },
+  (table: any) => ({
+    userFk: foreignKey({
+      columns: [table.userId],
+      foreignColumns: [users.id],
+    }),
+    userIdIdx: index("passkeys_user_id_idx").on(table.userId),
+  }),
+);
+
+export const passkeyChallenges = sqliteTable("passkey_challenges", {
+  id: text("id")
+    .primaryKey()
+    .$defaultFn(() => nanoid()),
+  challenge: text("challenge").notNull().unique(),
+  userId: text("user_id"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+});

src/layouts/DashboardLayout.astro

@@ -4,7 +4,6 @@ import { Icon } from 'astro-icon/components';
 import { db } from '../db';
 import { members, organizations } from '../db/schema';
 import { eq } from 'drizzle-orm';
-import Footer from '../components/Footer.astro';
 import Avatar from '../components/Avatar.astro';
 import { ClientRouter } from "astro:transitions";
 
@@ -57,7 +56,7 @@ const currentTeam = userMemberships.find(m => m.organization.id === currentTeamI
             </label>
           </div>
           <div class="flex-1 px-2 flex items-center gap-2">
-            <img src="/src/assets/logo.webp" alt="Chronus" class="h-8 w-8" />
+            <img src="/logo.webp" alt="Chronus" class="h-8 w-8" />
             <span class="text-xl font-bold text-primary">Chronus</span>
           </div>
         </div>
@@ -73,7 +72,7 @@ const currentTeam = userMemberships.find(m => m.organization.id === currentTeamI
           <!-- Sidebar content here -->
           <li class="mb-6">
             <a href="/dashboard" class="flex items-center gap-3 text-2xl font-bold text-primary hover:bg-transparent">
-              <img src="/src/assets/logo.webp" alt="Chronus" class="h-10 w-10" />
+              <img src="/logo.webp" alt="Chronus" class="h-10 w-10" />
               Chronus
             </a>
           </li>
@@ -181,8 +180,8 @@ const currentTeam = userMemberships.find(m => m.organization.id === currentTeamI
           </li>
 
           <li>
-            <form action="/api/auth/logout" method="POST">
+            <form action="/api/auth/logout" method="POST" class="contents">
-              <button type="submit" class="w-full text-error hover:bg-error/10 rounded-lg transition-colors active:bg-base-300/50!">
+              <button type="submit" class="flex w-full items-center gap-2 py-2 px-4 text-error hover:bg-error/10 rounded-lg transition-colors active:bg-base-300/50!">
                 <Icon name="heroicons:arrow-right-on-rectangle" class="w-5 h-5" />
                 Logout
               </button>
@@ -192,6 +191,5 @@ const currentTeam = userMemberships.find(m => m.organization.id === currentTeamI
 
       </div>
     </div>
-    <Footer />
 	</body>
 </html>

src/layouts/Layout.astro

@@ -1,6 +1,5 @@
 ---
 import '../styles/global.css';
-import Footer from '../components/Footer.astro';
 import { ClientRouter } from "astro:transitions";
 
 interface Props {
@@ -21,10 +20,9 @@ const { title } = Astro.props;
 		<title>{title}</title>
 		<ClientRouter />
 	</head>
-	<body class="h-screen bg-base-100 text-base-content flex flex-col overflow-auto">
+	<body class="min-h-screen bg-base-100 text-base-content flex flex-col">
-		<div class="flex-1 overflow-auto">
+		<div class="flex-1 flex flex-col">
 			<slot />
 		</div>
-		<Footer />
 	</body>
 </html>

src/lib/formatTime.ts

@@ -4,26 +4,15 @@
  * @returns Formatted string like "01:23:45 (1h 24m)" or "00:05:23 (5m)"
  */
 export function formatDuration(ms: number): string {
-  const totalSeconds = Math.floor(ms / 1000);
-  const hours = Math.floor(totalSeconds / 3600);
-  const minutes = Math.floor((totalSeconds % 3600) / 60);
-  const seconds = totalSeconds % 60;
-  
-  const timeStr = `${hours.toString().padStart(2, '0')}:${minutes.toString().padStart(2, '0')}:${seconds.toString().padStart(2, '0')}`;
-  
   // Calculate rounded version for easy reading
   const totalMinutes = Math.round(ms / 1000 / 60);
-  const roundedHours = Math.floor(totalMinutes / 60);
+  const hours = Math.floor(totalMinutes / 60);
-  const roundedMinutes = totalMinutes % 60;
+  const minutes = totalMinutes % 60;
-  
+
-  let roundedStr = '';
+  if (hours > 0) {
-  if (roundedHours > 0) {
+    return minutes > 0 ? `${hours}h ${minutes}m` : `${hours}h`;
-    roundedStr = roundedMinutes > 0 ? `${roundedHours}h ${roundedMinutes}m` : `${roundedHours}h`;
-  } else {
-    roundedStr = `${roundedMinutes}m`;
   }
-  
+  return `${minutes}m`;
-  return `${timeStr} (${roundedStr})`;
 }
 
 /**
@@ -33,7 +22,7 @@ export function formatDuration(ms: number): string {
  * @returns Formatted duration string or "Running..."
  */
 export function formatTimeRange(start: Date, end: Date | null): string {
-  if (!end) return 'Running...';
+  if (!end) return "Running...";
   const ms = end.getTime() - start.getTime();
   return formatDuration(ms);
 }

src/lib/validation.ts

@@ -0,0 +1,83 @@
+import { db } from "../db";
+import { clients, categories, tags as tagsTable } from "../db/schema";
+import { eq, and, inArray } from "drizzle-orm";
+
+export async function validateTimeEntryResources({
+  organizationId,
+  clientId,
+  categoryId,
+  tagIds,
+}: {
+  organizationId: string;
+  clientId: string;
+  categoryId: string;
+  tagIds?: string[];
+}) {
+  const [client, category] = await Promise.all([
+    db
+      .select()
+      .from(clients)
+      .where(
+        and(
+          eq(clients.id, clientId),
+          eq(clients.organizationId, organizationId),
+        ),
+      )
+      .get(),
+    db
+      .select()
+      .from(categories)
+      .where(
+        and(
+          eq(categories.id, categoryId),
+          eq(categories.organizationId, organizationId),
+        ),
+      )
+      .get(),
+  ]);
+
+  if (!client) {
+    return { valid: false, error: "Invalid client" };
+  }
+
+  if (!category) {
+    return { valid: false, error: "Invalid category" };
+  }
+
+  if (tagIds && tagIds.length > 0) {
+    const validTags = await db
+      .select()
+      .from(tagsTable)
+      .where(
+        and(
+          inArray(tagsTable.id, tagIds),
+          eq(tagsTable.organizationId, organizationId),
+        ),
+      )
+      .all();
+
+    if (validTags.length !== tagIds.length) {
+      return { valid: false, error: "Invalid tags" };
+    }
+  }
+
+  return { valid: true };
+}
+
+export function validateTimeRange(
+  start: string | number | Date,
+  end: string | number | Date,
+) {
+  const startDate = new Date(start);
+  const endDate = new Date(end);
+
+  if (isNaN(startDate.getTime()) || isNaN(endDate.getTime())) {
+    return { valid: false, error: "Invalid date format" };
+  }
+
+  if (endDate <= startDate) {
+    return { valid: false, error: "End time must be after start time" };
+  }
+
+  return { valid: true, startDate, endDate };
+}

src/pages/admin/index.astro

@@ -41,7 +41,7 @@ const allUsers = await db.select().from(users).all();
       <form method="POST" action="/api/admin/settings">
         <div class="form-control">
           <label class="label cursor-pointer">
-            <span class="label-text">
+            <span class="label-text flex-1 min-w-0 pr-4">
               <div class="font-semibold">Allow New Registrations</div>
               <div class="text-sm text-gray-500">When disabled, only existing users can log in</div>
             </span>

src/pages/api/auth/login.ts

@@ -1,33 +1,37 @@
-import type { APIRoute } from 'astro';
+import type { APIRoute } from "astro";
-import { db } from '../../../db';
+import { db } from "../../../db";
-import { users } from '../../../db/schema';
+import { users } from "../../../db/schema";
-import { verifyPassword, createSession } from '../../../lib/auth';
+import { verifyPassword, createSession } from "../../../lib/auth";
-import { eq } from 'drizzle-orm';
+import { eq } from "drizzle-orm";
 
 export const POST: APIRoute = async ({ request, cookies, redirect }) => {
   const formData = await request.formData();
-  const email = formData.get('email')?.toString();
+  const email = formData.get("email")?.toString();
-  const password = formData.get('password')?.toString();
+  const password = formData.get("password")?.toString();
 
   if (!email || !password) {
-    return new Response('Missing fields', { status: 400 });
+    return redirect("/login?error=missing_fields");
   }
 
-  const user = await db.select().from(users).where(eq(users.email, email)).get();
+  const user = await db
+    .select()
+    .from(users)
+    .where(eq(users.email, email))
+    .get();
 
   if (!user || !(await verifyPassword(password, user.passwordHash))) {
-    return new Response('Invalid email or password', { status: 400 });
+    return redirect("/login?error=invalid_credentials");
   }
 
   const { sessionId, expiresAt } = await createSession(user.id);
 
-  cookies.set('session_id', sessionId, {
+  cookies.set("session_id", sessionId, {
-    path: '/',
+    path: "/",
     httpOnly: true,
     secure: import.meta.env.PROD,
-    sameSite: 'lax',
+    sameSite: "lax",
     expires: expiresAt,
   });
 
-  return redirect('/dashboard');
+  return redirect("/dashboard");
 };

src/pages/api/auth/passkey/delete/index.ts

@@ -0,0 +1,35 @@
+import type { APIRoute } from "astro";
+import { db } from "../../../../../db";
+import { passkeys } from "../../../../../db/schema";
+import { eq, and } from "drizzle-orm";
+
+export const DELETE: APIRoute = async ({ request, locals }) => {
+  const user = locals.user;
+
+  if (!user) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+    });
+  }
+
+  const url = new URL(request.url);
+  const id = url.searchParams.get("id");
+
+  if (!id) {
+    return new Response(JSON.stringify({ error: "Passkey ID is required" }), {
+      status: 400,
+    });
+  }
+
+  try {
+    await db
+      .delete(passkeys)
+      .where(and(eq(passkeys.id, id), eq(passkeys.userId, user.id)));
+
+    return new Response(JSON.stringify({ success: true }));
+  } catch (error) {
+    return new Response(JSON.stringify({ error: "Failed to delete passkey" }), {
+      status: 500,
+    });
+  }
+};

src/pages/api/auth/passkey/login/finish.ts

@@ -0,0 +1,102 @@
+import type { APIRoute } from "astro";
+import { verifyAuthenticationResponse } from "@simplewebauthn/server";
+import { db } from "../../../../../db";
+import { users, passkeys, passkeyChallenges } from "../../../../../db/schema";
+import { eq, and, gt } from "drizzle-orm";
+import { createSession } from "../../../../../lib/auth";
+
+export const POST: APIRoute = async ({ request, cookies }) => {
+  const body = await request.json();
+  const { id } = body;
+
+  const passkey = await db.query.passkeys.findFirst({
+    where: eq(passkeys.id, id),
+  });
+
+  if (!passkey) {
+    return new Response(JSON.stringify({ error: "Passkey not found" }), {
+      status: 400,
+    });
+  }
+
+  const user = await db.query.users.findFirst({
+    where: eq(users.id, passkey.userId),
+  });
+
+  if (!user) return new Response(null, { status: 400 });
+
+  const clientDataJSON = Buffer.from(
+    body.response.clientDataJSON,
+    "base64url",
+  ).toString("utf-8");
+  const clientData = JSON.parse(clientDataJSON);
+  const challenge = clientData.challenge;
+
+  const dbChallenge = await db.query.passkeyChallenges.findFirst({
+    where: and(
+      eq(passkeyChallenges.challenge, challenge),
+      gt(passkeyChallenges.expiresAt, new Date()),
+    ),
+  });
+
+  if (!dbChallenge) {
+    return new Response(
+      JSON.stringify({ error: "Invalid or expired challenge" }),
+      {
+        status: 400,
+      },
+    );
+  }
+
+  let verification;
+  try {
+    verification = await verifyAuthenticationResponse({
+      response: body,
+      expectedChallenge: challenge as string,
+      expectedOrigin: new URL(request.url).origin,
+      expectedRPID: new URL(request.url).hostname,
+      credential: {
+        id: passkey.id,
+        publicKey: new Uint8Array(Buffer.from(passkey.publicKey, "base64")),
+        counter: passkey.counter,
+        transports: passkey.transports
+          ? JSON.parse(passkey.transports)
+          : undefined,
+      },
+    });
+  } catch (error) {
+    return new Response(JSON.stringify({ error: (error as Error).message }), {
+      status: 400,
+    });
+  }
+
+  if (verification.verified) {
+    const { authenticationInfo } = verification;
+
+    await db
+      .update(passkeys)
+      .set({
+        counter: authenticationInfo.newCounter,
+        lastUsedAt: new Date(),
+      })
+      .where(eq(passkeys.id, passkey.id));
+
+    const { sessionId, expiresAt } = await createSession(user.id);
+
+    cookies.set("session_id", sessionId, {
+      path: "/",
+      httpOnly: true,
+      secure: import.meta.env.PROD,
+      sameSite: "lax",
+      expires: expiresAt,
+    });
+
+    await db
+      .delete(passkeyChallenges)
+      .where(eq(passkeyChallenges.challenge, challenge));
+
+    return new Response(JSON.stringify({ verified: true }));
+  }
+
+  return new Response(JSON.stringify({ verified: false }), { status: 400 });
+};

src/pages/api/auth/passkey/login/start.ts

@@ -0,0 +1,18 @@
+import type { APIRoute } from "astro";
+import { generateAuthenticationOptions } from "@simplewebauthn/server";
+import { db } from "../../../../../db";
+import { passkeyChallenges } from "../../../../../db/schema";
+
+export const GET: APIRoute = async ({ request }) => {
+  const options = await generateAuthenticationOptions({
+    rpID: new URL(request.url).hostname,
+    userVerification: "preferred",
+  });
+
+  await db.insert(passkeyChallenges).values({
+    challenge: options.challenge,
+    expiresAt: new Date(Date.now() + 5 * 60 * 1000),
+  });
+
+  return new Response(JSON.stringify(options));
+};

src/pages/api/auth/passkey/register/finish.ts

@@ -0,0 +1,81 @@
+import type { APIRoute } from "astro";
+import { verifyRegistrationResponse } from "@simplewebauthn/server";
+import { db } from "../../../../../db";
+import { passkeys, passkeyChallenges } from "../../../../../db/schema";
+import { eq, and, gt } from "drizzle-orm";
+
+export const POST: APIRoute = async ({ request, locals }) => {
+  const user = locals.user;
+
+  if (!user) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+    });
+  }
+
+  const body = await request.json();
+
+  const clientDataJSON = Buffer.from(
+    body.response.clientDataJSON,
+    "base64url",
+  ).toString("utf-8");
+  const clientData = JSON.parse(clientDataJSON);
+  const challenge = clientData.challenge;
+
+  const dbChallenge = await db.query.passkeyChallenges.findFirst({
+    where: and(
+      eq(passkeyChallenges.challenge, challenge),
+      eq(passkeyChallenges.userId, user.id),
+      gt(passkeyChallenges.expiresAt, new Date()),
+    ),
+  });
+
+  if (!dbChallenge) {
+    return new Response(
+      JSON.stringify({ error: "Invalid or expired challenge" }),
+      {
+        status: 400,
+      },
+    );
+  }
+
+  let verification;
+  try {
+    verification = await verifyRegistrationResponse({
+      response: body,
+      expectedChallenge: challenge,
+      expectedOrigin: new URL(request.url).origin,
+      expectedRPID: new URL(request.url).hostname,
+    });
+  } catch (error) {
+    return new Response(JSON.stringify({ error: (error as Error).message }), {
+      status: 400,
+    });
+  }
+
+  if (verification.verified && verification.registrationInfo) {
+    const { registrationInfo } = verification;
+    const { credential, credentialDeviceType, credentialBackedUp } =
+      registrationInfo;
+
+    await db.insert(passkeys).values({
+      id: credential.id,
+      userId: user.id,
+      publicKey: Buffer.from(credential.publicKey).toString("base64"),
+      counter: credential.counter,
+      deviceType: credentialDeviceType,
+      backedUp: credentialBackedUp,
+      transports: body.response.transports
+        ? JSON.stringify(body.response.transports)
+        : undefined,
+    });
+
+    await db
+      .delete(passkeyChallenges)
+      .where(eq(passkeyChallenges.challenge, challenge));
+
+    return new Response(JSON.stringify({ verified: true }));
+  }
+
+  return new Response(JSON.stringify({ verified: false }), { status: 400 });
+};

src/pages/api/auth/passkey/register/start.ts

@@ -0,0 +1,45 @@
+import type { APIRoute } from "astro";
+import { generateRegistrationOptions } from "@simplewebauthn/server";
+import { db } from "../../../../../db";
+import { passkeys, passkeyChallenges } from "../../../../../db/schema";
+import { eq } from "drizzle-orm";
+
+export const GET: APIRoute = async ({ request, locals }) => {
+  const user = locals.user;
+
+  if (!user) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+    });
+  }
+
+  // Get user's existing passkeys to prevent registering the same authenticator twice
+  const userPasskeys = await db.query.passkeys.findMany({
+    where: eq(passkeys.userId, user.id),
+  });
+
+  const options = await generateRegistrationOptions({
+    rpName: "Chronus",
+    rpID: new URL(request.url).hostname,
+    userName: user.email,
+    attestationType: "none",
+    excludeCredentials: userPasskeys.map((passkey) => ({
+      id: passkey.id,
+      transports: passkey.transports
+        ? JSON.parse(passkey.transports)
+        : undefined,
+    })),
+    authenticatorSelection: {
+      residentKey: "preferred",
+      userVerification: "preferred",
+    },
+  });
+
+  await db.insert(passkeyChallenges).values({
+    challenge: options.challenge,
+    userId: user.id,
+    expiresAt: new Date(Date.now() + 5 * 60 * 1000),
+  });
+
+  return new Response(JSON.stringify(options));
+};

src/pages/api/auth/signup.ts

@@ -1,39 +1,53 @@
-import type { APIRoute } from 'astro';
+import type { APIRoute } from "astro";
-import { db } from '../../../db';
+import { db } from "../../../db";
-import { users, organizations, members, siteSettings } from '../../../db/schema';
+import {
-import { hashPassword, createSession } from '../../../lib/auth';
+  users,
-import { eq, count, sql } from 'drizzle-orm';
+  organizations,
-import { nanoid } from 'nanoid';
+  members,
+  siteSettings,
+} from "../../../db/schema";
+import { hashPassword, createSession } from "../../../lib/auth";
+import { eq, count, sql } from "drizzle-orm";
+import { nanoid } from "nanoid";
 
 export const POST: APIRoute = async ({ request, cookies, redirect }) => {
   const userCountResult = await db.select({ count: count() }).from(users).get();
   const isFirstUser = userCountResult ? userCountResult.count === 0 : true;
 
   if (!isFirstUser) {
-    const registrationSetting = await db.select()
+    const registrationSetting = await db
+      .select()
       .from(siteSettings)
-      .where(eq(siteSettings.key, 'registration_enabled'))
+      .where(eq(siteSettings.key, "registration_enabled"))
       .get();
 
-    const registrationEnabled = registrationSetting?.value === 'true';
+    const registrationEnabled = registrationSetting?.value === "true";
-    
+
     if (!registrationEnabled) {
-      return new Response('Registration is currently disabled', { status: 403 });
+      return redirect("/signup?error=registration_disabled");
     }
   }
 
   const formData = await request.formData();
-  const name = formData.get('name')?.toString();
+  const name = formData.get("name")?.toString();
-  const email = formData.get('email')?.toString();
+  const email = formData.get("email")?.toString();
-  const password = formData.get('password')?.toString();
+  const password = formData.get("password")?.toString();
 
   if (!name || !email || !password) {
-    return new Response('Missing fields', { status: 400 });
+    return redirect("/signup?error=missing_fields");
   }
 
-  const existingUser = await db.select().from(users).where(eq(users.email, email)).get();
+  if (password.length < 8) {
+    return redirect("/signup?error=password_too_short");
+  }
+
+  const existingUser = await db
+    .select()
+    .from(users)
+    .where(eq(users.email, email))
+    .get();
   if (existingUser) {
-    return new Response('User already exists', { status: 400 });
+    return redirect("/signup?error=user_exists");
   }
 
   const passwordHash = await hashPassword(password);
@@ -56,18 +70,18 @@ export const POST: APIRoute = async ({ request, cookies, redirect }) => {
   await db.insert(members).values({
     userId,
     organizationId: orgId,
-    role: 'owner',
+    role: "owner",
   });
 
   const { sessionId, expiresAt } = await createSession(userId);
 
-  cookies.set('session_id', sessionId, {
+  cookies.set("session_id", sessionId, {
-    path: '/',
+    path: "/",
     httpOnly: true,
     secure: import.meta.env.PROD,
-    sameSite: 'lax',
+    sameSite: "lax",
     expires: expiresAt,
   });
 
-  return redirect('/dashboard');
+  return redirect("/dashboard");
 };

src/pages/api/clients/[id]/update.ts

@@ -16,15 +16,33 @@ export const POST: APIRoute = async ({ request, params, locals, redirect }) => {
 
   let name: string | undefined;
   let email: string | undefined;
+  let phone: string | undefined;
+  let street: string | undefined;
+  let city: string | undefined;
+  let state: string | undefined;
+  let zip: string | undefined;
+  let country: string | undefined;
 
   if (request.headers.get("Content-Type")?.includes("application/json")) {
     const body = await request.json();
     name = body.name;
     email = body.email;
+    phone = body.phone;
+    street = body.street;
+    city = body.city;
+    state = body.state;
+    zip = body.zip;
+    country = body.country;
   } else {
     const formData = await request.formData();
     name = formData.get("name")?.toString();
     email = formData.get("email")?.toString();
+    phone = formData.get("phone")?.toString();
+    street = formData.get("street")?.toString();
+    city = formData.get("city")?.toString();
+    state = formData.get("state")?.toString();
+    zip = formData.get("zip")?.toString();
+    country = formData.get("country")?.toString();
   }
 
   if (!name || name.trim().length === 0) {
@@ -74,6 +92,12 @@ export const POST: APIRoute = async ({ request, params, locals, redirect }) => {
       .set({
         name: name.trim(),
         email: email?.trim() || null,
+        phone: phone?.trim() || null,
+        street: street?.trim() || null,
+        city: city?.trim() || null,
+        state: state?.trim() || null,
+        zip: zip?.trim() || null,
+        country: country?.trim() || null,
       })
       .where(eq(clients.id, id))
       .run();
@@ -85,6 +109,12 @@ export const POST: APIRoute = async ({ request, params, locals, redirect }) => {
           id,
           name: name.trim(),
           email: email?.trim() || null,
+          phone: phone?.trim() || null,
+          street: street?.trim() || null,
+          city: city?.trim() || null,
+          state: state?.trim() || null,
+          zip: zip?.trim() || null,
+          country: country?.trim() || null,
         }),
         {
           status: 200,

src/pages/api/clients/create.ts

@@ -12,15 +12,33 @@ export const POST: APIRoute = async ({ request, locals, redirect }) => {
 
   let name: string | undefined;
   let email: string | undefined;
+  let phone: string | undefined;
+  let street: string | undefined;
+  let city: string | undefined;
+  let state: string | undefined;
+  let zip: string | undefined;
+  let country: string | undefined;
 
   if (request.headers.get("Content-Type")?.includes("application/json")) {
     const body = await request.json();
     name = body.name;
     email = body.email;
+    phone = body.phone;
+    street = body.street;
+    city = body.city;
+    state = body.state;
+    zip = body.zip;
+    country = body.country;
   } else {
     const formData = await request.formData();
     name = formData.get("name")?.toString();
     email = formData.get("email")?.toString();
+    phone = formData.get("phone")?.toString();
+    street = formData.get("street")?.toString();
+    city = formData.get("city")?.toString();
+    state = formData.get("state")?.toString();
+    zip = formData.get("zip")?.toString();
+    country = formData.get("country")?.toString();
   }
 
   if (!name) {
@@ -44,13 +62,32 @@ export const POST: APIRoute = async ({ request, locals, redirect }) => {
     organizationId: userOrg.organizationId,
     name,
     email: email || null,
+    phone: phone || null,
+    street: street || null,
+    city: city || null,
+    state: state || null,
+    zip: zip || null,
+    country: country || null,
   });
 
   if (locals.scopes) {
-    return new Response(JSON.stringify({ id, name, email: email || null }), {
+    return new Response(
-      status: 201,
+      JSON.stringify({
-      headers: { "Content-Type": "application/json" },
+        id,
-    });
+        name,
+        email: email || null,
+        phone: phone || null,
+        street: street || null,
+        city: city || null,
+        state: state || null,
+        zip: zip || null,
+        country: country || null,
+      }),
+      {
+        status: 201,
+        headers: { "Content-Type": "application/json" },
+      },
+    );
   }
 
   return redirect("/dashboard/clients");

src/pages/api/invoices/[id]/convert.ts

@@ -0,0 +1,97 @@
+import type { APIRoute } from "astro";
+import { db } from "../../../../db";
+import { invoices, members } from "../../../../db/schema";
+import { eq, and, desc } from "drizzle-orm";
+
+export const POST: APIRoute = async ({ redirect, locals, params }) => {
+  const user = locals.user;
+  if (!user) {
+    return redirect("/login");
+  }
+
+  const { id: invoiceId } = params;
+  if (!invoiceId) {
+    return new Response("Invoice ID required", { status: 400 });
+  }
+
+  // Fetch invoice to verify existence
+  const invoice = await db
+    .select()
+    .from(invoices)
+    .where(eq(invoices.id, invoiceId))
+    .get();
+
+  if (!invoice) {
+    return new Response("Invoice not found", { status: 404 });
+  }
+
+  if (invoice.type !== "quote") {
+    return new Response("Only quotes can be converted to invoices", {
+      status: 400,
+    });
+  }
+
+  // Verify membership
+  const membership = await db
+    .select()
+    .from(members)
+    .where(
+      and(
+        eq(members.userId, user.id),
+        eq(members.organizationId, invoice.organizationId),
+      ),
+    )
+    .get();
+
+  if (!membership) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+
+  try {
+    // Generate next invoice number
+    const lastInvoice = await db
+      .select()
+      .from(invoices)
+      .where(
+        and(
+          eq(invoices.organizationId, invoice.organizationId),
+          eq(invoices.type, "invoice"),
+        ),
+      )
+      .orderBy(desc(invoices.createdAt))
+      .limit(1)
+      .get();
+
+    let nextInvoiceNumber = "INV-001";
+    if (lastInvoice) {
+      const match = lastInvoice.number.match(/(\d+)$/);
+      if (match) {
+        const num = parseInt(match[1]) + 1;
+        let prefix = lastInvoice.number.replace(match[0], "");
+        if (prefix === "EST-") prefix = "INV-";
+        nextInvoiceNumber =
+          prefix + num.toString().padStart(match[0].length, "0");
+      }
+    }
+
+    // Convert quote to invoice:
+    // 1. Change type to 'invoice'
+    // 2. Set status to 'draft' (so user can review before sending)
+    // 3. Update number to next invoice sequence
+    // 4. Update issue date to today
+    await db
+      .update(invoices)
+      .set({
+        type: "invoice",
+        status: "draft",
+        number: nextInvoiceNumber,
+        issueDate: new Date(),
+      })
+      .where(eq(invoices.id, invoiceId));
+
+    return redirect(`/dashboard/invoices/${invoiceId}`);
+  } catch (error) {
+    console.error("Error converting quote to invoice:", error);
+    return new Response("Internal Server Error", { status: 500 });
+  }
+};

src/pages/api/invoices/[id]/generate.ts

@@ -69,7 +69,9 @@ export const GET: APIRoute = async ({ params, locals }) => {
     // Generate PDF using Vue PDF
     // Suppress verbose logging from PDF renderer
     const originalConsoleLog = console.log;
+    const originalConsoleWarn = console.warn;
     console.log = () => {};
+    console.warn = () => {};
 
     try {
       const pdfDocument = createInvoiceDocument({
@@ -83,6 +85,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 
       // Restore console.log
       console.log = originalConsoleLog;
+      console.warn = originalConsoleWarn;
 
       const filename = `${invoice.type}_${invoice.number.replace(/[^a-zA-Z0-9]/g, "_")}.pdf`;
 
@@ -95,6 +98,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
     } catch (pdfError) {
       // Restore console.log on error
       console.log = originalConsoleLog;
+      console.warn = originalConsoleWarn;
       throw pdfError;
     }
   } catch (error) {

src/pages/api/invoices/[id]/update-tax.ts

@@ -0,0 +1,79 @@
+import type { APIRoute } from "astro";
+import { db } from "../../../../db";
+import { invoices, members } from "../../../../db/schema";
+import { eq, and } from "drizzle-orm";
+import { recalculateInvoiceTotals } from "../../../../utils/invoice";
+
+export const POST: APIRoute = async ({
+  request,
+  redirect,
+  locals,
+  params,
+}) => {
+  const user = locals.user;
+  if (!user) {
+    return redirect("/login");
+  }
+
+  const { id: invoiceId } = params;
+  if (!invoiceId) {
+    return new Response("Invoice ID required", { status: 400 });
+  }
+
+  // Fetch invoice to verify existence
+  const invoice = await db
+    .select()
+    .from(invoices)
+    .where(eq(invoices.id, invoiceId))
+    .get();
+
+  if (!invoice) {
+    return new Response("Invoice not found", { status: 404 });
+  }
+
+  // Verify membership
+  const membership = await db
+    .select()
+    .from(members)
+    .where(
+      and(
+        eq(members.userId, user.id),
+        eq(members.organizationId, invoice.organizationId)
+      )
+    )
+    .get();
+
+  if (!membership) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+
+  const formData = await request.formData();
+  const taxRateStr = formData.get("taxRate") as string;
+
+  if (taxRateStr === null) {
+    return new Response("Tax rate is required", { status: 400 });
+  }
+
+  try {
+    const taxRate = parseFloat(taxRateStr);
+
+    if (isNaN(taxRate) || taxRate < 0) {
+      return new Response("Invalid tax rate", { status: 400 });
+    }
+
+    await db
+      .update(invoices)
+      .set({
+        taxRate,
+      })
+      .where(eq(invoices.id, invoiceId));
+
+    // Recalculate totals since tax rate changed
+    await recalculateInvoiceTotals(invoiceId);
+
+    return redirect(`/dashboard/invoices/${invoiceId}`);
+  } catch (error) {
+    console.error("Error updating invoice tax rate:", error);
+    return new Response("Internal Server Error", { status: 500 });
+  }
+};

src/pages/api/invoices/[id]/update.ts

@@ -4,12 +4,7 @@ import { invoices, members } from "../../../../db/schema";
 import { eq, and } from "drizzle-orm";
 import { recalculateInvoiceTotals } from "../../../../utils/invoice";
 
-export const POST: APIRoute = async ({
+export const POST: APIRoute = async ({ request, redirect, locals, params }) => {
-  request,
-  redirect,
-  locals,
-  params,
-}) => {
   const user = locals.user;
   if (!user) {
     return redirect("/login");
@@ -38,8 +33,8 @@ export const POST: APIRoute = async ({
     .where(
       and(
         eq(members.userId, user.id),
-        eq(members.organizationId, invoice.organizationId)
+        eq(members.organizationId, invoice.organizationId),
-      )
+      ),
     )
     .get();
 
@@ -53,6 +48,8 @@ export const POST: APIRoute = async ({
   const issueDateStr = formData.get("issueDate") as string;
   const dueDateStr = formData.get("dueDate") as string;
   const taxRateStr = formData.get("taxRate") as string;
+  const discountType = (formData.get("discountType") as string) || "percentage";
+  const discountValueStr = formData.get("discountValue") as string;
   const notes = formData.get("notes") as string;
 
   if (!number || !currency || !issueDateStr || !dueDateStr) {
@@ -64,6 +61,11 @@ export const POST: APIRoute = async ({
     const dueDate = new Date(dueDateStr);
     const taxRate = taxRateStr ? parseFloat(taxRateStr) : 0;
 
+    let discountValue = discountValueStr ? parseFloat(discountValueStr) : 0;
+    if (discountType === "fixed") {
+      discountValue = Math.round(discountValue * 100);
+    }
+
     await db
       .update(invoices)
       .set({
@@ -72,6 +74,8 @@ export const POST: APIRoute = async ({
         issueDate,
         dueDate,
         taxRate,
+        discountType: discountType as "percentage" | "fixed",
+        discountValue,
         notes: notes || null,
       })
       .where(eq(invoices.id, invoiceId));

src/pages/api/invoices/create.ts

@@ -3,7 +3,12 @@ import { db } from "../../../db";
 import { invoices, members } from "../../../db/schema";
 import { eq, and } from "drizzle-orm";
 
-export const POST: APIRoute = async ({ request, redirect, locals, cookies }) => {
+export const POST: APIRoute = async ({
+  request,
+  redirect,
+  locals,
+  cookies,
+}) => {
   const user = locals.user;
   if (!user) {
     return redirect("/login");
@@ -36,7 +41,8 @@ export const POST: APIRoute = async ({ request, redirect, locals, cookies }) =>
   }
 
   const membership = currentTeamId
-    ? userMemberships.find((m) => m.organizationId === currentTeamId)
+    ? userMemberships.find((m) => m.organizationId === currentTeamId) ||
+      userMemberships[0]
     : userMemberships[0];
 
   if (!membership) {
@@ -72,3 +78,7 @@ export const POST: APIRoute = async ({ request, redirect, locals, cookies }) =>
     return new Response("Internal Server Error", { status: 500 });
   }
 };
+
+export const GET: APIRoute = async ({ redirect }) => {
+  return redirect("/dashboard/invoices/new");
+};

src/pages/api/organizations/update-name.ts

@@ -1,4 +1,6 @@
 import type { APIRoute } from "astro";
+import { promises as fs } from "fs";
+import path from "path";
 import { db } from "../../../db";
 import { organizations, members } from "../../../db/schema";
 import { eq, and } from "drizzle-orm";
@@ -17,6 +19,7 @@ export const POST: APIRoute = async ({ request, locals, redirect }) => {
   const state = formData.get("state") as string | null;
   const zip = formData.get("zip") as string | null;
   const country = formData.get("country") as string | null;
+  const logo = formData.get("logo") as File | null;
 
   if (!organizationId || !name || name.trim().length === 0) {
     return new Response("Organization ID and name are required", {
@@ -49,17 +52,59 @@ export const POST: APIRoute = async ({ request, locals, redirect }) => {
       );
     }
 
+    let logoUrl: string | undefined;
+
+    if (logo && logo.size > 0) {
+      const allowedTypes = ["image/png", "image/jpeg"];
+      if (!allowedTypes.includes(logo.type)) {
+        return new Response(
+          "Invalid file type. Only PNG and JPG are allowed.",
+          {
+            status: 400,
+          },
+        );
+      }
+
+      const ext = logo.name.split(".").pop() || "png";
+      const filename = `${organizationId}-${Date.now()}.${ext}`;
+      const dataDir = process.env.DATA_DIR
+        ? process.env.DATA_DIR
+        : import.meta.env.DATA_DIR;
+
+      if (!dataDir) {
+        throw new Error("DATA_DIR environment variable is not set");
+      }
+
+      const uploadDir = path.join(dataDir, "uploads");
+
+      try {
+        await fs.access(uploadDir);
+      } catch {
+        await fs.mkdir(uploadDir, { recursive: true });
+      }
+
+      const buffer = Buffer.from(await logo.arrayBuffer());
+      await fs.writeFile(path.join(uploadDir, filename), buffer);
+      logoUrl = `/uploads/${filename}`;
+    }
+
     // Update organization information
+    const updateData: any = {
+      name: name.trim(),
+      street: street?.trim() || null,
+      city: city?.trim() || null,
+      state: state?.trim() || null,
+      zip: zip?.trim() || null,
+      country: country?.trim() || null,
+    };
+
+    if (logoUrl) {
+      updateData.logoUrl = logoUrl;
+    }
+
     await db
       .update(organizations)
-      .set({
+      .set(updateData)
-        name: name.trim(),
-        street: street?.trim() || null,
-        city: city?.trim() || null,
-        state: state?.trim() || null,
-        zip: zip?.trim() || null,
-        country: country?.trim() || null,
-      })
       .where(eq(organizations.id, organizationId))
       .run();
 

src/pages/api/reports/export.ts

@@ -0,0 +1,137 @@
+import type { APIRoute } from 'astro';
+import { db } from '../../../db';
+import { timeEntries, members, users, clients, categories } from '../../../db/schema';
+import { eq, and, gte, lte, desc } from 'drizzle-orm';
+
+export const GET: APIRoute = async ({ request, locals, cookies }) => {
+  const user = locals.user;
+  if (!user) {
+    return new Response('Unauthorized', { status: 401 });
+  }
+
+  // Get current team from cookie
+  const currentTeamId = cookies.get('currentTeamId')?.value;
+
+  const userMemberships = await db.select()
+    .from(members)
+    .where(eq(members.userId, user.id))
+    .all();
+
+  if (userMemberships.length === 0) {
+    return new Response('No organization found', { status: 404 });
+  }
+
+  // Use current team or fallback to first membership
+  const userMembership = currentTeamId
+    ? userMemberships.find(m => m.organizationId === currentTeamId) || userMemberships[0]
+    : userMemberships[0];
+
+  const url = new URL(request.url);
+  const selectedMemberId = url.searchParams.get('member') || '';
+  const selectedCategoryId = url.searchParams.get('category') || '';
+  const selectedClientId = url.searchParams.get('client') || '';
+  const timeRange = url.searchParams.get('range') || 'week';
+  const customFrom = url.searchParams.get('from');
+  const customTo = url.searchParams.get('to');
+
+  const now = new Date();
+  let startDate = new Date();
+  let endDate = new Date();
+
+  switch (timeRange) {
+    case 'today':
+      startDate.setHours(0, 0, 0, 0);
+      endDate.setHours(23, 59, 59, 999);
+      break;
+    case 'week':
+      startDate.setDate(now.getDate() - 7);
+      break;
+    case 'month':
+      startDate.setMonth(now.getMonth() - 1);
+      break;
+    case 'mtd':
+      startDate = new Date(now.getFullYear(), now.getMonth(), 1);
+      break;
+    case 'ytd':
+      startDate = new Date(now.getFullYear(), 0, 1);
+      break;
+    case 'last-month':
+      startDate = new Date(now.getFullYear(), now.getMonth() - 1, 1);
+      endDate = new Date(now.getFullYear(), now.getMonth(), 0, 23, 59, 59, 999);
+      break;
+    case 'custom':
+      if (customFrom) {
+        const parts = customFrom.split('-');
+        startDate = new Date(parseInt(parts[0]), parseInt(parts[1]) - 1, parseInt(parts[2]), 0, 0, 0, 0);
+      }
+      if (customTo) {
+        const parts = customTo.split('-');
+        endDate = new Date(parseInt(parts[0]), parseInt(parts[1]) - 1, parseInt(parts[2]), 23, 59, 59, 999);
+      }
+      break;
+  }
+
+  const conditions = [
+    eq(timeEntries.organizationId, userMembership.organizationId),
+    gte(timeEntries.startTime, startDate),
+    lte(timeEntries.startTime, endDate),
+  ];
+
+  if (selectedMemberId) {
+    conditions.push(eq(timeEntries.userId, selectedMemberId));
+  }
+
+  if (selectedCategoryId) {
+    conditions.push(eq(timeEntries.categoryId, selectedCategoryId));
+  }
+
+  if (selectedClientId) {
+    conditions.push(eq(timeEntries.clientId, selectedClientId));
+  }
+
+  const entries = await db.select({
+    entry: timeEntries,
+    user: users,
+    client: clients,
+    category: categories,
+  })
+    .from(timeEntries)
+    .innerJoin(users, eq(timeEntries.userId, users.id))
+    .innerJoin(clients, eq(timeEntries.clientId, clients.id))
+    .innerJoin(categories, eq(timeEntries.categoryId, categories.id))
+    .where(and(...conditions))
+    .orderBy(desc(timeEntries.startTime))
+    .all();
+
+  // Generate CSV
+  const headers = ['Date', 'Start Time', 'End Time', 'Duration (h)', 'Member', 'Client', 'Category', 'Description'];
+  const rows = entries.map(e => {
+    const start = e.entry.startTime;
+    const end = e.entry.endTime;
+
+    let duration = 0;
+    if (end) {
+      duration = (end.getTime() - start.getTime()) / (1000 * 60 * 60); // Hours
+    }
+
+    return [
+      start.toLocaleDateString(),
+      start.toLocaleTimeString(),
+      end ? end.toLocaleTimeString() : '',
+      end ? duration.toFixed(2) : 'Running',
+      `"${(e.user.name || '').replace(/"/g, '""')}"`,
+      `"${(e.client.name || '').replace(/"/g, '""')}"`,
+      `"${(e.category.name || '').replace(/"/g, '""')}"`,
+      `"${(e.entry.description || '').replace(/"/g, '""')}"`
+    ].join(',');
+  });
+
+  const csvContent = [headers.join(','), ...rows].join('\n');
+
+  return new Response(csvContent, {
+    headers: {
+      'Content-Type': 'text/csv',
+      'Content-Disposition': `attachment; filename="time-entries-${startDate.toISOString().split('T')[0]}-to-${endDate.toISOString().split('T')[0]}.csv"`,
+    },
+  });
+};

src/pages/api/time-entries/manual.ts

@@ -1,18 +1,19 @@
-import type { APIRoute } from 'astro';
+import type { APIRoute } from "astro";
-import { db } from '../../../db';
+import { db } from "../../../db";
-import { timeEntries, members, timeEntryTags, categories, clients } from '../../../db/schema';
+import { timeEntries, members, timeEntryTags } from "../../../db/schema";
-import { eq, and } from 'drizzle-orm';
+import { eq } from "drizzle-orm";
-import { nanoid } from 'nanoid';
+import { nanoid } from "nanoid";
+import {
+  validateTimeEntryResources,
+  validateTimeRange,
+} from "../../../lib/validation";
 
 export const POST: APIRoute = async ({ request, locals }) => {
   if (!locals.user) {
-    return new Response(
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      JSON.stringify({ error: 'Unauthorized' }),
+      status: 401,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 401,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
   const body = await request.json();
@@ -20,67 +21,47 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
   // Validation
   if (!clientId) {
-    return new Response(
+    return new Response(JSON.stringify({ error: "Client is required" }), {
-      JSON.stringify({ error: 'Client is required' }),
+      status: 400,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 400,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
   if (!categoryId) {
-    return new Response(
+    return new Response(JSON.stringify({ error: "Category is required" }), {
-      JSON.stringify({ error: 'Category is required' }),
+      status: 400,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 400,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
   if (!startTime) {
-    return new Response(
+    return new Response(JSON.stringify({ error: "Start time is required" }), {
-      JSON.stringify({ error: 'Start time is required' }),
+      status: 400,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 400,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
   if (!endTime) {
-    return new Response(
+    return new Response(JSON.stringify({ error: "End time is required" }), {
-      JSON.stringify({ error: 'End time is required' }),
+      status: 400,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 400,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
-  const startDate = new Date(startTime);
+  const timeValidation = validateTimeRange(startTime, endTime);
-  const endDate = new Date(endTime);
 
-  if (isNaN(startDate.getTime()) || isNaN(endDate.getTime())) {
+  if (
-    return new Response(
+    !timeValidation.valid ||
-      JSON.stringify({ error: 'Invalid date format' }),
+    !timeValidation.startDate ||
-      {
+    !timeValidation.endDate
-        status: 400,
+  ) {
-        headers: { 'Content-Type': 'application/json' }
+    return new Response(JSON.stringify({ error: timeValidation.error }), {
-      }
+      status: 400,
-    );
+      headers: { "Content-Type": "application/json" },
+    });
   }
 
-  if (endDate <= startDate) {
+  const { startDate, endDate } = timeValidation;
-    return new Response(
-      JSON.stringify({ error: 'End time must be after start time' }),
-      {
-        status: 400,
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
-  }
 
   // Get user's organization
   const member = await db
@@ -91,57 +72,24 @@ export const POST: APIRoute = async ({ request, locals }) => {
     .get();
 
   if (!member) {
-    return new Response(
+    return new Response(JSON.stringify({ error: "No organization found" }), {
-      JSON.stringify({ error: 'No organization found' }),
+      status: 400,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 400,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
-  // Verify category belongs to organization
+  const resourceValidation = await validateTimeEntryResources({
-  const category = await db
+    organizationId: member.organizationId,
-    .select()
+    clientId,
-    .from(categories)
+    categoryId,
-    .where(
+    tagIds: Array.isArray(tags) ? tags : undefined,
-      and(
+  });
-        eq(categories.id, categoryId),
-        eq(categories.organizationId, member.organizationId)
-      )
-    )
-    .get();
 
-  if (!category) {
+  if (!resourceValidation.valid) {
-    return new Response(
+    return new Response(JSON.stringify({ error: resourceValidation.error }), {
-      JSON.stringify({ error: 'Invalid category' }),
+      status: 400,
-      {
+      headers: { "Content-Type": "application/json" },
-        status: 400,
+    });
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
-  }
-
-  // Verify client belongs to organization
-  const client = await db
-    .select()
-    .from(clients)
-    .where(
-      and(
-        eq(clients.id, clientId),
-        eq(clients.organizationId, member.organizationId)
-      )
-    )
-    .get();
-
-  if (!client) {
-    return new Response(
-      JSON.stringify({ error: 'Invalid client' }),
-      {
-        status: 400,
-        headers: { 'Content-Type': 'application/json' }
-      }
-    );
   }
 
   const id = nanoid();
@@ -166,7 +114,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
         tags.map((tagId: string) => ({
           timeEntryId: id,
           tagId,
-        }))
+        })),
       );
     }
 
@@ -179,17 +127,17 @@ export const POST: APIRoute = async ({ request, locals }) => {
       }),
       {
         status: 201,
-        headers: { 'Content-Type': 'application/json' }
+        headers: { "Content-Type": "application/json" },
-      }
+      },
     );
   } catch (error) {
-    console.error('Error creating manual time entry:', error);
+    console.error("Error creating manual time entry:", error);
     return new Response(
-      JSON.stringify({ error: 'Failed to create time entry' }),
+      JSON.stringify({ error: "Failed to create time entry" }),
       {
         status: 500,
-        headers: { 'Content-Type': 'application/json' }
+        headers: { "Content-Type": "application/json" },
-      }
+      },
     );
   }
 };

src/pages/api/time-entries/start.ts

@@ -1,13 +1,9 @@
 import type { APIRoute } from "astro";
 import { db } from "../../../db";
-import {
+import { timeEntries, members, timeEntryTags } from "../../../db/schema";
-  timeEntries,
-  members,
-  timeEntryTags,
-  categories,
-} from "../../../db/schema";
 import { eq, and, isNull } from "drizzle-orm";
 import { nanoid } from "nanoid";
+import { validateTimeEntryResources } from "../../../lib/validation";
 
 export const POST: APIRoute = async ({ request, locals }) => {
   if (!locals.user) return new Response("Unauthorized", { status: 401 });
@@ -48,19 +44,15 @@ export const POST: APIRoute = async ({ request, locals }) => {
     return new Response("No organization found", { status: 400 });
   }
 
-  const category = await db
+  const validation = await validateTimeEntryResources({
-    .select()
+    organizationId: member.organizationId,
-    .from(categories)
+    clientId,
-    .where(
+    categoryId,
-      and(
+    tagIds: tags,
-        eq(categories.id, categoryId),
+  });
-        eq(categories.organizationId, member.organizationId),
-      ),
-    )
-    .get();
 
-  if (!category) {
+  if (!validation.valid) {
-    return new Response("Invalid category", { status: 400 });
+    return new Response(validation.error, { status: 400 });
   }
 
   const startTime = new Date();

src/pages/api/user/change-password.ts

@@ -1,61 +1,104 @@
-import type { APIRoute } from 'astro';
+import type { APIRoute } from "astro";
-import { db } from '../../../db';
+import { db } from "../../../db";
-import { users } from '../../../db/schema';
+import { users } from "../../../db/schema";
-import { eq } from 'drizzle-orm';
+import { eq } from "drizzle-orm";
-import bcrypt from 'bcryptjs';
+import bcrypt from "bcryptjs";
 
 export const POST: APIRoute = async ({ request, locals, redirect }) => {
   const user = locals.user;
+  const contentType = request.headers.get("content-type");
+  const isJson = contentType?.includes("application/json");
+
   if (!user) {
-    return redirect('/login');
+    if (isJson) {
+      return new Response(JSON.stringify({ error: "Unauthorized" }), {
+        status: 401,
+      });
+    }
+    return redirect("/login");
   }
 
-  const formData = await request.formData();
+  let currentPassword, newPassword, confirmPassword;
-  const currentPassword = formData.get('currentPassword') as string;
+
-  const newPassword = formData.get('newPassword') as string;
+  if (isJson) {
-  const confirmPassword = formData.get('confirmPassword') as string;
+    const body = await request.json();
+    currentPassword = body.currentPassword;
+    newPassword = body.newPassword;
+    confirmPassword = body.confirmPassword;
+  } else {
+    const formData = await request.formData();
+    currentPassword = formData.get("currentPassword") as string;
+    newPassword = formData.get("newPassword") as string;
+    confirmPassword = formData.get("confirmPassword") as string;
+  }
 
   if (!currentPassword || !newPassword || !confirmPassword) {
-    return new Response('All fields are required', { status: 400 });
+    const msg = "All fields are required";
+    if (isJson)
+      return new Response(JSON.stringify({ error: msg }), { status: 400 });
+    return new Response(msg, { status: 400 });
   }
 
   if (newPassword !== confirmPassword) {
-    return new Response('New passwords do not match', { status: 400 });
+    const msg = "New passwords do not match";
+    if (isJson)
+      return new Response(JSON.stringify({ error: msg }), { status: 400 });
+    return new Response(msg, { status: 400 });
   }
 
   if (newPassword.length < 8) {
-    return new Response('Password must be at least 8 characters', { status: 400 });
+    const msg = "Password must be at least 8 characters";
+    if (isJson)
+      return new Response(JSON.stringify({ error: msg }), { status: 400 });
+    return new Response(msg, { status: 400 });
   }
 
   try {
     // Get current user from database
-    const dbUser = await db.select()
+    const dbUser = await db
+      .select()
       .from(users)
       .where(eq(users.id, user.id))
       .get();
 
     if (!dbUser) {
-      return new Response('User not found', { status: 404 });
+      const msg = "User not found";
+      if (isJson)
+        return new Response(JSON.stringify({ error: msg }), { status: 404 });
+      return new Response(msg, { status: 404 });
     }
 
     // Verify current password
-    const passwordMatch = await bcrypt.compare(currentPassword, dbUser.passwordHash);
+    const passwordMatch = await bcrypt.compare(
+      currentPassword,
+      dbUser.passwordHash,
+    );
     if (!passwordMatch) {
-      return new Response('Current password is incorrect', { status: 400 });
+      const msg = "Current password is incorrect";
+      if (isJson)
+        return new Response(JSON.stringify({ error: msg }), { status: 400 });
+      return new Response(msg, { status: 400 });
     }
 
     // Hash new password
     const hashedPassword = await bcrypt.hash(newPassword, 10);
 
     // Update password
-    await db.update(users)
+    await db
+      .update(users)
       .set({ passwordHash: hashedPassword })
       .where(eq(users.id, user.id))
       .run();
 
-    return redirect('/dashboard/settings?success=password');
+    if (isJson) {
+      return new Response(JSON.stringify({ success: true }), { status: 200 });
+    }
+    return redirect("/dashboard/settings?success=password");
   } catch (error) {
-    console.error('Error changing password:', error);
+    console.error("Error changing password:", error);
-    return new Response('Failed to change password', { status: 500 });
+    const msg = "Failed to change password";
+    if (isJson)
+      return new Response(JSON.stringify({ error: msg }), { status: 500 });
+    return new Response(msg, { status: 500 });
   }
 };

src/pages/api/user/tokens/index.ts

@@ -12,8 +12,16 @@ export const POST: APIRoute = async ({ request, locals }) => {
     });
   }
 
-  const formData = await request.formData();
+  let name: string | undefined;
-  const name = formData.get("name")?.toString();
+
+  const contentType = request.headers.get("content-type");
+  if (contentType?.includes("application/json")) {
+    const body = await request.json();
+    name = body.name;
+  } else {
+    const formData = await request.formData();
+    name = formData.get("name")?.toString();
+  }
 
   if (!name) {
     return new Response(JSON.stringify({ error: "Name is required" }), {

src/pages/api/user/update-profile.ts

@@ -1,30 +1,58 @@
-import type { APIRoute } from 'astro';
+import type { APIRoute } from "astro";
-import { db } from '../../../db';
+import { db } from "../../../db";
-import { users } from '../../../db/schema';
+import { users } from "../../../db/schema";
-import { eq } from 'drizzle-orm';
+import { eq } from "drizzle-orm";
 
 export const POST: APIRoute = async ({ request, locals, redirect }) => {
   const user = locals.user;
+  const contentType = request.headers.get("content-type");
+  const isJson = contentType?.includes("application/json");
+
   if (!user) {
-    return redirect('/login');
+    if (isJson) {
+      return new Response(JSON.stringify({ error: "Unauthorized" }), {
+        status: 401,
+      });
+    }
+    return redirect("/login");
   }
 
-  const formData = await request.formData();
+  let name: string | undefined;
-  const name = formData.get('name') as string;
+
+  if (isJson) {
+    const body = await request.json();
+    name = body.name;
+  } else {
+    const formData = await request.formData();
+    name = formData.get("name") as string;
+  }
 
   if (!name || name.trim().length === 0) {
-    return new Response('Name is required', { status: 400 });
+    const msg = "Name is required";
+    if (isJson) {
+      return new Response(JSON.stringify({ error: msg }), { status: 400 });
+    }
+    return new Response(msg, { status: 400 });
   }
 
   try {
-    await db.update(users)
+    await db
+      .update(users)
       .set({ name: name.trim() })
       .where(eq(users.id, user.id))
       .run();
 
-    return redirect('/dashboard/settings?success=profile');
+    if (isJson) {
+      return new Response(JSON.stringify({ success: true }), { status: 200 });
+    }
+
+    return redirect("/dashboard/settings?success=profile");
   } catch (error) {
-    console.error('Error updating profile:', error);
+    console.error("Error updating profile:", error);
-    return new Response('Failed to update profile', { status: 500 });
+    const msg = "Failed to update profile";
+    if (isJson) {
+      return new Response(JSON.stringify({ error: msg }), { status: 500 });
+    }
+    return new Response(msg, { status: 500 });
   }
 };

src/pages/dashboard/clients/[id]/edit.astro

@@ -58,7 +58,7 @@ if (!client) return Astro.redirect('/dashboard/clients');
             name="name"
             value={client.name}
             placeholder="Acme Corp"
-            class="input input-bordered"
+            class="input input-bordered w-full"
             required
           />
         </div>
@@ -72,11 +72,101 @@ if (!client) return Astro.redirect('/dashboard/clients');
             id="email"
             name="email"
             value={client.email || ''}
-            placeholder="contact@acme.com"
+            placeholder="jason.borne@cia.com"
-            class="input input-bordered"
+            class="input input-bordered w-full"
           />
         </div>
 
+        <div class="form-control">
+          <label class="label" for="phone">
+            <span class="label-text">Phone (optional)</span>
+          </label>
+          <input
+            type="tel"
+            id="phone"
+            name="phone"
+            value={client.phone || ''}
+            placeholder="+1 (780) 420-1337"
+            class="input input-bordered w-full"
+          />
+        </div>
+
+        <div class="divider">Address Details</div>
+
+        <div class="form-control">
+          <label class="label" for="street">
+            <span class="label-text">Street Address (optional)</span>
+          </label>
+          <input
+            type="text"
+            id="street"
+            name="street"
+            value={client.street || ''}
+            placeholder="123 Business Rd"
+            class="input input-bordered w-full"
+          />
+        </div>
+
+        <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+          <div class="form-control">
+            <label class="label" for="city">
+              <span class="label-text">City (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="city"
+              name="city"
+              value={client.city || ''}
+              placeholder="Edmonton"
+              class="input input-bordered w-full"
+            />
+          </div>
+
+          <div class="form-control">
+            <label class="label" for="state">
+              <span class="label-text">State / Province (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="state"
+              name="state"
+              value={client.state || ''}
+              placeholder="AB"
+              class="input input-bordered w-full"
+            />
+          </div>
+        </div>
+
+        <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+          <div class="form-control">
+            <label class="label" for="zip">
+              <span class="label-text">Zip / Postal Code (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="zip"
+              name="zip"
+              value={client.zip || ''}
+              placeholder="10001"
+              class="input input-bordered w-full"
+            />
+          </div>
+
+          <div class="form-control">
+            <label class="label" for="country">
+              <span class="label-text">Country (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="country"
+              name="country"
+              value={client.country || ''}
+              placeholder="Canada"
+              class="input input-bordered w-full"
+            />
+          </div>
+        </div>
+
         <div class="card-actions justify-between mt-6">
           <button
             type="button"

src/pages/dashboard/clients/[id]/index.astro

@@ -86,12 +86,34 @@ const totalEntriesCount = totalEntriesResult?.count || 0;
         <div class="flex justify-between items-start">
           <div>
             <h2 class="card-title text-2xl mb-1">{client.name}</h2>
-            {client.email && (
+            <div class="space-y-2 mb-4">
-              <div class="flex items-center gap-2 text-base-content/70 mb-4">
+              {client.email && (
-                <Icon name="heroicons:envelope" class="w-4 h-4" />
+                <div class="flex items-center gap-2 text-base-content/70">
-                <a href={`mailto:${client.email}`} class="link link-hover">{client.email}</a>
+                  <Icon name="heroicons:envelope" class="w-4 h-4" />
-              </div>
+                  <a href={`mailto:${client.email}`} class="link link-hover">{client.email}</a>
-            )}
+                </div>
+              )}
+              {client.phone && (
+                <div class="flex items-center gap-2 text-base-content/70">
+                  <Icon name="heroicons:phone" class="w-4 h-4" />
+                  <a href={`tel:${client.phone}`} class="link link-hover">{client.phone}</a>
+                </div>
+              )}
+              {(client.street || client.city || client.state || client.zip || client.country) && (
+                <div class="flex items-start gap-2 text-base-content/70">
+                  <Icon name="heroicons:map-pin" class="w-4 h-4 mt-0.5" />
+                  <div class="text-sm space-y-0.5">
+                    {client.street && <div>{client.street}</div>}
+                    {(client.city || client.state || client.zip) && (
+                      <div>
+                        {[client.city, client.state, client.zip].filter(Boolean).join(', ')}
+                      </div>
+                    )}
+                    {client.country && <div>{client.country}</div>}
+                  </div>
+                </div>
+              )}
+            </div>
           </div>
           <div class="flex gap-2">
             <a href={`/dashboard/clients/${client.id}/edit`} class="btn btn-primary btn-sm">

src/pages/dashboard/clients/new.astro

@@ -8,20 +8,20 @@ if (!user) return Astro.redirect('/login');
 <DashboardLayout title="New Client - Chronus">
   <div class="max-w-2xl mx-auto">
     <h1 class="text-3xl font-bold mb-6">Add New Client</h1>
-    
+
     <form method="POST" action="/api/clients/create" class="card bg-base-100 shadow-xl border border-base-200">
       <div class="card-body">
         <div class="form-control">
           <label class="label" for="name">
             <span class="label-text">Client Name</span>
           </label>
-          <input 
+          <input
-            type="text" 
+            type="text"
             id="name"
-            name="name" 
+            name="name"
-            placeholder="Acme Corp" 
+            placeholder="Acme Corp"
-            class="input input-bordered" 
+            class="input input-bordered w-full"
-            required 
+            required
           />
         </div>
 
@@ -29,15 +29,99 @@ if (!user) return Astro.redirect('/login');
           <label class="label" for="email">
             <span class="label-text">Email (optional)</span>
           </label>
-          <input 
+          <input
-            type="email" 
+            type="email"
             id="email"
-            name="email" 
+            name="email"
-            placeholder="contact@acme.com" 
+            placeholder="jason.borne@cia.com"
-            class="input input-bordered" 
+            class="input input-bordered w-full"
           />
         </div>
 
+        <div class="form-control">
+          <label class="label" for="phone">
+            <span class="label-text">Phone (optional)</span>
+          </label>
+          <input
+            type="tel"
+            id="phone"
+            name="phone"
+            placeholder="+1 (780) 420-1337"
+            class="input input-bordered w-full"
+          />
+        </div>
+
+        <div class="divider">Address Details</div>
+
+        <div class="form-control">
+          <label class="label" for="street">
+            <span class="label-text">Street Address (optional)</span>
+          </label>
+          <input
+            type="text"
+            id="street"
+            name="street"
+            placeholder="123 Business Rd"
+            class="input input-bordered w-full"
+          />
+        </div>
+
+        <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+          <div class="form-control">
+            <label class="label" for="city">
+              <span class="label-text">City (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="city"
+              name="city"
+              placeholder="Edmonton"
+              class="input input-bordered w-full"
+            />
+          </div>
+
+          <div class="form-control">
+            <label class="label" for="state">
+              <span class="label-text">State / Province (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="state"
+              name="state"
+              placeholder="AB"
+              class="input input-bordered w-full"
+            />
+          </div>
+        </div>
+
+        <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+          <div class="form-control">
+            <label class="label" for="zip">
+              <span class="label-text">Zip / Postal Code (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="zip"
+              name="zip"
+              placeholder="10001"
+              class="input input-bordered w-full"
+            />
+          </div>
+
+          <div class="form-control">
+            <label class="label" for="country">
+              <span class="label-text">Country (optional)</span>
+            </label>
+            <input
+              type="text"
+              id="country"
+              name="country"
+              placeholder="Canada"
+              class="input input-bordered w-full"
+            />
+          </div>
+        </div>
+
         <div class="card-actions justify-end mt-6">
           <a href="/dashboard/clients" class="btn btn-ghost">Cancel</a>
           <button type="submit" class="btn btn-primary">Create Client</button>

src/pages/dashboard/index.astro

@@ -41,52 +41,48 @@ if (currentOrg) {
   const weekAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000);
   const monthAgo = new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000);
 
-  const weekEntries = await db.select()
+  const weekStats = await db.select({
+      totalDuration: sql<number>`sum(${timeEntries.endTime} - ${timeEntries.startTime})`
+    })
     .from(timeEntries)
     .where(and(
       eq(timeEntries.organizationId, currentOrg.organizationId),
-      gte(timeEntries.startTime, weekAgo)
+      gte(timeEntries.startTime, weekAgo),
+      sql`${timeEntries.endTime} IS NOT NULL`
     ))
-    .all();
+    .get();
 
-  stats.totalTimeThisWeek = weekEntries.reduce((sum, e) => {
+  stats.totalTimeThisWeek = weekStats?.totalDuration || 0;
-    if (e.endTime) {
-      return sum + (e.endTime.getTime() - e.startTime.getTime());
-    }
-    return sum;
-  }, 0);
 
-  const monthEntries = await db.select()
+  const monthStats = await db.select({
+      totalDuration: sql<number>`sum(${timeEntries.endTime} - ${timeEntries.startTime})`
+    })
     .from(timeEntries)
     .where(and(
       eq(timeEntries.organizationId, currentOrg.organizationId),
-      gte(timeEntries.startTime, monthAgo)
+      gte(timeEntries.startTime, monthAgo),
+      sql`${timeEntries.endTime} IS NOT NULL`
     ))
-    .all();
+    .get();
 
-  stats.totalTimeThisMonth = monthEntries.reduce((sum, e) => {
+  stats.totalTimeThisMonth = monthStats?.totalDuration || 0;
-    if (e.endTime) {
-      return sum + (e.endTime.getTime() - e.startTime.getTime());
-    }
-    return sum;
-  }, 0);
 
-  const activeCount = await db.select()
+  const activeCount = await db.select({ count: sql<number>`count(*)` })
     .from(timeEntries)
     .where(and(
       eq(timeEntries.organizationId, currentOrg.organizationId),
       isNull(timeEntries.endTime)
     ))
-    .all();
+    .get();
 
-  stats.activeTimers = activeCount.length;
+  stats.activeTimers = activeCount?.count || 0;
 
-  const clientCount = await db.select()
+  const clientCount = await db.select({ count: sql<number>`count(*)` })
     .from(clients)
     .where(eq(clients.organizationId, currentOrg.organizationId))
-    .all();
+    .get();
 
-  stats.totalClients = clientCount.length;
+  stats.totalClients = clientCount?.count || 0;
 
   stats.recentEntries = await db.select({
     entry: timeEntries,
@@ -107,7 +103,7 @@ const hasMembership = userOrgs.length > 0;
 ---
 
 <DashboardLayout title="Dashboard - Chronus">
-  <div class="flex justify-between items-center mb-8">
+  <div class="flex flex-col sm:flex-row justify-between items-start sm:items-center gap-4 sm:gap-0 mb-8">
     <div>
       <h1 class="text-4xl font-bold text-primary mb-2">
         Dashboard

src/pages/dashboard/invoices/[id].astro

@@ -90,24 +90,32 @@ const isDraft = invoice.status === 'draft';
             </button>
           </form>
         )}
-        {(invoice.status === 'sent' && invoice.type === 'invoice') && (
+        {(invoice.status !== 'paid' && invoice.status !== 'void' && invoice.type === 'invoice') && (
            <form method="POST" action={`/api/invoices/${invoice.id}/status`}>
             <input type="hidden" name="status" value="paid" />
-            <button type="submit" class="btn btn-success text-white">
+            <button type="submit" class="btn btn-success">
               <Icon name="heroicons:check" class="w-5 h-5" />
               Mark Paid
             </button>
           </form>
         )}
-         {(invoice.status === 'sent' && invoice.type === 'quote') && (
+         {(invoice.status !== 'accepted' && invoice.status !== 'declined' && invoice.status !== 'void' && invoice.type === 'quote') && (
            <form method="POST" action={`/api/invoices/${invoice.id}/status`}>
             <input type="hidden" name="status" value="accepted" />
-            <button type="submit" class="btn btn-success text-white">
+            <button type="submit" class="btn btn-success">
               <Icon name="heroicons:check" class="w-5 h-5" />
               Mark Accepted
             </button>
           </form>
         )}
+        {(invoice.type === 'quote' && invoice.status === 'accepted') && (
+           <form method="POST" action={`/api/invoices/${invoice.id}/convert`}>
+            <button type="submit" class="btn btn-primary">
+              <Icon name="heroicons:document-duplicate" class="w-5 h-5" />
+              Convert to Invoice
+            </button>
+          </form>
+        )}
         <div class="dropdown dropdown-end">
           <div role="button" tabindex="0" class="btn btn-square btn-ghost border border-base-300">
             <Icon name="heroicons:ellipsis-horizontal" class="w-6 h-6" />
@@ -125,12 +133,6 @@ const isDraft = invoice.status === 'draft';
                 Download PDF
               </a>
             </li>
-            <li>
-              <button type="button" onclick="window.print()">
-                <Icon name="heroicons:printer" class="w-4 h-4" />
-                Print
-              </button>
-            </li>
             {invoice.status !== 'void' && invoice.status !== 'draft' && (
               <li>
                 <form method="POST" action={`/api/invoices/${invoice.id}/status`}>
@@ -196,7 +198,19 @@ const isDraft = invoice.status === 'draft';
           {client ? (
             <div>
               <div class="font-bold text-lg">{client.name}</div>
-              <div class="text-base-content/70">{client.email}</div>
+              {client.email && <div class="text-base-content/70">{client.email}</div>}
+              {client.phone && <div class="text-base-content/70">{client.phone}</div>}
+              {(client.street || client.city || client.state || client.zip || client.country) && (
+                <div class="text-sm text-base-content/70 mt-2 space-y-0.5">
+                  {client.street && <div>{client.street}</div>}
+                  {(client.city || client.state || client.zip) && (
+                    <div>
+                      {[client.city, client.state, client.zip].filter(Boolean).join(', ')}
+                    </div>
+                  )}
+                  {client.country && <div>{client.country}</div>}
+                </div>
+              )}
             </div>
           ) : (
              <div class="italic text-base-content/40">Client deleted</div>
@@ -205,7 +219,8 @@ const isDraft = invoice.status === 'draft';
 
         <!-- Items Table -->
         <div class="mb-8">
-          <table class="w-full">
+          <div class="overflow-x-auto">
+            <table class="w-full min-w-150">
             <thead>
               <tr class="border-b-2 border-base-200 text-left text-xs font-bold uppercase tracking-wider text-base-content/40">
                 <th class="py-3">Description</th>
@@ -242,7 +257,8 @@ const isDraft = invoice.status === 'draft';
                 </tr>
               )}
             </tbody>
-          </table>
+            </table>
+          </div>
         </div>
 
         <!-- Add Item Form (Only if Draft) -->
@@ -278,9 +294,25 @@ const isDraft = invoice.status === 'draft';
               <span class="text-base-content/60">Subtotal</span>
               <span class="font-medium">{formatCurrency(invoice.subtotal)}</span>
             </div>
-            {(invoice.taxRate ?? 0) > 0 && (
+            {(invoice.discountAmount > 0) && (
               <div class="flex justify-between text-sm">
-                <span class="text-base-content/60">Tax ({invoice.taxRate}%)</span>
+                <span class="text-base-content/60">
+                  Discount
+                  {invoice.discountType === 'percentage' && ` (${invoice.discountValue}%)`}
+                </span>
+                <span class="font-medium text-success">-{formatCurrency(invoice.discountAmount)}</span>
+              </div>
+            )}
+            {((invoice.taxRate ?? 0) > 0 || isDraft) && (
+              <div class="flex justify-between text-sm items-center group">
+                <span class="text-base-content/60 flex items-center gap-2">
+                  Tax ({invoice.taxRate ?? 0}%)
+                  {isDraft && (
+                    <button type="button" onclick="document.getElementById('tax_modal').showModal()" class="btn btn-ghost btn-xs btn-square opacity-0 group-hover:opacity-100 transition-opacity" title="Edit Tax Rate">
+                      <Icon name="heroicons:pencil" class="w-3 h-3" />
+                    </button>
+                  )}
+                </span>
                 <span class="font-medium">{formatCurrency(invoice.taxAmount)}</span>
               </div>
             )}
@@ -303,10 +335,42 @@ const isDraft = invoice.status === 'draft';
         {/* Edit Notes (Draft Only) - Simplistic approach */}
         {isDraft && !invoice.notes && (
              <div class="mt-8 text-center">
-                 <a href={`/dashboard/invoices/${invoice.id}/edit`} class="btn btn-sm btn-ghost">Add Notes</a>
+                 <a href={`/dashboard/invoices/${invoice.id}/edit`} class="btn btn-sm btn-primary">Edit Details</a>
              </div>
         )}
       </div>
     </div>
   </div>
+
+  <!-- Tax Modal -->
+  <dialog id="tax_modal" class="modal">
+    <div class="modal-box">
+      <h3 class="font-bold text-lg">Update Tax Rate</h3>
+      <p class="py-4">Enter the tax percentage to apply to the subtotal.</p>
+      <form method="POST" action={`/api/invoices/${invoice.id}/update-tax`}>
+        <div class="form-control mb-6">
+          <label class="label">
+            <span class="label-text">Tax Rate (%)</span>
+          </label>
+          <input
+            type="number"
+            name="taxRate"
+            step="0.01"
+            min="0"
+            max="100"
+            class="input input-bordered w-full"
+            value={invoice.taxRate ?? 0}
+            required
+          />
+        </div>
+        <div class="modal-action">
+          <button type="button" class="btn" onclick="document.getElementById('tax_modal').close()">Cancel</button>
+          <button type="submit" class="btn btn-primary">Update</button>
+        </div>
+      </form>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+      <button>close</button>
+    </form>
+  </dialog>
 </DashboardLayout>

src/pages/dashboard/invoices/[id]/edit.astro

@@ -38,6 +38,10 @@ if (!membership) {
 // Format dates for input[type="date"]
 const issueDateStr = invoice.issueDate.toISOString().split('T')[0];
 const dueDateStr = invoice.dueDate.toISOString().split('T')[0];
+
+const discountValueDisplay = invoice.discountType === 'fixed'
+  ? (invoice.discountValue || 0) / 100
+  : (invoice.discountValue || 0);
 ---
 
 <DashboardLayout title={`Edit ${invoice.number} - Chronus`}>
@@ -99,7 +103,9 @@ const dueDateStr = invoice.dueDate.toISOString().split('T')[0];
           <!-- Due Date -->
           <div class="form-control">
             <label class="label">
-              <span class="label-text font-semibold">Due Date</span>
+              <span class="label-text font-semibold">
+                {invoice.type === 'quote' ? 'Valid Until' : 'Due Date'}
+              </span>
             </label>
             <input
               type="date"
@@ -110,6 +116,27 @@ const dueDateStr = invoice.dueDate.toISOString().split('T')[0];
             />
           </div>
 
+          <!-- Discount -->
+          <div class="form-control">
+            <label class="label">
+              <span class="label-text font-semibold">Discount</span>
+            </label>
+            <div class="join w-full">
+              <select name="discountType" class="select select-bordered join-item">
+                <option value="percentage" selected={!invoice.discountType || invoice.discountType === 'percentage'}>%</option>
+                <option value="fixed" selected={invoice.discountType === 'fixed'}>Fixed</option>
+              </select>
+              <input
+                type="number"
+                name="discountValue"
+                step="0.01"
+                min="0"
+                class="input input-bordered join-item w-full"
+                value={discountValueDisplay}
+              />
+            </div>
+          </div>
+
            <!-- Tax Rate -->
           <div class="form-control">
             <label class="label">
@@ -128,7 +155,7 @@ const dueDateStr = invoice.dueDate.toISOString().split('T')[0];
         </div>
 
         <!-- Notes -->
-        <div class="form-control">
+        <div class="form-control flex flex-col">
           <label class="label">
             <span class="label-text font-semibold">Notes / Terms</span>
           </label>

src/pages/dashboard/invoices/index.astro

@@ -109,7 +109,8 @@ const getStatusColor = (status: string) => {
 
   <div class="card bg-base-100 shadow-xl border border-base-200">
     <div class="card-body p-0">
-      <table class="table table-zebra">
+      <div class="overflow-x-auto md:overflow-visible pb-32 md:pb-0">
+        <table class="table table-zebra">
           <thead>
             <tr class="bg-base-200/50">
               <th>Number</th>
@@ -162,7 +163,7 @@ const getStatusColor = (status: string) => {
                       <div role="button" tabindex="0" class="btn btn-ghost btn-sm btn-square">
                         <Icon name="heroicons:ellipsis-vertical" class="w-5 h-5" />
                       </div>
-                      <ul tabindex="0" class="dropdown-content menu p-2 shadow-lg bg-base-100 rounded-box w-52 border border-base-200 z-[100]">
+                      <ul tabindex="0" class="dropdown-content menu p-2 shadow-lg bg-base-100 rounded-box w-52 border border-base-200 z-100">
                         <li>
                           <a href={`/dashboard/invoices/${invoice.id}`}>
                             <Icon name="heroicons:eye" class="w-4 h-4" />
@@ -210,6 +211,7 @@ const getStatusColor = (status: string) => {
             )}
           </tbody>
         </table>
+      </div>
     </div>
   </div>
 </DashboardLayout>

src/pages/dashboard/invoices/new.astro

@@ -47,7 +47,9 @@ if (lastInvoice) {
   const match = lastInvoice.number.match(/(\d+)$/);
   if (match) {
     const num = parseInt(match[1]) + 1;
-    const prefix = lastInvoice.number.replace(match[0], '');
+    let prefix = lastInvoice.number.replace(match[0], '');
+    // Ensure we don't carry over an EST- prefix to an invoice
+    if (prefix === 'EST-') prefix = 'INV-';
     nextInvoiceNumber = prefix + num.toString().padStart(match[0].length, '0');
   }
 }
@@ -68,7 +70,9 @@ if (lastQuote) {
   const match = lastQuote.number.match(/(\d+)$/);
   if (match) {
     const num = parseInt(match[1]) + 1;
-    const prefix = lastQuote.number.replace(match[0], '');
+    let prefix = lastQuote.number.replace(match[0], '');
+    // Ensure we don't carry over an INV- prefix to a quote
+    if (prefix === 'INV-') prefix = 'EST-';
     nextQuoteNumber = prefix + num.toString().padStart(match[0].length, '0');
   }
 }
@@ -167,7 +171,7 @@ const defaultDueDate = nextMonth.toISOString().split('T')[0];
             <!-- Due Date -->
             <div class="form-control">
               <label class="label">
-                <span class="label-text font-semibold">Due Date</span>
+                <span class="label-text font-semibold" id="dueDateLabel">Due Date</span>
               </label>
               <input
                 type="date"
@@ -212,22 +216,26 @@ const defaultDueDate = nextMonth.toISOString().split('T')[0];
   // Update number based on document type
   const typeRadios = document.querySelectorAll('input[name="type"]');
   const numberInput = document.getElementById('documentNumber') as HTMLInputElement | null;
+  const dueDateLabel = document.getElementById('dueDateLabel');
 
-  if (numberInput) {
+  const invoiceNumber = numberInput?.dataset.invoiceNumber || 'INV-001';
-    const invoiceNumber = numberInput.dataset.invoiceNumber || 'INV-001';
+  const quoteNumber = numberInput?.dataset.quoteNumber || 'EST-001';
-    const quoteNumber = numberInput.dataset.quoteNumber || 'EST-001';
 
-    typeRadios.forEach(radio => {
+  typeRadios.forEach(radio => {
-      radio.addEventListener('change', (e) => {
+    radio.addEventListener('change', (e) => {
-        const target = e.target as HTMLInputElement;
+      const target = e.target as HTMLInputElement;
-        if (numberInput) {
+
-          if (target.value === 'quote') {
+      if (numberInput) {
-            numberInput.value = quoteNumber;
+        if (target.value === 'quote') {
-          } else if (target.value === 'invoice') {
+          numberInput.value = quoteNumber;
-            numberInput.value = invoiceNumber;
+        } else if (target.value === 'invoice') {
-          }
+          numberInput.value = invoiceNumber;
         }
-      });
+      }
+
+      if (dueDateLabel) {
+        dueDateLabel.textContent = target.value === 'quote' ? 'Valid Until' : 'Due Date';
+      }
     });
-  }
+  });
 </script>

src/pages/dashboard/reports.astro

@@ -52,6 +52,8 @@ const selectedMemberId = url.searchParams.get('member') || '';
 const selectedCategoryId = url.searchParams.get('category') || '';
 const selectedClientId = url.searchParams.get('client') || '';
 const timeRange = url.searchParams.get('range') || 'week';
+const customFrom = url.searchParams.get('from');
+const customTo = url.searchParams.get('to');
 
 const now = new Date();
 let startDate = new Date();
@@ -78,6 +80,16 @@ switch (timeRange) {
     startDate = new Date(now.getFullYear(), now.getMonth() - 1, 1);
     endDate = new Date(now.getFullYear(), now.getMonth(), 0, 23, 59, 59, 999);
     break;
+  case 'custom':
+    if (customFrom) {
+      const parts = customFrom.split('-');
+      startDate = new Date(parseInt(parts[0]), parseInt(parts[1]) - 1, parseInt(parts[2]), 0, 0, 0, 0);
+    }
+    if (customTo) {
+      const parts = customTo.split('-');
+      endDate = new Date(parseInt(parts[0]), parseInt(parts[1]) - 1, parseInt(parts[2]), 23, 59, 59, 999);
+    }
+    break;
 }
 
 const conditions = [
@@ -250,6 +262,7 @@ function getTimeRangeLabel(range: string) {
     case 'mtd': return 'Month to Date';
     case 'ytd': return 'Year to Date';
     case 'last-month': return 'Last Month';
+    case 'custom': return 'Custom Range';
     default: return 'Last 7 Days';
   }
 }
@@ -273,9 +286,39 @@ function getTimeRangeLabel(range: string) {
             <option value="mtd" selected={timeRange === 'mtd'}>Month to Date</option>
             <option value="ytd" selected={timeRange === 'ytd'}>Year to Date</option>
             <option value="last-month" selected={timeRange === 'last-month'}>Last Month</option>
+            <option value="custom" selected={timeRange === 'custom'}>Custom Range</option>
           </select>
         </div>
 
+        {timeRange === 'custom' && (
+          <>
+            <div class="form-control">
+              <label class="label">
+                <span class="label-text font-medium">From Date</span>
+              </label>
+              <input
+                type="date"
+                name="from"
+                class="input input-bordered w-full"
+                value={customFrom || (startDate.getFullYear() + '-' + String(startDate.getMonth() + 1).padStart(2, '0') + '-' + String(startDate.getDate()).padStart(2, '0'))}
+                onchange="this.form.submit()"
+              />
+            </div>
+            <div class="form-control">
+              <label class="label">
+                <span class="label-text font-medium">To Date</span>
+              </label>
+              <input
+                type="date"
+                name="to"
+                class="input input-bordered w-full"
+                value={customTo || (endDate.getFullYear() + '-' + String(endDate.getMonth() + 1).padStart(2, '0') + '-' + String(endDate.getDate()).padStart(2, '0'))}
+                onchange="this.form.submit()"
+              />
+            </div>
+          </>
+        )}
+
         <div class="form-control">
           <label class="label">
             <span class="label-text font-medium">Team Member</span>
@@ -318,6 +361,20 @@ function getTimeRangeLabel(range: string) {
           </select>
         </div>
       </form>
+
+      <style>
+        @media (max-width: 767px) {
+          form {
+            align-items: stretch !important;
+          }
+          .form-control {
+            width: 100%;
+          }
+        }
+        select, input {
+          width: 100%;
+        }
+      </style>
     </div>
   </div>
 
@@ -695,10 +752,18 @@ function getTimeRangeLabel(range: string) {
   {/* Detailed Entries */}
   <div class="card bg-base-100 shadow-xl border border-base-200">
     <div class="card-body">
-      <h2 class="card-title mb-4">
+      <div class="flex justify-between items-center mb-4">
-        <Icon name="heroicons:document-text" class="w-6 h-6" />
+        <h2 class="card-title">
-        Detailed Entries ({entries.length})
+          <Icon name="heroicons:document-text" class="w-6 h-6" />
-      </h2>
+          Detailed Entries ({entries.length})
+        </h2>
+        {entries.length > 0 && (
+          <a href={`/api/reports/export${url.search}`} class="btn btn-sm btn-outline" target="_blank">
+            <Icon name="heroicons:arrow-down-tray" class="w-4 h-4" />
+            Export CSV
+          </a>
+        )}
+      </div>
       {entries.length > 0 ? (
         <div class="overflow-x-auto">
           <table class="table table-zebra">

src/pages/dashboard/settings.astro

@@ -2,8 +2,12 @@
 import DashboardLayout from '../../layouts/DashboardLayout.astro';
 import { Icon } from 'astro-icon/components';
 import { db } from '../../db';
-import { apiTokens } from '../../db/schema';
+import { apiTokens, passkeys } from '../../db/schema';
 import { eq, desc } from 'drizzle-orm';
+import ProfileForm from '../../components/settings/ProfileForm.vue';
+import PasswordForm from '../../components/settings/PasswordForm.vue';
+import ApiTokenManager from '../../components/settings/ApiTokenManager.vue';
+import PasskeyManager from '../../components/settings/PasskeyManager.vue';
 
 const user = Astro.locals.user;
 if (!user) return Astro.redirect('/login');
@@ -16,6 +20,12 @@ const userTokens = await db.select()
   .where(eq(apiTokens.userId, user.id))
   .orderBy(desc(apiTokens.createdAt))
   .all();
+
+const userPasskeys = await db.select()
+  .from(passkeys)
+  .where(eq(passkeys.userId, user.id))
+  .orderBy(desc(passkeys.createdAt))
+  .all();
 ---
 
 <DashboardLayout title="Account Settings - Chronus">
@@ -40,177 +50,25 @@ const userTokens = await db.select()
     )}
 
     <!-- Profile Information -->
-    <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+    <ProfileForm client:load user={user} />
-      <div class="card-body p-4 sm:p-6">
-        <h2 class="card-title mb-6 text-lg sm:text-xl">
-          <Icon name="heroicons:user-circle" class="w-5 h-5 sm:w-6 sm:h-6" />
-          Profile Information
-        </h2>
-
-        <form action="/api/user/update-profile" method="POST" class="space-y-5">
-          <div class="form-control">
-            <label class="label pb-2">
-              <span class="label-text font-medium text-sm sm:text-base">Full Name</span>
-            </label>
-            <input
-              type="text"
-              name="name"
-              value={user.name}
-              placeholder="Your full name"
-              class="input input-bordered w-full"
-              required
-            />
-          </div>
-
-          <div class="form-control">
-            <label class="label pb-2">
-              <span class="label-text font-medium text-sm sm:text-base">Email</span>
-            </label>
-            <input
-              type="email"
-              name="email"
-              value={user.email}
-              placeholder="your@email.com"
-              class="input input-bordered w-full"
-              disabled
-            />
-            <div class="label pt-2">
-              <span class="label-text-alt text-base-content/60 text-xs sm:text-sm">Email cannot be changed</span>
-            </div>
-          </div>
-
-          <div class="flex justify-end pt-4">
-            <button type="submit" class="btn btn-primary w-full sm:w-auto">
-              <Icon name="heroicons:check" class="w-5 h-5" />
-              Save Changes
-            </button>
-          </div>
-        </form>
-      </div>
-    </div>
 
     <!-- Change Password -->
-    <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+    <PasswordForm client:load />
-      <div class="card-body p-4 sm:p-6">
-        <h2 class="card-title mb-6 text-lg sm:text-xl">
-          <Icon name="heroicons:key" class="w-5 h-5 sm:w-6 sm:h-6" />
-          Change Password
-        </h2>
 
-        <form action="/api/user/change-password" method="POST" class="space-y-5">
+    <!-- Passkeys -->
-          <div class="form-control">
+    <PasskeyManager client:load initialPasskeys={userPasskeys.map(pk => ({
-            <label class="label pb-2">
+      ...pk,
-              <span class="label-text font-medium text-sm sm:text-base">Current Password</span>
+      lastUsedAt: pk.lastUsedAt ? pk.lastUsedAt.toISOString() : null,
-            </label>
+      createdAt: pk.createdAt ? pk.createdAt.toISOString() : null
-            <input
+    }))} />
-              type="password"
-              name="currentPassword"
-              placeholder="Enter current password"
-              class="input input-bordered w-full"
-              required
-            />
-          </div>
-
-          <div class="form-control">
-            <label class="label pb-2">
-              <span class="label-text font-medium text-sm sm:text-base">New Password</span>
-            </label>
-            <input
-              type="password"
-              name="newPassword"
-              placeholder="Enter new password"
-              class="input input-bordered w-full"
-              required
-              minlength="8"
-            />
-            <div class="label pt-2">
-              <span class="label-text-alt text-base-content/60 text-xs sm:text-sm">Minimum 8 characters</span>
-            </div>
-          </div>
-
-          <div class="form-control">
-            <label class="label pb-2">
-              <span class="label-text font-medium text-sm sm:text-base">Confirm New Password</span>
-            </label>
-            <input
-              type="password"
-              name="confirmPassword"
-              placeholder="Confirm new password"
-              class="input input-bordered w-full"
-              required
-              minlength="8"
-            />
-          </div>
-
-          <div class="flex justify-end pt-4">
-            <button type="submit" class="btn btn-primary w-full sm:w-auto">
-              <Icon name="heroicons:lock-closed" class="w-5 h-5" />
-              Update Password
-            </button>
-          </div>
-        </form>
-      </div>
-    </div>
 
     <!-- API Tokens -->
-    <div class="card bg-base-100 shadow-xl border border-base-200 mb-6">
+    <ApiTokenManager client:load initialTokens={userTokens.map(t => ({
-      <div class="card-body p-4 sm:p-6">
+      ...t,
-        <div class="flex justify-between items-center mb-6">
+      lastUsedAt: t.lastUsedAt ? t.lastUsedAt.toISOString() : null,
-          <h2 class="card-title text-lg sm:text-xl">
+      createdAt: t.createdAt ? t.createdAt.toISOString() : ''
-            <Icon name="heroicons:code-bracket-square" class="w-5 h-5 sm:w-6 sm:h-6" />
+    }))} />
-            API Tokens
-          </h2>
-          <button class="btn btn-primary btn-sm" onclick="createTokenModal.showModal()">
-            <Icon name="heroicons:plus" class="w-4 h-4" />
-            Create Token
-          </button>
-        </div>
 
-        <div class="overflow-x-auto">
-          <table class="table">
-            <thead>
-              <tr>
-                <th>Name</th>
-                <th>Last Used</th>
-                <th>Created</th>
-                <th>Actions</th>
-              </tr>
-            </thead>
-            <tbody>
-              {userTokens.length === 0 ? (
-                <tr>
-                  <td colspan="4" class="text-center text-base-content/60 py-4">
-                    No API tokens found. Create one to access the API.
-                  </td>
-                </tr>
-              ) : (
-                userTokens.map(token => (
-                  <tr>
-                    <td class="font-medium">{token.name}</td>
-                    <td class="text-sm">
-                      {token.lastUsedAt ? token.lastUsedAt.toLocaleDateString() : 'Never'}
-                    </td>
-                    <td class="text-sm">
-                      {token.createdAt ? token.createdAt.toLocaleDateString() : 'N/A'}
-                    </td>
-                    <td>
-                      <button
-                        class="btn btn-ghost btn-xs text-error"
-                        onclick={`deleteToken('${token.id}')`}
-                      >
-                        <Icon name="heroicons:trash" class="w-4 h-4" />
-                      </button>
-                    </td>
-                  </tr>
-                ))
-              )}
-            </tbody>
-          </table>
-        </div>
-      </div>
-    </div>
-
-    <!-- Account Info -->
     <div class="card bg-base-100 shadow-xl border border-base-200">
       <div class="card-body p-4 sm:p-6">
         <h2 class="card-title mb-6 text-lg sm:text-xl">
@@ -238,132 +96,5 @@ const userTokens = await db.select()
     </div>
   </div>
 
-  <!-- Create Token Modal -->
-  <dialog id="createTokenModal" class="modal">
-    <div class="modal-box">
-      <h3 class="font-bold text-lg">Create API Token</h3>
-      <p class="py-4 text-sm text-base-content/70">
-        API tokens allow you to authenticate with the API programmatically.
-        Give your token a descriptive name.
-      </p>
 
-      <form id="createTokenForm" method="dialog" class="space-y-4">
-        <div class="form-control">
-          <label class="label pb-2">
-            <span class="label-text font-medium">Token Name</span>
-          </label>
-          <input
-            type="text"
-            name="name"
-            id="tokenName"
-            placeholder="e.g. CI/CD Pipeline"
-            class="input input-bordered w-full"
-            required
-          />
-        </div>
-
-        <div class="modal-action">
-          <button type="button" class="btn" onclick="createTokenModal.close()">Cancel</button>
-          <button type="submit" class="btn btn-primary">Generate Token</button>
-        </div>
-      </form>
-    </div>
-    <form method="dialog" class="modal-backdrop">
-      <button>close</button>
-    </form>
-  </dialog>
-
-  <!-- Show Token Modal -->
-  <dialog id="showTokenModal" class="modal">
-    <div class="modal-box">
-      <h3 class="font-bold text-lg text-success flex items-center gap-2">
-        <Icon name="heroicons:check-circle" class="w-6 h-6" />
-        Token Created
-      </h3>
-      <p class="py-4">
-        Make sure to copy your personal access token now. You won't be able to see it again!
-      </p>
-
-      <div class="bg-base-200 p-4 rounded-lg break-all font-mono text-sm relative group">
-        <span id="newTokenDisplay"></span>
-        <button
-          class="absolute top-2 right-2 btn btn-xs btn-ghost opacity-0 group-hover:opacity-100 transition-opacity"
-          onclick="copyToken()"
-          title="Copy to clipboard"
-        >
-          <Icon name="heroicons:clipboard" class="w-4 h-4" />
-        </button>
-      </div>
-
-      <div class="modal-action">
-        <button class="btn btn-primary" onclick="closeShowTokenModal()">Done</button>
-      </div>
-    </div>
-  </dialog>
-
-  <script is:inline>
-    // Handle Token Creation
-    const createTokenForm = document.getElementById('createTokenForm');
-
-    createTokenForm.addEventListener('submit', async (e) => {
-      e.preventDefault();
-      const name = document.getElementById('tokenName').value;
-      const formData = new FormData();
-      formData.append('name', name);
-
-      try {
-        const response = await fetch('/api/user/tokens', {
-          method: 'POST',
-          body: formData
-        });
-
-        if (response.ok) {
-          const data = await response.json();
-          document.getElementById('createTokenModal').close();
-          document.getElementById('newTokenDisplay').innerText = data.token;
-          document.getElementById('showTokenModal').showModal();
-          document.getElementById('tokenName').value = ''; // Reset form
-        } else {
-          alert('Failed to create token');
-        }
-      } catch (error) {
-        console.error('Error creating token:', error);
-        alert('An error occurred');
-      }
-    });
-
-    // Handle Token Copy
-    function copyToken() {
-      const token = document.getElementById('newTokenDisplay').innerText;
-      navigator.clipboard.writeText(token);
-    }
-
-    // Handle Closing Show Token Modal (refresh page to show new token in list)
-    function closeShowTokenModal() {
-      document.getElementById('showTokenModal').close();
-      window.location.reload();
-    }
-
-    // Handle Token Deletion
-    async function deleteToken(id) {
-      if (!confirm('Are you sure you want to revoke this token? Any applications using it will stop working.')) {
-        return;
-      }
-
-      try {
-        const response = await fetch(`/api/user/tokens/${id}`, {
-          method: 'DELETE'
-        });
-
-        if (response.ok) {
-          window.location.reload();
-        } else {
-          alert('Failed to delete token');
-        }
-      } catch (error) {
-        console.error('Error deleting token:', error);
-        alert('An error occurred');
-      }
-    }
-  </script>
 </DashboardLayout>

src/pages/dashboard/team.astro

@@ -38,7 +38,7 @@ const isAdmin = currentUserMember?.member.role === 'owner' || currentUserMember?
 ---
 
 <DashboardLayout title="Team - Chronus">
-  <div class="flex justify-between items-center mb-6">
+  <div class="flex flex-col sm:flex-row justify-between items-start sm:items-center gap-4 mb-6">
     <h1 class="text-3xl font-bold">Team Members</h1>
     <div class="flex gap-2">
       {isAdmin && (

src/pages/dashboard/team/settings.astro

@@ -67,9 +67,51 @@ const successType = url.searchParams.get('success');
         </div>
       )}
 
-      <form action="/api/organizations/update-name" method="POST" class="space-y-4">
+      <form
+        action="/api/organizations/update-name"
+        method="POST"
+        class="space-y-4"
+        enctype="multipart/form-data"
+      >
         <input type="hidden" name="organizationId" value={organization.id} />
 
+        <div class="form-control">
+          <div class="label">
+            <span class="label-text font-medium">Team Logo</span>
+          </div>
+          <div class="flex items-center gap-6">
+            <div class="avatar placeholder">
+              <div class="bg-base-200 text-neutral-content rounded-xl w-24 border border-base-300 flex items-center justify-center overflow-hidden">
+                {organization.logoUrl ? (
+                  <img
+                    src={organization.logoUrl}
+                    alt={organization.name}
+                    class="w-full h-full object-cover"
+                  />
+                ) : (
+                  <Icon
+                    name="heroicons:photo"
+                    class="w-8 h-8 opacity-40 text-base-content"
+                  />
+                )}
+              </div>
+            </div>
+            <div>
+              <input
+                type="file"
+                name="logo"
+                accept="image/png, image/jpeg"
+                class="file-input file-input-bordered w-full max-w-xs"
+              />
+              <div class="text-xs text-base-content/60 mt-2">
+                Upload a company logo (PNG, JPG).
+                <br />
+                Will be displayed on invoices and quotes.
+              </div>
+            </div>
+          </div>
+        </div>
+
         <label class="form-control">
           <div class="label">
             <span class="label-text font-medium">Team Name</span>
@@ -158,14 +200,12 @@ const successType = url.searchParams.get('success');
           </label>
         </div>
 
-        <div class="label">
+        <div class="flex flex-col sm:flex-row justify-between items-center gap-4 mt-6">
-          <span class="label-text-alt text-base-content/60">
+          <span class="text-xs text-base-content/60 text-center sm:text-left">
             Address information appears on invoices and quotes
           </span>
-        </div>
 
-        <div class="flex justify-end">
+          <button type="submit" class="btn btn-primary w-full sm:w-auto">
-          <button type="submit" class="btn btn-primary">
             <Icon name="heroicons:check" class="w-5 h-5" />
             Save Changes
           </button>

src/pages/dashboard/tracker.astro

@@ -164,14 +164,16 @@ const paginationPages = getPaginationPages(page, totalPages);
       <input type="radio" name="tracker_tabs" role="tab" class="tab text-base font-medium gap-2" aria-label="Timer" checked />
     <div role="tabpanel" class="tab-content bg-base-100 border-base-300 rounded-box p-6">
       {allClients.length === 0 ? (
-        <div class="alert alert-warning">
+        <div class="alert alert-warning flex flex-col sm:flex-row items-center gap-4">
-          <span>You need to create a client before tracking time.</span>
+          <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-          <a href="/dashboard/clients/new" class="btn btn-sm btn-primary">Add Client</a>
+          <span class="flex-1 text-center sm:text-left">You need to create a client before tracking time.</span>
+          <a href="/dashboard/clients/new" class="btn btn-sm btn-primary whitespace-nowrap">Add Client</a>
         </div>
       ) : allCategories.length === 0 ? (
-        <div class="alert alert-warning">
+        <div class="alert alert-warning flex flex-col sm:flex-row items-center gap-4">
-          <span>You need to create a category before tracking time.</span>
+          <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-          <a href="/dashboard/team/settings" class="btn btn-sm btn-primary">Team Settings</a>
+          <span class="flex-1 text-center sm:text-left">You need to create a category before tracking time.</span>
+          <a href="/dashboard/team/settings" class="btn btn-sm btn-primary whitespace-nowrap">Team Settings</a>
         </div>
       ) : (
         <Timer
@@ -192,14 +194,16 @@ const paginationPages = getPaginationPages(page, totalPages);
     <input type="radio" name="tracker_tabs" role="tab" class="tab text-base font-medium gap-2" aria-label="Manual Entry" />
     <div role="tabpanel" class="tab-content bg-base-100 border-base-300 rounded-box p-6">
       {allClients.length === 0 ? (
-        <div class="alert alert-warning">
+        <div class="alert alert-warning flex flex-col sm:flex-row items-center gap-4">
-          <span>You need to create a client before adding time entries.</span>
+          <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-          <a href="/dashboard/clients/new" class="btn btn-sm btn-primary">Add Client</a>
+          <span class="flex-1 text-center sm:text-left">You need to create a client before adding time entries.</span>
+          <a href="/dashboard/clients/new" class="btn btn-sm btn-primary whitespace-nowrap">Add Client</a>
         </div>
       ) : allCategories.length === 0 ? (
-        <div class="alert alert-warning">
+        <div class="alert alert-warning flex flex-col sm:flex-row items-center gap-4">
-          <span>You need to create a category before adding time entries.</span>
+          <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-          <a href="/dashboard/team/settings" class="btn btn-sm btn-primary">Team Settings</a>
+          <span class="flex-1 text-center sm:text-left">You need to create a category before adding time entries.</span>
+          <a href="/dashboard/team/settings" class="btn btn-sm btn-primary whitespace-nowrap">Team Settings</a>
         </div>
       ) : (
         <ManualEntry
@@ -228,7 +232,7 @@ const paginationPages = getPaginationPages(page, totalPages);
             type="text"
             name="search"
             placeholder="Search descriptions..."
-            class="input input-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors"
+            class="input input-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors w-full"
             value={searchTerm}
           />
         </div>
@@ -237,7 +241,7 @@ const paginationPages = getPaginationPages(page, totalPages);
           <label class="label">
             <span class="label-text font-medium">Client</span>
           </label>
-          <select name="client" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors" onchange="this.form.submit()">
+          <select name="client" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors w-full" onchange="this.form.submit()">
             <option value="">All Clients</option>
             {allClients.map(client => (
               <option value={client.id} selected={filterClient === client.id}>
@@ -251,7 +255,7 @@ const paginationPages = getPaginationPages(page, totalPages);
           <label class="label">
             <span class="label-text font-medium">Category</span>
           </label>
-          <select name="category" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors" onchange="this.form.submit()">
+          <select name="category" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors w-full" onchange="this.form.submit()">
             <option value="">All Categories</option>
             {allCategories.map(category => (
               <option value={category.id} selected={filterCategory === category.id}>
@@ -265,7 +269,7 @@ const paginationPages = getPaginationPages(page, totalPages);
           <label class="label">
             <span class="label-text font-medium">Status</span>
           </label>
-          <select name="status" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors" onchange="this.form.submit()">
+          <select name="status" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors w-full" onchange="this.form.submit()">
             <option value="" selected={filterStatus === ''}>All Entries</option>
             <option value="completed" selected={filterStatus === 'completed'}>Completed</option>
             <option value="running" selected={filterStatus === 'running'}>Running</option>
@@ -276,7 +280,7 @@ const paginationPages = getPaginationPages(page, totalPages);
           <label class="label">
             <span class="label-text font-medium">Entry Type</span>
           </label>
-          <select name="type" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors" onchange="this.form.submit()">
+          <select name="type" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors w-full" onchange="this.form.submit()">
             <option value="" selected={filterType === ''}>All Types</option>
             <option value="timed" selected={filterType === 'timed'}>Timed</option>
             <option value="manual" selected={filterType === 'manual'}>Manual</option>
@@ -287,7 +291,7 @@ const paginationPages = getPaginationPages(page, totalPages);
           <label class="label">
             <span class="label-text font-medium">Sort By</span>
           </label>
-          <select name="sort" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors" onchange="this.form.submit()">
+          <select name="sort" class="select select-bordered bg-base-300/50 hover:bg-base-300 focus:bg-base-300 border-base-300/50 focus:border-primary transition-colors w-full" onchange="this.form.submit()">
             <option value="start-desc" selected={sortBy === 'start-desc'}>Newest First</option>
             <option value="start-asc" selected={sortBy === 'start-asc'}>Oldest First</option>
             <option value="duration-desc" selected={sortBy === 'duration-desc'}>Longest Duration</option>

src/pages/index.astro

@@ -7,10 +7,10 @@ if (Astro.locals.user) {
 ---
 
 <Layout title="Chronus - Time Tracking">
-  <div class="hero h-full bg-linear-to-br from-base-100 via-base-200 to-base-300 flex items-center justify-center py-12">
+  <div class="hero flex-1 bg-linear-to-br from-base-100 via-base-200 to-base-300 flex items-center justify-center py-12">
     <div class="hero-content text-center">
       <div class="max-w-4xl">
-        <img src="/src/assets/logo.webp" alt="Chronus Logo" class="h-24 w-24 mx-auto mb-6" />
+        <img src="/logo.webp" alt="Chronus Logo" class="h-24 w-24 mx-auto mb-6" />
         <h1 class="text-6xl md:text-7xl font-bold mb-6 text-primary">
           Chronus
         </h1>

src/pages/login.astro

@@ -1,19 +1,69 @@
 ---
 import Layout from '../layouts/Layout.astro';
+import { Icon } from 'astro-icon/components';
 
 if (Astro.locals.user) {
   return Astro.redirect('/dashboard');
 }
+
+const error = Astro.url.searchParams.get('error');
+const errorMessage =
+  error === 'invalid_credentials'
+    ? 'Invalid email or password'
+    : error === 'missing_fields'
+      ? 'Please fill in all fields'
+      : null;
 ---
 
 <Layout title="Login - Chronus">
-  <div class="flex justify-center items-center min-h-screen bg-base-100">
+  <script>
+    import { startAuthentication } from "@simplewebauthn/browser";
+
+    const loginBtn = document.getElementById("passkey-login");
+
+    loginBtn?.addEventListener("click", async () => {
+      // 1. Get options from server
+      const resp = await fetch("/api/auth/passkey/login/start");
+      const options = await resp.json();
+
+      // 2. Browser handles interaction
+      let asseResp;
+      try {
+        asseResp = await startAuthentication(options);
+      } catch (error) {
+        console.error(error);
+        return;
+      }
+
+      // 3. Verify with server
+      const verificationResp = await fetch("/api/auth/passkey/login/finish", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(asseResp),
+      });
+
+      const verificationJSON = await verificationResp.json();
+      if (verificationJSON.verified) {
+        window.location.href = "/dashboard";
+      } else {
+        alert("Login failed");
+      }
+    });
+  </script>
+  <div class="flex justify-center items-center flex-1 bg-base-100">
     <div class="card bg-base-100 shadow-2xl w-full max-w-md mx-4">
       <div class="card-body">
-        <img src="/src/assets/logo.webp" alt="Chronus" class="h-16 w-16 mx-auto mb-4" />
+        <img src="/logo.webp" alt="Chronus" class="h-16 w-16 mx-auto mb-4" />
         <h2 class="text-3xl font-bold text-center mb-2">Welcome Back</h2>
         <p class="text-center text-base-content/60 mb-6">Sign in to continue to Chronus</p>
 
+        {errorMessage && (
+          <div role="alert" class="alert alert-error mb-4">
+            <Icon name="heroicons:exclamation-circle" class="w-6 h-6" />
+            <span>{errorMessage}</span>
+          </div>
+        )}
+
         <form action="/api/auth/login" method="POST" class="space-y-4">
           <label class="form-control">
             <div class="label">
@@ -44,6 +94,11 @@ if (Astro.locals.user) {
           <button class="btn btn-primary w-full mt-6">Sign In</button>
         </form>
 
+        <button id="passkey-login" class="btn btn-secondary w-full mt-4">
+          <Icon name="heroicons:finger-print" class="w-5 h-5 mr-2" />
+          Sign in with Passkey
+        </button>
+
         <div class="divider">OR</div>
 
         <div class="text-center">

src/pages/signup.astro

@@ -20,16 +20,33 @@ if (!isFirstUser) {
     .get();
   registrationDisabled = registrationSetting?.value !== 'true';
 }
+
+const error = Astro.url.searchParams.get('error');
+const errorMessage =
+  error === 'user_exists'
+    ? 'An account with this email already exists'
+    : error === 'missing_fields'
+      ? 'Please fill in all fields'
+      : error === 'registration_disabled'
+        ? 'Registration is currently disabled'
+        : null;
 ---
 
 <Layout title="Sign Up - Chronus">
-  <div class="flex justify-center items-center min-h-screen bg-base-100">
+  <div class="flex justify-center items-center flex-1 bg-base-100">
     <div class="card bg-base-100 shadow-2xl w-full max-w-md mx-4">
       <div class="card-body">
-        <img src="/src/assets/logo.webp" alt="Chronus" class="h-16 w-16 mx-auto mb-4" />
+        <img src="/logo.webp" alt="Chronus" class="h-16 w-16 mx-auto mb-4" />
         <h2 class="text-3xl font-bold text-center mb-2">Create Account</h2>
         <p class="text-center text-base-content/60 mb-6">Join Chronus to start tracking time</p>
 
+        {errorMessage && (
+          <div role="alert" class="alert alert-error mb-4">
+            <Icon name="heroicons:exclamation-circle" class="w-6 h-6" />
+            <span>{errorMessage}</span>
+          </div>
+        )}
+
         {registrationDisabled ? (
           <>
             <div class="alert alert-warning">

src/pages/uploads/[...path].ts

@@ -0,0 +1,70 @@
+import type { APIRoute } from "astro";
+import { promises as fs, constants } from "fs";
+import path from "path";
+
+export const GET: APIRoute = async ({ params }) => {
+  const filePathParam = params.path;
+
+  if (!filePathParam) {
+    return new Response("Not found", { status: 404 });
+  }
+
+  const dataDir = process.env.DATA_DIR
+    ? process.env.DATA_DIR
+    : import.meta.env.DATA_DIR;
+
+  if (!dataDir) {
+    return new Response("DATA_DIR environment variable is not set", {
+      status: 500,
+    });
+  }
+
+  const uploadDir = path.join(dataDir, "uploads");
+
+  const safePath = path.normalize(filePathParam).replace(/^(\.\.[\/\\])+/, "");
+  const fullPath = path.join(uploadDir, safePath);
+
+  if (!fullPath.startsWith(uploadDir)) {
+    return new Response("Forbidden", { status: 403 });
+  }
+
+  try {
+    await fs.access(fullPath, constants.R_OK);
+    const fileStats = await fs.stat(fullPath);
+
+    if (!fileStats.isFile()) {
+      return new Response("Not found", { status: 404 });
+    }
+
+    const fileContent = await fs.readFile(fullPath);
+
+    const ext = path.extname(fullPath).toLowerCase();
+    let contentType = "application/octet-stream";
+
+    switch (ext) {
+      case ".png":
+        contentType = "image/png";
+        break;
+      case ".jpg":
+      case ".jpeg":
+        contentType = "image/jpeg";
+        break;
+      case ".gif":
+        contentType = "image/gif";
+        break;
+      case ".svg":
+        contentType = "image/svg+xml";
+        break;
+      // WebP is intentionally omitted as it is not supported in PDF generation
+    }
+
+    return new Response(fileContent, {
+      headers: {
+        "Content-Type": contentType,
+        "Cache-Control": "public, max-age=31536000, immutable",
+      },
+    });
+  } catch (error) {
+    return new Response("Not found", { status: 404 });
+  }
+};

src/pdf/generateInvoicePDF.ts

@@ -1,5 +1,7 @@
 import { h } from "vue";
-import { Document, Page, Text, View } from "@ceereals/vue-pdf";
+import { Document, Page, Text, View, Image } from "@ceereals/vue-pdf";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
 import type { Style } from "@react-pdf/types";
 
 interface InvoiceItem {
@@ -13,6 +15,11 @@ interface InvoiceItem {
 interface Client {
   name: string;
   email: string | null;
+  street: string | null;
+  city: string | null;
+  state: string | null;
+  zip: string | null;
+  country: string | null;
 }
 
 interface Organization {
@@ -22,6 +29,7 @@ interface Organization {
   state: string | null;
   zip: string | null;
   country: string | null;
+  logoUrl?: string | null;
 }
 
 interface Invoice {
@@ -32,6 +40,9 @@ interface Invoice {
   dueDate: Date;
   currency: string;
   subtotal: number;
+  discountValue: number | null;
+  discountType: string | null;
+  discountAmount: number | null;
   taxRate: number | null;
   taxAmount: number;
   total: number;
@@ -67,6 +78,12 @@ const styles = {
     flex: 1,
     maxWidth: 280,
   } as Style,
+  logo: {
+    height: 40,
+    marginBottom: 8,
+    objectFit: "contain",
+    objectPosition: "left",
+  } as Style,
   headerRight: {
     flex: 1,
     alignItems: "flex-end",
@@ -84,40 +101,7 @@ const styles = {
     lineHeight: 1.5,
     marginBottom: 12,
   } as Style,
-  statusBadge: {
+
-    paddingHorizontal: 12,
-    paddingVertical: 4,
-    borderRadius: 6,
-    fontSize: 9,
-    fontWeight: "bold",
-    textTransform: "uppercase",
-    letterSpacing: 1,
-    alignSelf: "flex-start",
-  } as Style,
-  statusDraft: {
-    backgroundColor: "#F3F4F6",
-    color: "#6B7280",
-  } as Style,
-  statusSent: {
-    backgroundColor: "#DBEAFE",
-    color: "#1E40AF",
-  } as Style,
-  statusPaid: {
-    backgroundColor: "#D1FAE5",
-    color: "#065F46",
-  } as Style,
-  statusAccepted: {
-    backgroundColor: "#D1FAE5",
-    color: "#065F46",
-  } as Style,
-  statusVoid: {
-    backgroundColor: "#FEE2E2",
-    color: "#991B1B",
-  } as Style,
-  statusDeclined: {
-    backgroundColor: "#FEE2E2",
-    color: "#991B1B",
-  } as Style,
   invoiceTypeContainer: {
     alignItems: "flex-end",
     marginBottom: 16,
@@ -178,6 +162,11 @@ const styles = {
     fontSize: 10,
     color: "#6B7280",
   } as Style,
+  clientAddress: {
+    fontSize: 10,
+    color: "#6B7280",
+    lineHeight: 1.5,
+  } as Style,
   table: {
     marginBottom: 40,
   } as Style,
@@ -304,24 +293,6 @@ export function createInvoiceDocument(props: InvoiceDocumentProps) {
     });
   };
 
-  const getStatusStyle = (status: string): Style => {
-    const baseStyle = styles.statusBadge;
-    switch (status) {
-      case "draft":
-        return { ...baseStyle, ...styles.statusDraft };
-      case "sent":
-        return { ...baseStyle, ...styles.statusSent };
-      case "paid":
-      case "accepted":
-        return { ...baseStyle, ...styles.statusPaid };
-      case "void":
-      case "declined":
-        return { ...baseStyle, ...styles.statusVoid };
-      default:
-        return { ...baseStyle, ...styles.statusDraft };
-    }
-  };
-
   return h(Document, [
     h(
       Page,
@@ -330,6 +301,55 @@ export function createInvoiceDocument(props: InvoiceDocumentProps) {
         // Header
         h(View, { style: styles.header }, [
           h(View, { style: styles.headerLeft }, [
+            (() => {
+              if (organization.logoUrl) {
+                try {
+                  let logoPath;
+                  // Handle uploads directory which might be external to public/
+                  if (organization.logoUrl.startsWith("/uploads/")) {
+                    const dataDir = process.env.DATA_DIR
+                      ? process.env.DATA_DIR
+                      : import.meta.env.DATA_DIR;
+
+                    if (!dataDir) {
+                      throw new Error(
+                        "DATA_DIR environment variable is not set",
+                      );
+                    }
+
+                    const uploadDir = join(dataDir, "uploads");
+
+                    const filename = organization.logoUrl.replace(
+                      "/uploads/",
+                      "",
+                    );
+                    logoPath = join(uploadDir, filename);
+                  } else {
+                    logoPath = join(
+                      process.cwd(),
+                      "public",
+                      organization.logoUrl,
+                    );
+                  }
+
+                  if (existsSync(logoPath)) {
+                    const ext = logoPath.split(".").pop()?.toLowerCase();
+                    if (ext === "png" || ext === "jpg" || ext === "jpeg") {
+                      return h(Image, {
+                        src: {
+                          data: readFileSync(logoPath),
+                          format: ext === "png" ? "png" : "jpg",
+                        },
+                        style: styles.logo,
+                      });
+                    }
+                  }
+                } catch (e) {
+                  // Ignore errors
+                }
+              }
+              return null;
+            })(),
             h(Text, { style: styles.organizationName }, organization.name),
             organization.street || organization.city
               ? h(
@@ -353,9 +373,6 @@ export function createInvoiceDocument(props: InvoiceDocumentProps) {
                   ].filter(Boolean),
                 )
               : null,
-            h(View, { style: getStatusStyle(invoice.status) }, [
-              h(Text, invoice.status),
-            ]),
           ]),
           h(View, { style: styles.headerRight }, [
             h(View, { style: styles.invoiceTypeContainer }, [
@@ -374,14 +391,16 @@ export function createInvoiceDocument(props: InvoiceDocumentProps) {
                   formatDate(invoice.issueDate),
                 ),
               ]),
-              h(View, { style: styles.metaRow }, [
+              invoice.type !== "quote"
-                h(Text, { style: styles.metaLabel }, "Due Date"),
+                ? h(View, { style: styles.metaRow }, [
-                h(
+                    h(Text, { style: styles.metaLabel }, "Due Date"),
-                  Text,
+                    h(
-                  { style: styles.metaValue },
+                      Text,
-                  formatDate(invoice.dueDate),
+                      { style: styles.metaValue },
-                ),
+                      formatDate(invoice.dueDate),
-              ]),
+                    ),
+                  ])
+                : null,
             ]),
           ]),
         ]),
@@ -393,6 +412,28 @@ export function createInvoiceDocument(props: InvoiceDocumentProps) {
           [
             h(Text, { style: styles.sectionLabel }, "Bill To"),
             h(Text, { style: styles.clientName }, client.name),
+            client.street ||
+            client.city ||
+            client.state ||
+            client.zip ||
+            client.country
+              ? h(
+                  View,
+                  { style: styles.clientAddress },
+                  [
+                    client.street ? h(Text, client.street) : null,
+                    client.city || client.state || client.zip
+                      ? h(
+                          Text,
+                          [client.city, client.state, client.zip]
+                            .filter(Boolean)
+                            .join(", "),
+                        )
+                      : null,
+                    client.country ? h(Text, client.country) : null,
+                  ].filter(Boolean),
+                )
+              : null,
             client.email
               ? h(Text, { style: styles.clientEmail }, client.email)
               : null,
@@ -465,6 +506,24 @@ export function createInvoiceDocument(props: InvoiceDocumentProps) {
                   formatCurrency(invoice.subtotal),
                 ),
               ]),
+              (invoice.discountAmount ?? 0) > 0
+                ? h(View, { style: styles.totalRow }, [
+                    h(
+                      Text,
+                      { style: styles.totalLabel },
+                      `Discount${
+                        invoice.discountType === "percentage"
+                          ? ` (${invoice.discountValue}%)`
+                          : ""
+                      }`,
+                    ),
+                    h(
+                      Text,
+                      { style: styles.totalValue },
+                      `-${formatCurrency(invoice.discountAmount ?? 0)}`,
+                    ),
+                  ])
+                : null,
               (invoice.taxRate ?? 0) > 0
                 ? h(View, { style: styles.totalRow }, [
                     h(

src/utils/invoice.ts

@@ -27,16 +27,34 @@ export async function recalculateInvoiceTotals(invoiceId: string) {
   // Note: amounts are in cents
   const subtotal = items.reduce((acc, item) => acc + item.amount, 0);
 
-  const taxRate = invoice.taxRate || 0;
+  // Calculate discount
-  const taxAmount = Math.round(subtotal * (taxRate / 100));
+  const discountType = invoice.discountType || "percentage";
+  const discountValue = invoice.discountValue || 0;
+  let discountAmount = 0;
 
-  const total = subtotal + taxAmount;
+  if (discountType === "percentage") {
+    discountAmount = Math.round(subtotal * (discountValue / 100));
+  } else {
+    // Fixed amount is assumed to be in cents
+    discountAmount = Math.round(discountValue);
+  }
+
+  // Ensure discount doesn't exceed subtotal
+  discountAmount = Math.max(0, Math.min(discountAmount, subtotal));
+
+  const taxableAmount = subtotal - discountAmount;
+
+  const taxRate = invoice.taxRate || 0;
+  const taxAmount = Math.round(taxableAmount * (taxRate / 100));
+
+  const total = taxableAmount + taxAmount;
 
   // Update invoice
   await db
     .update(invoices)
     .set({
       subtotal,
+      discountAmount,
       taxAmount,
       total,
     })