feat(contacts): store contact submissions

apps/clients/api/serializers.py

@@ -3,32 +3,65 @@ from apps.clients.models import Client
 from core.serializers.base import BaseModelSerializer
 
 
-class ClientSerializer(BaseModelSerializer):
+class ClientSerializer(BaseModelSerializer):
     """
     Serializer for retrieving and representing client details.
     """
     class Meta:
         model = Client
-        fields = BaseModelSerializer.Meta.fields + (
-            "workspace",
-            "name",
-            "notes",
-        )
-        read_only_fields = fields
+        fields = BaseModelSerializer.Meta.fields + (
+            "workspace",
+            "name",
+            "notes",
+            "thumbnail",
+        )
+        read_only_fields = fields
+
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        request = self.context.get("request")
+        if instance.thumbnail:
+            thumbnail_url = instance.thumbnail.url
+            data["thumbnail"] = request.build_absolute_uri(thumbnail_url) if request else thumbnail_url
+        else:
+            data["thumbnail"] = None
+        return data
+
+
+def validate_thumbnail(value):
+    if value is None:
+        return value
+    max_bytes = 2 * 1024 * 1024
+    if getattr(value, "size", 0) > max_bytes:
+        raise serializers.ValidationError("Image size must be 2MB or less.")
+    content_type = (getattr(value, "content_type", "") or "").lower()
+    allowed_types = {"image/jpeg", "image/png", "image/webp"}
+    if content_type and content_type not in allowed_types:
+        raise serializers.ValidationError("Unsupported image type. Use JPG, PNG, or WebP.")
+    return value
 
 
 class ClientCreateSerializer(serializers.Serializer):
     """
     Serializer for handling input data during client creation.
     """
-    workspace_id = serializers.UUIDField()
-    name = serializers.CharField(max_length=255)
-    notes = serializers.CharField(allow_blank=True, required=False, default="")
+    workspace_id = serializers.UUIDField()
+    name = serializers.CharField(max_length=255)
+    notes = serializers.CharField(allow_blank=True, required=False, default="")
+    thumbnail = serializers.ImageField(required=False, allow_null=True)
+
+    def validate_thumbnail(self, value):
+        return validate_thumbnail(value)
 
 
 class ClientUpdateSerializer(serializers.Serializer):
     """
     Serializer for handling input data during client updates.
     """
-    name = serializers.CharField(max_length=255, required=False)
-    notes = serializers.CharField(allow_blank=True, required=False)
+    name = serializers.CharField(max_length=255, required=False)
+    notes = serializers.CharField(allow_blank=True, required=False)
+    thumbnail = serializers.ImageField(required=False, allow_null=True)
+    clear_thumbnail = serializers.BooleanField(required=False, default=False)
+
+    def validate_thumbnail(self, value):
+        return validate_thumbnail(value)

apps/clients/api/views.py

@@ -61,12 +61,13 @@ class ClientViewSet(ModelViewSet):
         
         client = create_client(
             user=request.user,
-            workspace_id=serializer.validated_data["workspace_id"],
-            name=serializer.validated_data["name"],
-            notes=serializer.validated_data.get("notes", "")
-        )
-        
-        output_serializer = ClientSerializer(client)
+            workspace_id=serializer.validated_data["workspace_id"],
+            name=serializer.validated_data["name"],
+            notes=serializer.validated_data.get("notes", ""),
+            thumbnail=serializer.validated_data.get("thumbnail"),
+        )
+        
+        output_serializer = ClientSerializer(client, context={"request": request})
         return Response(output_serializer.data, status=status.HTTP_201_CREATED)
 
     def update(self, request, *args, **kwargs):
@@ -80,12 +81,14 @@ class ClientViewSet(ModelViewSet):
         serializer.is_valid(raise_exception=True)
         
         updated_client = update_client(
-            client=client,
-            name=serializer.validated_data.get("name"),
-            notes=serializer.validated_data.get("notes")
-        )
-        
-        output_serializer = ClientSerializer(updated_client)
+            client=client,
+            name=serializer.validated_data.get("name"),
+            notes=serializer.validated_data.get("notes"),
+            thumbnail=serializer.validated_data.get("thumbnail"),
+            clear_thumbnail=serializer.validated_data.get("clear_thumbnail", False),
+        )
+        
+        output_serializer = ClientSerializer(updated_client, context={"request": request})
         return Response(output_serializer.data, status=status.HTTP_200_OK)
 
     def destroy(self, request, *args, **kwargs):

apps/clients/migrations/0002_client_thumbnail.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.12 on 2026-05-26 08:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('clients', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='client',
+            name='thumbnail',
+            field=models.ImageField(blank=True, null=True, upload_to='profile/clients/'),
+        ),
+    ]

apps/clients/models.py

@@ -17,6 +17,8 @@ class Client(BaseModel):
 
     notes = models.TextField(blank=True)
 
+    thumbnail = models.ImageField(upload_to="profile/clients/", blank=True, null=True)
+
     class Meta:
         db_table = "client"
         ordering = ("-updated_at", "-created_at")

apps/clients/services/clients.py

@@ -3,7 +3,7 @@ from apps.clients.models import Client
 from apps.workspaces.models import WorkspaceMembership
 
 
-def create_client(user, workspace_id, name, notes=""):
+def create_client(user, workspace_id, name, notes="", thumbnail=None):
     """
     Creates a new client after validating workspace membership and name uniqueness.
     """
@@ -23,12 +23,13 @@ def create_client(user, workspace_id, name, notes=""):
         workspace_id=workspace_id,
         name=name,
         notes=notes,
+        thumbnail=thumbnail,
         created_by=user,
         updated_by=user,
     )
-
-
-def update_client(client, name=None, notes=None):
+
+
+def update_client(client, name=None, notes=None, thumbnail=None, clear_thumbnail=False):
     """
     Updates an existing client while validating name uniqueness within the workspace.
     """
@@ -37,8 +38,20 @@ def update_client(client, name=None, notes=None):
             raise ValidationError({"name": "مشتری با این نام در این فضای کاری وجود دارد."})
         client.name = name
 
-    if notes is not None:
-        client.notes = notes
-
-    client.save(update_fields=["name", "notes", "updated_at"])
-    return client
+    if notes is not None:
+        client.notes = notes
+
+    old_thumbnail_name = client.thumbnail.name if client.thumbnail else None
+    if clear_thumbnail and client.thumbnail:
+        client.thumbnail.delete(save=False)
+        client.thumbnail = None
+
+    if thumbnail is not None:
+        client.thumbnail = thumbnail
+
+    client.save(update_fields=["name", "notes", "thumbnail", "updated_at"])
+    if old_thumbnail_name and client.thumbnail and client.thumbnail.name != old_thumbnail_name:
+        storage = client.thumbnail.storage
+        if storage.exists(old_thumbnail_name):
+            storage.delete(old_thumbnail_name)
+    return client

apps/contacts/__init__.py

@@ -0,0 +1 @@
+

apps/contacts/admin.py

@@ -0,0 +1,56 @@
+from django.contrib import admin
+
+from apps.contacts.models import ContactSubmission
+from core.admins.base import BaseAdmin, SoftDeleteListFilter
+
+
+@admin.register(ContactSubmission)
+class ContactSubmissionAdmin(BaseAdmin):
+    list_display = (
+        "id",
+        "full_name",
+        "email",
+        "mobile",
+        "status",
+        "created_at",
+        "is_deleted",
+    )
+    list_filter = (
+        SoftDeleteListFilter,
+        "status",
+        "created_at",
+    )
+    search_fields = (
+        "first_name",
+        "last_name",
+        "email",
+        "mobile",
+        "message",
+    )
+    readonly_fields = (
+        "id",
+        "ip_address",
+        "user_agent",
+        "created_at",
+        "updated_at",
+        "created_by",
+        "updated_by",
+    )
+    fields = (
+        "first_name",
+        "last_name",
+        "email",
+        "mobile",
+        "message",
+        "status",
+        "ip_address",
+        "user_agent",
+        "created_at",
+        "updated_at",
+        "created_by",
+        "updated_by",
+    )
+
+    @admin.display(description="Full name")
+    def full_name(self, obj):
+        return f"{obj.first_name} {obj.last_name}".strip()

apps/contacts/api/__init__.py

@@ -0,0 +1 @@
+

apps/contacts/api/serializers.py

@@ -0,0 +1,43 @@
+from rest_framework import serializers
+
+from apps.contacts.models import ContactSubmission
+
+
+class ContactSubmissionCreateSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = ContactSubmission
+        fields = (
+            "first_name",
+            "last_name",
+            "email",
+            "mobile",
+            "message",
+        )
+
+    def validate_mobile(self, value):
+        clean_value = value.strip()
+        if len(clean_value) < 8:
+            raise serializers.ValidationError("Enter a valid mobile number.")
+        return clean_value
+
+    def validate_message(self, value):
+        clean_value = value.strip()
+        if len(clean_value) < 10:
+            raise serializers.ValidationError("Message must be at least 10 characters.")
+        return clean_value
+
+
+class ContactSubmissionResponseSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = ContactSubmission
+        fields = (
+            "id",
+            "first_name",
+            "last_name",
+            "email",
+            "mobile",
+            "message",
+            "status",
+            "created_at",
+        )
+        read_only_fields = fields

apps/contacts/api/throttles.py

@@ -0,0 +1,5 @@
+from rest_framework.throttling import AnonRateThrottle
+
+
+class ContactSubmissionThrottle(AnonRateThrottle):
+    scope = "contact_submission"

apps/contacts/api/urls.py

@@ -0,0 +1,9 @@
+from django.urls import path
+
+from apps.contacts.api.views import ContactSubmissionView
+
+app_name = "contacts"
+
+urlpatterns = [
+    path("", ContactSubmissionView.as_view(), name="contact-submit"),
+]

apps/contacts/api/views.py

@@ -0,0 +1,40 @@
+from drf_spectacular.utils import extend_schema
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from apps.contacts.api.serializers import (
+    ContactSubmissionCreateSerializer,
+    ContactSubmissionResponseSerializer,
+)
+from apps.contacts.api.throttles import ContactSubmissionThrottle
+
+
+def _get_client_ip(request):
+    forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+    if forwarded_for:
+        return forwarded_for.split(",")[0].strip()
+    return request.META.get("REMOTE_ADDR")
+
+
+class ContactSubmissionView(APIView):
+    permission_classes = (AllowAny,)
+    throttle_classes = (ContactSubmissionThrottle,)
+    serializer_class = ContactSubmissionCreateSerializer
+
+    @extend_schema(
+        request=ContactSubmissionCreateSerializer,
+        responses={201: ContactSubmissionResponseSerializer},
+    )
+    def post(self, request):
+        serializer = self.serializer_class(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        submission = serializer.save(
+            ip_address=_get_client_ip(request),
+            user_agent=request.META.get("HTTP_USER_AGENT", ""),
+        )
+        return Response(
+            ContactSubmissionResponseSerializer(submission).data,
+            status=status.HTTP_201_CREATED,
+        )

apps/contacts/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class ContactsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.contacts"

apps/contacts/migrations/0001_initial.py

@@ -0,0 +1,85 @@
+# Generated manually for contact submissions.
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="ContactSubmission",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid7,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("deleted_at", models.DateTimeField(blank=True, null=True)),
+                ("is_deleted", models.BooleanField(default=False)),
+                ("is_active", models.BooleanField(default=False)),
+                ("first_name", models.CharField(max_length=120)),
+                ("last_name", models.CharField(max_length=120)),
+                ("email", models.EmailField(max_length=254)),
+                ("mobile", models.CharField(max_length=32)),
+                ("message", models.TextField()),
+                (
+                    "status",
+                    models.CharField(
+                        choices=[
+                            ("new", "New"),
+                            ("contacted", "Contacted"),
+                            ("closed", "Closed"),
+                            ("spam", "Spam"),
+                        ],
+                        default="new",
+                        max_length=20,
+                    ),
+                ),
+                ("ip_address", models.GenericIPAddressField(blank=True, null=True)),
+                ("user_agent", models.TextField(blank=True)),
+                (
+                    "created_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="created_%(app_label)s_%(class)s_set",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "updated_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="updated_%(app_label)s_%(class)s_set",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "contact_submission",
+                "ordering": ("-created_at",),
+                "indexes": [
+                    models.Index(fields=["id"], name="contactsubmission_id_idx"),
+                    models.Index(fields=["created_at"], name="contact_created_at_idx"),
+                    models.Index(fields=["status"], name="contact_status_idx"),
+                    models.Index(fields=["email"], name="contact_email_idx"),
+                ],
+            },
+        ),
+    ]

apps/contacts/migrations/__init__.py

@@ -0,0 +1 @@
+

apps/contacts/models.py

@@ -0,0 +1,36 @@
+from django.db import models
+
+from core.models.base import BaseModel
+
+
+class ContactSubmission(BaseModel):
+    class Status(models.TextChoices):
+        NEW = "new", "New"
+        CONTACTED = "contacted", "Contacted"
+        CLOSED = "closed", "Closed"
+        SPAM = "spam", "Spam"
+
+    first_name = models.CharField(max_length=120)
+    last_name = models.CharField(max_length=120)
+    email = models.EmailField()
+    mobile = models.CharField(max_length=32)
+    message = models.TextField()
+    status = models.CharField(
+        max_length=20,
+        choices=Status.choices,
+        default=Status.NEW,
+    )
+    ip_address = models.GenericIPAddressField(null=True, blank=True)
+    user_agent = models.TextField(blank=True)
+
+    class Meta:
+        db_table = "contact_submission"
+        ordering = ("-created_at",)
+        indexes = (
+            models.Index(fields=("created_at",), name="contact_created_at_idx"),
+            models.Index(fields=("status",), name="contact_status_idx"),
+            models.Index(fields=("email",), name="contact_email_idx"),
+        )
+
+    def __str__(self):
+        return f"{self.first_name} {self.last_name} - {self.email}"

apps/contacts/tests/__init__.py

@@ -0,0 +1 @@
+

apps/contacts/tests/test_api_views.py

@@ -0,0 +1,44 @@
+from django.urls import reverse
+from rest_framework import status
+from rest_framework.test import APITestCase
+
+from apps.contacts.models import ContactSubmission
+
+
+class ContactSubmissionApiTests(APITestCase):
+    def test_public_user_can_submit_contact_form(self):
+        response = self.client.post(
+            reverse("contacts:contact-submit"),
+            {
+                "first_name": "Amin",
+                "last_name": "Test",
+                "email": "amin@example.com",
+                "mobile": "09938228438",
+                "message": "I need help with Qlockify reports.",
+            },
+            format="json",
+            HTTP_X_FORWARDED_FOR="203.0.113.10",
+            HTTP_USER_AGENT="test-agent",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        submission = ContactSubmission.objects.get()
+        self.assertEqual(submission.email, "amin@example.com")
+        self.assertEqual(submission.ip_address, "203.0.113.10")
+        self.assertEqual(submission.user_agent, "test-agent")
+
+    def test_rejects_short_message(self):
+        response = self.client.post(
+            reverse("contacts:contact-submit"),
+            {
+                "first_name": "Amin",
+                "last_name": "Test",
+                "email": "amin@example.com",
+                "mobile": "09938228438",
+                "message": "Hi",
+            },
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertFalse(ContactSubmission.objects.exists())

apps/demos/__init__.py

@@ -0,0 +1 @@
+

apps/demos/api/__init__.py

@@ -0,0 +1 @@
+

apps/demos/api/throttles.py

@@ -0,0 +1,5 @@
+from rest_framework.throttling import AnonRateThrottle
+
+
+class DemoStartThrottle(AnonRateThrottle):
+    scope = "demo_start"

apps/demos/api/urls.py

@@ -0,0 +1,9 @@
+from django.urls import path
+
+from apps.demos.api.views import DemoStartView
+
+app_name = "demos"
+
+urlpatterns = [
+    path("start/", DemoStartView.as_view(), name="demo-start"),
+]

apps/demos/api/views.py

@@ -0,0 +1,29 @@
+from drf_spectacular.utils import extend_schema, inline_serializer
+from rest_framework import serializers, status
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from apps.demos.api.throttles import DemoStartThrottle
+from apps.demos.services import create_demo_environment
+
+
+class DemoStartView(APIView):
+    permission_classes = (AllowAny,)
+    throttle_classes = (DemoStartThrottle,)
+
+    @extend_schema(
+        request=None,
+        responses=inline_serializer(
+            name="DemoStartResponse",
+            fields={
+                "access": serializers.CharField(),
+                "refresh": serializers.CharField(),
+                "workspace_id": serializers.CharField(),
+                "expires_at": serializers.DateTimeField(),
+                "demo_environment_id": serializers.CharField(),
+            },
+        ),
+    )
+    def post(self, request):
+        return Response(create_demo_environment(), status=status.HTTP_201_CREATED)

apps/demos/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class DemosConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.demos"

apps/demos/management/__init__.py

@@ -0,0 +1 @@
+

apps/demos/management/commands/__init__.py

@@ -0,0 +1 @@
+

apps/demos/management/commands/cleanup_demo_environments.py

@@ -0,0 +1,18 @@
+from django.core.management.base import BaseCommand
+
+from apps.demos.services import cleanup_expired_demo_environments
+
+
+class Command(BaseCommand):
+    help = "Clean up expired isolated demo environments."
+
+    def add_arguments(self, parser):
+        parser.add_argument("--expired", action="store_true", help="Clean expired demo environments.")
+        parser.add_argument("--batch-size", type=int, default=None, help="Maximum number of environments to clean.")
+
+    def handle(self, *args, **options):
+        if not options["expired"]:
+            self.stderr.write("Only --expired cleanup is supported.")
+            return
+        cleaned = cleanup_expired_demo_environments(batch_size=options["batch_size"])
+        self.stdout.write(self.style.SUCCESS(f"Cleaned {cleaned} expired demo environment(s)."))

apps/demos/migrations/0001_initial.py

@@ -0,0 +1,97 @@
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+import uuid
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ("workspaces", "0008_hourlyratehistory"),
+        ("users", "0004_user_demo_fields"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="DemoEnvironment",
+            fields=[
+                ("id", models.UUIDField(default=uuid.uuid7, primary_key=True, serialize=False)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("deleted_at", models.DateTimeField(blank=True, null=True)),
+                ("is_deleted", models.BooleanField(default=False)),
+                ("is_active", models.BooleanField(default=False)),
+                ("expires_at", models.DateTimeField()),
+                (
+                    "status",
+                    models.CharField(
+                        choices=[("active", "Active"), ("expired", "Expired"), ("cleaned", "Cleaned")],
+                        default="active",
+                        max_length=16,
+                    ),
+                ),
+                ("seed_version", models.CharField(default="v1", max_length=32)),
+                ("cleaned_at", models.DateTimeField(blank=True, null=True)),
+                ("cleanup_error", models.TextField(blank=True)),
+                (
+                    "created_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="created_demos_demoenvironment_set",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "owner_user",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="demo_environment",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "updated_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="updated_demos_demoenvironment_set",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "workspace",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="demo_environment",
+                        to="workspaces.workspace",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "demo_environment",
+                "ordering": ("-created_at",),
+            },
+        ),
+        migrations.AddIndex(
+            model_name="demoenvironment",
+            index=models.Index(fields=["id"], name="demoenvironment_id_idx"),
+        ),
+        migrations.AddIndex(
+            model_name="demoenvironment",
+            index=models.Index(fields=["status", "expires_at"], name="demo_status_expires_idx"),
+        ),
+        migrations.AddIndex(
+            model_name="demoenvironment",
+            index=models.Index(fields=["owner_user"], name="demo_owner_user_idx"),
+        ),
+        migrations.AddIndex(
+            model_name="demoenvironment",
+            index=models.Index(fields=["workspace"], name="demo_workspace_idx"),
+        ),
+    ]

apps/demos/migrations/0002_remove_demoenvironment_demoenvironment_id_idx_and_more.py

@@ -0,0 +1,30 @@
+# Generated by Django 5.2.12 on 2026-06-06 21:07
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('demos', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.RemoveIndex(
+            model_name='demoenvironment',
+            name='demoenvironment_id_idx',
+        ),
+        migrations.AlterField(
+            model_name='demoenvironment',
+            name='created_by',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='created_%(app_label)s_%(class)s_set', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='demoenvironment',
+            name='updated_by',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='updated_%(app_label)s_%(class)s_set', to=settings.AUTH_USER_MODEL),
+        ),
+    ]

apps/demos/migrations/__init__.py

@@ -0,0 +1 @@
+

apps/demos/models.py

@@ -0,0 +1,39 @@
+from django.conf import settings
+from django.db import models
+
+from core.models.base import BaseModel
+
+
+class DemoEnvironment(BaseModel):
+    class Status(models.TextChoices):
+        ACTIVE = "active", "Active"
+        EXPIRED = "expired", "Expired"
+        CLEANED = "cleaned", "Cleaned"
+
+    owner_user = models.OneToOneField(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="demo_environment",
+    )
+    workspace = models.OneToOneField(
+        "workspaces.Workspace",
+        on_delete=models.CASCADE,
+        related_name="demo_environment",
+    )
+    expires_at = models.DateTimeField()
+    status = models.CharField(max_length=16, choices=Status.choices, default=Status.ACTIVE)
+    seed_version = models.CharField(max_length=32, default="v1")
+    cleaned_at = models.DateTimeField(blank=True, null=True)
+    cleanup_error = models.TextField(blank=True)
+
+    class Meta:
+        db_table = "demo_environment"
+        ordering = ("-created_at",)
+        indexes = [
+            models.Index(fields=["status", "expires_at"], name="demo_status_expires_idx"),
+            models.Index(fields=["owner_user"], name="demo_owner_user_idx"),
+            models.Index(fields=["workspace"], name="demo_workspace_idx"),
+        ]
+
+    def __str__(self):
+        return f"Demo {self.workspace_id} for {self.owner_user_id}"

apps/demos/services.py

@@ -0,0 +1,273 @@
+from __future__ import annotations
+
+import random
+import string
+from datetime import timedelta
+from decimal import Decimal
+
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.db import transaction
+from django.utils import timezone
+from rest_framework.exceptions import ValidationError
+
+from apps.clients.models import Client
+from apps.demos.models import DemoEnvironment
+from apps.notifications.services import RedisNotificationStore
+from apps.projects.models import Project, ProjectAccess, ProjectUserRate
+from apps.reports.models import ReportExportJob
+from apps.tags.models import Tag
+from apps.time_entries.models import TimeEntry
+from apps.users.services.auth import get_tokens_for_user
+from apps.workspaces.models import HourlyRateHistory, PriceUnit, Workspace, WorkspaceMembership, WorkspaceUserRate
+
+User = get_user_model()
+
+DEMO_SEED_VERSION = "v1"
+DEMO_RATE_CURRENCY = "IRT"
+
+
+def _unique_mobile(prefix: str) -> str:
+    for _ in range(50):
+        mobile = f"09{prefix}{''.join(random.choices(string.digits, k=7))}"
+        if not User.all_objects.filter(mobile=mobile).exists():
+            return mobile
+    raise ValidationError({"detail": "Could not allocate a unique demo mobile number."})
+
+
+def _create_demo_user(*, prefix: str, first_name: str, last_name: str, expires_at):
+    mobile = _unique_mobile(prefix)
+    user = User.objects.create_user(
+        mobile=mobile,
+        password=None,
+        email=f"demo-{mobile}@demo.qlockify.local",
+        first_name=first_name,
+        last_name=last_name,
+        is_active=True,
+        is_verified=True,
+        is_demo=True,
+        demo_expires_at=expires_at,
+    )
+    return user
+
+
+def _ensure_price_units() -> None:
+    PriceUnit.get_or_restore(
+        code="IRT",
+        defaults={"name": "Iranian Toman", "local_name": "تومان", "symbol": "تومان", "is_active": True},
+    )
+
+
+def _create_workspace_rate(*, workspace, user, amount: str, effective_from):
+    rate = WorkspaceUserRate.objects.create(
+        workspace=workspace,
+        user=user,
+        hourly_rate=Decimal(amount),
+        currency=DEMO_RATE_CURRENCY,
+        effective_from=effective_from,
+        is_active=True,
+    )
+    HourlyRateHistory.objects.create(
+        workspace=workspace,
+        user=user,
+        scope=HourlyRateHistory.Scope.WORKSPACE,
+        hourly_rate=rate.hourly_rate,
+        currency=rate.currency,
+        effective_from=effective_from,
+        is_active=True,
+    )
+    return rate
+
+
+def _create_project_rate(*, project, user, amount: str, effective_from):
+    rate = ProjectUserRate.objects.create(
+        project=project,
+        user=user,
+        hourly_rate=Decimal(amount),
+        currency=DEMO_RATE_CURRENCY,
+        effective_from=effective_from,
+        is_active=True,
+    )
+    HourlyRateHistory.objects.create(
+        workspace=project.workspace,
+        project=project,
+        user=user,
+        scope=HourlyRateHistory.Scope.PROJECT,
+        hourly_rate=rate.hourly_rate,
+        currency=rate.currency,
+        effective_from=effective_from,
+        is_active=True,
+    )
+    return rate
+
+
+def _create_entry(*, workspace, user, project, tags, days_ago: int, hour: int, duration_hours: float, description: str, billable: bool):
+    start_time = timezone.now().replace(hour=hour, minute=0, second=0, microsecond=0) - timedelta(days=days_ago)
+    end_time = start_time + timedelta(hours=duration_hours)
+    rate = None
+    currency = DEMO_RATE_CURRENCY
+    if billable and project:
+        rate = (
+            ProjectUserRate.objects.filter(project=project, user=user, is_deleted=False, is_active=True)
+            .order_by("-effective_from", "-updated_at")
+            .first()
+        )
+        if not rate:
+            rate = (
+                WorkspaceUserRate.objects.filter(workspace=workspace, user=user, is_deleted=False)
+                .order_by("-effective_from", "-updated_at")
+                .first()
+            )
+        if rate:
+            currency = rate.currency
+
+    entry = TimeEntry.objects.create(
+        workspace=workspace,
+        user=user,
+        project=project,
+        description=description,
+        start_time=start_time,
+        end_time=end_time,
+        duration=end_time - start_time,
+        is_billable=billable,
+        hourly_rate=rate.hourly_rate if rate else None,
+        currency=currency,
+        is_active=True,
+    )
+    entry.tags.set(tags)
+    return entry
+
+
+@transaction.atomic
+def create_demo_environment():
+    if not getattr(settings, "DEMO_ENABLED", True):
+        raise ValidationError({"detail": "Demo environments are currently disabled."})
+
+    _ensure_price_units()
+    expires_at = timezone.now() + timedelta(hours=settings.DEMO_ENVIRONMENT_TTL_HOURS)
+    owner = _create_demo_user(prefix="70", first_name="Demo", last_name="Owner", expires_at=expires_at)
+    admin = _create_demo_user(prefix="71", first_name="Nika", last_name="Admin", expires_at=expires_at)
+    member = _create_demo_user(prefix="72", first_name="Arman", last_name="Member", expires_at=expires_at)
+    guest = _create_demo_user(prefix="73", first_name="Sara", last_name="Guest", expires_at=expires_at)
+
+    workspace = Workspace.objects.create(
+        name="Qlockify Demo Workspace",
+        description="A temporary sandbox workspace with seeded data for exploring Qlockify.",
+        owner=owner,
+        is_active=True,
+    )
+    WorkspaceMembership.objects.bulk_create(
+        [
+            WorkspaceMembership(workspace=workspace, user=admin, role=WorkspaceMembership.Role.ADMIN, is_active=True),
+            WorkspaceMembership(workspace=workspace, user=member, role=WorkspaceMembership.Role.MEMBER, is_active=True),
+            WorkspaceMembership(workspace=workspace, user=guest, role=WorkspaceMembership.Role.GUEST, is_active=True),
+        ]
+    )
+
+    now = timezone.now()
+    for user, amount in ((owner, "750000"), (admin, "650000"), (member, "520000"), (guest, "350000")):
+        _create_workspace_rate(workspace=workspace, user=user, amount=amount, effective_from=now - timedelta(days=60))
+
+    college = Client.objects.create(workspace=workspace, name="Kanoon College", notes="Education client", is_active=True)
+    studio = Client.objects.create(workspace=workspace, name="Nova Studio", notes="Design and product client", is_active=True)
+    internal = Client.objects.create(workspace=workspace, name="Internal Ops", notes="Non-client internal work", is_active=True)
+
+    projects = {
+        "portal": Project.objects.create(workspace=workspace, client=college, name="Student Portal", color="#0891b2", is_active=True),
+        "bootcamp": Project.objects.create(workspace=workspace, client=college, name="Bootcamp Analytics", color="#14b8a6", is_active=True),
+        "brand": Project.objects.create(workspace=workspace, client=studio, name="Brand Refresh", color="#f97316", is_active=True),
+        "ops": Project.objects.create(workspace=workspace, client=internal, name="Operations Automation", color="#6366f1", is_active=True),
+        "archive": Project.objects.create(workspace=workspace, client=studio, name="Archived Campaign", color="#94a3b8", is_archived=True, is_active=True),
+    }
+
+    tags = {
+        "design": Tag.objects.create(workspace=workspace, name="Design", color="#f97316", is_active=True),
+        "backend": Tag.objects.create(workspace=workspace, name="Backend", color="#0ea5e9", is_active=True),
+        "meeting": Tag.objects.create(workspace=workspace, name="Meeting", color="#8b5cf6", is_active=True),
+        "qa": Tag.objects.create(workspace=workspace, name="QA", color="#22c55e", is_active=True),
+    }
+
+    for user in (member, guest):
+        for project in (projects["portal"], projects["bootcamp"], projects["brand"]):
+            ProjectAccess.objects.create(project=project, user=user, is_active=True)
+
+    _create_project_rate(project=projects["brand"], user=owner, amount="950000", effective_from=now - timedelta(days=30))
+    _create_project_rate(project=projects["portal"], user=member, amount="610000", effective_from=now - timedelta(days=20))
+    _create_project_rate(project=projects["bootcamp"], user=guest, amount="420000", effective_from=now - timedelta(days=15))
+
+    entry_templates = [
+        (owner, projects["brand"], [tags["design"]], 1, 9, 2.5, "Review landing page motion", True),
+        (owner, projects["ops"], [tags["backend"], tags["qa"]], 2, 10, 3.0, "Improve export pipeline", True),
+        (owner, None, [tags["meeting"]], 3, 13, 1.0, "Weekly planning", False),
+        (admin, projects["portal"], [tags["backend"]], 1, 8, 4.0, "API access checks", True),
+        (admin, projects["bootcamp"], [tags["qa"]], 4, 11, 2.0, "Report QA pass", True),
+        (member, projects["portal"], [tags["backend"], tags["qa"]], 2, 9, 5.0, "Timesheet improvements", True),
+        (member, projects["brand"], [tags["design"]], 6, 14, 2.5, "Design polish", True),
+        (guest, projects["bootcamp"], [tags["meeting"]], 3, 10, 1.5, "Client sync", True),
+        (guest, None, [], 5, 15, 1.0, "Uncategorized admin work", False),
+    ]
+    for entry in entry_templates:
+        _create_entry(workspace=workspace, user=entry[0], project=entry[1], tags=entry[2], days_ago=entry[3], hour=entry[4], duration_hours=entry[5], description=entry[6], billable=entry[7])
+
+    environment = DemoEnvironment.objects.create(
+        owner_user=owner,
+        workspace=workspace,
+        expires_at=expires_at,
+        seed_version=DEMO_SEED_VERSION,
+        status=DemoEnvironment.Status.ACTIVE,
+        is_active=True,
+    )
+    tokens = get_tokens_for_user(owner)
+    return {
+        **tokens,
+        "workspace_id": str(workspace.id),
+        "expires_at": expires_at.isoformat(),
+        "demo_environment_id": str(environment.id),
+    }
+
+
+def cleanup_demo_environment(environment: DemoEnvironment) -> bool:
+    workspace = environment.workspace
+    users = list(
+        User.all_objects.filter(
+            is_demo=True,
+            workspace_memberships__workspace=workspace,
+        ).distinct()
+    )
+
+    for job in ReportExportJob.all_objects.filter(workspace=workspace):
+        if job.file:
+            job.file.delete(save=False)
+
+    for user in users:
+        RedisNotificationStore.clear_user(str(user.id))
+
+    workspace.hard_delete()
+    for user in users:
+        user.hard_delete()
+    return True
+
+
+def cleanup_expired_demo_environments(*, batch_size: int | None = None) -> int:
+    batch_size = batch_size or settings.DEMO_CLEANUP_BATCH_SIZE
+    expired = list(
+        DemoEnvironment.objects.filter(
+            status=DemoEnvironment.Status.ACTIVE,
+            expires_at__lte=timezone.now(),
+        )
+        .select_related("workspace", "owner_user")
+        .order_by("expires_at")[:batch_size]
+    )
+    cleaned = 0
+    for environment in expired:
+        try:
+            with transaction.atomic():
+                cleanup_demo_environment(environment)
+            cleaned += 1
+        except Exception as exc:  # noqa: BLE001
+            DemoEnvironment.all_objects.filter(id=environment.id).update(
+                status=DemoEnvironment.Status.EXPIRED,
+                cleanup_error=str(exc)[:2000],
+                updated_at=timezone.now(),
+            )
+    return cleaned

apps/demos/tasks.py

@@ -0,0 +1,8 @@
+from celery import shared_task
+
+from apps.demos.services import cleanup_expired_demo_environments
+
+
+@shared_task(name="demos.cleanup_expired_environments")
+def cleanup_expired_demo_environments_task():
+    return cleanup_expired_demo_environments()

apps/demos/tests/__init__.py

@@ -0,0 +1 @@
+

apps/demos/tests/test_demo_api.py

@@ -0,0 +1,77 @@
+from django.contrib.auth import get_user_model
+from django.test import override_settings
+from django.utils import timezone
+from rest_framework.test import APITestCase
+
+from apps.clients.models import Client
+from apps.demos.models import DemoEnvironment
+from apps.demos.services import cleanup_expired_demo_environments
+from apps.projects.models import Project, ProjectAccess
+from apps.tags.models import Tag
+from apps.time_entries.models import TimeEntry
+from apps.workspaces.models import WorkspaceMembership, WorkspaceUserRate
+
+User = get_user_model()
+DEMO_START_URL = "/api/demo/start/"
+
+
+@override_settings(DEMO_ENABLED=True, DEMO_ENVIRONMENT_TTL_HOURS=24, DEMO_CLEANUP_BATCH_SIZE=100)
+class DemoStartApiTests(APITestCase):
+    def test_demo_start_creates_isolated_seeded_environment(self):
+        response = self.client.post(DEMO_START_URL)
+
+        self.assertEqual(response.status_code, 201)
+        self.assertIn("access", response.data)
+        self.assertIn("refresh", response.data)
+        self.assertEqual(DemoEnvironment.objects.count(), 1)
+
+        environment = DemoEnvironment.objects.select_related("owner_user", "workspace").get()
+        self.assertTrue(environment.owner_user.is_demo)
+        self.assertEqual(environment.owner_user.demo_expires_at, environment.expires_at)
+        self.assertGreaterEqual(WorkspaceMembership.objects.filter(workspace=environment.workspace).count(), 4)
+        self.assertGreaterEqual(Client.objects.filter(workspace=environment.workspace).count(), 3)
+        self.assertGreaterEqual(Project.objects.filter(workspace=environment.workspace).count(), 5)
+        self.assertGreaterEqual(Tag.objects.filter(workspace=environment.workspace).count(), 4)
+        self.assertGreaterEqual(TimeEntry.objects.filter(workspace=environment.workspace).count(), 8)
+        self.assertGreaterEqual(WorkspaceUserRate.objects.filter(workspace=environment.workspace).count(), 4)
+        self.assertGreaterEqual(ProjectAccess.objects.filter(project__workspace=environment.workspace).count(), 1)
+
+    def test_two_demo_starts_do_not_share_workspace_data(self):
+        first = self.client.post(DEMO_START_URL)
+        second = self.client.post(DEMO_START_URL)
+
+        self.assertEqual(first.status_code, 201)
+        self.assertEqual(second.status_code, 201)
+        environments = list(DemoEnvironment.objects.order_by("created_at"))
+        self.assertEqual(len(environments), 2)
+        self.assertNotEqual(environments[0].workspace_id, environments[1].workspace_id)
+        self.assertNotEqual(environments[0].owner_user_id, environments[1].owner_user_id)
+
+    def test_demo_user_cannot_search_external_users_or_send_otp(self):
+        self.client.post(DEMO_START_URL)
+        environment = DemoEnvironment.objects.select_related("owner_user").get()
+        real_user = User.objects.create_user(mobile="09111111111", password="Testpass123!")
+        self.client.force_authenticate(environment.owner_user)
+
+        search_response = self.client.get(f"/api/users/search/?mobile={real_user.mobile}")
+        self.assertEqual(search_response.status_code, 403)
+
+        otp_response = self.client.post(
+            "/api/users/otp/send/",
+            {"mobile": environment.owner_user.mobile, "mode": "login"},
+            format="json",
+        )
+        self.assertEqual(otp_response.status_code, 400)
+
+    def test_cleanup_deletes_expired_demo_and_keeps_real_users(self):
+        self.client.post(DEMO_START_URL)
+        environment = DemoEnvironment.objects.select_related("workspace").get()
+        real_user = User.objects.create_user(mobile="09122222222", password="Testpass123!")
+        DemoEnvironment.objects.filter(id=environment.id).update(expires_at=timezone.now() - timezone.timedelta(minutes=1))
+
+        cleaned = cleanup_expired_demo_environments()
+
+        self.assertEqual(cleaned, 1)
+        self.assertFalse(DemoEnvironment.all_objects.filter(id=environment.id).exists())
+        self.assertFalse(TimeEntry.all_objects.filter(workspace_id=environment.workspace_id).exists())
+        self.assertTrue(User.objects.filter(id=real_user.id).exists())

apps/notifications/services/store.py

@@ -205,6 +205,18 @@ class RedisNotificationStore:
             return True
         return False
 
+    @classmethod
+    def clear_user(cls, user_id: str) -> int:
+        ids_key = cls._ids_key(user_id)
+        data_key = cls._data_key(user_id)
+        count = redis_client.zcard(ids_key)
+        pipe = redis_client.pipeline()
+        pipe.delete(ids_key)
+        pipe.delete(data_key)
+        pipe.srem(cls.USERS_KEY, user_id)
+        pipe.execute()
+        return int(count or 0)
+
     @classmethod
     def mark_seen(cls, user_id: str, notif_id: str) -> dict | None:
         data = cls.get(user_id, notif_id)

apps/projects/api/serializers.py

@@ -1,6 +1,22 @@
+from decimal import Decimal
+
 from rest_framework import serializers
 from core.serializers.base import BaseModelSerializer
 from apps.projects.models import Project
+from apps.workspaces.models import PriceUnit
+
+
+def validate_thumbnail(value):
+    if value is None:
+        return value
+    max_bytes = 2 * 1024 * 1024
+    if getattr(value, "size", 0) > max_bytes:
+        raise serializers.ValidationError("Image size must be 2MB or less.")
+    content_type = (getattr(value, "content_type", "") or "").lower()
+    allowed_types = {"image/jpeg", "image/png", "image/webp"}
+    if content_type and content_type not in allowed_types:
+        raise serializers.ValidationError("Unsupported image type. Use JPG, PNG, or WebP.")
+    return value
 
 
 class ProjectSerializer(BaseModelSerializer):
@@ -11,6 +27,7 @@ class ProjectSerializer(BaseModelSerializer):
             "name",
             "client",
             "description",
+            "thumbnail",
             "is_archived",
             "color",
         )
@@ -18,12 +35,25 @@ class ProjectSerializer(BaseModelSerializer):
 
     def to_representation(self, instance):
         representation = super().to_representation(instance)
+        request = self.context.get("request")
+        if instance.thumbnail:
+            thumbnail_url = instance.thumbnail.url
+            representation["thumbnail"] = request.build_absolute_uri(thumbnail_url) if request else thumbnail_url
+        else:
+            representation["thumbnail"] = None
         if instance.client:
             representation['client'] = {
-                'id': instance.client.id,
-                'name': instance.client.name
-            }
-        return representation
+                'id': instance.client.id,
+                'name': instance.client.name,
+                'thumbnail': (
+                    request.build_absolute_uri(instance.client.thumbnail.url)
+                    if request and instance.client.thumbnail
+                    else instance.client.thumbnail.url
+                    if instance.client.thumbnail
+                    else None
+                ),
+            }
+        return representation
 
 
 class ProjectCreateSerializer(serializers.Serializer):
@@ -31,16 +61,25 @@ class ProjectCreateSerializer(serializers.Serializer):
     name = serializers.CharField(max_length=255)
     client = serializers.UUIDField(required=False, allow_null=True)
     description = serializers.CharField(required=False, allow_blank=True, default="")
+    thumbnail = serializers.ImageField(required=False, allow_null=True)
     color = serializers.CharField(max_length=7, required=False, allow_blank=True, default="")
 
+    def validate_thumbnail(self, value):
+        return validate_thumbnail(value)
+
 
 class ProjectUpdateSerializer(serializers.Serializer):
     name = serializers.CharField(max_length=255, required=False)
     client = serializers.UUIDField(required=False, allow_null=True)
     description = serializers.CharField(required=False, allow_blank=True)
+    thumbnail = serializers.ImageField(required=False, allow_null=True)
+    clear_thumbnail = serializers.BooleanField(required=False, default=False)
     color = serializers.CharField(max_length=7, required=False, allow_blank=True)
     is_archived = serializers.BooleanField(required=False)
 
+    def validate_thumbnail(self, value):
+        return validate_thumbnail(value)
+
 
 class ProjectAccessQuerySerializer(serializers.Serializer):
     workspace = serializers.UUIDField()
@@ -54,3 +93,23 @@ class ProjectAccessMutationSerializer(serializers.Serializer):
         child=serializers.UUIDField(),
         allow_empty=False,
     )
+
+
+class ProjectAccessRateMutationSerializer(serializers.Serializer):
+    workspace = serializers.UUIDField()
+    user = serializers.UUIDField()
+    project = serializers.UUIDField()
+    hourly_rate = serializers.DecimalField(
+        max_digits=10,
+        decimal_places=2,
+        min_value=Decimal("0.01"),
+        required=False,
+        allow_null=True,
+    )
+    currency = serializers.CharField(max_length=3, required=False, default="USD")
+
+    def validate_currency(self, value):
+        code = value.upper()
+        if not PriceUnit.objects.filter(code=code, is_deleted=False).exists():
+            raise serializers.ValidationError("Selected price unit is invalid.")
+        return code

apps/projects/api/views.py

@@ -16,16 +16,20 @@ from apps.projects.models import Project
 from apps.projects.api.serializers import (
     ProjectSerializer, ProjectCreateSerializer, ProjectUpdateSerializer,
     ProjectAccessMutationSerializer, ProjectAccessQuerySerializer,
+    ProjectAccessRateMutationSerializer,
 )
 from apps.projects.api.permissions import IsProjectMember, IsProjectManager
 from apps.projects.services.access import (
+    build_project_access_item,
     build_project_access_items,
     ensure_workspace_project_access,
     filter_projects_for_user,
-    get_access_managed_membership,
+    get_project_access_target_membership,
     grant_project_accesses,
     revoke_project_accesses,
+    user_has_project_access,
 )
+from apps.projects.services.rates import get_current_project_user_rate, remove_project_user_rate, upsert_project_user_rate
 from apps.projects.services.projects import (
     create_project,
     update_project,
@@ -85,6 +89,9 @@ class ProjectViewSet(ModelViewSet):
         if client_ids:
             queryset = queryset.filter(client_id__in=client_ids)
 
+        if "is_archived" not in self.request.query_params:
+            queryset = queryset.filter(is_archived=False)
+
         return queryset
 
     def get_serializer_class(self):
@@ -116,13 +123,14 @@ class ProjectViewSet(ModelViewSet):
         project = create_project(
             user=request.user,
             workspace=workspace,
-            name=serializer.validated_data["name"],
-            client=client,
+            name=serializer.validated_data["name"],
+            client=client,
             description=serializer.validated_data.get("description", ""),
-            color=serializer.validated_data.get("color", "")
+            color=serializer.validated_data.get("color", ""),
+            thumbnail=serializer.validated_data.get("thumbnail"),
         )
         
-        output_serializer = ProjectSerializer(project)
+        output_serializer = ProjectSerializer(project, context={"request": request})
         return Response(output_serializer.data, status=status.HTTP_201_CREATED)
 
     def update(self, request, *args, **kwargs):
@@ -140,7 +148,7 @@ class ProjectViewSet(ModelViewSet):
             **serializer.validated_data
         )
         
-        output_serializer = ProjectSerializer(updated_project)
+        output_serializer = ProjectSerializer(updated_project, context={"request": request})
         return Response(output_serializer.data, status=status.HTTP_200_OK)
 
     def destroy(self, request, *args, **kwargs):
@@ -165,7 +173,7 @@ class ProjectViewSet(ModelViewSet):
         project = self.get_object()
         updated_project = toggle_project_archive(project)
         
-        output_serializer = ProjectSerializer(updated_project)
+        output_serializer = ProjectSerializer(updated_project, context={"request": request})
         return Response(output_serializer.data, status=status.HTTP_200_OK)
 
     @action(detail=False, methods=["get"], url_path="access")
@@ -179,7 +187,7 @@ class ProjectViewSet(ModelViewSet):
             is_deleted=False,
         )
         ensure_workspace_project_access(request.user, workspace)
-        membership = get_access_managed_membership(workspace, str(serializer.validated_data["user"]))
+        membership = get_project_access_target_membership(workspace, str(serializer.validated_data["user"]))
 
         return Response(
             {
@@ -204,7 +212,7 @@ class ProjectViewSet(ModelViewSet):
             id=serializer.validated_data["workspace"],
             is_deleted=False,
         )
-        membership = get_access_managed_membership(workspace, str(serializer.validated_data["user"]))
+        membership = get_project_access_target_membership(workspace, str(serializer.validated_data["user"]))
         changed = grant_project_accesses(
             actor=request.user,
             workspace=workspace,
@@ -223,7 +231,7 @@ class ProjectViewSet(ModelViewSet):
             id=serializer.validated_data["workspace"],
             is_deleted=False,
         )
-        membership = get_access_managed_membership(workspace, str(serializer.validated_data["user"]))
+        membership = get_project_access_target_membership(workspace, str(serializer.validated_data["user"]))
         changed = revoke_project_accesses(
             actor=request.user,
             workspace=workspace,
@@ -231,3 +239,54 @@ class ProjectViewSet(ModelViewSet):
             project_ids=[str(project_id) for project_id in serializer.validated_data["project_ids"]],
         )
         return Response({"changed": changed}, status=status.HTTP_200_OK)
+
+    @action(detail=False, methods=["post"], url_path="access/rate")
+    def set_access_rate(self, request):
+        serializer = ProjectAccessRateMutationSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        workspace = get_object_or_404(
+            Workspace,
+            id=serializer.validated_data["workspace"],
+            is_deleted=False,
+        )
+        ensure_workspace_project_access(request.user, workspace)
+        membership = get_project_access_target_membership(workspace, str(serializer.validated_data["user"]))
+        project = get_object_or_404(
+            Project,
+            id=serializer.validated_data["project"],
+            workspace=workspace,
+            is_deleted=False,
+        )
+
+        has_access = user_has_project_access(membership.user, project)
+        if not has_access:
+            return Response(
+                {"detail": "Grant project access before setting a project-specific rate."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        removed = serializer.validated_data.get("hourly_rate") is None
+        if removed:
+            remove_project_user_rate(project=project, user=membership.user)
+        else:
+            upsert_project_user_rate(
+                project=project,
+                user=membership.user,
+                hourly_rate=serializer.validated_data["hourly_rate"],
+                currency=serializer.validated_data.get("currency", "USD"),
+            )
+
+        workspace_rate = (
+            workspace.user_rates.filter(user=membership.user, is_deleted=False)
+            .order_by("-effective_from", "-updated_at")
+            .first()
+        )
+        project_rate = get_current_project_user_rate(project=project, user=membership.user)
+        item = build_project_access_item(
+            project=project,
+            has_access=True,
+            workspace_rate=workspace_rate,
+            project_rate=project_rate,
+        )
+        return Response({"removed": removed, "item": item}, status=status.HTTP_200_OK)

apps/projects/migrations/0005_project_thumbnail.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.12 on 2026-05-26 08:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('projects', '0004_projectaccess'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='project',
+            name='thumbnail',
+            field=models.ImageField(blank=True, null=True, upload_to='profile/projects/'),
+        ),
+    ]

apps/projects/models.py

@@ -28,6 +28,8 @@ class Project(BaseModel):
 
     description = models.TextField(blank=True)
 
+    thumbnail = models.ImageField(upload_to="profile/projects/", blank=True, null=True)
+
     is_archived = models.BooleanField(default=False)
 
     color = models.CharField(max_length=7, blank=True)

apps/projects/services/access.py

@@ -5,8 +5,8 @@ from django.db.models import Q, QuerySet
 from django.utils import timezone
 from rest_framework.exceptions import PermissionDenied, ValidationError
 
-from apps.projects.models import Project, ProjectAccess
-from apps.workspaces.models import Workspace, WorkspaceMembership
+from apps.projects.models import Project, ProjectAccess, ProjectUserRate
+from apps.workspaces.models import Workspace, WorkspaceMembership, WorkspaceUserRate
 from apps.workspaces.services import PROJECTS_EDIT, get_workspace_role, has_workspace_capability
 
 User = get_user_model()
@@ -66,7 +66,7 @@ def ensure_workspace_project_access(user, workspace: Workspace) -> None:
         raise PermissionDenied("You do not have permission to manage project access in this workspace.")
 
 
-def get_access_managed_membership(workspace: Workspace, user_id: str) -> WorkspaceMembership:
+def get_project_access_target_membership(workspace: Workspace, user_id: str) -> WorkspaceMembership:
     membership = WorkspaceMembership.objects.filter(
         workspace=workspace,
         user_id=user_id,
@@ -75,41 +75,88 @@ def get_access_managed_membership(workspace: Workspace, user_id: str) -> Workspa
     ).select_related("user").first()
     if not membership:
         raise ValidationError({"user": "Selected user is not an active member of this workspace."})
-    if membership.role not in PROJECT_ACCESS_MANAGED_ROLES:
-        raise ValidationError({"user": "Owners and admins have implicit access to all projects."})
     return membership
 
 
+def serialize_rate(rate) -> dict | None:
+    if not rate:
+        return None
+    return {
+        "id": str(rate.id),
+        "hourly_rate": str(rate.hourly_rate),
+        "currency": rate.currency,
+        "effective_from": rate.effective_from.isoformat() if rate.effective_from else None,
+    }
+
+
+def build_project_access_item(*, project: Project, has_access: bool, workspace_rate, project_rate) -> dict:
+    return {
+        "id": str(project.id),
+        "name": project.name,
+        "description": project.description,
+        "color": project.color,
+        "is_archived": project.is_archived,
+        "client": (
+            {"id": str(project.client_id), "name": project.client.name}
+            if project.client_id and project.client
+            else None
+        ),
+        "has_access": has_access,
+        "workspace_rate": serialize_rate(workspace_rate),
+        "project_rate": serialize_rate(project_rate),
+    }
+
+
 def build_project_access_items(*, workspace: Workspace, target_user) -> list[dict]:
-    explicit_access_ids = set(
-        ProjectAccess.objects.filter(project__workspace=workspace, user=target_user).values_list("project_id", flat=True)
+    explicit_access_ids = {
+        str(project_id)
+        for project_id in ProjectAccess.objects.filter(
+            project__workspace=workspace,
+            user=target_user,
+        ).values_list("project_id", flat=True)
+    }
+    workspace_rate = (
+        WorkspaceUserRate.objects.filter(
+            workspace=workspace,
+            user=target_user,
+            is_deleted=False,
+        )
+        .order_by("-effective_from", "-updated_at")
+        .first()
     )
+    project_rates: dict[str, ProjectUserRate] = {}
+    for rate in (
+        ProjectUserRate.objects.filter(
+            project__workspace=workspace,
+            user=target_user,
+            is_active=True,
+            is_deleted=False,
+        )
+        .select_related("project")
+        .order_by("project_id", "-effective_from", "-updated_at")
+    ):
+        project_rates.setdefault(str(rate.project_id), rate)
     projects = (
         Project.objects.filter(workspace=workspace, is_deleted=False)
         .select_related("client")
         .order_by("client__name", "name")
     )
     return [
-        {
-            "id": str(project.id),
-            "name": project.name,
-            "description": project.description,
-            "color": project.color,
-            "is_archived": project.is_archived,
-            "client": (
-                {"id": str(project.client_id), "name": project.client.name}
-                if project.client_id and project.client
-                else None
-            ),
-            "has_access": str(project.id) in {str(project_id) for project_id in explicit_access_ids},
-        }
+        build_project_access_item(
+            project=project,
+            has_access=user_has_project_access(target_user, project) if user_has_implicit_project_access(target_user, workspace) else str(project.id) in explicit_access_ids,
+            workspace_rate=workspace_rate,
+            project_rate=project_rates.get(str(project.id)),
+        )
         for project in projects
     ]
 
 
 def grant_project_accesses(*, actor, workspace: Workspace, target_user, project_ids: list[str]) -> int:
     ensure_workspace_project_access(actor, workspace)
-    get_access_managed_membership(workspace, str(target_user.id))
+    membership = get_project_access_target_membership(workspace, str(target_user.id))
+    if membership.role not in PROJECT_ACCESS_MANAGED_ROLES:
+        raise ValidationError({"user": "Owners and admins already have access to all projects."})
 
     projects = list(Project.objects.filter(workspace=workspace, id__in=project_ids, is_deleted=False))
     if len(projects) != len(set(project_ids)):
@@ -128,7 +175,9 @@ def grant_project_accesses(*, actor, workspace: Workspace, target_user, project_
 
 def revoke_project_accesses(*, actor, workspace: Workspace, target_user, project_ids: list[str]) -> int:
     ensure_workspace_project_access(actor, workspace)
-    get_access_managed_membership(workspace, str(target_user.id))
+    membership = get_project_access_target_membership(workspace, str(target_user.id))
+    if membership.role not in PROJECT_ACCESS_MANAGED_ROLES:
+        raise ValidationError({"user": "Owners and admins always keep project access."})
 
     accesses = list(
         ProjectAccess.objects.filter(

apps/projects/services/projects.py

@@ -7,8 +7,8 @@ from apps.projects.models import Project
 from apps.workspaces.models import WorkspaceMembership
 
 
-@transaction.atomic
-def create_project(user, workspace, name, client=None, description="", color=""):
+@transaction.atomic
+def create_project(user, workspace, name, client=None, description="", color="", thumbnail=None):
     """
     Creates a new workspace-shared project.
     """
@@ -30,6 +30,7 @@ def create_project(user, workspace, name, client=None, description="", color="")
         name=name,
         client=client,
         description=description,
+        thumbnail=thumbnail,
         color=color,
         created_by=user,
         updated_by=user,
@@ -38,7 +39,7 @@ def create_project(user, workspace, name, client=None, description="", color="")
     return project
 
 
-def update_project(project, **kwargs):
+def update_project(project, **kwargs):
     """
     Updates specific fields of an existing project.
     """
@@ -49,20 +50,32 @@ def update_project(project, **kwargs):
         if Project.objects.filter(workspace=project.workspace, name=kwargs["name"], is_deleted=False).exists():
             raise ValidationError({"name": "A project with this name already exists in the workspace."})
 
-    client_id = kwargs.pop("client")
-    client = get_object_or_404(Client, id=client_id, is_deleted=False) if client_id else None
-    kwargs["client"] = client
+    if "client" in kwargs:
+        client_id = kwargs.pop("client")
+        client = get_object_or_404(Client, id=client_id, is_deleted=False) if client_id else None
+        kwargs["client"] = client
+
+    clear_thumbnail = kwargs.pop("clear_thumbnail", False)
+    old_thumbnail_name = project.thumbnail.name if project.thumbnail else None
+    if clear_thumbnail and project.thumbnail:
+        project.thumbnail.delete(save=False)
+        project.thumbnail = None
+        update_fields.append("thumbnail")
 
-    for field, value in kwargs.items():
-        if hasattr(project, field) and getattr(project, field) != value:
-            setattr(project, field, value)
-            update_fields.append(field)
+    for field, value in kwargs.items():
+        if hasattr(project, field) and getattr(project, field) != value:
+            setattr(project, field, value)
+            update_fields.append(field)
             
     if update_fields:
-        update_fields.append("updated_at")
-        project.save(update_fields=update_fields)
-        
-    return project
+        update_fields.append("updated_at")
+        project.save(update_fields=update_fields)
+        if old_thumbnail_name and project.thumbnail and project.thumbnail.name != old_thumbnail_name:
+            storage = project.thumbnail.storage
+            if storage.exists(old_thumbnail_name):
+                storage.delete(old_thumbnail_name)
+        
+    return project
 
 
 def toggle_project_archive(project) -> Project:

apps/projects/services/rates.py

@@ -0,0 +1,108 @@
+from django.utils import timezone
+
+from apps.projects.models import ProjectUserRate
+from apps.workspaces.models import HourlyRateHistory
+
+
+def record_project_rate_history(*, project, user, hourly_rate, currency, effective_from=None):
+    currency = currency.upper()
+    effective_from = effective_from or timezone.now()
+    latest = (
+        HourlyRateHistory.objects.filter(
+            workspace=project.workspace,
+            project=project,
+            user=user,
+            scope=HourlyRateHistory.Scope.PROJECT,
+            is_deleted=False,
+        )
+        .order_by("-effective_from", "-created_at")
+        .first()
+    )
+    if latest and latest.hourly_rate == hourly_rate and latest.currency == currency:
+        return latest
+    return HourlyRateHistory.objects.create(
+        workspace=project.workspace,
+        project=project,
+        user=user,
+        scope=HourlyRateHistory.Scope.PROJECT,
+        hourly_rate=hourly_rate,
+        currency=currency,
+        effective_from=effective_from,
+        is_active=True,
+    )
+
+
+def get_current_project_user_rate(*, project, user):
+    return (
+        ProjectUserRate.objects.filter(
+            project=project,
+            user=user,
+            is_active=True,
+            is_deleted=False,
+        )
+        .order_by("-effective_from", "-updated_at")
+        .first()
+    )
+
+
+def upsert_project_user_rate(*, project, user, hourly_rate, currency="USD"):
+    currency = currency.upper()
+    rate = (
+        ProjectUserRate.all_objects.filter(
+            project=project,
+            user=user,
+        )
+        .order_by("-updated_at", "-created_at")
+        .first()
+    )
+
+    effective_from = timezone.now()
+    if rate:
+        update_fields = []
+        if rate.is_deleted:
+            rate.restore()
+        if rate.hourly_rate != hourly_rate:
+            rate.hourly_rate = hourly_rate
+            update_fields.append("hourly_rate")
+        if rate.currency != currency:
+            rate.currency = currency
+            update_fields.append("currency")
+        if not rate.is_active:
+            rate.is_active = True
+            update_fields.append("is_active")
+        if update_fields:
+            update_fields.append("updated_at")
+            rate.save(update_fields=update_fields)
+            record_project_rate_history(
+                project=project,
+                user=user,
+                hourly_rate=rate.hourly_rate,
+                currency=rate.currency,
+                effective_from=effective_from,
+            )
+        return rate
+
+    rate = ProjectUserRate.objects.create(
+        project=project,
+        user=user,
+        hourly_rate=hourly_rate,
+        currency=currency,
+        effective_from=effective_from,
+        is_active=True,
+    )
+    record_project_rate_history(
+        project=project,
+        user=user,
+        hourly_rate=rate.hourly_rate,
+        currency=rate.currency,
+        effective_from=rate.effective_from,
+    )
+    return rate
+
+
+def remove_project_user_rate(*, project, user):
+    rate = get_current_project_user_rate(project=project, user=user)
+    if not rate:
+        return False
+    rate.delete()
+    return True

apps/projects/tests/test_views.py

@@ -1,9 +1,11 @@
+from decimal import Decimal
+
 from rest_framework.test import APITestCase
 
 from apps.clients.models import Client
-from apps.projects.models import Project, ProjectAccess
+from apps.projects.models import Project, ProjectAccess, ProjectUserRate
 from apps.users.models import User
-from apps.workspaces.models import Workspace, WorkspaceMembership
+from apps.workspaces.models import PriceUnit, Workspace, WorkspaceMembership, WorkspaceUserRate
 
 
 class ProjectViewTests(APITestCase):
@@ -15,6 +17,7 @@ class ProjectViewTests(APITestCase):
             first_name="Owner",
         )
         cls.workspace = Workspace.objects.create(name="Projects", owner=cls.owner)
+        PriceUnit.objects.create(code="USD", name="US Dollar", local_name="Dollar", symbol="$")
         cls.member = User.objects.create_user(
             mobile="09121110002",
             password="secret123",
@@ -47,6 +50,14 @@ class ProjectViewTests(APITestCase):
         cls.first_project = Project.objects.get(name="Alpha")
         ProjectAccess.objects.create(project=cls.first_project, user=cls.member)
         ProjectAccess.objects.create(project=cls.second_project, user=cls.member)
+        WorkspaceUserRate.objects.create(
+            workspace=cls.workspace,
+            user=cls.member,
+            hourly_rate=Decimal("25.00"),
+            currency="USD",
+            effective_from=cls.workspace.created_at,
+            is_active=True,
+        )
 
     def test_project_list_supports_multi_client_filter(self):
         self.client.force_authenticate(user=self.member)
@@ -84,6 +95,9 @@ class ProjectViewTests(APITestCase):
         items = access_response.data["items"]
         gamma_item = next(item for item in items if item["id"] == str(self.third_project.id))
         self.assertFalse(gamma_item["has_access"])
+        alpha_item = next(item for item in items if item["id"] == str(self.first_project.id))
+        self.assertEqual(alpha_item["workspace_rate"]["hourly_rate"], "25.00")
+        self.assertIsNone(alpha_item["project_rate"])
 
         grant_response = self.client.post(
             "/api/projects/access/grant/",
@@ -114,3 +128,92 @@ class ProjectViewTests(APITestCase):
         )
         self.assertEqual(revoke_response.status_code, 200)
         self.assertFalse(ProjectAccess.objects.filter(project=self.first_project, user=self.member).exists())
+
+    def test_project_access_rate_endpoint_saves_override_and_keeps_it_dormant_after_revoke(self):
+        self.client.force_authenticate(user=self.owner)
+
+        save_response = self.client.post(
+            "/api/projects/access/rate/",
+            {
+                "workspace": str(self.workspace.id),
+                "user": str(self.member.id),
+                "project": str(self.first_project.id),
+                "hourly_rate": "44.50",
+                "currency": "USD",
+            },
+            format="json",
+        )
+
+        self.assertEqual(save_response.status_code, 200)
+        self.assertFalse(save_response.data["removed"])
+        self.assertEqual(save_response.data["item"]["project_rate"]["hourly_rate"], "44.50")
+        self.assertTrue(
+            ProjectUserRate.objects.filter(project=self.first_project, user=self.member, is_deleted=False).exists()
+        )
+
+        revoke_response = self.client.post(
+            "/api/projects/access/revoke/",
+            {
+                "workspace": str(self.workspace.id),
+                "user": str(self.member.id),
+                "project_ids": [str(self.first_project.id)],
+            },
+            format="json",
+        )
+        self.assertEqual(revoke_response.status_code, 200)
+        self.assertTrue(
+            ProjectUserRate.objects.filter(project=self.first_project, user=self.member, is_deleted=False).exists()
+        )
+
+        access_response = self.client.get(
+            "/api/projects/access/",
+            {"workspace": str(self.workspace.id), "user": str(self.member.id)},
+        )
+        self.assertEqual(access_response.status_code, 200)
+        alpha_item = next(item for item in access_response.data["items"] if item["id"] == str(self.first_project.id))
+        self.assertFalse(alpha_item["has_access"])
+        self.assertEqual(alpha_item["project_rate"]["hourly_rate"], "44.50")
+
+    def test_project_access_rate_endpoint_rejects_projects_without_access(self):
+        self.client.force_authenticate(user=self.owner)
+
+        response = self.client.post(
+            "/api/projects/access/rate/",
+            {
+                "workspace": str(self.workspace.id),
+                "user": str(self.member.id),
+                "project": str(self.third_project.id),
+                "hourly_rate": "44.50",
+                "currency": "USD",
+            },
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, 400)
+        self.assertIn("Grant project access", response.data["detail"])
+
+    def test_owner_access_state_marks_all_projects_as_accessible_and_allows_project_rate_override(self):
+        self.client.force_authenticate(user=self.owner)
+
+        access_response = self.client.get(
+            "/api/projects/access/",
+            {"workspace": str(self.workspace.id), "user": str(self.owner.id)},
+        )
+        self.assertEqual(access_response.status_code, 200)
+        self.assertTrue(all(item["has_access"] for item in access_response.data["items"]))
+
+        save_response = self.client.post(
+            "/api/projects/access/rate/",
+            {
+                "workspace": str(self.workspace.id),
+                "user": str(self.owner.id),
+                "project": str(self.first_project.id),
+                "hourly_rate": "60.00",
+                "currency": "USD",
+            },
+            format="json",
+        )
+
+        self.assertEqual(save_response.status_code, 200)
+        self.assertEqual(save_response.data["item"]["project_rate"]["hourly_rate"], "60.00")
+        self.assertTrue(ProjectUserRate.objects.filter(project=self.first_project, user=self.owner, is_deleted=False).exists())

apps/reports/api/urls.py

@@ -6,6 +6,7 @@ from apps.reports.api.views import (
     ReportDayDetailsView,
     ReportExportJobViewSet,
     ReportTableView,
+    ReportUserSummaryView,
 )
 
 router = DefaultRouter()
@@ -15,6 +16,6 @@ urlpatterns = [
     path("chart/", ReportChartView.as_view(), name="report-chart"),
     path("table/", ReportTableView.as_view(), name="report-table"),
     path("day-details/", ReportDayDetailsView.as_view(), name="report-day-details"),
+    path("user-summary/", ReportUserSummaryView.as_view(), name="report-user-summary"),
     path("", include(router.urls)),
 ]
-

apps/reports/api/views.py

@@ -20,6 +20,7 @@ from apps.reports.services import (
     build_chart_report,
     build_day_details_report,
     build_table_report,
+    build_user_summary_report,
     load_report_filters,
 )
 from apps.reports.tasks import generate_report_export_task
@@ -83,6 +84,24 @@ class ReportDayDetailsView(APIView):
         return Response(payload)
 
 
+class ReportUserSummaryView(APIView):
+    permission_classes = [IsAuthenticated]
+
+    @extend_schema(responses=dict)
+    def get(self, request):
+        workspace_id = request.query_params.get("workspace")
+        payload = get_or_set_cache_payload(
+            CACHE_NAMESPACE_REPORTS,
+            ttl_seconds=REPORT_CACHE_TTL_SECONDS,
+            builder=lambda: build_user_summary_report(request.user, request.query_params),
+            resource="user-summary",
+            user_id=request.user.id,
+            workspace_id=workspace_id,
+            params=request.query_params,
+        )
+        return Response(payload)
+
+
 class ReportExportJobViewSet(
     mixins.CreateModelMixin,
     mixins.ListModelMixin,

apps/reports/services/__init__.py

@@ -2,6 +2,7 @@ from apps.reports.services.aggregation import (
     build_chart_report,
     build_day_details_report,
     build_table_report,
+    build_user_summary_report,
     build_user_scoped_table_reports,
     load_report_filters,
 )
@@ -10,6 +11,7 @@ __all__ = [
     "load_report_filters",
     "build_chart_report",
     "build_table_report",
+    "build_user_summary_report",
     "build_user_scoped_table_reports",
     "build_day_details_report",
 ]

apps/reports/services/aggregation.py

@@ -1,10 +1,10 @@
 from __future__ import annotations
 
 from collections import defaultdict
+from collections.abc import Iterable
 from dataclasses import dataclass, replace
 from datetime import date, datetime, time, timedelta
-from decimal import Decimal, ROUND_HALF_UP
-from typing import Iterable
+from decimal import ROUND_DOWN, Decimal
 
 import jdatetime
 from django.contrib.auth import get_user_model
@@ -18,7 +18,7 @@ from apps.projects.models import Project
 from apps.projects.services.access import user_has_project_access
 from apps.tags.models import Tag
 from apps.time_entries.models import TimeEntry
-from apps.workspaces.models import Workspace
+from apps.workspaces.models import HourlyRateHistory, Workspace
 from apps.workspaces.services import WORKSPACE_VIEW, get_workspace_role, has_workspace_capability
 
 User = get_user_model()
@@ -39,6 +39,25 @@ ALLOWED_PERIODS = {
     PERIOD_CUSTOM,
 }
 
+UNCATEGORIZED_IDS = {
+    "clients": "__uncategorized_client__",
+    "projects": "__uncategorized_project__",
+    "tags": "__uncategorized_tag__",
+}
+
+UNCATEGORIZED_LABELS = {
+    "en": {
+        "clients": "No client",
+        "projects": "No project",
+        "tags": "No tag",
+    },
+    "fa": {
+        "clients": "بدون مشتری",
+        "projects": "بدون پروژه",
+        "tags": "بدون تگ",
+    },
+}
+
 
 def _start_of_week(local_date: date) -> date:
     days_since_sunday = (local_date.weekday() + 1) % 7
@@ -91,128 +110,299 @@ def _serialize_rate(amount: Decimal | None, currency: str | None) -> dict | None
     }
 
 
-def _serialize_distinct_rates(entries: list[TimeEntry]) -> list[dict]:
+def _serialize_distinct_rates_from_rows(rate_rows: list[dict]) -> list[dict]:
     unique_rates: set[tuple[str, str]] = set()
-    for entry in entries:
-        if not entry.hourly_rate:
-            continue
-        unique_rates.add((f"{Decimal(entry.hourly_rate).quantize(Decimal('0.01'))}", entry.currency or "USD"))
+    for row in rate_rows:
+        unique_rates.add((row["amount"], row["currency"]))
     return [
         {"amount": amount, "currency": currency}
         for amount, currency in sorted(unique_rates, key=lambda item: (item[1], Decimal(item[0])))
     ]
 
 
-def _serialize_rate_periods(entries: list[TimeEntry]) -> list[dict]:
-    sorted_entries = sorted(entries, key=lambda entry: entry.start_time)
-    periods: list[dict] = []
-    current: dict | None = None
+def _serialize_rate_history_rows(*, user, workspace: Workspace, from_date: date, to_date: date) -> list[dict]:
+    current_timezone = timezone.get_current_timezone()
+    period_start = timezone.make_aware(datetime.combine(from_date, time.min), current_timezone)
+    period_end = timezone.make_aware(datetime.combine(to_date + timedelta(days=1), time.min), current_timezone)
+    rows = list(
+        HourlyRateHistory.objects.filter(
+            workspace=workspace,
+            user=user,
+            is_deleted=False,
+            effective_from__lt=period_end,
+        )
+        .select_related("project")
+        .order_by("scope", "project_id", "effective_from", "created_at")
+    )
 
-    for entry in sorted_entries:
-        if not entry.hourly_rate:
-            continue
+    grouped: dict[tuple[str, str | None], list[HourlyRateHistory]] = defaultdict(list)
+    for row in rows:
+        grouped[(row.scope, str(row.project_id) if row.project_id else None)].append(row)
 
-        amount = f"{Decimal(entry.hourly_rate).quantize(Decimal('0.01'))}"
-        currency = entry.currency or "USD"
-        start_date = _localize_datetime(entry.start_time).date()
-        end_source = entry.end_time or entry.start_time
-        end_date = _localize_datetime(end_source).date()
+    serialized: list[dict] = []
+    for (_scope, _project_id), history_rows in grouped.items():
+        selected_indexes = {
+            index for index, row in enumerate(history_rows) if row.effective_from >= period_start
+        }
+        previous_indexes = [
+            index for index, row in enumerate(history_rows) if row.effective_from < period_start
+        ]
+        if previous_indexes:
+            selected_indexes.add(previous_indexes[-1])
 
-        if (
-            current
-            and current["amount"] == amount
-            and current["currency"] == currency
-        ):
-            if end_date > current["to_date"]:
-                current["to_date"] = end_date
-            continue
-
-        if current:
-            periods.append(
+        for index in sorted(selected_indexes):
+            row = history_rows[index]
+            next_row = history_rows[index + 1] if index + 1 < len(history_rows) else None
+            if next_row and next_row.effective_from < period_start:
+                continue
+            from_day = max(_localize_datetime(row.effective_from).date(), from_date)
+            to_day = min(_localize_datetime(next_row.effective_from).date(), to_date) if next_row else None
+            serialized.append(
                 {
-                    "amount": current["amount"],
-                    "currency": current["currency"],
-                    "from_date": current["from_date"].isoformat(),
-                    "to_date": current["to_date"].isoformat(),
+                    "amount": f"{Decimal(row.hourly_rate).quantize(Decimal('0.01'))}",
+                    "currency": row.currency or "USD",
+                    "from_date": from_day.isoformat(),
+                    "to_date": to_day.isoformat() if to_day else None,
+                    "scope": row.scope,
+                    "project_name": row.project.name if row.project else None,
+                    "is_current": next_row is None,
                 }
             )
 
-        current = {
-            "amount": amount,
-            "currency": currency,
-            "from_date": start_date,
-            "to_date": end_date,
-        }
-
-    if current:
-        periods.append(
-            {
-                "amount": current["amount"],
-                "currency": current["currency"],
-                "from_date": current["from_date"].isoformat(),
-                "to_date": current["to_date"].isoformat(),
-            }
-        )
-
-    return periods
+    return sorted(
+        serialized,
+        key=lambda item: (
+            item["from_date"],
+            item["scope"],
+            item.get("project_name") or "",
+            Decimal(item["amount"]),
+        ),
+    )
 
 
-def _serialize_percentage_rows(shares: dict[str, dict], total_seconds: int) -> list[dict]:
-    if total_seconds <= 0:
-        return []
-    rows = []
-    for bucket in shares.values():
-        percentage = (
-            Decimal(bucket["seconds"]) * Decimal("100") / Decimal(total_seconds)
-        ).quantize(Decimal("1"), rounding=ROUND_HALF_UP)
-        rows.append(
-            {
-                "id": bucket["id"],
-                "name": bucket["name"],
-                "percentage": f"{percentage}",
-            }
-        )
-    rows.sort(key=lambda item: (-Decimal(item["percentage"]), item["name"].lower()))
-    return rows
+def _uncategorized_label(kind: str, language: str) -> str:
+    if language == "fa":
+        return {
+            "clients": "بدون مشتری",
+            "projects": "بدون پروژه",
+            "tags": "بدون تگ",
+        }[kind]
+    resolved_language = language if language in UNCATEGORIZED_LABELS else "en"
+    return UNCATEGORIZED_LABELS[resolved_language][kind]
 
 
-def _build_user_summary(user, entries: list[TimeEntry]) -> dict:
-    summary = _summary_from_entries(entries)
-    project_shares: dict[str, dict] = {}
-    client_shares: dict[str, dict] = {}
-    tag_shares: dict[str, dict] = {}
+def _share_bucket(bucket_id: str, name: str) -> dict:
+    return {
+        "id": bucket_id,
+        "name": name,
+        "seconds": Decimal("0"),
+        "income": _money_map(),
+    }
 
-    total_seconds = summary["billable_seconds"]
+
+def _entry_income_payload(entry: TimeEntry) -> tuple[str, Decimal] | None:
+    if not entry.is_billable or not entry.hourly_rate:
+        return None
+
+    duration_seconds = get_entry_duration_seconds(entry)
+    if duration_seconds <= 0:
+        return None
+
+    hourly_rate = Decimal(entry.hourly_rate)
+    income = (hourly_rate * Decimal(duration_seconds) / Decimal(3600)).quantize(Decimal("0.01"))
+    return entry.currency or "USD", income
+
+
+def _add_money(bucket: defaultdict[str, Decimal], currency: str, amount: Decimal) -> None:
+    bucket[currency] += amount
+
+
+def _breakdown_targets(entry: TimeEntry, kind: str, language: str) -> list[tuple[str, str]]:
+    if kind == "clients":
+        if entry.project and entry.project.client:
+            return [(str(entry.project.client_id), entry.project.client.name)]
+        return [(UNCATEGORIZED_IDS[kind], _uncategorized_label(kind, language))]
+
+    if kind == "projects":
+        if entry.project:
+            return [(str(entry.project_id), entry.project.name)]
+        return [(UNCATEGORIZED_IDS[kind], _uncategorized_label(kind, language))]
+
+    tags = list(entry.tags.all())
+    if tags:
+        return [(str(tag.id), tag.name) for tag in tags]
+    return [(UNCATEGORIZED_IDS[kind], _uncategorized_label(kind, language))]
+
+
+def _accumulate_breakdown_shares(entries: list[TimeEntry], kind: str, *, language: str) -> dict[str, dict]:
+    shares: dict[str, dict] = {}
     for entry in entries:
         if not entry.is_billable:
             continue
+
         duration_seconds = get_entry_duration_seconds(entry)
         if duration_seconds <= 0:
             continue
 
-        if entry.project_id:
-            project_bucket = project_shares.setdefault(
-                str(entry.project_id),
-                {"id": str(entry.project_id), "name": entry.project.name, "seconds": 0},
-            )
-            project_bucket["seconds"] += duration_seconds
+        targets = _breakdown_targets(entry, kind, language)
+        divisor = Decimal(len(targets)) if kind == "tags" and targets else Decimal("1")
+        income_payload = _entry_income_payload(entry)
 
-        if entry.project and entry.project.client_id:
-            client_bucket = client_shares.setdefault(
-                str(entry.project.client_id),
-                {"id": str(entry.project.client_id), "name": entry.project.client.name, "seconds": 0},
-            )
-            client_bucket["seconds"] += duration_seconds
+        for bucket_id, bucket_name in targets:
+            bucket = shares.setdefault(bucket_id, _share_bucket(bucket_id, bucket_name))
+            bucket["seconds"] += Decimal(duration_seconds) / divisor
+            if income_payload:
+                currency, amount = income_payload
+                _add_money(bucket["income"], currency, amount / divisor)
 
-        tags = list(entry.tags.all())
-        if tags:
-            allocated_seconds = Decimal(duration_seconds) / Decimal(len(tags))
-            for tag in tags:
-                tag_bucket = tag_shares.setdefault(
-                    str(tag.id),
-                    {"id": str(tag.id), "name": tag.name, "seconds": Decimal("0")},
-                )
-                tag_bucket["seconds"] += allocated_seconds
+    return shares
+
+
+def _allocate_percentage_rows(items: list[dict], total_value: Decimal) -> list[dict]:
+    if total_value <= 0 or not items:
+        return []
+
+    working_rows: list[dict] = []
+    assigned_total = 0
+    for item in items:
+        value = Decimal(item["value"])
+        raw_percentage = (value * Decimal("100") / total_value) if value > 0 else Decimal("0")
+        floored_percentage = int(raw_percentage.quantize(Decimal("1"), rounding=ROUND_DOWN))
+        assigned_total += floored_percentage
+        working_rows.append(
+            {
+                "id": item["id"],
+                "name": item["name"],
+                "value": value,
+                "percentage": floored_percentage,
+                "remainder": raw_percentage - Decimal(floored_percentage),
+            }
+        )
+
+    remaining_points = max(0, 100 - assigned_total)
+    for row in sorted(
+        working_rows,
+        key=lambda item: (-item["remainder"], -item["value"], item["name"].lower(), item["id"]),
+    )[:remaining_points]:
+        row["percentage"] += 1
+
+    serialized = [
+        {
+            "id": row["id"],
+            "name": row["name"],
+            "percentage": str(row["percentage"]),
+        }
+        for row in working_rows
+    ]
+    serialized.sort(key=lambda item: (-Decimal(item["percentage"]), item["name"].lower()))
+    return serialized
+
+
+def _single_currency_amount(income_totals: list[dict]) -> tuple[str | None, Decimal] | None:
+    non_zero_totals: list[tuple[str, Decimal]] = []
+    for item in income_totals:
+        amount = Decimal(item["amount"])
+        if amount == 0:
+            continue
+        non_zero_totals.append((item["currency"], amount))
+
+    if not non_zero_totals:
+        return None, Decimal("0")
+
+    currencies = {currency for currency, _ in non_zero_totals}
+    if len(currencies) != 1:
+        return None
+
+    currency = non_zero_totals[0][0]
+    total_amount = sum((amount for _, amount in non_zero_totals), Decimal("0"))
+    return currency, total_amount
+
+
+def _complete_percentage_rows(
+    rows: list[dict],
+    percentage_rows: list[dict],
+    *,
+    unavailable: bool = False,
+) -> list[dict]:
+    if unavailable:
+        return []
+
+    existing_ids = {row["id"] for row in percentage_rows}
+    completed = percentage_rows + [
+        {"id": row["id"], "name": row["name"], "percentage": "0"}
+        for row in rows
+        if row["id"] not in existing_ids
+    ]
+    completed.sort(key=lambda item: (-Decimal(item["percentage"]), item["name"].lower()))
+    return completed
+
+
+def _serialize_time_percentage_rows(rows: list[dict], shares: dict[str, dict]) -> list[dict]:
+    items = [
+        {
+            "id": bucket["id"],
+            "name": bucket["name"],
+            "value": Decimal(bucket["seconds"]),
+        }
+        for bucket in shares.values()
+    ]
+    total_seconds = sum((item["value"] for item in items), Decimal("0"))
+    return _complete_percentage_rows(rows, _allocate_percentage_rows(items, total_seconds))
+
+
+def _serialize_income_percentage_rows(rows: list[dict], shares: dict[str, dict]) -> list[dict]:
+    items: list[dict] = []
+    currencies: set[str] = set()
+
+    for bucket in shares.values():
+        income_totals = _serialize_money_totals(bucket["income"])
+        currency_amount = _single_currency_amount(income_totals)
+        if currency_amount is None:
+            return []
+
+        currency, amount = currency_amount
+        if currency:
+            currencies.add(currency)
+        items.append(
+            {
+                "id": bucket["id"],
+                "name": bucket["name"],
+                "value": amount,
+            }
+        )
+
+    if len(currencies) > 1:
+        return []
+
+    total_income = sum((item["value"] for item in items), Decimal("0"))
+    if total_income <= 0:
+        return []
+
+    return _complete_percentage_rows(rows, _allocate_percentage_rows(items, total_income))
+
+
+def _build_user_summary(
+    user,
+    entries: list[TimeEntry],
+    *,
+    workspace: Workspace,
+    from_date: date,
+    to_date: date,
+    language: str,
+) -> dict:
+    summary = _summary_from_entries(entries)
+    rate_rows = _serialize_rate_history_rows(
+        user=user,
+        workspace=workspace,
+        from_date=from_date,
+        to_date=to_date,
+    )
+    project_rows = _build_breakdown(entries, "projects", language=language)
+    client_rows = _build_breakdown(entries, "clients", language=language)
+    tag_rows = _build_breakdown(entries, "tags", language=language)
+    project_shares = _accumulate_breakdown_shares(entries, "projects", language=language)
+    client_shares = _accumulate_breakdown_shares(entries, "clients", language=language)
+    tag_shares = _accumulate_breakdown_shares(entries, "tags", language=language)
 
     return {
         "user": {
@@ -220,73 +410,62 @@ def _build_user_summary(user, entries: list[TimeEntry]) -> dict:
             "name": _user_display(user),
             "mobile": user.mobile,
         },
-        "hourly_rates": _serialize_distinct_rates(entries),
-        "rate_periods": _serialize_rate_periods(entries),
-        "total_seconds": total_seconds,
+        "hourly_rates": _serialize_distinct_rates_from_rows(rate_rows),
+        "rate_periods": rate_rows,
+        "total_seconds": summary["billable_seconds"],
         "total_duration": summary["total_duration"],
         "billable_seconds": summary["billable_seconds"],
         "billable_duration": summary["billable_duration"],
         "non_billable_seconds": summary["non_billable_seconds"],
         "non_billable_duration": summary["non_billable_duration"],
         "income_totals": summary["income_totals"],
-        "project_percentages": _serialize_percentage_rows(project_shares, total_seconds),
-        "client_percentages": _serialize_percentage_rows(client_shares, total_seconds),
-        "tag_percentages": _serialize_percentage_rows(tag_shares, total_seconds),
+        "project_percentages": _serialize_time_percentage_rows(project_rows, project_shares),
+        "client_percentages": _serialize_time_percentage_rows(client_rows, client_shares),
+        "tag_percentages": _serialize_time_percentage_rows(tag_rows, tag_shares),
+        "project_income_percentages": _serialize_income_percentage_rows(project_rows, project_shares),
+        "client_income_percentages": _serialize_income_percentage_rows(client_rows, client_shares),
+        "tag_income_percentages": _serialize_income_percentage_rows(tag_rows, tag_shares),
     }
 
 
-def _build_user_summaries(entries: list[TimeEntry]) -> list[dict]:
+def _build_user_summaries(entries: list[TimeEntry], *, filters: ReportFilters) -> list[dict]:
     grouped: dict[str, list[TimeEntry]] = defaultdict(list)
     for entry in entries:
         grouped[str(entry.user_id)].append(entry)
 
-    summaries = [_build_user_summary(grouped_entries[0].user, grouped_entries) for grouped_entries in grouped.values() if grouped_entries]
+    summaries = [
+        _build_user_summary(
+            grouped_entries[0].user,
+            grouped_entries,
+            workspace=filters.workspace,
+            from_date=filters.from_date,
+            to_date=filters.to_date,
+            language=filters.language,
+        )
+        for grouped_entries in grouped.values()
+        if grouped_entries
+    ]
     summaries.sort(key=lambda item: item["user"]["name"].lower())
     return summaries
 
 
-def _build_overall_percentage_payload(entries: list[TimeEntry]) -> dict:
-    project_shares: dict[str, dict] = {}
-    client_shares: dict[str, dict] = {}
-    tag_shares: dict[str, dict] = {}
-    total_seconds = 0
-
-    for entry in entries:
-        if not entry.is_billable:
-            continue
-        duration_seconds = get_entry_duration_seconds(entry)
-        if duration_seconds <= 0:
-            continue
-        total_seconds += duration_seconds
-
-        if entry.project_id:
-            project_bucket = project_shares.setdefault(
-                str(entry.project_id),
-                {"id": str(entry.project_id), "name": entry.project.name, "seconds": 0},
-            )
-            project_bucket["seconds"] += duration_seconds
-
-        if entry.project and entry.project.client_id:
-            client_bucket = client_shares.setdefault(
-                str(entry.project.client_id),
-                {"id": str(entry.project.client_id), "name": entry.project.client.name, "seconds": 0},
-            )
-            client_bucket["seconds"] += duration_seconds
-
-        tags = list(entry.tags.all())
-        if tags:
-            allocated_seconds = Decimal(duration_seconds) / Decimal(len(tags))
-            for tag in tags:
-                tag_bucket = tag_shares.setdefault(
-                    str(tag.id),
-                    {"id": str(tag.id), "name": tag.name, "seconds": Decimal("0")},
-                )
-                tag_bucket["seconds"] += allocated_seconds
+def _build_overall_percentage_payload(
+    entries: list[TimeEntry],
+    *,
+    language: str,
+    rows_by_kind: dict[str, list[dict]],
+) -> dict:
+    project_shares = _accumulate_breakdown_shares(entries, "projects", language=language)
+    client_shares = _accumulate_breakdown_shares(entries, "clients", language=language)
+    tag_shares = _accumulate_breakdown_shares(entries, "tags", language=language)
 
     return {
-        "project_percentages": _serialize_percentage_rows(project_shares, total_seconds),
-        "client_percentages": _serialize_percentage_rows(client_shares, total_seconds),
-        "tag_percentages": _serialize_percentage_rows(tag_shares, total_seconds),
+        "project_percentages": _serialize_time_percentage_rows(rows_by_kind["projects"], project_shares),
+        "client_percentages": _serialize_time_percentage_rows(rows_by_kind["clients"], client_shares),
+        "tag_percentages": _serialize_time_percentage_rows(rows_by_kind["tags"], tag_shares),
+        "project_income_percentages": _serialize_income_percentage_rows(rows_by_kind["projects"], project_shares),
+        "client_income_percentages": _serialize_income_percentage_rows(rows_by_kind["clients"], client_shares),
+        "tag_income_percentages": _serialize_income_percentage_rows(rows_by_kind["tags"], tag_shares),
     }
 
 
@@ -344,7 +523,13 @@ class ReportFilterSerializer(serializers.Serializer):
     language = serializers.ChoiceField(choices=("en", "fa"), required=False, default="en")
 
 
-def _resolve_period_bounds(period: str, from_date: date | None, to_date: date | None, *, language: str) -> tuple[date, date]:
+def _resolve_period_bounds(
+    period: str,
+    from_date: date | None,
+    to_date: date | None,
+    *,
+    language: str,
+) -> tuple[date, date]:
     today = timezone.localdate()
     if language == "fa":
         today_jalali = jdatetime.date.fromgregorian(date=today)
@@ -412,7 +597,11 @@ def load_report_filters(actor, raw_data) -> ReportFilters:
         "user": raw_data.get("user"),
         "client": raw_data.get("client"),
         "project": raw_data.get("project"),
-        "tags": raw_data.get("tags") or raw_data.getlist("tags") if hasattr(raw_data, "getlist") else raw_data.get("tags"),
+        "tags": (
+            raw_data.get("tags") or raw_data.getlist("tags")
+            if hasattr(raw_data, "getlist")
+            else raw_data.get("tags")
+        ),
         "language": raw_data.get("language", "en"),
     }
     if normalized["tags"] and not isinstance(normalized["tags"], list):
@@ -476,8 +665,15 @@ def load_report_filters(actor, raw_data) -> ReportFilters:
 
 
 def _base_queryset(filters: ReportFilters) -> QuerySet[TimeEntry]:
-    start_dt = timezone.make_aware(datetime.combine(filters.from_date, time.min), timezone.get_current_timezone())
-    end_dt = timezone.make_aware(datetime.combine(filters.to_date + timedelta(days=1), time.min), timezone.get_current_timezone())
+    current_timezone = timezone.get_current_timezone()
+    start_dt = timezone.make_aware(
+        datetime.combine(filters.from_date, time.min),
+        current_timezone,
+    )
+    end_dt = timezone.make_aware(
+        datetime.combine(filters.to_date + timedelta(days=1), time.min),
+        current_timezone,
+    )
 
     queryset = (
         TimeEntry.objects.filter(
@@ -580,9 +776,6 @@ def _bucket_key(filters: ReportFilters, local_dt: datetime) -> tuple[str, date]:
     if filters.period in {PERIOD_THIS_WEEK, PERIOD_THIS_MONTH, PERIOD_CUSTOM}:
         bucket_date = local_dt.date()
         return bucket_date.isoformat(), bucket_date
-    if filters.language == "fa":
-        persian_date = jdatetime.date.fromgregorian(date=local_dt.date())
-        return f"{persian_date.year:04d}-{persian_date.month:02d}", local_dt.date()
     bucket_date = date(local_dt.year, local_dt.month, 1)
     return bucket_date.strftime("%Y-%m"), bucket_date
 
@@ -660,7 +853,11 @@ def _scope_payload(filters: ReportFilters) -> dict:
         "workspace": {
             "id": str(filters.workspace.id),
             "name": filters.workspace.name,
-            "thumbnail_path": filters.workspace.thumbnail.path if getattr(filters.workspace, "thumbnail", None) else None,
+            "thumbnail_path": (
+                filters.workspace.thumbnail.path
+                if getattr(filters.workspace, "thumbnail", None)
+                else None
+            ),
         },
         "period": filters.period,
         "from_date": filters.from_date.isoformat(),
@@ -684,16 +881,29 @@ def _table_report_payload(
 ) -> dict:
     summary = _summary_from_entries(entries)
     include_latest_rate = not (filters.is_workspace_scope and not filters.user_id)
+    client_rows = _build_breakdown(entries, "clients", language=filters.language)
+    project_rows = _build_breakdown(entries, "projects", language=filters.language)
+    tag_rows = _build_breakdown(entries, "tags", language=filters.language)
     payload = {
         "scope": _scope_payload(filters),
         "summary": summary,
         "days": _group_daily(entries, include_latest_rate=include_latest_rate),
-        "clients": _build_breakdown(entries, "clients"),
-        "projects": _build_breakdown(entries, "projects"),
-        "tags": _build_breakdown(entries, "tags"),
+        "clients": client_rows,
+        "projects": project_rows,
+        "tags": tag_rows,
     }
     if filters.is_workspace_scope and not filters.user_id:
-        payload.update(_build_overall_percentage_payload(entries))
+        payload.update(
+            _build_overall_percentage_payload(
+                entries,
+                language=filters.language,
+                rows_by_kind={
+                    "clients": client_rows,
+                    "projects": project_rows,
+                    "tags": tag_rows,
+                },
+            )
+        )
     if user_summary is not None:
         payload["user_summary"] = user_summary
     if user_summaries is not None:
@@ -761,64 +971,31 @@ def _group_daily(entries: list[TimeEntry], *, include_latest_rate: bool) -> list
     return rows
 
 
-def _build_breakdown(entries: list[TimeEntry], kind: str) -> list[dict]:
+def _build_breakdown(entries: list[TimeEntry], kind: str, *, language: str) -> list[dict]:
     data: dict[str, dict] = {}
     for entry in entries:
-        if kind == "clients":
-            if not entry.project or not entry.project.client:
-                continue
-            item_id = str(entry.project.client_id)
-            item_name = entry.project.client.name
-        elif kind == "projects":
-            if not entry.project:
-                continue
-            item_id = str(entry.project_id)
-            item_name = entry.project.name
-        else:
-            if not entry.tags.exists():
-                continue
-            for tag in entry.tags.all():
-                bucket = data.setdefault(
-                    str(tag.id),
-                    {
-                        "id": str(tag.id),
-                        "name": tag.name,
-                        "billable_seconds": 0,
-                        "non_billable_seconds": 0,
-                        "total_seconds": 0,
-                        "income": _money_map(),
-                    },
-                )
-                duration_seconds = get_entry_duration_seconds(entry)
-                bucket["total_seconds"] += duration_seconds
-                if entry.is_billable:
-                    bucket["billable_seconds"] += duration_seconds
-                else:
-                    bucket["non_billable_seconds"] += duration_seconds
-                _add_income(bucket["income"], entry)
-            continue
-
-        bucket = data.setdefault(
-            item_id,
-            {
-                "id": item_id,
-                "name": item_name,
-                "billable_seconds": 0,
-                "non_billable_seconds": 0,
-                "total_seconds": 0,
-                "income": _money_map(),
-            },
-        )
         duration_seconds = get_entry_duration_seconds(entry)
-        bucket["total_seconds"] += duration_seconds
-        if entry.is_billable:
-            bucket["billable_seconds"] += duration_seconds
-        else:
-            bucket["non_billable_seconds"] += duration_seconds
-        _add_income(bucket["income"], entry)
+        for item_id, item_name in _breakdown_targets(entry, kind, language):
+            bucket = data.setdefault(
+                item_id,
+                {
+                    "id": item_id,
+                    "name": item_name,
+                    "billable_seconds": 0,
+                    "non_billable_seconds": 0,
+                    "total_seconds": 0,
+                    "income": _money_map(),
+                },
+            )
+            bucket["total_seconds"] += duration_seconds
+            if entry.is_billable:
+                bucket["billable_seconds"] += duration_seconds
+            else:
+                bucket["non_billable_seconds"] += duration_seconds
+            _add_income(bucket["income"], entry)
 
     rows = []
-    for item_id, bucket in sorted(data.items(), key=lambda item: item[1]["name"].lower()):
+    for _item_id, bucket in sorted(data.items(), key=lambda item: item[1]["name"].lower()):
         rows.append(
             {
                 "id": bucket["id"],
@@ -839,8 +1016,45 @@ def build_table_report(actor, raw_filters) -> dict:
     filters = load_report_filters(actor, raw_filters)
     entries = list(_base_queryset(filters))
     if filters.is_workspace_scope and not filters.user_id:
-        return _table_report_payload(filters, entries, user_summaries=_build_user_summaries(entries))
-    user_summary = _build_user_summary(entries[0].user, entries) if entries and filters.user_id else None
+        payload = _table_report_payload(
+            filters,
+            entries,
+            user_summaries=_build_user_summaries(entries, filters=filters),
+        )
+        return payload
+    user_summary = (
+        _build_user_summary(
+            entries[0].user,
+            entries,
+            workspace=filters.workspace,
+            from_date=filters.from_date,
+            to_date=filters.to_date,
+            language=filters.language,
+        )
+        if entries and filters.user_id
+        else None
+    )
+    return _table_report_payload(filters, entries, user_summary=user_summary)
+
+
+def build_user_summary_report(actor, raw_filters) -> dict:
+    filters = load_report_filters(actor, raw_filters)
+    if not filters.user_id:
+        raise serializers.ValidationError("A user is required.")
+
+    entries = list(_base_queryset(filters))
+    user_summary = (
+        _build_user_summary(
+            entries[0].user,
+            entries,
+            workspace=filters.workspace,
+            from_date=filters.from_date,
+            to_date=filters.to_date,
+            language=filters.language,
+        )
+        if entries
+        else None
+    )
     return _table_report_payload(filters, entries, user_summary=user_summary)
 
 
@@ -866,7 +1080,14 @@ def build_user_scoped_table_reports(actor, raw_filters) -> list[dict]:
             _table_report_payload(
                 user_filters,
                 user_entries,
-                user_summary=_build_user_summary(user_entries[0].user, user_entries),
+                user_summary=_build_user_summary(
+                    user_entries[0].user,
+                    user_entries,
+                    workspace=filters.workspace,
+                    from_date=filters.from_date,
+                    to_date=filters.to_date,
+                    language=filters.language,
+                ),
             )
         )
     return reports

apps/reports/services/export_i18n.py

@@ -1,10 +1,10 @@
 from __future__ import annotations
 
+from collections.abc import Iterable
 from dataclasses import dataclass
 from datetime import date
 from decimal import Decimal, InvalidOperation
 from pathlib import Path
-from typing import Iterable
 
 import jdatetime
 from arabic_reshaper import reshape
@@ -49,7 +49,13 @@ TRANSLATIONS = {
         "rate_history": "Hourly rate history",
         "from": "From",
         "to": "To",
+        "now": "Now",
+        "project": "Project",
         "percentage": "Percentage",
+        "hour_percentage": "Hour %",
+        "income_percentage": "Income %",
+        "multiple_rates": "Multiple rates - see details",
+        "variable_rate": "Variable rate",
         "none": "None",
         "daily_summary": "Daily Summary",
         "clients": "Clients",
@@ -59,6 +65,9 @@ TRANSLATIONS = {
         "name": "Name",
         "total": "Total",
         "no_data": "No data",
+        "uncategorized_client": "No client",
+        "uncategorized_project": "No project",
+        "uncategorized_tag": "No tag",
     },
     "fa": {
         "report_title": "گزارش فضای کاری",
@@ -88,7 +97,13 @@ TRANSLATIONS = {
         "rate_history": "تاریخچه نرخ ساعتی",
         "from": "از",
         "to": "تا",
+        "now": "حال",
+        "project": "پروژه",
         "percentage": "درصد",
+        "hour_percentage": "درصد ساعت",
+        "income_percentage": "درصد کارکرد",
+        "multiple_rates": "چند نرخ - جزئیات در گزارش کاربر",
+        "variable_rate": "نرخ متغیر",
         "none": "بدون مورد",
         "daily_summary": "خلاصه روزانه",
         "clients": "مشتریان",
@@ -98,6 +113,9 @@ TRANSLATIONS = {
         "name": "نام",
         "total": "جمع",
         "no_data": "بدون داده",
+        "uncategorized_client": "بدون مشتری",
+        "uncategorized_project": "بدون پروژه",
+        "uncategorized_tag": "بدون تگ",
     },
 }
 
@@ -130,6 +148,8 @@ CURRENCY_LABELS = {
     "TRY": {"en": "TRY", "fa": "لیر"},
 }
 
+DECIMAL_TRIM_CURRENCIES = {"IRR", "IRT"}
+
 
 @dataclass(frozen=True)
 class ExportLocale:
@@ -164,6 +184,15 @@ class ExportLocale:
         return self.format_number(value, ascii_digits=ascii_digits)
 
     def format_amount(self, value: object, *, ascii_digits: bool = False) -> str:
+        return self.format_amount_for_currency(value, None, ascii_digits=ascii_digits)
+
+    def format_amount_for_currency(
+        self,
+        value: object,
+        currency: str | None,
+        *,
+        ascii_digits: bool = False,
+    ) -> str:
         raw = str(value).strip()
         if not raw:
             return raw
@@ -179,18 +208,24 @@ class ExportLocale:
         grouped_integer = f"{int(integer_part):,}"
         formatted = f"{sign}{grouped_integer}"
         if fractional_part:
-            trimmed_fraction = fractional_part.rstrip("0")
+            trimmed_fraction = (
+                ""
+                if str(currency or "").upper() in DECIMAL_TRIM_CURRENCIES
+                else fractional_part.rstrip("0")
+            )
             if trimmed_fraction:
                 formatted = f"{formatted}.{trimmed_fraction}"
         return self.format_number(formatted, ascii_digits=ascii_digits)
 
     def format_money_label(self, income_totals: list[dict], *, ascii_digits: bool = False) -> str:
         if not income_totals:
-            return "-"
+            return self.format_number("0", ascii_digits=ascii_digits)
         parts = []
         for item in income_totals:
             currency = self.currency_label(item["currency"])
-            parts.append(f"{self.format_amount(item['amount'], ascii_digits=ascii_digits)} {currency}")
+            parts.append(
+                f"{self.format_amount_for_currency(item['amount'], item['currency'], ascii_digits=ascii_digits)} {currency}"
+            )
         return " | ".join(parts)
 
     def currency_label(self, code: str | None) -> str:
@@ -225,7 +260,7 @@ def user_label(user_payload: dict | None, locale: ExportLocale, *, ascii_digits:
 
 
 def safe_sheet_title(title: str, used: Iterable[str]) -> str:
-    invalid = set('[]:*?/\\')
+    invalid = set("[]:*?/\\")
     sanitized = "".join("-" if char in invalid else char for char in title).strip() or "Sheet"
     base = sanitized[:31]
     used_set = set(used)

apps/reports/tests/test_exporters.py

@@ -4,7 +4,13 @@ from django.test import TestCase
 from openpyxl import load_workbook
 
 from apps.reports.services.export_i18n import build_export_locale
-from apps.reports.services.exporters import build_excel_report, build_pdf_report
+from apps.reports.services.exporters import (
+    _pdf_summary_rate_label,
+    _rate_label,
+    _sort_breakdown_rows,
+    build_excel_report,
+    build_pdf_report,
+)
 
 
 def make_report_data(*, user_name="Owner User", mobile="09129990001", hourly_rate=None):
@@ -68,17 +74,90 @@ def make_user_summary(*, name: str, mobile: str):
         "project_percentages": [{"id": "1", "name": "Website", "percentage": "100"}],
         "client_percentages": [{"id": "1", "name": "Acme", "percentage": "100"}],
         "tag_percentages": [{"id": "1", "name": "Design", "percentage": "100"}],
+        "project_income_percentages": [{"id": "1", "name": "Website", "percentage": "100"}],
+        "client_income_percentages": [{"id": "1", "name": "Acme", "percentage": "100"}],
+        "tag_income_percentages": [{"id": "1", "name": "Design", "percentage": "100"}],
     }
 
 
+def make_variable_user_summary(*, name: str, mobile: str):
+    summary = make_user_summary(name=name, mobile=mobile)
+    summary["hourly_rates"] = [
+        {"amount": "15.00", "currency": "USD"},
+        {"amount": "18.00", "currency": "USD"},
+    ]
+    summary["rate_periods"] = [
+        {
+            "amount": "15.00",
+            "currency": "USD",
+            "from_date": "2026-04-01",
+            "to_date": "2026-04-14",
+        },
+        {
+            "amount": "18.00",
+            "currency": "USD",
+            "from_date": "2026-04-15",
+            "to_date": "2026-04-30",
+        },
+    ]
+    return summary
+
+
 class ReportExporterTests(TestCase):
+    def test_export_rate_labels_trim_rial_and_toman_decimals(self):
+        locale = build_export_locale("en")
+
+        self.assertEqual(
+            _rate_label(locale, {"amount": "1250.75", "currency": "USD"}),
+            "1,250.75 USD",
+        )
+        self.assertEqual(
+            _rate_label(locale, {"amount": "1250.75", "currency": "IRR"}),
+            "1,250 IRR",
+        )
+        self.assertEqual(
+            _rate_label(locale, {"amount": "9800.50", "currency": "IRT"}),
+            "9,800 IRT",
+        )
+
+    def test_pdf_summary_uses_multiple_rates_label(self):
+        locale = build_export_locale("en")
+
+        self.assertEqual(
+            _pdf_summary_rate_label(
+                locale,
+                [
+                    {"amount": "15.00", "currency": "USD"},
+                    {"amount": "18.00", "currency": "USD"},
+                ],
+            ),
+            "Variable rate",
+        )
+
+    def test_breakdown_rows_are_sorted_by_hour_percentage(self):
+        rows = [
+            {"id": "low", "name": "Low", "billable_seconds": 7200},
+            {"id": "high", "name": "High", "billable_seconds": 3600},
+            {"id": "tie", "name": "Tie", "billable_seconds": 10800},
+        ]
+        percentages = [
+            {"id": "low", "name": "Low", "percentage": "20"},
+            {"id": "high", "name": "High", "percentage": "70"},
+            {"id": "tie", "name": "Tie", "percentage": "20"},
+        ]
+
+        self.assertEqual(
+            [row["name"] for row in _sort_breakdown_rows(rows, percentages)],
+            ["High", "Tie", "Low"],
+        )
+
     def test_excel_export_adds_per_user_sheets_and_daily_rate_column(self):
         locale = build_export_locale("en")
         report_data = make_report_data(
             hourly_rate={"amount": "15.00", "currency": "USD"},
         )
         report_data["user_summaries"] = [
-            make_user_summary(name="Owner User", mobile="09129990001"),
+            make_variable_user_summary(name="Owner User", mobile="09129990001"),
             make_user_summary(name="Team Mate", mobile="09129990002"),
         ]
         per_user_reports = [
@@ -88,7 +167,7 @@ class ReportExporterTests(TestCase):
                     mobile="09129990001",
                     hourly_rate={"amount": "15.00", "currency": "USD"},
                 ),
-                "user_summary": make_user_summary(name="Owner User", mobile="09129990001"),
+                "user_summary": make_variable_user_summary(name="Owner User", mobile="09129990001"),
             },
             {
                 **make_report_data(
@@ -117,34 +196,54 @@ class ReportExporterTests(TestCase):
         summary_sheet = workbook[workbook.sheetnames[0]]
         summary_values = list(summary_sheet.iter_rows(values_only=True))
 
+        self.assertEqual(summary_sheet.freeze_panes, "B1")
         self.assertEqual(summary_sheet["A1"].value, "Workspace Report")
         self.assertEqual(summary_sheet["B1"].value, "Exports")
         self.assertEqual(summary_sheet["A15"].value, "Users Summary")
-        self.assertIn("A15:M15", {str(item) for item in summary_sheet.merged_cells.ranges})
+        merged_ranges = {str(item) for item in summary_sheet.merged_cells.ranges}
+        self.assertIn("A15:F15", merged_ranges)
+        self.assertIn("H15:J15", merged_ranges)
+        self.assertIn("L15:N15", merged_ranges)
+        self.assertIn("P15:R15", merged_ranges)
+        self.assertNotIn("A15:R15", merged_ranges)
+        self.assertIsNone(summary_sheet["G15"].fill.fill_type)
+        self.assertIsNone(summary_sheet["G16"].fill.fill_type)
+        self.assertIsNone(summary_sheet["K15"].fill.fill_type)
+        self.assertIsNone(summary_sheet["O15"].fill.fill_type)
         self.assertEqual(
-            tuple(summary_sheet.iter_rows(min_row=16, max_row=16, values_only=True))[0][:13],
+            tuple(summary_sheet.iter_rows(min_row=16, max_row=16, values_only=True))[0][:18],
             (
                 "Name",
                 "Mobile",
                 "Working hours",
-                "Non-working hours",
-                "Income",
                 "Hourly rate",
                 "Period",
+                "Income",
+                None,
                 "Clients",
-                "Percentage",
+                "Hour %",
+                "Income %",
+                None,
                 "Projects",
-                "Percentage",
+                "Hour %",
+                "Income %",
+                None,
                 "Tags",
-                "Percentage",
+                "Hour %",
+                "Income %",
             ),
         )
         self.assertTrue(any(row and "Owner User" in row for row in summary_values))
         self.assertTrue(any(row and "09129990001" in row for row in summary_values))
+        self.assertTrue(any(row and "Variable rate" in row for row in summary_values))
+        self.assertEqual(summary_sheet["A17"].border.top.style, "medium")
+        self.assertEqual(summary_sheet["A18"].border.top.style, "medium")
+        self.assertIsNone(summary_sheet["G17"].border.top)
 
         user_sheet = workbook[workbook.sheetnames[1]]
         user_values = list(user_sheet.iter_rows(values_only=True))
 
+        self.assertEqual(user_sheet.freeze_panes, "B1")
         daily_header = next(row[:6] for row in user_values if row and "Date" in row)
         self.assertEqual(
             daily_header,
@@ -161,6 +260,18 @@ class ReportExporterTests(TestCase):
         daily_row = next(row[:6] for row in user_values if row and "2026/04/12" in row)
         self.assertEqual(daily_row[4], "15 USD")
 
+        breakdown_header = next(row[:7] for row in user_values if row and row[0] == "Name" and row[2] == "Hour %")
+        self.assertEqual(
+            breakdown_header[:5],
+            (
+                "Name",
+                "Billable hours",
+                "Hour %",
+                "Income",
+                "Income %",
+            ),
+        )
+
     def test_pdf_export_supports_persian_locale(self):
         locale = build_export_locale("fa")
         report_data = make_report_data(
@@ -168,7 +279,16 @@ class ReportExporterTests(TestCase):
         )
         report_data["user_summaries"] = [make_user_summary(name="Owner User", mobile="09129990001")]
         per_user_reports = [
-            {**make_report_data(user_name="Owner User", mobile="09129990001"), "user_summary": make_user_summary(name="Owner User", mobile="09129990001")}
+            {
+                **make_report_data(
+                    user_name="Owner User",
+                    mobile="09129990001",
+                ),
+                "user_summary": make_user_summary(
+                    name="Owner User",
+                    mobile="09129990001",
+                ),
+            }
         ]
 
         content = build_pdf_report(report_data=report_data, locale=locale, per_user_reports=per_user_reports)

apps/reports/tests/test_views.py

@@ -10,7 +10,7 @@ from apps.projects.models import Project
 from apps.tags.models import Tag
 from apps.time_entries.models import TimeEntry
 from apps.users.models import User
-from apps.workspaces.models import Workspace, WorkspaceMembership
+from apps.workspaces.models import Workspace, WorkspaceMembership, WorkspaceUserRate
 
 
 class ReportViewTests(APITestCase):
@@ -147,9 +147,130 @@ class ReportViewTests(APITestCase):
         self.assertEqual(owner_summary["project_percentages"][0]["percentage"], "100")
         self.assertEqual(owner_summary["client_percentages"][0]["percentage"], "100")
         self.assertEqual(owner_summary["tag_percentages"][0]["percentage"], "100")
-        self.assertEqual(member_summary["project_percentages"], [])
-        self.assertEqual(member_summary["client_percentages"], [])
-        self.assertEqual(member_summary["tag_percentages"], [])
+        self.assertEqual(member_summary["project_percentages"][0]["percentage"], "0")
+        self.assertEqual(member_summary["client_percentages"][0]["percentage"], "0")
+        self.assertEqual(member_summary["tag_percentages"][0]["percentage"], "0")
+
+    def test_specific_user_report_includes_uncategorized_rows_and_balanced_percentages(self):
+        self.client.force_authenticate(user=self.owner)
+
+        TimeEntry.objects.create(
+            workspace=self.workspace,
+            user=self.owner,
+            project=None,
+            description="Uncategorized billable",
+            start_time="2026-04-12T10:00:00+03:30",
+            end_time="2026-04-12T11:00:00+03:30",
+            duration=timedelta(hours=1),
+            is_billable=True,
+            hourly_rate=Decimal("10.00"),
+            currency="USD",
+        )
+
+        with patch(
+            "apps.reports.services.aggregation.timezone.localdate",
+            return_value=date(2026, 4, 20),
+        ):
+            response = self.client.get(
+                "/api/reports/table/",
+                {
+                    "workspace": str(self.workspace.id),
+                    "period": "this_month",
+                    "user": str(self.owner.id),
+                    "language": "en",
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        summary = response.data["user_summary"]
+        self.assertEqual(
+            sum(int(row["percentage"]) for row in summary["project_percentages"]),
+            100,
+        )
+        self.assertEqual(
+            sum(int(row["percentage"]) for row in summary["client_percentages"]),
+            100,
+        )
+        self.assertEqual(
+            sum(int(row["percentage"]) for row in summary["tag_percentages"]),
+            100,
+        )
+        self.assertEqual(
+            {row["name"] for row in summary["project_percentages"]},
+            {"Website", "No project"},
+        )
+        self.assertEqual(
+            {row["name"] for row in summary["client_percentages"]},
+            {"Acme", "No client"},
+        )
+        self.assertEqual(
+            {row["name"] for row in summary["tag_percentages"]},
+            {"Design", "No tag"},
+        )
+        self.assertEqual(
+            {row["name"] for row in response.data["projects"]},
+            {"Website", "No project"},
+        )
+        self.assertEqual(
+            {row["name"] for row in response.data["clients"]},
+            {"Acme", "No client"},
+        )
+        self.assertEqual(
+            {row["name"] for row in response.data["tags"]},
+            {"Design", "No tag"},
+        )
+        self.assertEqual(
+            sum(int(row["percentage"]) for row in summary["project_income_percentages"]),
+            100,
+        )
+        self.assertEqual(
+            sum(int(row["percentage"]) for row in summary["client_income_percentages"]),
+            100,
+        )
+        self.assertEqual(
+            sum(int(row["percentage"]) for row in summary["tag_income_percentages"]),
+            100,
+        )
+
+    def test_income_percentages_are_hidden_for_mixed_currency_breakdowns(self):
+        self.client.force_authenticate(user=self.owner)
+        second_project = Project.objects.create(
+            workspace=self.workspace,
+            name="Mobile App",
+            client=self.client_obj,
+        )
+
+        TimeEntry.objects.create(
+            workspace=self.workspace,
+            user=self.owner,
+            project=second_project,
+            description="EUR work",
+            start_time="2026-04-13T10:00:00+03:30",
+            end_time="2026-04-13T11:00:00+03:30",
+            duration=timedelta(hours=1),
+            is_billable=True,
+            hourly_rate=Decimal("20.00"),
+            currency="EUR",
+        )
+
+        with patch(
+            "apps.reports.services.aggregation.timezone.localdate",
+            return_value=date(2026, 4, 20),
+        ):
+            response = self.client.get(
+                "/api/reports/table/",
+                {
+                    "workspace": str(self.workspace.id),
+                    "period": "this_month",
+                    "user": str(self.owner.id),
+                    "language": "en",
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        summary = response.data["user_summary"]
+        self.assertEqual(summary["project_income_percentages"], [])
+        self.assertEqual(summary["client_income_percentages"], [])
 
     def test_daily_rate_uses_latest_billable_entry_snapshot(self):
         self.client.force_authenticate(user=self.owner)
@@ -199,6 +320,75 @@ class ReportViewTests(APITestCase):
             {"amount": "35.00", "currency": "USD"},
         )
 
+    def test_user_summary_endpoint_keeps_workspace_rate_history_and_marks_current_row_open(self):
+        self.client.force_authenticate(user=self.owner)
+
+        TimeEntry.objects.create(
+            workspace=self.workspace,
+            user=self.owner,
+            project=None,
+            description="Legacy workspace rate",
+            start_time="2026-04-08T08:00:00+03:30",
+            end_time="2026-04-08T09:00:00+03:30",
+            duration=timedelta(hours=1),
+            is_billable=True,
+            hourly_rate=Decimal("12.00"),
+            currency="USD",
+        )
+        TimeEntry.objects.create(
+            workspace=self.workspace,
+            user=self.owner,
+            project=self.project,
+            description="Current project rate",
+            start_time="2026-04-12T08:00:00+03:30",
+            end_time="2026-04-12T10:00:00+03:30",
+            duration=timedelta(hours=2),
+            is_billable=True,
+            hourly_rate=Decimal("25.00"),
+            currency="USD",
+        )
+        WorkspaceUserRate.objects.create(
+            workspace=self.workspace,
+            user=self.owner,
+            hourly_rate=Decimal("12.00"),
+            currency="USD",
+            effective_from="2026-04-01T00:00:00+03:30",
+            is_active=True,
+        )
+
+        with patch(
+            "apps.reports.services.aggregation.timezone.localdate",
+            return_value=date(2026, 4, 20),
+        ):
+            response = self.client.get(
+                "/api/reports/user-summary/",
+                {
+                    "workspace": str(self.workspace.id),
+                    "period": "this_month",
+                    "user": str(self.owner.id),
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        rate_periods = response.data["user_summary"]["rate_periods"]
+        self.assertEqual(
+            rate_periods,
+            [
+                {
+                    "amount": "12.00",
+                    "currency": "USD",
+                    "from_date": "2026-04-08",
+                    "to_date": None,
+                },
+                {
+                    "amount": "25.00",
+                    "currency": "USD",
+                    "from_date": "2026-04-10",
+                    "to_date": "2026-04-12",
+                },
+            ],
+        )
+
     def test_custom_period_longer_than_31_days_is_rejected(self):
         self.client.force_authenticate(user=self.owner)
 

apps/time_entries/api/serializers.py

@@ -1,4 +1,5 @@
 from rest_framework import serializers
+from django.utils import timezone
 
 from core.serializers.base import BaseModelSerializer
 from apps.time_entries.models import TimeEntry
@@ -31,6 +32,27 @@ class TimeEntrySerializer(BaseModelSerializer):
     tag_details = serializers.SerializerMethodField()
     start_time = serializers.DateTimeField(format="%Y-%m-%d %H:%M:%S")
     end_time = serializers.DateTimeField(format="%Y-%m-%d %H:%M:%S", allow_null=True)
+    start_time_ms = serializers.SerializerMethodField()
+    end_time_ms = serializers.SerializerMethodField()
+    server_now_ms = serializers.SerializerMethodField()
+
+    @staticmethod
+    def _epoch_ms(value):
+        if value is None:
+            return None
+        if timezone.is_naive(value):
+            value = timezone.make_aware(value, timezone.get_current_timezone())
+        return int(value.timestamp() * 1000)
+
+    def get_start_time_ms(self, obj):
+        return self._epoch_ms(obj.start_time)
+
+    def get_end_time_ms(self, obj):
+        return self._epoch_ms(obj.end_time)
+
+    def get_server_now_ms(self, obj):
+        server_now = self.context.get("server_now") or timezone.now()
+        return self._epoch_ms(server_now)
 
     def get_tags(self, obj):
         return [str(tag.id) for tag in Tag.all_objects.filter(time_entries=obj).order_by("-updated_at", "-created_at")]
@@ -76,7 +98,10 @@ class TimeEntrySerializer(BaseModelSerializer):
             "project_details",
             "description",
             "start_time",
+            "start_time_ms",
             "end_time",
+            "end_time_ms",
+            "server_now_ms",
             "duration",
             "tags",
             "tag_details",
@@ -93,7 +118,7 @@ class TimeEntryCreateSerializer(serializers.Serializer):
     """
     workspace_id = serializers.UUIDField()
     project_id = serializers.UUIDField(required=False, allow_null=True)
-    start_time = serializers.DateTimeField()
+    start_time = serializers.DateTimeField(required=False)
     end_time = serializers.DateTimeField(required=False, allow_null=True)
     description = serializers.CharField(required=False, allow_blank=True, default="")
     tags = serializers.ListField(child=serializers.UUIDField(), required=False)
@@ -102,6 +127,12 @@ class TimeEntryCreateSerializer(serializers.Serializer):
     def validate(self, attrs):
         user = self.context.get("request").user if self.context.get("request") else None
         workspace_id = attrs.get("workspace_id")
+        start_time = attrs.get("start_time")
+        end_time = attrs.get("end_time")
+
+        if end_time is not None and start_time is None:
+            raise serializers.ValidationError({"start_time": "Start time is required when end time is provided."})
+
         project_id = attrs.pop("project_id", serializers.empty)
         if project_id is not serializers.empty:
             if project_id is None:

apps/time_entries/api/views.py

@@ -38,6 +38,17 @@ class TimeEntryViewSet(ModelViewSet):
     filterset_class = TimeEntryFilter
     search_fields = ["description", "project__name", "project__client__name", "tags__name"]
 
+    @staticmethod
+    def _epoch_ms(value):
+        if timezone.is_naive(value):
+            value = timezone.make_aware(value, timezone.get_current_timezone())
+        return int(value.timestamp() * 1000)
+
+    def _serializer_context(self, *, server_now=None):
+        context = self.get_serializer_context()
+        context["server_now"] = server_now or timezone.now()
+        return context
+
     @staticmethod
     def _serialize_duration_ms(entry):
         if entry.duration is not None:
@@ -51,8 +62,12 @@ class TimeEntryViewSet(ModelViewSet):
         days_since_sunday = (local_dt.weekday() + 1) % 7
         return (local_dt - timedelta(days=days_since_sunday)).date()
 
-    def _build_grouped_entries(self, entries):
-        serialized_entries = TimeEntrySerializer(entries, many=True, context=self.get_serializer_context()).data
+    def _build_grouped_entries(self, entries, *, server_now):
+        serialized_entries = TimeEntrySerializer(
+            entries,
+            many=True,
+            context=self._serializer_context(server_now=server_now),
+        ).data
         serialized_by_id = {item["id"]: item for item in serialized_entries}
         weeks = []
         weeks_by_key = {}
@@ -114,6 +129,7 @@ class TimeEntryViewSet(ModelViewSet):
         queryset = self.filter_queryset(self.get_queryset())
         paginator = self.pagination_class()
         page = paginator.paginate_queryset(queryset, request, view=self)
+        server_now = timezone.now()
         current_items_count = len(page)
         has_more = (paginator.offset + current_items_count) < paginator.count
 
@@ -125,7 +141,19 @@ class TimeEntryViewSet(ModelViewSet):
                 "offset": paginator.offset,
                 "next_offset": paginator.offset + current_items_count if has_more else None,
                 "has_more": has_more,
-                "groups": self._build_grouped_entries(page),
+                "server_now_ms": self._epoch_ms(server_now),
+                "server_now": server_now.isoformat(),
+                "groups": self._build_grouped_entries(page, server_now=server_now),
+            }
+        )
+
+    @action(detail=False, methods=["get"], url_path="debug-time")
+    def debug_time(self, request):
+        server_now = timezone.now()
+        return Response(
+            {
+                "server_now_ms": self._epoch_ms(server_now),
+                "server_now": server_now.isoformat(),
             }
         )
 
@@ -148,7 +176,7 @@ class TimeEntryViewSet(ModelViewSet):
             **serializer.validated_data
         )
         
-        output_serializer = TimeEntrySerializer(entry, context=self.get_serializer_context())
+        output_serializer = TimeEntrySerializer(entry, context=self._serializer_context())
         return Response(output_serializer.data, status=status.HTTP_201_CREATED)
 
     def update(self, request, *args, **kwargs):
@@ -168,7 +196,7 @@ class TimeEntryViewSet(ModelViewSet):
             **serializer.validated_data
         )
         
-        output_serializer = TimeEntrySerializer(updated_entry, context=self.get_serializer_context())
+        output_serializer = TimeEntrySerializer(updated_entry, context=self._serializer_context())
         return Response(output_serializer.data, status=status.HTTP_200_OK)
 
     @action(detail=True, methods=["post"])
@@ -189,7 +217,7 @@ class TimeEntryViewSet(ModelViewSet):
         end_time = serializer.validated_data.get("end_time")
         stopped_entry = stop_time_entry(entry, end_time=end_time)
         
-        output_serializer = TimeEntrySerializer(stopped_entry, context=self.get_serializer_context())
+        output_serializer = TimeEntrySerializer(stopped_entry, context=self._serializer_context())
         return Response(output_serializer.data, status=status.HTTP_200_OK)
 
     def destroy(self, request, *args, **kwargs):

apps/time_entries/services/rates.py

@@ -1,7 +1,14 @@
+from apps.projects.services.access import user_has_project_access
+from apps.projects.services.rates import get_current_project_user_rate
 from apps.workspaces.models import WorkspaceUserRate
 
 
 def resolve_rate(user, project):
+    if user_has_project_access(user, project):
+        project_user_rate = get_current_project_user_rate(project=project, user=user)
+        if project_user_rate:
+            return project_user_rate.hourly_rate, project_user_rate.currency
+
     workspace_user_rate = WorkspaceUserRate.objects.filter(
         user=user,
         workspace=project.workspace,

apps/time_entries/services/time_entries.py

@@ -22,24 +22,29 @@ def _verify_workspace_access(user, workspace_id):
         raise PermissionDenied("You do not have access to this workspace.")
 
 
-def create_time_entry(user, workspace_id, start_time, end_time=None, project=None, tags=None, description="", is_billable=False):
+def create_time_entry(user, workspace_id, start_time=None, end_time=None, project=None, tags=None, description="", is_billable=False):
     """
     Creates a new time entry. If end_time is None, it acts as a running timer.
     """
     _verify_workspace_access(user, workspace_id)
 
-    if not end_time:
-        has_running_timer = TimeEntry.objects.filter(
-            workspace_id=workspace_id, 
-            user=user, 
-            end_time__isnull=True, 
-            is_deleted=False
-        ).exists()
-        if has_running_timer:
-            raise ValidationError({"non_field_errors": "You already have a running timer in this workspace."})
-
-    if start_time and end_time and start_time >= end_time:
-        raise ValidationError({"end_time": "End time must be strictly after start time."})
+    if not end_time:
+        has_running_timer = TimeEntry.objects.filter(
+            workspace_id=workspace_id, 
+            user=user, 
+            end_time__isnull=True, 
+            is_deleted=False
+        ).exists()
+        if has_running_timer:
+            raise ValidationError({"non_field_errors": "You already have a running timer in this workspace."})
+
+    if start_time is None:
+        if end_time is not None:
+            raise ValidationError({"start_time": "Start time is required when end time is provided."})
+        start_time = timezone.now()
+
+    if start_time and end_time and start_time >= end_time:
+        raise ValidationError({"end_time": "End time must be strictly after start time."})
 
     if project and project.workspace_id != workspace_id:
         raise ValidationError({"project": "Project must belong to the same workspace."})

apps/time_entries/tests/test_services.py

@@ -1,10 +1,11 @@
 from datetime import timedelta
+from decimal import Decimal
 
 from django.test import TestCase
 from django.utils import timezone
 from rest_framework.exceptions import ValidationError
 
-from apps.projects.models import Project
+from apps.projects.models import Project, ProjectAccess, ProjectUserRate
 from apps.tags.models import Tag
 from apps.time_entries.services.time_entries import (
     create_time_entry,
@@ -12,14 +13,21 @@ from apps.time_entries.services.time_entries import (
     update_time_entry,
 )
 from apps.users.models import User
-from apps.workspaces.models import Workspace
+from apps.workspaces.models import Workspace, WorkspaceMembership, WorkspaceUserRate
 
 
 class TimeEntryServiceTests(TestCase):
     @classmethod
     def setUpTestData(cls):
         cls.user = User.objects.create_user(mobile="09121111111", password="secret123")
+        cls.member = User.objects.create_user(mobile="09121111112", password="secret123")
         cls.workspace = Workspace.objects.create(name="Core", owner=cls.user)
+        WorkspaceMembership.objects.create(
+            workspace=cls.workspace,
+            user=cls.member,
+            role=WorkspaceMembership.Role.MEMBER,
+            is_active=True,
+        )
 
     def test_create_time_entry_allows_only_one_running_timer_per_workspace(self):
         create_time_entry(
@@ -47,6 +55,18 @@ class TimeEntryServiceTests(TestCase):
         self.assertIsNotNone(stopped_entry.end_time)
         self.assertIsNotNone(stopped_entry.duration)
 
+    def test_create_running_time_entry_defaults_start_time_to_server_now(self):
+        before = timezone.now()
+        entry = create_time_entry(
+            user=self.user,
+            workspace_id=self.workspace.id,
+        )
+        after = timezone.now()
+
+        self.assertIsNone(entry.end_time)
+        self.assertGreaterEqual(entry.start_time, before)
+        self.assertLessEqual(entry.start_time, after)
+
     def test_update_time_entry_preserves_deleted_project_and_tags(self):
         project = Project.objects.create(workspace=self.workspace, name="Deleted project")
         tag = Tag.objects.create(
@@ -85,3 +105,36 @@ class TimeEntryServiceTests(TestCase):
             ),
             [tag.id],
         )
+
+    def test_create_billable_time_entry_uses_project_user_rate_override(self):
+        project = Project.objects.create(workspace=self.workspace, name="Override project")
+        ProjectAccess.objects.create(project=project, user=self.member)
+        WorkspaceUserRate.objects.create(
+            workspace=self.workspace,
+            user=self.member,
+            hourly_rate=Decimal("10.00"),
+            currency="USD",
+            effective_from=self.workspace.created_at,
+            is_active=True,
+        )
+        ProjectUserRate.objects.create(
+            project=project,
+            user=self.member,
+            hourly_rate=Decimal("20.00"),
+            currency="EUR",
+            effective_from=self.workspace.created_at,
+            is_active=True,
+        )
+
+        entry = create_time_entry(
+            user=self.member,
+            workspace_id=self.workspace.id,
+            start_time=timezone.now() - timedelta(minutes=30),
+            end_time=timezone.now(),
+            project=project,
+            description="Billable work",
+            is_billable=True,
+        )
+
+        self.assertEqual(entry.hourly_rate, Decimal("20.00"))
+        self.assertEqual(entry.currency, "EUR")

apps/time_entries/tests/test_views.py

@@ -1,4 +1,4 @@
-from datetime import datetime
+from datetime import datetime, timedelta
 
 from django.utils import timezone
 from rest_framework.test import APITestCase
@@ -19,6 +19,31 @@ def make_aware(year, month, day, hour=9, minute=0, second=0):
 
 
 class TimeEntryViewTests(APITestCase):
+    def test_create_running_time_entry_without_start_time_uses_server_time(self):
+        user = User.objects.create_user(mobile="09125555555", password="secret123")
+        workspace = Workspace.objects.create(name="Core", owner=user)
+
+        self.client.force_authenticate(user=user)
+        before = timezone.now()
+        response = self.client.post(
+            "/api/time-entries/",
+            {
+                "workspace_id": str(workspace.id),
+                "description": "Running work",
+            },
+            format="json",
+        )
+        after = timezone.now()
+
+        self.assertEqual(response.status_code, 201)
+        entry = TimeEntry.objects.get(id=response.data["id"])
+        self.assertIsNone(entry.end_time)
+        self.assertGreaterEqual(entry.start_time, before)
+        self.assertLessEqual(entry.start_time, after)
+        self.assertIsInstance(response.data["start_time_ms"], int)
+        self.assertIsNone(response.data["end_time_ms"])
+        self.assertIsInstance(response.data["server_now_ms"], int)
+
     def test_time_entry_list_returns_grouped_payload_for_ended_entries(self):
         user = User.objects.create_user(mobile="09126666666", password="secret123")
         workspace = Workspace.objects.create(name="Core", owner=user)
@@ -50,6 +75,8 @@ class TimeEntryViewTests(APITestCase):
 
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.data["current_page_items_count"], 1)
+        self.assertIsInstance(response.data["server_now_ms"], int)
+        self.assertIn("server_now", response.data)
         self.assertFalse(response.data["has_more"])
         self.assertEqual(len(response.data["groups"]), 1)
         self.assertEqual(len(response.data["groups"][0]["days"]), 1)
@@ -57,6 +84,41 @@ class TimeEntryViewTests(APITestCase):
             response.data["groups"][0]["days"][0]["entries"][0]["id"],
             str(first_entry.id),
         )
+        entry_payload = response.data["groups"][0]["days"][0]["entries"][0]
+        self.assertIsInstance(entry_payload["start_time_ms"], int)
+        self.assertIsInstance(entry_payload["end_time_ms"], int)
+        self.assertIsInstance(entry_payload["server_now_ms"], int)
+
+    def test_debug_time_returns_server_clock_payload(self):
+        user = User.objects.create_user(mobile="09126666667", password="secret123")
+        self.client.force_authenticate(user=user)
+
+        response = self.client.get("/api/time-entries/debug-time/")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertIsInstance(response.data["server_now_ms"], int)
+        self.assertIn("server_now", response.data)
+
+    def test_stop_running_time_entry_returns_server_epoch_fields(self):
+        user = User.objects.create_user(mobile="09126666668", password="secret123")
+        workspace = Workspace.objects.create(name="Core", owner=user)
+        entry = TimeEntry.objects.create(
+            workspace=workspace,
+            user=user,
+            description="Running work",
+            start_time=timezone.now() - timedelta(seconds=5),
+        )
+
+        self.client.force_authenticate(user=user)
+        response = self.client.post(f"/api/time-entries/{entry.id}/stop/", {}, format="json")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertIsInstance(response.data["start_time_ms"], int)
+        self.assertIsInstance(response.data["end_time_ms"], int)
+        self.assertIsInstance(response.data["server_now_ms"], int)
+        entry.refresh_from_db()
+        self.assertIsNotNone(entry.duration)
+        self.assertGreaterEqual(entry.duration.total_seconds(), 5)
 
     def test_time_entry_update_preserves_current_deleted_tags(self):
         user = User.objects.create_user(mobile="09127777777", password="secret123")

apps/users/api/serializers.py

@@ -8,11 +8,11 @@ from apps.users.email_identity import normalize_email_identity
 
 User = get_user_model()
 
-INVALID_MOBILE_FORMAT_MESSAGE = "\u0641\u0631\u0645\u062a \u0634\u0645\u0627\u0631\u0647 \u0645\u0648\u0628\u0627\u06cc\u0644 \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0633\u062a."
-INVALID_MOBILE_NUMBER_MESSAGE = "\u0634\u0645\u0627\u0631\u0647 \u0645\u0648\u0628\u0627\u06cc\u0644 \u0645\u0639\u062a\u0628\u0631 \u0646\u06cc\u0633\u062a."
-PASSWORD_MISMATCH_MESSAGE = "\u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0645\u0637\u0627\u0628\u0642\u062a \u0646\u062f\u0627\u0631\u062f."
-NEW_PASSWORD_MISMATCH_MESSAGE = "\u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u062c\u062f\u06cc\u062f \u0648 \u062a\u06a9\u0631\u0627\u0631 \u0622\u0646 \u0645\u0637\u0627\u0628\u0642\u062a \u0646\u062f\u0627\u0631\u0646\u062f."
-PASSWORD_REUSE_MESSAGE = "\u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u062c\u062f\u06cc\u062f \u0646\u0628\u0627\u06cc\u062f \u0628\u0627 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0642\u0628\u0644\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f."
+INVALID_MOBILE_FORMAT_MESSAGE = "فرمت شماره موبایل نادرست است."
+INVALID_MOBILE_NUMBER_MESSAGE = "شماره موبایل معتبر نیست."
+PASSWORD_MISMATCH_MESSAGE = "رمز عبور مطابقت ندارد."
+NEW_PASSWORD_MISMATCH_MESSAGE = "رمز عبور جدید و تکرار آن مطابقت ندارند."
+PASSWORD_REUSE_MESSAGE = "رمز عبور جدید نباید با رمز عبور قبلی یکسان باشد."
 
 
 def _raise_password_validation_error(password: str, *, user, field_name: str) -> None:
@@ -212,10 +212,12 @@ class UserProfileSerializer(BaseModelSerializer):
             "profile_picture",
             "birth_date",
             "is_verified",
+            "is_demo",
+            "demo_expires_at",
             "full_name",
             "age",
         )
-        read_only_fields = BaseModelSerializer.Meta.fields + ("mobile", "is_verified")
+        read_only_fields = BaseModelSerializer.Meta.fields + ("mobile", "is_verified", "is_demo", "demo_expires_at")
 
 
 class UserSearchSerializer(serializers.ModelSerializer):

apps/users/api/views.py

@@ -1,61 +1,59 @@
-from django.http import HttpResponseRedirect
 from django.contrib.auth import get_user_model
+from django.http import HttpResponseRedirect
 from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework import serializers, status
 from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.generics import ListAPIView, UpdateAPIView
+from rest_framework.mixins import DestroyModelMixin, RetrieveModelMixin, UpdateModelMixin
 from rest_framework.parsers import FormParser, MultiPartParser
 from rest_framework.permissions import AllowAny, IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
-from rest_framework_simplejwt.authentication import JWTAuthentication
-from rest_framework.mixins import UpdateModelMixin, RetrieveModelMixin, DestroyModelMixin
 from rest_framework.viewsets import GenericViewSet
-
-
-from core.paginations.limit_offset import CustomLimitOffsetPagination
+from rest_framework_simplejwt.authentication import JWTAuthentication
 
 from apps.users.api.serializers import (
     ChangePasswordSerializer,
-    LoginOtpSerializer,
-    LoginSerializer,
     GoogleOAuthClaimVerifySerializer,
     GoogleOAuthCompleteSerializer,
     GoogleOAuthFlowSerializer,
+    LoginOtpSerializer,
+    LoginSerializer,
+    LogoutSerializer,
     RegisterSerializer,
+    RegisterWithPasswordSerializer,
     ResetPasswordSerializer,
     SendOTPSerializer,
+    TokenPairSerializer,
     UserListSerializer,
     UserProfilePictureSerializer,
-    LogoutSerializer,
-    TokenPairSerializer,
-    RegisterWithPasswordSerializer,
     UserProfileSerializer,
     UserSearchSerializer,
 )
 from apps.users.api.throttles import (
+    GoogleClaimSendBurstThrottle,
+    GoogleClaimSendSustainedThrottle,
+    GoogleClaimVerifyThrottle,
     OTPLoginThrottle,
     OTPSendBurstThrottle,
     OTPSendSustainedThrottle,
     PasswordLoginThrottle,
-    GoogleClaimSendBurstThrottle,
-    GoogleClaimSendSustainedThrottle,
-    GoogleClaimVerifyThrottle,
 )
 from apps.users.services.auth import (
-    register_user_with_password, 
-    register_user_with_otp, 
-    generate_and_send_otp,
-    login_with_password,
-    login_with_otp,
-    reset_password_with_otp,
     change_password,
-    logout_user
+    generate_and_send_otp,
+    login_with_otp,
+    login_with_password,
+    logout_user,
+    register_user_with_otp,
+    register_user_with_password,
+    reset_password_with_otp,
 )
 from apps.users.services.google_oauth import (
     build_authenticated_flow_payload,
     build_google_authorization_url,
+    build_google_callback_error_redirect_url,
     build_google_callback_redirect_url,
     build_pending_google_flow_payload,
     complete_google_signup,
@@ -68,6 +66,7 @@ from apps.users.services.google_oauth import (
     sync_user_from_google_profile,
     verify_google_claim,
 )
+from core.paginations.limit_offset import CustomLimitOffsetPagination
 
 User = get_user_model()
 
@@ -89,7 +88,7 @@ class RegisterWithPasswordView(APIView):
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
-        tokens = register_user_with_password(mobile, password)        
+        tokens = register_user_with_password(mobile, password)
         return Response(tokens, status=status.HTTP_201_CREATED)
 
 
@@ -125,7 +124,7 @@ class SendOTPView(APIView):
     def post(self, request):
         serializer = SendOTPSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        
+
         payload = generate_and_send_otp(
             mobile=serializer.validated_data["mobile"],
             mode=serializer.validated_data["mode"]
@@ -142,7 +141,7 @@ class LoginView(APIView):
     def post(self, request):
         serializer = LoginSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        
+
         tokens = login_with_password(
             mobile=serializer.validated_data["mobile"],
             password=serializer.validated_data["password"],
@@ -159,7 +158,7 @@ class LoginOTPView(APIView):
     def post(self, request):
         serializer = LoginOtpSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        
+
         tokens = login_with_otp(
             mobile=serializer.validated_data["mobile"],
             code=serializer.validated_data["code"],
@@ -182,22 +181,42 @@ class GoogleOAuthCallbackView(APIView):
     @extend_schema(responses=None)
     def get(self, request):
         if request.query_params.get("error"):
-            raise serializers.ValidationError(
-                {"detail": request.query_params.get("error_description") or "Google sign-in was cancelled."}
+            return HttpResponseRedirect(
+                build_google_callback_error_redirect_url(
+                    code=request.query_params.get("error") or "google_sign_in_cancelled",
+                    detail=(
+                        request.query_params.get("error_description")
+                        or "Google sign-in was cancelled."
+                    ),
+                )
             )
+        try:
+            consume_google_state(request.query_params.get("state"))
+            profile = exchange_code_for_google_profile(request.query_params.get("code"))
+            social_account = find_social_account_for_profile(profile)
 
-        consume_google_state(request.query_params.get("state"))
-        profile = exchange_code_for_google_profile(request.query_params.get("code"))
-        social_account = find_social_account_for_profile(profile)
+            if social_account:
+                sync_user_from_google_profile(social_account.user, profile)
+                flow_payload = build_authenticated_flow_payload(social_account.user)
+            else:
+                flow_payload = build_pending_google_flow_payload(profile)
 
-        if social_account:
-            sync_user_from_google_profile(social_account.user, profile)
-            flow_payload = build_authenticated_flow_payload(social_account.user)
-        else:
-            flow_payload = build_pending_google_flow_payload(profile)
-
-        flow = create_google_flow(flow_payload)
-        return HttpResponseRedirect(build_google_callback_redirect_url(flow))
+            flow = create_google_flow(flow_payload)
+            return HttpResponseRedirect(build_google_callback_redirect_url(flow))
+        except serializers.ValidationError as exc:
+            detail = exc.detail
+            if isinstance(detail, dict):
+                message = detail.get("detail", "Google sign-in could not be completed.")
+            else:
+                message = detail
+            if isinstance(message, list):
+                message = message[0] if message else "Google sign-in could not be completed."
+            return HttpResponseRedirect(
+                build_google_callback_error_redirect_url(
+                    code="google_callback_failed",
+                    detail=str(message),
+                )
+            )
 
 
 class GoogleOAuthFlowView(APIView):
@@ -254,12 +273,12 @@ class GoogleOAuthClaimVerifyView(APIView):
 class ResetPasswordView(APIView):
     permission_classes = (AllowAny,)
     serializer_class = ResetPasswordSerializer
-    
+
     @extend_schema(request=ResetPasswordSerializer)
     def post(self, request):
         serializer = ResetPasswordSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        
+
         reset_password_with_otp(
             mobile=serializer.validated_data["mobile"],
             code=serializer.validated_data["code"],
@@ -274,9 +293,14 @@ class ChangePasswordView(APIView):
 
     @extend_schema(request=ChangePasswordSerializer)
     def patch(self, request, *args, **kwargs):
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot change passwords."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
         serializer = ChangePasswordSerializer(data=request.data, context={"request": request})
         serializer.is_valid(raise_exception=True)
-        
+
         change_password(
             user=request.user,
             old_password=serializer.validated_data["old_password"],
@@ -308,6 +332,11 @@ class SetPasswordView(UpdateAPIView):
 
     @extend_schema(request=ChangePasswordSerializer, responses=None)
     def patch(self, request, *args, **kwargs):
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot change passwords."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
         return super().patch(request, *args, **kwargs)
 
     def get_object(self):
@@ -328,6 +357,11 @@ class ProfilePictureView(APIView):
         operation_id="users_profile_picture_self_create",
     )
     def post(self, request):
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot upload profile pictures."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
         serializer = UserProfilePictureSerializer(
             instance=request.user,
             data=request.data,
@@ -343,6 +377,11 @@ class ProfilePictureView(APIView):
         operation_id="users_profile_picture_self_delete",
     )
     def delete(self, request):
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot remove profile pictures."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
         request.user.profile_picture.delete(save=False)
         request.user.profile_picture = None
         request.user.save(update_fields=["profile_picture", "updated_at"])
@@ -382,17 +421,22 @@ class UserSearchAPIView(APIView):
     permission_classes = [IsAuthenticated]
 
     def get(self, request):
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot search external users."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
         mobile = request.query_params.get('mobile')
         if not mobile:
             return Response(
-                {"detail": "Mobile parameter is required."}, 
+                {"detail": "Mobile parameter is required."},
                 status=status.HTTP_400_BAD_REQUEST
             )
-            
+
         user = User.objects.filter(mobile=mobile).first()
         if not user:
             return Response(
-                {"detail": "User not found."}, 
+                {"detail": "User not found."},
                 status=status.HTTP_404_NOT_FOUND
             )
 

apps/users/migrations/0004_user_demo_fields.py

@@ -0,0 +1,25 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("users", "0003_normalize_user_email_identity"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="demo_expires_at",
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="is_demo",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddIndex(
+            model_name="user",
+            index=models.Index(fields=["is_demo", "demo_expires_at"], name="user_demo_expires_idx"),
+        ),
+    ]

apps/users/models.py

@@ -22,6 +22,8 @@ class User(AbstractUser, BaseModel):
 
     password_updated_at = models.DateTimeField(blank=True, null=True)
     is_verified = models.BooleanField(default=False)
+    is_demo = models.BooleanField(default=False)
+    demo_expires_at = models.DateTimeField(blank=True, null=True)
 
     USERNAME_FIELD = "mobile"
     REQUIRED_FIELDS = []
@@ -63,6 +65,7 @@ class User(AbstractUser, BaseModel):
         indexes = (
             models.Index(fields=["id"], name="user_id_idx"),
             models.Index(fields=["mobile"], name="user_mobile_idx"),
+            models.Index(fields=["is_demo", "demo_expires_at"], name="user_demo_expires_idx"),
         )
 
 

apps/users/services/auth.py

@@ -18,7 +18,7 @@ from apps.users.utils import record_login_attempt
 User = get_user_model()
 
 USER_ALREADY_EXISTS_MESSAGE = "User already exists."
-PASSWORD_REUSE_MESSAGE = "\u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u062c\u062f\u06cc\u062f \u0646\u0628\u0627\u06cc\u062f \u0628\u0627 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0642\u0628\u0644\u06cc \u06cc\u06a9\u0633\u0627\u0646 \u0628\u0627\u0634\u062f."
+PASSWORD_REUSE_MESSAGE = "رمز عبور جدید نباید با رمز عبور قبلی یکسان باشد."
 OTP_EXPIRY_SECONDS = 120
 
 
@@ -55,15 +55,15 @@ def register_user_with_password(mobile, password):
 def register_user_with_otp(mobile, code, password, first_name="", last_name=""):
     """Business logic for verifying OTP and registering a user."""
     if User.objects.filter(mobile=mobile).exists():
-        raise ValidationError({"mobile": "\u0627\u06cc\u0646 \u0634\u0645\u0627\u0631\u0647 \u0642\u0628\u0644\u0627\u064b \u062b\u0628\u062a \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"mobile": "این شماره قبلاً ثبت شده است."})
 
     redis_conn = get_redis_connection("default")
     stored_code = redis_conn.get(f"verification_code:{mobile}")
 
     if not stored_code:
-        raise ValidationError({"code": "\u06a9\u062f \u062a\u0623\u06cc\u06cc\u062f \u06cc\u0627\u0641\u062a \u0646\u0634\u062f."})
+        raise ValidationError({"code": "کد تأیید یافت نشد."})
     if stored_code.decode("utf-8") != code:
-        raise ValidationError({"code": "\u06a9\u062f \u062a\u0623\u06cc\u06cc\u062f \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"code": "کد تأیید اشتباه است."})
 
     user = User.objects.create_user(
         mobile=mobile,
@@ -81,13 +81,17 @@ def register_user_with_otp(mobile, code, password, first_name="", last_name=""):
 
 def generate_and_send_otp(mobile, mode):
     """Business logic for generating OTP, checking existence rules, and sending SMS."""
-    user_exists = User.objects.filter(mobile=mobile).exists()
+    user = User.objects.filter(mobile=mobile).only("is_demo").first()
+    user_exists = user is not None
+
+    if user and user.is_demo:
+        raise ValidationError({"mobile": "Demo accounts cannot use SMS verification."})
 
     if mode == "register" and user_exists:
-        raise ValidationError({"mobile": "\u0627\u06cc\u0646 \u0634\u0645\u0627\u0631\u0647 \u0642\u0628\u0644\u0627\u064b \u062b\u0628\u062a\u200c\u0646\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"mobile": "این شماره قبلاً ثبت‌نام شده است."})
 
     if mode in ["login", "forget_password"] and not user_exists:
-        raise ValidationError({"mobile": "\u0627\u06cc\u0646 \u0634\u0645\u0627\u0631\u0647 \u06cc\u0627\u0641\u062a \u0646\u0634\u062f."})
+        raise ValidationError({"mobile": "این شماره یافت نشد."})
 
     verification_code = "".join(random.choices(string.digits, k=5))
 
@@ -109,10 +113,10 @@ def login_with_password(mobile, password, request=None):
 
     if not user or not user.check_password(password):
         record_login_attempt(request, user, LoginAttempt.StatusType.FAILED)
-        raise ValidationError({"detail": "\u0634\u0645\u0627\u0631\u0647 \u0645\u0648\u0628\u0627\u06cc\u0644 \u06cc\u0627 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"detail": "شماره موبایل یا رمز عبور اشتباه است."})
 
     if not user.is_active:
-        raise ValidationError({"detail": "\u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0634\u0645\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"detail": "حساب کاربری شما غیرفعال شده است."})
 
     record_login_attempt(request, user, LoginAttempt.StatusType.SUCCESS)
     return get_tokens_for_user(user)
@@ -125,7 +129,7 @@ def login_with_otp(mobile, code, request=None):
 
     if not stored_code or stored_code.decode("utf-8") != code:
         record_login_attempt(request, None, LoginAttempt.StatusType.FAILED)
-        raise ValidationError({"code": "\u06a9\u062f \u062a\u0627\u06cc\u06cc\u062f \u0646\u0627\u0645\u0639\u062a\u0628\u0631 \u0627\u0633\u062a \u06cc\u0627 \u0645\u0646\u0642\u0636\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"code": "کد تایید نامعتبر است یا منقضی شده است."})
 
     user, created = User.objects.get_or_create(mobile=mobile)
     if created:
@@ -133,7 +137,7 @@ def login_with_otp(mobile, code, request=None):
         user.save()
 
     if not user.is_active:
-        raise ValidationError({"detail": "\u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0634\u0645\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"detail": "حساب کاربری شما غیرفعال شده است."})
 
     record_login_attempt(request, user, LoginAttempt.StatusType.SUCCESS)
     redis_conn.delete(f"verification_code:{mobile}")
@@ -145,13 +149,13 @@ def reset_password_with_otp(mobile, code, password):
     """Verify OTP and change forgotten password."""
     user = User.objects.filter(mobile=mobile).first()
     if not user:
-        raise ValidationError({"mobile": "\u06a9\u0627\u0631\u0628\u0631\u06cc \u0628\u0627 \u0627\u06cc\u0646 \u0634\u0645\u0627\u0631\u0647 \u06cc\u0627\u0641\u062a \u0646\u0634\u062f."})
+        raise ValidationError({"mobile": "کاربری با این شماره یافت نشد."})
 
     redis_conn = get_redis_connection("default")
     stored_code = redis_conn.get(f"verification_code:{mobile}")
 
     if not stored_code or stored_code.decode("utf-8") != code:
-        raise ValidationError({"code": "\u06a9\u062f \u062a\u0627\u06cc\u06cc\u062f \u0646\u0627\u0645\u0639\u062a\u0628\u0631 \u0627\u0633\u062a \u06cc\u0627 \u0645\u0646\u0642\u0636\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"code": "کد تایید نامعتبر است یا منقضی شده است."})
 
     _validate_new_password(password, user=user, field_name="password")
 
@@ -167,7 +171,7 @@ def reset_password_with_otp(mobile, code, password):
 def change_password(user, old_password, new_password):
     """Change password for an already authenticated user."""
     if not user.check_password(old_password):
-        raise ValidationError({"old_password": "\u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0641\u0639\u0644\u06cc \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"old_password": "رمز عبور فعلی اشتباه است."})
 
     _validate_new_password(new_password, user=user, field_name="new_password")
 
@@ -182,9 +186,9 @@ def change_password(user, old_password, new_password):
 def logout_user(refresh_token_str):
     """Blacklist the user's refresh token."""
     if not refresh_token_str:
-        raise ValidationError({"refresh": "\u062a\u0648\u06a9\u0646 \u0631\u0641\u0631\u0634 \u0627\u0644\u0632\u0627\u0645\u06cc \u0627\u0633\u062a."})
+        raise ValidationError({"refresh": "توکن رفرش الزامی است."})
     try:
         token = RefreshToken(refresh_token_str)
         token.blacklist()
     except TokenError:
-        raise ValidationError({"detail": "\u062a\u0648\u06a9\u0646 \u0646\u0627\u0645\u0639\u062a\u0628\u0631 \u0627\u0633\u062a \u06cc\u0627 \u0642\u0628\u0644\u0627 \u0645\u0646\u0642\u0636\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a."})
+        raise ValidationError({"detail": "توکن نامعتبر است یا قبلا منقضی شده است."})

apps/users/services/google_oauth.py

@@ -1,10 +1,10 @@
 from __future__ import annotations
 
+import logging
 import secrets
 from dataclasses import asdict, dataclass, is_dataclass
 from typing import Any
-from urllib.parse import urlencode
-from urllib.parse import urlparse
+from urllib.parse import urlencode, urlparse
 
 import requests
 from django.conf import settings
@@ -16,7 +16,6 @@ from apps.users.email_identity import mask_mobile, normalize_email_identity
 from apps.users.models import User, UserSocialAccount
 from apps.users.services.auth import generate_and_send_otp, get_tokens_for_user
 
-
 GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
 GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
 GOOGLE_USERINFO_URL = "https://openidconnect.googleapis.com/v1/userinfo"
@@ -27,6 +26,8 @@ GOOGLE_FLOW_TTL_SECONDS = 900
 GOOGLE_STATE_CACHE_PREFIX = "google_oauth_state"
 GOOGLE_FLOW_CACHE_PREFIX = "google_oauth_flow"
 
+logger = logging.getLogger(__name__)
+
 
 class GoogleOAuthFlowError(APIException):
     status_code = 409
@@ -305,6 +306,16 @@ def exchange_code_for_google_profile(code: str) -> GoogleProfile:
         token_response.raise_for_status()
         token_payload = token_response.json()
     except requests.RequestException as exc:
+        response = getattr(exc, "response", None)
+        logger.warning(
+            "Google token exchange failed",
+            extra={
+                "google_status_code": getattr(response, "status_code", None),
+                "google_response_text": getattr(response, "text", "")[:1000] if response is not None else "",
+                "google_redirect_uri": getattr(settings, "GOOGLE_OAUTH_REDIRECT_URI", ""),
+            },
+            exc_info=True,
+        )
         raise ValidationError({"detail": "Google token exchange failed."}) from exc
 
     access_token = token_payload.get("access_token")
@@ -320,6 +331,15 @@ def exchange_code_for_google_profile(code: str) -> GoogleProfile:
         userinfo_response.raise_for_status()
         userinfo = userinfo_response.json()
     except requests.RequestException as exc:
+        response = getattr(exc, "response", None)
+        logger.warning(
+            "Google user profile lookup failed",
+            extra={
+                "google_status_code": getattr(response, "status_code", None),
+                "google_response_text": getattr(response, "text", "")[:1000] if response is not None else "",
+            },
+            exc_info=True,
+        )
         raise ValidationError({"detail": "Google user profile lookup failed."}) from exc
 
     provider_user_id = userinfo.get("sub", "")
@@ -347,6 +367,16 @@ def build_google_callback_redirect_url(flow: str) -> str:
     return f"{get_frontend_google_callback_url()}?flow={flow}"
 
 
+def build_google_callback_error_redirect_url(*, code: str, detail: str) -> str:
+    params = urlencode(
+        {
+            "error": code,
+            "error_description": detail,
+        }
+    )
+    return f"{get_frontend_google_callback_url()}?{params}"
+
+
 def find_social_account_for_profile(profile: GoogleProfile) -> UserSocialAccount | None:
     return (
         UserSocialAccount.objects.select_related("user")
@@ -431,7 +461,10 @@ def complete_google_signup(flow: str, mobile: str) -> dict[str, Any]:
             user=existing_mobile_user,
             mobile=normalized_mobile,
             resolution="existing_mobile_claim",
-            detail="Existing mobile account found. Verify ownership to attach Google and set the verified email address.",
+            detail=(
+                "Existing mobile account found. Verify ownership to attach "
+                "Google and set the verified email address."
+            ),
         )
         update_google_flow(flow, claim_payload)
         return _build_public_google_flow_payload(claim_payload)

apps/users/tests/test_api_views.py

@@ -1,18 +1,22 @@
 from io import StringIO
 from unittest.mock import Mock, patch
+from urllib.parse import parse_qs, urlparse
 
 from django.conf import settings
 from django.core.cache import cache
 from django.core.management import call_command
 from django.db import IntegrityError
 from django.test import override_settings
-from rest_framework.test import APIRequestFactory
-from rest_framework import status
-from rest_framework.test import APITestCase
+from rest_framework import serializers, status
+from rest_framework.test import APIRequestFactory, APITestCase
 
 from apps.users.api.views import RegisterWithPasswordView
 from apps.users.models import User, UserSocialAccount
-from apps.users.services.google_oauth import GoogleProfile
+from apps.users.services.google_oauth import (
+    GoogleProfile,
+    build_google_authorization_url,
+    exchange_code_for_google_profile,
+)
 
 
 class UserApiViewTests(APITestCase):
@@ -551,6 +555,42 @@ class GoogleOAuthApiTests(APITestCase):
         self.assertIn("accounts.google.com", response["Location"])
         self.assertIn("state=", response["Location"])
 
+    @patch("apps.users.services.google_oauth.requests.get")
+    @patch("apps.users.services.google_oauth.requests.post")
+    def test_google_token_exchange_uses_the_same_configured_redirect_uri_as_authorization_url(
+        self,
+        requests_post,
+        requests_get,
+    ):
+        auth_url = build_google_authorization_url()
+        parsed_auth_url = urlparse(auth_url)
+        auth_redirect_uri = parse_qs(parsed_auth_url.query)["redirect_uri"][0]
+
+        token_response = Mock()
+        token_response.raise_for_status.return_value = None
+        token_response.json.return_value = {"access_token": "google-access-token"}
+        requests_post.return_value = token_response
+
+        userinfo_response = Mock()
+        userinfo_response.raise_for_status.return_value = None
+        userinfo_response.json.return_value = {
+            "sub": "google-sub-redirect-uri",
+            "email": "redirect@example.com",
+            "email_verified": True,
+            "given_name": "Redirect",
+            "family_name": "Uri",
+            "picture": "https://example.com/avatar.png",
+        }
+        requests_get.return_value = userinfo_response
+
+        exchange_code_for_google_profile("google-auth-code")
+
+        self.assertEqual(
+            requests_post.call_args.kwargs["data"]["redirect_uri"],
+            auth_redirect_uri,
+        )
+        self.assertEqual(auth_redirect_uri, settings.GOOGLE_OAUTH_REDIRECT_URI)
+
     @patch("apps.users.services.google_oauth.requests.get")
     @patch("apps.users.api.views.exchange_code_for_google_profile")
     def test_google_callback_redirects_with_authenticated_flow_for_linked_account(
@@ -633,6 +673,41 @@ class GoogleOAuthApiTests(APITestCase):
         self.assertEqual(flow_response.data["resolution"], "new_account")
         self.assertIsNone(flow_response.data["mobile_hint"])
 
+    def test_google_callback_redirects_cancellation_back_to_frontend(self):
+        response = self.client.get(
+            "/api/users/oauth/google/callback/?error=access_denied&error_description=User%20cancelled",
+        )
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("/auth/google/callback?error=access_denied", response["Location"])
+        self.assertIn("error_description=User+cancelled", response["Location"])
+
+    @patch("apps.users.api.views.exchange_code_for_google_profile")
+    def test_google_callback_redirects_backend_errors_back_to_frontend(
+        self,
+        exchange_code_for_google_profile,
+    ):
+        exchange_code_for_google_profile.side_effect = serializers.ValidationError(
+            {"detail": "Google token exchange failed."}
+        )
+
+        start_response = self.client.get("/api/users/oauth/google/start/")
+        state = start_response["Location"].split("state=", 1)[1].split("&", 1)[0]
+
+        response = self.client.get(
+            f"/api/users/oauth/google/callback/?state={state}&code=google-code",
+        )
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(
+            "/auth/google/callback?error=google_callback_failed",
+            response["Location"],
+        )
+        self.assertIn(
+            "error_description=Google+token+exchange+failed.",
+            response["Location"],
+        )
+
     @patch("apps.users.api.views.exchange_code_for_google_profile")
     def test_google_callback_redirects_with_email_claim_flow_for_matching_email(
         self,
@@ -995,7 +1070,7 @@ class GoogleOAuthAuditCommandTests(APITestCase):
             password="secret123",
             email="owner@example.com",
         )
-        other_user = User.objects.create_user(
+        User.objects.create_user(
             mobile="09126660002",
             password="secret123",
             email="shared@example.com",

apps/workspaces/api/views.py

@@ -3,7 +3,8 @@ from django.shortcuts import get_object_or_404
 from rest_framework import status
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.response import Response
-from rest_framework.filters import OrderingFilter, SearchFilter
+from rest_framework.filters import OrderingFilter, SearchFilter
+from rest_framework.decorators import action
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework.viewsets import ModelViewSet
 from rest_framework.permissions import IsAuthenticated
@@ -15,6 +16,8 @@ from apps.notifications.services import (
     notify_workspace_membership_removed,
     notify_workspace_membership_role_changed,
 )
+from apps.projects.models import ProjectUserRate
+from apps.projects.services.access import filter_projects_for_user
 from apps.workspaces.api.permissions import (
     CanWorkspaceManageMembers,
     IsWorkspaceAdmin,
@@ -78,6 +81,8 @@ class WorkspaceViewSet(ModelViewSet):
     def get_permissions(self):
         if self.action in ["list", "retrieve"]:
             return [IsAuthenticated(), IsWorkspaceMember()]
+        if self.action == "my_rates":
+            return [IsAuthenticated()]
         if self.action in ["update", "partial_update"]:
             return [IsAuthenticated(), IsWorkspaceAdmin()]
 
@@ -86,8 +91,94 @@ class WorkspaceViewSet(ModelViewSet):
 
         return [IsAuthenticated()]
         
-    def perform_create(self, serializer):
-        serializer.save(owner=self.request.user)
+    def perform_create(self, serializer):
+        serializer.save(owner=self.request.user)
+
+    def create(self, request, *args, **kwargs):
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot create additional workspaces."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
+        return super().create(request, *args, **kwargs)
+
+    @action(detail=True, methods=["get"], url_path="my-rates")
+    def my_rates(self, request, pk=None):
+        workspace = self.get_object()
+        if not has_workspace_capability(request.user, workspace, WORKSPACE_VIEW):
+            raise PermissionDenied("You do not have access to this workspace.")
+
+        def serialize_rate(rate):
+            if not rate:
+                return None
+            unit = PriceUnit.objects.filter(code=rate.currency, is_deleted=False).first()
+            return {
+                "id": str(rate.id),
+                "hourly_rate": str(rate.hourly_rate),
+                "currency": rate.currency,
+                "price_unit": PriceUnitSerializer(unit).data if unit else None,
+                "effective_from": rate.effective_from.isoformat() if rate.effective_from else None,
+            }
+
+        workspace_rate = (
+            WorkspaceUserRate.objects.filter(
+                workspace=workspace,
+                user=request.user,
+                is_deleted=False,
+            )
+            .order_by("-effective_from", "-updated_at")
+            .first()
+        )
+        accessible_projects = list(
+            filter_projects_for_user(
+                request.user,
+                workspace.projects.filter(is_deleted=False).select_related("client"),
+            ).order_by("client__name", "name")
+        )
+        accessible_project_ids = [project.id for project in accessible_projects]
+        project_rates_by_project_id = {}
+        for rate in (
+            ProjectUserRate.objects.filter(
+                project_id__in=accessible_project_ids,
+                user=request.user,
+                is_active=True,
+                is_deleted=False,
+            )
+            .select_related("project", "project__client")
+            .order_by("project_id", "-effective_from", "-updated_at")
+        ):
+            project_rates_by_project_id.setdefault(str(rate.project_id), rate)
+
+        payload = {
+            "workspace": {
+                "id": str(workspace.id),
+                "name": workspace.name,
+            },
+            "workspace_rate": serialize_rate(workspace_rate),
+            "accessible_project_count": len(accessible_projects),
+            "project_rates": [
+                {
+                    "project": {
+                        "id": str(project.id),
+                        "name": project.name,
+                        "client": (
+                            {"id": str(project.client_id), "name": project.client.name}
+                            if project.client_id and project.client
+                            else None
+                        ),
+                    },
+                    "rate": serialize_rate(project_rates_by_project_id[str(project.id)]),
+                }
+                for project in accessible_projects
+                if str(project.id) in project_rates_by_project_id
+            ],
+        }
+        payload["project_override_count"] = len(payload["project_rates"])
+        payload["workspace_fallback_project_count"] = max(
+            payload["accessible_project_count"] - payload["project_override_count"],
+            0,
+        )
+        return Response(payload)
 
 
 class WorkspaceMembershipViewSet(ModelViewSet):
@@ -163,7 +254,12 @@ class WorkspaceMembershipViewSet(ModelViewSet):
                 status=status.HTTP_400_BAD_REQUEST
             )
             
-        workspace = get_object_or_404(Workspace, id=workspace_id)
+        workspace = get_object_or_404(Workspace, id=workspace_id)
+        if getattr(request.user, "is_demo", False):
+            return Response(
+                {"detail": "Demo accounts cannot add workspace members."},
+                status=status.HTTP_403_FORBIDDEN,
+            )
         
         permission = IsWorkspaceAdmin()
         if not permission.has_object_permission(request, self, workspace):

apps/workspaces/migrations/0008_hourlyratehistory.py

@@ -0,0 +1,78 @@
+# Generated by Django 5.2.12 on 2026-05-26 08:20
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+def seed_rate_history(apps, schema_editor):
+    HourlyRateHistory = apps.get_model('workspaces', 'HourlyRateHistory')
+    WorkspaceUserRate = apps.get_model('workspaces', 'WorkspaceUserRate')
+    ProjectUserRate = apps.get_model('projects', 'ProjectUserRate')
+
+    workspace_rows = [
+        HourlyRateHistory(
+            workspace_id=rate.workspace_id,
+            user_id=rate.user_id,
+            project_id=None,
+            scope='workspace',
+            hourly_rate=rate.hourly_rate,
+            currency=rate.currency,
+            effective_from=rate.effective_from,
+            is_active=True,
+        )
+        for rate in WorkspaceUserRate.objects.filter(is_deleted=False)
+    ]
+    project_rows = [
+        HourlyRateHistory(
+            workspace_id=rate.project.workspace_id,
+            user_id=rate.user_id,
+            project_id=rate.project_id,
+            scope='project',
+            hourly_rate=rate.hourly_rate,
+            currency=rate.currency,
+            effective_from=rate.effective_from,
+            is_active=True,
+        )
+        for rate in ProjectUserRate.objects.select_related('project').filter(is_deleted=False)
+    ]
+    HourlyRateHistory.objects.bulk_create(workspace_rows + project_rows, ignore_conflicts=True)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('projects', '0005_project_thumbnail'),
+        ('workspaces', '0007_workspacemembership_membership_ws_active_user_idx'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='HourlyRateHistory',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid7, primary_key=True, serialize=False)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('deleted_at', models.DateTimeField(blank=True, null=True)),
+                ('is_deleted', models.BooleanField(default=False)),
+                ('is_active', models.BooleanField(default=False)),
+                ('scope', models.CharField(choices=[('workspace', 'Workspace'), ('project', 'Project')], max_length=16)),
+                ('hourly_rate', models.DecimalField(decimal_places=2, max_digits=10)),
+                ('currency', models.CharField(default='USD', max_length=3)),
+                ('effective_from', models.DateTimeField()),
+                ('created_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='created_%(app_label)s_%(class)s_set', to=settings.AUTH_USER_MODEL)),
+                ('project', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='hourly_rate_history', to='projects.project')),
+                ('updated_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='updated_%(app_label)s_%(class)s_set', to=settings.AUTH_USER_MODEL)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='hourly_rate_history', to=settings.AUTH_USER_MODEL)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='hourly_rate_history', to='workspaces.workspace')),
+            ],
+            options={
+                'db_table': 'hourly_rate_history',
+                'ordering': ('effective_from', 'created_at'),
+                'indexes': [models.Index(fields=['workspace', 'user', 'effective_from'], name='hrh_ws_user_eff_idx'), models.Index(fields=['project', 'user', 'effective_from'], name='hrh_project_user_eff_idx')],
+            },
+        ),
+        migrations.RunPython(seed_rate_history, migrations.RunPython.noop),
+    ]

apps/workspaces/models.py

@@ -173,3 +173,53 @@ class WorkspaceUserRate(BaseModel):
                 "currency": self.currency,
             },
         )
+
+
+class HourlyRateHistory(BaseModel):
+    class Scope(models.TextChoices):
+        WORKSPACE = "workspace", "Workspace"
+        PROJECT = "project", "Project"
+
+    workspace = models.ForeignKey(
+        Workspace,
+        on_delete=models.CASCADE,
+        related_name="hourly_rate_history",
+    )
+    user = models.ForeignKey(
+        User,
+        on_delete=models.CASCADE,
+        related_name="hourly_rate_history",
+    )
+    project = models.ForeignKey(
+        "projects.Project",
+        on_delete=models.CASCADE,
+        related_name="hourly_rate_history",
+        null=True,
+        blank=True,
+    )
+    scope = models.CharField(max_length=16, choices=Scope.choices)
+    hourly_rate = models.DecimalField(max_digits=10, decimal_places=2)
+    currency = models.CharField(max_length=3, default="USD")
+    effective_from = models.DateTimeField()
+
+    class Meta:
+        db_table = "hourly_rate_history"
+        ordering = ("effective_from", "created_at")
+        indexes = [
+            models.Index(fields=["workspace", "user", "effective_from"], name="hrh_ws_user_eff_idx"),
+            models.Index(fields=["project", "user", "effective_from"], name="hrh_project_user_eff_idx"),
+        ]
+
+    def get_additional_data(self):
+        return build_workspace_log_metadata(
+            section=SECTION_RATES,
+            workspace_id=self.workspace_id,
+            target_id=self.id,
+            target_label=self.user.full_name or self.user.mobile,
+            extra={
+                "rate_user_id": str(self.user_id),
+                "project_id": str(self.project_id) if self.project_id else None,
+                "scope": self.scope,
+                "currency": self.currency,
+            },
+        )

apps/workspaces/services/rates.py

@@ -1,6 +1,34 @@
 from django.utils import timezone
 
-from apps.workspaces.models import WorkspaceUserRate
+from apps.workspaces.models import HourlyRateHistory, WorkspaceUserRate
+
+
+def record_workspace_rate_history(*, workspace, user_id, hourly_rate, currency, effective_from=None):
+    currency = currency.upper()
+    effective_from = effective_from or timezone.now()
+    latest = (
+        HourlyRateHistory.objects.filter(
+            workspace=workspace,
+            user_id=user_id,
+            scope=HourlyRateHistory.Scope.WORKSPACE,
+            project__isnull=True,
+            is_deleted=False,
+        )
+        .order_by("-effective_from", "-created_at")
+        .first()
+    )
+    if latest and latest.hourly_rate == hourly_rate and latest.currency == currency:
+        return latest
+    return HourlyRateHistory.objects.create(
+        workspace=workspace,
+        user_id=user_id,
+        project=None,
+        scope=HourlyRateHistory.Scope.WORKSPACE,
+        hourly_rate=hourly_rate,
+        currency=currency,
+        effective_from=effective_from,
+        is_active=True,
+    )
 
 
 def upsert_workspace_user_rate(workspace, user_id, hourly_rate, currency="USD"):
@@ -11,6 +39,7 @@ def upsert_workspace_user_rate(workspace, user_id, hourly_rate, currency="USD"):
         is_deleted=False,
     ).first()
 
+    effective_from = timezone.now()
     if rate:
         update_fields = []
         if rate.hourly_rate != hourly_rate:
@@ -25,16 +54,31 @@ def upsert_workspace_user_rate(workspace, user_id, hourly_rate, currency="USD"):
         if update_fields:
             update_fields.append("updated_at")
             rate.save(update_fields=update_fields)
+            record_workspace_rate_history(
+                workspace=workspace,
+                user_id=user_id,
+                hourly_rate=rate.hourly_rate,
+                currency=rate.currency,
+                effective_from=effective_from,
+            )
         return rate
 
-    return WorkspaceUserRate.objects.create(
+    rate = WorkspaceUserRate.objects.create(
         workspace=workspace,
         user_id=user_id,
         hourly_rate=hourly_rate,
         currency=currency,
-        effective_from=timezone.now(),
+        effective_from=effective_from,
         is_active=True,
     )
+    record_workspace_rate_history(
+        workspace=workspace,
+        user_id=user_id,
+        hourly_rate=rate.hourly_rate,
+        currency=rate.currency,
+        effective_from=rate.effective_from,
+    )
+    return rate
 
 
 def update_workspace_user_rate(rate_instance, **kwargs):
@@ -50,5 +94,12 @@ def update_workspace_user_rate(rate_instance, **kwargs):
     if update_fields:
         update_fields.append("updated_at")
         rate_instance.save(update_fields=update_fields)
+        if {"hourly_rate", "currency", "is_active"} & set(update_fields):
+            record_workspace_rate_history(
+                workspace=rate_instance.workspace,
+                user_id=rate_instance.user_id,
+                hourly_rate=rate_instance.hourly_rate,
+                currency=rate_instance.currency,
+            )
 
     return rate_instance

apps/workspaces/tests/test_api_permissions.py

@@ -4,6 +4,7 @@ from django.core.cache import cache
 from django.test import TestCase
 from rest_framework.test import APITestCase
 
+from apps.projects.models import Project, ProjectAccess, ProjectUserRate
 from apps.users.models import User
 from apps.workspaces.api.permissions import (
     CanWorkspaceManageMembers,
@@ -11,7 +12,7 @@ from apps.workspaces.api.permissions import (
     IsWorkspaceMember,
     IsWorkspaceOwner,
 )
-from apps.workspaces.models import Workspace, WorkspaceMembership
+from apps.workspaces.models import PriceUnit, Workspace, WorkspaceMembership, WorkspaceUserRate
 
 
 class WorkspacePermissionTests(TestCase):
@@ -189,3 +190,48 @@ class WorkspaceMembershipCacheTests(APITestCase):
         target = next(item for item in fresh_response.data["items"] if item["id"] == str(self.membership.id))
         self.assertEqual(target["role"], WorkspaceMembership.Role.GUEST)
         self.assertFalse(target["is_active"])
+
+
+class WorkspaceMyRatesApiTests(APITestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.owner = User.objects.create_user(mobile="09127770101", password="secret123")
+        cls.member = User.objects.create_user(mobile="09127770102", password="secret123")
+        cls.workspace = Workspace.objects.create(name="Rates View", owner=cls.owner)
+        WorkspaceMembership.objects.create(
+            workspace=cls.workspace,
+            user=cls.member,
+            role=WorkspaceMembership.Role.MEMBER,
+            is_active=True,
+        )
+        PriceUnit.objects.create(code="USD", name="US Dollar", local_name="Dollar", symbol="$")
+        cls.project = Project.objects.create(workspace=cls.workspace, name="Mobile App")
+        ProjectAccess.objects.create(project=cls.project, user=cls.member)
+        WorkspaceUserRate.objects.create(
+            workspace=cls.workspace,
+            user=cls.member,
+            hourly_rate="10.00",
+            currency="USD",
+            effective_from=cls.workspace.created_at,
+            is_active=True,
+        )
+        ProjectUserRate.objects.create(
+            project=cls.project,
+            user=cls.member,
+            hourly_rate="18.00",
+            currency="USD",
+            effective_from=cls.workspace.created_at,
+            is_active=True,
+        )
+
+    def test_member_can_view_own_workspace_and_project_rates(self):
+        self.client.force_authenticate(user=self.member)
+
+        response = self.client.get(f"/api/workspaces/{self.workspace.id}/my-rates/")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data["workspace_rate"]["hourly_rate"], "10.00")
+        self.assertEqual(response.data["project_override_count"], 1)
+        self.assertEqual(response.data["workspace_fallback_project_count"], 0)
+        self.assertEqual(response.data["project_rates"][0]["project"]["name"], "Mobile App")
+        self.assertEqual(response.data["project_rates"][0]["rate"]["hourly_rate"], "18.00")

apps/workspaces/tests/test_rates.py

@@ -4,7 +4,7 @@ from django.core.cache import cache
 from django.test import TestCase
 from rest_framework.test import APITestCase
 
-from apps.projects.models import Project
+from apps.projects.models import Project, ProjectAccess, ProjectUserRate
 from apps.time_entries.services.rates import resolve_rate
 from apps.users.models import User
 from apps.workspaces.models import (
@@ -78,6 +78,53 @@ class WorkspaceRateTests(APITestCase):
         self.assertIsNone(hourly_rate)
         self.assertEqual(currency, "")
 
+    def test_resolve_rate_prefers_project_user_rate_when_member_has_access(self):
+        WorkspaceUserRate.objects.create(
+            workspace=self.workspace,
+            user=self.member,
+            hourly_rate=Decimal("40.00"),
+            currency="EUR",
+            effective_from=self.project.created_at,
+            is_active=True,
+        )
+        ProjectAccess.objects.create(project=self.project, user=self.member)
+        ProjectUserRate.objects.create(
+            project=self.project,
+            user=self.member,
+            hourly_rate=Decimal("55.00"),
+            currency="USD",
+            effective_from=self.project.created_at,
+            is_active=True,
+        )
+
+        hourly_rate, currency = resolve_rate(self.member, self.project)
+
+        self.assertEqual(hourly_rate, Decimal("55.00"))
+        self.assertEqual(currency, "USD")
+
+    def test_resolve_rate_ignores_project_user_rate_without_access(self):
+        WorkspaceUserRate.objects.create(
+            workspace=self.workspace,
+            user=self.member,
+            hourly_rate=Decimal("40.00"),
+            currency="EUR",
+            effective_from=self.project.created_at,
+            is_active=True,
+        )
+        ProjectUserRate.objects.create(
+            project=self.project,
+            user=self.member,
+            hourly_rate=Decimal("55.00"),
+            currency="USD",
+            effective_from=self.project.created_at,
+            is_active=True,
+        )
+
+        hourly_rate, currency = resolve_rate(self.member, self.project)
+
+        self.assertEqual(hourly_rate, Decimal("40.00"))
+        self.assertEqual(currency, "EUR")
+
     def test_admin_can_manage_workspace_user_rates(self):
         self.client.force_authenticate(user=self.admin)
 

config/settings/base.py

@@ -2,6 +2,7 @@ import os
 from datetime import timedelta
 from pathlib import Path
 
+from celery.schedules import crontab
 from dotenv import load_dotenv
 
 load_dotenv()
@@ -48,6 +49,8 @@ LOCAL_APPS = [
     "apps.notifications",
     "apps.reports",
     "apps.logs",
+    "apps.demos",
+    "apps.contacts",
 ]
 
 INSTALLED_APPS = DJANGO_APPS + THIRD_PARTY_APPS + LOCAL_APPS
@@ -138,6 +141,8 @@ REST_FRAMEWORK = {
         "otp_send_sustained": "10/day",
         "login_password": "5/10m",
         "login_otp": "5/10m",
+        "demo_start": os.getenv("DEMO_START_RATE_LIMIT", "10/hour"),
+        "contact_submission": os.getenv("CONTACT_SUBMISSION_RATE_LIMIT", "5/hour"),
     },
     "EXCEPTION_HANDLER": "core.exceptions.handlers.exception_handler",
 }
@@ -243,7 +248,21 @@ NOTIFICATION_TOAST_LEVELS = tuple(
 
 REPORT_EXPORT_RETENTION_DAYS = int(os.getenv("REPORT_EXPORT_RETENTION_DAYS", "7"))
 
-CELERY_IMPORTS = ("apps.users.tasks", "apps.notifications.tasks", "apps.reports.tasks")
+DEMO_ENABLED = os.getenv("DEMO_ENABLED", "True") == "True"
+DEMO_ENVIRONMENT_TTL_HOURS = int(os.getenv("DEMO_ENVIRONMENT_TTL_HOURS", "24"))
+DEMO_CLEANUP_BATCH_SIZE = int(os.getenv("DEMO_CLEANUP_BATCH_SIZE", "100"))
+
+CELERY_IMPORTS = ("apps.users.tasks", "apps.notifications.tasks", "apps.reports.tasks", "apps.demos.tasks")
+CELERY_BEAT_SCHEDULE = {
+    "reports-cleanup-expired-exports": {
+        "task": "reports.cleanup_expired_exports",
+        "schedule": crontab(minute=0, hour="*/6"),
+    },
+    "demos-cleanup-expired-environments": {
+        "task": "demos.cleanup_expired_environments",
+        "schedule": crontab(minute=0, hour="*"),
+    },
+}
 
 
 STORAGES = {

config/urls.py

@@ -24,6 +24,8 @@ urlpatterns = [
     path("api/notifications/", include("apps.notifications.api.urls"), name="notifications"),
     path("api/reports/", include("apps.reports.api.urls"), name="reports"),
     path("api/logs/", include("apps.logs.api.urls"), name="logs"),
+    path("api/demo/", include("apps.demos.api.urls"), name="demos"),
+    path("api/contact/", include("apps.contacts.api.urls"), name="contacts"),
 ]
 
 if settings.DEBUG: