hr_lite 0.23.1 → 0.26.0

data/app/views/hr_lite/admin/statutory_rate_cards/_form.html.erb

@@ -12,7 +12,7 @@
     <%= render "hr_lite/shared/form_errors", record: card %>
 
     <div class="hrl-field">
-      <%= f.label :effective_from, "Financial year starts (1 April)" %>
+      <%= f.label :effective_from, "Takes effect on (1 April for a new financial year, or the 1st of the month a mid-year change applies from)" %>
       <%= f.date_field :effective_from %>
     </div>
 

data/app/views/hr_lite/admin/tax_declarations/index.html.erb

@@ -7,6 +7,7 @@
       <a class="hrl-btn <%= "hrl-btn--primary" if @status == status %>"
          href="<%= hr_lite.admin_tax_declarations_path(status: status) %>"><%= status.humanize %></a>
     <% end %>
+    <a class="hrl-btn" href="<%= hr_lite.overview_admin_tax_declarations_path %>">Everyone's tax</a>
   </div>
 </section>
 

data/app/views/hr_lite/admin/tax_declarations/overview.html.erb

@@ -0,0 +1,39 @@
+<% content_for(:page_title) { "Everyone's tax" } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title">Everyone's tax — <%= HrLite::FinancialYear.label(Date.current) %></h1>
+  <div class="hrl-page__actions"><a class="hrl-btn" href="<%= hr_lite.admin_tax_declarations_path %>">Declarations</a></div>
+</div>
+<p class="hrl-small hrl-muted">Worked out now from each salary structure, the slips already paid and the declaration (limits applied). Open a declaration for the full working.</p>
+
+<section class="hrl-card">
+  <div class="hrl-table-wrap">
+    <table class="hrl-table hrl-table--stack">
+      <thead><tr><th>Person</th><th>Regime</th><th>Tax for the year</th><th>Deducted so far</th><th>TDS a month</th><th>Declaration</th></tr></thead>
+      <tbody>
+        <% @profiles.each do |profile| %>
+          <% declaration = @declarations[profile.user_id] %>
+          <% tax = HrLite::TaxComputation.new(user: profile.user, declaration: declaration) %>
+          <tr>
+            <td data-label="Person"><a class="hrl-card__link" href="<%= hr_lite.person_admin_tax_declarations_path(profile.user_id) %>"><%= hr_display_name(profile.user) %></a> <span class="hrl-small hrl-muted"><%= profile.employee_code %></span></td>
+            <% if tax.structure %>
+              <td data-label="Regime"><%= tax.regime.humanize %><% winner, by = tax.saving %><% if winner != tax.regime && by.positive? %><br><span class="hrl-small hrl-muted"><%= winner.humanize %> saves <%= hrl_rupees(by) %></span><% end %></td>
+              <td data-label="Tax for the year" class="hrl-num"><%= hrl_rupees(tax.chosen.annual_tax) %></td>
+              <td data-label="Deducted so far" class="hrl-num"><%= hrl_rupees(tax.chosen.tds_paid) %></td>
+              <td data-label="TDS a month" class="hrl-num"><%= hrl_rupees(tax.chosen.monthly) %></td>
+            <% else %>
+              <td data-label="Regime" colspan="4" class="hrl-muted">No salary structure</td>
+            <% end %>
+            <td data-label="Declaration">
+              <% if declaration %>
+                <a class="hrl-card__link" href="<%= hr_lite.admin_tax_declaration_path(declaration) %>"><%= declaration.status.humanize %></a>
+              <% else %>
+                <span class="hrl-muted">Not filed</span>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+  <%= hrl_pagination %>
+</section>

data/app/views/hr_lite/admin/tax_declarations/person.html.erb

@@ -0,0 +1,10 @@
+<% content_for(:page_title) { "Tax — #{hr_display_name(@person)}" } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title">Tax — <%= hr_display_name(@person) %></h1>
+  <div class="hrl-page__actions">
+    <a class="hrl-btn" href="<%= hr_lite.overview_admin_tax_declarations_path %>">Everyone's tax</a>
+    <% if @tax.declaration %><a class="hrl-btn" href="<%= hr_lite.admin_tax_declaration_path(@tax.declaration) %>">Declaration</a><% end %>
+  </div>
+</div>
+<% unless @tax.declaration %><p class="hrl-small hrl-muted">No declaration filed this year — the old-regime figure carries no investments yet.</p><% end %>
+<%= render "hr_lite/tax/computation", tax: @tax, both: true %>

data/app/views/hr_lite/admin/tax_declarations/show.html.erb

@@ -17,6 +17,8 @@
   </p>
 </section>
 
+<%= render "hr_lite/tax/computation", tax: @tax, both: true %>
+
 <%= form_with model: @declaration, url: hr_lite.admin_tax_declaration_path(@declaration),
               method: :patch, scope: :tax_declaration, local: true do |f| %>
   <section class="hrl-card">
@@ -27,7 +29,18 @@
         <span class="hrl-small hrl-muted">
           Claimed <%= hrl_money(item.object.declared_amount) %>
           <%= "— #{item.object.label}" if item.object.label.present? %>
+          <%= "· limit #{hrl_money(item.object.cap)}" if item.object.cap %>
+          <%= "· landlord PAN #{item.object.landlord_pan}" if item.object.landlord_pan.present? %>
         </span>
+        <% if item.object.proofs.attached? %>
+          <span class="hrl-row">
+            <% item.object.proofs.each do |proof| %>
+              <a class="hrl-card__link" href="<%= hr_lite.proof_admin_tax_declaration_path(@declaration, proof_id: proof.id) %>">Open <%= proof.filename %></a>
+            <% end %>
+          </span>
+        <% else %>
+          <span class="hrl-small hrl-badge hrl-badge--warn">No proof attached</span>
+        <% end %>
         <%= item.text_field :verified_amount,
               value: item.object.verified_amount&.to_s("F"), inputmode: "decimal",
               placeholder: "Verified amount" %>
@@ -41,8 +54,12 @@
 
 <section class="hrl-card">
   <h2 class="hrl-card__title">Decide</h2>
-  <%= button_to "Verify", hr_lite.verify_admin_tax_declaration_path(@declaration),
-        method: :post, class: "hrl-btn hrl-btn--primary" %>
+  <div class="hrl-row">
+    <%= button_to "Accept all and verify", hr_lite.accept_all_admin_tax_declaration_path(@declaration),
+          method: :post, class: "hrl-btn hrl-btn--primary" %>
+    <%= button_to "Verify the amounts recorded above", hr_lite.verify_admin_tax_declaration_path(@declaration),
+          method: :post, class: "hrl-btn" %>
+  </div>
   <%= form_with url: hr_lite.reject_admin_tax_declaration_path(@declaration),
                 method: :post, local: true do %>
     <div class="hrl-field">

data/app/views/hr_lite/leave_requests/_balance_chips.html.erb

@@ -1,10 +1,12 @@
-<section class="hrl-card">
-  <h2 class="hrl-card__title">Leave balance <%= HrLite::LeaveYear.label(HrLite::LeaveYear.current_key) %></h2>
+<%# locals: user (default: you), compact, bare (no card of its own — sits inside another card) %>
+<% user = local_assigns[:user] || hr_current_user %>
+<%= tag.send(local_assigns[:bare] ? :div : :section, class: ("hrl-card" unless local_assigns[:bare])) do %>
+  <%= tag.send(local_assigns[:bare] ? :h3 : :h2, class: "hrl-card__title") do %>Leave balance <%= HrLite::LeaveYear.label(HrLite::LeaveYear.current_key) %><% end %>
   <% types = HrLite::LeaveType.active.where(paid: true).where.not(annual_quota: nil) %>
   <% if types.any? %>
     <div class="hrl-row">
       <% types.each do |type| %>
-        <% balance = HrLite::LeaveBalance.for(hr_current_user, type, HrLite::LeaveYear.current_key) %>
+        <% balance = HrLite::LeaveBalance.for(user, type, HrLite::LeaveYear.current_key) %>
         <span class="hrl-badge hrl-badge--type" style="--hrl-type: <%= type.color %>">
           <%= type.name %> · <%= hrl_days(balance.available) %> of <%= hrl_days(balance.entitled) %> left
         </span>
@@ -16,4 +18,4 @@
   <% else %>
     <p class="hrl-muted hrl-small">No leave types configured yet.</p>
   <% end %>
-</section>
+<% end %>

data/app/views/hr_lite/tax/_computation.html.erb

@@ -0,0 +1,56 @@
+<%# locals: tax (HrLite::TaxComputation), both (true on the admin sheet: every regime's working, open) %>
+<% sheet = tax.chosen %>
+<% winner, by = tax.saving %>
+<% names = { "new" => "New regime", "old" => "Old regime" } %>
+<section class="hrl-card" aria-live="polite">
+  <h2 class="hrl-card__title">Income tax <%= HrLite::FinancialYear.label(HrLite::FinancialYear.start_for(tax.month)) %></h2>
+  <% if tax.structure.nil? %>
+    <p class="hrl-muted">No salary structure yet — tax is worked out once one is set.</p>
+  <% else %>
+    <div class="hrl-kpis hrl-kpis--money">
+      <div class="hrl-kpi"><div class="hrl-kpi__value"><%= hrl_rupees(sheet.annual_tax) %></div><div class="hrl-kpi__label">Tax for the year (<%= names[sheet.regime] %>)</div></div>
+      <div class="hrl-kpi"><div class="hrl-kpi__value"><%= hrl_rupees(sheet.monthly) %></div><div class="hrl-kpi__label">TDS a month, next <%= pluralize(sheet.months_left, "month") %></div></div>
+      <div class="hrl-kpi"><div class="hrl-kpi__value"><%= hrl_rupees(sheet.tds_paid) %></div><div class="hrl-kpi__label">Deducted so far</div></div>
+      <div class="hrl-kpi"><div class="hrl-kpi__value"><%= hrl_rupees(sheet.remaining) %></div><div class="hrl-kpi__label">Still to deduct</div></div>
+    </div>
+
+    <div class="hrl-tax-compare" role="group" aria-label="Old and new regime compared">
+      <% tax.sheets.each do |name, s| %>
+        <div class="hrl-tax-compare__col<%= " hrl-tax-compare__col--chosen" if name == sheet.regime %>">
+          <strong><%= names[name] %></strong><% if name == sheet.regime %> <span class="hrl-badge">Chosen</span><% end %>
+          <div class="hrl-tax-compare__amount"><%= hrl_rupees(s.annual_tax) %></div>
+          <div class="hrl-small hrl-muted">a year · <%= hrl_rupees(s.monthly) %> a month</div>
+        </div>
+      <% end %>
+    </div>
+    <p class="hrl-small">
+      <% if by.zero? %>Both regimes cost the same this year.
+      <% else %><strong><%= names[winner] %></strong> costs <%= hrl_rupees(by) %> less this year<%= winner == sheet.regime ? " — you are on it." : "." %><% end %>
+    </p>
+
+    <% (both ? tax.sheets.values : [ sheet ]).each do |s| %>
+      <details class="hrl-tax-working" <%= "open" if both %>>
+        <summary class="hrl-btn">How the <%= names[s.regime].downcase %> tax is worked out</summary>
+        <table class="hrl-table hrl-tax-working__table">
+          <tbody>
+            <tr><td>Salary paid so far this year</td><td class="hrl-num"><%= hrl_rupees(tax.paid_gross) %></td></tr>
+            <tr><td>Expected for the rest of the year (<%= hrl_rupees(tax.structure.monthly_gross) %> × <%= s.months_left %>)</td><td class="hrl-num"><%= hrl_rupees(tax.projected_gross) %></td></tr>
+            <tr class="hrl-tax-working__total"><td>Gross salary for the year</td><td class="hrl-num"><%= hrl_rupees(s.gross) %></td></tr>
+            <% if s.hra_exemption.positive? %><tr><td>Less HRA exemption (from rent)</td><td class="hrl-num">− <%= hrl_rupees(s.hra_exemption) %></td></tr><% end %>
+            <tr><td>Less standard deduction</td><td class="hrl-num">− <%= hrl_rupees(s.standard_deduction) %></td></tr>
+            <% s.deductions.each do |row| %>
+              <tr><td>Less <%= row.label %><br><span class="hrl-small hrl-muted">claimed <%= hrl_rupees(row.claimed) %><%= " · limit #{hrl_rupees(row.cap)}" if row.cap %></span></td><td class="hrl-num">− <%= hrl_rupees(row.allowed) %></td></tr>
+            <% end %>
+            <tr class="hrl-tax-working__total"><td>Taxable income</td><td class="hrl-num"><%= hrl_rupees(s.taxable) %></td></tr>
+            <% s.slabs.select { |row| row[:income].positive? }.each do |row| %>
+              <tr><td><%= hrl_rupees(row[:from]) %> – <%= row[:to] ? hrl_rupees(row[:to]) : "above" %> at <%= (row[:rate] * 100).to_i %>% on <%= hrl_rupees(row[:income]) %></td><td class="hrl-num"><%= hrl_rupees(row[:tax]) %></td></tr>
+            <% end %>
+            <tr class="hrl-tax-working__total"><td>Tax for the year, after any §87A rebate, with 4% cess</td><td class="hrl-num"><%= hrl_rupees(s.annual_tax) %></td></tr>
+            <tr><td>Already deducted (TDS)</td><td class="hrl-num">− <%= hrl_rupees(s.tds_paid) %></td></tr>
+            <tr class="hrl-tax-working__total"><td>Each remaining month (<%= s.months_left %>)</td><td class="hrl-num"><%= hrl_rupees(s.monthly) %></td></tr>
+          </tbody>
+        </table>
+      </details>
+    <% end %>
+  <% end %>
+</section>

data/app/views/hr_lite/tax_declarations/show.html.erb

@@ -1,73 +1,75 @@
-<% content_for(:page_title) { "Tax declaration" } %>
+<% content_for(:page_title) { "Tax" } %>
 <% submittable = @declaration.persisted? && (@declaration.draft? || @declaration.rejected?) %>
+<% locked = @declaration.verified? %>
 <div class="hrl-page__head">
-  <h1 class="hrl-page__title">Tax declaration — <%= @declaration.label %></h1>
+  <h1 class="hrl-page__title">Tax — <%= @declaration.label %></h1>
 </div>
 
-<section class="hrl-card">
-  <p class="hrl-muted hrl-small">
-    Your whole year's TDS is projected from these numbers, so a declaration
-    filed in April spreads the tax evenly instead of landing it in March.
-    Claim what you intend to invest; HR records what the proof supports when
-    you hand it over.
-  </p>
-  <p>
-    Status: <%= hrl_request_status_badge(@declaration.status == "verified" ? "approved" : @declaration.status) %>
-    <% if @declaration.note.present? %>
-      <span class="hrl-small hrl-muted">— <%= @declaration.note %></span>
-    <% end %>
-  </p>
-</section>
+<div id="hrl-tax-preview"><%= render "hr_lite/tax/computation", tax: @tax, both: false %></div>
 
-<%= form_with model: @declaration, url: hr_lite.tax_declaration_path, method: :patch,
-              scope: :tax_declaration, local: true do |f| %>
+<%= form_with model: @declaration, url: hr_lite.tax_declaration_path, method: :patch, scope: :tax_declaration, local: true,
+              multipart: true, data: { hrl_tax_preview: hr_lite.preview_tax_declaration_path } do |f| %>
   <%= render "hr_lite/shared/form_errors", record: @declaration %>
 
   <section class="hrl-card">
-    <div class="hrl-field">
-      <%= f.label :regime, "Tax regime", id: "hrl-tax-regime", for: nil %>
-      <div role="radiogroup" aria-labelledby="hrl-tax-regime">
-        <% [ [ "new", "New regime", "Lower rates, no deductions." ],
-             [ "old", "Old regime", "The deductions below reduce your tax." ] ].each do |value, name, hint| %>
-          <div class="hrl-field--check">
-            <%= f.radio_button :regime, value %>
-            <%= f.label :regime, value: value do %><span><%= name %><span class="hrl-hint"><%= hint %></span></span><% end %>
-          </div>
-        <% end %>
-      </div>
-    </div>
-  </section>
+    <p>
+      Declaration: <%= hrl_request_status_badge(@declaration.status == "verified" ? "approved" : @declaration.status) %>
+      <% if @declaration.note.present? %><span class="hrl-small hrl-muted">— <%= @declaration.note %></span><% end %>
+    </p>
+    <fieldset class="hrl-field" <%= "disabled" if locked %>>
+      <legend>Tax regime</legend>
+      <% [ [ "new", "New regime", "Lower rates; only the standard deduction." ],
+           [ "old", "Old regime", "Higher rates; the investments below reduce your tax." ] ].each do |value, name, hint| %>
+        <div class="hrl-field--check">
+          <%= f.radio_button :regime, value %>
+          <%= f.label :regime, value: value do %><span><%= name %><span class="hrl-hint"><%= hint %></span></span><% end %>
+        </div>
+      <% end %>
+    </fieldset>
+  </details>
 
   <details class="hrl-card" <%= "open" if @declaration.regime != "new" || @declaration.errors.any? %>>
-    <summary class="hrl-btn">Deductions (old regime only)</summary>
-    <%= f.fields_for :tax_declaration_items do |item| %>
-      <div class="hrl-field">
-        <%= item.hidden_field :section %>
-        <%= item.label :declared_amount, item.object.section_label %>
-        <%= item.text_field :declared_amount,
-              value: item.object.declared_amount&.to_s("F"), inputmode: "decimal" %>
-        <%= item.label :label, "What it is (optional)", class: "hrl-mt hrl-muted" %>
-        <%= item.text_field :label %>
-        <% if item.object.persisted? && item.object.verified_amount %>
-          <span class="hrl-small hrl-muted">
-            HR verified <%= hrl_money(item.object.verified_amount) %>
-          </span>
-        <% end %>
-      </div>
-    <% end %>
-    <p>Total claimed: <strong><%= hrl_money(@declaration.declared_total) %></strong></p>
+    <summary class="hrl-btn">Investments and rent (old regime only)</summary>
+    <p class="hrl-small hrl-muted">Enter what you will invest or pay this year and attach the proof. The legal limit is applied for you — anything above it simply does not count. Until HR checks the proof, what you claim is used, so you never overpay tax in the meantime.</p>
+    <fieldset <%= "disabled" if locked %>>
+      <%= f.fields_for :tax_declaration_items do |item| %>
+        <% line = item.object %>
+        <div class="hrl-field">
+          <%= item.hidden_field :section %>
+          <%= item.label :declared_amount, line.section_label %>
+          <%= item.text_field :declared_amount, value: line.declared_amount&.to_s("F"), inputmode: "decimal", autocomplete: "off" %>
+          <% if line.cap %>
+            <progress class="hrl-tax-cap" max="<%= line.cap %>" value="<%= [ line.declared_amount.to_i, line.cap ].min %>" aria-hidden="true"></progress>
+            <span class="hrl-hint" data-hrl-cap="<%= line.cap %>"><%= hrl_rupees([ line.declared_amount.to_i, line.cap ].min) %> of the <%= hrl_rupees(line.cap) %> limit counts</span>
+          <% end %>
+          <% if line.section.start_with?("80d") %>
+            <div class="hrl-field--check hrl-mt"><%= item.check_box :senior %><%= item.label :senior, line.section == "80d" ? "I am 60 or older" : "A parent is 60 or older" %></div>
+          <% end %>
+          <% if line.section == "hra" %>
+            <%= item.label :landlord_pan, "Landlord's PAN (needed above ₹1,00,000 a year)", class: "hrl-mt" %>
+            <%= item.text_field :landlord_pan, autocomplete: "off", maxlength: 10, autocapitalize: "characters" %>
+          <% end %>
+          <%= item.label :proofs, "Proof (PDF, JPG or PNG, up to 5 MB each)", class: "hrl-mt" %>
+          <%= item.file_field :proofs, multiple: true, accept: "application/pdf,image/jpeg,image/png" %>
+          <% if line.persisted? && line.proofs.attached? %>
+            <ul class="hrl-row hrl-mt" aria-label="Attached proof">
+              <% line.proofs.each do |proof| %><li class="hrl-badge hrl-badge--muted"><%= proof.filename %></li><% end %>
+            </ul>
+          <% end %>
+          <% if line.persisted? && line.verified_amount %><span class="hrl-small hrl-muted">HR accepted <%= hrl_money(line.verified_amount) %></span><% end %>
+        </div>
+      <% end %>
+    </fieldset>
   </details>
 
-  <% if submittable %>
-    <p class="hrl-muted hrl-small">
-      Submitting locks it for HR to check. They can send it back if the proof
-      does not match.
-    </p>
+  <% unless locked %>
+    <% if submittable %><p class="hrl-muted hrl-small">Submitting sends it to HR to check the proof. They can send it back if something does not match.</p><% end %>
+    <div class="hrl-form-actions">
+      <%= f.submit "Save", class: submittable ? "hrl-btn" : "hrl-btn hrl-btn--primary" %>
+      <% if submittable %><button type="submit" name="submit_to_hr" value="1" class="hrl-btn hrl-btn--primary">Submit to HR</button><% end %>
+    </div>
+  <% else %>
+    <p class="hrl-small hrl-muted">HR has verified this year's declaration. Ask HR to reopen it to change anything.</p>
   <% end %>
-  <div class="hrl-form-actions">
-    <%= f.submit "Save draft", class: submittable ? "hrl-btn" : "hrl-btn hrl-btn--primary" %>
-    <% if submittable %>
-      <button type="submit" name="submit_to_hr" value="1" class="hrl-btn hrl-btn--primary">Submit to HR</button>
-    <% end %>
-  </div>
 <% end %>
+<% content_for(:scripts) { javascript_include_tag "hr_lite/tax_preview", defer: true } %>

data/app/views/hr_lite/timelines/show.html.erb

@@ -31,6 +31,7 @@
   <section class="hrl-card hrl-card--private" aria-labelledby="private-records">
     <h2 class="hrl-card__title" id="private-records">Private records</h2>
     <p class="hrl-small"><strong>Private</strong> — only <%= @person.id == hr_current_user.id ? "you" : name %> and people with access can see this.</p>
+    <% if @show_balance %><%= render "hr_lite/leave_requests/balance_chips", user: @person, compact: true, bare: true %><% end %>
     <%= render "events", events: @private_events, empty: "Nothing private in #{@year}." %>
   </section>
 <% end %>

data/config/routes.rb

@@ -35,6 +35,7 @@ HrLite::Engine.routes.draw do
   end
   resource :tax_declaration, only: %i[show update], controller: "tax_declarations" do
     post :submit
+    post :preview
   end
   resources :loans, only: :index
   get "team", to: "team#show"
@@ -80,7 +81,8 @@ HrLite::Engine.routes.draw do
     end
     get "documents/for/:user_id", to: "documents#show", as: :employee_documents
     resources :tax_declarations, only: %i[index show update] do
-      member { post :verify; post :reject }
+      member { post :verify; post :reject; post :accept_all; get "proofs/:proof_id", action: :proof, as: :proof }
+      collection { get :overview; get "people/:user_id", action: :person, as: :person }
     end
     resources :loans, only: %i[index new create show] do
       member { post :close; post :cancel }
@@ -120,10 +122,14 @@ HrLite::Engine.routes.draw do
     end
     resources :performance_plans, only: %i[index new create edit update]
     resources :awards, only: %i[index new create edit update]
+    resources :ca_reviews, only: :index do
+      collection { post :verify; post :flag; post :verify_all }
+      member { post :resolve }
+    end
     resources :payroll_runs, only: %i[index show new create destroy] do
       member do
         post :compute
-        post :finalize
+        post :approve
         post :unlock
         post :publish
         get :register

data/db/migrate/20261010100000_add_ctc_to_hr_lite_salary_structures.rb

@@ -0,0 +1,9 @@
+class AddCtcToHrLiteSalaryStructures < ActiveRecord::Migration[8.1]
+  # The agreed Annual CTC is now the input (encrypted, like every amount);
+  # metro decides the HRA rate. Existing rows keep their lines and get a CTC
+  # the next time they are saved.
+  def change
+    add_column :hr_lite_salary_structures, :annual_ctc, :text
+    add_column :hr_lite_salary_structures, :metro, :boolean, null: false, default: false
+  end
+end

data/db/migrate/20261010100100_add_approval_to_hr_lite_payroll_runs.rb

@@ -0,0 +1,10 @@
+class AddApprovalToHrLitePayrollRuns < ActiveRecord::Migration[8.1]
+  # Two people approve a run: the first is stamped here, the second
+  # finalizes and publishes it. auto_approved_at marks a run the 3rd-of-month
+  # job approved because nobody had.
+  def change
+    add_column :hr_lite_payroll_runs, :first_approved_by_id, :bigint
+    add_column :hr_lite_payroll_runs, :first_approved_at, :datetime
+    add_column :hr_lite_payroll_runs, :auto_approved_at, :datetime
+  end
+end

data/db/migrate/20261010100200_grant_hr_lite_payroll_approve.rb

@@ -0,0 +1,22 @@
+class GrantHrLitePayrollApprove < ActiveRecord::Migration[8.1]
+  # payroll.approve is new in 0.24.0, and RoleSeeds never touches an existing
+  # role, so without this nobody on a running install could approve. HR and
+  # Super Admin approve; HR also reads every run, sets salary structures and
+  # edits employee profiles (owner decision 2026-10-09).
+  GRANTS = {
+    "HR" => { "payroll.approve" => "all", "payroll.view" => "all", "salary.view" => "all", "salary.manage" => "all", "profile.manage" => "all" },
+    "Super Admin" => { "payroll.approve" => "all" }
+  }.freeze
+
+  def up
+    GRANTS.each do |role_name, grants|
+      role = HrLite::Role.find_by(name: role_name) or next
+      grants.each do |key, scope|
+        grant = HrLite::RoleGrant.find_or_initialize_by(role: role, permission_key: key)
+        grant.update!(scope: scope)
+      end
+    end
+  end
+
+  def down; end
+end

data/db/migrate/20261010100300_seed_hr_lite_fy2026_rate_cards.rb

@@ -0,0 +1,16 @@
+class SeedHrLiteFy2026RateCards < ActiveRecord::Migration[8.1]
+  # Ships the FY 2026-27 card and the October 2026 EPF-ceiling card into an
+  # install that already has its cards. Creates only what is missing — a card
+  # an accountant already entered is never touched.
+  def up
+    # A fresh install gets every shipped card from `hr_lite:seed`; this is for
+    # one that already seeded, where the seed would never run again.
+    return unless HrLite::StatutoryRateCardRecord.exists?
+
+    require "hr_lite/statutory_seeds"
+    created = HrLite::StatutorySeeds.seed_cards!
+    say "Seeded #{created.join(', ')}" if created.any?
+  end
+
+  def down; end
+end

data/db/migrate/20261010100400_add_tax_fields_to_hr_lite_tax_declaration_items.rb

@@ -0,0 +1,9 @@
+class AddTaxFieldsToHrLiteTaxDeclarationItems < ActiveRecord::Migration[8.1]
+  # senior lifts the 80D limit (₹25,000 → ₹50,000) for whoever the line covers;
+  # landlord_pan is required once rent passes ₹1 lakh a year (encrypted:
+  # it is somebody else's government ID). Proofs attach through Active Storage.
+  def change
+    add_column :hr_lite_tax_declaration_items, :senior, :boolean, null: false, default: false
+    add_column :hr_lite_tax_declaration_items, :landlord_pan, :text
+  end
+end

data/db/migrate/20261010100500_grant_hr_lite_tax_to_hr.rb

@@ -0,0 +1,12 @@
+class GrantHrLiteTaxToHr < ActiveRecord::Migration[8.1]
+  # HR sees and checks everyone's tax (owner decision 2026-10-09). RoleSeeds
+  # never touches an existing role, so a running install needs this.
+  def up
+    role = HrLite::Role.find_by(name: "HR") or return
+    { "tax.view" => "all", "tax.manage" => "all" }.each do |key, scope|
+      HrLite::RoleGrant.find_or_initialize_by(role: role, permission_key: key).update!(scope: scope)
+    end
+  end
+
+  def down; end
+end

data/db/migrate/20261010110000_create_hr_lite_ca_reviews.rb

@@ -0,0 +1,21 @@
+class CreateHrLiteCaReviews < ActiveRecord::Migration[8.1]
+  # The CA's year-end mark on one salary slip or tax declaration: verified,
+  # or flagged with what is wrong until HR/payroll resolves it.
+  def change
+    create_table :hr_lite_ca_reviews do |t|
+      t.string :subject_type, null: false
+      t.bigint :subject_id, null: false
+      # verified | flagged | resolved
+      t.string :status, null: false
+      t.text :note
+      t.bigint :reviewed_by_id, null: false
+      t.datetime :reviewed_at, null: false
+      t.bigint :resolved_by_id
+      t.datetime :resolved_at
+      t.text :resolution_note
+      t.timestamps
+    end
+    add_index :hr_lite_ca_reviews, %i[subject_type subject_id], unique: true
+    add_check_constraint :hr_lite_ca_reviews, "status IN ('verified', 'flagged', 'resolved')", name: "hr_lite_ca_reviews_status_check"
+  end
+end

data/db/migrate/20261010110100_seed_hr_lite_ca_role.rb

@@ -0,0 +1,14 @@
+class SeedHrLiteCaRole < ActiveRecord::Migration[8.1]
+  # The CA role is new in 0.26.0 and payroll.verify is a new key. RoleSeeds
+  # creates the missing role; Super Admin, an existing role, gets the key here.
+  def up
+    return unless HrLite::Role.exists?
+
+    require "hr_lite/role_seeds"
+    HrLite::RoleSeeds.call
+    super_admin = HrLite::Role.find_by(name: "Super Admin") or return
+    HrLite::RoleGrant.find_or_initialize_by(role: super_admin, permission_key: "payroll.verify").update!(scope: "all")
+  end
+
+  def down; end
+end

data/lib/hr_lite/notifications.rb

@@ -22,6 +22,11 @@ module HrLite
       "attendance.missed_check_out" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
       "attendance.short_day" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
       "payroll.finalized"     => { bell: false, email: false, leadership_email: true,  leadership_bell: true  },
+      "ca.flagged" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
+      "ca.reminder" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
+      "ca.overdue" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
+      "payroll.approval_needed" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
+      "payroll.overdue" => { bell: true, email: true, leadership_email: false, leadership_bell: false },
       "payroll.published"     => { bell: true,  email: true,  leadership_email: true,  leadership_bell: false },
       "kudos.mentioned"       => { bell: true,  email: true,  leadership_email: false, leadership_bell: false },
       "appraisal.shared"      => { bell: true,  email: true,  leadership_email: true,  leadership_bell: false },

data/lib/hr_lite/permissions.rb

@@ -37,6 +37,8 @@ module HrLite
       "payroll.view" => [ "Payroll", "See payroll runs and salary slips" ],
       "payroll.manage" => [ "Payroll", "Create, compute, finalize, unlock and publish payroll" ],
       "payroll.export" => [ "Payroll", "Download the payout register, including bank details" ],
+      "payroll.verify" => [ "Payroll", "Verify or flag each salary slip and tax declaration at year end (CA review)" ],
+      "payroll.approve" => [ "Payroll", "Approve a computed payroll run (two approvals finalize and publish it)" ],
       "salary.view" => [ "Payroll", "See salary structures" ],
       "salary.manage" => [ "Payroll", "Set and revise salary structures" ],
       "appraisal.view" => [ "Growth", "See appraisals" ],

data/lib/hr_lite/role_seeds.rb

@@ -36,9 +36,9 @@ module HrLite
         grants: {
           "leave.request" => "self", "leave.view" => "all", "leave.approve" => "all",
           "leave.manage" => "all", "attendance.view" => "all", "attendance.manage" => "all",
-          "profile.view" => "all", "payroll.view" => "self",
-          "appraisal.view" => "self", "resignation.view" => "all",
-          "document.view" => "all", "tax.view" => "self",
+          "profile.view" => "all", "payroll.view" => "all", "payroll.approve" => "all",
+          "salary.view" => "all", "salary.manage" => "all", "profile.manage" => "all", "appraisal.view" => "self", "resignation.view" => "all",
+          "document.view" => "all", "tax.view" => "all", "tax.manage" => "all",
           "expense.claim" => "self", "benefit.view" => "all", "benefit.manage" => "all",
           "hr_request.raise" => "self", "hr_request.manage" => "all", "policy.view" => "all",
           "asset.view" => "all", "asset.manage" => "all", "checklist.manage" => "all"
@@ -70,6 +70,12 @@ module HrLite
           "asset.view" => "all", "asset.manage" => "all", "checklist.manage" => "all"
         }
       },
+      Role::CA => {
+        description: "Outside chartered accountant: reads every slip and tax declaration and verifies them before 31 March.",
+        grants: {
+          "payroll.view" => "all", "salary.view" => "all", "tax.view" => "all", "payroll.verify" => "all"
+        }
+      },
       Role::SUPER_ADMIN => {
         description: "Everything, including pay, appraisals and who holds which role.",
         grants: Permissions::KEYS.to_h { |key| [ key, "all" ] }