hr_lite 0.14.0 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '04966d2c7a57a06e49c64c6a375b148c497f83340a79445eb0f243dd783246f0'
-  data.tar.gz: 1112874bf22548910a651e53123056fd1341e045598060660c12f93b284789bb
+  metadata.gz: 14d37a1d62a035315390be2c619a74722c58e6b53b747422aa4ab48458287102
+  data.tar.gz: fbbb6c7efb893ff38d6992971844fd721deca4819943f0e0dd8f1cd343f4b4fc
 SHA512:
-  metadata.gz: '00219df8c7244175712e7a87768f50301fa2f8b0110ae201f343409064bdb1083cce3eef587ad046cf7e1831a1981eb7d3c6e816e2a9d431cbbb86aaf5ef8c89'
-  data.tar.gz: 53af8da6feddf2be67301f9754f2912a08fe246bada0b68eb89b2eb49b70a3279db4ded5645f3438bc859e1a57be3cde29e6c1fc59526db2747d1cc98a5525c6
+  metadata.gz: 70b42e3a35bd683ab62ecda90d33009511faeda8595cbc9ec9fc9f1ae2388f61592059a4ea1be151ade6ec3062f4ecea2726098f2f58adc55048f8e108de7460
+  data.tar.gz: a19199e7cd8a173713e97d77266d4779951ef47d70171c234ee65d2afec5cc35be8670542db4e49ad2e656efe6031b8aba053cc281f687fd08dd6b20e3d83511

data/CHANGELOG.md

@@ -7,6 +7,106 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-09-27
+
+Employee ID cards, print requests through Ask HR, recording leave for
+somebody, and notices that reach the right people. Two migrations, both
+additive (`blood_group`/`emergency_contact` on profiles, `created_by_id` on
+leave requests). New runtime dependency: `rqrcode`.
+
+### Added
+
+- **Employee ID card.** `/id_card` shows the card front and back; `/id_card/:user_id`
+  lets anyone whose `profile.view` reaches that person open it to print. Print
+  gives one CR80 (54 × 85.6 mm) face per page. The QR holds the company brand,
+  address and phone as plain text — no URL, nothing to host.
+- **ID photo.** The one field an employee edits on their own profile. JPG, PNG
+  or WebP under 5 MB, content-sniffed; every change is audited.
+- Blood group and emergency contact on the leadership employee form, encrypted
+  like the other personal fields so the audit email reads `[changed]`.
+- `config.company` may return `brand:` and `phone:`.
+- **Request a printed ID card.** One tap on the card raises an Ask-HR request
+  in the new `id_card` category. It needs a photo first, and only one can be
+  open at a time. The desk opens the card from the request to print it;
+  answering the request stamps "Issued" on the card.
+- **Record leave for somebody.** Approvals → Record leave, for leave taken but
+  never applied for. It is saved approved by whoever records it, keeps the
+  balance check, stores `created_by_id`, and emails the employee — not the
+  approvers. The employee is picked by typing a name or code.
+- A new hire gets the Employee role with their profile, so Ask HR and
+  Policies work from day one.
+- **Publish policies and announcements.** Leadership (`policy.manage`) writes
+  one at `/admin/policies`; every current employee gets an email and a bell.
+  A policy asks to be acknowledged, an announcement does not, and reusing a
+  title publishes the next version. The list shows who still has to
+  acknowledge.
+- **Holiday notices.** Adding a holiday tells everyone; a pasted list sends one
+  notice, not one per line (new matrix row `holiday.published`).
+- `config.notifications = ->(user) { { url:, unread: } }` puts a notifications
+  link with the unread count in the HR shell. Off by default.
+
+### Changed
+
+- Notification defaults: a leave application and an Ask-HR request now EMAIL
+  every approver / desk holder as well as belling them; the team "on leave"
+  notice is a bell only, and is not sent at all for leave already over.
+- Overlap and attendance errors on a leave request no longer say "you" — HR
+  sees them too now.
+- Employee codes are zero-padded to six digits, and the prefix may end in one
+  hyphen — `ESA-` gives `ESA-000001`. Existing codes are left as they are.
+
+## [0.15.0] - 2026-08-18
+
+The screens for three features that shipped as tables nobody could reach. No
+migration — the data layer was already there.
+
+### Fixed
+
+- **Documents, tax declarations and loans had no UI at all.** 0.13.0 and
+  0.14.0 shipped their models, tables, payroll integration and an expiry job,
+  and every one of them passed its specs — but there was no controller, no
+  route and no view. An employee could not upload a passport, HR could not
+  verify a PAN, and nobody could file an 80C declaration. Loans at least
+  reached a payslip; the other two were unreachable rows.
+- **A tax declaration 500ed when a real browser saved it.** The form posts a
+  line for every section, because that is what a list of claimable things
+  looks like, and the blank ones violated a NOT NULL amount. The specs had
+  only ever posted the lines they filled in. Blank sections are now dropped,
+  and clearing an existing amount withdraws that claim.
+- `TaxDeclaration` and `ApprovalFlow` were missing `inverse_of` on their
+  nested associations. The foreign key is not derived from the class name, so
+  a nested item on an unsaved parent could not see it — every first save
+  failed with "declaration must exist".
+
+### Added
+
+- **Documents.** Employees upload, see what is expiring and remove anything
+  not yet verified; HR sees what is waiting, whose file is missing which
+  category, and verifies or sends one back with a reason. Downloads go
+  through the row's own `readable_by?` and every one is audited — a file
+  leaving the building is the event worth recording.
+- **Tax declarations.** A section-by-section claim the employee files
+  themselves, replacing an admin typing one lump sum into the profile. HR
+  records what the proof actually supported, which is often less than the
+  claim. Until it is verified payroll deducts against the CLAIM: making
+  somebody overpay tax all year because paperwork is slow is its own kind of
+  wrong.
+- **Loans.** Employees see what they owe and what comes out of the next
+  payslip; the money tier records a loan, closes it, or cancels one that has
+  not been deducted from yet. Cancelling after an instalment has been taken
+  is refused — that money has already left somebody's salary.
+- Nav entries for all three, employee and admin.
+
+### Changed
+
+- Verifying a document requires being able to OPEN it. Attesting to a scan
+  you are not allowed to look at is not verification, and it keeps an
+  Aadhaar with the money tier rather than with whoever happens to run HR.
+- The spec suite deletes its sqlite file before every run. The role and
+  rate-card migrations SEED rows, and seeds never overwrite what exists —
+  right in production, wrong in a test database, where a leftover file kept
+  yesterday's definitions and a change to `RoleSeeds` silently did not apply.
+
 ## [0.14.0] - 2026-08-18
 
 The admin half, plus the two ends of employment that were still manual.
@@ -793,7 +893,8 @@ Initial release.
   bus with per-event channel matrix (bell, email, leadership email/bell),
   daily leadership digest and an append-only audit trail.
 
-[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.14.0...HEAD
+[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.15.0...HEAD
+[0.15.0]: https://github.com/kshtzkr/hr_lite/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/kshtzkr/hr_lite/compare/v0.13.0...v0.14.0
 [0.13.0]: https://github.com/kshtzkr/hr_lite/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/kshtzkr/hr_lite/compare/v0.11.0...v0.12.0

data/README.md

@@ -131,7 +131,10 @@ HrLite.configure do |c|
 
   c.mailer_from     = "hr@example.com"
   c.public_url_base = "https://hr.example.com"  # enables deep links in emails
-  c.company         = -> { { name: "Acme", address: "Head office address", logo_path: nil } }
+  # brand + phone are optional; the ID card prints brand, and its QR holds
+  # brand, address and phone as plain text.
+  c.company         = -> { { name: "Acme", brand: "acme.in", address: "Head office address",
+                            phone: "+91 00000 00000", logo_url: nil } }
 
   # Salary-slip PDFs: plug your renderer, or add wicked_pdf to the bundle and
   # the built-in renderer takes over. With neither, PDF export is disabled.

data/app/assets/javascripts/hr_lite/print.js

@@ -0,0 +1,5 @@
+// The ID card's Print button. The engine ships no framework, and an inline
+// onclick would need a CSP nonce the host may not issue.
+document.addEventListener("click", function (event) {
+  if (event.target.closest("[data-hrl-print]")) window.print();
+});

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -324,3 +324,75 @@
 .hrl-prose { max-width: 68ch; }
 .hrl-prose p { margin: 0 0 .8rem; line-height: 1.6; }
 .hrl-prose p:last-child { margin-bottom: 0; }
+
+/* ID card. Every length is N × --u, where N is the design's pixel value at
+   360px wide — so one variable fits a phone, the desktop, and a CR80 print. */
+.hrl-idcard-faces { container-type: inline-size; display: flex; flex-wrap: wrap; gap: 3.5rem; justify-content: center; }
+.hrl-idcard-face { display: flex; flex-direction: column; align-items: center; gap: .85rem; }
+.hrl-idcard__label { font: 600 11px/1 var(--hrl-card-body, var(--hrl-font)); letter-spacing: .14em; color: #64748B; }
+.hrl-idcard {
+  --u: min(1px, 100cqi / 360);
+  --blue: #0057A8; --green: #00A24F; --red: #ED1C24;
+  width: calc(360 * var(--u)); height: calc(570 * var(--u));
+  background: #fff; border: calc(1.4 * var(--u)) solid #D9D9D9; border-radius: calc(22 * var(--u));
+  box-shadow: 0 6px 18px rgba(15, 23, 42, .08), 0 24px 48px rgba(15, 23, 42, .08);
+  overflow: hidden; position: relative; display: flex; flex-direction: column;
+  font-family: var(--hrl-card-body, var(--hrl-font)); color: #0F172A; print-color-adjust: exact; -webkit-print-color-adjust: exact;
+}
+.hrl-idcard--back { align-items: center; }
+.hrl-idcard__band { height: calc(176 * var(--u)); background: var(--blue); display: flex; flex-direction: column; align-items: center; padding-top: calc(18 * var(--u)); }
+.hrl-idcard__slot { width: calc(64 * var(--u)); height: calc(10 * var(--u)); border-radius: 9999px; background: #F9F9F9; box-shadow: inset 0 1px 3px rgba(0, 0, 0, .25); }
+.hrl-idcard__slot--back { margin-top: calc(18 * var(--u)); background: #F1F5F9; box-shadow: inset 0 1px 3px rgba(0, 0, 0, .2); }
+.hrl-idcard__logo { margin-top: calc(18 * var(--u)); background: #fff; border-radius: 9999px; padding: calc(8 * var(--u)) calc(18 * var(--u)); display: flex; align-items: center; font: 700 calc(13 * var(--u)) var(--hrl-card-display, var(--hrl-font)); color: var(--blue); }
+.hrl-idcard__logo img { height: calc(26 * var(--u)); display: block; }
+.hrl-idcard__kicker { margin-top: calc(12 * var(--u)); font: 600 calc(10 * var(--u))/1 var(--hrl-card-body, var(--hrl-font)); letter-spacing: .2em; color: rgba(255, 255, 255, .85); }
+.hrl-idcard__photo {
+  position: absolute; top: calc(126 * var(--u)); left: 50%; transform: translateX(-50%);
+  width: calc(140 * var(--u)); height: calc(164 * var(--u)); border-radius: calc(26 * var(--u));
+  border: calc(5 * var(--u)) solid #fff; box-shadow: 0 6px 18px rgba(15, 23, 42, .15); background: #F8FAFC; overflow: hidden;
+  display: flex; align-items: center; justify-content: center; font: 700 calc(34 * var(--u)) var(--hrl-card-display, var(--hrl-font)); color: #64748B;
+}
+.hrl-idcard__photo img { width: 100%; height: 100%; object-fit: cover; display: block; }
+.hrl-idcard__who { margin-top: calc(124 * var(--u)); text-align: center; padding: 0 calc(24 * var(--u)); }
+.hrl-idcard__name { font: 800 calc(25 * var(--u))/1.1 var(--hrl-card-display, var(--hrl-font)); letter-spacing: -.02em; text-wrap: balance; }
+.hrl-idcard__role { margin-top: calc(6 * var(--u)); font: 500 calc(13 * var(--u))/1.3 var(--hrl-card-body, var(--hrl-font)); color: #334155; }
+.hrl-idcard__green { color: var(--green); }
+.hrl-idcard__blue { color: var(--blue); }
+.hrl-idcard__red { color: var(--red) !important; }
+.hrl-idcard__facts {
+  margin: calc(18 * var(--u)) calc(24 * var(--u)) 0; display: grid; grid-template-columns: 1fr 1fr; gap: calc(12 * var(--u)) calc(16 * var(--u));
+  padding: calc(14 * var(--u)) calc(16 * var(--u)); background: #F8FAFC; border-radius: calc(16 * var(--u)); border: 1px solid #E2E8F0;
+}
+.hrl-idcard__facts dt { font: 600 calc(9 * var(--u))/1 var(--hrl-card-body, var(--hrl-font)); letter-spacing: .14em; color: #64748B; }
+.hrl-idcard__facts dd { margin: calc(5 * var(--u)) 0 0; font: 600 calc(13 * var(--u))/1.2 var(--hrl-card-body, var(--hrl-font)); color: #0F172A; }
+.hrl-idcard__strip { margin-top: auto; height: calc(10 * var(--u)); display: grid; grid-template-columns: 2fr 1fr 1fr; }
+.hrl-idcard__strip span:nth-child(1) { background: var(--blue); }
+.hrl-idcard__strip span:nth-child(2) { background: var(--green); }
+.hrl-idcard__strip span:nth-child(3) { background: var(--red); }
+.hrl-idcard__title { margin-top: calc(26 * var(--u)); font: 800 calc(18 * var(--u))/1.1 var(--hrl-card-display, var(--hrl-font)); letter-spacing: -.01em; }
+.hrl-idcard__qr { margin-top: calc(16 * var(--u)); padding: calc(14 * var(--u)); border-radius: calc(24 * var(--u)); border: calc(1.4 * var(--u)) solid #D9D9D9; box-shadow: 0 6px 18px rgba(15, 23, 42, .08); }
+.hrl-idcard__qr svg { width: calc(176 * var(--u)); height: calc(176 * var(--u)); display: block; }
+.hrl-idcard__code { margin-top: calc(12 * var(--u)); font: 600 calc(12 * var(--u))/1 var(--hrl-card-body, var(--hrl-font)); letter-spacing: .16em; }
+.hrl-idcard__rows { margin: calc(22 * var(--u)) calc(28 * var(--u)) 0; align-self: stretch; display: flex; flex-direction: column; gap: calc(10 * var(--u)); }
+.hrl-idcard__rows div { display: flex; justify-content: space-between; gap: calc(12 * var(--u)); font: 400 calc(12 * var(--u))/1.4 var(--hrl-card-body, var(--hrl-font)); color: #475569; }
+.hrl-idcard__rows b { font-weight: 600; color: #0F172A; text-align: right; }
+.hrl-idcard__rows hr { margin: 0; border: 0; height: 1px; background: #E2E8F0; }
+.hrl-idcard__note { margin: calc(20 * var(--u)) calc(28 * var(--u)) 0; text-align: center; font: 400 calc(11 * var(--u))/1.5 var(--hrl-card-body, var(--hrl-font)); color: #64748B; text-wrap: pretty; }
+.hrl-idcard__foot { margin-top: auto; align-self: stretch; background: var(--blue); padding: calc(14 * var(--u)) calc(24 * var(--u)); display: flex; justify-content: space-between; align-items: center; }
+.hrl-idcard__foot b { font: 700 calc(13 * var(--u))/1 var(--hrl-card-display, var(--hrl-font)); color: #fff; }
+.hrl-idcard__foot span { font: 500 calc(10 * var(--u))/1 var(--hrl-card-body, var(--hrl-font)); letter-spacing: .14em; color: rgba(255, 255, 255, .85); }
+.hrl-idcard-actions { display: flex; flex-wrap: wrap; gap: .85rem; align-items: flex-start; justify-content: center; margin-top: 1.5rem; }
+
+/* Print: one CR80 face per page, nothing else. */
+@media print {
+  @page { size: 54mm 85.6mm; margin: 0; }
+  .hrl-side, .hrl-appbar, .hrl-tabbar, .hrl-flash, .hrl-page__head, .hrl-idcard__label, .hrl-idcard-actions { display: none !important; }
+  .hrl-body { background: #fff; }
+  .hrl-main { padding: 0; margin: 0; }
+  .hrl-idcard-faces { display: block; }
+  .hrl-idcard { --u: calc(54mm / 360); box-shadow: none; break-after: page; }
+}
+
+/* Notifications link, shown only when the host configures one. */
+.hrl-bell { display: inline-flex; align-items: center; gap: .4rem; min-height: 44px; font-size: .86rem; font-weight: 600; }
+.hrl-bell__count { min-width: 1.4rem; padding: 0 .4rem; border-radius: 9999px; background: var(--hrl-accent); color: var(--hrl-accent-ink); font-size: .75rem; text-align: center; }

data/app/controllers/hr_lite/admin/documents_controller.rb

@@ -0,0 +1,63 @@
+module HrLite
+  module Admin
+    # HR's side: whose documents are missing, and verifying the ones that
+    # arrived. Reaching a person's list is `document.view`; opening the file
+    # still goes through the row's own visibility.
+    class DocumentsController < BaseController
+      skip_before_action :require_operations_access!
+      before_action :require_document_access!
+
+      def index
+        @category = params[:category].presence
+        scope = hr_scope(Document.includes(:user).recent_first, "document.view")
+        scope = scope.where(category: @category) if @category
+        @pending = scope.where(verification: "pending").limit(50).to_a
+        @documents = paginate(scope)
+        @categories = Document.distinct.order(:category).pluck(:category)
+      end
+
+      def show
+        @employee = HrLite.user_klass.find(params[:user_id])
+        hr_require_reach!("document.view", @employee)
+        @documents = Document.for_user(@employee).recent_first
+        @missing = Document::SENSITIVE_CATEGORIES - @documents.map(&:category)
+      end
+
+      def verify
+        document = find_manageable
+        document.verify!(actor: hr_current_user, note: params[:note])
+        redirect_back fallback_location: admin_documents_path,
+                      notice: "#{document.title} verified."
+      end
+
+      def reject
+        document = find_manageable
+        note = params[:note].to_s.strip
+        if note.blank?
+          return redirect_back fallback_location: admin_documents_path,
+                               alert: "Say what is wrong with it — the employee has to re-upload."
+        end
+
+        document.reject!(actor: hr_current_user, note: note)
+        redirect_back fallback_location: admin_documents_path, notice: "#{document.title} rejected."
+      end
+
+      private
+
+      def require_document_access!
+        hr_require_permission!("document.view", scope: :team)
+      end
+
+      # You may verify a document you can OPEN. Attesting to a scan you are
+      # not allowed to look at is not verification, and the row's visibility
+      # is what keeps an Aadhaar with the money tier rather than with
+      # whoever happens to run HR.
+      def find_manageable
+        document = Document.find(params[:id])
+        raise ActiveRecord::RecordNotFound unless document.readable_by?(hr_current_user)
+
+        document
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -115,7 +115,7 @@ module HrLite
           :user_id, :manager_id, :designation, :date_of_birth, :date_of_joining,
           :date_of_exit, :department, :work_location, :pan_number, :pf_uan, :esi_number,
           :bank_account_number, :bank_ifsc, :bank_name, :tax_regime, :declared_annual_deductions,
-          :fy_opening_gross, :fy_opening_tds
+          :fy_opening_gross, :fy_opening_tds, :blood_group, :emergency_contact
         )
       end
 

data/app/controllers/hr_lite/admin/holidays_controller.rb

@@ -11,6 +11,7 @@ module HrLite
       def create
         @holiday = Holiday.new(holiday_params)
         if @holiday.save
+          announce("Holiday added: #{@holiday.name} on #{@holiday.date.strftime('%a %d %b %Y')}")
           redirect_to admin_holidays_path(year: @holiday.date.year), notice: "Holiday added."
         else
           redirect_to admin_holidays_path, alert: @holiday.errors.full_messages.to_sentence
@@ -55,6 +56,7 @@ module HrLite
           created += 1
         end
 
+        announce("#{created} holiday#{'s' unless created == 1} added to the calendar") if created.positive?
         message = "#{created} holiday#{'s' unless created == 1} added."
         message += " Problems: #{problems.join('; ')}" if problems.any?
         redirect_to admin_holidays_path, problems.any? ? { alert: message } : { notice: message }
@@ -62,6 +64,11 @@ module HrLite
 
       private
 
+      def announce(title)
+        staff = HrLite.active_employees
+        Notifications.publish("holiday.published", title: title, path: "/holidays", bell_to: staff, email_to: staff)
+      end
+
       def holiday_params
         params.require(:holiday).permit(:date, :name, :optional)
       end

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -16,6 +16,27 @@ module HrLite
         @balance = @request.balance
       end
 
+      # HR records leave somebody forgot to apply for. Approved on save, by the
+      # person recording it; the balance check still applies.
+      def new
+        @request = LeaveRequest.new(start_date: Date.current, end_date: Date.current)
+        @people = recordable
+      end
+
+      def create
+        profile = recordable.find_by(employee_code: params[:employee_code].to_s.strip)
+        @request = LeaveRequest.new(params.require(:leave_request).permit(:leave_type_id, :start_date, :end_date, :half_day, :reason)
+                                          .merge(user_id: profile&.user_id, created_by_id: hr_current_user.id))
+        recorded = profile && LeaveRequest.transaction do
+          (@request.save && @request.approve!(actor: hr_current_user, note: "Recorded by HR")) || raise(ActiveRecord::Rollback)
+        end
+        return redirect_to(admin_leave_request_path(@request), notice: "Leave recorded and approved.") if recorded
+
+        @request.errors.add(:base, profile ? "Not enough balance — adjust it first or use unpaid leave" : "Pick an employee from the list") if @request.errors.empty?
+        @people = recordable
+        render :new, status: :unprocessable_entity
+      end
+
       def approve
         request = find_decidable
         if request.approve!(actor: hr_current_user, note: params[:decision_note].presence)
@@ -68,6 +89,8 @@ module HrLite
       end
 
       def find_decidable = decidable.find(params[:id])
+
+      def recordable = hr_scope(EmployeeProfile.includes(:user), "leave.approve")
     end
   end
 end

data/app/controllers/hr_lite/admin/loans_controller.rb

@@ -0,0 +1,59 @@
+module HrLite
+  module Admin
+    # Loans and salary advances. Money tier: the instalment lands as a
+    # deduction on a payslip, so whoever sets it is setting somebody's pay.
+    class LoansController < SuperadminController
+      def index
+        @status = params[:status].presence_in(Loan::STATUSES) || "active"
+        @loans = paginate(Loan.includes(:user).where(status: @status).order(starts_on: :desc))
+        @outstanding = Loan.active.includes(:loan_repayments).sum(BigDecimal(0), &:outstanding)
+      end
+
+      def new
+        @loan = Loan.new(starts_on: Date.current.next_month.beginning_of_month)
+      end
+
+      def create
+        @loan = Loan.new(loan_params.merge(approved_by_id: hr_current_user.id))
+        if @loan.save
+          redirect_to admin_loans_path,
+                      notice: "Loan recorded for #{HrLite.display_name(@loan.user)} — " \
+                              "deductions start #{@loan.starts_on.strftime('%b %Y')}."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def show
+        @loan = Loan.includes(:loan_repayments).find(params[:id])
+      end
+
+      # Closing stops the deduction. It does NOT delete the repayments —
+      # those are on published payslips and are what the outstanding balance
+      # is derived from.
+      def close
+        loan = Loan.find(params[:id])
+        loan.update!(status: "closed")
+        redirect_to admin_loans_path, notice: "Closed — no further deductions."
+      end
+
+      def cancel
+        loan = Loan.find(params[:id])
+        if loan.loan_repayments.exists?
+          return redirect_to admin_loan_path(loan),
+                             alert: "Instalments have already been deducted. Close it instead — " \
+                                    "cancelling would deny money that has left somebody's salary."
+        end
+
+        loan.update!(status: "cancelled")
+        redirect_to admin_loans_path, notice: "Cancelled before any deduction."
+      end
+
+      private
+
+      def loan_params
+        params.require(:loan).permit(:user_id, :principal, :monthly_instalment, :starts_on, :reason)
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/policies_controller.rb

@@ -0,0 +1,29 @@
+module HrLite
+  module Admin
+    # Write a policy or an announcement and send it to everyone. A policy asks
+    # to be acknowledged; an announcement does not. Same title again = the
+    # next version.
+    class PoliciesController < ApplicationController
+      before_action { hr_require_permission!("policy.manage", scope: :all) }
+
+      def index
+        @policies = Policy.newest_first
+      end
+
+      def new
+        @policy = Policy.new(effective_from: Date.current, acknowledgement_required: true)
+      end
+
+      def create
+        @policy = Policy.new(params.require(:policy).permit(:title, :body, :effective_from, :acknowledgement_required)
+                                   .merge(published: true))
+        @policy.version = (Policy.where(title: @policy.title).maximum(:version) || 0) + 1
+        if @policy.save
+          redirect_to admin_policies_path, notice: "Published — everyone has been told."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/tax_declarations_controller.rb

@@ -0,0 +1,75 @@
+module HrLite
+  module Admin
+    # HR checking the proof behind a declaration, line by line. The verified
+    # amount is what payroll deducts against once this is done, so it is
+    # entered per section rather than accepted wholesale.
+    class TaxDeclarationsController < BaseController
+      skip_before_action :require_operations_access!
+      before_action :require_tax_access!
+
+      def index
+        @status = params[:status].presence_in(TaxDeclaration::STATUSES) || "submitted"
+        @declarations = paginate(
+          hr_scope(TaxDeclaration.includes(:user, :tax_declaration_items), "tax.view")
+            .where(status: @status).order(created_at: :desc)
+        )
+      end
+
+      def show
+        @declaration = find_visible
+      end
+
+      def update
+        @declaration = find_manageable
+        # Recording what the proof supported is a separate act from deciding
+        # — an amount can be corrected while the decision is still pending.
+        if @declaration.update(verification_params)
+          redirect_to admin_tax_declaration_path(@declaration), notice: "Amounts recorded."
+        else
+          render :show, status: :unprocessable_entity
+        end
+      end
+
+      def verify
+        declaration = find_manageable
+        declaration.verify!(actor: hr_current_user, note: params[:note])
+        redirect_to admin_tax_declarations_path, notice: "Verified — payroll will use the checked amounts."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_tax_declaration_path(declaration), alert: "Only a submitted declaration can be verified."
+      end
+
+      def reject
+        declaration = find_manageable
+        declaration.reject!(actor: hr_current_user, note: params[:note].to_s.strip)
+        redirect_to admin_tax_declarations_path, notice: "Sent back to the employee."
+      rescue ArgumentError
+        redirect_to admin_tax_declaration_path(declaration),
+                    alert: "Say what is missing — they have to know what to fix."
+      end
+
+      private
+
+      def require_tax_access!
+        hr_require_permission!("tax.view", scope: :all)
+      end
+
+      def find_visible
+        declaration = TaxDeclaration.includes(:tax_declaration_items).find(params[:id])
+        hr_require_reach!("tax.view", declaration.user)
+        declaration
+      end
+
+      def find_manageable
+        declaration = TaxDeclaration.find(params[:id])
+        hr_require_reach!("tax.manage", declaration.user)
+        declaration
+      end
+
+      def verification_params
+        params.require(:tax_declaration).permit(
+          tax_declaration_items_attributes: %i[id verified_amount]
+        )
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/documents_controller.rb

@@ -0,0 +1,69 @@
+module HrLite
+  # An employee's own documents, and the download itself.
+  #
+  # The FILE is the sensitive part, so every read goes through
+  # `Document#readable_by?` rather than through the scope that found the row.
+  # A passport is not a payslip: HR can see that one exists without being
+  # handed the scan.
+  class DocumentsController < ApplicationController
+    def index
+      @documents = Document.for_user(hr_current_user).recent_first
+      @document = Document.new
+      @expiring = @documents.select { |d| d.expires_on && d.expires_on <= 60.days.from_now.to_date }
+    end
+
+    def create
+      @document = Document.new(document_params)
+      @document.user_id = hr_current_user.id
+      @document.uploaded_by_id = hr_current_user.id
+
+      if @document.save
+        redirect_to documents_path, notice: "#{@document.title} uploaded."
+      else
+        @documents = Document.for_user(hr_current_user).recent_first
+        @expiring = []
+        render :index, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      document = Document.for_user(hr_current_user).find(params[:id])
+      # A verified identity document is evidence HR acted on; removing it
+      # quietly would leave their verification pointing at nothing.
+      if document.verified?
+        return redirect_to documents_path, status: :see_other,
+                           alert: "#{document.title} has been verified — ask HR to replace it."
+      end
+
+      document.destroy!
+      redirect_to documents_path, notice: "#{document.title} removed.", status: :see_other
+    end
+
+    # The one place a file leaves the building. Scoped by nothing — the
+    # permission check is the row's own, because a document may be readable
+    # by its owner, by HR, or by nobody but the money tier.
+    def download
+      document = Document.find(params[:id])
+      unless document.readable_by?(hr_current_user)
+        raise ActiveRecord::RecordNotFound
+      end
+
+      AuditLog.record!(
+        action: "document.downloaded", subject: document, actor: hr_current_user,
+        changes: { "title" => document.title, "category" => document.category,
+                   "owner" => HrLite.display_name(document.user) }
+      )
+      # rails_blob_path, not url_for: an engine controller has no default
+      # host and url_for(attachment) raises without one.
+      redirect_to Rails.application.routes.url_helpers.rails_blob_path(
+        document.file, disposition: "attachment", only_path: true
+      ), allow_other_host: false
+    end
+
+    private
+
+    def document_params
+      params.require(:document).permit(:category, :title, :reference_number, :issued_on, :expires_on, :file)
+    end
+  end
+end

data/app/controllers/hr_lite/hr_requests_controller.rb

@@ -19,6 +19,8 @@ module HrLite
       @request = HrRequest.new(request_params.merge(user_id: hr_current_user.id))
       if @request.save
         redirect_to hr_requests_path, notice: "Sent to HR."
+      elsif @request.category == "id_card"
+        redirect_to id_card_path, alert: @request.errors.full_messages.to_sentence
       else
         render :new, status: :unprocessable_entity
       end

data/app/controllers/hr_lite/id_cards_controller.rb

@@ -0,0 +1,25 @@
+module HrLite
+  # The employee ID card: your own, or — for HR printing it — anyone your
+  # `profile.view` reaches. The photo is the one thing an employee edits.
+  class IdCardsController < ApplicationController
+    def show
+      @user = params[:user_id] ? HrLite.user_klass.find(params[:user_id]) : hr_current_user
+      hr_require_reach!("profile.view", @user) unless @user == hr_current_user
+      @profile = EmployeeProfile.find_by(user_id: @user.id)
+      card_requests = HrRequest.where(user_id: @user.id, category: "id_card")
+      @issued_on = card_requests.where(status: "resolved").maximum(:resolved_at)
+      @print_requested = card_requests.open_requests.pick(:created_at)
+    end
+
+    def photo
+      profile = EmployeeProfile.find_by!(user_id: hr_current_user.id)
+      profile.photo = params.require(:photo)
+      if profile.save
+        AuditLog.record!(action: "id_card.photo_changed", subject: profile, actor: hr_current_user)
+        redirect_to id_card_path, notice: "Photo updated.", status: :see_other
+      else
+        redirect_to id_card_path, alert: profile.errors.full_messages.to_sentence, status: :see_other
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/loans_controller.rb

@@ -0,0 +1,11 @@
+module HrLite
+  # What an employee owes and what is coming out of the next payslip. Read
+  # only: a loan is agreed with the company, not self-served.
+  class LoansController < ApplicationController
+    def index
+      @loans = Loan.where(user_id: hr_current_user.id).order(starts_on: :desc)
+      @outstanding = @loans.sum(BigDecimal(0), &:outstanding)
+      @next_month = Date.current.next_month.beginning_of_month
+    end
+  end
+end