hr_lite 0.5.0 → 0.5.3

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -7,7 +7,9 @@ module HrLite
     class EmployeesController < LeadershipController
       def index
         @profiles = paginate(EmployeeProfile.includes(:user).order(:employee_code))
-        @users_without_profile = HrLite.employees.reject { |u| EmployeeProfile.exists?(user_id: u.id) }
+        # One pluck instead of an EXISTS query per employee.
+        profiled = EmployeeProfile.pluck(:user_id).to_set
+        @users_without_profile = HrLite.employees.reject { |u| profiled.include?(u.id) }
         @pending_resignations = Resignation.pending.includes(:user).recent_first
       end
 
@@ -24,17 +26,26 @@ module HrLite
       def create
         new_login = params.dig(:employee_profile, :new_user_email).present?
         @profile = EmployeeProfile.new(profile_params)
+        saved = false
 
-        if new_login
-          user = HrLite.config.onboard_user.call(
-            name: params.dig(:employee_profile, :new_user_name).to_s,
-            email: params.dig(:employee_profile, :new_user_email).to_s.strip,
-            password: params.dig(:employee_profile, :new_user_password).to_s
-          )
-          @profile.user_id = user.id
+        # One transaction: a profile that fails validation used to leave the
+        # freshly-created login committed — a role-bearing account with no HR
+        # profile, invisible on every HR screen.
+        ActiveRecord::Base.transaction do
+          if new_login
+            user = HrLite.config.onboard_user.call(
+              name: params.dig(:employee_profile, :new_user_name).to_s,
+              email: params.dig(:employee_profile, :new_user_email).to_s.strip,
+              password: params.dig(:employee_profile, :new_user_password).to_s
+            )
+            @profile.user_id = user.id
+          end
+
+          saved = @profile.save
+          raise ActiveRecord::Rollback unless saved
         end
 
-        if @profile.save
+        if saved
           if new_login
             invite_url = HrLite.config.invite_url_for&.call(@profile.user)
             Notifications.publish(
@@ -66,7 +77,7 @@ module HrLite
 
       def update
         @profile = EmployeeProfile.find(params[:id])
-        if @profile.update(profile_params)
+        if @profile.update(update_profile_params)
           redirect_to admin_employee_path(@profile), notice: "Employee profile updated."
         else
           render :edit, status: :unprocessable_entity
@@ -77,7 +88,9 @@ module HrLite
       # access via the host hook. Audited via the profile update.
       def offboard
         @profile = EmployeeProfile.find(params[:id])
-        exit_date = params[:date_of_exit].presence&.to_date || Date.current
+        # `.to_date` on a raw param raises Date::Error and 500s; the
+        # controller's own parser exists for exactly this.
+        exit_date = params[:date_of_exit].present? ? parse_date_param(params[:date_of_exit]) : Date.current
 
         @profile.update!(date_of_exit: exit_date)
         begin
@@ -87,6 +100,8 @@ module HrLite
         end
         redirect_to admin_employee_path(@profile),
                     notice: "Offboarded — last day #{exit_date.strftime('%d %b %Y')}, access revoked."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_employee_path(@profile), alert: e.record.errors.full_messages.to_sentence
       end
 
       private
@@ -95,9 +110,18 @@ module HrLite
         params.require(:employee_profile).permit(
           :user_id, :manager_id, :designation, :date_of_birth, :date_of_joining,
           :date_of_exit, :department, :work_location, :pan_number, :pf_uan, :esi_number,
-          :bank_account_number, :bank_ifsc, :bank_name, :tax_regime, :declared_annual_deductions
+          :bank_account_number, :bank_ifsc, :bank_name, :tax_regime, :declared_annual_deductions,
+          :fy_opening_gross, :fy_opening_tds
         )
       end
+
+      # user_id says WHOSE profile this is, and salary structures, appraisals
+      # and slips all key off it independently. Repointing an existing profile
+      # hands one person's PAN, bank details and pay history to another, so it
+      # is a create-time field only.
+      def update_profile_params
+        profile_params.except(:user_id)
+      end
     end
   end
 end

data/app/controllers/hr_lite/admin/leave_balances_controller.rb

@@ -2,8 +2,7 @@ module HrLite
   module Admin
     class LeaveBalancesController < BaseController
       def index
-        year = params[:year].to_i
-        @year = year.between?(2000, 2100) ? year : LeaveYear.current_key
+        @year = sanitized_year
         @types = LeaveType.active.where(paid: true).where.not(annual_quota: nil)
         @employees = HrLite.employees
       end
@@ -12,7 +11,9 @@ module HrLite
       def adjust
         user = HrLite.user_klass.find(params[:user_id])
         type = LeaveType.find(params[:leave_type_id])
-        year = params[:year].to_i
+        # Unsanitised, a missing param wrote the adjustment into leave year 0,
+        # where no screen can ever show it.
+        year = sanitized_year
         delta = BigDecimal(params[:delta].to_s)
         note = params[:note].to_s.strip
 
@@ -20,21 +21,26 @@ module HrLite
           return redirect_to admin_leave_balances_path(year: year), alert: "A note is required."
         end
 
-        balance = LeaveBalance.for(user, type, year)
-        balance.adjustment += delta
-        balance.adjustment_note = [ balance.adjustment_note.presence, "#{delta.to_f} — #{note}" ].compact.join("; ")
-        balance.save!
+        balance = LeaveBalance.adjust!(user, type, year, delta: delta, note: "#{delta.to_f} — #{note}")
 
-        AuditLog.create!(
-          actor: hr_current_user, action: "adjust",
-          subject_type: balance.class.name, subject_id: balance.id,
-          audited_changes: { "user" => HrLite.display_name(user), "type" => type.code,
-                             "delta" => delta.to_f, "note" => note }
+        AuditLog.record!(
+          action: "adjust", subject: balance, actor: hr_current_user,
+          changes: { "user" => HrLite.display_name(user), "type" => type.code,
+                     "delta" => delta.to_f, "note" => note }
         )
         redirect_to admin_leave_balances_path(year: year),
                     notice: "Balance adjusted for #{HrLite.display_name(user)}."
       rescue ArgumentError
-        redirect_to admin_leave_balances_path, alert: "Enter a valid adjustment number."
+        # Keep the admin on the year they were looking at.
+        redirect_to admin_leave_balances_path(year: sanitized_year),
+                    alert: "Enter a valid adjustment number."
+      end
+
+      private
+
+      def sanitized_year
+        year = params[:year].to_i
+        year.between?(2000, 2100) ? year : LeaveYear.current_key
       end
     end
   end

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -24,6 +24,22 @@ module HrLite
         redirect_to admin_leave_request_path(request), alert: "Only pending requests can be decided."
       end
 
+      # LeaveRequest#cancellable_by? has always allowed an admin to call off
+      # approved future leave, but no route reached it — the only cancel action
+      # was the employee's own, scoped to their own rows. A trip called off
+      # while the person was unreachable, or after they were offboarded, could
+      # not be released at all, and the quota stayed spent.
+      def cancel
+        request = LeaveRequest.find(params[:id])
+        if request.cancellable_by?(hr_current_user)
+          request.cancel!(actor: hr_current_user)
+          redirect_to admin_leave_requests_path, notice: "Leave cancelled — the balance is released."
+        else
+          redirect_to admin_leave_request_path(request),
+                      alert: "Only pending leave, or approved leave that has not started, can be cancelled."
+        end
+      end
+
       def reject
         request = LeaveRequest.find(params[:id])
         note = params[:decision_note].to_s.strip

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -55,8 +55,17 @@ module HrLite
       # deliberately leadership-only PII.
       def register
         run = PayrollRun.find(params[:id])
-        send_data register_csv(run), filename: "payroll-register-#{run.period_month.strftime('%Y-%m')}.csv",
-                                     type: "text/csv"
+        csv = register_csv(run)
+        # A GET that walks out of the building with every employee's pay and
+        # bank account. Nothing else in the module leaks this much in one
+        # click, so the download itself is the auditable event.
+        AuditLog.record!(
+          action: "payroll.register_exported", subject: run, actor: hr_current_user,
+          changes: { "period" => run.label, "rows" => run.salary_slips.count,
+                     "includes_bank_details" => true }
+        )
+        send_data csv, filename: "payroll-register-#{run.period_month.strftime('%Y-%m')}.csv",
+                       type: "text/csv"
       end
 
       private

data/app/controllers/hr_lite/admin/resignations_controller.rb

@@ -5,13 +5,25 @@ module HrLite
         resignation = Resignation.find(params[:id])
         resignation.accept!(
           actor: hr_current_user,
-          last_day: params[:last_day].presence&.to_date,
+          # `.to_date` on a raw param raises Date::Error and 500s; the
+          # controller's own parser exists for exactly this.
+          last_day: params[:last_day].presence && parse_date_param(params[:last_day]),
           note: params[:note]
         )
-        redirect_to admin_employees_path,
-                    notice: "Resignation accepted — exit date recorded on the profile."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_employees_path, alert: "Only pending resignations can be accepted."
+        notice = if resignation.exit_date_recorded?
+          "Resignation accepted — exit date recorded on the profile."
+        else
+          "Resignation accepted. No employee profile exists for " \
+            "#{hr_display_name(resignation.user)}, so no exit date was recorded — " \
+            "create the profile to clip attendance and payroll."
+        end
+        redirect_to admin_employees_path, notice: notice
+      rescue ActiveRecord::RecordInvalid => e
+        # A rejected exit date used to be reported as "not pending", which was
+        # simply the wrong reason: the transaction rolls back either way.
+        message = resignation.reload.pending? ? e.record.errors.full_messages.to_sentence
+                                              : "Only pending resignations can be accepted."
+        redirect_to admin_employees_path, alert: message
       end
     end
   end

data/app/controllers/hr_lite/admin/salary_slips_controller.rb

@@ -20,20 +20,34 @@ module HrLite
         tds_override = params.dig(:salary_slip, :tds_override).presence
         profile = EmployeeProfile.find_by(user_id: slip.user_id)
         structure = SalaryStructure.effective_for(slip.user, run.period_month)
+        if structure.nil?
+          return redirect_to admin_salary_slip_path(slip),
+                             alert: "No salary structure is effective for #{run.label} — add one first."
+        end
+
+        lop = lop_override && BigDecimal(lop_override)
+        tds = tds_override && BigDecimal(tds_override)
+        # Unbounded overrides are a money bug, not a typo: a negative LOP pays
+        # for days never worked, one above the month zeroes the person out.
+        if lop && !lop.between?(0, slip.days_in_month)
+          return redirect_to admin_salary_slip_path(slip),
+                             alert: "LOP days must be between 0 and #{slip.days_in_month}."
+        end
+        if tds&.negative?
+          return redirect_to admin_salary_slip_path(slip), alert: "TDS cannot be negative."
+        end
 
         attributes = SlipBuilder.call(
           run: run, user: slip.user, structure: structure, profile: profile,
-          lop_override: lop_override && BigDecimal(lop_override),
-          tds_override: tds_override && BigDecimal(tds_override)
+          lop_override: lop, tds_override: tds
         )
         slip.update!(attributes)
 
-        AuditLog.create!(
-          actor: hr_current_user, action: "override",
-          subject_type: slip.class.name, subject_id: slip.id,
-          audited_changes: { "period" => run.label, "employee" => HrLite.display_name(slip.user),
-                             "lop_override" => lop_override || "cleared",
-                             "tds_override" => tds_override ? "[changed]" : "cleared" }
+        AuditLog.record!(
+          action: "override", subject: slip, actor: hr_current_user,
+          changes: { "period" => run.label, "employee" => HrLite.display_name(slip.user),
+                     "lop_override" => lop_override || "cleared",
+                     "tds_override" => tds_override ? "[changed]" : "cleared" }
         )
         redirect_to admin_salary_slip_path(slip), notice: "Slip recomputed with overrides."
       rescue ArgumentError

data/app/controllers/hr_lite/admin/superadmin_controller.rb

@@ -3,7 +3,12 @@ module HrLite
     # Money tier: salary structures, payroll, slips, appraisals and
     # promotions. Only config.superadmin_emails — ordinary leadership can
     # govern policy and people but never sees another person's pay.
+    # The money tier stands on its own rather than layering on leadership: a
+    # payroll operator does not have to also govern people and policy.
+    # Inheriting the leadership check locked a configured superadmin who was
+    # absent from leadership_emails out of payroll entirely.
     class SuperadminController < LeadershipController
+      skip_before_action :require_hr_leadership!
       before_action :require_hr_superadmin!
 
       private

data/app/controllers/hr_lite/org_controller.rb

@@ -10,8 +10,13 @@ module HrLite
       @by_user = profiles.index_by(&:user_id)
       build_tree(profiles)
       @own_profile = @by_user[hr_current_user.id]
+      # STOPS at the first exited manager rather than skipping past them. The
+      # L-labels are positional, so dropping a link from the middle promoted
+      # everyone above it — the card then called a skip-level manager your L1,
+      # contradicting the tree below, which drops exited managers entirely and
+      # renders their reports as roots.
       exited = EmployeeProfile.where(date_of_exit: ...Date.current).pluck(:user_id).to_set
-      @own_chain = (@own_profile&.reporting_chain || []).reject { |boss| exited.include?(boss.id) }
+      @own_chain = (@own_profile&.reporting_chain || []).take_while { |boss| !exited.include?(boss.id) }
     end
 
     private

data/app/controllers/hr_lite/resignations_controller.rb

@@ -4,7 +4,12 @@ module HrLite
   class ResignationsController < ApplicationController
     def show
       @resignation = own.recent_first.first
-      @new_resignation = Resignation.new(proposed_last_day: Date.current + 30) unless @resignation&.pending?
+      # No form once one is pending OR already accepted: an agreed exit date is
+      # not something to re-file, and accepting a second one would overwrite
+      # the date payroll and attendance already clip to.
+      unless @resignation&.pending? || @resignation&.accepted?
+        @new_resignation = Resignation.new(proposed_last_day: Date.current + 30)
+      end
     end
 
     def create

data/app/helpers/hr_lite/application_helper.rb

@@ -71,19 +71,9 @@ module HrLite
       render "hr_lite/shared/pagination"
     end
 
+    # Delegates to the PORO so the host-rendered slip PDF formats identically.
     def hrl_money(amount)
-      return "—" if amount.nil?
-
-      whole, fraction = HrLite::Money.round2(amount).to_s("F").split(".")
-      sign = whole.start_with?("-") ? "-" : ""
-      whole = whole.delete_prefix("-")
-      # Indian digit grouping: last three digits together, then pairs
-      # (12,34,567 — not the western 1,234,567).
-      if whole.length > 3
-        head = whole[0..-4].reverse.scan(/\d{1,2}/).join(",").reverse
-        whole = "#{head},#{whole[-3..]}"
-      end
-      "#{sign}#{HrLite.config.currency_symbol}#{whole}.#{fraction.ljust(2, '0')}"
+      HrLite::Money.format(amount)
     end
 
     # Indian-system amount in words for the slip footer. Delegates to the

data/app/jobs/hr_lite/application_job.rb

@@ -1,4 +1,9 @@
 module HrLite
+  # Parent of the engine's jobs. It existed but nothing inherited from it, so
+  # no retry policy applied anywhere: a digest or a rollover that hit a
+  # dropped connection was simply lost for that day — or for that year.
   class ApplicationJob < ActiveJob::Base
+    retry_on ActiveRecord::ConnectionNotEstablished, ActiveRecord::Deadlocked,
+             wait: :polynomially_longer, attempts: 5
   end
 end

data/app/jobs/hr_lite/daily_digest_job.rb

@@ -1,7 +1,7 @@
 module HrLite
   # Morning leadership email: who's out, what's pending, what's flagged.
   # Sends nothing on a quiet day.
-  class DailyDigestJob < ActiveJob::Base
+  class DailyDigestJob < ApplicationJob
     queue_as :default
 
     def perform(date: Date.current)

data/app/jobs/hr_lite/leave_year_rollover_job.rb

@@ -4,7 +4,7 @@ module HrLite
   # carry-forward into the new year's balance rows. Idempotent — a balance
   # whose carry has already been written is never touched again (manual
   # adjustments stay safe).
-  class LeaveYearRolloverJob < ActiveJob::Base
+  class LeaveYearRolloverJob < ApplicationJob
     queue_as :default
 
     def perform(year: nil)

data/app/jobs/hr_lite/payroll_auto_draft_job.rb

@@ -3,14 +3,17 @@ module HrLite
   # payroll from attendance and the policy, then tell leadership it is
   # waiting for review. Publishing stays a deliberate human action —
   # the system prepares, people approve.
-  class PayrollAutoDraftJob < ActiveJob::Base
+  class PayrollAutoDraftJob < ApplicationJob
     queue_as :default
 
     def perform(month: Date.current.prev_month.beginning_of_month)
       return unless EmployeeProfile.active_for(month).exists?
 
       run = PayrollRun.find_or_create_by!(period_month: month)
-      return unless run.draft? || run.review?
+      # Only ever drafts an UNTOUCHED run. Accepting `review` as well meant a
+      # re-run recomputed a month somebody was already reviewing and told
+      # leadership all over again that it was waiting for them.
+      return unless run.draft? && run.salary_slips.none?
 
       run.compute!(actor: nil)
       Notifications.publish(

data/app/models/concerns/hr_lite/audited.rb

@@ -9,10 +9,14 @@ module HrLite
     SKIPPED_ATTRIBUTES = %w[updated_at created_at].freeze
     REDACTED = "[changed]".freeze
 
+    # *_commit, not *_create/_update/_destroy: these callbacks write an audit
+    # row and email leadership a diff. Fired inside the transaction they
+    # announce changes that then roll back — a failed onboarding used to mail
+    # out a profile diff for a profile that was never saved.
     included do
-      after_create  { hr_lite_audit!("create") }
-      after_update  { hr_lite_audit!("update") }
-      after_destroy { hr_lite_audit!("destroy") }
+      after_create_commit  { hr_lite_audit!("create") }
+      after_update_commit  { hr_lite_audit!("update") }
+      after_destroy_commit { hr_lite_audit!("destroy") }
     end
 
     private
@@ -63,7 +67,10 @@ module HrLite
         "policy.changed",
         title: "#{actor_name.presence || 'Someone'} #{log.action}d #{subject}",
         body: nil,
-        diff: log.audited_changes
+        # policy.changed fans out to leadership_emails, which is a WIDER list
+        # than the money tier. Leadership may know an appraisal changed; the
+        # ratings and review text inside it are not theirs to read.
+        diff: log.money_tier? ? nil : log.audited_changes
       )
     end
   end

data/app/models/hr_lite/appraisal.rb

@@ -43,7 +43,15 @@ module HrLite
         body: rating ? "Rating: #{rating}/5" : nil,
         path: "/appraisals/#{id}",
         bell_to: [ user ],
-        email_to: [ user ]
+        email_to: [ user ],
+        # Leadership gets the fact, named, pointing somewhere they can open —
+        # but not the rating: appraisal content is money-tier and this list is
+        # wider than that tier.
+        leadership: {
+          title: "#{HrLite.display_name(user)}'s appraisal for #{period_label} was shared",
+          body: nil,
+          path: "/admin/employees"
+        }
       )
       true
     end

data/app/models/hr_lite/audit_log.rb

@@ -8,7 +8,43 @@ module HrLite
 
     validates :action, :subject_type, :subject_id, presence: true
 
+    # Subjects whose CONTENTS belong to the money tier. Salary structures
+    # encrypt their amounts so the diff is already redacted, but appraisal
+    # ratings and review text are plain columns — they must not reach the
+    # leadership audit screen or the policy.changed email.
+    MONEY_TIER_TYPES = %w[
+      HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
+      HrLite::PayrollRun HrLite::SalarySlip
+    ].freeze
+
     scope :recent, -> { order(created_at: :desc) }
+    scope :outside_money_tier, -> { where.not(subject_type: MONEY_TIER_TYPES) }
+
+    # The five-line `create!` that four call sites had each spelled out.
+    #
+    # This RAISES, unlike the Audited concern, which swallows failures so an
+    # audit hiccup cannot roll back an ordinary policy edit. On the money
+    # path that trade goes the other way: a payroll transition nobody can
+    # explain afterwards should not be allowed to happen at all, so callers
+    # run it inside the same transaction as the write it describes.
+    #
+    # `changes` is a whitelist the caller writes out by hand. Never pass
+    # amounts — this table is not encrypted.
+    def self.record!(action:, subject:, actor: HrLite::Current.actor, changes: {})
+      create!(
+        actor: actor,
+        action: action,
+        subject_type: subject.class.name,
+        # A destroyed record has no id left, and the row still has to say
+        # what happened.
+        subject_id: subject.id || 0,
+        audited_changes: changes
+      )
+    end
+
+    def money_tier?
+      MONEY_TIER_TYPES.include?(subject_type)
+    end
 
     def readonly?
       persisted?

data/app/models/hr_lite/comp_off_request.rb

@@ -54,7 +54,9 @@ module HrLite
 
       Notifications.publish(
         "comp_off.approved",
-        title: "Comp-off approved — #{credit_days.to_f} day#{'s' if credit_days > 1} credited for #{date_worked.strftime('%d %b')}",
+        # credit_days is 0.5 or 1 and nothing else, so there is no plural to
+        # reach for here.
+        title: "Comp-off approved — #{credit_days.to_f} day credited for #{date_worked.strftime('%d %b')}",
         body: decision_note.presence,
         path: "/comp_off_requests",
         bell_to: [ user ], email_to: [ user ]
@@ -106,21 +108,11 @@ module HrLite
     # balance. The balance row is locked for the increment; two admins
     # approving two different requests for one person cannot lose an update.
     def credit_balance!(type)
-      year = LeaveYear.current_key
-      balance = LeaveBalance.for(user, type, year)
-      if balance.new_record?
-        begin
-          balance.save!
-        rescue ActiveRecord::RecordNotUnique
-          balance = LeaveBalance.for(user, type, year)
-        end
-      end
-      balance.with_lock do
-        balance.adjustment += credit_days
-        balance.adjustment_note = [ balance.adjustment_note.presence,
-                                    "+#{credit_days.to_f} comp-off for #{date_worked} (request ##{id})" ].compact.join("; ")
-        balance.save!
-      end
+      LeaveBalance.adjust!(
+        user, type, LeaveYear.current_key,
+        delta: credit_days,
+        note: "+#{credit_days.to_f} comp-off for #{date_worked} (request ##{id})"
+      )
     end
 
     def transition!(new_status, actor, note)

data/app/models/hr_lite/designation_change.rb

@@ -27,7 +27,17 @@ module HrLite
       self.from_designation ||= EmployeeProfile.find_by(user_id: user_id)&.designation
     end
 
+    # Only the newest row owns the profile's designation. Backfilling an older
+    # promotion used to overwrite the current title and push the stale one to
+    # the host as well. (A future-dated promotion still applies on save — that
+    # is how sharing an appraisal announces the new role.)
+    def latest_by_effective_date?
+      self.class.where(user_id: user_id).timeline.first&.id == id
+    end
+
     def apply_to_profile
+      return unless latest_by_effective_date?
+
       profile = EmployeeProfile.find_by(user_id: user_id)
       profile&.update!(designation: to_designation)
 
@@ -45,7 +55,14 @@ module HrLite
         body: "Effective #{effective_date.strftime('%d %b %Y')}.",
         path: "/career",
         bell_to: [ user ],
-        email_to: [ user ]
+        email_to: [ user ],
+        # "/career" is the reader's OWN career page, so a leadership copy of
+        # this used to link them to their own record instead of the person the
+        # promotion is about.
+        leadership: {
+          title: "#{HrLite.display_name(user)} — new role: #{to_designation}",
+          path: "/admin/employees"
+        }
       )
     end
   end

data/app/models/hr_lite/employee_profile.rb

@@ -13,7 +13,11 @@ module HrLite
     belongs_to :manager, class_name: HrLite.config.user_class, optional: true
 
     encrypts :pan_number, :pf_uan, :esi_number, :bank_account_number, :bank_ifsc
-    encrypted_money :declared_annual_deductions
+    # fy_opening_*: income already paid this financial year that this install
+    # did not run — a previous employer, or the months before payroll was
+    # switched on here. Feeds the TDS projection so a mid-year start does not
+    # read as zero income for the months it cannot see.
+    encrypted_money :declared_annual_deductions, :fy_opening_gross, :fy_opening_tds
 
     TAX_REGIMES = %w[new old].freeze