hr_lite 0.5.3 → 0.7.0

data/app/views/hr_lite/admin/roles/_form.html.erb

@@ -0,0 +1,47 @@
+<section class="hrl-card">
+  <%= form_with model: role, url: url, method: method, local: true do |f| %>
+    <%= render "hr_lite/shared/form_errors", record: role %>
+
+    <div class="hrl-field">
+      <%= f.label :name %>
+      <% if role.system? %>
+        <%= f.text_field :name, disabled: true %>
+        <span class="hrl-small hrl-muted">
+          Built-in roles keep their name — the upgrade path and the seed both
+          identify them by it. The permissions below are yours to change.
+        </span>
+      <% else %>
+        <%= f.text_field :name %>
+      <% end %>
+    </div>
+    <div class="hrl-field">
+      <%= f.label :description, "Description (shown on the roles list)" %>
+      <%= f.text_field :description %>
+    </div>
+
+    <% HrLite::Permissions.grouped.each do |group, keys| %>
+      <fieldset>
+        <legend><%= group %></legend>
+        <% keys.each do |key| %>
+          <% held = role.grant_map[key] || "none" %>
+          <div class="hrl-field">
+            <%= label_tag "grants_#{key.tr('.', '_')}", HrLite::Permissions.description(key) %>
+            <%= select_tag "grants[#{key}]",
+                  options_for_select([
+                    [ "Not granted", "none" ],
+                    [ "Their own records", "self" ],
+                    [ "Their team's records", "team" ],
+                    [ "Everyone's records", "all" ]
+                  ], held),
+                  id: "grants_#{key.tr('.', '_')}" %>
+          </div>
+        <% end %>
+      </fieldset>
+    <% end %>
+
+    <div class="hrl-form-actions">
+      <%= f.submit "Save", class: "hrl-btn hrl-btn--primary" %>
+      <a class="hrl-btn" href="<%= hr_lite.admin_roles_path %>">Cancel</a>
+    </div>
+  <% end %>
+</section>

data/app/views/hr_lite/admin/roles/edit.html.erb

@@ -0,0 +1,53 @@
+<% content_for(:page_title) { @role.name } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title"><%= @role.name %></h1>
+  <% unless @role.system? %>
+    <div class="hrl-page__actions">
+      <%= button_to "Delete role", hr_lite.admin_role_path(@role), method: :delete,
+            class: "hrl-btn hrl-btn--danger",
+            form: { data: { turbo_confirm: "Delete #{@role.name}? Everyone holding it loses that access." } } %>
+    </div>
+  <% end %>
+</div>
+
+<%= render "form", role: @role, url: hr_lite.admin_role_path(@role), method: :patch %>
+
+<section class="hrl-card">
+  <h2 class="hrl-card__title">Who holds this role</h2>
+  <% assignments = @role.role_assignments.includes(:user).sort_by { |a| hr_display_name(a.user).downcase } %>
+  <% if assignments.empty? %>
+    <p class="hrl-muted">Nobody yet.</p>
+  <% else %>
+    <div class="hrl-table-wrap">
+      <table class="hrl-table hrl-table--stack">
+        <thead><tr><th>Person</th><th>Added</th><th></th></tr></thead>
+        <tbody>
+          <% assignments.each do |assignment| %>
+            <tr>
+              <td data-label="Person"><%= hr_display_name(assignment.user) %></td>
+              <td data-label="Added"><%= assignment.created_at.to_date.strftime("%d %b %Y") %></td>
+              <td data-label="">
+                <%= button_to "Remove", hr_lite.admin_role_assignment_path(@role, assignment),
+                      method: :delete, class: "hrl-btn",
+                      form: { data: { turbo_confirm: "Remove #{hr_display_name(assignment.user)} from #{@role.name}?" } } %>
+              </td>
+            </tr>
+          <% end %>
+        </tbody>
+      </table>
+    </div>
+  <% end %>
+
+  <%= form_with url: hr_lite.admin_role_assignments_path(@role), method: :post, local: true do %>
+    <div class="hrl-field">
+      <%= label_tag :user_id, "Add somebody to this role" %>
+      <% held = @role.role_assignments.map(&:user_id) %>
+      <%= select_tag :user_id,
+            options_for_select(HrLite.employees.reject { |u| held.include?(u.id) }
+                                     .map { |u| [ hr_display_name(u), u.id ] }) %>
+    </div>
+    <div class="hrl-form-actions">
+      <%= submit_tag "Add", class: "hrl-btn hrl-btn--primary" %>
+    </div>
+  <% end %>
+</section>

data/app/views/hr_lite/admin/roles/index.html.erb

@@ -0,0 +1,49 @@
+<% content_for(:page_title) { "Roles" } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title">Roles &amp; permissions</h1>
+  <div class="hrl-page__actions">
+    <a class="hrl-btn hrl-btn--primary" href="<%= hr_lite.new_admin_role_path %>">Add role</a>
+  </div>
+</div>
+
+<section class="hrl-card">
+  <p class="hrl-muted hrl-small">
+    A permission is what somebody may do; its scope is whose records they may
+    do it to — only their own, their reports', or everyone's.
+  </p>
+  <div class="hrl-table-wrap">
+    <table class="hrl-table hrl-table--stack">
+      <thead><tr><th>Role</th><th>People</th><th>Reaches</th><th></th></tr></thead>
+      <tbody>
+        <% @roles.each do |role| %>
+          <tr>
+            <td data-label="Role">
+              <strong><%= role.name %></strong>
+              <% if role.system? %><span class="hrl-badge hrl-badge--muted">Built-in</span><% end %>
+              <% if role.description.present? %>
+                <div class="hrl-small hrl-muted"><%= role.description %></div>
+              <% end %>
+            </td>
+            <td data-label="People" class="hrl-num"><%= role.role_assignments.size %></td>
+            <td data-label="Reaches">
+              <% company_wide = role.role_grants.count { |g| g.scope == "all" } %>
+              <% team = role.role_grants.count { |g| g.scope == "team" } %>
+              <%= role.role_grants.size %> permission<%= "s" unless role.role_grants.size == 1 %>
+              <%# Joined rather than concatenated: a role with team grants and
+                  no company-wide ones rendered a leading "·" with nothing
+                  in front of it. %>
+              <% reach = [ ("#{company_wide} company-wide" if company_wide.positive?),
+                           ("#{team} own team" if team.positive?) ].compact %>
+              <% if reach.any? %>
+                <span class="hrl-small hrl-muted"><%= reach.join(" · ") %></span>
+              <% end %>
+            </td>
+            <td data-label="">
+              <a class="hrl-small" href="<%= hr_lite.edit_admin_role_path(role) %>">Edit</a>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+</section>

data/app/views/hr_lite/admin/roles/new.html.erb

@@ -0,0 +1,3 @@
+<% content_for(:page_title) { "New role" } %>
+<div class="hrl-page__head"><h1 class="hrl-page__title">New role</h1></div>
+<%= render "form", role: @role, url: hr_lite.admin_roles_path, method: :post %>

data/app/views/hr_lite/admin/statutory_rate_cards/_form.html.erb

@@ -0,0 +1,109 @@
+<section class="hrl-card">
+  <% if local_assigns[:copied_from] %>
+    <p class="hrl-muted hrl-small">
+      Copied from FY <%= copied_from.financial_year %>. Most years carry PF and
+      ESI over untouched and move only the slabs — change what the Finance Act
+      changed, and leave the rest.
+    </p>
+  <% end %>
+
+  <%= form_with model: card, url: url, method: method, local: true,
+                scope: :statutory_rate_card do |f| %>
+    <%= render "hr_lite/shared/form_errors", record: card %>
+
+    <div class="hrl-field">
+      <%= f.label :effective_from, "Financial year starts (1 April)" %>
+      <%= f.date_field :effective_from %>
+    </div>
+
+    <fieldset>
+      <legend>Provident fund</legend>
+      <% { employee_rate: "Employee rate (0.12 = 12%)", employer_rate: "Employer rate",
+           eps_rate: "EPS rate", wage_ceiling: "PF wage ceiling (₹)",
+           eps_wage_ceiling: "EPS wage ceiling (₹)", edli_rate: "EDLI rate",
+           edli_ceiling: "EDLI ceiling (₹)", admin_rate: "PF admin rate" }.each do |key, label| %>
+        <div class="hrl-field">
+          <%= label_tag "statutory_rate_card_pf_#{key}", label %>
+          <%= text_field_tag "statutory_rate_card[pf][#{key}]", card.pf[key.to_s],
+                             id: "statutory_rate_card_pf_#{key}", inputmode: "decimal" %>
+        </div>
+      <% end %>
+    </fieldset>
+
+    <fieldset>
+      <legend>ESI</legend>
+      <% { employee_rate: "Employee rate", employer_rate: "Employer rate",
+           gross_ceiling: "Gross ceiling (₹)" }.each do |key, label| %>
+        <div class="hrl-field">
+          <%= label_tag "statutory_rate_card_esi_#{key}", label %>
+          <%= text_field_tag "statutory_rate_card[esi][#{key}]", card.esi[key.to_s],
+                             id: "statutory_rate_card_esi_#{key}", inputmode: "decimal" %>
+        </div>
+      <% end %>
+    </fieldset>
+
+    <% %w[new old].each do |regime| %>
+      <% table = card.income_tax[regime] || {} %>
+      <fieldset>
+        <legend><%= regime.capitalize %> regime</legend>
+        <% { "standard_deduction" => "Standard deduction (₹)",
+             "rebate_cap" => "§87A rebate cap (₹)",
+             "cess_rate" => "Cess rate (0.04 = 4%)" }.each do |key, label| %>
+          <div class="hrl-field">
+            <%= label_tag "statutory_rate_card_it_#{regime}_#{key}", label %>
+            <%= text_field_tag "statutory_rate_card[income_tax][#{regime}][#{key}]", table[key],
+                               id: "statutory_rate_card_it_#{regime}_#{key}", inputmode: "decimal" %>
+          </div>
+        <% end %>
+        <div class="hrl-field hrl-field--check">
+          <%= hidden_field_tag "statutory_rate_card[income_tax][#{regime}][marginal_relief]", "0" %>
+          <%= check_box_tag "statutory_rate_card[income_tax][#{regime}][marginal_relief]", "1",
+                            table["marginal_relief"] %>
+          <%= label_tag "statutory_rate_card_income_tax_#{regime}_marginal_relief",
+                        "Marginal relief just above the rebate cap" %>
+        </div>
+
+        <p class="hrl-small hrl-muted">
+          Slabs, lowest first. Leave the last band's "up to" empty — that is
+          the open-ended top rate.
+        </p>
+        <% slabs = Array(table["slabs"]) %>
+        <% (slabs + [ nil, nil ]).each_with_index do |row, index| %>
+          <div class="hrl-row">
+            <%= text_field_tag "statutory_rate_card[income_tax][#{regime}][slabs][#{index}][from]",
+                               row&.first, placeholder: "From ₹", inputmode: "decimal" %>
+            <%= text_field_tag "statutory_rate_card[income_tax][#{regime}][slabs][#{index}][to]",
+                               row&.at(1), placeholder: "Up to ₹ (blank = top)", inputmode: "decimal" %>
+            <%= text_field_tag "statutory_rate_card[income_tax][#{regime}][slabs][#{index}][rate]",
+                               row&.last, placeholder: "Rate (0.05)", inputmode: "decimal" %>
+          </div>
+        <% end %>
+      </fieldset>
+    <% end %>
+
+    <fieldset>
+      <legend>Sign-off</legend>
+      <p class="hrl-small hrl-muted">
+        Until a card is signed off, every payroll run computed on it carries a
+        warning. Record the person who actually checked the figures.
+      </p>
+      <div class="hrl-field">
+        <%= f.label :verified_by, "Checked by (name)" %>
+        <%= f.text_field :verified_by %>
+      </div>
+      <div class="hrl-field">
+        <%= f.label :verified_on, "Checked on" %>
+        <%= f.date_field :verified_on %>
+      </div>
+      <div class="hrl-field">
+        <%= f.label :notes, "Notes" %>
+        <%= f.text_field :notes %>
+      </div>
+    </fieldset>
+
+    <div class="hrl-form-actions">
+      <%= f.submit "Save", class: "hrl-btn hrl-btn--primary" %>
+      <a class="hrl-btn" href="<%= hr_lite.admin_statutory_rate_cards_path %>">Cancel</a>
+    </div>
+  <% end %>
+</section>

data/app/views/hr_lite/admin/statutory_rate_cards/edit.html.erb

@@ -0,0 +1,4 @@
+<% content_for(:page_title) { "FY #{@card.financial_year}" } %>
+<div class="hrl-page__head"><h1 class="hrl-page__title">FY <%= @card.financial_year %></h1></div>
+<%= render "form", card: @card,
+      url: hr_lite.admin_statutory_rate_card_path(@card), method: :patch %>

data/app/views/hr_lite/admin/statutory_rate_cards/index.html.erb

@@ -0,0 +1,59 @@
+<% content_for(:page_title) { "Statutory rates" } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title">Statutory rates</h1>
+  <div class="hrl-page__actions">
+    <a class="hrl-btn hrl-btn--primary" href="<%= hr_lite.new_admin_statutory_rate_card_path %>">Add a year</a>
+  </div>
+</div>
+
+<section class="hrl-card">
+  <p class="hrl-muted hrl-small">
+    PF, ESI and the income-tax slabs, per financial year. Payroll resolves the
+    card that was in force for the month it is computing, so correcting a year
+    never changes an earlier one.
+  </p>
+  <div class="hrl-table-wrap">
+    <table class="hrl-table hrl-table--stack">
+      <thead><tr><th>Year</th><th>PF ceiling</th><th>ESI ceiling</th><th>Verified</th><th></th></tr></thead>
+      <tbody>
+        <% @cards.each do |card| %>
+          <tr>
+            <td data-label="Year">
+              <strong>FY <%= card.financial_year %></strong>
+              <div class="hrl-small hrl-muted">from <%= card.effective_from.strftime("%d %b %Y") %></div>
+            </td>
+            <td data-label="PF ceiling" class="hrl-num"><%= HrLite::Money.format(card.to_card[:pf][:wage_ceiling]) %></td>
+            <td data-label="ESI ceiling" class="hrl-num"><%= HrLite::Money.format(card.to_card[:esi][:gross_ceiling]) %></td>
+            <td data-label="Verified">
+              <% if card.verified? %>
+                <span class="hrl-badge"><%= card.verified_by %></span>
+                <div class="hrl-small hrl-muted"><%= card.verified_on.strftime("%d %b %Y") %></div>
+              <% else %>
+                <span class="hrl-badge hrl-badge--muted">Not checked</span>
+              <% end %>
+            </td>
+            <td data-label="">
+              <a class="hrl-small" href="<%= hr_lite.edit_admin_statutory_rate_card_path(card) %>">Edit</a>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+</section>
+
+<section class="hrl-card">
+  <h2 class="hrl-card__title">Professional tax</h2>
+  <% if @states.empty? %>
+    <p class="hrl-muted">
+      No state bands are configured. Everybody's professional tax is being
+      deducted at ₹0 — which is right only if no state you employ in levies it.
+    </p>
+  <% else %>
+    <p class="hrl-muted hrl-small">
+      Bands are configured for: <%= @states.map(&:humanize).to_sentence %>.
+      An employee whose salary structure names any other state is deducted ₹0,
+      and payroll says so on the run.
+    </p>
+  <% end %>
+</section>

data/app/views/hr_lite/admin/statutory_rate_cards/new.html.erb

@@ -0,0 +1,4 @@
+<% content_for(:page_title) { "Add a financial year" } %>
+<div class="hrl-page__head"><h1 class="hrl-page__title">Add a financial year</h1></div>
+<%= render "form", card: @card, copied_from: @copied_from,
+      url: hr_lite.admin_statutory_rate_cards_path, method: :post %>

data/config/routes.rb

@@ -46,6 +46,10 @@ HrLite::Engine.routes.draw do
     resources :regularization_requests, only: %i[index show] do
       member { post :approve; post :reject }
     end
+    resources :roles, except: :show do
+      resources :assignments, only: %i[create destroy], controller: "role_assignments"
+    end
+    resources :statutory_rate_cards, only: %i[index new create edit update]
     resources :leave_types, except: :show
     resources :office_locations, except: :show
     resources :holidays, only: %i[index create update destroy] do

data/db/migrate/20260817183347_create_hr_lite_roles_and_grants.rb

@@ -0,0 +1,49 @@
+class CreateHrLiteRolesAndGrants < ActiveRecord::Migration[8.1]
+  # Roles replace the three configured lambdas (admin_check, leadership_emails,
+  # superadmin_emails). Two of those matched a MUTABLE email string — a
+  # permission stored in a column the host lets people edit.
+  #
+  # Permissions themselves are not a table: the vocabulary is declared in
+  # HrLite::Permissions::REGISTRY, so a grant is a (role, key, scope) row and
+  # an unknown key cannot be stored. That keeps seeding idempotent, and makes
+  # retiring a permission a code change with a spec rather than silent data.
+  def change
+    create_table :hr_lite_roles do |t|
+      t.string :name, null: false
+      t.string :description
+      # Roles the engine seeds and refers to by name. Renaming or deleting one
+      # is refused by the model — the upgrade path off the email lists lands
+      # people in these, and the roles screen has to keep meaning something.
+      t.boolean :system, null: false, default: false
+      t.timestamps
+    end
+    add_index :hr_lite_roles, :name, unique: true
+
+    create_table :hr_lite_role_grants do |t|
+      t.references :role, null: false, index: false,
+                   foreign_key: { to_table: :hr_lite_roles, on_delete: :cascade }
+      t.string :permission_key, null: false
+      # self | team | all — see HrLite::Permissions. Stored per grant so one
+      # key covers "own leave", "my reports' leave" and "everyone's leave".
+      t.string :scope, null: false, default: "self"
+      t.timestamps
+    end
+    # One scope per (role, permission): a role either reaches a set of rows or
+    # it does not, and two rows for one key would make that a lookup race.
+    add_index :hr_lite_role_grants, %i[role_id permission_key], unique: true
+    add_check_constraint :hr_lite_role_grants, "scope IN ('self', 'team', 'all')",
+                         name: "hr_lite_role_grants_scope_check"
+
+    create_table :hr_lite_role_assignments do |t|
+      # No FK to the host user table — its name is host-specific, the same
+      # reason every other user_id in this engine is a bare bigint.
+      t.bigint :user_id, null: false
+      t.references :role, null: false, index: false,
+                   foreign_key: { to_table: :hr_lite_roles, on_delete: :cascade }
+      t.bigint :granted_by_id
+      t.timestamps
+    end
+    add_index :hr_lite_role_assignments, %i[user_id role_id], unique: true
+    add_index :hr_lite_role_assignments, :role_id
+  end
+end

data/db/migrate/20260817183629_seed_hr_lite_roles_from_email_tiers.rb

@@ -0,0 +1,82 @@
+class SeedHrLiteRolesFromEmailTiers < ActiveRecord::Migration[8.1]
+  # The upgrade path off the email lists. On an install that is already
+  # running, this is the migration that decides whether anyone loses access,
+  # so it is deliberately generous: everybody who could reach something
+  # before can reach at least as much afterwards.
+  #
+  #   config.superadmin_emails  -> Super Admin
+  #   config.leadership_emails  -> Leadership
+  #   admin_check == true       -> HR
+  #   everybody else            -> Employee
+  #
+  # It reads the host's OWN configuration, so nothing has to be typed twice,
+  # and it says out loud what it did — an upgrade that silently grants the
+  # money tier to the wrong person is the failure worth being loud about.
+  def up
+    require "hr_lite/role_seeds"
+    created = HrLite::RoleSeeds.call
+    say "Seeded roles: #{created.join(', ')}" if created.any?
+
+    # A host that has already assigned roles by hand is not re-derived from
+    # email lists — that would undo their work.
+    if HrLite::RoleAssignment.exists?
+      say "Role assignments already exist — leaving them alone."
+      return
+    end
+
+    roles = HrLite::Role.where(name: [
+      HrLite::Role::EMPLOYEE, HrLite::Role::HR,
+      HrLite::Role::LEADERSHIP, HrLite::Role::SUPER_ADMIN
+    ]).index_by(&:name)
+
+    # The legacy predicates, read directly rather than through HrLite.admin?
+    # — which by now answers off roles, and would say no to everyone.
+    superadmins = HrLite.normalize_email_list(HrLite.config.superadmin_emails)
+    leaders = HrLite.normalize_email_list(HrLite.config.leadership_emails)
+    # Pre-0.5.0 behaviour, still live on hosts that never set the money list:
+    # an empty superadmin list meant "the same people as leadership".
+    superadmins = leaders if superadmins.empty?
+
+    assigned = Hash.new { |hash, key| hash[key] = [] }
+
+    HrLite.config.employees_scope.call.find_each do |user|
+      address = user.respond_to?(:email) ? user.email.to_s.downcase.strip : ""
+      names = [ HrLite::Role::EMPLOYEE ]
+      names << HrLite::Role::SUPER_ADMIN if address.present? && superadmins.include?(address)
+      names << HrLite::Role::LEADERSHIP if address.present? && leaders.include?(address)
+      names << HrLite::Role::HR if legacy_admin?(user)
+
+      names.uniq.each do |name|
+        role = roles[name] or next
+
+        HrLite::RoleAssignment.create!(user_id: user.id, role: role)
+        assigned[name] << HrLite.display_name(user)
+      end
+    end
+
+    if assigned.empty?
+      say "No users matched employees_scope — assign roles from the Roles screen."
+    else
+      assigned.each { |name, people| say "#{name}: #{people.sort.join(', ')}" }
+    end
+    say "Set `config.legacy_tier_checks = true` to keep the old email lists in " \
+        "charge for now; it is honoured until 0.7.0."
+  end
+
+  # Assignments only — the roles themselves stay, because dropping them would
+  # take every hand-made grant with them.
+  def down
+    HrLite::RoleAssignment.delete_all
+  end
+
+  private
+
+  # admin_check is a host lambda over the host's own user model; a host whose
+  # users do not answer it must not break the whole upgrade.
+  def legacy_admin?(user)
+    !!HrLite.config.admin_check.call(user)
+  rescue StandardError => e
+    say "admin_check raised for #{HrLite.display_name(user)} (#{e.class}) — treated as not HR."
+    false
+  end
+end

data/db/migrate/20260817190159_create_hr_lite_statutory_rate_cards.rb

@@ -0,0 +1,44 @@
+class CreateHrLiteStatutoryRateCards < ActiveRecord::Migration[8.1]
+  # Statutory rates lived in a frozen hash in Ruby, so adding a financial year
+  # meant a gem release. Every April that is a deadline the gem controls and
+  # the company does not — and 0.5.3 shipped a warning about exactly that
+  # because the FY2026-27 card did not exist.
+  #
+  # Rates are not secret (they are published by the government), so the
+  # figures are plain JSON. What matters is that they are EFFECTIVE-DATED and
+  # carry who checked them: a payroll rerun of an old month must resolve to
+  # the card that was in force for that month, not to today's.
+  def change
+    create_table :hr_lite_statutory_rate_cards do |t|
+      t.date :effective_from, null: false
+      t.json :pf, null: false, default: {}
+      t.json :esi, null: false, default: {}
+      t.json :income_tax, null: false, default: {}
+      # Who signed it off, and when. A card nobody has confirmed is a card
+      # payroll should say something about — see SlipBuilder's warnings.
+      t.string :verified_by
+      t.date :verified_on
+      t.text :notes
+      t.timestamps
+    end
+    # One card per date: two would make "which rates applied in June" a
+    # question about row order.
+    add_index :hr_lite_statutory_rate_cards, :effective_from, unique: true
+
+    create_table :hr_lite_professional_tax_slabs do |t|
+      # Professional tax is a STATE levy. Karnataka was the only state with
+      # real slabs in code; every other state silently computed zero, which
+      # is a wrong answer delivered confidently.
+      t.string :state, null: false
+      t.date :effective_from, null: false
+      # Inclusive lower bound on monthly earned gross.
+      t.decimal :from_amount, precision: 12, scale: 2, null: false
+      t.decimal :monthly, precision: 12, scale: 2, null: false
+      # Several states collect a larger amount in the last month of the year.
+      t.decimal :feb_extra, precision: 12, scale: 2
+      t.timestamps
+    end
+    add_index :hr_lite_professional_tax_slabs, %i[state effective_from from_amount],
+              unique: true, name: "index_hr_lite_pt_slabs_on_state_date_and_bound"
+  end
+end

data/lib/generators/hr_lite/install/templates/initializer.rb

@@ -7,13 +7,19 @@ HrLite.configure do |c|
   c.current_user_method = :current_user
   c.authenticate_method = :authenticate_user!
 
-  # Operations tier (team attendance, leave decisions, overview board).
-  c.admin_check = ->(user) { user.respond_to?(:admin?) && user.admin? }
-
-  # Governing tier — ONLY these people change policy, employee profiles,
-  # salary structures, payroll and appraisals. Keep it in an env var so
-  # changing leadership never needs a deploy.
-  c.leadership_emails = ENV.fetch("HR_LEADERSHIP_EMAILS", "").split(",").map(&:strip)
+  # Access is a role table, not configuration — `rake hr_lite:seed` creates
+  # the built-in roles and you assign people from /admin/roles. The first
+  # person needs Super Admin, which the upgrade migration grants on an
+  # existing install; on a fresh one, from a console:
+  #
+  #   HrLite::RoleAssignment.create!(
+  #     user_id: User.find_by!(email: "you@example.com").id,
+  #     role: HrLite::Role.find_by!(name: HrLite::Role::SUPER_ADMIN))
+  #
+  # Upgrading from pre-0.6.0 and not ready to move? Uncomment this and keep
+  # your leadership_emails / superadmin_emails / admin_check as they were.
+  # It is honoured until 0.8.0.
+  # c.legacy_tier_checks = true
 
   # Where the portal is reachable (subdomain or path). Enables email link
   # buttons and HrLite.public_url / HrLite.public_url? for deep links.

data/lib/hr_lite/configuration.rb

@@ -10,7 +10,8 @@ module HrLite
                   :leadership_emails, :leadership_check, :extra_stylesheets,
                   :superadmin_emails, :superadmin_check,
                   :mailer_from, :public_url_base, :notification_matrix, :back_link,
-                  :onboard_user, :offboard_user, :invite_url_for
+                  :onboard_user, :offboard_user, :invite_url_for,
+                  :legacy_tier_checks
 
     attr_reader :leave_year_start_month
 
@@ -45,6 +46,12 @@ module HrLite
       @time_zone             = "Asia/Kolkata"
       @currency_symbol      = "₹"
       @on_designation_change = ->(user, designation) { }
+      # Access came from three lambdas before 0.6.0, two of which matched the
+      # user's EMAIL — a mutable, host-owned, unverified column that a host
+      # then had to remember never to let anyone edit. Roles replace them.
+      # This flag hands authority back to the old lambdas for a host that has
+      # not finished migrating; honoured for one more minor version, gone in 0.8.0.
+      @legacy_tier_checks    = false
       @leadership_emails     = []
       @leadership_check      = ->(user) { HrLite.email_listed?(user, HrLite.config.leadership_emails) }
       # Money tier: salary structures, payroll, slips, appraisals. Empty

data/lib/hr_lite/current.rb

@@ -3,5 +3,9 @@ module HrLite
   # readable from any model callback without threading it through.
   class Current < ActiveSupport::CurrentAttributes
     attribute :actor
+    # Resolved permissions, keyed by user id. Every screen asks several times
+    # per request and resolution joins three tables; CurrentAttributes is
+    # reset between requests, so a role change takes effect on the next one.
+    attribute :access_cache
   end
 end