hr_lite 0.51.0 → 0.52.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29f3f6694be039bef5c21d9548eaf1aaf8ff7c60191b0e92e2903c9fac7769fe
-  data.tar.gz: 361260627747e8ca8280401e985ef777cc8b267864fc6ccc0229ddf84670e939
+  metadata.gz: 6668e3a20cc3b84ebe77b9ae78ff2c20a12c37af21193d88b5f723a1383a7dca
+  data.tar.gz: ec7757fc4f4c0220dd21f05037b4054221a76ae445306c32911a2e71dcdd841d
 SHA512:
-  metadata.gz: fbe31ca225879b95e882ee76b5cca183ef535c124c75616ebde7cd350bc03bff252febf09d6e7375f0dcf395ab19593548140667e6aa358b707be8f405c0f6f3
-  data.tar.gz: 39472b4fffa414eaafcbb2a7fb366354608d79f91f1cabe3e41d1e5a32380a2f7b42460fe3539e726850e163cea5680b5531aa4edf5ab7e79449d16e425e4091
+  metadata.gz: 68367c0172ccdf649c52272c4c9256e00ecdd55452f7a3cbecd74a12f58e91966eed0b7e5b03f0d20a4380570a219e1602da4604e09cfa7584af20f78097f664
+  data.tar.gz: 6128e7796d5bc897db57b0c5ca1ac6a8dfb2ece9eadecf423f5d28815f1a9f847192845976893843b90cac4927cec61ea2c4221912a05f6d161238e944bb6c19

data/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.52.0] - 2026-10-16
+
+- HR uploads documents for an employee: the person's Documents page (HR → People → a person → Documents) now has "Upload a document", the same form as My documents. Only company-wide profile managers (HR, admin) see it, and never on their own record. The document belongs to the employee, records who uploaded it, and its visibility still follows its category (an Aadhaar, PAN, passport or bank document stays with the money tier).
+- Download links now expire after 5 minutes. Before, the file link behind "Open" never expired, so anyone holding a copied link could fetch the scan without signing in. Every download is still permission-checked and audited first.
+
+## [0.51.1] - 2026-10-16
+
+- No "Check in again" once the day is worked in full: after checking out with the person's day done (HR's 8h 30m, less any shorter day), the button is gone and the card reads "Your day is done: 8h 45m worked." The server refuses a check-in again too. A short day still offers it as before.
+
 ## [0.51.0] - 2026-10-16
 
 - Shorter day on a repeat: HR or admin give a person 30, 60 or 90 minutes off the working day (so 7h at the least) on a pattern set like a calendar's custom repeat: every N days, every N weeks on chosen weekdays, or every N months on the start's date, from a start date, ending never, on a date, or after N times. No repeat means every day, as before.

data/app/controllers/hr_lite/admin/documents_controller.rb

@@ -17,10 +17,24 @@ module HrLite
       end
 
       def show
-        @employee = HrLite.user_klass.find(params[:user_id])
-        hr_require_reach!("document.view", @employee)
-        @documents = Document.for_user(@employee).recent_first
-        @missing = Document::SENSITIVE_CATEGORIES - @documents.map(&:category)
+        load_person
+        @document = Document.new
+      end
+
+      # HR files a document for someone, e.g. a scan handed over on paper:
+      # company-wide profile managers only, and never their own (My documents).
+      def create
+        load_person
+        raise ActiveRecord::RecordNotFound if @employee.id == hr_current_user.id
+        return hr_access_denied unless hr_can?("profile.manage", scope: :all)
+
+        @document = Document.new(params.require(:document).permit(:category, :title, :reference_number, :issued_on, :expires_on, :file)
+                                       .merge(user_id: @employee.id, uploaded_by_id: hr_current_user.id))
+        if @document.save
+          redirect_to admin_employee_documents_path(@employee.id), notice: "#{@document.title} uploaded."
+        else
+          render :show, status: :unprocessable_entity
+        end
       end
 
       def verify
@@ -44,6 +58,13 @@ module HrLite
 
       private
 
+      def load_person
+        @employee = HrLite.user_klass.find(params[:user_id])
+        hr_require_reach!("document.view", @employee)
+        @documents = Document.for_user(@employee).recent_first
+        @missing = Document::SENSITIVE_CATEGORIES - @documents.map(&:category)
+      end
+
       def require_document_access!
         hr_require_permission!("document.view", scope: :team)
       end

data/app/controllers/hr_lite/documents_controller.rb

@@ -56,7 +56,7 @@ module HrLite
       # rails_blob_path, not url_for: an engine controller has no default
       # host and url_for(attachment) raises without one.
       redirect_to Rails.application.routes.url_helpers.rails_blob_path(
-        document.file, disposition: "attachment", only_path: true
+        document.file, disposition: "attachment", only_path: true, expires_in: 5.minutes # the link dies with the visit
       ), allow_other_host: false
     end
 

data/app/models/hr_lite/attendance_record.rb

@@ -76,8 +76,11 @@ module HrLite
 
     def worked_under?(minutes) = !!(minutes && worked_duration && worked_duration < minutes.minutes)
 
-    # Check in again after checking out: once a day, inside the hours HR sets in Settings.
+    # Check in again after checking out: once a day, inside the hours HR sets in
+    # Settings, and only while the day is short (a full day has nothing to add).
     def recheck_in_open?(at = Time.current)
+      return false if required_minutes && !short?
+
       s = Setting.instance
       now = at.in_time_zone(HrLite.config.time_zone).strftime("%H:%M")
       check_out_at.present? && rechecked_in_at.nil? && now >= s.recheck_in_from && now < s.recheck_in_until

data/app/views/hr_lite/admin/documents/show.html.erb

@@ -41,3 +41,7 @@
     </div>
   <% end %>
 </section>
+
+<% if @employee.id != hr_current_user.id && hr_can?("profile.manage", scope: :all) %>
+  <%= render "hr_lite/documents/upload_form", document: @document, url: hr_lite.admin_employee_documents_path(@employee.id), open: @document.errors.any? %>
+<% end %>

data/app/views/hr_lite/attendance/_punch_card.html.erb

@@ -108,6 +108,8 @@
       </button>
       <p class="hrl-small hrl-muted" data-hrl-geo-status role="status" aria-live="polite"></p>
     <% end %>
+  <% elsif record.required_minutes && !record.short? %>
+    <p class="hrl-small hrl-muted">Your day is done: <%= hrl_duration(record.worked_duration) %> worked.</p>
   <% else %>
     <p class="hrl-small hrl-muted">Check in again is open once a day, <%= HrLite::Setting.instance.recheck_in_from %>–<%= HrLite::Setting.instance.recheck_in_until %>.</p>
   <% end %>

data/app/views/hr_lite/documents/_upload_form.html.erb

@@ -0,0 +1,30 @@
+<%# locals: document, url (where it posts), open (start expanded) — one upload form for My documents and HR's view of a person. %>
+<details class="hrl-card" <%= "open" if open || document.errors.any? %>>
+  <summary class="hrl-btn hrl-btn--primary">Upload a document</summary>
+  <%= form_with model: document, url: url, method: :post, local: true, class: "hrl-mt" do |f| %>
+    <%= render "hr_lite/shared/form_errors", record: document %>
+    <div class="hrl-field">
+      <%= f.label :category, id: "hrl-doc-category", for: nil %>
+      <div class="hrl-chiprow" role="radiogroup" aria-labelledby="hrl-doc-category">
+        <% (HrLite::Document::SENSITIVE_CATEGORIES.map { |c| [ c.humanize.sub(/\APan\z/, "PAN"), c ] } +
+            [ [ "Offer letter", "offer_letter" ], [ "Certificate", "certificate" ], [ "Other", "other" ] ]).each do |label, value| %>
+          <label><%= f.radio_button :category, value, required: true %><span><%= label %></span></label>
+        <% end %>
+      </div>
+    </div>
+    <div class="hrl-field"><%= f.label :title %><%= f.text_field :title, required: true %></div>
+    <div class="hrl-field">
+      <%= f.label :reference_number, "Document number (optional)" %>
+      <%= f.text_field :reference_number %>
+    </div>
+    <div class="hrl-field">
+      <%= f.label :expires_on, "Expires on (optional — we will remind you)" %>
+      <%= f.date_field :expires_on %>
+    </div>
+    <div class="hrl-field">
+      <%= f.label :file, "File (PDF or image, up to 10 MB)" %>
+      <%= f.file_field :file, required: true, accept: "application/pdf,image/*" %>
+    </div>
+    <div class="hrl-form-actions"><%= f.submit "Upload", class: "hrl-btn hrl-btn--primary" %></div>
+  <% end %>
+</details>

data/app/views/hr_lite/documents/index.html.erb

@@ -55,32 +55,4 @@
   <% end %>
 </section>
 
-<details class="hrl-card" <%= "open" if @documents.empty? || @document.errors.any? %>>
-  <summary class="hrl-btn hrl-btn--primary">Upload a document</summary>
-  <%= form_with model: @document, url: hr_lite.documents_path, method: :post, local: true, class: "hrl-mt" do |f| %>
-    <%= render "hr_lite/shared/form_errors", record: @document %>
-    <div class="hrl-field">
-      <%= f.label :category, id: "hrl-doc-category", for: nil %>
-      <div class="hrl-chiprow" role="radiogroup" aria-labelledby="hrl-doc-category">
-        <% (HrLite::Document::SENSITIVE_CATEGORIES.map { |c| [ c.humanize.sub(/\APan\z/, "PAN"), c ] } +
-            [ [ "Offer letter", "offer_letter" ], [ "Certificate", "certificate" ], [ "Other", "other" ] ]).each do |label, value| %>
-          <label><%= f.radio_button :category, value, required: true %><span><%= label %></span></label>
-        <% end %>
-      </div>
-    </div>
-    <div class="hrl-field"><%= f.label :title %><%= f.text_field :title, required: true %></div>
-    <div class="hrl-field">
-      <%= f.label :reference_number, "Document number (optional)" %>
-      <%= f.text_field :reference_number %>
-    </div>
-    <div class="hrl-field">
-      <%= f.label :expires_on, "Expires on (optional — we will remind you)" %>
-      <%= f.date_field :expires_on %>
-    </div>
-    <div class="hrl-field">
-      <%= f.label :file, "File (PDF or image, up to 10 MB)" %>
-      <%= f.file_field :file, required: true, accept: "application/pdf,image/*" %>
-    </div>
-    <div class="hrl-form-actions"><%= f.submit "Upload", class: "hrl-btn hrl-btn--primary" %></div>
-  <% end %>
-</details>
+<%= render "hr_lite/documents/upload_form", document: @document, url: hr_lite.documents_path, open: @documents.empty? %>

data/config/routes.rb

@@ -105,6 +105,7 @@ HrLite::Engine.routes.draw do
       member { post :verify; post :reject }
     end
     get "documents/for/:user_id", to: "documents#show", as: :employee_documents
+    post "documents/for/:user_id", to: "documents#create"
     resources :tax_declarations, only: %i[index show update] do
       member { post :verify; post :reject; post :accept_all; get "proofs/:proof_id", action: :proof, as: :proof }
       collection { get :overview; get "people/:user_id", action: :person, as: :person }

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.51.0"
+  VERSION = "0.52.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.51.0
+  version: 0.52.0
 platform: ruby
 authors:
 - kshitiz sinha
@@ -369,6 +369,7 @@ files:
 - app/views/hr_lite/career/show.html.erb
 - app/views/hr_lite/comp_off_requests/index.html.erb
 - app/views/hr_lite/comp_off_requests/new.html.erb
+- app/views/hr_lite/documents/_upload_form.html.erb
 - app/views/hr_lite/documents/index.html.erb
 - app/views/hr_lite/employee_profiles/show.html.erb
 - app/views/hr_lite/event_mailer/event.html.erb