hr_lite 0.5.0 → 0.5.2

data/app/models/hr_lite/payroll_run.rb

@@ -13,6 +13,8 @@ module HrLite
     validates :period_month, presence: true, uniqueness: true
     validates :status, inclusion: { in: STATUSES }
     validate :period_is_first_of_month
+    # Create-only: an existing run must stay transitionable forever.
+    validate :period_is_a_closed_month, on: :create
     before_destroy :draft_only_destroy
 
     scope :recent_first, -> { order(period_month: :desc) }
@@ -27,16 +29,25 @@ module HrLite
       period_month.strftime("%B %Y")
     end
 
+    # `processing` is allowed back in so a run stranded there by a killed
+    # process (deploy roll, timeout) can be recomputed instead of blocking
+    # that month forever.
     def compute!(actor:)
-      raise_unless %w[draft review]
-
-      update!(status: "processing")
-      PayrollRunProcessor.call(self)
-      update!(status: "review", processed_at: Time.current)
-      true
-    rescue => e
-      update_columns(status: "draft") # rubocop:disable Rails/SkipsModelValidations
-      raise e
+      raise_unless %w[draft review processing]
+      previous = status
+
+      begin
+        update!(status: "processing")
+        PayrollRunProcessor.call(self)
+        update!(status: "review", processed_at: Time.current)
+        true
+      rescue => e
+        # Restore what the run WAS. Hardcoding "draft" here used to demote a
+        # finalized or published run — which then exposed the delete-draft
+        # control, and that cascades over every salary slip.
+        update_columns(status: previous) # rubocop:disable Rails/SkipsModelValidations
+        raise e
+      end
     end
 
     def finalize!(actor:)
@@ -63,12 +74,20 @@ module HrLite
       update!(status: "published", published_at: Time.current, published_by_id: actor.id)
 
       slips = salary_slips.includes(:user).to_a
+      # Everyone is emailed — a final settlement matters most to the person who
+      # has left — but a bell is only useful to someone who can still sign in,
+      # and offboarding revokes that. Sending one pointed at a page they cannot
+      # open is just noise in a place they will never look.
+      exited = EmployeeProfile.where(user_id: slips.map(&:user_id))
+                              .where(date_of_exit: ..Date.current)
+                              .pluck(:user_id).to_set
+
       Notifications.publish(
         "payroll.published",
         title: "Your salary slip for #{label} is ready",
         body: "Open Earthly HR to view or download it.",
         path: "/salary_slips",
-        bell_to: slips.map(&:user),
+        bell_to: slips.reject { |slip| exited.include?(slip.user_id) }.map(&:user),
         email_to: slips.map(&:user)
       )
       true
@@ -102,6 +121,16 @@ module HrLite
       errors.add(:period_month, "must be the 1st of a month")
     end
 
+    # Days that have not happened yet score as `upcoming`, which payroll folds
+    # into payable — so computing a month before it ends pays for days nobody
+    # worked, and once finalized the slips are immutable.
+    def period_is_a_closed_month
+      return unless period_month
+      return if period_month.end_of_month < Date.current
+
+      errors.add(:period_month, "must be a month that has already ended")
+    end
+
     def draft_only_destroy
       return if draft?
 

data/app/models/hr_lite/regularization_request.rb

@@ -49,6 +49,14 @@ module HrLite
     # InvalidMerge with the real story so the admin knows what to fix.
     def approve!(actor:, note: nil)
       transition!("approved", actor, note) do
+        # Re-checked at approval, not only at create: leave can be approved for
+        # that day while the ticket waits in the queue, and DayStatus ranks
+        # full-day leave above any punch — so the "fix" would write a record
+        # nothing reads while telling everyone attendance had been corrected.
+        if LeaveRequest.active_on(date).where(user_id: user_id, half_day: false).exists?
+          raise InvalidMerge, "the day is now covered by approved leave — cancel the leave first"
+        end
+
         record = AttendanceRecord.find_or_initialize_by(user_id: user_id, date: date)
         record.check_in_at = check_in_at if check_in_at
         record.check_out_at = check_out_at if check_out_at

data/app/models/hr_lite/resignation.rb

@@ -29,9 +29,18 @@ module HrLite
         update!(status: "accepted", decided_by_id: actor.id, decided_at: Time.current,
                 decision_note: note.presence, proposed_last_day: final_day)
         profile = EmployeeProfile.find_by(user_id: user_id)
+        # Someone can resign before HR ever created their profile. That is not
+        # a reason to refuse the resignation — but the caller has to know
+        # nothing was stamped, because the screen used to claim it was.
+        @exit_date_recorded = profile.present?
         profile&.update!(date_of_exit: final_day)
       end
 
+      # Notice periods are the normal case, so access is revoked here only
+      # when the last day has already passed. Otherwise the person keeps
+      # working it out and leadership revokes from the employee page.
+      revoke_access! if final_day <= Date.current
+
       Notifications.publish(
         "resignation.accepted",
         title: "Resignation accepted — last working day #{final_day.strftime('%d %b %Y')}",
@@ -56,8 +65,21 @@ module HrLite
       true
     end
 
+    # False when the person had no employee profile to stamp — see accept!.
+    def exit_date_recorded?
+      @exit_date_recorded
+    end
+
     private
 
+    # Best-effort, like every other call of this hook: a host that cannot
+    # revoke must not roll back an accepted resignation.
+    def revoke_access!
+      HrLite.config.offboard_user.call(user)
+    rescue => e
+      Rails.logger.error("[hr_lite] offboard_user failed: #{e.class}: #{e.message}")
+    end
+
     def notify_submitted
       Notifications.publish(
         "resignation.submitted",
@@ -78,6 +100,11 @@ module HrLite
     def single_open_resignation
       if self.class.pending.where(user_id: user_id).exists?
         errors.add(:base, "You already have a pending resignation")
+      elsif self.class.where(user_id: user_id, status: "accepted").exists?
+        # Only `pending` used to block a second one, so someone whose exit was
+        # already agreed could resign again — and accepting the new one would
+        # overwrite the exit date payroll and attendance already clip to.
+        errors.add(:base, "Your resignation has already been accepted — talk to your manager to change the date")
       end
     end
   end

data/app/models/hr_lite/salary_slip.rb

@@ -18,6 +18,10 @@ module HrLite
     before_save :ensure_run_editable
 
     scope :published, -> { joins(:payroll_run).where(hr_lite_payroll_runs: { status: "published" }) }
+    # What counts as already paid for tax-to-date. A finalized run is money
+    # already decided; waiting for publication made the next month's TDS
+    # projection read those earnings as zero.
+    scope :settled, -> { joins(:payroll_run).where(hr_lite_payroll_runs: { status: %w[finalized published] }) }
     scope :recent_first, -> { order(period_month: :desc) }
 
     def published?
@@ -33,13 +37,13 @@ module HrLite
       lop_override || lop_days
     end
 
-    # Indian FY (Apr 1) to-date sums of PUBLISHED slips before this period —
+    # Indian FY (Apr 1) to-date sums of SETTLED slips before this period —
     # feeds the TDS projector and the slip's YTD table.
     def self.fy_to_date(user, period_month)
       fy_start = period_month.month >= 4 ? Date.new(period_month.year, 4, 1)
                                          : Date.new(period_month.year - 1, 4, 1)
-      slips = published.where(user_id: user.id)
-                       .where(period_month: fy_start...period_month)
+      slips = settled.where(user_id: user.id)
+                     .where(period_month: fy_start...period_month)
       {
         gross: slips.sum(BigDecimal(0)) { |s| s.gross_earnings || BigDecimal(0) },
         tds: slips.sum(BigDecimal(0)) { |s| Money.d(s.deduction_amount("tds")) },

data/app/services/hr_lite/attendance_puncher.rb

@@ -4,6 +4,9 @@ module HrLite
   # without GPS or outside every office radius is recorded AND flagged —
   # denying GPS must not stop anyone from working.
   class AttendancePuncher
+    # What the browser can legitimately report (geo_punch.js).
+    GEO_STATUSES = %w[ok denied unavailable timeout insecure].freeze
+
     Result = Struct.new(:record, :error, keyword_init: true) do
       def ok? = error.nil?
     end
@@ -18,7 +21,11 @@ module HrLite
       @lat = lat.presence
       @lng = lng.presence
       @accuracy_m = accuracy_m.presence
-      @geo_status = geo_status
+      # Client-supplied and rendered straight into the admin-facing flag note.
+      # Anything outside the browser's real permission states is not evidence:
+      # a blank one (JS never ran) produced "without GPS ()", and a crafted one
+      # let an employee write reassuring text onto their own flag.
+      @geo_status = GEO_STATUSES.include?(geo_status.to_s) ? geo_status.to_s : "unavailable"
     end
 
     def call

data/app/services/hr_lite/calculators/esi.rb

@@ -1,9 +1,12 @@
 module HrLite
   module Calculators
-    # ESI: eligibility is decided on the FULL structure monthly gross
-    # (a low-attendance month must not pull someone into ESI); when
-    # eligible, contributions apply to the earned gross and round UP
-    # to the next rupee (ESIC rule).
+    # ESI: eligibility is decided on the FULL structure monthly gross (a
+    # low-attendance month must not pull someone into ESI), and specifically
+    # on the gross in force at the START of the ESIC contribution period —
+    # April–September or October–March. A rise past the ceiling mid-period
+    # does not end coverage; the caller resolves that period-start gross and
+    # passes it here. Contributions apply to the EARNED gross and round up to
+    # the next rupee (ESIC rule).
     module Esi
       Result = Struct.new(:applicable, :employee, :employer, keyword_init: true) do
         def applicable? = applicable

data/app/services/hr_lite/calculators/professional_tax.rb

@@ -8,7 +8,11 @@ module HrLite
         slabs = rates[state.to_s] || []
         earned = Money.d(gross_earned)
 
-        slab = slabs.reverse.find { |row| earned > row[:above] }
+        # `from:` is an INCLUSIVE lower bound — ₹25,000 is taxed, ₹24,999.50 is
+        # not. The older exclusive `above:` form still works so a host's own
+        # slab table keeps functioning, but it cannot express that boundary on
+        # a decimal amount: `above: 24999` taxed a prorated ₹24,999.50.
+        slab = slabs.reverse.find { |row| row[:from] ? earned >= row[:from] : earned > row[:above] }
         return BigDecimal(0) unless slab
 
         amount = slab[:monthly]

data/app/services/hr_lite/calculators/tds.rb

@@ -35,7 +35,14 @@ module HrLite
         taxable = [ projected - deductions, BigDecimal(0) ].max
 
         slab_tax = slab_tax_for(taxable, table[:slabs])
-        slab_tax = BigDecimal(0) if taxable <= table[:rebate_cap] # §87A full rebate
+        if taxable <= table[:rebate_cap]
+          slab_tax = BigDecimal(0) # §87A full rebate
+        elsif table[:marginal_relief]
+          # Just past the cliff the tax may not exceed the income earned above
+          # it — without this, one rupee over ₹12,00,000 costs ~₹60,000 of tax.
+          # Old regime carries no such relief, hence the per-regime flag.
+          slab_tax = [ slab_tax, taxable - table[:rebate_cap] ].min
+        end
         annual = Money.round_to_10(slab_tax * (1 + table[:cess_rate]))
 
         monthly = Money.round_rupee((annual - Money.d(fy_tds_paid)) / months_remaining)

data/app/services/hr_lite/leave_day_counter.rb

@@ -3,19 +3,24 @@ module HrLite
   # company-wide holidays inside the range are free; a half-day (single-day
   # requests only) consumes 0.5.
   module LeaveDayCounter
-    def self.count(leave_request)
+    # `calendar:` lets a caller counting many requests over the same span
+    # build ONE calendar and reuse it. Each one costs a Holiday query and a
+    # Setting query, and the balances grid counts every approved request of
+    # every employee for every leave type.
+    def self.count(leave_request, calendar: nil)
       count_range(
         start_date: leave_request.start_date,
         end_date: leave_request.end_date,
-        half_day: leave_request.half_day
+        half_day: leave_request.half_day,
+        calendar: calendar
       )
     end
 
-    def self.count_range(start_date:, end_date:, half_day: false)
+    def self.count_range(start_date:, end_date:, half_day: false, calendar: nil)
       return 0 if start_date.nil? || end_date.nil? || end_date < start_date
 
       range = start_date..end_date
-      working = WorkingCalendar.new(range).working_days_in(range)
+      working = (calendar || WorkingCalendar.new(range)).working_days_in(range)
       return BigDecimal("0.5") if half_day && working.positive?
 
       BigDecimal(working)

data/app/services/hr_lite/overview_query.rb

@@ -15,6 +15,17 @@ module HrLite
       LeaveRequest.active_on(@date).includes(:leave_type, :user).order(:start_date)
     end
 
+    # Comp-off and regularization are approvals too. Counting leave alone made
+    # the board announce "All present and accounted for" while both queues
+    # still had work in them.
+    def pending_comp_offs
+      CompOffRequest.pending.includes(:user).recent_first
+    end
+
+    def pending_regularizations
+      RegularizationRequest.pending.includes(:user).recent_first
+    end
+
     def flagged_today
       AttendanceRecord.for_date(@date).flagged.includes(:user)
     end
@@ -25,7 +36,7 @@ module HrLite
 
     def kpis
       {
-        pending: pending_requests.count,
+        pending: pending_requests.count + pending_comp_offs.count + pending_regularizations.count,
         on_leave: on_leave_today.count,
         flagged: flagged_today.count,
         missing_checkout: missing_checkout_yesterday.count

data/app/services/hr_lite/payroll_run_processor.rb

@@ -31,6 +31,11 @@ module HrLite
             run: @run, user: user, structure: structure, profile: profile,
             lop_override: slip.lop_override, tds_override: slip.tds_override
           )
+          if attributes[:total_deductions] > attributes[:gross_earnings]
+            warnings << "Deductions exceed earnings for #{HrLite.display_name(user)} — " \
+                        "net pay floored at zero, review the overrides"
+          end
+
           slip.assign_attributes(attributes)
           slip.save!
           keep_ids << slip.id

data/app/services/hr_lite/slip_builder.rb

@@ -21,8 +21,14 @@ module HrLite
     def call
       summary = AttendanceSummary.for(user: @user, month: @run.period_month)
       days_in_month = summary[:days_in_month]
-      lop = Money.d(@lop_override || summary[:lop_days])
-      payable = [ Money.d(days_in_month) - Money.d(summary[:out_of_window]) - lop, Money.d(0) ].max
+      # Clamped defensively: a stored negative override (written before the
+      # controller bounded them) would otherwise pay more days than the month has.
+      lop = [ Money.d(@lop_override || summary[:lop_days]), BigDecimal(0) ].max
+      # `upcoming` is normally zero — PayrollRun refuses a month that has not
+      # ended — but subtracting it means a legacy run for an open month cannot
+      # pay for days nobody has worked yet.
+      payable = [ Money.d(days_in_month) - Money.d(summary[:out_of_window]) -
+                  Money.d(summary[:upcoming]) - lop, Money.d(0) ].max
 
       earnings = Calculators::Proration.call(
         structure: @structure, payable_days: payable, days_in_month: days_in_month
@@ -44,7 +50,7 @@ module HrLite
         )
       end
 
-      esi = Calculators::Esi.call(monthly_gross: @structure.monthly_gross, gross_earned: gross_earned,
+      esi = Calculators::Esi.call(monthly_gross: esi_reference_gross, gross_earned: gross_earned,
                                   applicable: @structure.esi_applicable, rates: @rates[:esi])
       if esi.applicable?
         deductions << { code: "esi_employee", label: "ESI", amount: esi.employee }
@@ -60,8 +66,12 @@ module HrLite
         regime: @profile.tax_regime,
         structure_monthly_gross: @structure.monthly_gross,
         gross_earned_this_month: gross_earned,
-        fy_gross_paid: fy[:gross],
-        fy_tds_paid: fy[:tds],
+        # Plus anything paid this FY that this install never ran — a previous
+        # employer, or the months before payroll was switched on. Without it a
+        # mid-year start projects those months as zero income and can land the
+        # whole year under the rebate cap.
+        fy_gross_paid: fy[:gross] + Money.d(@profile.fy_opening_gross),
+        fy_tds_paid: fy[:tds] + Money.d(@profile.fy_opening_tds),
         months_remaining: months_remaining_in_fy,
         declared_annual_deductions: @profile.declared_annual_deductions,
         rates: @rates[:income_tax],
@@ -75,6 +85,9 @@ module HrLite
         period_month: @run.period_month,
         days_in_month: days_in_month,
         payable_days: payable,
+        # Recorded so the slip can say WHY a mid-month joiner's payable days
+        # are short, instead of looking like days went missing.
+        out_of_window_days: Money.d(summary[:out_of_window]),
         lop_days: Money.d(summary[:lop_days]),
         lop_override: @lop_override,
         tds_override: @tds_override,
@@ -84,17 +97,50 @@ module HrLite
         tax_details: tds.details.to_json,
         gross_earnings: gross_earned,
         total_deductions: total_deductions,
-        net_pay: gross_earned - total_deductions,
+        # A heavy-LOP month can leave TDS (projected from the full structure)
+        # larger than what was actually earned. Nobody is paid a negative
+        # salary; PayrollRunProcessor warns when this floor bites.
+        net_pay: [ gross_earned - total_deductions, BigDecimal(0) ].max,
         computed_at: Time.current
       }
     end
 
     private
 
-    # Months left in the Indian FY including the run month itself.
+    # Months left in the Indian FY (Apr–Mar) including the run month itself:
+    # April = 12, December = 4, January = 3, March = 1. Capped at the exit
+    # month for a leaver, so a final settlement is not spread over months
+    # that will never be paid.
     def months_remaining_in_fy
       month = @run.period_month.month
-      month >= 4 ? (15 - month) : (3 - month + 1)
+      calendar = month >= 4 ? (16 - month) : (4 - month)
+      exit_date = @profile&.date_of_exit
+      return calendar if exit_date.nil? || exit_date < @run.period_month
+
+      [ calendar, months_between(@run.period_month, exit_date) ].min
+    end
+
+    def months_between(from, to)
+      (to.year * 12 + to.month) - (from.year * 12 + from.month) + 1
+    end
+
+    # ESIC contribution periods run April–September and October–March.
+    # Eligibility is fixed for the whole period, so it is decided on the
+    # salary in force on its first day — re-deciding it every month dropped
+    # someone out of ESI the moment a mid-period raise crossed the ceiling.
+    def esi_reference_gross
+      month = @run.period_month
+      start = if month.month.between?(4, 9)
+        Date.new(month.year, 4, 1)
+      elsif month.month >= 10
+        Date.new(month.year, 10, 1)
+      else
+        Date.new(month.year - 1, 10, 1)
+      end
+
+      # No structure that far back (a mid-period joiner) — their own is the
+      # only salary this period has ever had.
+      (SalaryStructure.effective_for(@user, start) || @structure).monthly_gross
     end
 
     def serialize_rows(rows)

data/app/views/hr_lite/admin/attendances/index.html.erb

@@ -14,7 +14,10 @@
 
 <div class="hrl-kpis">
   <div class="hrl-kpi"><div class="hrl-kpi__value"><%= @records.values.count { |r| r.check_in_at } %></div><div class="hrl-kpi__label">Checked in</div></div>
-  <div class="hrl-kpi"><div class="hrl-kpi__value"><%= @employees.size - @records.size %></div><div class="hrl-kpi__label">No punch</div></div>
+  <%# Derived from the same predicate as "Checked in". Counting rows instead
+      dropped a record with no check-in out of BOTH tiles, so the numbers
+      quietly stopped adding up to the headcount. %>
+  <div class="hrl-kpi"><div class="hrl-kpi__value"><%= @employees.size - @records.values.count { |r| r.check_in_at } %></div><div class="hrl-kpi__label">No punch</div></div>
   <div class="hrl-kpi"><div class="hrl-kpi__value"><%= @flagged_count %></div><div class="hrl-kpi__label">Flagged</div></div>
   <div class="hrl-kpi"><div class="hrl-kpi__value"><%= @records.values.count { |r| r.check_in_at && r.check_out_at.nil? } %></div><div class="hrl-kpi__label">Still in</div></div>
 </div>

data/app/views/hr_lite/admin/comp_off_requests/show.html.erb

@@ -29,18 +29,32 @@
 </section>
 
 <% if @request.pending? %>
+  <%# Approve and reject are two separate forms on purpose. Rails binds the
+      CSRF token to the form's OWN action, so one form retargeted with
+      `formaction:` can never pass verification on the second endpoint. %>
   <section class="hrl-card">
-    <h2 class="hrl-card__title">Decide</h2>
+    <h2 class="hrl-card__title">Approve</h2>
     <%= form_with url: hr_lite.approve_admin_comp_off_request_path(@request), method: :post, local: true do |f| %>
       <div class="hrl-field">
-        <%= f.label :decision_note, "Note (required to reject, optional to approve)" %>
-        <%= f.text_area :decision_note %>
+        <%= f.label :decision_note, "Note (optional)", for: "approve_note" %>
+        <%= f.text_area :decision_note, id: "approve_note" %>
       </div>
       <div class="hrl-form-actions">
         <%= f.button "Approve — credit #{@request.credit_days.to_f} day",
                      type: :submit, class: "hrl-btn hrl-btn--primary" %>
-        <%= f.button "Reject", type: :submit, class: "hrl-btn hrl-btn--danger",
-                     formaction: hr_lite.reject_admin_comp_off_request_path(@request) %>
+      </div>
+    <% end %>
+  </section>
+
+  <section class="hrl-card">
+    <h2 class="hrl-card__title">Reject</h2>
+    <%= form_with url: hr_lite.reject_admin_comp_off_request_path(@request), method: :post, local: true do |f| %>
+      <div class="hrl-field">
+        <%= f.label :decision_note, "Reason (required)", for: "reject_note" %>
+        <%= f.text_area :decision_note, id: "reject_note" %>
+      </div>
+      <div class="hrl-form-actions">
+        <%= f.button "Reject", type: :submit, class: "hrl-btn hrl-btn--danger" %>
       </div>
     <% end %>
   </section>

data/app/views/hr_lite/admin/employees/_form.html.erb

@@ -41,9 +41,16 @@
     <div class="hrl-field"><%= f.label :designation %><%= f.text_field :designation %></div>
     <div class="hrl-field">
       <%= f.label :manager_id, "Reports to (their L1)" %>
+      <%# The current manager stays listed even after they exit. Dropping them
+          left the select with no matching option, so the browser preselected
+          the blank one and saving anything silently wiped the reporting line
+          of everyone whose manager had left. %>
+      <% candidates = HrLite.active_employees.reject { |u| u.id == profile.user_id } %>
+      <% if profile.manager && candidates.none? { |u| u.id == profile.manager_id } %>
+        <% candidates += [ profile.manager ] %>
+      <% end %>
       <%= f.select :manager_id,
-                   HrLite.active_employees.reject { |u| u.id == profile.user_id }
-                         .map { |u| [ HrLite.display_name(u), u.id ] },
+                   candidates.map { |u| [ HrLite.display_name(u), u.id ] },
                    include_blank: "— nobody (top of the org) —" %>
     </div>
     <div class="hrl-field"><%= f.label :department %><%= f.text_field :department %></div>
@@ -68,6 +75,17 @@
       <%= f.label :declared_annual_deductions, "Declared annual deductions (old regime only)" %>
       <%= f.number_field :declared_annual_deductions, step: 0.01, value: profile.declared_annual_deductions&.to_s("F") %>
     </div>
+    <%# Only what THIS install has paid is visible to the tax projection, so a
+        mid-year start (or a joiner from another employer) needs the earlier
+        months stated here or the year under-deducts. %>
+    <div class="hrl-field">
+      <%= f.label :fy_opening_gross, "Gross already paid this FY elsewhere (previous employer, or before payroll started here)" %>
+      <%= f.number_field :fy_opening_gross, step: 0.01, value: profile.fy_opening_gross&.to_s("F") %>
+    </div>
+    <div class="hrl-field">
+      <%= f.label :fy_opening_tds, "TDS already deducted this FY elsewhere" %>
+      <%= f.number_field :fy_opening_tds, step: 0.01, value: profile.fy_opening_tds&.to_s("F") %>
+    </div>
     <div class="hrl-form-actions">
       <%= f.submit "Save profile", class: "hrl-btn hrl-btn--primary" %>
       <a class="hrl-btn" href="<%= hr_lite.admin_employees_path %>">Cancel</a>

data/app/views/hr_lite/admin/employees/show.html.erb

@@ -35,23 +35,33 @@
   </section>
 <% end %>
 
-<% if @profile.date_of_exit.nil? %>
-  <section class="hrl-card">
-    <h2 class="hrl-card__title">Offboard</h2>
+<%# Stays on the page after an exit date is stamped. Accepting a resignation
+    stamps one, and hiding this card at that moment removed the only control
+    that revokes sign-in — during the notice period, when it is needed. %>
+<section class="hrl-card">
+  <h2 class="hrl-card__title"><%= @profile.date_of_exit ? "Revoke access" : "Offboard" %></h2>
+  <% if @profile.date_of_exit %>
+    <p class="hrl-small hrl-muted">Last day is <%= @profile.date_of_exit.strftime("%d %b %Y") %> —
+      attendance and payroll already clip to it. Run this on or after that day to revoke
+      sign-in. Records are never deleted.</p>
+  <% else %>
     <p class="hrl-small hrl-muted">Stamps the last day (attendance and payroll clip to it) and revokes sign-in.
       Records are never deleted.</p>
-    <%= form_with url: hr_lite.offboard_admin_employee_path(@profile), method: :post, local: true,
-                  html: { data: { turbo_confirm: "Offboard #{hr_display_name(@profile.user)}?" } } do %>
-      <div class="hrl-field">
-        <label for="off_date">Last working day</label>
-        <input type="date" id="off_date" name="date_of_exit" class="hrl-input" value="<%= Date.current %>">
-      </div>
-      <div class="hrl-form-actions">
-        <button class="hrl-btn hrl-btn--danger" type="submit">Offboard employee</button>
-      </div>
-    <% end %>
-  </section>
-<% end %>
+  <% end %>
+  <%= form_with url: hr_lite.offboard_admin_employee_path(@profile), method: :post, local: true,
+                html: { data: { turbo_confirm: "Offboard #{hr_display_name(@profile.user)}?" } } do %>
+    <div class="hrl-field">
+      <label for="off_date">Last working day</label>
+      <input type="date" id="off_date" name="date_of_exit" class="hrl-input"
+             value="<%= @profile.date_of_exit || Date.current %>">
+    </div>
+    <div class="hrl-form-actions">
+      <button class="hrl-btn hrl-btn--danger" type="submit">
+        <%= @profile.date_of_exit ? "Revoke access now" : "Offboard employee" %>
+      </button>
+    </div>
+  <% end %>
+</section>
 
 <div class="hrl-grid hrl-grid--2">
   <section class="hrl-card">

data/app/views/hr_lite/admin/leave_requests/show.html.erb

@@ -10,7 +10,9 @@
   <dl class="hrl-deflist">
     <dt>Type</dt><dd><%= @request.leave_type.name %> (<%= @request.paid? ? "paid" : "unpaid" %>)</dd>
     <dt>Dates</dt><dd><%= @request.date_range_label %></dd>
-    <dt>Working days</dt><dd><%= @request.days_count.to_f %></dd>
+    <%# Counted live, not from the create-time cache: a holiday added after
+        the request was filed changes what the balance is actually debited. %>
+    <dt>Working days</dt><dd><%= HrLite::LeaveDayCounter.count(@request).to_f %></dd>
     <dt>Status</dt><dd><span class="hrl-badge"><%= @request.status.humanize %></span></dd>
     <% if @request.reason.present? %><dt>Reason</dt><dd><%= @request.reason %></dd><% end %>
     <% unless @request.leave_type.unlimited? %>
@@ -21,18 +23,48 @@
   </dl>
 </section>
 
+<%# An approved leave that has not started yet can still be called off — the
+    balance is recomputed live, so cancelling gives the days straight back. %>
+<% if @request.cancellable_by?(hr_current_user) && !@request.pending? %>
+  <section class="hrl-card">
+    <h2 class="hrl-card__title">Cancel</h2>
+    <p class="hrl-small hrl-muted">Releases the days back to their balance. Only possible
+      before the leave starts.</p>
+    <%= form_with url: hr_lite.cancel_admin_leave_request_path(@request), method: :post, local: true,
+                  html: { data: { turbo_confirm: "Cancel this approved leave?" } } do %>
+      <div class="hrl-form-actions">
+        <button class="hrl-btn hrl-btn--danger" type="submit">Cancel this leave</button>
+      </div>
+    <% end %>
+  </section>
+<% end %>
+
 <% if @request.pending? %>
   <section class="hrl-card">
     <h2 class="hrl-card__title">Decide</h2>
+    <%# Approve and reject are two separate forms on purpose. Rails binds the
+        CSRF token to the form's OWN action, so one form retargeted with
+        `formaction:` can never pass verification on the second endpoint. %>
     <%= form_with url: hr_lite.approve_admin_leave_request_path(@request), method: :post, local: true do %>
       <div class="hrl-field">
-        <label for="decision_note">Note (required to reject)</label>
-        <textarea name="decision_note" id="decision_note" class="hrl-input"></textarea>
+        <label for="approve_note">Note (optional)</label>
+        <textarea name="decision_note" id="approve_note" class="hrl-input"></textarea>
       </div>
       <div class="hrl-form-actions">
         <button class="hrl-btn hrl-btn--primary" type="submit">Approve</button>
-        <button class="hrl-btn hrl-btn--danger" type="submit"
-                formaction="<%= hr_lite.reject_admin_leave_request_path(@request) %>">Reject</button>
+      </div>
+    <% end %>
+  </section>
+
+  <section class="hrl-card">
+    <h2 class="hrl-card__title">Reject</h2>
+    <%= form_with url: hr_lite.reject_admin_leave_request_path(@request), method: :post, local: true do %>
+      <div class="hrl-field">
+        <label for="reject_note">Reason (required)</label>
+        <textarea name="decision_note" id="reject_note" class="hrl-input"></textarea>
+      </div>
+      <div class="hrl-form-actions">
+        <button class="hrl-btn hrl-btn--danger" type="submit">Reject</button>
       </div>
     <% end %>
   </section>