Merge pull request #14759 from opf/fix/time-tracking-error-with-ongoi…

…ng-time-entry

fix time entries endpoint to return ongoing time entries while lacking log own time permission

modules/costs/app/models/time_entries/scopes/ongoing.rb

@@ -37,7 +37,12 @@ def ongoing
 
       def visible_ongoing(user = User.current)
         TimeEntry
-          .where(work_package_id: WorkPackage.allowed_to(user, :log_own_time), user:, ongoing: true)
+          .where(work_package_id: visible_work_packages(user).select(:id), user:, ongoing: true)
+      end
+
+      def visible_work_packages(user)
+        WorkPackage.allowed_to(user, :log_own_time).or(
+          WorkPackage.where(project_id: Project.allowed_to(User.current, :log_time)))
       end
 
       def not_ongoing

modules/costs/spec/models/queries/time_entries/time_entry_query_integration_spec.rb

@@ -55,6 +55,14 @@
       it 'only returns the users own time entries' do
         expect(subject).to contain_exactly(user_timer)
       end
+
+      context 'when user has log_time permission' do
+        let(:user) { create(:user, member_with_permissions: { project => %i[log_time] }) }
+
+        it 'still returns the users own time entries' do
+          expect(subject).to contain_exactly(user_timer)
+        end
+      end
     end
   end
 end