Time Settings

Path: /time/settings. The page uses the standard ModuleSettingsLayout with sub-tabs.

Screenshot needed — /time/settings General tab with the workspace defaults form

General

Single form, persisted in the time_tracking_settings table (one row per workspace, lazy-created on first read).

Entry locking

Path: /time/settings → Entry Locking card.

When a lock date is set, every create / update / delete server action checks entry.log_date <= lock_date and rejects the write with a clear error message for non-admins. The check applies regardless of surface (timer, manual, API, calendar-import convert).

Locked entries display a 🔒 Lock indicator in List view. The Edit / Delete / Split actions are hidden; the Copy timer link action stays active so a locked entry can still be re-played as a fresh entry.

This is separate from the per-entry approval lock: an approved entry (locked_at set by the approval trigger) is locked individually regardless of the workspace lock date.

Tracking reminders

Path: /time/settings → General form → Reminders section.

When reminder_enabled is on, the daily cron at the configured reminder_send_time_utc evaluates each workspace member:

• Daily: if yesterday's tracked hours < reminder_min_daily_hours, send a reminder email + in-app notification. Skipped on weekends and on days the user has already tracked above the threshold.
• Weekly: every Monday, if last week's total < reminder_min_weekly_hours, send a weekly reminder.

Reminders surface inside Workestra (notification bell) and in email — no Slack DM yet (planned).

A user who tracks zero on day N and zero on day N+1 gets one reminder, not two — the cron de-duplicates to avoid nag fatigue.

Audit log

Path: /time/settings/audit-log (admins only). Lists every state-changing action on time_entries rows: create, update, delete, split, lock, submit, approve, reject.

Each row expands to show the before / after diff for update events: the original hours / log_date / description / project_id / billable / tags vs. the new values. For on-behalf-of writes, the diff also includes on_behalf_of so the trail names the target user.

Pagination: 50 rows per page, ordered newest first.

Rates

Pro — requires Finance subscription.

Top-down rate-resolution chain — see Rates & Billing for full priority logic.

UI on /time/settings/rates is structured top-to-bottom in priority order:

1. Workspace default — fallback for everyone (the card at the top)
2. User / project rate overrides — most-specific-wins matrix below
3. Per-task rate overrides (P1-9) — bottom section. The 5th, most specific level: when a time entry is on a task, a task-rate override beats the project + user combination.

Each section: Add row → pick scope, set rate / currency / effective dates → save. Inline edit; soft-confirm delete.

Constraints:

• User / project overrides must set at least one of user_id or project_id
• Per-task rate is keyed on task_id only
• Effective date range must be valid (from ≤ to if both set)

Approvers

(Pro) Multi-level approval routes — the heart of the Time Pro approval flow. See Approvals for routing semantics.

UI on /time/settings/approvers shows every route grouped by scope (user / team / project / workspace). Each row:

• Scope (e.g. "Team: Engineering")
• Levels (1, 2, 3, …) with the approver + optional fallback per level
• Edit / delete buttons

The free tier still uses the simpler model: anyone with time:approve permission can approve any submitted timesheet. To grant approval rights:

1. Go to Teams → Roles
2. Edit (or create) a role
3. Check the time:approve permission
4. Assign the role to the relevant users

Workspace admins automatically have time:approve regardless of role.

Integrations

Three sub-tabs: Native integrations, Browser extensions, Webhooks.

Native integrations

External calendars (Google / Outlook / iCal) connect from here. See Calendar Import for the full flow. Disconnect with one click.

Browser extensions

Direct download buttons for Chrome and Firefox + a list of supported apps the extension injects into. See Browser Extension.

Webhooks

The webhooks UI. See Integrations for full event list and delivery semantics.

Per webhook row:

• Name — friendly label
• URL — endpoint to receive POSTs
• Secret — generated once (visible in a one-time dialog after save), used for HMAC signing
• Events — multi-select from the available event list
• Enabled toggle
• Test button — fires a synthetic webhook.test event
• Delivery log — last 50 attempts with status, response code, response body

Don't roll your own outbound webhooks elsewhere — the factory handles HMAC, retries, dead-letter queuing, and the daily delivery cron. Hitting it manually defeats those guarantees.

Permissions

Time-tracking-specific permissions:

Configure these on the Teams → Roles page.

Database tables (advanced — for admins / devs)

If you ever need to inspect the underlying data, the time module owns these tables:

All workspace-scoped via RLS.

---

Next steps

• Timer — try the core flow once settings are configured
• Approvals — assign the time:approve permission to managers