CE sign-in/out tracking + attendance report

.github/copilot-instructions.md

@@ -229,6 +229,7 @@ this). Match the existing pattern:
 
 - ES6+ syntax, ESM imports/exports, `const`/`let` (no `var`)
 - Use `const` for fixed values — not `SCREAMING_SNAKE_CASE` constants (e.g., `const styleId = "foo"` not `const STYLE_ID = "foo"`)
+- **Default to no new JavaScript.** Prefer a server-rendered (ERB/decorator/helper) or Turbo solution over adding a new Stimulus controller. Only reach for JS when the behavior genuinely can't be done server-side or with Turbo (e.g. it needs live client-side state, the browser's own time zone, or DOM the server can't produce). If a change seems to need JS, first ask whether rendering it on the server — even with a small trade-off — is acceptable, and flag that trade-off. When JS is truly required, reuse or generalize an existing controller before writing a new one.
 - **Strongly prefer Stimulus** for JavaScript behavior — do not write raw/inline JS or jQuery
 - **Always use Tailwind CSS** utility classes for styling — do not write custom CSS unless absolutely necessary
 - **Prefer static Tailwind classes over dynamically-constructed ones.** Tailwind's JIT scanner only generates classes it finds as complete literal strings in the source — a class built by interpolation (e.g. `bg-#{color}-500`, `text-${size}`, `class="w-#{n}"`) won't be generated and silently renders unstyled. Write the full class names out, and select between complete literals (e.g. a lookup hash mapping a value to a whole class string, or a ternary picking between two literal classes) rather than splicing fragments. Only build a class dynamically when the set of values is open-ended and can't be enumerated; in that case add the candidates to the Tailwind safelist.

AGENTS.md

@@ -97,6 +97,7 @@ This codebase (Rails 8.1)
 | `Event` | Events with registrations, featured/published states |
 | `EventStaff` | Join model connecting `Person` to `Event` as staff (title, `expected_to_attend`); drives the "Meet the staff" roster and "My events" |
 | `EventRegistrationChecklistCompletion` | Audited completion row for one manual onboarding step on an `EventRegistration` (`step` from `EventRegistration::CHECKLIST_STEPS`, `completed_by` User, `completed_at`); row-exists = done. Powers the event Onboarding tab's checkbox matrix |
+| `EventAttendanceTimeEntry` | One sign-in/sign-out pair for a registrant on a day of an event (`signed_in_at`, `signed_out_at` — nil while "open"/still signed in; `created_by`/`updated_by` stamped only on staff edits, nil for registrant self-service). Generic day-of-event timekeeping (many per day for breaks/lunch), currently surfaced only on the CE callout when CE is paid; `EventAttendanceReport` totals minutes per day. Sign-in window derives from `Event#attendance_sign_in_open?` |
 | `RegistrationTicketCallout` | Call-outs shown on an event's registration ticket (title, subtitle, HTML description, `callout_type` action/reference, icon/colour, `payment_access_gated` — only shown once the registrant has `payment_access_granted?`, draggable `position`, `hidden` draft/opt-out, `display_from` drip date, and `has_many :resources` through `RegistrationTicketCalloutResource`); each links to its own public detail page. A nil `builtin_key` is an admin-authored callout; a set `builtin_key` is a built-in card materialized by `BuiltinCallouts` (hidden instead of deleted, restorable to default) |
 | `RegistrationTicketCalloutResource` | Ordered join linking a `RegistrationTicketCallout` to the `Resource`s shown on its detail page |
 | `Story` | Editorial content with facilitators, primary/gallery assets |
@@ -199,6 +200,8 @@ action, or `authorize! :workshop, to: :summary?`).
 - `EventParticipationReport` — Cross-event participation report grouped by calendar year (unique people trained vs attended seats vs per-status outcome counts, chart series) for the events participation page; sibling of `EventRevenueReport`
 - `ReportPeriods` — Shared module (included by `EventRevenueReport` and `EventParticipationReport`) resolving the reporting-hub period toggle (this year / last year / all time) to a metric scope + label for the summary cards
 - `EventScholarshipReport` — Cross-event scholarship report grouped by calendar year: scholarship dollars and award counts (funded vs unfunded, via `EventDashboard`) per facilitator training, plus an attended-trainee count split into "Training" (scheduled) vs "On-demand" (`event.on_demand?`). Sibling of `EventRevenueReport`/`EventParticipationReport` (includes `ReportPeriods`); powers the `events#scholarships` report page and the statistics-hub scholarship summary card
+- `EventAttendanceReport` — Per-event attendance sign-in/out report from `EventAttendanceTimeEntry`, grouped by day then registrant with per-day and grand-total minutes; `ce_only:` scopes to CE registrants and surfaces license number + awarded hours. The in-portal CE hour sign-in sheet, linked from the participation report (`?ce=true`) at `attendance_event_path`
+- `EventAttendanceEntriesUpdate` — Applies a batch of submitted sign-in/out rows to one `EventRegistration`'s `event_attendance_time_entries` (add/correct/remove through nested attributes) and stamps `created_by`/`updated_by` with the editing admin. Shared by the CE edit form (`ContinuingEducationRegistrationsController#update`, datetime rows across every day) and the attendance report's inline per-day editor (`EventRegistrationsController#update_attendance`, clock times against one day)
 - `ScholarshipApplication` — Gathers one person's scholarship-application answers for an event by field across all their submissions, so answers surface whether captured on a dedicated scholarship form, an embedded registration section, or the registration submission itself (used by the scholarship edit page and the public submission view)
 - `WorkshopSearchService` — Complex filtering, sorting, pagination with ActionPolicy
 - `WorkshopFromIdeaService` — Converts WorkshopIdea to Workshop with asset migration

CLAUDE.md

@@ -239,6 +239,7 @@ this). Match the existing pattern:
 
 - ES6+ syntax, ESM imports/exports, `const`/`let` (no `var`)
 - Use `const` for fixed values — not `SCREAMING_SNAKE_CASE` constants (e.g., `const styleId = "foo"` not `const STYLE_ID = "foo"`)
+- **Default to no new JavaScript.** Prefer a server-rendered (ERB/decorator/helper) or Turbo solution over adding a new Stimulus controller. Only reach for JS when the behavior genuinely can't be done server-side or with Turbo (e.g. it needs live client-side state, the browser's own time zone, or DOM the server can't produce). If a change seems to need JS, first ask whether rendering it on the server — even with a small trade-off — is acceptable, and flag that trade-off. When JS is truly required, reuse or generalize an existing controller before writing a new one.
 - **Strongly prefer Stimulus** for JavaScript behavior — do not write raw/inline JS or jQuery
 - **Always use Tailwind CSS** utility classes for styling — do not write custom CSS unless absolutely necessary
 - **Prefer static Tailwind classes over dynamically-constructed ones.** Tailwind's JIT scanner only generates classes it finds as complete literal strings in the source — a class built by interpolation (e.g. `bg-#{color}-500`, `text-${size}`, `class="w-#{n}"`) won't be generated and silently renders unstyled. Write the full class names out, and select between complete literals (e.g. a lookup hash mapping a value to a whole class string, or a ternary picking between two literal classes) rather than splicing fragments. Only build a class dynamically when the set of values is open-ended and can't be enumerated; in that case add the candidates to the Tailwind safelist.

app/controllers/application_controller.rb

@@ -35,6 +35,16 @@ def csv_dollars(cents)
     cents.positive? ? helpers.dollars_from_cents(cents) : ""
   end
 
+  # A failed save's errors as one flash-ready sentence. Errors on a nested association
+  # arrive keyed "<association>.<attribute>", and their full message pastes the
+  # humanized association name in front — fine for "Hours can't be blank", wrong for a
+  # child validation written as a whole sentence, so those show verbatim.
+  def error_sentence(record)
+    record.errors.map { |error|
+      error.attribute.to_s.include?(".") ? error.message : error.full_message
+    }.to_sentence
+  end
+
   def after_sign_out_path_for(resource_or_scope)
     if params[:reset_password].present? # needed for custom "log out and reset it" flow
       new_user_password_path

app/controllers/continuing_education_registrations_controller.rb

@@ -22,8 +22,8 @@ def create
       @ce_registration.save!
     end
     redirect_to edit_event_registration_path(@ce_registration.event_registration), notice: "CE registration created.", status: :see_other
-  rescue ActiveRecord::RecordInvalid
-    flash.now[:alert] = @ce_registration.errors.full_messages.to_sentence
+  rescue ActiveRecord::RecordInvalid => e
+    flash.now[:alert] = error_sentence(e.record)
     render :new, status: :unprocessable_content
   end
 
@@ -37,10 +37,11 @@ def update
     ActiveRecord::Base.transaction do
       apply_ce_params(@ce_registration)
       @ce_registration.save!
+      apply_time_entries(@ce_registration.event_registration)
     end
-    redirect_to edit_event_registration_path(@ce_registration.event_registration), notice: "CE registration updated.", status: :see_other
-  rescue ActiveRecord::RecordInvalid
-    flash.now[:alert] = @ce_registration.errors.full_messages.to_sentence
+    redirect_to after_ce_path(@ce_registration.event_registration), notice: "CE registration updated.", status: :see_other
+  rescue ActiveRecord::RecordInvalid => e
+    flash.now[:alert] = error_sentence(e.record)
     render :edit, status: :unprocessable_content
   end
 
@@ -54,7 +55,7 @@ def destroy
 
     registration = @ce_registration.event_registration
     @ce_registration.destroy!
-    redirect_to edit_event_registration_path(registration), notice: "CE registration removed.", status: :see_other
+    redirect_to after_ce_path(registration), notice: "CE registration removed.", status: :see_other
   end
 
   def toggle_certificate
@@ -67,6 +68,17 @@ def toggle_certificate
 
   private
 
+  # After save/destroy, return to the CE sign-in report when the page was opened
+  # from there (return_to=attendance, kept in sync with the edit view's eyebrow);
+  # otherwise the registration edit page.
+  def after_ce_path(registration)
+    if params[:return_to] == "attendance"
+      attendance_event_path(registration.event, ce: "true", anchor: "totals")
+    else
+      edit_event_registration_path(registration)
+    end
+  end
+
   def set_ce_registration
     @ce_registration = ContinuingEducationRegistration.find(params[:id])
   end
@@ -96,4 +108,18 @@ def apply_ce_params(ce_registration)
       .permit(comments_attributes: [ :id, :topic, :body, :flagged, :_destroy ])[:comments_attributes]
     ce_registration.comments_attributes = comments if comments.present?
   end
+
+  # Staff corrections to the registrant's attendance times, submitted alongside the
+  # CE form under continuing_education_registration[time_entries] as full datetimes
+  # (this form spans every day, unlike the report's per-day editor).
+  def apply_time_entries(registration)
+    EventAttendanceEntriesUpdate.new(registration, time_entries_attributes, editor: current_user).save!
+  end
+
+  def time_entries_attributes
+    params.fetch(:continuing_education_registration, {})
+          .permit(time_entries: [ :id, :signed_in_at, :signed_out_at, :_destroy ])
+          .fetch(:time_entries, {})
+          .values
+  end
 end

app/controllers/event_registrations_controller.rb

@@ -2,7 +2,7 @@ class EventRegistrationsController < ApplicationController
   require "csv"
 
   # show redirects to slug URL; kept for backwards compatibility
-  before_action :set_event_registration, only: [ :show, :edit, :update, :destroy, :update_onboarding ]
+  before_action :set_event_registration, only: [ :show, :edit, :update, :destroy, :update_onboarding, :update_attendance ]
 
   def index
     authorize!
@@ -104,6 +104,7 @@ def update
           when "ticket" then redirect_to registration_ticket_path(@event_registration.slug), notice: notice, status: :see_other
           when "preview_reminder" then redirect_to preview_reminder_event_path(@event_registration.event), notice: notice, status: :see_other
           when "onboarding" then redirect_to helpers.onboarding_event_row_path(@event_registration.event, @event_registration.id), notice: notice, status: :see_other
+          when "attendance" then redirect_to attendance_event_path(@event_registration.event), notice: notice, status: :see_other
           else
             # No explicit origin: keep admins in the management context (the
             # roster) rather than dropping them on the public registration show.
@@ -155,6 +156,28 @@ def update_onboarding
     end
   end
 
+  # Inline correction of one registrant's sign-in/out times for one training day, from
+  # the event's attendance report. Rows carry clock times only — the day comes from the
+  # report section the editor was opened in — plus a blank row to add a session and a
+  # Remove box to drop one. Registrants still stamp their own times from the CE callout;
+  # this is where staff fix a missed sign-in or a forgotten sign-out without leaving the
+  # report.
+  def update_attendance
+    authorize! @event_registration, to: :update_attendance?
+    date = attendance_date_param
+    return head :unprocessable_content unless date
+
+    rows = attendance_rows(date)
+    EventAttendanceEntriesUpdate.new(@event_registration, rows, editor: current_user).save!
+    redirect_to attendance_report_path(date), notice: "Attendance times updated.", status: :see_other
+  rescue ActiveRecord::RecordInvalid => e
+    flash[:alert] = error_sentence(e.record)
+    # Hand the submitted times back so a rejected save doesn't cost the admin what
+    # they typed; the editor reopens on this cell prefilled with them.
+    flash[:attendance_rows] = submitted_attendance_rows
+    redirect_to attendance_report_path(date, reopen: true), status: :see_other
+  end
+
   def confirm
     @event_registration = EventRegistration.includes(registrant: :user, event: :location).find(params[:id])
     authorize! @event_registration, to: :confirm?
@@ -319,6 +342,51 @@ def set_event_registration
     @event_registration = EventRegistration.includes({ registrant: [ :user, { affiliations: :organization } ] }, { event: [ :location, :event_forms ] }, :organizations, comments: [ :created_by, :updated_by ]).find(params[:id])
   end
 
+  # The training day the inline editor was opened on. Nil for anything unparseable —
+  # the date comes from the report's own sections, so a bad one is a broken request.
+  def attendance_date_param
+    Date.iso8601(params[:date].to_s)
+  rescue ArgumentError
+    nil
+  end
+
+  # The submitted sessions as attendance-entry attributes. Clock times ("08:50") are
+  # combined with the editor's day, since a session belongs to the day it's listed
+  # under; the CE edit page stays the place to enter a pair that crosses midnight.
+  def attendance_rows(date)
+    submitted_attendance_rows.map do |row|
+      { "id" => row["id"],
+        "signed_in_at" => attendance_time(date, row["in"]),
+        "signed_out_at" => attendance_time(date, row["out"]),
+        "_destroy" => row["_destroy"] }
+    end
+  end
+
+  def submitted_attendance_rows
+    params.fetch(:attendance, {})
+          .permit(entries: [ :id, :in, :out, :_destroy ])
+          .fetch(:entries, {})
+          .values
+          .map { |row| row.to_h.stringify_keys }
+  end
+
+  # Blank stays blank: an empty sign-in marks an untouched row (dropped by the
+  # association's reject_if), an empty sign-out leaves the session open.
+  def attendance_time(date, clock)
+    return nil if clock.blank?
+
+    Time.zone.parse("#{date.iso8601} #{clock}")
+  end
+
+  # Back to the report in read mode, scrolled to the day cell that was edited, keeping
+  # whichever view the admin had open. `reopen:` puts that cell back into edit mode.
+  def attendance_report_path(date, reopen: false)
+    cell = helpers.attendance_cell_id(@event_registration, date)
+    attendance_event_path(@event_registration.event,
+      ce: params[:ce].presence, group: params[:group].presence, return_to: params[:return_to].presence,
+      edit: (cell if reopen), anchor: cell)
+  end
+
   # Creates the audited completion row for a checklist step (recording who/when),
   # or removes it — so an unchecked step leaves no trace.
   def toggle_checklist_step(step, completed)