hr_lite 0.5.0 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00cc5c346c88ddc803a5336a1c14a07dd4609fc887213f99e9b11654f26fa109
-  data.tar.gz: 8306411151a38ea5b1fe0fe9c7b4bd3572e16917a1defc1e15d4e823ab7f9c1b
+  metadata.gz: bdcc58ee5fdba440b0f70b9f22b85d85d20ef02f16c92481d4aad89a2395489f
+  data.tar.gz: f705fe091062bbe92246fd19fb1615c9fd9e0f2c6ed34ece293d155cc81879b1
 SHA512:
-  metadata.gz: 6f9be2057c4023881d956fc8feadb18d2917bb38cd92746b7a448a60fedea0fc94d335b22d36a627a8ce888e36a7520ca6118ad77e6f5956b96fdec695f813dc
-  data.tar.gz: 95c8048ecd82dc4b92d9e4e5b79240bed1385e297206383280c76e010d141f666e57eb150eac9defdbe556978226d7b4a5fff21ff8132103e04e09862a36f3ad
+  metadata.gz: c674e21d22c69a6b2ff5e51cbbb329f166140054212d81a2582c5d0b421350a732c94ae2b8074e4da15f4b510f9a0fa5bfceda84c633b57def295c2066276370
+  data.tar.gz: 514bf9fa94450d2ccdd4a7443125ec355dd4d68e99c264eac62fe3b5b3be2034a17a64c94571ef51580b97a8ebd59ba85e0a05a55474e3ec80dd9a4ebf798a7d

data/CHANGELOG.md

@@ -7,6 +7,213 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.3] - 2026-08-17
+
+Correctness and traceability pass, ahead of the permissions work in 0.6.0.
+**Adds one migration** — check constraints on every status column, plus an
+index and foreign key on `hr_lite_designation_changes.appraisal_id`. It
+refuses to run, naming the table and the offending values, if a live row
+already holds a status no model declares.
+
+### Fixed
+
+- **Payroll ran silently on an out-of-date statutory card.** The lookup fell
+  back to the newest card on or before the run month with no signal, so a run
+  in a financial year the gem ships no card for computed PF, ESI, PT and TDS
+  on the previous year's figures and said nothing. It still falls back —
+  payroll cannot stop dead every 1 April — but `PayrollRunProcessor` now puts
+  a warning naming both financial years at the TOP of the run's warnings, on
+  every compute. Adding a year remains one new entry in
+  `StatutoryRateCard::CARDS`; rates are never inferred forward.
+- **A blank email could be granted the leadership tier.** `leadership_check`
+  did not drop empty entries the way `superadmin_check` did, so one stray
+  comma in `HR_LEADERSHIP_EMAILS` ("a@x.com,,b@x.com") put `""` on the list
+  and any user whose email was blank or nil matched it. Both checks now share
+  `HrLite.email_listed?`, which refuses a blank address against any list.
+- Comp-off approval no longer reaches for a plural that cannot occur — a
+  credit is 0.5 or 1 day and never more.
+
+### Added
+
+- **The money path leaves a trail.** Payroll compute, finalize, unlock and
+  publish, every leave approval, rejection and cancellation, and the payout
+  register download now write `AuditLog` rows. Previously a run could be
+  computed, finalized, unlocked, edited and republished and the audit screen
+  showed none of it.
+  - These rows are written inside the same transaction as the change they
+    describe and RAISE on failure, unlike the `Audited` concern, which stays
+    best-effort for ordinary policy edits. A payroll transition nobody can
+    account for afterwards does not happen at all.
+  - Amounts are deliberately excluded — `audit_logs` is not encrypted. Rows
+    record who moved a run, how far, and over how many people. Leave rows
+    carry the approver's note and never the employee's own reason.
+  - `HrLite::PayrollRun` and `HrLite::SalarySlip` join `MONEY_TIER_TYPES`, so
+    payroll rows stay out of the leadership audit screen.
+- `HrLite::AuditLog.record!` — the five-line `create!` that five call sites
+  had each written out.
+- `HrLite::FinancialYear` — the Indian FY (1 April) worked out in one place
+  instead of three.
+
+### Changed
+
+- Statuses are enforced by the database. `update_column`, `update_all`,
+  `insert_all` and console fixes can no longer write a value that no screen
+  renders and no transition accepts.
+- The suite enforces its own coverage: 100% line, 90% branch, 90% per file.
+  The README claimed 100% and nothing checked it; switching the floor on found
+  eight untested paths, including all three slip-override money guards (LOP
+  above the days in the month, negative LOP, negative TDS) and the offboarding
+  error path. All are covered now.
+- `docs/PAYROLL.md` no longer lists ESI contribution-period lock-in as
+  unmodelled — 0.5.2 implemented it.
+
+## [0.5.2] - 2026-08-08
+
+The rest of the audit that produced 0.5.1. **Adds three migrations** — they
+run through the host's normal `db:migrate`; each table holds a handful of
+rows per employee, so the builds are instant.
+
+### Fixed
+
+- **Payroll accepted a run for a month that had not ended.** Days that have
+  not happened score as `upcoming`, which fed straight into payable days, so
+  computing mid-month paid for every remaining day as if it had been worked —
+  and finalizing froze that into immutable slips. `parse_month_param` made it
+  easy to reach: a mangled month fell back to the current one.
+- **ESI eligibility was re-decided every month.** ESIC contribution periods run
+  April–September and October–March and eligibility holds for the whole
+  period; a mid-period raise past the ceiling used to end coverage on the spot.
+- **A mid-year install deducted no tax.** TDS projected the year only from
+  slips this install produced, so earlier months — a previous employer, or the
+  months before payroll was switched on — read as zero income and usually put
+  the year under the rebate cap. `EmployeeProfile` gains `fy_opening_gross`
+  and `fy_opening_tds`.
+- Regularization now re-checks the approved-leave conflict at approval. Leave
+  granted while the ticket waited made the fix a silent no-op, because
+  full-day leave outranks any punch — while everyone was told attendance had
+  been corrected.
+- Admins can cancel leave. `cancellable_by?` always allowed it for approved
+  leave that has not started, but no route reached it, so leave called off
+  while someone was away could not be released and the quota stayed spent.
+- One open resignation per person, one pending regularization per person per
+  day, and one leave type carrying the comp-off flag are now enforced by
+  partial unique indexes, not only by validations that race. Retiring the
+  flagged comp-off type releases the flag so a replacement can take it.
+- An employee whose resignation was already accepted can no longer file
+  another, which would have overwritten the agreed exit date.
+- `Audited` fires on commit. Firing inside the transaction announced changes
+  to leadership that then rolled back — a failed onboarding mailed out a diff
+  for a profile that was never saved.
+- Slips record and show days outside the employment window, so a mid-month
+  joiner's payslip adds up instead of looking short.
+- The career page dates the current role from the change actually in force,
+  not from a promotion recorded for next quarter.
+- The org chart's reporting line stops at the first manager who has left; it
+  used to skip them and promote everyone above a level, contradicting the
+  tree below.
+- Publishing no longer bells offboarded people at a page their revoked login
+  cannot open. They still get the email.
+- Leadership copies of employee-scoped notifications are named and point at a
+  page leadership can open. "Your appraisal has been shared" linking to
+  `/appraisals/7` was fanned out verbatim; the leadership copy also drops the
+  rating, which is money-tier.
+
+### Performance
+
+- `LeaveBalance#used` builds one working calendar for the leave year instead
+  of one per approved request — measured 11 queries down to 1 for five
+  requests, and the admin balances grid multiplies that by employees × leave
+  types.
+- `HrLite.admin_users` starts from `employees_scope` rather than loading and
+  instantiating every row in the users table on each admin notification.
+
+## [0.5.1] - 2026-08-07
+
+Bug-fix release from a full audit of the engine. No migrations, no
+configuration changes required.
+
+### Fixed
+
+- **Every admin "Reject" button returned a 422.** The decision screens
+  rendered one form pointed at the approve endpoint and retargeted the
+  Reject button with `formaction:`. Rails binds the authenticity token to
+  the form's own action and method (`per_form_csrf_tokens`, the default
+  since `load_defaults 5.0`), so that token was never valid at the reject
+  path. Comp-off, leave and regularization rejections could not be made
+  from a browser at all. Each screen now renders separate Approve and
+  Reject forms.
+- **`PayrollRun#compute!` demoted any run — including a published one — to
+  `draft`.** The `raise_unless` guard raised inside the method-level
+  rescue, which then rewrote the status. Draft runs are deletable and the
+  delete cascades over every salary slip. The guard now sits outside the
+  rescue and the previous status is restored; a run stranded in
+  `processing` is recoverable.
+- **TDS was wrong on every slip from April to December**: months remaining
+  in the financial year read `15 - month` instead of `16 - month`.
+- TDS to-date counted published slips only, so a finalized-but-unpublished
+  month projected as zero income; §115BAC marginal relief above the rebate
+  cap was missing; a leaver's projection ran past their exit month.
+- Net pay is floored at zero and the run warns when deductions exceed
+  earnings. Review-stage LOP and TDS overrides are bounded.
+- **A configured superadmin absent from `leadership_emails` was locked out
+  of the money tier entirely.** `SuperadminController` no longer inherits
+  the leadership check, and the Payroll nav item hangs off the money tier.
+- Appraisal ratings and review text reached ordinary leadership through
+  the audit screen and the `policy.changed` email; money-tier subjects are
+  excluded from both.
+- Accepting a resignation stamped an exit date, which hid the only control
+  that revokes sign-in. The card stays, and access is revoked immediately
+  when the last day has already passed.
+- Onboarding created the login before validating the profile and outside
+  any transaction, leaving orphaned role-bearing accounts behind.
+- A backdated `DesignationChange` overwrote the current designation and
+  pushed it to the host; only the newest row applies now.
+- Editing a profile whose manager had exited silently cleared the
+  reporting line, because the select offered no matching option.
+- Leave: creation and approval use the same as-of date (future-dated
+  requests on monthly accrual could be filed but never approved); approval
+  locks the balance row rather than the request row; the stored adjustment
+  has one locked write path; entitlement stops accruing at the exit date;
+  the comp-off flag can be moved to a replacement leave type.
+- Attendance: a check-out with no check-in is refused; clearing both times
+  on a day with no punch no longer writes a bogus audit row or emails a
+  removal that never happened; the punch card offers yesterday's check-out
+  after midnight; `geo_status` is confined to what a browser can report.
+- The overview board counts and lists comp-off and regularization, and the
+  team attendance KPIs add up to the headcount again.
+- One bad recipient no longer drops the rest of a notification fan-out.
+- The slip PDF formats money like the web slip; amounts in words handle
+  negatives and figures above ₹100 crore; professional-tax slabs gained an
+  inclusive `from:` bound.
+
+### Added
+
+- A **More** tab on phones, opening a sheet with every nav item and every
+  group the viewer is entitled to. Below 768px the left rail is hidden and
+  the tab bar holds five items, so the rest of the app — including all
+  admin, leadership and payroll screens — was unreachable.
+- Confirmation prompts that actually run. The engine ships no Turbo, so
+  its `data-turbo-confirm` attributes were inert and destructive buttons
+  fired on the first click. A small script reads the same attribute and
+  stands aside when a host does load Turbo.
+- A retry policy on the engine's jobs, which had never inherited
+  `ApplicationJob`.
+
+### Documentation
+
+- Reworked the README to open-source standard: a shields.io badge row, a table
+  of contents, a per-feature usage guide (attendance and geolocation; leave,
+  comp-off and regularization; payroll; kudos and @mentions; the notification
+  bus), and sections for the recurring jobs, rake tasks and the install
+  generator.
+- Documented the leadership and superadmin (money) access tiers, and the
+  `HR_LEADERSHIP_EMAILS` convention the generated initializer uses to keep the
+  governing list out of a deploy.
+- Filled gaps in `docs/CONFIGURATION.md`: the `superadmin_check`,
+  `public_url_base`, `onboard_user`, `offboard_user` and `invite_url_for`
+  keys, and the `resignation.*`, `employee.onboarded` and `payroll.draft_ready`
+  rows of the notification matrix.
+
 ## [0.5.0] - 2026-07-20
 
 ### Added
@@ -202,5 +409,15 @@ Initial release.
   bus with per-event channel matrix (bell, email, leadership email/bell),
   daily leadership digest and an append-only audit trail.
 
-[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.5.3...HEAD
+[0.5.3]: https://github.com/kshtzkr/hr_lite/compare/v0.5.2...v0.5.3
+[0.5.2]: https://github.com/kshtzkr/hr_lite/compare/v0.5.1...v0.5.2
+[0.5.1]: https://github.com/kshtzkr/hr_lite/compare/v0.5.0...v0.5.1
+[0.5.0]: https://github.com/kshtzkr/hr_lite/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/kshtzkr/hr_lite/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/kshtzkr/hr_lite/compare/v0.2.1...v0.3.0
+[0.2.1]: https://github.com/kshtzkr/hr_lite/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/kshtzkr/hr_lite/compare/v0.1.2...v0.2.0
+[0.1.2]: https://github.com/kshtzkr/hr_lite/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/kshtzkr/hr_lite/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/kshtzkr/hr_lite/releases/tag/v0.1.0