hr_lite 0.5.2 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d22267458cedf1755a676934b2488e404e78e26ea9c2b803f9dd72ee828b620d
-  data.tar.gz: 50605b10283eb03f12bde5884917c033aebf58e7afc968de790f9581ff6cf8d4
+  metadata.gz: bdcc58ee5fdba440b0f70b9f22b85d85d20ef02f16c92481d4aad89a2395489f
+  data.tar.gz: f705fe091062bbe92246fd19fb1615c9fd9e0f2c6ed34ece293d155cc81879b1
 SHA512:
-  metadata.gz: 7cc91aa10c5d70555bfedb8870d3d87cac4b06ea762222b768a120abae7ed5f46d94c96091aee92a397eb2390e5432611ede42076b78d02c060dcba4da3ebd53
-  data.tar.gz: 5e850af90388970e343448c95533a7251ce0834400f33c6570feef5eddb511621e888d9b7c28b1cbb6391bb70941730e1f2804470d9c1bf1a5439ea7edc85c38
+  metadata.gz: c674e21d22c69a6b2ff5e51cbbb329f166140054212d81a2582c5d0b421350a732c94ae2b8074e4da15f4b510f9a0fa5bfceda84c633b57def295c2066276370
+  data.tar.gz: 514bf9fa94450d2ccdd4a7443125ec355dd4d68e99c264eac62fe3b5b3be2034a17a64c94571ef51580b97a8ebd59ba85e0a05a55474e3ec80dd9a4ebf798a7d

data/CHANGELOG.md

@@ -7,6 +7,66 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.3] - 2026-08-17
+
+Correctness and traceability pass, ahead of the permissions work in 0.6.0.
+**Adds one migration** — check constraints on every status column, plus an
+index and foreign key on `hr_lite_designation_changes.appraisal_id`. It
+refuses to run, naming the table and the offending values, if a live row
+already holds a status no model declares.
+
+### Fixed
+
+- **Payroll ran silently on an out-of-date statutory card.** The lookup fell
+  back to the newest card on or before the run month with no signal, so a run
+  in a financial year the gem ships no card for computed PF, ESI, PT and TDS
+  on the previous year's figures and said nothing. It still falls back —
+  payroll cannot stop dead every 1 April — but `PayrollRunProcessor` now puts
+  a warning naming both financial years at the TOP of the run's warnings, on
+  every compute. Adding a year remains one new entry in
+  `StatutoryRateCard::CARDS`; rates are never inferred forward.
+- **A blank email could be granted the leadership tier.** `leadership_check`
+  did not drop empty entries the way `superadmin_check` did, so one stray
+  comma in `HR_LEADERSHIP_EMAILS` ("a@x.com,,b@x.com") put `""` on the list
+  and any user whose email was blank or nil matched it. Both checks now share
+  `HrLite.email_listed?`, which refuses a blank address against any list.
+- Comp-off approval no longer reaches for a plural that cannot occur — a
+  credit is 0.5 or 1 day and never more.
+
+### Added
+
+- **The money path leaves a trail.** Payroll compute, finalize, unlock and
+  publish, every leave approval, rejection and cancellation, and the payout
+  register download now write `AuditLog` rows. Previously a run could be
+  computed, finalized, unlocked, edited and republished and the audit screen
+  showed none of it.
+  - These rows are written inside the same transaction as the change they
+    describe and RAISE on failure, unlike the `Audited` concern, which stays
+    best-effort for ordinary policy edits. A payroll transition nobody can
+    account for afterwards does not happen at all.
+  - Amounts are deliberately excluded — `audit_logs` is not encrypted. Rows
+    record who moved a run, how far, and over how many people. Leave rows
+    carry the approver's note and never the employee's own reason.
+  - `HrLite::PayrollRun` and `HrLite::SalarySlip` join `MONEY_TIER_TYPES`, so
+    payroll rows stay out of the leadership audit screen.
+- `HrLite::AuditLog.record!` — the five-line `create!` that five call sites
+  had each written out.
+- `HrLite::FinancialYear` — the Indian FY (1 April) worked out in one place
+  instead of three.
+
+### Changed
+
+- Statuses are enforced by the database. `update_column`, `update_all`,
+  `insert_all` and console fixes can no longer write a value that no screen
+  renders and no transition accepts.
+- The suite enforces its own coverage: 100% line, 90% branch, 90% per file.
+  The README claimed 100% and nothing checked it; switching the floor on found
+  eight untested paths, including all three slip-override money guards (LOP
+  above the days in the month, negative LOP, negative TDS) and the offboarding
+  error path. All are covered now.
+- `docs/PAYROLL.md` no longer lists ESI contribution-period lock-in as
+  unmodelled — 0.5.2 implemented it.
+
 ## [0.5.2] - 2026-08-08
 
 The rest of the audit that produced 0.5.1. **Adds three migrations** — they
@@ -349,7 +409,8 @@ Initial release.
   bus with per-event channel matrix (bell, email, leadership email/bell),
   daily leadership digest and an append-only audit trail.
 
-[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.5.2...HEAD
+[Unreleased]: https://github.com/kshtzkr/hr_lite/compare/v0.5.3...HEAD
+[0.5.3]: https://github.com/kshtzkr/hr_lite/compare/v0.5.2...v0.5.3
 [0.5.2]: https://github.com/kshtzkr/hr_lite/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/kshtzkr/hr_lite/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/kshtzkr/hr_lite/compare/v0.4.0...v0.5.0

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -75,10 +75,9 @@ module HrLite
       private
 
       def log_regularization(record, note, removed:)
-        AuditLog.create!(
-          actor: hr_current_user, action: removed ? "destroy" : "regularize",
-          subject_type: record.class.name, subject_id: record.id || 0,
-          audited_changes: { "date" => record.date.to_s, "note" => note }
+        AuditLog.record!(
+          action: removed ? "destroy" : "regularize", subject: record, actor: hr_current_user,
+          changes: { "date" => record.date.to_s, "note" => note }
         )
         Notifications.publish(
           "attendance.regularized",

data/app/controllers/hr_lite/admin/leave_balances_controller.rb

@@ -23,11 +23,10 @@ module HrLite
 
         balance = LeaveBalance.adjust!(user, type, year, delta: delta, note: "#{delta.to_f} — #{note}")
 
-        AuditLog.create!(
-          actor: hr_current_user, action: "adjust",
-          subject_type: balance.class.name, subject_id: balance.id,
-          audited_changes: { "user" => HrLite.display_name(user), "type" => type.code,
-                             "delta" => delta.to_f, "note" => note }
+        AuditLog.record!(
+          action: "adjust", subject: balance, actor: hr_current_user,
+          changes: { "user" => HrLite.display_name(user), "type" => type.code,
+                     "delta" => delta.to_f, "note" => note }
         )
         redirect_to admin_leave_balances_path(year: year),
                     notice: "Balance adjusted for #{HrLite.display_name(user)}."

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -55,8 +55,17 @@ module HrLite
       # deliberately leadership-only PII.
       def register
         run = PayrollRun.find(params[:id])
-        send_data register_csv(run), filename: "payroll-register-#{run.period_month.strftime('%Y-%m')}.csv",
-                                     type: "text/csv"
+        csv = register_csv(run)
+        # A GET that walks out of the building with every employee's pay and
+        # bank account. Nothing else in the module leaks this much in one
+        # click, so the download itself is the auditable event.
+        AuditLog.record!(
+          action: "payroll.register_exported", subject: run, actor: hr_current_user,
+          changes: { "period" => run.label, "rows" => run.salary_slips.count,
+                     "includes_bank_details" => true }
+        )
+        send_data csv, filename: "payroll-register-#{run.period_month.strftime('%Y-%m')}.csv",
+                       type: "text/csv"
       end
 
       private

data/app/controllers/hr_lite/admin/salary_slips_controller.rb

@@ -43,12 +43,11 @@ module HrLite
         )
         slip.update!(attributes)
 
-        AuditLog.create!(
-          actor: hr_current_user, action: "override",
-          subject_type: slip.class.name, subject_id: slip.id,
-          audited_changes: { "period" => run.label, "employee" => HrLite.display_name(slip.user),
-                             "lop_override" => lop_override || "cleared",
-                             "tds_override" => tds_override ? "[changed]" : "cleared" }
+        AuditLog.record!(
+          action: "override", subject: slip, actor: hr_current_user,
+          changes: { "period" => run.label, "employee" => HrLite.display_name(slip.user),
+                     "lop_override" => lop_override || "cleared",
+                     "tds_override" => tds_override ? "[changed]" : "cleared" }
         )
         redirect_to admin_salary_slip_path(slip), notice: "Slip recomputed with overrides."
       rescue ArgumentError

data/app/models/hr_lite/audit_log.rb

@@ -12,11 +12,36 @@ module HrLite
     # encrypt their amounts so the diff is already redacted, but appraisal
     # ratings and review text are plain columns — they must not reach the
     # leadership audit screen or the policy.changed email.
-    MONEY_TIER_TYPES = %w[HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure].freeze
+    MONEY_TIER_TYPES = %w[
+      HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
+      HrLite::PayrollRun HrLite::SalarySlip
+    ].freeze
 
     scope :recent, -> { order(created_at: :desc) }
     scope :outside_money_tier, -> { where.not(subject_type: MONEY_TIER_TYPES) }
 
+    # The five-line `create!` that four call sites had each spelled out.
+    #
+    # This RAISES, unlike the Audited concern, which swallows failures so an
+    # audit hiccup cannot roll back an ordinary policy edit. On the money
+    # path that trade goes the other way: a payroll transition nobody can
+    # explain afterwards should not be allowed to happen at all, so callers
+    # run it inside the same transaction as the write it describes.
+    #
+    # `changes` is a whitelist the caller writes out by hand. Never pass
+    # amounts — this table is not encrypted.
+    def self.record!(action:, subject:, actor: HrLite::Current.actor, changes: {})
+      create!(
+        actor: actor,
+        action: action,
+        subject_type: subject.class.name,
+        # A destroyed record has no id left, and the row still has to say
+        # what happened.
+        subject_id: subject.id || 0,
+        audited_changes: changes
+      )
+    end
+
     def money_tier?
       MONEY_TIER_TYPES.include?(subject_type)
     end

data/app/models/hr_lite/comp_off_request.rb

@@ -54,7 +54,9 @@ module HrLite
 
       Notifications.publish(
         "comp_off.approved",
-        title: "Comp-off approved — #{credit_days.to_f} day#{'s' if credit_days > 1} credited for #{date_worked.strftime('%d %b')}",
+        # credit_days is 0.5 or 1 and nothing else, so there is no plural to
+        # reach for here.
+        title: "Comp-off approved — #{credit_days.to_f} day credited for #{date_worked.strftime('%d %b')}",
         body: decision_note.presence,
         path: "/comp_off_requests",
         bell_to: [ user ], email_to: [ user ]

data/app/models/hr_lite/leave_request.rb

@@ -78,10 +78,15 @@ module HrLite
 
     def cancel!(actor:)
       was_approved = approved?
-      self.status = "cancelled"
-      self.decided_by_id = actor.id
-      self.decided_at = Time.current
-      save!
+      transaction do
+        self.status = "cancelled"
+        self.decided_by_id = actor.id
+        self.decided_at = Time.current
+        save!
+        # Cancelling an APPROVED leave hands the days back to the balance, so
+        # it is a quota change as much as a status change.
+        audit!("cancelled", actor, was_approved ? "was approved" : nil)
+      end
 
       Notifications.publish(
         "leave.cancelled",
@@ -117,9 +122,27 @@ module HrLite
         self.decided_at = Time.current
         self.decision_note = note
         save!
+        audit!(new_status, actor, note)
       end
     end
 
+    # Approve and reject both come through `transition!`, and `with_lock` is
+    # already a transaction — so a failed audit row rolls the decision back
+    # rather than leaving one that nobody can account for. The employee's own
+    # `reason` is deliberately not copied here; the approver's note is.
+    def audit!(action, actor, note)
+      AuditLog.record!(
+        action: "leave.#{action}", subject: self, actor: actor,
+        changes: {
+          "employee" => HrLite.display_name(user),
+          "type" => leave_type.code,
+          "dates" => date_range_label,
+          "days" => days_count&.to_s("F"),
+          "note" => note.presence
+        }.compact
+      )
+    end
+
     # This request is still pending here, so balance.used excludes it:
     # approving is valid iff the request fits the remaining balance.
     def insufficient_balance_now?

data/app/models/hr_lite/payroll_run.rb

@@ -39,7 +39,12 @@ module HrLite
       begin
         update!(status: "processing")
         PayrollRunProcessor.call(self)
-        update!(status: "review", processed_at: Time.current)
+        transaction do
+          update!(status: "review", processed_at: Time.current)
+          audit!("payroll.computed", actor,
+                 "slips" => salary_slips.count, "warnings" => warnings.length,
+                 "from_status" => previous)
+        end
         true
       rescue => e
         # Restore what the run WAS. Hardcoding "draft" here used to demote a
@@ -54,7 +59,12 @@ module HrLite
       raise_unless %w[review]
       raise ActiveRecord::RecordInvalid.new(self), "no slips" if salary_slips.none?
 
-      update!(status: "finalized", finalized_at: Time.current, finalized_by_id: actor.id)
+      transaction do
+        update!(status: "finalized", finalized_at: Time.current, finalized_by_id: actor.id)
+        # Finalizing freezes every slip in the run. Who did it, to how many
+        # people, is the row an investigation starts from.
+        audit!("payroll.finalized", actor, "slips" => salary_slips.count)
+      end
       Notifications.publish(
         "payroll.finalized",
         title: "Payroll #{label} finalized — #{salary_slips.count} slips, net #{Money.round2(total_net).to_s('F')}",
@@ -65,13 +75,21 @@ module HrLite
 
     def unlock!(actor:)
       raise_unless %w[finalized]
-      update!(status: "review")
+      transaction do
+        update!(status: "review")
+        # Reopening frozen slips for editing is the single most sensitive
+        # transition in the module — it is the one that has to leave a trace.
+        audit!("payroll.unlocked", actor, "slips" => salary_slips.count)
+      end
       true
     end
 
     def publish!(actor:)
       raise_unless %w[finalized]
-      update!(status: "published", published_at: Time.current, published_by_id: actor.id)
+      transaction do
+        update!(status: "published", published_at: Time.current, published_by_id: actor.id)
+        audit!("payroll.published", actor, "slips" => salary_slips.count)
+      end
 
       slips = salary_slips.includes(:user).to_a
       # Everyone is emailed — a final settlement matters most to the person who
@@ -106,6 +124,14 @@ module HrLite
 
     private
 
+    # Amounts stay out of it on purpose: audit_logs is a plaintext table and
+    # every slip amount in this module is encrypted. The row records WHO
+    # moved the run and HOW FAR, never what anyone is paid.
+    def audit!(action, actor, changes)
+      AuditLog.record!(action: action, subject: self, actor: actor,
+                       changes: changes.merge("period" => label))
+    end
+
     def sum_slips(attribute)
       salary_slips.sum(BigDecimal(0)) { |slip| slip.public_send(attribute) || BigDecimal(0) }
     end

data/app/models/hr_lite/regularization_request.rb

@@ -71,10 +71,9 @@ module HrLite
         raise InvalidMerge, record.errors.full_messages.to_sentence unless record.valid?
 
         record.save!
-        AuditLog.create!(
-          actor: actor, action: "regularize",
-          subject_type: record.class.name, subject_id: record.id,
-          audited_changes: { "date" => record.date.to_s, "ticket" => id, "note" => reason }
+        AuditLog.record!(
+          action: "regularize", subject: record, actor: actor,
+          changes: { "date" => record.date.to_s, "ticket" => id, "note" => reason }
         )
       end
 

data/app/models/hr_lite/salary_slip.rb

@@ -40,8 +40,7 @@ module HrLite
     # Indian FY (Apr 1) to-date sums of SETTLED slips before this period —
     # feeds the TDS projector and the slip's YTD table.
     def self.fy_to_date(user, period_month)
-      fy_start = period_month.month >= 4 ? Date.new(period_month.year, 4, 1)
-                                         : Date.new(period_month.year - 1, 4, 1)
+      fy_start = FinancialYear.start_for(period_month)
       slips = settled.where(user_id: user.id)
                      .where(period_month: fy_start...period_month)
       {

data/app/services/hr_lite/payroll_run_processor.rb

@@ -12,7 +12,10 @@ module HrLite
     end
 
     def call
-      warnings = []
+      # First in the list on purpose: if the statutory card is from an older
+      # financial year, every number below it is computed on last year's
+      # rates and that is the thing to read first.
+      warnings = Array(StatutoryRateCard.warning_for(@run.period_month))
 
       ActiveRecord::Base.transaction do
         eligible = EmployeeProfile.active_for(@run.period_month).includes(:user).to_a

data/db/migrate/20260817182124_add_status_constraints_and_appraisal_fk_to_hr_lite.rb

@@ -0,0 +1,63 @@
+class AddStatusConstraintsAndAppraisalFkToHrLite < ActiveRecord::Migration[8.1]
+  # Every status column in the engine is a plain string validated only in
+  # Ruby, so anything that skips validations — update_column, update_all,
+  # insert_all, a console fix, a future migration — can write a value no
+  # screen renders and no transition accepts. These constraints put the
+  # allowed set somewhere it cannot be bypassed.
+  #
+  # Deliberately in step with each model's own STATUSES array: adding a
+  # status now means writing a migration, which is the point.
+  STATUSES = {
+    hr_lite_attendance_records: %w[present half_day],
+    hr_lite_leave_requests: %w[pending approved rejected cancelled],
+    hr_lite_comp_off_requests: %w[pending approved rejected cancelled],
+    hr_lite_regularization_requests: %w[pending approved rejected cancelled],
+    hr_lite_resignations: %w[pending accepted withdrawn],
+    hr_lite_appraisals: %w[draft shared],
+    hr_lite_payroll_runs: %w[draft processing review finalized published]
+  }.freeze
+
+  def up
+    # On an install that already holds an off-list value the constraint build
+    # fails with a bare integrity error naming neither the row nor the value.
+    # Say what is actually in the way instead — this runs on live data.
+    offenders = STATUSES.filter_map do |table, statuses|
+      found = select_values(
+        "SELECT DISTINCT status FROM #{table} WHERE status NOT IN (#{quoted(statuses)})"
+      )
+      "#{table}: #{found.join(', ')}" if found.any?
+    end
+
+    if offenders.any?
+      raise ActiveRecord::IrreversibleMigration,
+            "Cannot constrain status columns — these rows hold values no model " \
+            "declares. Correct them first:\n  #{offenders.join("\n  ")}"
+    end
+
+    STATUSES.each do |table, statuses|
+      add_check_constraint table, status_sql(statuses), name: constraint_name(table)
+    end
+
+    # has_one :designation_change, dependent: :nullify — with neither an index
+    # nor a foreign key. Destroying an appraisal scanned the whole table to
+    # find its promotion row, and nothing stopped that row from being left
+    # pointing at an appraisal that no longer exists.
+    add_index :hr_lite_designation_changes, :appraisal_id
+    add_foreign_key :hr_lite_designation_changes, :hr_lite_appraisals,
+                    column: :appraisal_id, on_delete: :nullify
+  end
+
+  def down
+    remove_foreign_key :hr_lite_designation_changes, column: :appraisal_id
+    remove_index :hr_lite_designation_changes, :appraisal_id
+    STATUSES.each_key { |table| remove_check_constraint table, name: constraint_name(table) }
+  end
+
+  private
+
+  def status_sql(statuses) = "status IN (#{quoted(statuses)})"
+
+  def quoted(statuses) = statuses.map { |s| connection.quote(s) }.join(", ")
+
+  def constraint_name(table) = "#{table}_status_check"
+end

data/lib/hr_lite/configuration.rb

@@ -46,16 +46,13 @@ module HrLite
       @currency_symbol      = "₹"
       @on_designation_change = ->(user, designation) { }
       @leadership_emails     = []
-      @leadership_check      = ->(user) do
-        emails = HrLite.config.leadership_emails.map { |e| e.to_s.downcase.strip }
-        emails.include?(user.email.to_s.downcase)
-      end
+      @leadership_check      = ->(user) { HrLite.email_listed?(user, HrLite.config.leadership_emails) }
       # Money tier: salary structures, payroll, slips, appraisals. Empty
       # list means "same as leadership" (pre-0.5.0 behaviour).
       @superadmin_emails     = []
       @superadmin_check      = ->(user) do
-        emails = HrLite.config.superadmin_emails.map { |e| e.to_s.downcase.strip }.reject(&:empty?)
-        emails.empty? ? HrLite.leadership?(user) : emails.include?(user.email.to_s.downcase)
+        list = HrLite.normalize_email_list(HrLite.config.superadmin_emails)
+        list.empty? ? HrLite.leadership?(user) : HrLite.email_listed?(user, list)
       end
       @extra_stylesheets     = [] # host stylesheets linked AFTER hr_lite.css (CSS-var overrides)
       @mailer_from           = "hr@example.com"

data/lib/hr_lite/financial_year.rb

@@ -0,0 +1,26 @@
+module HrLite
+  # The Indian financial year runs 1 April – 31 March. Three places worked
+  # this out for themselves (the slip's year-to-date sums, the TDS projector
+  # and the rate card); it lives here once so they cannot drift apart.
+  module FinancialYear
+    START_MONTH = 4
+
+    # First day of the FY containing `date`. March 2027 belongs to the year
+    # that opened on 1 April 2026.
+    def self.start_for(date)
+      year = date.month >= START_MONTH ? date.year : date.year - 1
+      Date.new(year, START_MONTH, 1)
+    end
+
+    # "2026-27" — for warnings and screens, never for arithmetic.
+    def self.label(date)
+      start = start_for(date)
+      "#{start.year}-#{format('%02d', (start.year + 1) % 100)}"
+    end
+
+    # True when `date` falls in an earlier FY than `other`.
+    def self.before?(date, other)
+      start_for(date) < start_for(other)
+    end
+  end
+end

data/lib/hr_lite/statutory_rate_card.rb

@@ -3,9 +3,13 @@ module HrLite
   # is a one-hash edit that gets code review and a spec diff, never an
   # inline-constant hunt.
   #
-  # VERIFY WITH A CA before the first run of any new financial year; the
-  # FY 2026-27 card ships with FY 2025-26 figures pending confirmation of
-  # the Feb 2026 Finance Act.
+  # VERIFY WITH A CA before the first run of any new financial year. Adding
+  # a year is one new dated entry in CARDS; nothing else changes.
+  #
+  # When no card exists for a run's financial year the lookup falls back to
+  # the newest one it has — payroll cannot simply stop every April — but
+  # `warning_for` says so on the run, and `PayrollRunProcessor` puts that
+  # sentence in front of every other warning until a card is added.
   module StatutoryRateCard
     def self.r(value) = BigDecimal(value.to_s)
     private_class_method :r
@@ -58,8 +62,44 @@ module HrLite
     }.freeze
 
     def self.for(period_month)
-      effective = CARDS.keys.sort.reverse.find { |date| date <= period_month }
-      effective ? CARDS[effective] : CARDS[CARDS.keys.min]
+      CARDS[effective_date_for(period_month)]
+    end
+
+    # Which card a run will actually use. A month older than every card
+    # borrows the earliest one — see `predates_cards?`, which says so.
+    def self.effective_date_for(period_month)
+      CARDS.keys.sort.reverse.find { |date| date <= period_month } || CARDS.keys.min
+    end
+
+    # The card in force is from an EARLIER financial year than the run. The
+    # lookup still returns figures — it has to, or payroll would stop dead
+    # every April — so the run carries the warning instead.
+    def self.stale_for?(period_month)
+      FinancialYear.before?(effective_date_for(period_month), period_month)
+    end
+
+    # The run is older than every card we ship, so it is being computed on
+    # rates that had not been announced yet.
+    def self.predates_cards?(period_month)
+      period_month < CARDS.keys.min
+    end
+
+    # One sentence naming both the run's FY and the card's, or nil when they
+    # match. Rendered verbatim in the run's warnings list.
+    def self.warning_for(period_month)
+      card_fy = FinancialYear.label(effective_date_for(period_month))
+      run_fy  = FinancialYear.label(period_month)
+
+      if predates_cards?(period_month)
+        "Payroll for FY #{run_fy} is being computed on the FY #{card_fy} " \
+        "statutory card — no card ships for a year that early. PF, ESI, PT " \
+        "and TDS on this run are not the rates that applied. Verify with your CA."
+      elsif stale_for?(period_month)
+        "Payroll for FY #{run_fy} is being computed on the FY #{card_fy} " \
+        "statutory card — no card ships for FY #{run_fy} yet. PF, ESI, PT and " \
+        "TDS on this run use last year's rates. Add a CA-verified card for " \
+        "FY #{run_fy} before publishing."
+      end
     end
   end
 end

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.5.2"
+  VERSION = "0.5.3"
 end

data/lib/hr_lite.rb

@@ -3,6 +3,7 @@ require "hr_lite/engine"
 require "hr_lite/configuration"
 require "hr_lite/current"
 require "hr_lite/leave_year"
+require "hr_lite/financial_year"
 require "hr_lite/mention_parser"
 require "hr_lite/notifications"
 require "hr_lite/seeds"
@@ -42,11 +43,27 @@ module HrLite
       user.present? && !!config.superadmin_check.call(user)
     end
 
+    # An access list, cleaned. "a@x.com,,b@x.com".split(",") — one stray
+    # comma in an ENV var — used to put "" in the list, and a user whose
+    # email was blank then MATCHED it and was handed the tier.
+    def normalize_email_list(emails)
+      Array(emails).map { |e| e.to_s.downcase.strip }.reject(&:empty?)
+    end
+
+    # Whether a user's own email is on a configured access list. A blank
+    # email is never on any list, however the list is spelled.
+    def email_listed?(user, emails)
+      address = user.respond_to?(:email) ? user.email.to_s.downcase.strip : ""
+      return false if address.empty?
+
+      normalize_email_list(emails).include?(address)
+    end
+
     # Leadership members resolvable to actual user records (for bell
     # notifications). Emails configured but absent from the user table are
     # still reachable by email — see Notifications.
     def leadership_users
-      emails = config.leadership_emails.map { |e| e.to_s.downcase.strip }.reject(&:empty?)
+      emails = normalize_email_list(config.leadership_emails)
       return user_klass.none if emails.empty?
 
       user_klass.where("LOWER(#{user_klass.table_name}.email) IN (?)", emails)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.3
 platform: ruby
 authors:
 - kshitiz sinha
@@ -242,6 +242,7 @@ files:
 - db/migrate/20260807184103_add_live_uniqueness_indexes_to_hr_lite.rb
 - db/migrate/20260807184426_add_fy_opening_to_hr_lite_employee_profiles.rb
 - db/migrate/20260807184939_add_out_of_window_days_to_hr_lite_salary_slips.rb
+- db/migrate/20260817182124_add_status_constraints_and_appraisal_fk_to_hr_lite.rb
 - lib/generators/hr_lite/install/install_generator.rb
 - lib/generators/hr_lite/install/templates/AFTER_INSTALL
 - lib/generators/hr_lite/install/templates/initializer.rb
@@ -250,6 +251,7 @@ files:
 - lib/hr_lite/configuration.rb
 - lib/hr_lite/current.rb
 - lib/hr_lite/engine.rb
+- lib/hr_lite/financial_year.rb
 - lib/hr_lite/geo.rb
 - lib/hr_lite/leave_year.rb
 - lib/hr_lite/mention_parser.rb