feat: log staff sign-in and sign-out and force logout at a set time

apps/api/src/attendance/workday.interceptor.ts

@@ -0,0 +1,27 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common';
+import type { Actor } from '../common/record-scope';
+import { AttendanceService } from './attendance.service';
+
+@Injectable()
+export class WorkdayInterceptor implements NestInterceptor {
+  constructor(private readonly attendance: AttendanceService) {}
+
+  async intercept(context: ExecutionContext, next: CallHandler) {
+    if (context.getType() !== 'http') return next.handle();
+    const req = context.switchToHttp().getRequest<{
+      user?: Actor;
+      originalUrl?: string;
+      url?: string;
+    }>();
+    const actor = req.user;
+    const path = req.originalUrl || req.url || '';
+    if (!actor?.userId || path.includes('/auth/logout')) return next.handle();
+    await this.attendance.assertSession(actor);
+    return next.handle();
+  }
+}