hr_lite 0.5.2 → 0.6.0

data/app/controllers/hr_lite/admin/roles_controller.rb

@@ -0,0 +1,73 @@
+module HrLite
+  module Admin
+    # Who may do what. Gated on `role.manage`, which by default only the
+    # money tier holds — the authority to grant yourself payroll is the
+    # authority to read everyone's pay, so it lives with the pay.
+    class RolesController < LeadershipController
+      skip_before_action :require_governing_access!
+      before_action :require_role_management!
+
+      def index
+        @roles = Role.alphabetical.includes(:role_grants, :role_assignments)
+      end
+
+      def new
+        @role = Role.new
+      end
+
+      def create
+        @role = Role.new(role_params)
+        if @role.save
+          @role.replace_grants!(grant_params)
+          redirect_to admin_roles_path, notice: "#{@role.name} created."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+        @role = Role.find(params[:id])
+      end
+
+      def update
+        @role = Role.find(params[:id])
+        if @role.update(role_params)
+          @role.replace_grants!(grant_params)
+          redirect_to admin_roles_path, notice: "#{@role.name} updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        role = Role.find(params[:id])
+        if role.destroy
+          redirect_to admin_roles_path, notice: "#{role.name} deleted.", status: :see_other
+        else
+          redirect_to admin_roles_path, alert: role.errors.full_messages.to_sentence,
+                      status: :see_other
+        end
+      end
+
+      private
+
+      def require_role_management!
+        hr_require_permission!("role.manage", scope: :all)
+      end
+
+      def role_params
+        permitted = params.require(:role).permit(:name, :description)
+        # A built-in role's NAME is what the seed, the upgrade migration and
+        # the specs all identify it by; the model refuses a rename, and not
+        # sending one keeps the form from failing on an untouched field.
+        @role&.system? ? permitted.except(:name) : permitted
+      end
+
+      # The form posts the COMPLETE picture, so a permission absent from it is
+      # one being taken away. "none" is how the form says "not granted".
+      def grant_params
+        params.fetch(:grants, {}).permit(Permissions::KEYS).to_h
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/salary_slips_controller.rb

@@ -43,12 +43,11 @@ module HrLite
         )
         slip.update!(attributes)
 
-        AuditLog.create!(
-          actor: hr_current_user, action: "override",
-          subject_type: slip.class.name, subject_id: slip.id,
-          audited_changes: { "period" => run.label, "employee" => HrLite.display_name(slip.user),
-                             "lop_override" => lop_override || "cleared",
-                             "tds_override" => tds_override ? "[changed]" : "cleared" }
+        AuditLog.record!(
+          action: "override", subject: slip, actor: hr_current_user,
+          changes: { "period" => run.label, "employee" => HrLite.display_name(slip.user),
+                     "lop_override" => lop_override || "cleared",
+                     "tds_override" => tds_override ? "[changed]" : "cleared" }
         )
         redirect_to admin_salary_slip_path(slip), notice: "Slip recomputed with overrides."
       rescue ArgumentError

data/app/controllers/hr_lite/admin/superadmin_controller.rb

@@ -1,20 +1,24 @@
 module HrLite
   module Admin
-    # Money tier: salary structures, payroll, slips, appraisals and
-    # promotions. Only config.superadmin_emails — ordinary leadership can
-    # govern policy and people but never sees another person's pay.
-    # The money tier stands on its own rather than layering on leadership: a
-    # payroll operator does not have to also govern people and policy.
-    # Inheriting the leadership check locked a configured superadmin who was
-    # absent from leadership_emails out of payroll entirely.
+    # Money screens: salary structures, payroll, slips, appraisals and
+    # promotions. Ordinary governing authority reaches none of it — leadership
+    # governs policy and people but never sees another person's pay.
+    #
+    # The money gate stands on its own rather than layering on the governing
+    # one: a payroll operator does not have to also govern people and policy.
+    # Stacking the two locked a configured money-tier user who was absent from
+    # the leadership list out of payroll entirely.
     class SuperadminController < LeadershipController
-      skip_before_action :require_hr_leadership!
-      before_action :require_hr_superadmin!
+      skip_before_action :require_governing_access!
+      before_action :require_money_access!
 
       private
 
-      def require_hr_superadmin!
-        hr_access_denied unless hr_superadmin?
+      # Deliberately payroll.manage rather than a "super admin" role name:
+      # roles are data an install re-cuts, and gating on a NAME would make
+      # renaming one a silent lock-out.
+      def require_money_access!
+        hr_require_permission!("payroll.manage", scope: :all)
       end
     end
   end

data/app/controllers/hr_lite/application_controller.rb

@@ -10,10 +10,48 @@ module HrLite
     before_action :hr_set_current_actor
     around_action :hr_use_time_zone
 
-    helper_method :hr_current_user, :hr_admin?, :hr_leadership?, :hr_superadmin?, :hr_display_name
+    helper_method :hr_current_user, :hr_admin?, :hr_leadership?, :hr_superadmin?, :hr_display_name,
+                  :hr_can?, :hr_reaches?, :hr_access
 
     private
 
+    # --- authorization -----------------------------------------------------
+
+    def hr_access
+      HrLite::Access.for(hr_current_user)
+    end
+
+    # May the signed-in person do this at all, at `scope` or wider?
+    def hr_can?(key, scope: :self)
+      hr_access.can?(key, scope: scope)
+    end
+
+    # May they do it to THIS person's records? The question the module could
+    # not ask before roles, and whose absence let any admin approve anybody's
+    # leave.
+    def hr_reaches?(key, subject_user)
+      hr_access.reaches?(key, subject_user)
+    end
+
+    # Gate a whole controller or action. `scope` is the weakest scope that can
+    # reach the screen at all — a manager reaching a team screen still has
+    # every ROW checked separately by `hr_require_reach!`.
+    def hr_require_permission!(key, scope: :self)
+      hr_access_denied unless hr_can?(key, scope: scope)
+    end
+
+    # Gate one record. Deliberately a 404, not a 403: whether a particular
+    # person exists is not something a stranger gets to learn from us.
+    def hr_require_reach!(key, subject_user)
+      raise ActiveRecord::RecordNotFound unless hr_reaches?(key, subject_user)
+    end
+
+    # Narrow a relation to the rows this permission reaches, so an index
+    # never renders a row the member action would refuse.
+    def hr_scope(relation, key, column: :user_id)
+      hr_access.scope_relation(relation, key, column: column)
+    end
+
     def hr_authenticate!
       send(HrLite.config.authenticate_method)
     end

data/app/helpers/hr_lite/application_helper.rb

@@ -24,9 +24,12 @@ module HrLite
       { label: "Audit",     path: :admin_audit_logs_path,       match: [ "/admin/audit_logs" ] }
     ].freeze
 
-    # Money tier — only config.superadmin_emails see these.
+    # Money screens, plus role management: granting somebody payroll is the
+    # same act as holding it, so it sits with the pay rather than with the
+    # other governing screens.
     SUPERADMIN_NAV_ITEMS = [
-      { label: "Payroll", path: :admin_payroll_runs_path, match: [ "/admin/payroll_runs", "/admin/salary_slips" ] }
+      { label: "Payroll", path: :admin_payroll_runs_path, match: [ "/admin/payroll_runs", "/admin/salary_slips" ] },
+      { label: "Roles",   path: :admin_roles_path,        match: [ "/admin/roles" ] }
     ].freeze
 
     # Only items whose routes exist yet (the nav grows with each phase).

data/app/models/hr_lite/audit_log.rb

@@ -12,11 +12,36 @@ module HrLite
     # encrypt their amounts so the diff is already redacted, but appraisal
     # ratings and review text are plain columns — they must not reach the
     # leadership audit screen or the policy.changed email.
-    MONEY_TIER_TYPES = %w[HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure].freeze
+    MONEY_TIER_TYPES = %w[
+      HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
+      HrLite::PayrollRun HrLite::SalarySlip
+    ].freeze
 
     scope :recent, -> { order(created_at: :desc) }
     scope :outside_money_tier, -> { where.not(subject_type: MONEY_TIER_TYPES) }
 
+    # The five-line `create!` that four call sites had each spelled out.
+    #
+    # This RAISES, unlike the Audited concern, which swallows failures so an
+    # audit hiccup cannot roll back an ordinary policy edit. On the money
+    # path that trade goes the other way: a payroll transition nobody can
+    # explain afterwards should not be allowed to happen at all, so callers
+    # run it inside the same transaction as the write it describes.
+    #
+    # `changes` is a whitelist the caller writes out by hand. Never pass
+    # amounts — this table is not encrypted.
+    def self.record!(action:, subject:, actor: HrLite::Current.actor, changes: {})
+      create!(
+        actor: actor,
+        action: action,
+        subject_type: subject.class.name,
+        # A destroyed record has no id left, and the row still has to say
+        # what happened.
+        subject_id: subject.id || 0,
+        audited_changes: changes
+      )
+    end
+
     def money_tier?
       MONEY_TIER_TYPES.include?(subject_type)
     end

data/app/models/hr_lite/comp_off_request.rb

@@ -54,7 +54,9 @@ module HrLite
 
       Notifications.publish(
         "comp_off.approved",
-        title: "Comp-off approved — #{credit_days.to_f} day#{'s' if credit_days > 1} credited for #{date_worked.strftime('%d %b')}",
+        # credit_days is 0.5 or 1 and nothing else, so there is no plural to
+        # reach for here.
+        title: "Comp-off approved — #{credit_days.to_f} day credited for #{date_worked.strftime('%d %b')}",
         body: decision_note.presence,
         path: "/comp_off_requests",
         bell_to: [ user ], email_to: [ user ]

data/app/models/hr_lite/leave_request.rb

@@ -78,10 +78,15 @@ module HrLite
 
     def cancel!(actor:)
       was_approved = approved?
-      self.status = "cancelled"
-      self.decided_by_id = actor.id
-      self.decided_at = Time.current
-      save!
+      transaction do
+        self.status = "cancelled"
+        self.decided_by_id = actor.id
+        self.decided_at = Time.current
+        save!
+        # Cancelling an APPROVED leave hands the days back to the balance, so
+        # it is a quota change as much as a status change.
+        audit!("cancelled", actor, was_approved ? "was approved" : nil)
+      end
 
       Notifications.publish(
         "leave.cancelled",
@@ -117,9 +122,27 @@ module HrLite
         self.decided_at = Time.current
         self.decision_note = note
         save!
+        audit!(new_status, actor, note)
       end
     end
 
+    # Approve and reject both come through `transition!`, and `with_lock` is
+    # already a transaction — so a failed audit row rolls the decision back
+    # rather than leaving one that nobody can account for. The employee's own
+    # `reason` is deliberately not copied here; the approver's note is.
+    def audit!(action, actor, note)
+      AuditLog.record!(
+        action: "leave.#{action}", subject: self, actor: actor,
+        changes: {
+          "employee" => HrLite.display_name(user),
+          "type" => leave_type.code,
+          "dates" => date_range_label,
+          "days" => days_count&.to_s("F"),
+          "note" => note.presence
+        }.compact
+      )
+    end
+
     # This request is still pending here, so balance.used excludes it:
     # approving is valid iff the request fits the remaining balance.
     def insufficient_balance_now?

data/app/models/hr_lite/payroll_run.rb

@@ -39,7 +39,12 @@ module HrLite
       begin
         update!(status: "processing")
         PayrollRunProcessor.call(self)
-        update!(status: "review", processed_at: Time.current)
+        transaction do
+          update!(status: "review", processed_at: Time.current)
+          audit!("payroll.computed", actor,
+                 "slips" => salary_slips.count, "warnings" => warnings.length,
+                 "from_status" => previous)
+        end
         true
       rescue => e
         # Restore what the run WAS. Hardcoding "draft" here used to demote a
@@ -54,7 +59,12 @@ module HrLite
       raise_unless %w[review]
       raise ActiveRecord::RecordInvalid.new(self), "no slips" if salary_slips.none?
 
-      update!(status: "finalized", finalized_at: Time.current, finalized_by_id: actor.id)
+      transaction do
+        update!(status: "finalized", finalized_at: Time.current, finalized_by_id: actor.id)
+        # Finalizing freezes every slip in the run. Who did it, to how many
+        # people, is the row an investigation starts from.
+        audit!("payroll.finalized", actor, "slips" => salary_slips.count)
+      end
       Notifications.publish(
         "payroll.finalized",
         title: "Payroll #{label} finalized — #{salary_slips.count} slips, net #{Money.round2(total_net).to_s('F')}",
@@ -65,13 +75,21 @@ module HrLite
 
     def unlock!(actor:)
       raise_unless %w[finalized]
-      update!(status: "review")
+      transaction do
+        update!(status: "review")
+        # Reopening frozen slips for editing is the single most sensitive
+        # transition in the module — it is the one that has to leave a trace.
+        audit!("payroll.unlocked", actor, "slips" => salary_slips.count)
+      end
       true
     end
 
     def publish!(actor:)
       raise_unless %w[finalized]
-      update!(status: "published", published_at: Time.current, published_by_id: actor.id)
+      transaction do
+        update!(status: "published", published_at: Time.current, published_by_id: actor.id)
+        audit!("payroll.published", actor, "slips" => salary_slips.count)
+      end
 
       slips = salary_slips.includes(:user).to_a
       # Everyone is emailed — a final settlement matters most to the person who
@@ -106,6 +124,14 @@ module HrLite
 
     private
 
+    # Amounts stay out of it on purpose: audit_logs is a plaintext table and
+    # every slip amount in this module is encrypted. The row records WHO
+    # moved the run and HOW FAR, never what anyone is paid.
+    def audit!(action, actor, changes)
+      AuditLog.record!(action: action, subject: self, actor: actor,
+                       changes: changes.merge("period" => label))
+    end
+
     def sum_slips(attribute)
       salary_slips.sum(BigDecimal(0)) { |slip| slip.public_send(attribute) || BigDecimal(0) }
     end

data/app/models/hr_lite/regularization_request.rb

@@ -71,10 +71,9 @@ module HrLite
         raise InvalidMerge, record.errors.full_messages.to_sentence unless record.valid?
 
         record.save!
-        AuditLog.create!(
-          actor: actor, action: "regularize",
-          subject_type: record.class.name, subject_id: record.id,
-          audited_changes: { "date" => record.date.to_s, "ticket" => id, "note" => reason }
+        AuditLog.record!(
+          action: "regularize", subject: record, actor: actor,
+          changes: { "date" => record.date.to_s, "ticket" => id, "note" => reason }
         )
       end
 

data/app/models/hr_lite/role.rb

@@ -0,0 +1,66 @@
+module HrLite
+  # A named bundle of grants. Roles are DATA — the seeded six are a starting
+  # point an install is expected to edit, not a fixed ladder in code.
+  class Role < ApplicationRecord
+    include Audited
+
+    # Seeded by name. `Employee` in particular is load-bearing: it is what a
+    # new hire is given so that self-service works on day one.
+    EMPLOYEE = "Employee".freeze
+    MANAGER = "Manager".freeze
+    HR = "HR".freeze
+    FINANCE = "Finance".freeze
+    LEADERSHIP = "Leadership".freeze
+    SUPER_ADMIN = "Super Admin".freeze
+
+    has_many :role_grants, dependent: :destroy
+    has_many :role_assignments, dependent: :destroy
+
+    validates :name, presence: true, uniqueness: { case_sensitive: false }
+    before_destroy :protect_system_role
+    validate :system_role_keeps_its_name, on: :update
+
+    scope :alphabetical, -> { order(:name) }
+
+    # Every key this role grants, mapped to its scope. The shape the access
+    # resolver merges.
+    def grant_map
+      role_grants.to_h { |grant| [ grant.permission_key, grant.scope ] }
+    end
+
+    # Replaces the whole grant set in one transaction — the roles screen posts
+    # the complete picture, so a permission absent from the form is a
+    # permission being taken away, not one left alone.
+    def replace_grants!(grants)
+      transaction do
+        role_grants.destroy_all
+        grants.each do |key, scope|
+          next if scope.blank? || scope.to_s == "none"
+
+          role_grants.create!(permission_key: Permissions.validate!(key), scope: scope.to_s)
+        end
+      end
+      reload
+    end
+
+    def system? = self[:system]
+
+    private
+
+    def protect_system_role
+      return unless system?
+
+      errors.add(:base, "#{name} is a built-in role and cannot be deleted")
+      throw :abort
+    end
+
+    # The name is the identifier the seed, the upgrade path and the specs all
+    # use. Permissions on a system role are free to change; what it is called
+    # is not.
+    def system_role_keeps_its_name
+      return unless system? && name_changed?
+
+      errors.add(:name, "cannot be changed on a built-in role")
+    end
+  end
+end

data/app/models/hr_lite/role_assignment.rb

@@ -0,0 +1,18 @@
+module HrLite
+  # Who holds which role. Assignments are audited because granting somebody
+  # the money tier is exactly the kind of change that has to be explainable
+  # afterwards.
+  class RoleAssignment < ApplicationRecord
+    include Audited
+
+    belongs_to :role
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :granted_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :user_id, uniqueness: { scope: :role_id }
+
+    scope :for_user, ->(user) { where(user_id: user.id) }
+
+    def hr_lite_audit_label = "#{HrLite.display_name(user)} — #{role.name}"
+  end
+end

data/app/models/hr_lite/role_grant.rb

@@ -0,0 +1,15 @@
+module HrLite
+  # One (role, permission, scope) triple. The permission key is validated
+  # against the declared registry, so a typo is a refused write rather than a
+  # grant that silently never matches anything.
+  class RoleGrant < ApplicationRecord
+    belongs_to :role
+
+    validates :permission_key, presence: true,
+                               inclusion: { in: Permissions::KEYS, message: "is not a known permission" },
+                               uniqueness: { scope: :role_id }
+    validates :scope, inclusion: { in: Permissions::SCOPES.map(&:to_s) }
+
+    def covers?(needed_scope) = Permissions.scope_covers?(scope, needed_scope)
+  end
+end

data/app/models/hr_lite/salary_slip.rb

@@ -40,8 +40,7 @@ module HrLite
     # Indian FY (Apr 1) to-date sums of SETTLED slips before this period —
     # feeds the TDS projector and the slip's YTD table.
     def self.fy_to_date(user, period_month)
-      fy_start = period_month.month >= 4 ? Date.new(period_month.year, 4, 1)
-                                         : Date.new(period_month.year - 1, 4, 1)
+      fy_start = FinancialYear.start_for(period_month)
       slips = settled.where(user_id: user.id)
                      .where(period_month: fy_start...period_month)
       {

data/app/services/hr_lite/access.rb

@@ -0,0 +1,111 @@
+module HrLite
+  # The one place that answers "may this person do this, and to whose rows".
+  #
+  # Two questions, deliberately separated:
+  #
+  #   can?(user, "leave.approve")            — may they at all, at any scope
+  #   scope_for(user, "leave.approve")       — :self, :team, :all or nil
+  #   reaches?(user, "leave.approve", other) — may they, for THIS person
+  #
+  # A controller that only asks the first question is the bug this class
+  # exists to prevent: before roles, any admin could approve anybody's leave
+  # because nothing ever asked whose leave it was.
+  class Access
+    # Resolution touches three tables and every screen asks several times per
+    # request, so it is memoized per user for the life of the request.
+    def self.for(user)
+      # An unsaved user holds nothing: roles are rows keyed by user id, and
+      # there is no id yet to key them by.
+      return new(nil, {}) if user.nil? || user.id.nil?
+
+      Current.access_cache ||= {}
+      Current.access_cache[user.id] ||= new(user, resolve(user))
+    end
+
+    # The strongest scope held for each key across all of the user's roles.
+    # Two roles granting the same key keep the WIDER of the two — roles add
+    # up, they do not narrow each other.
+    def self.resolve(user)
+      grants = RoleGrant.joins(role: :role_assignments)
+                        .where(hr_lite_role_assignments: { user_id: user.id })
+                        .pluck(:permission_key, :scope)
+
+      grants.each_with_object({}) do |(key, scope), map|
+        held = map[key]
+        map[key] = scope if held.nil? || Permissions.scope_covers?(scope, held)
+      end
+    end
+
+    def initialize(user, permission_map)
+      @user = user
+      @map = permission_map
+    end
+
+    attr_reader :user
+
+    def scope_for(key)
+      @map[Permissions.validate!(key)]&.to_sym
+    end
+
+    def can?(key, scope: :self)
+      held = scope_for(key)
+      held.present? && Permissions.scope_covers?(held, scope)
+    end
+
+    # Whether this permission reaches a particular person's rows. `self`
+    # reaches only the holder; `team` reaches their direct and indirect
+    # reports; `all` reaches everyone.
+    def reaches?(key, subject_user)
+      return false if user.nil? || subject_user.nil?
+
+      case scope_for(key)
+      when :all then true
+      when :team then subject_user.id == user.id || report_ids.include?(subject_user.id)
+      when :self then subject_user.id == user.id
+      else false
+      end
+    end
+
+    # User ids this person's `team` scope covers, for scoping a whole
+    # relation rather than checking one row at a time. `all` returns nil,
+    # meaning "do not filter" — a caller that treats nil as an empty list
+    # would show leadership nothing, so the callers use `scope_relation`.
+    def visible_user_ids(key)
+      case scope_for(key)
+      when :all then nil
+      when :team then [ user.id, *report_ids ]
+      when :self then [ user.id ]
+      else []
+      end
+    end
+
+    # Narrows a relation to the rows this permission reaches. The column is
+    # named because not every table calls it user_id.
+    def scope_relation(relation, key, column: :user_id)
+      ids = visible_user_ids(key)
+      ids.nil? ? relation : relation.where(column => ids)
+    end
+
+    # Everyone below this person in the reporting chain. Walked breadth-first
+    # with a seen set — EmployeeProfile validates the chain is acyclic, but a
+    # cycle written directly to the database must not spin here forever.
+    def report_ids
+      @report_ids ||= begin
+        by_manager = EmployeeProfile.where.not(manager_id: nil).pluck(:manager_id, :user_id)
+                                    .group_by(&:first)
+                                    .transform_values { |pairs| pairs.map(&:last) }
+        found = []
+        seen = [ user.id ].to_set
+        queue = by_manager[user.id]&.dup || []
+
+        while (id = queue.shift)
+          next unless seen.add?(id)
+
+          found << id
+          queue.concat(by_manager[id] || [])
+        end
+        found
+      end
+    end
+  end
+end

data/app/services/hr_lite/payroll_run_processor.rb

@@ -12,7 +12,10 @@ module HrLite
     end
 
     def call
-      warnings = []
+      # First in the list on purpose: if the statutory card is from an older
+      # financial year, every number below it is computed on last year's
+      # rates and that is the thing to read first.
+      warnings = Array(StatutoryRateCard.warning_for(@run.period_month))
 
       ActiveRecord::Base.transaction do
         eligible = EmployeeProfile.active_for(@run.period_month).includes(:user).to_a

data/app/views/hr_lite/admin/roles/_form.html.erb

@@ -0,0 +1,47 @@
+<section class="hrl-card">
+  <%= form_with model: role, url: url, method: method, local: true do |f| %>
+    <%= render "hr_lite/shared/form_errors", record: role %>
+
+    <div class="hrl-field">
+      <%= f.label :name %>
+      <% if role.system? %>
+        <%= f.text_field :name, disabled: true %>
+        <span class="hrl-small hrl-muted">
+          Built-in roles keep their name — the upgrade path and the seed both
+          identify them by it. The permissions below are yours to change.
+        </span>
+      <% else %>
+        <%= f.text_field :name %>
+      <% end %>
+    </div>
+    <div class="hrl-field">
+      <%= f.label :description, "Description (shown on the roles list)" %>
+      <%= f.text_field :description %>
+    </div>
+
+    <% HrLite::Permissions.grouped.each do |group, keys| %>
+      <fieldset>
+        <legend><%= group %></legend>
+        <% keys.each do |key| %>
+          <% held = role.grant_map[key] || "none" %>
+          <div class="hrl-field">
+            <%= label_tag "grants_#{key.tr('.', '_')}", HrLite::Permissions.description(key) %>
+            <%= select_tag "grants[#{key}]",
+                  options_for_select([
+                    [ "Not granted", "none" ],
+                    [ "Their own records", "self" ],
+                    [ "Their team's records", "team" ],
+                    [ "Everyone's records", "all" ]
+                  ], held),
+                  id: "grants_#{key.tr('.', '_')}" %>
+          </div>
+        <% end %>
+      </fieldset>
+    <% end %>
+
+    <div class="hrl-form-actions">
+      <%= f.submit "Save", class: "hrl-btn hrl-btn--primary" %>
+      <a class="hrl-btn" href="<%= hr_lite.admin_roles_path %>">Cancel</a>
+    </div>
+  <% end %>
+</section>