hr_lite 0.11.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 655b4d27557dace6262528eb82af6912b4b7dfcdc3ff6b8274068876b8bb970c
-  data.tar.gz: ba15eee422c61704681db9d8d1194851f8c761459524844ade6e4cd054776f81
+  metadata.gz: a035599be75b81c0d2f3d1fc1b8f95328df845445f6c93d997a9906f9b43846e
+  data.tar.gz: 8a840cc6c1af2ef49af660859fc6edf0f2ccec4b59377017c9cc0467793e8396
 SHA512:
-  metadata.gz: 4b4224f36f2cd4b3c256d440e6f439f59ce86e61436545f4f5a1afab97d827c64db86b4ee3b21f72003ea8864010b0369d6a719cd833a7194855adc1af10602c
-  data.tar.gz: 3de774d902610ab761c5794fe4f9eec3c404dac26ccf0fbea553bfe6bafe09e45c576e8264b07c70b6eef07af3f93f54c88aa43d3fd149921d4726456823a890
+  metadata.gz: 9bef92ea728cc960bc548c37fe3a8a34090ad531bec3ab248dc572ce9931f44fb5bf2591b1578df0c22f68ffd5ab7c02e6e7a8ed43445b1087524fc59584889b
+  data.tar.gz: 2598075e1f67e8e2c9e7fa4142db5e7561f42f17e32a9be6207ca560116a8e9d3ac7b7876c02e4bc77c250df6ef0ec0b05592ad9c073b22aaa8f01158129276f

data/CHANGELOG.md

@@ -7,6 +7,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.0] - 2026-08-18
+
+The four things an employee had to leave the system to do. **Adds one
+migration.**
+
+### Added
+
+- **Expenses**, with categories carrying a monthly cap and a receipt rule.
+  The cap is checked when the claim is MADE, not at approval — telling
+  somebody they are over it after a week of waiting is the wrong moment to
+  find out. A claim awaiting a decision counts against the cap; a rejected
+  one gives the room back.
+- Expenses route through the approval engine from 0.9.0 rather than growing a
+  fifth approve/reject. Configure a flow and a claim gets manager-then-finance
+  for free. `reimbursed` is a separate state from `approved`, because agreeing
+  to pay somebody and paying them are different days and the person waiting
+  cares about the second one.
+- **Benefits and enrolments.** Dependants are a COUNT, not a list — names and
+  dates of birth of somebody's family are data this engine has no reason to
+  hold, and holding them would mean protecting them.
+- **An HR help desk**: raise, assign, resolve, with the answer going back to
+  the person who asked instead of dying in somebody's inbox.
+- **Policies, versioned.** Re-issuing asks everybody again, because an
+  acknowledgement of v1 says nothing about v2 — that is the whole point of
+  versioning it. Acknowledgements are `readonly?` once written: evidence that
+  can be edited afterwards is not evidence. Clicking twice is not an error.
+- Permissions for all four, granted to the roles that should hold them, and
+  nine notification events.
+
+### Changed
+
+- `HrLite::Expense` is the second module on the approval engine, which is the
+  first real test of the claim made in 0.9.0 that a new module gets
+  multi-level approval without touching the engine. It did.
+
 ## [0.11.0] - 2026-08-18
 
 Documents, and a tax declaration that is more than one number. **Adds one
@@ -694,7 +729,8 @@ Initial release.
   bus with per-event channel matrix (bell, email, leadership email/bell),
   daily leadership digest and an append-only audit trail.
 
-[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.11.0...HEAD
+[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.12.0...HEAD
+[0.12.0]: https://github.com/kshtzkr/hr_lite/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/kshtzkr/hr_lite/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/kshtzkr/hr_lite/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/kshtzkr/hr_lite/compare/v0.8.0...v0.9.0

data/app/models/hr_lite/approval_flow.rb

@@ -22,7 +22,7 @@ module HrLite
     def self.approvable_types
       %w[
         HrLite::LeaveRequest HrLite::CompOffRequest
-        HrLite::RegularizationRequest HrLite::Resignation
+        HrLite::RegularizationRequest HrLite::Resignation HrLite::Expense
       ].freeze
     end
 

data/app/models/hr_lite/benefit.rb

@@ -0,0 +1,37 @@
+module HrLite
+  # An insurance policy or other benefit the company provides. Employees can
+  # finally see what they are covered for without emailing somebody.
+  class Benefit < ApplicationRecord
+    include EncryptedMoney
+    include Audited
+
+    KINDS = %w[health life accident other].freeze
+
+    encrypted_money :coverage, :employer_premium, :employee_premium
+
+    has_many :benefit_enrolments, class_name: "HrLite::BenefitEnrolment", dependent: :destroy
+    has_many :enrolled_users, through: :benefit_enrolments, source: :user
+
+    validates :name, presence: true
+    validates :kind, inclusion: { in: KINDS }
+    validate :expiry_is_after_the_start
+
+    scope :active, -> { where(active: true) }
+    scope :live_on, ->(date) {
+      active.where("effective_from IS NULL OR effective_from <= ?", date)
+            .where("expires_on IS NULL OR expires_on >= ?", date)
+    }
+
+    def expiring?(within: 30, on: Date.current)
+      expires_on.present? && expires_on <= on + within && expires_on >= on
+    end
+
+    private
+
+    def expiry_is_after_the_start
+      return if effective_from.nil? || expires_on.nil? || expires_on >= effective_from
+
+      errors.add(:expires_on, "must be on or after the start date")
+    end
+  end
+end

data/app/models/hr_lite/benefit_enrolment.rb

@@ -0,0 +1,30 @@
+module HrLite
+  # Who is covered, from when. Dependants are a COUNT, not a list — names and
+  # dates of birth of somebody's family are data this engine has no reason to
+  # hold, and holding them would mean protecting them.
+  class BenefitEnrolment < ApplicationRecord
+    include Audited
+
+    belongs_to :benefit, class_name: "HrLite::Benefit"
+    belongs_to :user, class_name: HrLite.config.user_class
+
+    validates :enrolled_on, presence: true
+    validates :user_id, uniqueness: { scope: :benefit_id }
+    validates :dependants, numericality: { greater_than_or_equal_to: 0 }
+    validate :ended_after_it_started
+
+    scope :live_on, ->(date) {
+      where(enrolled_on: ..date).where("ended_on IS NULL OR ended_on >= ?", date)
+    }
+
+    def live?(on = Date.current) = enrolled_on <= on && (ended_on.nil? || ended_on >= on)
+
+    private
+
+    def ended_after_it_started
+      return if ended_on.nil? || enrolled_on.nil? || ended_on >= enrolled_on
+
+      errors.add(:ended_on, "must be on or after the enrolment date")
+    end
+  end
+end

data/app/models/hr_lite/expense.rb

@@ -0,0 +1,142 @@
+module HrLite
+  # A claim. Routed through the approval engine rather than growing a fifth
+  # approve/reject of its own — configure a flow for it and it gets manager
+  # then finance for free.
+  class Expense < ApplicationRecord
+    include EncryptedMoney
+    include Audited
+    include Approvable
+
+    STATUSES = %w[draft submitted approved rejected reimbursed cancelled].freeze
+
+    encrypted_money :amount
+
+    belongs_to :category, class_name: "HrLite::ExpenseCategory"
+    belongs_to :user, class_name: HrLite.config.user_class
+
+    has_one_attached :receipt
+
+    validates :status, inclusion: { in: STATUSES }
+    validates :description, presence: true
+    validates :spent_on, presence: true
+    validate :amount_is_positive
+    validate :spent_on_is_not_in_the_future
+    validate :within_the_category_cap, on: :create
+    validate :receipt_is_present_when_the_category_demands_one
+
+    scope :awaiting_reimbursement, -> { where(status: "approved") }
+    scope :recent_first, -> { order(spent_on: :desc, id: :desc) }
+
+    STATUSES.each { |s| define_method("#{s}?") { status == s } }
+
+    def submit!(actor:)
+      raise ActiveRecord::RecordInvalid.new(self), "not a draft" unless draft? || rejected?
+
+      update!(status: "submitted", submitted_at: Time.current)
+      notify_deciders
+      true
+    end
+
+    def approve!(actor:, note: nil)
+      return record_routed!(actor, note, :approved) if awaiting?(actor)
+
+      settle!("approved", actor, note)
+    end
+
+    def reject!(actor:, note:)
+      raise ArgumentError, "a rejection needs a reason" if note.blank?
+      return record_routed!(actor, note, :rejected) if awaiting?(actor)
+
+      settle!("rejected", actor, note)
+    end
+
+    # Paid out with a payroll month. Kept separate from `approved` because
+    # agreeing to pay somebody and actually paying them are different days,
+    # and the person waiting cares about the second one.
+    def reimburse!(actor:, period_month:)
+      raise ActiveRecord::RecordInvalid.new(self), "not approved" unless approved?
+
+      transaction do
+        update!(status: "reimbursed", reimbursed_in: period_month.beginning_of_month)
+        AuditLog.record!(action: "expense.reimbursed", subject: self, actor: actor,
+                         changes: { "employee" => HrLite.display_name(user),
+                                    "period" => period_month.strftime("%B %Y") })
+      end
+      Notifications.publish(
+        "expense.reimbursed",
+        title: "Your #{category.name} claim was reimbursed with #{period_month.strftime('%B %Y')} payroll",
+        path: "/expenses", bell_to: [ user ], email_to: [ user ]
+      )
+      true
+    end
+
+    private
+
+    def record_routed!(actor, note, intent)
+      approval = approval_for(actor)
+      result = approval_route.decide!(approval, status: intent.to_s, actor: actor, note: note)
+
+      case result.outcome
+      when :approved then settle!("approved", actor, note)
+      # `reject!` already refuses a blank note, so there is nothing to
+      # default to here.
+      when :rejected then settle!("rejected", actor, note)
+      else
+        notify_deciders
+        true
+      end
+    end
+
+    def settle!(new_status, actor, note)
+      update!(status: new_status, decision_note: note.presence)
+      Notifications.publish(
+        new_status == "approved" ? "expense.approved" : "expense.rejected",
+        title: "Your #{category.name} claim was #{new_status}",
+        body: note.presence, path: "/expenses", bell_to: [ user ], email_to: [ user ]
+      )
+      true
+    end
+
+    def notify_deciders
+      deciders = pending_approvals.map(&:approver).compact.uniq
+      deciders = HrLite.users_holding("expense.approve").to_a if deciders.empty?
+      return if deciders.empty?
+
+      Notifications.publish(
+        "expense.submitted",
+        title: "#{HrLite.display_name(user)} claimed #{Money.format(amount)} — #{category.name}",
+        body: description, path: "/admin/expenses", bell_to: deciders
+      )
+    end
+
+    def amount_is_positive
+      errors.add(:amount, "must be more than zero") unless amount&.positive?
+    end
+
+    def spent_on_is_not_in_the_future
+      return if spent_on.nil? || spent_on <= Date.current
+
+      errors.add(:spent_on, "cannot be in the future")
+    end
+
+    # Checked at claim time rather than at approval: telling somebody they
+    # are over the cap after they have waited a week for an answer is the
+    # wrong moment to find out.
+    def within_the_category_cap
+      return if category.nil? || amount.nil? || spent_on.nil?
+
+      remaining = category.remaining_for(user, spent_on.beginning_of_month)
+      return if remaining.nil? || amount <= remaining
+
+      errors.add(:amount, "is over the #{category.name} cap for #{spent_on.strftime('%B')} " \
+                          "— #{Money.format(remaining)} left")
+    end
+
+    def receipt_is_present_when_the_category_demands_one
+      return unless category&.receipt_required
+      return if receipt.attached?
+
+      errors.add(:receipt, "is required for #{category.name}")
+    end
+  end
+end

data/app/models/hr_lite/expense_category.rb

@@ -0,0 +1,33 @@
+module HrLite
+  # "Travel", "Client entertainment", "Home office" — with the cap and the
+  # receipt rule that go with each.
+  class ExpenseCategory < ApplicationRecord
+    include EncryptedMoney
+    include Audited
+
+    encrypted_money :monthly_cap
+
+    has_many :expenses, class_name: "HrLite::Expense", foreign_key: :category_id,
+                        dependent: :restrict_with_error
+
+    validates :name, presence: true, uniqueness: { case_sensitive: false }
+
+    scope :active, -> { where(active: true) }
+    scope :alphabetical, -> { order(:name) }
+
+    def uncapped? = monthly_cap.nil?
+
+    # What is left of this month's cap for one person, or nil when uncapped.
+    # Counts everything not refused: a claim awaiting a decision has still
+    # been spent against the cap.
+    def remaining_for(user, month = Date.current.beginning_of_month)
+      return nil if uncapped?
+
+      spent = expenses.where(user_id: user.id)
+                      .where(spent_on: month..month.end_of_month)
+                      .where.not(status: %w[rejected cancelled])
+                      .sum(BigDecimal(0)) { |e| e.amount || BigDecimal(0) }
+      [ monthly_cap - spent, BigDecimal(0) ].max
+    end
+  end
+end

data/app/models/hr_lite/hr_request.rb

@@ -0,0 +1,75 @@
+module HrLite
+  # "Can I have a salary certificate?" — the questions that were going to
+  # somebody's inbox and getting lost there.
+  class HrRequest < ApplicationRecord
+    include Audited
+
+    STATUSES = %w[open in_progress resolved closed cancelled].freeze
+
+    CATEGORIES = %w[
+      salary_certificate employment_certificate address_change bank_change
+      document_request payroll_query tax_query insurance_query policy_query other
+    ].freeze
+
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :assigned_to, class_name: HrLite.config.user_class, optional: true
+
+    validates :subject, presence: true
+    validates :category, inclusion: { in: CATEGORIES }
+    validates :status, inclusion: { in: STATUSES }
+
+    scope :open_requests, -> { where(status: %w[open in_progress]) }
+    scope :recent_first, -> { order(created_at: :desc) }
+
+    STATUSES.each { |s| define_method("#{s}?") { status == s } }
+
+    after_create_commit :notify_desk
+
+    def category_label = category.humanize
+
+    def assign!(actor:, assignee:)
+      update!(assigned_to_id: assignee.id, status: "in_progress")
+      Notifications.publish(
+        "hr_request.assigned",
+        title: "#{category_label}: #{subject}",
+        body: "Assigned to you by #{HrLite.display_name(actor)}.",
+        path: "/admin/hr_requests/#{id}", bell_to: [ assignee ]
+      )
+      true
+    end
+
+    def resolve!(actor:, resolution:)
+      raise ArgumentError, "a resolution needs an answer" if resolution.blank?
+
+      update!(status: "resolved", resolution: resolution, resolved_at: Time.current,
+              assigned_to_id: assigned_to_id || actor.id)
+      Notifications.publish(
+        "hr_request.resolved",
+        title: "Your request was answered — #{subject}",
+        body: resolution, path: "/hr_requests/#{id}",
+        bell_to: [ user ], email_to: [ user ]
+      )
+      true
+    end
+
+    def cancel!(actor:)
+      raise ActiveRecord::RecordInvalid.new(self), "already settled" unless open? || in_progress?
+
+      update!(status: "cancelled")
+      true
+    end
+
+    private
+
+    def notify_desk
+      desk = HrLite.users_holding("hr_request.manage").to_a
+      return if desk.empty?
+
+      Notifications.publish(
+        "hr_request.raised",
+        title: "#{HrLite.display_name(user)} asked: #{subject}",
+        body: body.presence, path: "/admin/hr_requests/#{id}", bell_to: desk
+      )
+    end
+  end
+end

data/app/models/hr_lite/policy.rb

@@ -0,0 +1,59 @@
+module HrLite
+  # A written policy people are held to. Versioned, because "you agreed to
+  # this" is only true of the version somebody actually read.
+  class Policy < ApplicationRecord
+    include Audited
+
+    has_many :policy_acknowledgements, class_name: "HrLite::PolicyAcknowledgement",
+                                       dependent: :destroy
+
+    validates :title, presence: true, uniqueness: { scope: :version }
+    validates :body, presence: true
+    validates :effective_from, presence: true
+    validates :version, numericality: { greater_than: 0 }
+
+    scope :published, -> { where(published: true) }
+    scope :live_on, ->(date) { published.where(effective_from: ..date) }
+    scope :newest_first, -> { order(effective_from: :desc, version: :desc) }
+
+    # The version in force today for each title — an older one stays for the
+    # acknowledgements attached to it, but nobody should be reading it.
+    def self.current
+      live_on(Date.current).group_by(&:title).values.map do |versions|
+        versions.max_by(&:version)
+      end
+    end
+
+    # Re-issuing asks everybody again, which is the whole point of versioning
+    # it: an acknowledgement of v1 says nothing about v2.
+    def supersede!(body:, effective_from: Date.current, acknowledgement_required: nil)
+      self.class.create!(
+        title: title, body: body, version: version + 1, effective_from: effective_from,
+        acknowledgement_required: acknowledgement_required.nil? ? self.acknowledgement_required : acknowledgement_required,
+        published: true
+      )
+    end
+
+    def acknowledged_by?(user)
+      policy_acknowledgements.exists?(user_id: user.id)
+    end
+
+    def outstanding_for
+      return HrLite.user_klass.none unless acknowledgement_required && published
+
+      HrLite.user_klass.where(id: HrLite.active_employees.map(&:id))
+            .where.not(id: policy_acknowledgements.select(:user_id))
+    end
+
+    # Clicking twice is not an error and must not read as one. The
+    # find_or_create handles the second click; the rescue handles two
+    # requests arriving at once, which the unique index refuses.
+    def acknowledge!(user)
+      policy_acknowledgements.find_or_create_by!(user_id: user.id) do |ack|
+        ack.acknowledged_at = Time.current
+      end
+    rescue ActiveRecord::RecordNotUnique
+      policy_acknowledgements.find_by!(user_id: user.id)
+    end
+  end
+end

data/app/models/hr_lite/policy_acknowledgement.rb

@@ -0,0 +1,13 @@
+module HrLite
+  # "I have read this." Kept per VERSION, and never edited — it is the
+  # evidence, and evidence that can be changed afterwards is not evidence.
+  class PolicyAcknowledgement < ApplicationRecord
+    belongs_to :policy, class_name: "HrLite::Policy"
+    belongs_to :user, class_name: HrLite.config.user_class
+
+    validates :acknowledged_at, presence: true
+    validates :user_id, uniqueness: { scope: :policy_id }
+
+    def readonly? = persisted?
+  end
+end

data/db/migrate/20260818004707_create_hr_lite_employee_services.rb

@@ -0,0 +1,108 @@
+class CreateHrLiteEmployeeServices < ActiveRecord::Migration[8.1]
+  # Four things an employee has to leave the system to do today: claim an
+  # expense, see what insurance they have, ask HR a question, and read the
+  # policy they are being held to.
+  #
+  # Expenses and requests route through the approval engine from 0.9.0
+  # rather than growing a fifth and sixth approve/reject of their own.
+  def change
+    create_table :hr_lite_expense_categories do |t|
+      t.string :name, null: false
+      t.text :monthly_cap        # encrypted; null = uncapped
+      t.boolean :receipt_required, null: false, default: true
+      t.boolean :active, null: false, default: true
+      t.timestamps
+    end
+    add_index :hr_lite_expense_categories, :name, unique: true
+
+    create_table :hr_lite_expenses do |t|
+      t.bigint :user_id, null: false
+      t.references :category, null: false, index: true,
+                   foreign_key: { to_table: :hr_lite_expense_categories }
+      t.text :amount, null: false # encrypted
+      t.date :spent_on, null: false
+      t.string :description, null: false
+      # draft | submitted | approved | rejected | reimbursed | cancelled
+      t.string :status, null: false, default: "draft"
+      t.datetime :submitted_at
+      t.string :decision_note
+      # Which payroll month paid it out, once it was reimbursed.
+      t.date :reimbursed_in
+      t.timestamps
+    end
+    add_index :hr_lite_expenses, %i[user_id status]
+    add_check_constraint :hr_lite_expenses,
+                         "status IN ('draft', 'submitted', 'approved', 'rejected', 'reimbursed', 'cancelled')",
+                         name: "hr_lite_expenses_status_check"
+
+    create_table :hr_lite_benefits do |t|
+      t.string :name, null: false
+      # health | life | accident | other
+      t.string :kind, null: false, default: "health"
+      t.string :provider
+      t.string :policy_number
+      t.text :coverage          # encrypted — sum assured
+      t.text :employer_premium  # encrypted
+      t.text :employee_premium  # encrypted
+      t.date :effective_from
+      t.date :expires_on
+      t.text :notes
+      t.boolean :active, null: false, default: true
+      t.timestamps
+    end
+
+    create_table :hr_lite_benefit_enrolments do |t|
+      t.references :benefit, null: false, index: true,
+                   foreign_key: { to_table: :hr_lite_benefits, on_delete: :cascade }
+      t.bigint :user_id, null: false
+      t.date :enrolled_on, null: false
+      t.date :ended_on
+      # Dependants covered, as a count — names and dates of birth are the
+      # kind of family data this engine has no reason to hold.
+      t.integer :dependants, null: false, default: 0
+      t.timestamps
+    end
+    add_index :hr_lite_benefit_enrolments, %i[benefit_id user_id], unique: true
+
+    create_table :hr_lite_hr_requests do |t|
+      t.bigint :user_id, null: false
+      # salary_certificate | address_change | bank_change | payroll_query | ...
+      t.string :category, null: false
+      t.string :subject, null: false
+      t.text :body
+      # open | in_progress | resolved | closed | cancelled
+      t.string :status, null: false, default: "open"
+      t.bigint :assigned_to_id
+      t.datetime :resolved_at
+      t.text :resolution
+      t.timestamps
+    end
+    add_index :hr_lite_hr_requests, %i[user_id status]
+    add_index :hr_lite_hr_requests, :assigned_to_id
+    add_check_constraint :hr_lite_hr_requests,
+                         "status IN ('open', 'in_progress', 'resolved', 'closed', 'cancelled')",
+                         name: "hr_lite_hr_requests_status_check"
+
+    create_table :hr_lite_policies do |t|
+      t.string :title, null: false
+      t.text :body, null: false
+      t.integer :version, null: false, default: 1
+      t.date :effective_from, null: false
+      t.boolean :acknowledgement_required, null: false, default: false
+      t.boolean :published, null: false, default: false
+      t.timestamps
+    end
+    add_index :hr_lite_policies, %i[title version], unique: true
+
+    create_table :hr_lite_policy_acknowledgements do |t|
+      t.references :policy, null: false, index: true,
+                   foreign_key: { to_table: :hr_lite_policies, on_delete: :cascade }
+      t.bigint :user_id, null: false
+      t.datetime :acknowledged_at, null: false
+      t.timestamps
+    end
+    # One acknowledgement per person per VERSION: re-issuing a policy has to
+    # ask everybody again, which is the entire point of versioning it.
+    add_index :hr_lite_policy_acknowledgements, %i[policy_id user_id], unique: true
+  end
+end

data/lib/hr_lite/notifications.rb

@@ -34,6 +34,14 @@ module HrLite
       # A document about to lapse — a passport or a visa is somebody's right
       # to work, and finding out late is the whole problem.
       "document.expiring"     => { bell: true,  email: true,  leadership_email: true,  leadership_bell: false },
+      "expense.submitted"     => { bell: true,  email: false, leadership_email: false, leadership_bell: false },
+      "expense.approved"      => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
+      "expense.rejected"      => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
+      "expense.reimbursed"    => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
+      "hr_request.raised"     => { bell: true,  email: false, leadership_email: false, leadership_bell: false },
+      "hr_request.assigned"   => { bell: true,  email: false, leadership_email: false, leadership_bell: false },
+      "hr_request.resolved"   => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
+      "policy.published"      => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
       "digest.daily"          => { bell: false, email: false, leadership_email: true,  leadership_bell: false },
       "resignation.submitted" => { bell: true,  email: false, leadership_email: true,  leadership_bell: true  },
       "resignation.accepted"  => { bell: true,  email: true,  leadership_email: true,  leadership_bell: false },

data/lib/hr_lite/permissions.rb

@@ -47,6 +47,15 @@ module HrLite
       "document.manage" => [ "Documents", "Upload, verify and open identity and bank documents" ],
       "tax.view" => [ "Payroll", "See tax declarations" ],
       "tax.manage" => [ "Payroll", "Verify tax declarations and the proof behind them" ],
+      "expense.claim" => [ "Expenses", "Claim expenses" ],
+      "expense.approve" => [ "Expenses", "Approve and reject expense claims" ],
+      "expense.reimburse" => [ "Expenses", "Mark claims reimbursed with a payroll month" ],
+      "benefit.view" => [ "Benefits", "See benefits and who is enrolled" ],
+      "benefit.manage" => [ "Benefits", "Add benefits and enrol people" ],
+      "hr_request.raise" => [ "Help desk", "Raise a request with HR" ],
+      "hr_request.manage" => [ "Help desk", "Answer and assign HR requests" ],
+      "policy.view" => [ "Policies", "Read published policies" ],
+      "policy.manage" => [ "Policies", "Write, publish and re-issue policies" ],
       "settings.manage" => [ "Administration", "Change company settings, offices and policy" ],
       "audit.view" => [ "Administration", "Read the audit trail" ],
       "audit.view_money" => [ "Administration", "Read audit rows about pay, appraisals and promotions" ],

data/lib/hr_lite/role_seeds.rb

@@ -17,7 +17,9 @@ module HrLite
           "leave.request" => "self", "leave.view" => "self",
           "attendance.view" => "self", "payroll.view" => "self",
           "profile.view" => "self", "appraisal.view" => "self",
-          "resignation.view" => "self", "document.view" => "self", "tax.view" => "self"
+          "resignation.view" => "self", "document.view" => "self", "tax.view" => "self",
+          "expense.claim" => "self", "benefit.view" => "self",
+          "hr_request.raise" => "self", "policy.view" => "all"
         }
       },
       Role::MANAGER => {
@@ -36,7 +38,9 @@ module HrLite
           "leave.manage" => "all", "attendance.view" => "all", "attendance.manage" => "all",
           "profile.view" => "all", "payroll.view" => "self",
           "appraisal.view" => "self", "resignation.view" => "all",
-          "document.view" => "all", "tax.view" => "self"
+          "document.view" => "all", "tax.view" => "self",
+          "expense.claim" => "self", "benefit.view" => "all", "benefit.manage" => "all",
+          "hr_request.raise" => "self", "hr_request.manage" => "all", "policy.view" => "all"
         }
       },
       Role::FINANCE => {
@@ -47,6 +51,8 @@ module HrLite
           "payroll.view" => "all", "payroll.manage" => "all", "payroll.export" => "all",
           "salary.view" => "all", "salary.manage" => "all",
           "tax.view" => "all", "tax.manage" => "all",
+          "expense.claim" => "self", "expense.approve" => "all", "expense.reimburse" => "all",
+          "policy.view" => "all",
           "audit.view" => "all", "audit.view_money" => "all"
         }
       },
@@ -58,7 +64,8 @@ module HrLite
           "profile.view" => "all", "profile.manage" => "all",
           "resignation.view" => "all", "resignation.manage" => "all",
           "settings.manage" => "all", "audit.view" => "all", "payroll.view" => "self",
-          "document.view" => "all"
+          "document.view" => "all", "expense.approve" => "all", "benefit.manage" => "all",
+          "hr_request.manage" => "all", "policy.view" => "all", "policy.manage" => "all"
         }
       },
       Role::SUPER_ADMIN => {

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.11.0"
+  VERSION = "0.12.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.12.0
 platform: ruby
 authors:
 - kshitiz sinha
@@ -118,11 +118,16 @@ files:
 - app/models/hr_lite/approval_step.rb
 - app/models/hr_lite/attendance_record.rb
 - app/models/hr_lite/audit_log.rb
+- app/models/hr_lite/benefit.rb
+- app/models/hr_lite/benefit_enrolment.rb
 - app/models/hr_lite/comp_off_request.rb
 - app/models/hr_lite/designation_change.rb
 - app/models/hr_lite/document.rb
 - app/models/hr_lite/employee_profile.rb
+- app/models/hr_lite/expense.rb
+- app/models/hr_lite/expense_category.rb
 - app/models/hr_lite/holiday.rb
+- app/models/hr_lite/hr_request.rb
 - app/models/hr_lite/kudo.rb
 - app/models/hr_lite/kudo_mention.rb
 - app/models/hr_lite/leave_balance.rb
@@ -133,6 +138,8 @@ files:
 - app/models/hr_lite/office_location.rb
 - app/models/hr_lite/payroll_line_item.rb
 - app/models/hr_lite/payroll_run.rb
+- app/models/hr_lite/policy.rb
+- app/models/hr_lite/policy_acknowledgement.rb
 - app/models/hr_lite/professional_tax_slab.rb
 - app/models/hr_lite/regularization_request.rb
 - app/models/hr_lite/resignation.rb
@@ -283,6 +290,7 @@ files:
 - db/migrate/20260818001151_create_hr_lite_approvals.rb
 - db/migrate/20260818002627_create_hr_lite_payroll_components_and_loans.rb
 - db/migrate/20260818003616_create_hr_lite_documents_and_declarations.rb
+- db/migrate/20260818004707_create_hr_lite_employee_services.rb
 - lib/generators/hr_lite/install/install_generator.rb
 - lib/generators/hr_lite/install/templates/AFTER_INSTALL
 - lib/generators/hr_lite/install/templates/initializer.rb