hr_lite 0.20.0 → 0.20.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 308cf87cc748758a71ff2bafc7cc301e7ff1fa3f0efc0e0b222e7e4e82e30161
-  data.tar.gz: 8541bec2dbd4b8c6c1b895065a9580f65de22ce01d128c86c4bc52455aa2bdc0
+  metadata.gz: 36aafaef8b40a06e92550352b9b1b316d793185ffa871c2a872430c44a88d23c
+  data.tar.gz: 957a8842a0ce1fa20e200c9cd0795a9c75eeff204be0d39aa9198781fcfc13ed
 SHA512:
-  metadata.gz: 7b6788e0da35e5695257ebf95e2a25b152a8c42d9659d449197995061b57220d34ae6503986f6aa80497cd55dc74e44d0ea2247126cf48924cead29d2c2f40f8
-  data.tar.gz: 06d8209caa183f2092611e9d7613b12a7d1cb45e3333a9ad0b0d1027e4f5ed48e6845e9b6766e6ed8f1352ca537c8921bf85e5e23af9b49876b75021273f645b
+  metadata.gz: e7eeeb898e3798322fdf75539115586a9513b8c048edd51b89af45bba9cc37d7577e4645cf1b3c6707158b1c51d49195d2d803dddcab5dae2990b6607a6a8772
+  data.tar.gz: 74eb90b519e1ca6f7ece2261bbf02f4e0cc094ebbd6faf054eb1945af71a4d4c950551ce7d10c353b14e652bbe2af3ce9978d7af4a729882f3e87214ba76549d

data/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.2] - 2026-10-05
+
+No migration.
+
+### Changed
+
+- **Leave team notice goes out on apply, by email too.** The whole team
+  (minus the applicant) gets the bell and an email the moment leave is
+  applied, not after approval. The reason is still left out. Hosts can
+  mute either channel with the `leave.team_notice` matrix row.
+- **A blocked location holds the punch.** Browsers ask for location once;
+  after a "Don't allow" every later punch was filed without GPS and
+  flagged. The punch now waits and tells the employee to allow location,
+  then tap again. Timeout and no-GPS devices still punch (and flag).
+- Team attendance board: "Fix / month" is now "Edit / half day", the
+  screen where HR changes a marked day to a half day.
+
+## [0.20.1] - 2026-10-03
+
+Security fixes. No migration.
+
+### Upgrading
+
+Document numbers are now encrypted with Active Record Encryption. Rows
+saved before this release are plain text, so the host needs
+`config.active_record.encryption.support_unencrypted_data = true` to keep
+reading them, and should re-save each `HrLite::Document` once to encrypt
+the old numbers.
+
+### Security
+
+- **Nobody decides their own request.** A manager could approve their own
+  leave, comp-off and attendance fixes, Finance its own expense claims, and
+  anyone recording leave for someone else could record their own as
+  approved. HR could verify or reject its own documents. All refused now.
+- **Nobody edits their own records from the admin screens.** HR rewriting
+  its own attendance, adjusting its own leave balance, or Finance verifying
+  its own tax declaration is refused.
+- **Document numbers are encrypted.** Aadhaar, PAN and passport numbers
+  were stored in plain text and copied into audit diffs and the leadership
+  audit email. Loans join the money tier for audit mail.
+- **A rejected tax declaration no longer lowers TDS.**
+- **Payroll CSVs defuse formulas.** Register and report cells that open
+  with `=`, `+`, `-` or `@` are escaped, since names are staff-typed.
+- **The payout register needs `payroll.export`**, not just
+  `payroll.manage`.
+- **The admin overview respects reach.** A team-scoped manager sees only
+  the people they reach, not the whole company.
+- **Expense receipts** take the same type and size rule as documents.
+
 ## [0.20.0] - 2026-10-01
 
 Salary as CTC, and who is out today. No migration.

data/app/assets/javascripts/hr_lite/geo_punch.js

@@ -6,7 +6,7 @@
 //     <button type="submit">…</button>
 //     <span data-hrl-geo-status hidden></span>
 //   </form>
-// The punch NEVER blocks on GPS: denied/timeout/unavailable submit anyway
+// A denied permission holds the punch; timeout/unavailable submit anyway
 // with geo_status set; the server flags them.
 (function () {
   "use strict";
@@ -45,7 +45,15 @@
           send("ok");
         },
         function (err) {
-          send(err && err.code === 1 ? "denied" : "timeout");
+          // Browsers ask only once; a past "Don't allow" denies silently forever.
+          // Hold the punch so it is never filed (and flagged) without GPS.
+          if (err && err.code === 1) {
+            locating = false;
+            if (button) { button.disabled = false; button.removeAttribute("aria-busy"); }
+            if (label) label.textContent = "Location is blocked. Allow location for this site in your browser settings, then tap again.";
+            return;
+          }
+          send("timeout");
         },
         { enableHighAccuracy: true, timeout: 10000, maximumAge: 60000 }
       );

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -82,7 +82,8 @@ module HrLite
       # authorities, so they resolve through different permissions — a role
       # can be given the board without being given the pencil.
       def find_visible_employee = employee_within("attendance.view")
-      def find_manageable_employee = employee_within("attendance.manage")
+      # Nobody rewrites their own punches: team and company scope include the holder.
+      def find_manageable_employee = employee_within("attendance.manage").tap { |e| raise ActiveRecord::RecordNotFound if e.id == hr_current_user.id }
 
       def employee_within(permission)
         employee = HrLite.user_klass.find(params[:user_id])

data/app/controllers/hr_lite/admin/comp_off_requests_controller.rb

@@ -40,8 +40,9 @@ module HrLite
       # A manager decides for their own reports; HR decides for everyone.
       # Scoped through the relation, so reaching for somebody else's report
       # is a 404 rather than a 403 that confirms the person exists.
+      # Nobody decides their own request: team scope includes the approver.
       def decidable
-        hr_scope(CompOffRequest.all, "leave.approve")
+        hr_scope(CompOffRequest.all, "leave.approve").where.not(user_id: hr_current_user.id)
       end
 
       def find_decidable = decidable.find(params[:id])

data/app/controllers/hr_lite/admin/documents_controller.rb

@@ -54,6 +54,8 @@ module HrLite
       # whoever happens to run HR.
       def find_manageable
         document = Document.find(params[:id])
+        # readable_by? always admits the owner, and nobody verifies their own paperwork.
+        raise ActiveRecord::RecordNotFound if document.user_id == hr_current_user.id
         raise ActiveRecord::RecordNotFound unless document.readable_by?(hr_current_user)
 
         document

data/app/controllers/hr_lite/admin/expenses_controller.rb

@@ -39,7 +39,8 @@ module HrLite
 
       def require_deciding! = hr_require_permission!("expense.approve", scope: :team)
 
-      def decidable = hr_scope(Expense.all, "expense.approve")
+      # Nobody approves their own claim: team scope includes the approver.
+      def decidable = hr_scope(Expense.all, "expense.approve").where.not(user_id: hr_current_user.id)
     end
   end
 end

data/app/controllers/hr_lite/admin/leave_balances_controller.rb

@@ -13,6 +13,7 @@ module HrLite
         # A manager reaches this screen through leave.approve; changing
         # somebody's quota is leave.manage, for THAT person.
         hr_require_reach!("leave.manage", user)
+        raise ActiveRecord::RecordNotFound if user.id == hr_current_user.id # never one's own quota
         type = LeaveType.find(params[:leave_type_id])
         # Unsanitised, a missing param wrote the adjustment into leave year 0,
         # where no screen can ever show it.

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -84,13 +84,14 @@ module HrLite
       # somebody else's report gets a 404 through the scoped relation rather
       # than a 403 — the same shape every employee-tier screen already uses,
       # and it does not confirm that the other person exists.
+      # Nobody decides their own request: team scope includes the approver.
       def decidable
-        hr_scope(LeaveRequest.all, "leave.approve")
+        hr_scope(LeaveRequest.all, "leave.approve").where.not(user_id: hr_current_user.id)
       end
 
       def find_decidable = decidable.find(params[:id])
 
-      def recordable = hr_scope(EmployeeProfile.includes(:user), "leave.approve")
+      def recordable = hr_scope(EmployeeProfile.includes(:user), "leave.approve").where.not(user_id: hr_current_user.id)
     end
   end
 end

data/app/controllers/hr_lite/admin/overview_controller.rb

@@ -4,7 +4,7 @@ module HrLite
       SECTION_CAP = 10
 
       def index
-        @query = OverviewQuery.new
+        @query = OverviewQuery.new(user_ids: hr_access.visible_user_ids("leave.view"))
         @kpis = @query.kpis
       end
     end

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -1,6 +1,8 @@
 module HrLite
   module Admin
     class PayrollRunsController < SuperadminController
+      # The register carries every bank account: its own key, not just payroll.manage.
+      before_action -> { hr_require_permission!("payroll.export", scope: :all) }, only: :register
       def index
         @runs = paginate(PayrollRun.recent_first)
       end
@@ -82,6 +84,8 @@ module HrLite
 
       def register_csv(run)
         require "csv"
+        # A cell opening with = + - @ runs as a formula; names are staff-typed.
+        safe = ->(v) { v.is_a?(String) && v.match?(/\A[=+\-@\t\r]/) ? "'#{v}" : v }
         CSV.generate do |csv|
           csv << [ "Code", "Name", "Days", "LOP", "Gross", "PF", "ESI", "PT", "TDS",
                    "Net pay", "Bank", "Account", "IFSC" ]
@@ -95,7 +99,7 @@ module HrLite
               deductions.dig("esi_employee", "amount") || 0, deductions.dig("pt", "amount") || 0,
               deductions.dig("tds", "amount") || 0, slip.net_pay,
               profile&.bank_name, profile&.bank_account_number, profile&.bank_ifsc
-            ]
+            ].map(&safe)
           end
         end
       end

data/app/controllers/hr_lite/admin/regularization_requests_controller.rb

@@ -40,8 +40,9 @@ module HrLite
       # A manager decides for their own reports; HR decides for everyone.
       # Scoped through the relation, so reaching for somebody else's report
       # is a 404 rather than a 403 that confirms the person exists.
+      # Nobody decides their own request: team scope includes the approver.
       def decidable
-        hr_scope(RegularizationRequest.all, "attendance.manage")
+        hr_scope(RegularizationRequest.all, "attendance.manage").where.not(user_id: hr_current_user.id)
       end
 
       def find_decidable = decidable.find(params[:id])

data/app/controllers/hr_lite/admin/reports_controller.rb

@@ -141,9 +141,11 @@ module HrLite
         require "csv"
         return "" if rows.empty?
 
+        # A cell opening with = + - @ runs as a formula; names are staff-typed.
+        safe = ->(v) { v.is_a?(String) && v.match?(/\A[=+\-@\t\r]/) ? "'#{v}" : v }
         CSV.generate do |csv|
           csv << rows.first.keys
-          rows.each { |row| csv << row.values }
+          rows.each { |row| csv << row.values.map(&safe) }
         end
       end
     end

data/app/controllers/hr_lite/admin/tax_declarations_controller.rb

@@ -62,6 +62,7 @@ module HrLite
       def find_manageable
         declaration = TaxDeclaration.find(params[:id])
         hr_require_reach!("tax.manage", declaration.user)
+        raise ActiveRecord::RecordNotFound if declaration.user_id == hr_current_user.id # never one's own
         declaration
       end
 

data/app/models/hr_lite/audit_log.rb

@@ -14,7 +14,7 @@ module HrLite
     # leadership audit screen or the policy.changed email.
     MONEY_TIER_TYPES = %w[
       HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
-      HrLite::PayrollRun HrLite::SalarySlip HrLite::PayrollLineItem
+      HrLite::PayrollRun HrLite::SalarySlip HrLite::PayrollLineItem HrLite::Loan
     ].freeze
 
     scope :recent, -> { order(created_at: :desc) }

data/app/models/hr_lite/document.rb

@@ -5,6 +5,9 @@ module HrLite
   class Document < ApplicationRecord
     include Audited
 
+    # An Aadhaar, PAN or passport number: encrypted, which also redacts it from audit diffs and their emails.
+    encrypts :reference_number
+
     VISIBILITIES = %w[self hr money].freeze
     VERIFICATIONS = %w[pending verified rejected].freeze
 

data/app/models/hr_lite/expense.rb

@@ -23,6 +23,7 @@ module HrLite
     validate :spent_on_is_not_in_the_future
     validate :within_the_category_cap, on: :create
     validate :receipt_is_present_when_the_category_demands_one
+    validate :receipt_is_a_small_pdf_or_image
 
     scope :awaiting_reimbursement, -> { where(status: "approved") }
     scope :recent_first, -> { order(spent_on: :desc, id: :desc) }
@@ -138,5 +139,12 @@ module HrLite
 
       errors.add(:receipt, "is required for #{category.name}")
     end
+
+    def receipt_is_a_small_pdf_or_image
+      return unless receipt.attached?
+      return errors.add(:receipt, "must be a PDF or an image") unless Document::ALLOWED_TYPES.include?(receipt.blob.content_type)
+
+      errors.add(:receipt, "must be under #{Document::MAX_BYTES / 1.megabyte} MB") if receipt.blob.byte_size > Document::MAX_BYTES
+    end
   end
 end

data/app/models/hr_lite/leave_request.rb

@@ -25,6 +25,7 @@ module HrLite
 
     before_validation :cache_days_count, on: :create
     after_create :notify_requested, unless: :recorded_by_hr?
+    after_create :notify_team
 
     scope :pending, -> { where(status: "pending") }
     scope :approved, -> { where(status: "approved") }
@@ -171,7 +172,6 @@ module HrLite
       return false if insufficient
 
       notify_decision("Leave approved")
-      notify_team
       true
     end
 
@@ -247,8 +247,8 @@ module HrLite
       )
     end
 
-    # Everyone should know a colleague will be away — bell + email to the
-    # whole team (matrix row "leave.team_notice"; hosts can mute either
+    # Everyone should know a colleague will be away, the moment they apply —
+    # bell + email to the whole team (matrix row "leave.team_notice"; hosts can mute either
     # channel). Deliberately excludes the reason: dates are team-relevant,
     # the why is not.
     def notify_team

data/app/services/hr_lite/overview_query.rb

@@ -3,36 +3,38 @@ module HrLite
   # one source, so they always agree. Sections return Relations (callers
   # paginate or cap as they see fit).
   class OverviewQuery
-    def initialize(date: Date.current)
+    # user_ids nil = everyone; a team-scoped viewer sees only the people they reach.
+    def initialize(date: Date.current, user_ids: nil)
       @date = date
+      @user_ids = user_ids
     end
 
     def pending_requests
-      LeaveRequest.pending.includes(:leave_type, :user).order(:created_at)
+      reach(LeaveRequest.pending.includes(:leave_type, :user).order(:created_at))
     end
 
     def on_leave_today
-      LeaveRequest.active_on(@date).includes(:leave_type, :user).order(:start_date)
+      reach(LeaveRequest.active_on(@date).includes(:leave_type, :user).order(:start_date))
     end
 
     # Comp-off and regularization are approvals too. Counting leave alone made
     # the board announce "All present and accounted for" while both queues
     # still had work in them.
     def pending_comp_offs
-      CompOffRequest.pending.includes(:user).recent_first
+      reach(CompOffRequest.pending.includes(:user).recent_first)
     end
 
     def pending_regularizations
-      RegularizationRequest.pending.includes(:user).recent_first
+      reach(RegularizationRequest.pending.includes(:user).recent_first)
     end
 
     def flagged_today
-      AttendanceRecord.for_date(@date).flagged.includes(:user)
+      reach(AttendanceRecord.for_date(@date).flagged.includes(:user))
     end
 
     # AttendanceCloseJob fills check_out_at, so the days it closed count too.
     def missing_checkout_yesterday
-      yesterday = AttendanceRecord.for_date(@date - 1)
+      yesterday = reach(AttendanceRecord.for_date(@date - 1))
       yesterday.missing_checkout.or(yesterday.where(regularization_note: AttendanceRecord::AUTO_CHECKOUT_NOTE))
                .includes(:user)
     end
@@ -49,5 +51,9 @@ module HrLite
     def empty?
       kpis.values.all?(&:zero?)
     end
+
+    private
+
+    def reach(relation) = @user_ids ? relation.where(user_id: @user_ids) : relation
   end
 end

data/app/services/hr_lite/slip_builder.rb

@@ -135,7 +135,8 @@ module HrLite
     def annual_deductions
       declaration = TaxDeclaration.for(@user, @run.period_month)
       return @profile.declared_annual_deductions if declaration.nil?
-      return @profile.declared_annual_deductions if declaration.draft?
+      # A rejected declaration lowers nothing: its self-declared total stays editable and unchecked.
+      return @profile.declared_annual_deductions if declaration.draft? || declaration.rejected?
 
       declaration.allowable_total
     end

data/app/views/hr_lite/admin/attendances/index.html.erb

@@ -43,7 +43,7 @@
             <% if record&.regularized? %><span class="hrl-badge">Fixed</span><% end %>
           </td>
           <td data-label="">
-            <a class="hrl-small" href="<%= hr_lite.admin_attendance_path(employee.id, date: @date, month: @date.strftime("%Y-%m")) %>">Fix / month</a>
+            <a class="hrl-small" href="<%= hr_lite.admin_attendance_path(employee.id, date: @date, month: @date.strftime("%Y-%m")) %>">Edit / half day</a>
           </td>
         </tr>
       <% end %>

data/lib/hr_lite/notifications.rb

@@ -51,7 +51,7 @@ module HrLite
       "resignation.withdrawn" => { bell: true,  email: false, leadership_email: true,  leadership_bell: false },
       "employee.onboarded"    => { bell: true,  email: true,  leadership_email: true,  leadership_bell: false },
       "payroll.draft_ready"   => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
-      "leave.team_notice"     => { bell: true,  email: false, leadership_email: false, leadership_bell: false },
+      "leave.team_notice"     => { bell: true,  email: true,   leadership_email: false, leadership_bell: false },
       "comp_off.requested"    => { bell: true,  email: false, leadership_email: true,  leadership_bell: true  },
       "comp_off.approved"     => { bell: true,  email: true,  leadership_email: true,  leadership_bell: false },
       "comp_off.rejected"     => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.20.0"
+  VERSION = "0.20.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.20.2
 platform: ruby
 authors:
 - kshitiz sinha