hr_lite 0.5.2 → 0.6.0

data/lib/hr_lite.rb

@@ -3,6 +3,9 @@ require "hr_lite/engine"
 require "hr_lite/configuration"
 require "hr_lite/current"
 require "hr_lite/leave_year"
+require "hr_lite/financial_year"
+require "hr_lite/permissions"
+require "hr_lite/role_seeds"
 require "hr_lite/mention_parser"
 require "hr_lite/notifications"
 require "hr_lite/seeds"
@@ -30,34 +33,101 @@ module HrLite
       config.user_class.constantize
     end
 
+    # --- authorization -----------------------------------------------------
+
+    # The question every gate now asks. `scope:` is what the CALLER needs;
+    # a holder with a wider scope satisfies it.
+    def can?(user, key, scope: :self)
+      Access.for(user).can?(key, scope: scope)
+    end
+
+    # Whether `user` may exercise `key` over `subject`'s rows. This is the
+    # question that did not exist before roles, and its absence is why any
+    # admin could approve anybody's leave.
+    def reaches?(user, key, subject)
+      Access.for(user).reaches?(key, subject)
+    end
+
+    def access_for(user) = Access.for(user)
+
+    # --- legacy tier predicates --------------------------------------------
+    #
+    # Kept because views, hosts and the notification fan-out all call them.
+    # They are now READ OFF ROLES rather than off a mutable email column; the
+    # configured lambdas survive only as an explicit opt-in for a host that
+    # has not migrated yet (see Configuration#legacy_tier_checks).
+
     def admin?(user)
-      user.present? && !!config.admin_check.call(user)
+      return false if user.blank?
+      return !!config.admin_check.call(user) if config.legacy_tier_checks
+
+      can?(user, "leave.approve", scope: :all) || can?(user, "attendance.manage", scope: :all)
     end
 
     def leadership?(user)
-      user.present? && !!config.leadership_check.call(user)
+      return false if user.blank?
+      return !!config.leadership_check.call(user) if config.legacy_tier_checks
+
+      can?(user, "profile.manage", scope: :all)
     end
 
     def superadmin?(user)
-      user.present? && !!config.superadmin_check.call(user)
+      return false if user.blank?
+      return !!config.superadmin_check.call(user) if config.legacy_tier_checks
+
+      can?(user, "payroll.manage", scope: :all)
+    end
+
+    # An access list, cleaned. "a@x.com,,b@x.com".split(",") — one stray
+    # comma in an ENV var — used to put "" in the list, and a user whose
+    # email was blank then MATCHED it and was handed the tier.
+    def normalize_email_list(emails)
+      Array(emails).map { |e| e.to_s.downcase.strip }.reject(&:empty?)
+    end
+
+    # Whether a user's own email is on a configured access list. A blank
+    # email is never on any list, however the list is spelled.
+    def email_listed?(user, emails)
+      address = user.respond_to?(:email) ? user.email.to_s.downcase.strip : ""
+      return false if address.empty?
+
+      normalize_email_list(emails).include?(address)
     end
 
     # Leadership members resolvable to actual user records (for bell
-    # notifications). Emails configured but absent from the user table are
-    # still reachable by email — see Notifications.
+    # notifications). On a legacy host, emails configured but absent from the
+    # user table are still reachable by email — see Notifications.
     def leadership_users
-      emails = config.leadership_emails.map { |e| e.to_s.downcase.strip }.reject(&:empty?)
+      unless config.legacy_tier_checks
+        return users_holding("profile.manage", scope: :all)
+      end
+
+      emails = normalize_email_list(config.leadership_emails)
       return user_klass.none if emails.empty?
 
       user_klass.where("LOWER(#{user_klass.table_name}.email) IN (?)", emails)
     end
 
-    # Every domain event that bells the admins calls this. Loading and
-    # instantiating the entire users table to run admin_check per row is fine
-    # at ten staff and silly at a thousand — so it starts from employees_scope
-    # (which a host narrows to real staff) rather than every row that exists.
+    # Everyone whose roles grant `key` at `scope` or wider. One query over
+    # the grant tables rather than instantiating every user and asking.
+    def users_holding(key, scope: :all)
+      wide = Permissions::SCOPE_RANK.select { |_, rank| rank >= Permissions::SCOPE_RANK.fetch(scope) }
+      ids = RoleAssignment.joins(role: :role_grants)
+                          .where(hr_lite_role_grants: {
+                            permission_key: Permissions.validate!(key), scope: wide.keys.map(&:to_s)
+                          })
+                          .distinct.pluck(:user_id)
+      user_klass.where(id: ids)
+    end
+
+    # Every domain event that bells the admins calls this. On roles it is one
+    # query over the grant tables; on a legacy host it still has to run the
+    # host's lambda per row, which is why it starts from employees_scope
+    # (narrowed to real staff) rather than every row that exists.
     def admin_users
-      employees.select { |u| admin?(u) }
+      return employees.select { |u| admin?(u) } if config.legacy_tier_checks
+
+      users_holding("leave.approve", scope: :all).sort_by { |u| display_name(u).downcase }
     end
 
     # Everyone HR tracks (host-overridable to exclude bots/test accounts),

data/lib/tasks/hr_lite_tasks.rake

@@ -1,8 +1,16 @@
 namespace :hr_lite do
-  desc "Idempotently seed HR reference data (leave types, national holidays)"
+  desc "Idempotently seed HR reference data (leave types, national holidays, roles)"
   task seed: :environment do
     require "hr_lite/seeds"
-    created = HrLite::Seeds.run!
+    require "hr_lite/role_seeds"
+    created = HrLite::Seeds.run! + HrLite::RoleSeeds.call
     puts created.any? ? "hr_lite:seed created: #{created.join(', ')}" : "hr_lite:seed — nothing to do"
   end
+
+  desc "Idempotently seed the built-in roles only (never overwrites a tuned role)"
+  task roles: :environment do
+    require "hr_lite/role_seeds"
+    created = HrLite::RoleSeeds.call
+    puts created.any? ? "hr_lite:roles created: #{created.join(', ')}" : "hr_lite:roles — nothing to do"
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.6.0
 platform: ruby
 authors:
 - kshitiz sinha
@@ -72,6 +72,8 @@ files:
 - app/controllers/hr_lite/admin/payroll_runs_controller.rb
 - app/controllers/hr_lite/admin/regularization_requests_controller.rb
 - app/controllers/hr_lite/admin/resignations_controller.rb
+- app/controllers/hr_lite/admin/role_assignments_controller.rb
+- app/controllers/hr_lite/admin/roles_controller.rb
 - app/controllers/hr_lite/admin/salary_slips_controller.rb
 - app/controllers/hr_lite/admin/salary_structures_controller.rb
 - app/controllers/hr_lite/admin/settings_controller.rb
@@ -120,9 +122,13 @@ files:
 - app/models/hr_lite/payroll_run.rb
 - app/models/hr_lite/regularization_request.rb
 - app/models/hr_lite/resignation.rb
+- app/models/hr_lite/role.rb
+- app/models/hr_lite/role_assignment.rb
+- app/models/hr_lite/role_grant.rb
 - app/models/hr_lite/salary_slip.rb
 - app/models/hr_lite/salary_structure.rb
 - app/models/hr_lite/setting.rb
+- app/services/hr_lite/access.rb
 - app/services/hr_lite/attendance_puncher.rb
 - app/services/hr_lite/attendance_summary.rb
 - app/services/hr_lite/calculators/esi.rb
@@ -170,6 +176,10 @@ files:
 - app/views/hr_lite/admin/payroll_runs/show.html.erb
 - app/views/hr_lite/admin/regularization_requests/index.html.erb
 - app/views/hr_lite/admin/regularization_requests/show.html.erb
+- app/views/hr_lite/admin/roles/_form.html.erb
+- app/views/hr_lite/admin/roles/edit.html.erb
+- app/views/hr_lite/admin/roles/index.html.erb
+- app/views/hr_lite/admin/roles/new.html.erb
 - app/views/hr_lite/admin/salary_slips/show.html.erb
 - app/views/hr_lite/admin/salary_structures/_form.html.erb
 - app/views/hr_lite/admin/salary_structures/edit.html.erb
@@ -242,6 +252,9 @@ files:
 - db/migrate/20260807184103_add_live_uniqueness_indexes_to_hr_lite.rb
 - db/migrate/20260807184426_add_fy_opening_to_hr_lite_employee_profiles.rb
 - db/migrate/20260807184939_add_out_of_window_days_to_hr_lite_salary_slips.rb
+- db/migrate/20260817182124_add_status_constraints_and_appraisal_fk_to_hr_lite.rb
+- db/migrate/20260817183347_create_hr_lite_roles_and_grants.rb
+- db/migrate/20260817183629_seed_hr_lite_roles_from_email_tiers.rb
 - lib/generators/hr_lite/install/install_generator.rb
 - lib/generators/hr_lite/install/templates/AFTER_INSTALL
 - lib/generators/hr_lite/install/templates/initializer.rb
@@ -250,11 +263,14 @@ files:
 - lib/hr_lite/configuration.rb
 - lib/hr_lite/current.rb
 - lib/hr_lite/engine.rb
+- lib/hr_lite/financial_year.rb
 - lib/hr_lite/geo.rb
 - lib/hr_lite/leave_year.rb
 - lib/hr_lite/mention_parser.rb
 - lib/hr_lite/money.rb
 - lib/hr_lite/notifications.rb
+- lib/hr_lite/permissions.rb
+- lib/hr_lite/role_seeds.rb
 - lib/hr_lite/seeds.rb
 - lib/hr_lite/statutory_rate_card.rb
 - lib/hr_lite/version.rb