hr_lite 0.23.1 → 0.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f73917345c95226e4a223cbe4e3e13b4819e4ca6ea3831cbc4c129eff64bbe1
-  data.tar.gz: '03581e4aa969660467a7b7ecfd04938677398dbf57fe49b43beaee3b82c635e9'
+  metadata.gz: 54c475874de00a0db443998c37e4caeb3340e202584e094db29ef423c4902698
+  data.tar.gz: 849526338af6b16a5648a5163d140f0cda40b2fa3c34ef2a63a3d2f454761132
 SHA512:
-  metadata.gz: ce7315e67fa6cafd5beb9cba391e05545281e3d4af17bf1ef27576cbccef1195e0b6788f80cc9c702de68bbed0e1e9a1d754bb175f1557d8023932c22073cb66
-  data.tar.gz: 73934a9be7d733498691e8f35cf6705501992a28163040133165e599287793e0810ca194f6b0e744ab23f6dee9c4742f3a957e1a30efb4672dc3a9451e5828e8
+  metadata.gz: 38bf1cd87f1e283d7e8a54e60a18a19020fae7ff52feca24941f94dc40673c29d3a08a99d8c82699353f9958a99ffaf39ab8ae0a6c2e5e237ee1d96a567ae0c7
+  data.tar.gz: 390843351f21b51a9f2f17f1159214035349ecf8a689722d8dd429b803775715b322d6914fc251bb1808ad03c09c569f55beb0c85b634de8fefa41069b6317f1

data/CHANGELOG.md

@@ -7,6 +7,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.26.0] - 2026-10-10
+
+Two migrations: `hr_lite_ca_reviews`, and a data migration creating the CA role and giving Super Admin the new `payroll.verify` permission. Schedule `CaReviewReminderJob` weekly and `CaReviewOverdueJob` on 31 March.
+
+### Added
+- CA year-end review: a new **CA** role for an outside chartered accountant (reads every slip, salary structure and tax declaration with its proofs; verifies; nothing else). CA logins without an HR profile are not staff — `HrLite.employees` leaves them out, so attendance, payroll, team screens and broadcasts never count them.
+- "CA review" (`/admin/ca_reviews`): progress for the financial year (slips and declarations verified, flags open), tabs for salary slips and tax declarations, filters (to review, flagged, verified, resolved), Verify, Flag with a required note, and "Verify all shown". A flag tells approvers and payroll (`ca.flagged`); they fix it the normal way and Mark resolved with a note. A published slip is never edited. `HrLite::CaReview`.
+- `CaReviewReminderJob` (weekly, acts only in March) and `CaReviewOverdueJob` (31 March): what is left, to the CA reviewers and then to payroll and HR.
+- A CA (`payroll.view`, all) can open any slip read-only.
+
+## [0.25.0] - 2026-10-10
+
+Three migrations: `senior` and `landlord_pan` (encrypted) on declaration lines; a data migration adding the FY 2026-27 and October 2026 rate cards to installs that already have cards; a data migration giving HR `tax.view` and `tax.manage` (all).
+
+### Added
+- Statutory cards ship for FY 2026-27 (Finance Act 2026 left slabs, standard deduction and the §87A rebate unchanged; the Income-tax Act 2025 is in force) and from 1 October 2026, when the EPF/EPS/EDLI wage ceiling rose to ₹25,000 (Notification S.O. 5109(E), 17 Sep 2026; applied from October payroll, so September stays on ₹15,000). Both are seeded already verified, with the source in the card's notes. Cards may now take effect on the 1st of any month for a change notified mid-year. `StatutoryRateCard::SOURCES`.
+- `HrLite::TaxComputation`: a person's income tax worked out now — the structure in force, the slips already paid and the declaration — for both regimes, using payroll's own TDS calculator. Each step is shown: salary paid and expected, HRA exemption, standard deduction, every deduction with what was claimed, what counts and the limit, taxable income, each slab, tax with rebate and cess, TDS deducted and each remaining month. `Calculators::Tds.slab_rows`.
+- The legal limits apply by themselves (old regime): Sec 123 / 80C ₹1,50,000, Sec 124 / 80CCD(1B) ₹50,000, home-loan interest ₹2,00,000, Sec 126 / 80D ₹25,000 or ₹50,000 for a senior — now with a separate line for parents. HRA is the least of the HRA received, rent less 10% of Basic and 50% (metro) / 40% of Basic. A landlord's PAN is required above ₹1,00,000 of rent. Payroll's TDS uses the same capped figures.
+- Proof on every declaration line: PDF, JPG or PNG up to 5 MB each. HR opens each file through an audited download (`tax_proof.downloaded`) and can "Accept all and verify" in one click.
+- The employee's Tax page leads with this year's tax, TDS a month, deducted and still to deduct, the two regimes side by side with the cheaper one named, and the full working. It re-works the tax as you type (`POST /tax_declaration/preview`, `hr_lite/tax_preview.js`), nothing saved; each line's limit bar follows the amount.
+- HR and admin: the full working on every declaration, both regimes; "Everyone's tax" (`/admin/tax_declarations/overview`) lists each person's regime, tax, TDS so far and a month, the cheaper regime, and declaration status; each name opens that person's working whether or not they filed. HR gets a "Tax checks" link under Manage.
+
+### Changed
+- Section labels name the Income-tax Act 2025 section beside the old one ("Sec 123 (old 80C) — …").
+- A claim above its legal limit no longer lowers TDS beyond the limit.
+
+## [0.24.0] - 2026-10-10
+
+Three migrations: `annual_ctc` (encrypted) and `metro` on salary structures; `first_approved_by_id`, `first_approved_at` and `auto_approved_at` on payroll runs; and a data migration granting the new `payroll.approve` permission to HR and Super Admin, plus `payroll.view`, `salary.view`, `salary.manage` and `profile.manage` to HR. Schedule `HrLite::PayrollAutoApproveJob` on the 3rd.
+
+### Added
+- Salary structures take the Annual CTC only. Saving splits it — Basic 50% of CTC (the labour codes' wage floor), HRA 50% of Basic for a metro (new "Works in a metro" box) and 40% elsewhere, employer PF, ESI and gratuity (4.81% of Basic) inside the CTC, special allowance the rest — and stores the CTC, encrypted. The form shows the monthly split read-only; Basic, HRA, special and other are no longer typed. Existing structures keep their numbers until next saved, and their CTC is unchanged (gratuity is counted only on a CTC-split structure). `SalaryStructure::GRATUITY_RATE`, `#gratuity`.
+- Payroll needs two approvals: anyone with `payroll.approve` approves a reviewed run (Approve), and a second, different person — one of the two able to run payroll — approves it again, which finalizes and publishes it. Recomputing clears the first approval. The run page says who approved and what is left. Approvers without `payroll.manage` (HR) get a "Payroll approval" link under Manage, read every run and approve, but cannot compute, unlock or delete.
+- `HrLite::PayrollAutoApproveJob`: on the 3rd, a run still in review is approved and published by the system (`auto_approved_at`, audit `payroll.auto_approved`), unless it has blocking warnings — no salary structure for someone, a state with no PT slabs, or a statutory rate card that is last year's or not yet verified — when approvers hear `payroll.overdue` instead.
+- Payroll warns when leave or attendance fixes for the month are still pending: they are paid as loss of pay until approved.
+
+### Changed
+- HR (role defaults and, on existing installs, the data migration) can now set salary structures, read and approve payroll, and edit employee profiles — which includes the screens gated on `profile.manage`: employees, resignations, awards, leave types, holidays, offices, company settings and the audit trail. Roles stay `role.manage`.
+- Salary structures are gated on `salary.manage` (was `payroll.manage`), and the employee page shows them to `salary.view`.
+- The single-person Finalize button and route are gone: a run is finalized by its second approval. Publish stays for a run unlocked and re-approved.
+- `PayrollAutoDraftJob` notifies `payroll.approve` holders as well as `payroll.manage`.
+
+## [0.23.2] - 2026-10-10
+
+No migrations.
+
+### Added
+- Timeline "Private records" card: a Leave balance line per leave type for the current leave year ("Casual leave · 7 of 10 left"), and pending or rejected leave requests ("Casual leave — pending"), for the employee and anyone `leave.view` reaches (their manager, HR). `leave_requests/_balance_chips` takes optional `user:` and `bare:` locals.
+
 ## [0.23.1] - 2026-10-10
 
 No migrations.

data/README.md

@@ -381,7 +381,10 @@ whatever you run). Each is idempotent and sends nothing on a quiet day.
 | Job | Schedule | Purpose |
 |---|---|---|
 | `HrLite::DailyDigestJob` | each morning | Leadership digest: who is out today, pending approvals, flagged punches, missing checkouts |
-| `HrLite::PayrollAutoDraftJob` | monthly, on the 1st | Draft and compute the previous month's payroll from attendance, then notify leadership for review (publishing stays a human action) |
+| `HrLite::PayrollAutoDraftJob` | monthly, on the 1st | Draft and compute the previous month's payroll from attendance, then notify the approvers (`payroll.approve`) and payroll operators |
+| `HrLite::CaReviewReminderJob` | weekly (it acts only in March) | Tell CA reviewers how many slips and declarations are still unverified before 31 March |
+| `HrLite::CaReviewOverdueJob` | 31 March, evening | Tell payroll and HR what the CA has not verified, and any flags left open |
+| `HrLite::PayrollAutoApproveJob` | monthly, on the 3rd | Approve and publish last month's run if nobody finished approving it — unless it has blocking warnings (no salary structure, no PT slabs, a stale or unverified statutory card), when the approvers are told it is overdue instead |
 | `HrLite::LeaveYearRolloverJob` | leave year's first day (Jan 1, or Jul 1 for a July–June year) | Materialize carry-forward into the new year's balances |
 | `HrLite::AttendanceCloseJob` | each night, `55 23 * * * Asia/Kolkata` | Close the day: an open punch is checked out at 23:59 and marked half day; a run before noon (a retry, or a morning schedule that lets night shifts check out first) closes the previous day instead; nobody checked in stays absent. Each is emailed how to fix it. Skips weekends, holidays and approved leave. Run it once a day — a re-run tells the no-shows again. |
 

data/app/assets/javascripts/hr_lite/tax_preview.js

@@ -0,0 +1,38 @@
+// Live tax: a form with data-hrl-tax-preview="<url>" posts what is on screen
+// (files left out) as it is typed, and the server's worked-out tax replaces
+// #hrl-tax-preview. Nothing is saved; the Save button still does that.
+(function () {
+  "use strict";
+  var form = document.querySelector("form[data-hrl-tax-preview]");
+  var panel = document.getElementById("hrl-tax-preview");
+  if (!form || !panel) return;
+
+  var timer;
+  function refresh() {
+    var data = new FormData(form);
+    Array.from(data.keys()).forEach(function (key) { if (/\[proofs\]/.test(key)) data.delete(key); });
+    data.delete("_method");
+    fetch(form.dataset.hrlTaxPreview, { method: "POST", body: data, credentials: "same-origin", headers: { "Accept": "text/html" } })
+      .then(function (response) { return response.ok ? response.text() : null; })
+      .then(function (html) { if (html) panel.innerHTML = html; });
+  }
+  var rupees = new Intl.NumberFormat("en-IN", { style: "currency", currency: "INR", maximumFractionDigits: 0 });
+  // The limit bar and "₹X of the ₹Y limit counts" follow the amount as typed.
+  function updateCap(input) {
+    var field = input.closest(".hrl-field");
+    var hint = field && field.querySelector("[data-hrl-cap]");
+    if (!hint) return;
+    var cap = Number(hint.dataset.hrlCap);
+    var counts = Math.min(Math.max(Number(input.value.replace(/[^0-9.]/g, "")) || 0, 0), cap);
+    field.querySelector("progress").value = counts;
+    hint.textContent = rupees.format(counts) + " of the " + rupees.format(cap) + " limit counts";
+  }
+  function schedule(event) {
+    if (event.target.type === "file") return;
+    if (/declared_amount/.test(event.target.name)) updateCap(event.target);
+    clearTimeout(timer);
+    timer = setTimeout(refresh, 400);
+  }
+  form.addEventListener("input", schedule);
+  form.addEventListener("change", schedule);
+})();

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -318,7 +318,8 @@ summary.hrl-btn::-webkit-details-marker { display: none; } /* Safari before 18.4
 
 /* Forms */
 .hrl-field { margin-bottom: .8rem; }
-.hrl-field label { display: block; font-size: var(--hrl-t-small); font-weight: 600; margin-bottom: .3rem; }
+.hrl-field label, .hrl-field legend { display: block; font-size: var(--hrl-t-small); font-weight: 600; margin-bottom: .3rem; }
+fieldset { border: 0; margin: 0; padding: 0; min-width: 0; }
 .hrl-hint { color: var(--hrl-muted); font-size: var(--hrl-t-small); margin-top: .25rem; }
 /* Full-width text-ish controls only — checkboxes/radios/hidden must keep
    their natural size (a bare [type] selector out-ranked .hrl-field--check
@@ -390,6 +391,16 @@ summary.hrl-btn::-webkit-details-marker { display: none; } /* Safari before 18.4
 .hrl-card--private .hrl-timeline__item::before { background: var(--hrl-bg); border: 2px solid var(--hrl-field); }
 .hrl-card--private .hrl-badge--muted { background: var(--hrl-card); }
 
+/* Tax: the two regimes side by side, then the working as a plain table. */
+.hrl-tax-compare { display: grid; grid-template-columns: 1fr 1fr; gap: var(--hrl-s-3); margin: var(--hrl-s-4) 0 var(--hrl-s-2); }
+.hrl-tax-compare__col { border: 1px solid var(--hrl-line); border-radius: var(--hrl-radius-sm); padding: var(--hrl-s-3); min-width: 0; }
+.hrl-tax-compare__col--chosen { border: 2px solid var(--hrl-accent); }
+.hrl-tax-compare__amount { font-size: var(--hrl-t-title); font-weight: 700; margin-top: var(--hrl-s-1); overflow-wrap: anywhere; }
+.hrl-tax-working { margin-top: var(--hrl-s-3); }
+.hrl-tax-working__table td { vertical-align: top; overflow-wrap: anywhere; }
+.hrl-tax-working__total td { font-weight: 700; border-top: 1px solid var(--hrl-line); }
+.hrl-tax-cap { display: block; width: 100%; height: 8px; margin-top: var(--hrl-s-1); accent-color: var(--hrl-accent); }
+
 /* Mention autocomplete menu */
 .hrl-mention-wrap { position: relative; }
 .hrl-mention-menu {

data/app/controllers/hr_lite/admin/ca_reviews_controller.rb

@@ -0,0 +1,76 @@
+module HrLite
+  module Admin
+    # The CA's year-end pass over every slip and declaration. Reviewers
+    # (payroll.verify) verify or flag; approvers and payroll resolve flags.
+    class CaReviewsController < BaseController
+      skip_before_action :require_operations_access!
+      before_action -> { require_any!("payroll.verify", "payroll.approve", "payroll.manage") }, only: :index
+      before_action -> { require_any!("payroll.verify") }, only: %i[verify flag verify_all]
+      before_action -> { require_any!("payroll.approve", "payroll.manage") }, only: :resolve
+
+      def index
+        @fy = FinancialYear.start_for(params[:fy].present? ? parse_date_param(params[:fy]) : Date.current)
+        @tab = params[:tab] == "declarations" ? "declarations" : "slips"
+        @status = params[:status].presence_in(%w[unreviewed verified flagged resolved])
+        scope = @tab == "slips" ? CaReview.slips_for(@fy).includes(:user, :payroll_run).order("hr_lite_payroll_runs.period_month", :user_id) : CaReview.declarations_for(@fy).includes(:user).order(:user_id)
+        type = scope.klass.name
+        reviewed = CaReview.where(subject_type: type)
+        scope = if @status == "unreviewed"
+          scope.where.not(id: reviewed.select(:subject_id))
+        elsif @status
+          scope.where(id: reviewed.where(status: @status).select(:subject_id))
+        else
+          scope
+        end
+        @rows = paginate(scope)
+        @reviews = reviewed.where(subject_id: @rows.map(&:id)).index_by(&:subject_id)
+        @left = CaReview.outstanding(@fy)
+        @totals = { "slips" => CaReview.slips_for(@fy).count, "declarations" => CaReview.declarations_for(@fy).count }
+      end
+
+      def verify
+        CaReview.verify!(subject, actor: hr_current_user)
+        redirect_back_to_list notice: "Verified."
+      end
+
+      def flag
+        return redirect_back_to_list(alert: "Say what is wrong — HR has to know what to fix.") if params[:note].blank?
+
+        CaReview.flag!(subject, actor: hr_current_user, note: params[:note])
+        redirect_back_to_list notice: "Flagged — HR and payroll have been told."
+      end
+
+      # "Verify all shown": the unreviewed rows on the page the CA was looking at.
+      def verify_all
+        model = params[:subject_type] == "HrLite::TaxDeclaration" ? TaxDeclaration : SalarySlip
+        reviewed = CaReview.where(subject_type: model.name, subject_id: params[:ids]).pluck(:subject_id)
+        model.where(id: Array(params[:ids]) - reviewed.map(&:to_s)).find_each { |s| CaReview.verify!(s, actor: hr_current_user) }
+        redirect_back_to_list notice: "Verified everything shown."
+      end
+
+      def resolve
+        CaReview.find(params[:id]).resolve!(actor: hr_current_user, note: params[:note])
+        redirect_back_to_list notice: "Marked resolved."
+      rescue ActiveRecord::RecordInvalid
+        redirect_back_to_list alert: "Only a flagged item can be resolved."
+      end
+
+      private
+
+      def require_any!(*keys)
+        return if keys.any? { |key| hr_can?(key, scope: :all) }
+
+        hr_require_permission!(keys.first, scope: :all)
+      end
+
+      def subject
+        model = params[:subject_type] == "HrLite::TaxDeclaration" ? TaxDeclaration : SalarySlip
+        model.find(params[:subject_id])
+      end
+
+      def redirect_back_to_list(**flash)
+        redirect_to admin_ca_reviews_path(params.permit(:fy, :tab, :status, :page).to_h), **flash
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -1,6 +1,9 @@
 module HrLite
   module Admin
     class PayrollRunsController < SuperadminController
+      # Approvers (HR) read runs and approve them without running payroll.
+      skip_before_action :require_money_access!, only: %i[index show approve]
+      before_action :require_approver_or_money!, only: %i[index show approve]
       # The register carries every bank account: its own key, not just payroll.manage.
       before_action -> { hr_require_permission!("payroll.export", scope: :all) }, only: :register
       def index
@@ -41,8 +44,8 @@ module HrLite
         transition { |run| run.compute!(actor: hr_current_user) && "Computed — review the slips." }
       end
 
-      def finalize
-        transition { |run| run.finalize!(actor: hr_current_user) && "Run finalized." }
+      def approve
+        transition { |run| run.approve!(actor: hr_current_user) && (run.published? ? "Second approval — run finalized and published." : "Approved — one more approver publishes it.") }
       end
 
       def unlock
@@ -74,12 +77,19 @@ module HrLite
 
       private
 
+      def require_approver_or_money!
+        return if hr_can?("payroll.manage", scope: :all)
+
+        hr_require_permission!("payroll.approve", scope: :all)
+      end
+
       def transition
         run = PayrollRun.find(params[:id])
         notice = yield(run)
         redirect_to admin_payroll_run_path(run), notice: notice
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_payroll_run_path(run), alert: "That step is not available from #{run.status}."
+      rescue ActiveRecord::RecordInvalid => e
+        alert = e.message.match?(/approver/) ? e.message.sub(/\AValidation failed: /, "").capitalize + "." : "That step is not available from #{run.status}."
+        redirect_to admin_payroll_run_path(run), alert: alert
       end
 
       def register_csv(run)

data/app/controllers/hr_lite/admin/salary_slips_controller.rb

@@ -1,6 +1,10 @@
 module HrLite
   module Admin
     class SalarySlipsController < SuperadminController
+      # A CA reads a slip to verify it (payroll.view, all) without running payroll.
+      skip_before_action :require_money_access!, only: :show
+      before_action -> { hr_require_permission!("payroll.view", scope: :all) }, only: :show
+
       def show
         @slip = SalarySlip.includes(:payroll_run).find(params[:id])
         @profile = @slip.user_profile

data/app/controllers/hr_lite/admin/salary_structures_controller.rb

@@ -1,6 +1,9 @@
 module HrLite
   module Admin
+    # salary.manage, not payroll.manage: HR sets structures without running payroll.
     class SalaryStructuresController < SuperadminController
+      skip_before_action :require_money_access!
+      before_action -> { hr_require_permission!("salary.manage", scope: :all) }
       before_action :set_profile
 
       def new
@@ -12,9 +15,7 @@ module HrLite
         @structure = SalaryStructure.new(structure_params.merge(
           user_id: @profile.user_id, created_by_id: hr_current_user.id
         ))
-        return fill_from_ctc(:new) if params[:fill_from_ctc]
-
-        if @structure.save
+        if @structure.save(context: :ctc_form)
           redirect_to admin_employee_path(@profile), notice: "Salary structure saved."
         else
           render :new, status: :unprocessable_entity
@@ -28,9 +29,7 @@ module HrLite
       def update
         @structure = SalaryStructure.where(user_id: @profile.user_id).find(params[:id])
         @structure.assign_attributes(structure_params)
-        return fill_from_ctc(:edit) if params[:fill_from_ctc]
-
-        if @structure.save
+        if @structure.save(context: :ctc_form)
           redirect_to admin_employee_path(@profile), notice: "Salary structure updated."
         else
           render :edit, status: :unprocessable_entity
@@ -39,22 +38,13 @@ module HrLite
 
       private
 
-      # Shows the split for a check; only the Save button writes it.
-      def fill_from_ctc(view)
-        @structure.fill_from_ctc
-        return render(view, status: :unprocessable_entity) unless @structure.valid?
-
-        flash.now[:notice] = "Filled from CTC — check the lines, then Save."
-        render view
-      end
-
       def set_profile
         @profile = EmployeeProfile.find(params[:employee_id])
       end
 
       def structure_params
         params.require(:salary_structure).permit(
-          :annual_ctc, :effective_from, :basic, :hra, :special_allowance, :other_earnings,
+          :annual_ctc, :effective_from, :metro,
           :pf_applicable, :pf_on_full_basic, :esi_applicable, :pt_state, :notes
         )
       end

data/app/controllers/hr_lite/admin/tax_declarations_controller.rb

@@ -17,6 +17,51 @@ module HrLite
 
       def show
         @declaration = find_visible
+        @tax = TaxComputation.new(user: @declaration.user, declaration: @declaration)
+      end
+
+      # Everyone's tax this year, worked out now, whether or not they declared.
+      def overview
+        visible = hr_access.visible_user_ids("tax.view")
+        profiles = EmployeeProfile.active_for(Date.current).includes(:user).order(:employee_code)
+        profiles = profiles.where(user_id: visible) if visible
+        @profiles = paginate(profiles)
+        @declarations = TaxDeclaration.where(user_id: @profiles.map(&:user_id),
+                                             financial_year: FinancialYear.start_for(Date.current)).index_by(&:user_id)
+      end
+
+      # Anyone's full working, filed or not.
+      def person
+        @person = HrLite.user_klass.find(params[:user_id])
+        hr_require_reach!("tax.view", @person)
+        @tax = TaxComputation.new(user: @person)
+      end
+
+      # The proof, through a permission check and an audit row — never a bare blob link.
+      def proof
+        declaration = find_visible
+        file = declaration.tax_declaration_items.flat_map { |item| item.proofs.to_a }.find { |p| p.id == params[:proof_id].to_i }
+        raise ActiveRecord::RecordNotFound unless file
+
+        AuditLog.record!(action: "tax_proof.downloaded", subject: declaration, actor: hr_current_user,
+                         changes: { "file" => file.filename.to_s, "owner" => HrLite.display_name(declaration.user) })
+        redirect_to Rails.application.routes.url_helpers.rails_blob_path(file, disposition: "attachment", only_path: true),
+                    allow_other_host: false
+      end
+
+      # One click when the proof matches the claim: every unchecked line is
+      # accepted at what was claimed (the legal limit still applies), then verified.
+      def accept_all
+        declaration = find_manageable
+        TaxDeclaration.transaction do
+          declaration.tax_declaration_items.each do |item|
+            item.update!(verified_amount: item.declared_amount) if item.verified_amount.nil?
+          end
+          declaration.verify!(actor: hr_current_user, note: "Proof accepted")
+        end
+        redirect_to admin_tax_declarations_path, notice: "Accepted and verified — payroll uses these amounts now."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_tax_declaration_path(declaration), alert: "Only a submitted declaration can be accepted."
       end
 
       def update
@@ -26,6 +71,7 @@ module HrLite
         if @declaration.update(verification_params)
           redirect_to admin_tax_declaration_path(@declaration), notice: "Amounts recorded."
         else
+          @tax = TaxComputation.new(user: @declaration.user, declaration: @declaration)
           render :show, status: :unprocessable_entity
         end
       end

data/app/controllers/hr_lite/tax_declarations_controller.rb

@@ -8,6 +8,16 @@ module HrLite
       # A saved draft holds only its claims; the rest still need a line to fill.
       fill_missing_sections(@declaration)
       @regime = @declaration.regime
+      @tax = TaxComputation.new(user: hr_current_user, declaration: @declaration)
+    end
+
+    # The form posts here as it is typed in: the tax worked out on what is on
+    # screen, nothing saved.
+    def preview
+      declaration = current_declaration || TaxDeclaration.new(user_id: hr_current_user.id, financial_year: financial_year)
+      declaration.regime = declaration_params[:regime] if declaration_params[:regime]
+      declaration.tax_declaration_items_attributes = preview_items
+      render partial: "hr_lite/tax/computation", locals: { tax: TaxComputation.new(user: hr_current_user, declaration: declaration), both: false }
     end
 
     def update
@@ -32,6 +42,7 @@ module HrLite
         # Re-render needs the full set of lines back, or the form loses the
         # sections the person had not filled in yet.
         fill_missing_sections(@declaration)
+        @tax = TaxComputation.new(user: hr_current_user, declaration: @declaration)
         render :show, status: :unprocessable_entity
       end
     end
@@ -75,6 +86,13 @@ module HrLite
       end
     end
 
+    # Lines for a preview: amounts only, never files (a blanked line is marked
+    # for removal, which the computation skips). Already filtered by the
+    # permit in declaration_params, so plain hashes are safe here.
+    def preview_items
+      (declaration_params[:tax_declaration_items_attributes] || {}).to_unsafe_h.transform_values { |row| row.except("proofs") }
+    end
+
     def employee_regime
       EmployeeProfile.find_by(user_id: hr_current_user.id)&.tax_regime.presence || "new"
     end
@@ -87,7 +105,7 @@ module HrLite
     def declaration_params
       permitted = params.require(:tax_declaration).permit(
         :regime,
-        tax_declaration_items_attributes: %i[id section label declared_amount _destroy]
+        tax_declaration_items_attributes: [ :id, :section, :label, :declared_amount, :senior, :landlord_pan, :_destroy, { proofs: [] } ]
       )
       items = permitted[:tax_declaration_items_attributes]
       return permitted if items.blank?

data/app/controllers/hr_lite/timelines_controller.rb

@@ -13,7 +13,8 @@ module HrLite
       @public_events = timeline.public_events
       @private_events = timeline.private_events
       # Shown only to someone who may see private rows at all: the person, or a reach-holder.
-      @private_card = @person.id == hr_current_user.id || @private_events.any?
+      @show_balance = HrLite.reaches?(hr_current_user, "leave.view", @person)
+      @private_card = @person.id == hr_current_user.id || @show_balance || @private_events.any?
     end
   end
 end

data/app/helpers/hr_lite/application_helper.rb

@@ -18,6 +18,8 @@ module HrLite
       { label: "ID card",    path: :id_card_path,        match: [ "/id_card" ], group: "Me" },
       { label: "Career",     path: :career_path,         match: [ "/career", "/appraisals" ], group: "Me" },
       { label: "Timeline",   path: :timeline_path,       match: [ "/timeline" ], group: "Me" },
+      { label: "CA review",  path: :admin_ca_reviews_path, match: [ "/admin/ca_reviews" ], group: "Company",
+        if: -> { hr_can?("payroll.verify", scope: :all) || hr_can?("payroll.approve", scope: :all) } },
       { label: "Policies",   path: :policies_path,       match: [ "/policies" ], group: "Company" },
       { label: "Ask HR",     path: :hr_requests_path,    match: [ "/hr_requests" ], group: "Company" },
       { label: "Org",        path: :org_path,            match: [ "/org" ], group: "Company" },
@@ -38,6 +40,11 @@ module HrLite
       { label: "Help desk",       path: :admin_hr_requests_path,     match: [ "/admin/hr_requests" ] },
       { label: "Assets",          path: :admin_assets_path,          match: [ "/admin/assets" ] },
       { label: "Benefits",        path: :admin_benefits_path,        match: [ "/admin/benefits" ] },
+      # HR approves payroll without running it; Super Admin reaches it under Organisation.
+      { label: "Payroll approval", path: :admin_payroll_runs_path, match: [ "/admin/payroll_runs" ],
+        if: -> { hr_can?("payroll.approve", scope: :all) && !hr_superadmin? } },
+      { label: "Tax checks", path: :admin_tax_declarations_path, match: [ "/admin/tax_declarations" ],
+        if: -> { hr_can?("tax.view", scope: :all) && !hr_superadmin? } },
       { label: "Joining & exits", path: :admin_checklists_path,      match: [ "/admin/checklists" ] }
     ].freeze
 

data/app/jobs/hr_lite/ca_review_overdue_job.rb

@@ -0,0 +1,19 @@
+module HrLite
+  # Schedule on 31 March evening: anything the CA has not verified, or a flag
+  # nobody resolved, goes to payroll and HR as overdue.
+  class CaReviewOverdueJob < ApplicationJob
+    queue_as :default
+
+    def perform(on: Date.current)
+      left = CaReview.outstanding(FinancialYear.start_for(on))
+      return if left.values.sum.zero?
+
+      people = HrLite.users_holding("payroll.approve", scope: :all).to_a | HrLite.users_holding("payroll.manage", scope: :all).to_a
+      Notifications.publish(
+        "ca.overdue",
+        title: "CA review overdue: #{left['slips']} slips, #{left['declarations']} declarations unverified, #{left['flagged']} flags open",
+        path: "/admin/ca_reviews?status=unreviewed", bell_to: people, email_to: people
+      )
+    end
+  end
+end

data/app/jobs/hr_lite/ca_review_reminder_job.rb

@@ -0,0 +1,21 @@
+module HrLite
+  # Schedule weekly in March: tells the CA reviewers what is left before 31 March.
+  class CaReviewReminderJob < ApplicationJob
+    queue_as :default
+
+    def perform(on: Date.current)
+      return unless on.month == 3
+
+      left = CaReview.outstanding(FinancialYear.start_for(on))
+      return if left.values.sum.zero?
+
+      reviewers = HrLite.users_holding("payroll.verify", scope: :all).to_a
+      Notifications.publish(
+        "ca.reminder",
+        title: "CA review: #{left['slips']} slips and #{left['declarations']} declarations left before 31 March" \
+               "#{", #{left['flagged']} flagged" if left['flagged'].positive?}",
+        path: "/admin/ca_reviews", bell_to: reviewers, email_to: reviewers
+      )
+    end
+  end
+end

data/app/jobs/hr_lite/payroll_auto_approve_job.rb

@@ -0,0 +1,21 @@
+module HrLite
+  # The 3rd-of-month backstop (schedule it on the 3rd): last month's run that
+  # is still in review is approved and published by the system, unless it has
+  # blocking warnings — then the approvers are told it is overdue instead.
+  class PayrollAutoApproveJob < ApplicationJob
+    queue_as :default
+
+    def perform(month: Date.current.prev_month.beginning_of_month)
+      run = PayrollRun.find_by(period_month: month, status: "review")
+      return unless run
+      return if run.auto_approve!
+
+      people = HrLite.users_holding("payroll.approve", scope: :all).to_a
+      Notifications.publish(
+        "payroll.overdue",
+        title: "Payroll #{run.label} is overdue — not auto-approved: #{run.blocking_warnings.join('; ')}",
+        path: "/admin/payroll_runs/#{run.id}", bell_to: people, email_to: people
+      )
+    end
+  end
+end

data/app/jobs/hr_lite/payroll_auto_draft_job.rb

@@ -16,7 +16,7 @@ module HrLite
       return unless run.draft? && run.salary_slips.none?
 
       run.compute!(actor: nil)
-      payroll = HrLite.users_holding("payroll.manage", scope: :all).to_a
+      payroll = HrLite.users_holding("payroll.approve", scope: :all).to_a | HrLite.users_holding("payroll.manage", scope: :all).to_a
       Notifications.publish(
         "payroll.draft_ready",
         title: "Payroll #{run.label} computed from attendance — #{run.salary_slips.count} slips await review",

data/app/models/hr_lite/audit_log.rb

@@ -15,7 +15,7 @@ module HrLite
     MONEY_TIER_TYPES = %w[
       HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
       HrLite::PayrollRun HrLite::SalarySlip HrLite::PayrollLineItem HrLite::Loan
-      HrLite::PerformancePlan
+      HrLite::PerformancePlan HrLite::CaReview
     ].freeze
 
     scope :recent, -> { order(created_at: :desc) }

data/app/models/hr_lite/ca_review.rb

@@ -0,0 +1,66 @@
+module HrLite
+  # A chartered accountant's year-end mark on one salary slip or tax
+  # declaration. Verifying is final; a flag says what is wrong and stays open
+  # until HR or payroll fixes it the normal way (a correcting line on a later
+  # slip, or reopening the declaration) and resolves it. The slip itself is
+  # never edited.
+  class CaReview < ApplicationRecord
+    include Audited
+
+    SUBJECTS = %w[HrLite::SalarySlip HrLite::TaxDeclaration].freeze
+    STATUSES = %w[verified flagged resolved].freeze
+
+    belongs_to :subject, polymorphic: true
+    belongs_to :reviewed_by, class_name: HrLite.config.user_class
+    belongs_to :resolved_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :subject_type, inclusion: { in: SUBJECTS }
+    validates :status, inclusion: { in: STATUSES }
+    validates :note, presence: true, if: -> { status == "flagged" }
+
+    # What the CA reviews for a financial year: every published slip, and
+    # every declaration somebody actually filed.
+    def self.slips_for(fy)
+      SalarySlip.joins(:payroll_run).where(hr_lite_payroll_runs: { status: "published", period_month: fy...fy.next_year })
+    end
+
+    def self.declarations_for(fy) = TaxDeclaration.where(financial_year: fy).where.not(status: "draft")
+
+    # Still to do before 31 March: never reviewed, or flagged and not resolved.
+    def self.outstanding(fy)
+      { "slips" => slips_for(fy), "declarations" => declarations_for(fy) }.transform_values do |scope|
+        done = where(subject: scope, status: %w[verified resolved]).count
+        scope.count - done
+      end.merge("flagged" => where(subject_type: SUBJECTS, status: "flagged").count)
+    end
+
+    def self.verify!(subject, actor:)
+      review = find_or_initialize_by(subject: subject)
+      review.update!(status: "verified", note: nil, reviewed_by_id: actor.id, reviewed_at: Time.current)
+      review
+    end
+
+    def self.flag!(subject, actor:, note:)
+      review = find_or_initialize_by(subject: subject)
+      review.update!(status: "flagged", note: note.to_s.strip, reviewed_by_id: actor.id, reviewed_at: Time.current,
+                     resolved_by_id: nil, resolved_at: nil, resolution_note: nil)
+      people = (HrLite.users_holding("payroll.approve", scope: :all).to_a | HrLite.users_holding("payroll.manage", scope: :all).to_a)
+      Notifications.publish("ca.flagged", title: "CA flagged #{review.subject_label}", body: review.note,
+                                          path: "/admin/ca_reviews?status=flagged", bell_to: people, email_to: people)
+      review
+    end
+
+    def resolve!(actor:, note:)
+      raise ActiveRecord::RecordInvalid.new(self), "not flagged" unless status == "flagged"
+
+      update!(status: "resolved", resolved_by_id: actor.id, resolved_at: Time.current, resolution_note: note.to_s.strip.presence)
+    end
+
+    def subject_label
+      case subject
+      when SalarySlip then "#{HrLite.display_name(subject.user)}'s #{subject.period_month.strftime('%B %Y')} slip"
+      else "#{HrLite.display_name(subject.user)}'s #{subject.label} tax declaration"
+      end
+    end
+  end
+end