hr_lite 0.5.3 → 0.7.0

data/app/controllers/hr_lite/admin/statutory_rate_cards_controller.rb

@@ -0,0 +1,97 @@
+module HrLite
+  module Admin
+    # Adding a financial year, and recording who checked it. Money tier: these
+    # figures decide what lands in a bank account.
+    #
+    # New years are created by COPYING the newest card — a year's PF and ESI
+    # figures usually carry over untouched and only the slabs move, so a blank
+    # form would be an invitation to mistype eight numbers that were already
+    # right.
+    class StatutoryRateCardsController < SuperadminController
+      def index
+        @cards = StatutoryRateCardRecord.chronological.reverse
+        @states = ProfessionalTaxSlab.distinct.order(:state).pluck(:state)
+      end
+
+      def new
+        newest = StatutoryRateCardRecord.chronological.last
+        @card = StatutoryRateCardRecord.new(
+          effective_from: next_financial_year(newest),
+          pf: newest&.pf || {}, esi: newest&.esi || {}, income_tax: newest&.income_tax || {}
+        )
+        @copied_from = newest
+      end
+
+      def create
+        @card = StatutoryRateCardRecord.new(card_params)
+        if @card.save
+          redirect_to admin_statutory_rate_cards_path,
+                      notice: "FY #{@card.financial_year} card saved. Payroll will use it " \
+                              "from #{@card.effective_from.strftime('%d %b %Y')}."
+        else
+          @copied_from = nil
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+        @card = StatutoryRateCardRecord.find(params[:id])
+      end
+
+      def update
+        @card = StatutoryRateCardRecord.find(params[:id])
+        if @card.update(card_params)
+          redirect_to admin_statutory_rate_cards_path, notice: "FY #{@card.financial_year} card updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      private
+
+      def next_financial_year(newest)
+        return FinancialYear.start_for(Date.current) if newest.nil?
+
+        [ newest.effective_from.next_year, FinancialYear.start_for(Date.current) ].max
+      end
+
+      # The figures arrive as flat strings from number fields and are stored
+      # as strings in JSON — a float would not survive the round trip intact,
+      # and these decide deductions.
+      def card_params
+        permitted = params.require(:statutory_rate_card)
+                          .permit(:effective_from, :verified_by, :verified_on, :notes,
+                                  pf: {}, esi: {}, income_tax: {})
+        permitted.to_h.tap do |attrs|
+          attrs["income_tax"] = rebuild_regimes(attrs["income_tax"]) if attrs["income_tax"]
+        end
+      end
+
+      # A blank `to` is the open-ended top slab and has to stay nil rather
+      # than becoming "" — the calculators read nil as "no upper bound".
+      def rebuild_regimes(income_tax)
+        income_tax.to_h do |regime, table|
+          rows = slab_rows(table["slabs"]).reject { |from, _to, _rate| from.blank? }
+          [ regime, table.except("slabs").merge(
+            "slabs" => rows.map { |from, to, rate| [ from, to.presence, rate ] },
+            "marginal_relief" => truthy?(table["marginal_relief"])
+          ) ]
+        end
+      end
+
+      # Two shapes reach here. The form posts index-keyed rows
+      # (`slabs[0][from]`), which Rails hands over as a hash. A card being
+      # copied — or a client posting one back unchanged — carries the stored
+      # array of [from, to, rate] triples.
+      def slab_rows(slabs)
+        case slabs
+        when Hash then slabs.values.map { |row| [ row["from"], row["to"], row["rate"] ] }
+        when Array then slabs.map { |row| Array(row).first(3) }
+        else []
+        end
+      end
+
+      def truthy?(value) = [ true, "1", "true" ].include?(value)
+    end
+  end
+end

data/app/controllers/hr_lite/admin/superadmin_controller.rb

@@ -1,20 +1,24 @@
 module HrLite
   module Admin
-    # Money tier: salary structures, payroll, slips, appraisals and
-    # promotions. Only config.superadmin_emails — ordinary leadership can
-    # govern policy and people but never sees another person's pay.
-    # The money tier stands on its own rather than layering on leadership: a
-    # payroll operator does not have to also govern people and policy.
-    # Inheriting the leadership check locked a configured superadmin who was
-    # absent from leadership_emails out of payroll entirely.
+    # Money screens: salary structures, payroll, slips, appraisals and
+    # promotions. Ordinary governing authority reaches none of it — leadership
+    # governs policy and people but never sees another person's pay.
+    #
+    # The money gate stands on its own rather than layering on the governing
+    # one: a payroll operator does not have to also govern people and policy.
+    # Stacking the two locked a configured money-tier user who was absent from
+    # the leadership list out of payroll entirely.
     class SuperadminController < LeadershipController
-      skip_before_action :require_hr_leadership!
-      before_action :require_hr_superadmin!
+      skip_before_action :require_governing_access!
+      before_action :require_money_access!
 
       private
 
-      def require_hr_superadmin!
-        hr_access_denied unless hr_superadmin?
+      # Deliberately payroll.manage rather than a "super admin" role name:
+      # roles are data an install re-cuts, and gating on a NAME would make
+      # renaming one a silent lock-out.
+      def require_money_access!
+        hr_require_permission!("payroll.manage", scope: :all)
       end
     end
   end

data/app/controllers/hr_lite/application_controller.rb

@@ -10,10 +10,48 @@ module HrLite
     before_action :hr_set_current_actor
     around_action :hr_use_time_zone
 
-    helper_method :hr_current_user, :hr_admin?, :hr_leadership?, :hr_superadmin?, :hr_display_name
+    helper_method :hr_current_user, :hr_admin?, :hr_leadership?, :hr_superadmin?, :hr_display_name,
+                  :hr_can?, :hr_reaches?, :hr_access
 
     private
 
+    # --- authorization -----------------------------------------------------
+
+    def hr_access
+      HrLite::Access.for(hr_current_user)
+    end
+
+    # May the signed-in person do this at all, at `scope` or wider?
+    def hr_can?(key, scope: :self)
+      hr_access.can?(key, scope: scope)
+    end
+
+    # May they do it to THIS person's records? The question the module could
+    # not ask before roles, and whose absence let any admin approve anybody's
+    # leave.
+    def hr_reaches?(key, subject_user)
+      hr_access.reaches?(key, subject_user)
+    end
+
+    # Gate a whole controller or action. `scope` is the weakest scope that can
+    # reach the screen at all — a manager reaching a team screen still has
+    # every ROW checked separately by `hr_require_reach!`.
+    def hr_require_permission!(key, scope: :self)
+      hr_access_denied unless hr_can?(key, scope: scope)
+    end
+
+    # Gate one record. Deliberately a 404, not a 403: whether a particular
+    # person exists is not something a stranger gets to learn from us.
+    def hr_require_reach!(key, subject_user)
+      raise ActiveRecord::RecordNotFound unless hr_reaches?(key, subject_user)
+    end
+
+    # Narrow a relation to the rows this permission reaches, so an index
+    # never renders a row the member action would refuse.
+    def hr_scope(relation, key, column: :user_id)
+      hr_access.scope_relation(relation, key, column: column)
+    end
+
     def hr_authenticate!
       send(HrLite.config.authenticate_method)
     end

data/app/helpers/hr_lite/application_helper.rb

@@ -24,9 +24,13 @@ module HrLite
       { label: "Audit",     path: :admin_audit_logs_path,       match: [ "/admin/audit_logs" ] }
     ].freeze
 
-    # Money tier — only config.superadmin_emails see these.
+    # Money screens, plus role management: granting somebody payroll is the
+    # same act as holding it, so it sits with the pay rather than with the
+    # other governing screens.
     SUPERADMIN_NAV_ITEMS = [
-      { label: "Payroll", path: :admin_payroll_runs_path, match: [ "/admin/payroll_runs", "/admin/salary_slips" ] }
+      { label: "Payroll", path: :admin_payroll_runs_path, match: [ "/admin/payroll_runs", "/admin/salary_slips" ] },
+      { label: "Roles",   path: :admin_roles_path,        match: [ "/admin/roles" ] },
+      { label: "Rates",   path: :admin_statutory_rate_cards_path, match: [ "/admin/statutory_rate_cards" ] }
     ].freeze
 
     # Only items whose routes exist yet (the nav grows with each phase).

data/app/models/hr_lite/professional_tax_slab.rb

@@ -0,0 +1,41 @@
+module HrLite
+  # One state's professional-tax band. PT is a state levy with its own slabs
+  # and its own revision schedule, so it is dated separately from the central
+  # rate card rather than living inside it.
+  class ProfessionalTaxSlab < ApplicationRecord
+    include Audited
+
+    self.table_name = "hr_lite_professional_tax_slabs"
+
+    # A state that genuinely levies nothing. Distinct from a state nobody has
+    # configured — see `configured?`, which is what stops payroll quietly
+    # deducting zero for a state whose slabs simply were never entered.
+    NO_LEVY = "none".freeze
+
+    validates :state, presence: true
+    validates :effective_from, presence: true
+    validates :from_amount, :monthly, presence: true,
+                                      numericality: { greater_than_or_equal_to: 0 }
+    validates :feb_extra, numericality: { greater_than_or_equal_to: 0 }, allow_nil: true
+
+    scope :for_state, ->(state) { where(state: state.to_s) }
+
+    # The bands in force for a state in a given month: the newest effective
+    # date that is not in the future, and every band carrying it.
+    def self.effective_for(state, period_month)
+      dates = for_state(state).where(effective_from: ..period_month)
+      newest = dates.maximum(:effective_from)
+      return none if newest.nil?
+
+      for_state(state).where(effective_from: newest).order(:from_amount)
+    end
+
+    # The shape Calculators::ProfessionalTax reads.
+    def self.table_for(state, period_month)
+      effective_for(state, period_month).map do |slab|
+        { from: Money.d(slab.from_amount), monthly: Money.d(slab.monthly),
+          feb_extra: slab.feb_extra && Money.d(slab.feb_extra) }.compact
+      end
+    end
+  end
+end

data/app/models/hr_lite/role.rb

@@ -0,0 +1,66 @@
+module HrLite
+  # A named bundle of grants. Roles are DATA — the seeded six are a starting
+  # point an install is expected to edit, not a fixed ladder in code.
+  class Role < ApplicationRecord
+    include Audited
+
+    # Seeded by name. `Employee` in particular is load-bearing: it is what a
+    # new hire is given so that self-service works on day one.
+    EMPLOYEE = "Employee".freeze
+    MANAGER = "Manager".freeze
+    HR = "HR".freeze
+    FINANCE = "Finance".freeze
+    LEADERSHIP = "Leadership".freeze
+    SUPER_ADMIN = "Super Admin".freeze
+
+    has_many :role_grants, dependent: :destroy
+    has_many :role_assignments, dependent: :destroy
+
+    validates :name, presence: true, uniqueness: { case_sensitive: false }
+    before_destroy :protect_system_role
+    validate :system_role_keeps_its_name, on: :update
+
+    scope :alphabetical, -> { order(:name) }
+
+    # Every key this role grants, mapped to its scope. The shape the access
+    # resolver merges.
+    def grant_map
+      role_grants.to_h { |grant| [ grant.permission_key, grant.scope ] }
+    end
+
+    # Replaces the whole grant set in one transaction — the roles screen posts
+    # the complete picture, so a permission absent from the form is a
+    # permission being taken away, not one left alone.
+    def replace_grants!(grants)
+      transaction do
+        role_grants.destroy_all
+        grants.each do |key, scope|
+          next if scope.blank? || scope.to_s == "none"
+
+          role_grants.create!(permission_key: Permissions.validate!(key), scope: scope.to_s)
+        end
+      end
+      reload
+    end
+
+    def system? = self[:system]
+
+    private
+
+    def protect_system_role
+      return unless system?
+
+      errors.add(:base, "#{name} is a built-in role and cannot be deleted")
+      throw :abort
+    end
+
+    # The name is the identifier the seed, the upgrade path and the specs all
+    # use. Permissions on a system role are free to change; what it is called
+    # is not.
+    def system_role_keeps_its_name
+      return unless system? && name_changed?
+
+      errors.add(:name, "cannot be changed on a built-in role")
+    end
+  end
+end

data/app/models/hr_lite/role_assignment.rb

@@ -0,0 +1,18 @@
+module HrLite
+  # Who holds which role. Assignments are audited because granting somebody
+  # the money tier is exactly the kind of change that has to be explainable
+  # afterwards.
+  class RoleAssignment < ApplicationRecord
+    include Audited
+
+    belongs_to :role
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :granted_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :user_id, uniqueness: { scope: :role_id }
+
+    scope :for_user, ->(user) { where(user_id: user.id) }
+
+    def hr_lite_audit_label = "#{HrLite.display_name(user)} — #{role.name}"
+  end
+end

data/app/models/hr_lite/role_grant.rb

@@ -0,0 +1,15 @@
+module HrLite
+  # One (role, permission, scope) triple. The permission key is validated
+  # against the declared registry, so a typo is a refused write rather than a
+  # grant that silently never matches anything.
+  class RoleGrant < ApplicationRecord
+    belongs_to :role
+
+    validates :permission_key, presence: true,
+                               inclusion: { in: Permissions::KEYS, message: "is not a known permission" },
+                               uniqueness: { scope: :role_id }
+    validates :scope, inclusion: { in: Permissions::SCOPES.map(&:to_s) }
+
+    def covers?(needed_scope) = Permissions.scope_covers?(scope, needed_scope)
+  end
+end

data/app/models/hr_lite/statutory_rate_card_record.rb

@@ -0,0 +1,95 @@
+module HrLite
+  # A financial year's statutory figures, as data. Named for the table rather
+  # than the lookup module (HrLite::StatutoryRateCard) that reads it — hosts
+  # and specs call the module, not this.
+  class StatutoryRateCardRecord < ApplicationRecord
+    include Audited
+
+    self.table_name = "hr_lite_statutory_rate_cards"
+
+    validates :effective_from, presence: true, uniqueness: true
+    validate :effective_from_opens_a_financial_year
+    validate :carries_every_figure_payroll_reads
+
+    scope :chronological, -> { order(:effective_from) }
+
+    def self.effective_for(period_month)
+      where(effective_from: ..period_month).order(effective_from: :desc).first ||
+        chronological.first
+    end
+
+    def financial_year = FinancialYear.label(effective_from)
+
+    def verified? = verified_by.present? && verified_on.present?
+
+    # The shape SlipBuilder and the calculators expect: symbol keys and
+    # BigDecimal everywhere, because JSON gives back strings and floats and
+    # a float has no business in a PF calculation.
+    def to_card
+      {
+        pf: deep_decimalize(pf).symbolize_keys,
+        esi: deep_decimalize(esi).symbolize_keys,
+        pt: {}, # slabs live in their own table — resolved by state at use
+        income_tax: income_tax.transform_values { |regime| decimalize_regime(regime) }
+      }
+    end
+
+    private
+
+    def decimalize_regime(regime)
+      regime = regime.symbolize_keys
+      regime.merge(
+        standard_deduction: Money.d(regime[:standard_deduction]),
+        rebate_cap: Money.d(regime[:rebate_cap]),
+        cess_rate: Money.d(regime[:cess_rate]),
+        marginal_relief: !!regime[:marginal_relief],
+        slabs: Array(regime[:slabs]).map { |from, to, rate|
+          [ Money.d(from), to.nil? ? nil : Money.d(to), Money.d(rate) ]
+        }
+      )
+    end
+
+    def deep_decimalize(hash)
+      hash.to_h { |key, value| [ key, Money.d(value) ] }
+    end
+
+    # A card dated mid-year would mean two sets of slabs inside one financial
+    # year, and the TDS projector works on an annual figure — there is no
+    # sensible answer to "which slabs applied to this year's income" then.
+    def effective_from_opens_a_financial_year
+      return if effective_from.blank?
+      return if effective_from == FinancialYear.start_for(effective_from)
+
+      errors.add(:effective_from, "must be 1 April — a card covers a whole financial year")
+    end
+
+    REQUIRED = {
+      "pf" => %w[employee_rate employer_rate eps_rate wage_ceiling eps_wage_ceiling
+                 edli_rate edli_ceiling admin_rate],
+      "esi" => %w[employee_rate employer_rate gross_ceiling]
+    }.freeze
+
+    # A card missing a figure does not fail at save time; it fails halfway
+    # through computing somebody's salary, as a NoMethodError on nil.
+    def carries_every_figure_payroll_reads
+      REQUIRED.each do |attribute, keys|
+        missing = keys - Array(public_send(attribute)&.keys)
+        errors.add(attribute, "is missing #{missing.join(', ')}") if missing.any?
+      end
+
+      %w[new old].each do |regime|
+        table = income_tax[regime]
+        next errors.add(:income_tax, "is missing the #{regime} regime") if table.blank?
+
+        missing = %w[standard_deduction rebate_cap cess_rate slabs] - table.keys
+        next errors.add(:income_tax, "#{regime} regime is missing #{missing.join(', ')}") if missing.any?
+
+        # A present-but-empty slab list is the dangerous shape: it validates
+        # on key presence and then taxes everybody at zero.
+        if Array(table["slabs"]).empty?
+          errors.add(:income_tax, "#{regime} regime has no tax slabs — every salary would be taxed at zero")
+        end
+      end
+    end
+  end
+end

data/app/services/hr_lite/access.rb

@@ -0,0 +1,111 @@
+module HrLite
+  # The one place that answers "may this person do this, and to whose rows".
+  #
+  # Two questions, deliberately separated:
+  #
+  #   can?(user, "leave.approve")            — may they at all, at any scope
+  #   scope_for(user, "leave.approve")       — :self, :team, :all or nil
+  #   reaches?(user, "leave.approve", other) — may they, for THIS person
+  #
+  # A controller that only asks the first question is the bug this class
+  # exists to prevent: before roles, any admin could approve anybody's leave
+  # because nothing ever asked whose leave it was.
+  class Access
+    # Resolution touches three tables and every screen asks several times per
+    # request, so it is memoized per user for the life of the request.
+    def self.for(user)
+      # An unsaved user holds nothing: roles are rows keyed by user id, and
+      # there is no id yet to key them by.
+      return new(nil, {}) if user.nil? || user.id.nil?
+
+      Current.access_cache ||= {}
+      Current.access_cache[user.id] ||= new(user, resolve(user))
+    end
+
+    # The strongest scope held for each key across all of the user's roles.
+    # Two roles granting the same key keep the WIDER of the two — roles add
+    # up, they do not narrow each other.
+    def self.resolve(user)
+      grants = RoleGrant.joins(role: :role_assignments)
+                        .where(hr_lite_role_assignments: { user_id: user.id })
+                        .pluck(:permission_key, :scope)
+
+      grants.each_with_object({}) do |(key, scope), map|
+        held = map[key]
+        map[key] = scope if held.nil? || Permissions.scope_covers?(scope, held)
+      end
+    end
+
+    def initialize(user, permission_map)
+      @user = user
+      @map = permission_map
+    end
+
+    attr_reader :user
+
+    def scope_for(key)
+      @map[Permissions.validate!(key)]&.to_sym
+    end
+
+    def can?(key, scope: :self)
+      held = scope_for(key)
+      held.present? && Permissions.scope_covers?(held, scope)
+    end
+
+    # Whether this permission reaches a particular person's rows. `self`
+    # reaches only the holder; `team` reaches their direct and indirect
+    # reports; `all` reaches everyone.
+    def reaches?(key, subject_user)
+      return false if user.nil? || subject_user.nil?
+
+      case scope_for(key)
+      when :all then true
+      when :team then subject_user.id == user.id || report_ids.include?(subject_user.id)
+      when :self then subject_user.id == user.id
+      else false
+      end
+    end
+
+    # User ids this person's `team` scope covers, for scoping a whole
+    # relation rather than checking one row at a time. `all` returns nil,
+    # meaning "do not filter" — a caller that treats nil as an empty list
+    # would show leadership nothing, so the callers use `scope_relation`.
+    def visible_user_ids(key)
+      case scope_for(key)
+      when :all then nil
+      when :team then [ user.id, *report_ids ]
+      when :self then [ user.id ]
+      else []
+      end
+    end
+
+    # Narrows a relation to the rows this permission reaches. The column is
+    # named because not every table calls it user_id.
+    def scope_relation(relation, key, column: :user_id)
+      ids = visible_user_ids(key)
+      ids.nil? ? relation : relation.where(column => ids)
+    end
+
+    # Everyone below this person in the reporting chain. Walked breadth-first
+    # with a seen set — EmployeeProfile validates the chain is acyclic, but a
+    # cycle written directly to the database must not spin here forever.
+    def report_ids
+      @report_ids ||= begin
+        by_manager = EmployeeProfile.where.not(manager_id: nil).pluck(:manager_id, :user_id)
+                                    .group_by(&:first)
+                                    .transform_values { |pairs| pairs.map(&:last) }
+        found = []
+        seen = [ user.id ].to_set
+        queue = by_manager[user.id]&.dup || []
+
+        while (id = queue.shift)
+          next unless seen.add?(id)
+
+          found << id
+          queue.concat(by_manager[id] || [])
+        end
+        found
+      end
+    end
+  end
+end

data/app/services/hr_lite/calculators/professional_tax.rb

@@ -1,11 +1,16 @@
 module HrLite
   module Calculators
-    # State-slab professional tax on earned gross. Unknown states and
-    # states without PT (UP, Uttarakhand) simply yield zero. Slabs may
-    # carry a feb_extra for states that top up the February deduction.
+    # State-slab professional tax on earned gross. Slabs may carry a
+    # feb_extra for the states that top up the last month's deduction.
+    #
+    # Slabs come from `hr_lite_professional_tax_slabs`, dated per state,
+    # falling back to whatever `rates` hash the caller passes for a host that
+    # has not seeded yet. A state nobody configured yields zero — and
+    # `unconfigured?` is how payroll gets to SAY so, because a confident zero
+    # is the failure mode here, not an exception.
     module ProfessionalTax
-      def self.call(state:, gross_earned:, period_month:, rates:)
-        slabs = rates[state.to_s] || []
+      def self.call(state:, gross_earned:, period_month:, rates: {})
+        slabs = slabs_for(state, period_month, rates)
         earned = Money.d(gross_earned)
 
         # `from:` is an INCLUSIVE lower bound — ₹25,000 is taxed, ₹24,999.50 is
@@ -19,6 +24,30 @@ module HrLite
         amount += slab[:feb_extra] if slab[:feb_extra] && period_month.month == 2
         Money.round_rupee(amount)
       end
+
+      def self.slabs_for(state, period_month, rates = {})
+        stored = stored_slabs(state, period_month)
+        return stored if stored.present?
+
+        rates[state.to_s] || []
+      end
+
+      # A state with no stored slabs and none in the fallback table. That is
+      # NOT the same as a state with no professional tax: Karnataka was the
+      # only state ever entered in code, so every other one deducted nothing
+      # and nothing said so.
+      def self.unconfigured?(state, period_month, rates = {})
+        return false if state.to_s == ProfessionalTaxSlab::NO_LEVY
+
+        slabs_for(state, period_month, rates).empty?
+      end
+
+      def self.stored_slabs(state, period_month)
+        ProfessionalTaxSlab.table_for(state, period_month)
+      rescue ActiveRecord::ActiveRecordError
+        # Host mid-migration: gem upgraded, db:migrate not yet run.
+        []
+      end
     end
   end
 end

data/app/services/hr_lite/payroll_run_processor.rb

@@ -16,10 +16,12 @@ module HrLite
       # financial year, every number below it is computed on last year's
       # rates and that is the thing to read first.
       warnings = Array(StatutoryRateCard.warning_for(@run.period_month))
+      warnings.concat(Array(StatutoryRateCard.unverified_for(@run.period_month)))
 
       ActiveRecord::Base.transaction do
         eligible = EmployeeProfile.active_for(@run.period_month).includes(:user).to_a
         keep_ids = []
+        unconfigured_states = []
 
         eligible.each do |profile|
           user = profile.user
@@ -29,6 +31,14 @@ module HrLite
             next
           end
 
+          # Professional tax is a state levy, and a state nobody has entered
+          # slabs for deducts nothing — which looks exactly like a state that
+          # levies nothing. Collected per state rather than per employee so a
+          # forty-person office is one line, not forty.
+          if Calculators::ProfessionalTax.unconfigured?(structure.pt_state, @run.period_month)
+            unconfigured_states << structure.pt_state
+          end
+
           slip = @run.salary_slips.find_or_initialize_by(user_id: user.id)
           attributes = SlipBuilder.call(
             run: @run, user: user, structure: structure, profile: profile,
@@ -44,6 +54,13 @@ module HrLite
           keep_ids << slip.id
         end
 
+        unconfigured_states.uniq.sort.each do |state|
+          warnings << "No professional-tax slabs are configured for " \
+                      "#{state.to_s.humanize} — everybody there is being deducted ₹0. " \
+                      "Enter that state's bands, or set their structures to 'none' if " \
+                      "it genuinely levies no PT."
+        end
+
         @run.salary_slips.where.not(id: keep_ids).destroy_all
         @run.update!(warnings: warnings)
       end