hr_lite 0.20.0 → 0.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 308cf87cc748758a71ff2bafc7cc301e7ff1fa3f0efc0e0b222e7e4e82e30161
-  data.tar.gz: 8541bec2dbd4b8c6c1b895065a9580f65de22ce01d128c86c4bc52455aa2bdc0
+  metadata.gz: 0d52aa888b9029219bfde72b9d7eabcae22691d9bb5ec73ec6a924191cdf8ac2
+  data.tar.gz: b1e9c215421a30a9c521059c90349db86276f0e74f3ac4c7eb4a34a05ca2cd2b
 SHA512:
-  metadata.gz: 7b6788e0da35e5695257ebf95e2a25b152a8c42d9659d449197995061b57220d34ae6503986f6aa80497cd55dc74e44d0ea2247126cf48924cead29d2c2f40f8
-  data.tar.gz: 06d8209caa183f2092611e9d7613b12a7d1cb45e3333a9ad0b0d1027e4f5ed48e6845e9b6766e6ed8f1352ca537c8921bf85e5e23af9b49876b75021273f645b
+  metadata.gz: 349fcb87fb86b6ee48633227123a83e712bdd5486cda707de5f3c70d8f2b4df941747610fbf5a817336ece750f4c3d28727559faff4997c840a1fd598be83499
+  data.tar.gz: a1c509e0a1189eeac70b67ab848ab04b3507ce85ce456d17396dca9419911187fd26021bbb997d779f07d6d51835e58c105dd4b52f0a7d3ee788899a3781ca9d

data/CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.1] - 2026-10-03
+
+Security fixes. No migration.
+
+### Upgrading
+
+Document numbers are now encrypted with Active Record Encryption. Rows
+saved before this release are plain text, so the host needs
+`config.active_record.encryption.support_unencrypted_data = true` to keep
+reading them, and should re-save each `HrLite::Document` once to encrypt
+the old numbers.
+
+### Security
+
+- **Nobody decides their own request.** A manager could approve their own
+  leave, comp-off and attendance fixes, Finance its own expense claims, and
+  anyone recording leave for someone else could record their own as
+  approved. HR could verify or reject its own documents. All refused now.
+- **Nobody edits their own records from the admin screens.** HR rewriting
+  its own attendance, adjusting its own leave balance, or Finance verifying
+  its own tax declaration is refused.
+- **Document numbers are encrypted.** Aadhaar, PAN and passport numbers
+  were stored in plain text and copied into audit diffs and the leadership
+  audit email. Loans join the money tier for audit mail.
+- **A rejected tax declaration no longer lowers TDS.**
+- **Payroll CSVs defuse formulas.** Register and report cells that open
+  with `=`, `+`, `-` or `@` are escaped, since names are staff-typed.
+- **The payout register needs `payroll.export`**, not just
+  `payroll.manage`.
+- **The admin overview respects reach.** A team-scoped manager sees only
+  the people they reach, not the whole company.
+- **Expense receipts** take the same type and size rule as documents.
+
 ## [0.20.0] - 2026-10-01
 
 Salary as CTC, and who is out today. No migration.

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -82,7 +82,8 @@ module HrLite
       # authorities, so they resolve through different permissions — a role
       # can be given the board without being given the pencil.
       def find_visible_employee = employee_within("attendance.view")
-      def find_manageable_employee = employee_within("attendance.manage")
+      # Nobody rewrites their own punches: team and company scope include the holder.
+      def find_manageable_employee = employee_within("attendance.manage").tap { |e| raise ActiveRecord::RecordNotFound if e.id == hr_current_user.id }
 
       def employee_within(permission)
         employee = HrLite.user_klass.find(params[:user_id])

data/app/controllers/hr_lite/admin/comp_off_requests_controller.rb

@@ -40,8 +40,9 @@ module HrLite
       # A manager decides for their own reports; HR decides for everyone.
       # Scoped through the relation, so reaching for somebody else's report
       # is a 404 rather than a 403 that confirms the person exists.
+      # Nobody decides their own request: team scope includes the approver.
       def decidable
-        hr_scope(CompOffRequest.all, "leave.approve")
+        hr_scope(CompOffRequest.all, "leave.approve").where.not(user_id: hr_current_user.id)
       end
 
       def find_decidable = decidable.find(params[:id])

data/app/controllers/hr_lite/admin/documents_controller.rb

@@ -54,6 +54,8 @@ module HrLite
       # whoever happens to run HR.
       def find_manageable
         document = Document.find(params[:id])
+        # readable_by? always admits the owner, and nobody verifies their own paperwork.
+        raise ActiveRecord::RecordNotFound if document.user_id == hr_current_user.id
         raise ActiveRecord::RecordNotFound unless document.readable_by?(hr_current_user)
 
         document

data/app/controllers/hr_lite/admin/expenses_controller.rb

@@ -39,7 +39,8 @@ module HrLite
 
       def require_deciding! = hr_require_permission!("expense.approve", scope: :team)
 
-      def decidable = hr_scope(Expense.all, "expense.approve")
+      # Nobody approves their own claim: team scope includes the approver.
+      def decidable = hr_scope(Expense.all, "expense.approve").where.not(user_id: hr_current_user.id)
     end
   end
 end

data/app/controllers/hr_lite/admin/leave_balances_controller.rb

@@ -13,6 +13,7 @@ module HrLite
         # A manager reaches this screen through leave.approve; changing
         # somebody's quota is leave.manage, for THAT person.
         hr_require_reach!("leave.manage", user)
+        raise ActiveRecord::RecordNotFound if user.id == hr_current_user.id # never one's own quota
         type = LeaveType.find(params[:leave_type_id])
         # Unsanitised, a missing param wrote the adjustment into leave year 0,
         # where no screen can ever show it.

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -84,13 +84,14 @@ module HrLite
       # somebody else's report gets a 404 through the scoped relation rather
       # than a 403 — the same shape every employee-tier screen already uses,
       # and it does not confirm that the other person exists.
+      # Nobody decides their own request: team scope includes the approver.
       def decidable
-        hr_scope(LeaveRequest.all, "leave.approve")
+        hr_scope(LeaveRequest.all, "leave.approve").where.not(user_id: hr_current_user.id)
       end
 
       def find_decidable = decidable.find(params[:id])
 
-      def recordable = hr_scope(EmployeeProfile.includes(:user), "leave.approve")
+      def recordable = hr_scope(EmployeeProfile.includes(:user), "leave.approve").where.not(user_id: hr_current_user.id)
     end
   end
 end

data/app/controllers/hr_lite/admin/overview_controller.rb

@@ -4,7 +4,7 @@ module HrLite
       SECTION_CAP = 10
 
       def index
-        @query = OverviewQuery.new
+        @query = OverviewQuery.new(user_ids: hr_access.visible_user_ids("leave.view"))
         @kpis = @query.kpis
       end
     end

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -1,6 +1,8 @@
 module HrLite
   module Admin
     class PayrollRunsController < SuperadminController
+      # The register carries every bank account: its own key, not just payroll.manage.
+      before_action -> { hr_require_permission!("payroll.export", scope: :all) }, only: :register
       def index
         @runs = paginate(PayrollRun.recent_first)
       end
@@ -82,6 +84,8 @@ module HrLite
 
       def register_csv(run)
         require "csv"
+        # A cell opening with = + - @ runs as a formula; names are staff-typed.
+        safe = ->(v) { v.is_a?(String) && v.match?(/\A[=+\-@\t\r]/) ? "'#{v}" : v }
         CSV.generate do |csv|
           csv << [ "Code", "Name", "Days", "LOP", "Gross", "PF", "ESI", "PT", "TDS",
                    "Net pay", "Bank", "Account", "IFSC" ]
@@ -95,7 +99,7 @@ module HrLite
               deductions.dig("esi_employee", "amount") || 0, deductions.dig("pt", "amount") || 0,
               deductions.dig("tds", "amount") || 0, slip.net_pay,
               profile&.bank_name, profile&.bank_account_number, profile&.bank_ifsc
-            ]
+            ].map(&safe)
           end
         end
       end

data/app/controllers/hr_lite/admin/regularization_requests_controller.rb

@@ -40,8 +40,9 @@ module HrLite
       # A manager decides for their own reports; HR decides for everyone.
       # Scoped through the relation, so reaching for somebody else's report
       # is a 404 rather than a 403 that confirms the person exists.
+      # Nobody decides their own request: team scope includes the approver.
       def decidable
-        hr_scope(RegularizationRequest.all, "attendance.manage")
+        hr_scope(RegularizationRequest.all, "attendance.manage").where.not(user_id: hr_current_user.id)
       end
 
       def find_decidable = decidable.find(params[:id])

data/app/controllers/hr_lite/admin/reports_controller.rb

@@ -141,9 +141,11 @@ module HrLite
         require "csv"
         return "" if rows.empty?
 
+        # A cell opening with = + - @ runs as a formula; names are staff-typed.
+        safe = ->(v) { v.is_a?(String) && v.match?(/\A[=+\-@\t\r]/) ? "'#{v}" : v }
         CSV.generate do |csv|
           csv << rows.first.keys
-          rows.each { |row| csv << row.values }
+          rows.each { |row| csv << row.values.map(&safe) }
         end
       end
     end

data/app/controllers/hr_lite/admin/tax_declarations_controller.rb

@@ -62,6 +62,7 @@ module HrLite
       def find_manageable
         declaration = TaxDeclaration.find(params[:id])
         hr_require_reach!("tax.manage", declaration.user)
+        raise ActiveRecord::RecordNotFound if declaration.user_id == hr_current_user.id # never one's own
         declaration
       end
 

data/app/models/hr_lite/audit_log.rb

@@ -14,7 +14,7 @@ module HrLite
     # leadership audit screen or the policy.changed email.
     MONEY_TIER_TYPES = %w[
       HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
-      HrLite::PayrollRun HrLite::SalarySlip HrLite::PayrollLineItem
+      HrLite::PayrollRun HrLite::SalarySlip HrLite::PayrollLineItem HrLite::Loan
     ].freeze
 
     scope :recent, -> { order(created_at: :desc) }

data/app/models/hr_lite/document.rb

@@ -5,6 +5,9 @@ module HrLite
   class Document < ApplicationRecord
     include Audited
 
+    # An Aadhaar, PAN or passport number: encrypted, which also redacts it from audit diffs and their emails.
+    encrypts :reference_number
+
     VISIBILITIES = %w[self hr money].freeze
     VERIFICATIONS = %w[pending verified rejected].freeze
 

data/app/models/hr_lite/expense.rb

@@ -23,6 +23,7 @@ module HrLite
     validate :spent_on_is_not_in_the_future
     validate :within_the_category_cap, on: :create
     validate :receipt_is_present_when_the_category_demands_one
+    validate :receipt_is_a_small_pdf_or_image
 
     scope :awaiting_reimbursement, -> { where(status: "approved") }
     scope :recent_first, -> { order(spent_on: :desc, id: :desc) }
@@ -138,5 +139,12 @@ module HrLite
 
       errors.add(:receipt, "is required for #{category.name}")
     end
+
+    def receipt_is_a_small_pdf_or_image
+      return unless receipt.attached?
+      return errors.add(:receipt, "must be a PDF or an image") unless Document::ALLOWED_TYPES.include?(receipt.blob.content_type)
+
+      errors.add(:receipt, "must be under #{Document::MAX_BYTES / 1.megabyte} MB") if receipt.blob.byte_size > Document::MAX_BYTES
+    end
   end
 end

data/app/services/hr_lite/overview_query.rb

@@ -3,36 +3,38 @@ module HrLite
   # one source, so they always agree. Sections return Relations (callers
   # paginate or cap as they see fit).
   class OverviewQuery
-    def initialize(date: Date.current)
+    # user_ids nil = everyone; a team-scoped viewer sees only the people they reach.
+    def initialize(date: Date.current, user_ids: nil)
       @date = date
+      @user_ids = user_ids
     end
 
     def pending_requests
-      LeaveRequest.pending.includes(:leave_type, :user).order(:created_at)
+      reach(LeaveRequest.pending.includes(:leave_type, :user).order(:created_at))
     end
 
     def on_leave_today
-      LeaveRequest.active_on(@date).includes(:leave_type, :user).order(:start_date)
+      reach(LeaveRequest.active_on(@date).includes(:leave_type, :user).order(:start_date))
     end
 
     # Comp-off and regularization are approvals too. Counting leave alone made
     # the board announce "All present and accounted for" while both queues
     # still had work in them.
     def pending_comp_offs
-      CompOffRequest.pending.includes(:user).recent_first
+      reach(CompOffRequest.pending.includes(:user).recent_first)
     end
 
     def pending_regularizations
-      RegularizationRequest.pending.includes(:user).recent_first
+      reach(RegularizationRequest.pending.includes(:user).recent_first)
     end
 
     def flagged_today
-      AttendanceRecord.for_date(@date).flagged.includes(:user)
+      reach(AttendanceRecord.for_date(@date).flagged.includes(:user))
     end
 
     # AttendanceCloseJob fills check_out_at, so the days it closed count too.
     def missing_checkout_yesterday
-      yesterday = AttendanceRecord.for_date(@date - 1)
+      yesterday = reach(AttendanceRecord.for_date(@date - 1))
       yesterday.missing_checkout.or(yesterday.where(regularization_note: AttendanceRecord::AUTO_CHECKOUT_NOTE))
                .includes(:user)
     end
@@ -49,5 +51,9 @@ module HrLite
     def empty?
       kpis.values.all?(&:zero?)
     end
+
+    private
+
+    def reach(relation) = @user_ids ? relation.where(user_id: @user_ids) : relation
   end
 end

data/app/services/hr_lite/slip_builder.rb

@@ -135,7 +135,8 @@ module HrLite
     def annual_deductions
       declaration = TaxDeclaration.for(@user, @run.period_month)
       return @profile.declared_annual_deductions if declaration.nil?
-      return @profile.declared_annual_deductions if declaration.draft?
+      # A rejected declaration lowers nothing: its self-declared total stays editable and unchecked.
+      return @profile.declared_annual_deductions if declaration.draft? || declaration.rejected?
 
       declaration.allowable_total
     end

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.20.0"
+  VERSION = "0.20.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.20.1
 platform: ruby
 authors:
 - kshitiz sinha