hr_lite 0.29.0 → 0.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5463a93b5739d60f73bd2cd554fce576f754218a8415fbd81ae35bdadc6ebcf
-  data.tar.gz: dadfaf0eb389d5cbe4fd012ef47d05561d03bc7e313462c491359114bb5cf294
+  metadata.gz: cc6f0b0eab85d612fdadaffc907d6b8d64eda04ed9fba81c5611ef37266916cf
+  data.tar.gz: 81a344480832392ca76230a465597bc085e6e155b063f7f823fc2348de9891cf
 SHA512:
-  metadata.gz: e9d1029c660d36bca33f79ede86ca0684a48616824f243a42df8c8a944b2b1b8fd55401e2cf3fafdf4411e9e33bcca24a9ddbc99c5337ed45db6a0e0830db541
-  data.tar.gz: 5c7a048e80c6522360eae49ddedf37589762ac548fa4768c5f6d3ff9d2a25be3c5fd8925dcdfdce79ee35daf003c13efd8eb9ecbab29567c83983b87cc5cb70c
+  metadata.gz: e9dba6adb15c59d153c44e29e5bbba3e24df80b6c2f8caaa4383bc49b98ba052a30780a51fe70bbfaf989188b8642bdb3de096214595dbeb511c3da6faf4a642
+  data.tar.gz: b8c776a6b48436ba780f09f948a5233d7372dd5abb5ed540c10507cb26de5a0cd7ec4f0f1a7cd40c528c5af18c0c8bc49e0d6959418d3b0c0b2a769450703011

data/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.31.0] - 2026-10-13
+
+- Office geofence (`config.office_geofence = true`, off by default). A check-in must come from inside an active office's radius (Admin → Offices), with a GPS fix at least that precise; otherwise it is refused with "You are not within the office location. Please request Work From Home (WFH) approval from HR." A denied or failed location says why. Check-out is unchanged.
+- Work from home requests. Employees request one or more dates from today up to 30 days ahead, with a reason; a 30-day calendar marks pending, approved and rejected dates. Overlapping live requests are refused. HR approves or rejects (a remark is required to reject) from Approvals → WFH; nobody decides their own. Only an approved request covering today lets a check-in skip the geofence; the day's record links to it and shows "WFH". Submission and decisions are audited and notified; a notification failure never blocks either.
+- HR gives WFH directly from the WFH board: approved at once, from today onwards, up to 60 days per grant. Audited (`wfh.granted`) and the employee is told.
+- Permanent WFH: a profile switch HR sets. The person checks in from anywhere; a check-in inside an office radius is recorded as office, not WFH. The same holds for a date-approved WFH day. Attendance records carry `wfh` and show "WFH" only for remote check-ins.
+- WFH board for HR: employees requested and approved, pending and rejected counts, who is home on a chosen date (approved requests and permanent WFH, each person once) with whether they checked in from home or the office, and every schedule, filtered by date range, name, department, status and WFH attendance.
+
+## [0.30.0] - 2026-10-13
+
+- Attendance slots (`config.attendance_slots = true`, off by default). Employees pick a check-in slot (09:00, 09:30, 10:00 or 10:30; checkout 8h30 later) for today, this week or this month. Saving locks it. HR sets or unlocks a slot from the employee's attendance page. No slot means 10:00.
+- Late penalties. After 5 minutes of grace, each started half hour late adds 30 minutes to that day's checkout. A check-in after 11:00 also adds 1 hour to each of the next two working days, and one after 11:30 makes the day a half day (an approved regularization ticket lifts it). Leaving before the required checkout adds 30 minutes to the next working day (nightly close job). The punch card shows the slot, the required checkout, time left and any shortage, and My attendance lists the month's penalties. HR removes a penalty with a reason; the row is kept.
+- Late buffer. HR gives an employee 1h or 2h with a reason (parental care, medical, health, other) on their profile. It delays the penalty clock. Colleagues see the category on the team board; the note is HR-only and encrypted.
+
 ## [0.29.0] - 2026-10-11
 
 - ID card: Share button. Draws front and back side by side into one PNG and opens the phone's share sheet (WhatsApp, mail…); desktops download the PNG. The card photo is now served through the Active Storage proxy (same site), so it shows up in the image when storage redirects to a cloud bucket. Vendors html-to-image 1.11.11 (MIT).

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -111,6 +111,35 @@ module HrLite
         end
       end
 
+      # HR sets a locked slot from today for the period.
+      def slot
+        @employee = find_manageable_employee
+        period = params[:period].to_s
+        slot = AttendanceSlot.new(user_id: @employee.id, set_by_id: hr_current_user.id, period: period,
+                                  start_minute: params[:start_minute].to_i, starts_on: Date.current,
+                                  ends_on: AttendanceSlot.ends_on_for(period, Date.current))
+        flash_for = slot.save ? { notice: "Slot set to #{AttendanceSlot.label(slot.start_minute)}." } : { alert: slot.errors.full_messages.to_sentence }
+        redirect_to admin_attendance_path(@employee.id), flash_for
+      end
+
+      # Lets the employee pick a new slot themselves.
+      def unlock_slot
+        @employee = find_manageable_employee
+        AttendanceSlot.where(user_id: @employee.id, locked: true).where(ends_on: Date.current..).find_each { |s| s.update!(locked: false) }
+        redirect_to admin_attendance_path(@employee.id), notice: "Slot unlocked. #{hr_display_name(@employee)} can pick a new one."
+      end
+
+      def remove_penalty
+        @employee = find_manageable_employee
+        penalty = AttendancePenalty.active.where(user_id: @employee.id).find(params[:penalty_id])
+        reason = params[:removal_reason].to_s.strip
+        month = penalty.date.strftime("%Y-%m")
+        return redirect_to admin_attendance_path(@employee.id, month: month), alert: "A reason is required." if reason.blank?
+
+        penalty.update!(removed_at: Time.current, removed_by_id: hr_current_user.id, removal_reason: reason)
+        redirect_to admin_attendance_path(@employee.id, month: month), notice: "Penalty removed."
+      end
+
       private
 
       # Viewing somebody's month and rewriting their punches are different

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -115,7 +115,8 @@ module HrLite
           :user_id, :manager_id, :designation, :date_of_birth, :date_of_joining,
           :date_of_exit, :probation_until, :department, :work_location, :pan_number, :pf_uan, :esi_number,
           :bank_account_number, :bank_ifsc, :bank_name, :tax_regime, :declared_annual_deductions,
-          :fy_opening_gross, :fy_opening_tds, :blood_group, :emergency_contact
+          :fy_opening_gross, :fy_opening_tds, :blood_group, :emergency_contact,
+          :buffer_minutes, :buffer_reason, :buffer_note, :permanent_wfh
         )
       end
 

data/app/controllers/hr_lite/admin/wfh_requests_controller.rb

@@ -0,0 +1,103 @@
+module HrLite
+  module Admin
+    # WFH board (counts, who is home on a date, every schedule) and the
+    # decision screen. Viewing is attendance.view, deciding attendance.manage.
+    class WfhRequestsController < BaseController
+      def index
+        @from = params[:from].present? ? parse_date_param(params[:from]) : Date.current
+        @to = [ params[:to].present? ? parse_date_param(params[:to]) : @from + WfhRequest::MAX_DAYS_AHEAD, @from ].max
+        @on = params[:on].present? ? parse_date_param(params[:on]) : Date.current
+        @status = params[:status].presence_in(WfhRequest::STATUSES)
+        @attendance = params[:attendance].presence_in(%w[checked_in not_checked_in])
+        @departments = EmployeeProfile.where.not(department: [ nil, "" ]).distinct.order(:department).pluck(:department)
+
+        visible = hr_scope(WfhRequest.all, "attendance.view")
+        visible = visible.where(user_id: filtered_user_ids) if filtered_user_ids
+        range = visible.overlapping(@from, @to)
+        @kpis = {
+          requested: range.distinct.count(:user_id),
+          approved: range.approved.distinct.count(:user_id),
+          pending: range.pending.count,
+          rejected: range.where(status: "rejected").count
+        }
+
+        load_home(visible)
+
+        scoped = @status ? range.where(status: @status) : range
+        @requests = paginate(scoped.includes(:user).order(:user_id, :start_date, :id))
+      end
+
+      # HR gives WFH outright, approved on creation, up to 60 days.
+      def create
+        employee = HrLite.user_klass.find(params[:user_id])
+        hr_require_reach!("attendance.manage", employee)
+        raise ActiveRecord::RecordNotFound if employee.id == hr_current_user.id
+
+        request = WfhRequest.grant!(user_id: employee.id, by: hr_current_user, start_date: params[:start_date],
+                                    end_date: params[:end_date], reason: params[:reason].to_s.strip)
+        redirect_to admin_wfh_requests_path, notice: "WFH given to #{hr_display_name(employee)} for #{request.dates_label}."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_wfh_requests_path, alert: "Could not give WFH: #{e.record.errors.full_messages.to_sentence}"
+      end
+
+      def show
+        @request = hr_scope(WfhRequest.all, "attendance.view").find(params[:id])
+        @decidable = decidable.exists?(@request.id)
+      end
+
+      def approve
+        request = decidable.find(params[:id])
+        request.approve!(actor: hr_current_user, note: params[:decision_note].to_s.strip.presence)
+        redirect_to admin_wfh_requests_path, notice: "WFH approved for #{hr_display_name(request.user)}."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_wfh_request_path(request), alert: "Only pending requests can be decided."
+      end
+
+      def reject
+        request = decidable.find(params[:id])
+        note = params[:decision_note].to_s.strip
+        return redirect_to admin_wfh_request_path(request), alert: "A remark is required to reject." if note.blank?
+
+        request.reject!(actor: hr_current_user, note: note)
+        redirect_to admin_wfh_requests_path, notice: "WFH rejected."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_wfh_request_path(request), alert: "Only pending requests can be decided."
+      end
+
+      private
+
+      # Nobody decides their own request; out-of-scope ids are a 404.
+      def decidable = hr_scope(WfhRequest.all, "attendance.manage").where.not(user_id: hr_current_user.id)
+
+      HomeRow = Struct.new(:user, :label, :request)
+
+      # Everyone home on @on: an approved request, else permanent WFH. One row a person.
+      def load_home(visible)
+        rows = visible.approved.overlapping(@on, @on).includes(:user).order(:user_id)
+                      .map { |r| HomeRow.new(r.user, r.dates_label, r) }.uniq { |row| row.user.id }
+        permanent = hr_scope(EmployeeProfile.where(permanent_wfh: true), "attendance.view")
+        permanent = permanent.where(user_id: filtered_user_ids) if filtered_user_ids
+        ids = permanent.pluck(:user_id) - rows.map { |row| row.user.id }
+        rows += HrLite.user_klass.where(id: ids).map { |u| HomeRow.new(u, "Permanent WFH", nil) }
+        @records = AttendanceRecord.where(date: @on, user_id: rows.map { |row| row.user.id }).where.not(check_in_at: nil).index_by(&:user_id)
+        @home_count = rows.size
+        @home = @attendance ? rows.select { |row| @records.key?(row.user.id) == (@attendance == "checked_in") } : rows
+        @grantable = HrLite.employees.select { |u| u.id != hr_current_user.id && hr_reaches?("attendance.manage", u) }
+      end
+
+      def filtered_user_ids
+        return @filtered_user_ids if defined?(@filtered_user_ids)
+
+        ids = nil
+        if (q = params[:q].to_s.strip.downcase).present?
+          ids = HrLite.employees.select { |u| HrLite.display_name(u).to_s.downcase.include?(q) }.map(&:id)
+        end
+        if (dept = params[:department].presence)
+          in_dept = EmployeeProfile.where(department: dept).pluck(:user_id)
+          ids = ids ? ids & in_dept : in_dept
+        end
+        @filtered_user_ids = ids
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/attendance_controller.rb

@@ -25,6 +25,29 @@ module HrLite
       punch(:check_out)
     end
 
+    # Saving locks the slot for the period; a locked one only HR changes.
+    def slot
+      raise ActiveRecord::RecordNotFound unless HrLite.config.attendance_slots
+
+      period = params[:period].to_s
+      to = AttendanceSlot.ends_on_for(period, Date.current)
+      if AttendanceSlot.where(user_id: hr_current_user.id, locked: true).overlapping(Date.current, to).exists?
+        return redirect_to attendance_path, alert: "Your slot is locked for that period. Ask HR to change it."
+      end
+      # Today's penalty was priced on the slot at check-in; picking one now would rewrite it.
+      if AttendanceRecord.where(user_id: hr_current_user.id, date: Date.current).where.not(check_in_at: nil).exists?
+        return redirect_to attendance_path, alert: "Pick your slot before checking in."
+      end
+
+      slot = AttendanceSlot.new(user_id: hr_current_user.id, set_by_id: hr_current_user.id, period: period,
+                                start_minute: params[:start_minute].to_i, starts_on: Date.current, ends_on: to)
+      if slot.save
+        redirect_to attendance_path, notice: "Slot #{AttendanceSlot.label(slot.start_minute)} saved and locked until #{to.strftime('%d %b')}."
+      else
+        redirect_to attendance_path, alert: slot.errors.full_messages.to_sentence
+      end
+    end
+
     private
 
     def punch(kind)

data/app/controllers/hr_lite/wfh_requests_controller.rb

@@ -0,0 +1,45 @@
+module HrLite
+  # Employee-side WFH requests. Scoping to hr_current_user IS the
+  # authorization; there is no edit, so a decided request cannot change.
+  class WfhRequestsController < ApplicationController
+    def index
+      @requests = paginate(WfhRequest.where(user_id: hr_current_user.id).recent_first)
+      @request = WfhRequest.new(start_date: Date.current, end_date: Date.current)
+      load_calendar
+    end
+
+    def create
+      @request = WfhRequest.new(params.require(:wfh_request).permit(:start_date, :end_date, :reason)
+                                      .merge(user_id: hr_current_user.id, status: "pending"))
+      # Row lock on the user: two tabs can't both pass the overlap check.
+      saved = WfhRequest.transaction { HrLite.user_klass.lock.find(hr_current_user.id) && @request.save }
+      if saved
+        @request.notify_requested
+        redirect_to wfh_requests_path, notice: "WFH request sent to HR."
+      else
+        @requests = paginate(WfhRequest.where(user_id: hr_current_user.id).recent_first)
+        load_calendar
+        render :index, status: :unprocessable_entity
+      end
+    end
+
+    def cancel
+      WfhRequest.where(user_id: hr_current_user.id).find(params[:id]).cancel!(actor: hr_current_user)
+      redirect_to wfh_requests_path, notice: "WFH request cancelled."
+    rescue ActiveRecord::RecordInvalid
+      redirect_to wfh_requests_path, alert: "Only pending requests can be cancelled."
+    end
+
+    private
+
+    # Status per date for the next 30 days; a later request wins a shared date.
+    def load_calendar
+      @window = Date.current..(Date.current + WfhRequest::MAX_DAYS_AHEAD)
+      @day_status = {}
+      WfhRequest.where(user_id: hr_current_user.id, status: %w[pending approved rejected])
+                .overlapping(@window.first, @window.last).order(:id).each do |request|
+        (request.start_date..request.end_date).each { |d| @day_status[d] = request.status if @window.cover?(d) }
+      end
+    end
+  end
+end

data/app/helpers/hr_lite/application_helper.rb

@@ -2,7 +2,7 @@ module HrLite
   module ApplicationHelper
     NAV_ITEMS = [
       { label: "Home",       path: :root_path,           match: [ "/" ], group: "My work" },
-      { label: "Attendance", path: :attendance_path,     match: [ "/attendance", "/regularization_requests" ], group: "My work" },
+      { label: "Attendance", path: :attendance_path,     match: [ "/attendance", "/regularization_requests", "/wfh_requests" ], group: "My work" },
       { label: "Leaves",     path: :leave_requests_path, match: [ "/leave_requests", "/leave_balances", "/comp_off_requests" ], group: "My work" },
       { label: "Team",       path: :team_path,           match: [ "/team" ], group: "My work" },
       # The phone tab bar shows the first four; the rest fill the More sheet,
@@ -33,7 +33,7 @@ module HrLite
     ADMIN_NAV_ITEMS = [
       { label: "Overview",        path: :admin_overview_path,        match: [ "/admin/overview" ] },
       { label: "Team attendance", path: :admin_attendances_path,     match: [ "/admin/attendances" ] },
-      { label: "Approvals",       path: :admin_leave_requests_path,  match: [ "/admin/leave_requests", "/admin/leave_balances", "/admin/comp_off_requests", "/admin/regularization_requests" ] },
+      { label: "Approvals",       path: :admin_leave_requests_path,  match: [ "/admin/leave_requests", "/admin/leave_balances", "/admin/comp_off_requests", "/admin/regularization_requests", "/admin/wfh_requests" ] },
       { label: "Reports",         path: :admin_reports_path,         match: [ "/admin/reports" ] },
       { label: "Claims",          path: :admin_expenses_path,        match: [ "/admin/expenses" ],
         if: -> { hr_can?("expense.approve", scope: :team) } },

data/app/jobs/hr_lite/attendance_close_job.rb

@@ -27,11 +27,23 @@ module HrLite
           tell(user, date, "attendance.short_day",
                "You worked #{(record.worked_duration / 3600.0).round(1)} of #{record.required_hours}h on #{day} — marked half day")
         end
+        penalize_short_day(record) if record&.check_out_at
       end
     end
 
     private
 
+    # Out before the slot's required checkout: +30 min on the next working day.
+    def penalize_short_day(record)
+      return unless HrLite.config.attendance_slots && record.check_out_at < record.required_check_out_at
+
+      next_day = AttendancePenalty.next_working_days(record.date, 1).first
+      AttendancePenalty.find_or_create_by!(attendance_record: record, reason: "short_day", date: next_day) do |p|
+        p.user_id = record.user_id
+        p.minutes = AttendanceSlot::STEP_MINUTES
+      end
+    end
+
     def tell(user, date, event, title)
       rule = HrLite.config.self_regularization
       body = if rule

data/app/models/hr_lite/attendance_penalty.rb

@@ -0,0 +1,30 @@
+module HrLite
+  # Minutes added to one day's required checkout. Never deleted: HR removes
+  # one with a reason and the row stays as the record.
+  class AttendancePenalty < ApplicationRecord
+    include Audited
+
+    REASONS = {
+      "late" => "Late check-in",
+      "late_carry" => "Checked in after 11:00",
+      "short_day" => "Left before the required checkout"
+    }.freeze
+
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :attendance_record
+    belongs_to :removed_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :reason, inclusion: { in: REASONS.keys }
+    validates :minutes, numericality: { greater_than: 0 }
+    validates :removal_reason, presence: true, if: :removed_at
+
+    scope :active, -> { where(removed_at: nil) }
+
+    def self.next_working_days(date, count)
+      calendar = WorkingCalendar.new((date + 1)..(date + 31))
+      ((date + 1)..(date + 31)).select { |d| calendar.working_day?(d) }.first(count)
+    end
+
+    def label = REASONS.fetch(reason)
+  end
+end

data/app/models/hr_lite/attendance_record.rb

@@ -3,13 +3,15 @@ module HrLite
     STATUSES = %w[present half_day].freeze
     AUTO_CHECKOUT_NOTE = "Auto check-out: no check-out punched".freeze
     SHORT_DAY_NOTE = "Short day: under the required hours".freeze
-    # Half days the close job set (not HR); an approved ticket lifts them.
-    AUTO_NOTES = [ AUTO_CHECKOUT_NOTE, SHORT_DAY_NOTE ].freeze
+    LATE_HALF_DAY_NOTE = "Half day: checked in after 11:30".freeze
+    # Half days the system set (not HR); an approved ticket lifts them.
+    AUTO_NOTES = [ AUTO_CHECKOUT_NOTE, SHORT_DAY_NOTE, LATE_HALF_DAY_NOTE ].freeze
     # Check-in and check-out further apart than this are called out on the board.
     PUNCH_GAP_ALERT_M = 500
 
     belongs_to :user, class_name: HrLite.config.user_class
     belongs_to :regularized_by, class_name: HrLite.config.user_class, optional: true
+    belongs_to :wfh_request, optional: true
 
     validates :date, presence: true, uniqueness: { scope: :user_id }
     validates :status, inclusion: { in: STATUSES }
@@ -45,6 +47,15 @@ module HrLite
       !!(hours && worked_duration && worked_duration < hours.hours)
     end
 
+    # config.attendance_slots: slot start + 8h30 + the day's active penalties.
+    def required_check_out_at
+      return unless HrLite.config.attendance_slots && check_in_at
+
+      extra = AttendancePenalty.active.where(user_id: user_id, date: date).sum(:minutes)
+      date.in_time_zone(HrLite.config.time_zone) +
+        (AttendanceSlot.start_minute_for(user_id, date) + AttendanceSlot::DAY_MINUTES + extra).minutes
+    end
+
     # Metres between where the day was checked in and checked out.
     def punch_gap_m
       return unless check_in_lat && check_in_lng && check_out_lat && check_out_lng

data/app/models/hr_lite/attendance_slot.rb

@@ -0,0 +1,38 @@
+module HrLite
+  # The check-in slot an employee commits to for a day, week or month.
+  # Saving locks it; only an attendance manager changes or unlocks it.
+  class AttendanceSlot < ApplicationRecord
+    include Audited
+
+    START_MINUTES = [ 540, 570, 600, 630 ].freeze # 09:00 09:30 10:00 10:30
+    DEFAULT_START_MINUTE = 600
+    PERIODS = { "day" => "Today", "week" => "This week", "month" => "This month" }.freeze
+    DAY_MINUTES = 510 # 8h30m from slot to checkout
+    GRACE_MINUTES = 5
+    STEP_MINUTES = 30
+    CARRY_AFTER_MINUTE = 660 # 11:00 — +1h on the next 2 working days
+    HALF_DAY_AFTER_MINUTE = 690 # 11:30 — the day is a half day
+
+    belongs_to :user, class_name: HrLite.config.user_class
+
+    validates :start_minute, inclusion: { in: START_MINUTES }
+    validates :period, inclusion: { in: PERIODS.keys }
+    validates :starts_on, :ends_on, presence: true
+
+    scope :overlapping, ->(from, to) { where("starts_on <= ? AND ends_on >= ?", to, from) }
+
+    def self.current(user_id, date) = where(user_id: user_id).overlapping(date, date).order(:created_at).last
+    def self.start_minute_for(user_id, date) = current(user_id, date)&.start_minute || DEFAULT_START_MINUTE
+
+    def self.ends_on_for(period, from)
+      { "week" => from.end_of_week(:monday), "month" => from.end_of_month }.fetch(period, from)
+    end
+
+    # 0 within grace, then +30 for every started half hour: 6–35 late = 30, 36–65 = 60.
+    def self.penalty_minutes(late)
+      late <= GRACE_MINUTES ? 0 : STEP_MINUTES * ((late - GRACE_MINUTES) / STEP_MINUTES.to_f).ceil
+    end
+
+    def self.label(minute) = format("%02d:%02d", *minute.divmod(60))
+  end
+end

data/app/models/hr_lite/employee_profile.rb

@@ -20,6 +20,17 @@ module HrLite
     # read as zero income for the months it cannot see.
     encrypted_money :declared_annual_deductions, :fy_opening_gross, :fy_opening_tds
 
+    # HR-granted late allowance; it delays the penalty clock. Colleagues see
+    # the category, only HR sees the note (encrypted: it can be medical).
+    BUFFER_MINUTES = [ 60, 120 ].freeze
+    BUFFER_REASONS = { "parental_care" => "Parental care", "medical" => "Medical",
+                       "health" => "Health", "other" => "Other" }.freeze
+    encrypts :buffer_note
+    normalizes :buffer_minutes, with: ->(v) { v.presence }
+    validates :buffer_minutes, inclusion: { in: BUFFER_MINUTES }, allow_nil: true
+    validates :buffer_reason, inclusion: { in: BUFFER_REASONS.keys }, if: :buffer_minutes
+    validates :buffer_note, presence: true, if: -> { buffer_minutes && buffer_reason == "other" }
+
     TAX_REGIMES = %w[new old].freeze
     BLOOD_GROUPS = %w[A+ A- B+ B- AB+ AB- O+ O-].freeze
     normalizes :blood_group, with: ->(v) { v.presence } # the "Not set" chip posts ""

data/app/models/hr_lite/wfh_request.rb

@@ -0,0 +1,108 @@
+module HrLite
+  # "Let me work from home on these dates." HR approves or rejects; only an
+  # approved request covering today lets a check-in skip the office geofence.
+  class WfhRequest < ApplicationRecord
+    STATUSES = %w[pending approved rejected cancelled].freeze
+    MAX_DAYS_AHEAD = 30
+    HR_MAX_DAYS = 60 # a span HR grants directly
+
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :decided_by, class_name: HrLite.config.user_class, optional: true
+    belongs_to :created_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :start_date, :end_date, :reason, presence: true
+    validates :status, inclusion: { in: STATUSES }
+    validate :dates_in_window, :no_overlap, on: :create
+
+    scope :pending, -> { where(status: "pending") }
+    scope :approved, -> { where(status: "approved") }
+    scope :live, -> { where(status: %w[pending approved]) }
+    scope :overlapping, ->(from, to) { where("start_date <= ? AND end_date >= ?", to, from) }
+    scope :recent_first, -> { order(start_date: :desc, id: :desc) }
+
+    STATUSES.each { |s| define_method("#{s}?") { status == s } }
+
+    def self.approved_for(user_id, date) = approved.where(user_id: user_id).overlapping(date, date).first
+
+    # HR grants WFH outright: approved on creation, up to HR_MAX_DAYS long.
+    def self.grant!(user_id:, by:, start_date:, end_date:, reason:)
+      request = create!(user_id: user_id, start_date: start_date, end_date: end_date, reason: reason,
+                        status: "approved", created_by_id: by.id, decided_by_id: by.id, decided_at: Time.current)
+      AuditLog.record!(action: "wfh.granted", subject: request, actor: by,
+                       changes: { "dates" => request.dates_label, "reason" => reason })
+      request.send(:announce, "wfh.approved", "HR gave you WFH — #{request.dates_label}", reason, "/wfh_requests", [ request.user ])
+      request
+    end
+
+    def granted? = created_by_id.present? && created_by_id != user_id
+
+    def dates_label
+      start_date == end_date ? start_date.strftime("%a %-d %b") : "#{start_date.strftime('%-d %b')} – #{end_date.strftime('%-d %b')}"
+    end
+
+    def days = (end_date - start_date).to_i + 1
+
+    def approve!(actor:, note: nil)
+      transition!("approved", actor, note)
+      announce("wfh.approved", "WFH approved — #{dates_label}", decision_note, "/wfh_requests", [ user ])
+    end
+
+    def reject!(actor:, note:)
+      transition!("rejected", actor, note)
+      announce("wfh.rejected", "WFH rejected — #{dates_label}", decision_note, "/wfh_requests", [ user ])
+    end
+
+    def cancel!(actor:)
+      transition!("cancelled", actor, nil)
+      announce("wfh.cancelled", "#{HrLite.display_name(user)} cancelled WFH for #{dates_label}", nil,
+               "/admin/wfh_requests/#{id}", HrLite.admin_users)
+    end
+
+    def notify_requested
+      AuditLog.record!(action: "wfh.requested", subject: self, actor: user,
+                       changes: { "dates" => dates_label, "reason" => reason })
+      announce("wfh.requested", "#{HrLite.display_name(user)} requested WFH for #{dates_label}", reason,
+               "/admin/wfh_requests/#{id}", HrLite.admin_users)
+    end
+
+    private
+
+    def transition!(new_status, actor, note)
+      with_lock do
+        raise ActiveRecord::RecordInvalid.new(self), "not pending" unless pending?
+
+        update!(status: new_status, decided_by_id: actor.id, decided_at: Time.current, decision_note: note)
+      end
+      AuditLog.record!(action: "wfh.#{new_status}", subject: self, actor: actor,
+                       changes: { "dates" => dates_label, "note" => note }.compact)
+      true
+    end
+
+    # A notification failure never undoes a request or a decision.
+    def announce(event, title, body, path, to)
+      Notifications.publish(event, title: title, body: body.presence, path: path, bell_to: to,
+                                   email_to: event == "wfh.requested" ? [] : to)
+    rescue => e
+      Rails.logger.error("[hr_lite] wfh notification failed: #{e.class}: #{e.message}")
+    end
+
+    def dates_in_window
+      return unless start_date && end_date
+
+      errors.add(:start_date, "cannot be in the past") if start_date < Date.current
+      errors.add(:end_date, "must be on or after the start date") if end_date < start_date
+      if granted?
+        errors.add(:end_date, "HR can grant at most #{HR_MAX_DAYS} days at a time") if days > HR_MAX_DAYS
+      elsif end_date > Date.current + MAX_DAYS_AHEAD
+        errors.add(:end_date, "must be within #{MAX_DAYS_AHEAD} days from today")
+      end
+    end
+
+    def no_overlap
+      return unless start_date && end_date && user_id
+
+      clash = self.class.live.where(user_id: user_id).overlapping(start_date, end_date).exists?
+      errors.add(:base, "You already have a pending or approved WFH request on some of these dates") if clash
+    end
+  end
+end

data/app/services/hr_lite/attendance_puncher.rb

@@ -6,6 +6,7 @@ module HrLite
   class AttendancePuncher
     # What the browser can legitimately report (geo_punch.js).
     GEO_STATUSES = %w[ok denied unavailable timeout insecure].freeze
+    OFF_SITE_MESSAGE = "You are not within the office location. Please request Work From Home (WFH) approval from HR.".freeze
 
     Result = Struct.new(:record, :error, keyword_init: true) do
       def ok? = error.nil?
@@ -34,6 +35,10 @@ module HrLite
                                  "or raise a regularization ticket.")
       end
 
+      if (error = geofence_error)
+        return Result.new(error: error)
+      end
+
       record = resolve_record
       return Result.new(error: "No open check-in to close.") if record.nil?
 
@@ -43,6 +48,8 @@ module HrLite
           return Result.new(record: record, error: already_in_message(record)) if record.check_in_at.present?
 
           stamp(record, :check_in)
+          record.wfh = !!@remote
+          record.wfh_request_id = @wfh&.id if @remote
         when :check_out
           return Result.new(record: record, error: "Check in first.") if record.check_in_at.blank?
 
@@ -53,6 +60,7 @@ module HrLite
 
         apply_geo_flags(record)
         record.save!
+        apply_slot_rules(record) if @kind == :check_in && HrLite.config.attendance_slots
       end
       notify_if_flagged(record)
       Result.new(record: record)
@@ -75,6 +83,31 @@ module HrLite
       retry
     end
 
+    # config.office_geofence: a check-in must be inside an office radius with
+    # a fix at least that precise, unless HR approved WFH for today or made
+    # the person permanent WFH. Inside the radius the day is office either way.
+    def geofence_error
+      return unless @kind == :check_in && HrLite.config.office_geofence && OfficeLocation.active.exists?
+      return if in_office?
+
+      @wfh = WfhRequest.approved_for(@user.id, Date.current)
+      @remote = @wfh.present? || EmployeeProfile.where(user_id: @user.id).pick(:permanent_wfh)
+      return if @remote
+      return OFF_SITE_MESSAGE if @lat && @lng
+
+      "We could not read your location (#{@geo_status}). Turn location on and try again, " \
+        "or request Work From Home (WFH) approval from HR."
+    end
+
+    def in_office?
+      return false unless @lat && @lng && @accuracy_m.to_f.positive?
+
+      OfficeLocation.active.any? do |office|
+        @accuracy_m.to_f <= office.radius_m &&
+          Geo.distance_m(office.lat, office.lng, @lat.to_f, @lng.to_f) <= office.radius_m
+      end
+    end
+
     def stamp(record, side)
       record.public_send("#{side}_at=", Time.current)
       record.public_send("#{side}_lat=", @lat)
@@ -86,12 +119,33 @@ module HrLite
       "Already checked in at #{record.check_in_at.in_time_zone(HrLite.config.time_zone).strftime('%H:%M')}."
     end
 
+    # Late ladder against slot + buffer; after 11:00 also +1h on the next two
+    # working days; after 11:30 the day is a half day. The buffer shifts all three.
+    def apply_slot_rules(record)
+      local = record.check_in_at.in_time_zone(HrLite.config.time_zone)
+      arrived = local.hour * 60 + local.min - EmployeeProfile.where(user_id: @user.id).pick(:buffer_minutes).to_i
+      late = AttendanceSlot.penalty_minutes(arrived - AttendanceSlot.start_minute_for(@user.id, record.date))
+      penalize(record, record.date, late, "late") if late.positive?
+      return if arrived <= AttendanceSlot::CARRY_AFTER_MINUTE
+
+      AttendancePenalty.next_working_days(record.date, 2).each { |day| penalize(record, day, 60, "late_carry") }
+      return if arrived <= AttendanceSlot::HALF_DAY_AFTER_MINUTE
+
+      record.update!(status: "half_day", regularization_note: AttendanceRecord::LATE_HALF_DAY_NOTE)
+    end
+
+    def penalize(record, date, minutes, reason)
+      AttendancePenalty.create!(user_id: @user.id, date: date, minutes: minutes, reason: reason, attendance_record: record)
+    end
+
     def apply_geo_flags(record)
       label = @kind == :check_in ? "Check-in" : "Check-out"
 
       if @lat.nil? || @lng.nil?
         reason = @geo_status == "ok" ? "unavailable" : @geo_status
         record.add_flag!("#{label} without GPS (#{reason})")
+      elsif record.wfh
+        nil # WFH: off-site is the point
       elsif OfficeLocation.active.exists? && !OfficeLocation.covering?(@lat, @lng)
         office = OfficeLocation.nearest(@lat, @lng)
         distance_km = (Geo.distance_m(office.lat, office.lng, @lat, @lng) / 1000.0).round(1)