hr_lite 0.54.0 → 0.55.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2914dd05ed8eb6c4e9974e4f4d84ee8149f6158e976ee6f7ec07958b8046a894
-  data.tar.gz: 36bc28076ab2d1d16a6ac20df8171c28ae50b317081ec3e2a6b205cf32591d05
+  metadata.gz: 901c6516adf77c589f4e570c477d7aa2a7b05f279e5ef9d205cf868796074939
+  data.tar.gz: d3a6e968a40f6e5fe9d8503a174f8ce004c18ee6cf25218372e21a78d5fecc76
 SHA512:
-  metadata.gz: 1235ee079d20011f1d966c605814f028ece64a6d148c6ad8e28be4b1a9db7cb1b9ac98ded5b1f7c87a6c10536c7d524788b0f87096be4146f2fbe2458b08d0c4
-  data.tar.gz: a770905bf3daeab581c3edc9a3fb7d4902824d3c47a491e5af540123df3c6aaad711d9d6de88b6a0055acc9432750dd9802ce3c0426c74b1070293d81e24a835
+  metadata.gz: 43c25d542b2eacd2af96e5ff8b281f608fb202be4c1c8ecdd4790b440843fb79ceb32596e8d641bb72beffc8c606dd558d65cd0bba5fbc4a860a8a59e5f24790
+  data.tar.gz: 2e1af9569c33bce9ca0ea5ef790b855d397e6ebf6c88a656757001849f0d197ee8901c057d19de835d999d80005dab3fd6e505ef26829167d3be7f9a101c834c

data/CHANGELOG.md

@@ -7,6 +7,66 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.55.0] - 2026-10-17
+
+The second pass of the HRMS audit of 0.54.0 covers bugs, security, performance and the remaining screen fixes (#115–#131). No migrations.
+
+- **Payroll compute runs in a background job** (`HrLite::PayrollComputeJob`, default queue).
+  - The run page shows "Computing…" and refreshes until the run reaches review.
+  - A failed compute leaves the run as it was and adds a run warning, not an error page.
+  - Hosts need a running ActiveJob backend.
+- **Money**
+  - A run computed before a leave decision, a day fix or a one-off item change now needs a recompute before it can be approved or published.
+  - "Record and verify" refuses blank verified amounts.
+  - Once an employee submits a tax declaration, they can no longer edit it.
+  - HR's verified amounts need a submitted declaration, and each change writes an audit row.
+  - Claims and help-desk tickets refuse decisions in the wrong state.
+  - "1,200" or "1,50,000" in a money field saves instead of failing.
+  - An employee can open only the current or the previous financial year's declaration.
+  - The tax panel labels its gross "before unpaid days".
+- **Leave and attendance**
+  - Deciding a leave or a claim outside its approval flow settles the flow's other rows.
+  - The late ladder skips weekly offs, holidays and half-day leave.
+  - HR attendance fixes refuse future dates, times that fall on another day, and approved full-day leave.
+  - Optional holidays are no longer shaded as days off.
+  - A request warns when it and the other pending ones go past the balance.
+  - First-half and second-half leave on the same date no longer clash.
+  - The approver sees the balance as of the leave date.
+  - Inbox › All lists a flow leave once.
+  - The company-wide leave notice no longer names the leave type.
+  - Submit buttons lock after the first press.
+- **Security and audit**
+  - HR cannot edit their own profile or salary, or offboard themselves. The pages return 404 and the buttons are hidden.
+  - Tax-proof links expire after 5 minutes and ID-card photo links after an hour.
+  - These now write audit rows: role permission changes, comp-off approvals, resignations, and payroll run create and delete.
+  - Audit rows redact date of birth and help-desk text.
+  - "Aadhaar" and "PAN" uploads reach the money tier whatever their case.
+  - Kudos mentions reach employees only.
+  - Offboarding removes the person's HR role assignments.
+- **Inbox**
+  - Your own requests on a person's week open your own pages.
+  - Claim rows name the type, amount and date.
+  - Pending resignations are an Inbox queue and count in "N requests waiting".
+  - "One-off items" shows only to those who can run payroll.
+- **Screens**
+  - Leave forms say what is wrong, and decision pages ask before acting.
+  - Payslips, tax working, tax states and loan facts read in words and whole days.
+  - Admin settings, roles (permission groups fold), policies, holidays and the audit trail fit a phone. Page views are hidden from the audit trail by default.
+  - "Fix a day" is the one name for attendance fixes.
+  - Compute leads a draft run, and the rate card in force is marked.
+  - Home shows this week's leave from today, and reports have month arrows.
+  - Person pages link back, and the employee form is grouped.
+  - People › "My team" is "Team board".
+  - Inbox › WFH puts Give WFH before a folded filter.
+  - Search has a visible Close.
+  - Button borders meet 3:1 contrast, and the sides clear the notch.
+  - List links are 44 px buttons, the help-desk pick starts blank, and work-time bars sit further apart.
+- **Performance**
+  - Leave-balance grids, the report and the chips count each balance once.
+  - A leave notice reads every recipient's do-not-disturb in one query.
+  - A person's month, the work-time report and the payroll register each load in one query instead of one per day or slip.
+  - The overview drops an unused count.
+
 ## [0.54.0] - 2026-10-17
 
 Fixes from the HRMS UI/UX audit of 0.52.0. No migrations.

data/app/assets/javascripts/hr_lite/confirm.js

@@ -26,11 +26,15 @@
         return;
       }
 
-      // Double-submit guard (data-disable-with is inert without Turbo/ujs). The
-      // timeout lets the submitter's value post first; geo punch runs its own.
-      if (!form.hasAttribute("data-hrl-geo-punch") && event.submitter) {
-        var b = event.submitter;
-        setTimeout(function () { b.disabled = true; b.setAttribute("aria-busy", "true"); }, 0);
+      // Double-submit guard (data-disable-with is inert without Turbo/ujs): every
+      // submit button of the form, Enter included. The timeout lets the
+      // submitter's value post first; geo punch runs its own.
+      if (!form.hasAttribute("data-hrl-geo-punch")) {
+        setTimeout(function () {
+          Array.prototype.forEach.call(form.elements, function (b) {
+            if (b.type === "submit") { b.disabled = true; b.setAttribute("aria-busy", "true"); }
+          });
+        }, 0);
       }
     },
     true // capture, so the check runs before any other submit handler

data/app/assets/javascripts/hr_lite/countdown.js

@@ -1,12 +1,19 @@
-// Ticks "Xh YYm left" on [data-hrl-countdown="<iso time>"]. Display only:
+// Ticks "Xh YYm left" on [data-hrl-countdown="<iso time>"] (data-hrl-done when
+// it runs out) and "Xh YYm so far" on [data-hrl-since]. Display only:
 // the server ends the mode itself, with or without this page open.
 (function () {
   "use strict";
+  function hm(min) { return Math.floor(min / 60) + "h " + String(min % 60).padStart(2, "0") + "m"; }
   function tick() {
     document.querySelectorAll("[data-hrl-countdown]").forEach(function (el) {
       var left = Math.max(0, Math.round((Date.parse(el.dataset.hrlCountdown) - Date.now()) / 60000));
-      el.textContent = left === 0 ? "ended" : Math.floor(left / 60) + "h " + String(left % 60).padStart(2, "0") + "m left";
+      el.textContent = left === 0 ? (el.dataset.hrlDone || "ended") : hm(left) + " left";
+    });
+    document.querySelectorAll("[data-hrl-since]").forEach(function (el) {
+      el.textContent = hm(Math.max(0, Math.floor((Date.now() - Date.parse(el.dataset.hrlSince)) / 60000))) + " so far";
     });
   }
   document.addEventListener("DOMContentLoaded", function () { tick(); setInterval(tick, 30000); });
+  // A PWA brought back from the background repaints at once, not on the next tick.
+  document.addEventListener("visibilitychange", function () { if (!document.hidden) tick(); });
 })();

data/app/assets/javascripts/hr_lite/search.js

@@ -5,7 +5,7 @@
 (function () {
   var dialog = document.querySelector("[data-hrl-search]");
   if (!dialog || !dialog.showModal) return;
-  var form = dialog.querySelector("form");
+  var form = dialog.querySelector("form[role=search]");
   var input = form.querySelector("input");
   var out = dialog.querySelector("[data-hrl-search-results]");
   var timer;

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -101,8 +101,9 @@ html:has(.hrl-body) { scroll-padding-top: 4rem; scroll-padding-bottom: calc(4.4r
 }
 .hrl-shell { display: flex; min-height: 100vh; }
 .hrl-content { flex: 1; min-width: 0; }
+/* Landscape notch: never closer to the cutout than the gutter. */
 .hrl-main {
-  padding: .85rem;
+  padding: .85rem max(.85rem, env(safe-area-inset-right)) .85rem max(.85rem, env(safe-area-inset-left));
   padding-bottom: calc(4.4rem + env(safe-area-inset-bottom));
   max-width: 68rem;
   margin: 0 auto;
@@ -242,6 +243,7 @@ html:has(.hrl-body) { scroll-padding-top: 4rem; scroll-padding-bottom: calc(4.4r
 .hrl-card--empty { text-align: center; color: var(--hrl-muted); padding: 1.8rem 1rem; }
 .hrl-card--warn { background: var(--hrl-warn-bg); border-color: transparent; }
 .hrl-card > p:first-child { margin-top: 0; }
+.hrl-card > hr { border: 0; border-top: 1px solid var(--hrl-line); margin: var(--hrl-s-4) 0; }
 /* Vertical rhythm: forms, buttons and disclosures stacked in a card never
    touch (only .hrl-field carried spacing, so a button above a form, or an
    open disclosure above the next control, sat flush). 12px >= the 8px
@@ -281,12 +283,12 @@ details > form > button[type=submit], details > form > .hrl-btn { margin-top: .2
 .hrl-btn {
   display: inline-flex; align-items: center; justify-content: center; gap: .4rem;
   min-height: var(--hrl-target); padding: .55rem 1rem; border-radius: var(--hrl-radius-sm);
-  border: 1px solid var(--hrl-line); background: var(--hrl-card); color: var(--hrl-ink);
+  border: 1px solid var(--hrl-field); background: var(--hrl-card); color: var(--hrl-ink);
   font-size: var(--hrl-t-body); font-weight: 600; cursor: pointer; text-decoration: none;
   max-width: 100%; overflow-wrap: anywhere; text-align: center;
 }
 .hrl-btn--primary { background: var(--hrl-accent); border-color: var(--hrl-accent); color: var(--hrl-accent-ink); }
-.hrl-btn--danger { color: var(--hrl-bad); border-color: var(--hrl-bad-bg); }
+.hrl-btn--danger { color: var(--hrl-bad); border-color: var(--hrl-bad); }
 .hrl-btn--block { width: 100%; }
 .hrl-btn--big { min-height: 58px; font-size: var(--hrl-t-lead); }
 .hrl-btn[disabled] { opacity: .55; cursor: default; }
@@ -319,6 +321,7 @@ summary.hrl-btn::-webkit-details-marker { display: none; } /* Safari before 18.4
 .hrl-table td[data-label=""] > :is(a, button) + :is(a, button, form) { margin-left: var(--hrl-s-2); }
 .hrl-table td[data-label=""] > :is(a, button) + form { display: inline-block; vertical-align: top; } /* a button_to beside a link, not under it */
 .hrl-table td[data-label=""] > form + form { margin-top: var(--hrl-s-2); }
+.hrl-table td form > :is(.hrl-input, select) + :is(.hrl-btn, input[type="submit"]) { margin-top: var(--hrl-s-2); } /* a note above its button, never touching */
 .hrl-table tr:has(.hrl-btn) > td, .hrl-table tr:has(.hrl-btn) td > .hrl-badge { vertical-align: middle; } /* text lines up with a 44px button */
 /* Stack on phones and on the narrow content column beside the 768-1023px rail. */
 @media (max-width: 640px), (min-width: 768px) and (max-width: 1023px) {
@@ -338,6 +341,7 @@ summary.hrl-btn::-webkit-details-marker { display: none; } /* Safari before 18.4
 
 /* Forms */
 .hrl-field { margin-bottom: .8rem; }
+@media (min-width: 1024px) { .hrl-field { max-width: 40rem; } }
 .hrl-field label, .hrl-field legend { display: block; font-size: var(--hrl-t-small); font-weight: 600; margin-bottom: .3rem; }
 fieldset { border: 0; margin: 0; padding: 0; min-width: 0; }
 .hrl-hint { color: var(--hrl-muted); font-size: var(--hrl-t-small); margin-top: .25rem; }
@@ -366,7 +370,7 @@ fieldset { border: 0; margin: 0; padding: 0; min-width: 0; }
 .hrl-field--check label .hrl-hint { display: block; margin-top: 0; font-weight: 400; }
 /* Rails wraps an invalid label/field in this div; contents keeps the stack, the re-pointed token reddens the border. */
 .field_with_errors { display: contents; --hrl-field: var(--hrl-bad); }
-.field_with_errors label { color: var(--hrl-bad); }
+.field_with_errors label, .hrl-hint--bad { color: var(--hrl-bad); }
 .hrl-errors { background: var(--hrl-bad-bg); color: var(--hrl-bad); border-radius: var(--hrl-radius-sm); padding: .7rem .9rem; margin-bottom: .85rem; font-size: var(--hrl-t-body); }
 .hrl-errors ul { margin: .3rem 0 0; padding-left: 1.1rem; }
 .hrl-form-actions { display: flex; flex-wrap: wrap; gap: .6rem; margin-top: 1rem; }
@@ -381,7 +385,7 @@ fieldset { border: 0; margin: 0; padding: 0; min-width: 0; }
   min-width: var(--hrl-target); justify-content: center;
 }
 .hrl-chiprow input { position: absolute; opacity: 0; pointer-events: none; }
-.hrl-chiprow input:checked + span, .hrl-chiprow label:has(input:checked) { background: var(--hrl-info-bg); border-color: var(--hrl-accent); color: var(--hrl-accent); }
+.hrl-chiprow input:checked + span, .hrl-chiprow label:has(input:checked), .hrl-btn[aria-current="true"] { background: var(--hrl-info-bg); border-color: var(--hrl-accent); color: var(--hrl-accent); }
 /* The radio is invisible, so its focus ring goes on the chip. */
 .hrl-chiprow label:has(input:focus-visible) { outline: var(--hrl-focus-w) solid var(--hrl-focus); outline-offset: var(--hrl-focus-offset); }
 
@@ -457,10 +461,10 @@ fieldset { border: 0; margin: 0; padding: 0; min-width: 0; }
 .hrl-tree__name, .hrl-tree__role { min-width: 0; overflow-wrap: anywhere; }
 .hrl-tree__name { font-weight: 700; font-size: var(--hrl-t-small); }
 a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--hrl-target); }
-.hrl-tree__role { color: var(--hrl-muted); font-size: var(--hrl-t-small); }
+.hrl-tree__role, .hrl-tree__card .hrl-muted { color: var(--hrl-ink-2); font-size: var(--hrl-t-small); }
 .hrl-chainrow { display: flex; flex-wrap: wrap; align-items: center; gap: .4rem; }
 .hrl-chainrow__step { display: inline-flex; align-items: center; gap: .4rem; min-width: 0; }
-.hrl-chainrow .hrl-badge { white-space: normal; overflow-wrap: anywhere; }
+.hrl-chainrow .hrl-badge, .hrl-badge--type { white-space: normal; overflow-wrap: anywhere; } /* long leave-balance chips wrap, not cut */
 .hrl-chainrow__arrow { color: var(--hrl-muted); }
 
 /* Definition list */
@@ -505,6 +509,7 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-mgrid__flag { position: absolute; top: 3px; right: 4px; width: 7px; height: 7px; border-radius: var(--hrl-radius-pill); background: var(--hrl-bad); }
 .hrl-legend { display: flex; flex-wrap: wrap; gap: .4rem; margin-top: .6rem; }
 .hrl-legend .hrl-mgrid__flag { position: static; display: inline-block; }
+.hrl-legend + .hrl-mgrid { margin-top: .6rem; } /* the month key sits above its grid */
 @media (min-width: 768px) { .hrl-mgrid--cal .hrl-mgrid__day { min-height: 88px; } }
 
 /* Utility */
@@ -579,11 +584,12 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-idcard__foot b { font: 700 calc(13 * var(--u))/1 var(--hrl-card-display, var(--hrl-font)); color: #fff; }
 .hrl-idcard__foot span { font: 500 calc(10 * var(--u))/1 var(--hrl-card-body, var(--hrl-font)); letter-spacing: .14em; color: rgba(255, 255, 255, .85); }
 .hrl-idcard-actions { display: flex; flex-wrap: wrap; gap: .85rem; align-items: flex-start; justify-content: center; margin-top: 1.5rem; }
+.hrl-idcard-help { flex-basis: 100%; justify-content: center; }
 
 /* Print: one CR80 face per page, nothing else. */
 @media print {
   @page { size: 54mm 85.6mm; margin: 0; }
-  .hrl-side, .hrl-appbar, .hrl-tabbar, .hrl-flash, .hrl-page__head, .hrl-idcard__label, .hrl-idcard-actions { display: none !important; }
+  .hrl-side, .hrl-appbar, .hrl-tabbar, .hrl-flash, .hrl-page__head, .hrl-backlink, .hrl-idcard__label, .hrl-idcard-actions { display: none !important; }
   .hrl-body { background: #fff; }
   .hrl-main { padding: 0; margin: 0; }
   .hrl-idcard-faces { display: block; }
@@ -619,12 +625,14 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-fill--offline { fill: var(--hrl-mode-offline); } .hrl-stroke--offline { stroke: var(--hrl-mode-offline); } .hrl-fill-bg--offline { background: var(--hrl-mode-offline); }
 .hrl-chart-row { display: grid; gap: var(--hrl-gap-target); }
 @media (min-width: 481px) { .hrl-chart-row { grid-template-columns: 10rem 1fr; align-items: center; } }
+.hrl-chart-row .hrl-num { white-space: nowrap; } /* "16h 13m" stays on one line at 360px */
 .hrl-donut { width: 10rem; max-width: 100%; transform: rotate(0deg); }
 .hrl-donut__track { stroke: var(--hrl-bg); }
+.hrl-field input[type="color"] { width: 4.5rem; padding: .2rem; }
 .hrl-swatch { display: inline-block; width: .7rem; height: .7rem; border-radius: var(--hrl-radius-pill); vertical-align: middle; }
 .hrl-chart-scroll { overflow-x: auto; }
 /* Wide enough per bar that the height (10rem) sets the scale, so labels render ~12.6px and long ranges scroll. */
-.hrl-bars { width: 100%; min-width: max(16rem, calc(var(--hrl-bars-n, 0) * 1.4rem)); height: 10rem; }
+.hrl-bars { width: 100%; min-width: max(16rem, calc(var(--hrl-bars-n, 0) * 1.75rem)); height: 10rem; }
 .hrl-bars__label { font-size: 9px; fill: var(--hrl-muted); }
 .hrl-daystrip { width: 100%; height: 2rem; background: var(--hrl-bg); border-radius: var(--hrl-radius-sm); }
 .hrl-timeline__auto { stroke: var(--hrl-card); stroke-width: .3; stroke-dasharray: .6 .4; }
@@ -642,5 +650,6 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 
 /* Search palette (search.js): one box for screens and people, ⌘K anywhere. */
 .hrl-search { width: min(36rem, calc(100% - 2rem)); margin: 10vh auto auto; padding: var(--hrl-s-4); border: 1px solid var(--hrl-line); border-radius: var(--hrl-radius); background: var(--hrl-card); color: var(--hrl-ink); }
+.hrl-search__close { display: flex; justify-content: flex-end; margin: 0 0 var(--hrl-s-2); }
 .hrl-search::backdrop { background: rgb(15 23 42 / .4); }
 .hrl-search__list { list-style: none; margin: var(--hrl-s-1) 0 0; padding: 0; display: grid; gap: var(--hrl-s-2); }

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -104,6 +104,12 @@ module HrLite
                              alert: "A check-in time is required when a check-out is set."
         end
 
+        # Full-day leave outranks any punch, so the fix would change nothing anyone reads.
+        if LeaveRequest.active_on(date).where(user_id: @employee.id, half_day: false).exists?
+          return redirect_to admin_attendance_path(@employee.id, date: date, month: date.strftime("%Y-%m")),
+                             alert: "The day is covered by approved leave — cancel the leave first."
+        end
+
         record.assign_attributes(attrs)
         record.clear_check_out if params[:reset] == "check_out"
         record.half_day_part = attrs[:half_day_part].presence if attrs.key?(:half_day_part)
@@ -209,16 +215,17 @@ module HrLite
       # whose own page this viewer may open for this person.
       def summary_requests(user, range)
         id, from, to = user.id, range.first, range.last
+        own = id == hr_current_user.id # nobody decides their own request: open the employee's own pages
         day = ->(d) { d.strftime("%a %-d %b") }
         {
           "leave.view" => -> {
             LeaveRequest.where(user_id: id).overlapping_range(from, to).includes(:leave_type)
-                        .map { |r| [ r.leave_type.name, r.date_range_label, r.status, admin_leave_request_path(r) ] } +
-              CompOffRequest.where(user_id: id, date_worked: range).map { |r| [ "Comp-off", day.(r.date_worked), r.status, admin_comp_off_request_path(r) ] }
+                        .map { |r| [ r.leave_type.name, r.date_range_label, r.status, own ? leave_request_path(r) : admin_leave_request_path(r) ] } +
+              CompOffRequest.where(user_id: id, date_worked: range).map { |r| [ "Comp-off", day.(r.date_worked), r.status, own ? comp_off_requests_path : admin_comp_off_request_path(r) ] }
           },
           "attendance.view" => -> {
             WfhRequest.where(user_id: id).overlapping(from, to).map { |r| [ "WFH", r.dates_label, r.status, admin_wfh_request_path(r) ] } +
-              RegularizationRequest.where(user_id: id, date: range).map { |r| [ "Attendance fix", day.(r.date), r.status, admin_regularization_request_path(r) ] }
+              RegularizationRequest.where(user_id: id, date: range).map { |r| [ "Attendance fix", day.(r.date), r.status, own ? regularization_requests_path : admin_regularization_request_path(r) ] }
           },
           "expense.approve" => -> {
             Expense.where(user_id: id, spent_on: range).includes(:category)

data/app/controllers/hr_lite/admin/audit_logs_controller.rb

@@ -5,6 +5,7 @@ module HrLite
         # Appraisal and promotion rows carry review text in plain columns:
         # ordinary leadership governs people and policy, not pay.
         scope = hr_superadmin? ? AuditLog.recent : AuditLog.recent.outside_money_tier
+        scope = scope.where.not("action LIKE ?", "%.viewed") unless params[:views] # page views drown the changes
         @audit_logs = paginate(scope.includes(:actor))
       end
     end

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -72,11 +72,11 @@ module HrLite
       end
 
       def edit
-        @profile = EmployeeProfile.find(params[:id])
+        @profile = others_profile
       end
 
       def update
-        @profile = EmployeeProfile.find(params[:id])
+        @profile = others_profile
         if @profile.update(update_profile_params)
           redirect_to admin_employee_path(@profile), notice: "Employee profile updated."
         else
@@ -87,12 +87,16 @@ module HrLite
       # Exit: stamps the date (attendance/payroll clip on it) and revokes
       # access via the host hook. Audited via the profile update.
       def offboard
-        @profile = EmployeeProfile.find(params[:id])
+        @profile = others_profile
         # `.to_date` on a raw param raises Date::Error and 500s; the
         # controller's own parser exists for exactly this.
         exit_date = params[:date_of_exit].present? ? parse_date_param(params[:date_of_exit]) : Date.current
 
-        @profile.update!(date_of_exit: exit_date)
+        ActiveRecord::Base.transaction do
+          @profile.update!(date_of_exit: exit_date)
+          # HR, Finance, Leadership go with the job; Employee stays so the person still opens their slips.
+          RoleAssignment.for_user(@profile.user).joins(:role).where.not(hr_lite_roles: { name: Role::EMPLOYEE }).destroy_all
+        end
         # The last day has a list too — and it is the one that matters most,
         # since an unreturned laptop and un-revoked access both outlive the
         # employment.
@@ -110,6 +114,9 @@ module HrLite
 
       private
 
+      # Nobody edits or offboards their own record here (auto-approve would publish it); someone else does.
+      def others_profile = EmployeeProfile.find(params[:id]).tap { |p| raise ActiveRecord::RecordNotFound if p.user_id == hr_current_user.id }
+
       def profile_params
         params.require(:employee_profile).permit(
           :user_id, :manager_id, :designation, :date_of_birth, :date_of_joining,

data/app/controllers/hr_lite/admin/expenses_controller.rb

@@ -15,6 +15,8 @@ module HrLite
         expense = decidable.find(params[:id])
         expense.approve!(actor: hr_current_user, note: params[:decision_note].presence)
         redirect_to admin_expenses_path, notice: "Claim approved."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_expenses_path, alert: "Only a submitted claim can be approved."
       end
 
       def reject
@@ -24,6 +26,8 @@ module HrLite
 
         expense.reject!(actor: hr_current_user, note: note)
         redirect_to admin_expenses_path, notice: "Claim rejected."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_expenses_path, alert: "Only a submitted claim can be rejected."
       end
 
       def reimburse

data/app/controllers/hr_lite/admin/hr_requests_controller.rb

@@ -20,6 +20,8 @@ module HrLite
         assignee = HrLite.user_klass.find(params[:assignee_id])
         request.assign!(actor: hr_current_user, assignee: assignee)
         redirect_to admin_hr_request_path(request), notice: "Assigned to #{HrLite.display_name(assignee)}."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_hr_request_path(request), alert: "This request is already settled."
       end
 
       def resolve
@@ -28,6 +30,8 @@ module HrLite
         redirect_to admin_hr_requests_path, notice: "Answered."
       rescue ArgumentError
         redirect_to admin_hr_request_path(request), alert: "Write an answer before resolving."
+      rescue ActiveRecord::RecordInvalid
+        redirect_to admin_hr_request_path(request), alert: "This request is already settled."
       end
 
       private

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -24,7 +24,10 @@ module HrLite
       end
 
       def create
-        profile = recordable.find_by(employee_code: params[:employee_code].to_s.strip)
+        typed = params[:employee_code].to_s.strip
+        # The code, else a typed name — only when exactly one person has it.
+        profile = recordable.find_by(employee_code: typed) ||
+                  recordable.select { |p| HrLite.display_name(p.user).casecmp?(typed) }.then { |m| m.first if m.one? }
         @request = LeaveRequest.new(params.require(:leave_request).permit(:leave_type_id, :start_date, :end_date, :half_day, :half_day_part, :reason)
                                           .merge(user_id: profile&.user_id, created_by_id: hr_current_user.id))
         recorded = profile && LeaveRequest.transaction do

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -18,7 +18,7 @@ module HrLite
         month = parse_month_param(params.dig(:payroll_run, :period_month))
         @run = PayrollRun.new(period_month: month, created_by_id: hr_current_user.id,
                               notes: params.dig(:payroll_run, :notes))
-        if @run.save
+        if PayrollRun.transaction { @run.save && audit!("payroll.created", @run) }
           redirect_to admin_payroll_run_path(@run), notice: "Run created — compute when ready."
         else
           render :new, status: :unprocessable_entity
@@ -32,7 +32,7 @@ module HrLite
 
       def destroy
         run = PayrollRun.find(params[:id])
-        if run.destroy
+        if PayrollRun.transaction { run.destroy && audit!("payroll.deleted", run) }
           redirect_to admin_payroll_runs_path, notice: "Draft run deleted.", status: :see_other
         else
           redirect_to admin_payroll_run_path(run), alert: run.errors.full_messages.to_sentence,
@@ -41,7 +41,7 @@ module HrLite
       end
 
       def compute
-        transition { |run| run.compute!(actor: hr_current_user) && "Computed — review the slips." }
+        transition { |run| run.compute_later!(actor: hr_current_user) && "Compute started." }
       end
 
       def approve
@@ -77,6 +77,8 @@ module HrLite
 
       private
 
+      def audit!(action, run) = AuditLog.record!(action: action, subject: run, actor: hr_current_user, changes: { "period" => run.label })
+
       def require_approver_or_money!
         return if hr_can?("payroll.manage", scope: :all)
 
@@ -99,8 +101,10 @@ module HrLite
         CSV.generate do |csv|
           csv << [ "Code", "Name", "Days", "LOP", "Gross", "PF", "ESI", "PT", "TDS",
                    "Net pay", "Bank", "Account", "IFSC" ]
-          run.salary_slips.includes(:user).each do |slip|
-            profile = slip.user_profile
+          slips = run.salary_slips.includes(:user).to_a
+          profiles = EmployeeProfile.where(user_id: slips.map(&:user_id)).index_by(&:user_id) # one query, not one a slip
+          slips.each do |slip|
+            profile = profiles[slip.user_id]
             deductions = slip.deductions_rows.index_by { |row| row["code"] }
             csv << [
               profile&.employee_code, HrLite.display_name(slip.user),

data/app/controllers/hr_lite/admin/reports_controller.rb

@@ -109,9 +109,10 @@ module HrLite
         visible_users.flat_map do |user|
           types.map do |type|
             balance = LeaveBalance.for(user, type, year)
+            entitled = balance.entitled
+            used = balance.used # each once: both query
             { "Employee" => HrLite.display_name(user), "Type" => type.code,
-              "Entitled" => balance.entitled.to_f, "Used" => balance.used.to_f,
-              "Available" => balance.available.to_f }
+              "Entitled" => entitled.to_f, "Used" => used.to_f, "Available" => (entitled - used).to_f }
           end
         end
       end

data/app/controllers/hr_lite/admin/salary_structures_controller.rb

@@ -38,8 +38,10 @@ module HrLite
 
       private
 
+      # Nobody sets their own pay.
       def set_profile
         @profile = EmployeeProfile.find(params[:employee_id])
+        raise ActiveRecord::RecordNotFound if @profile.user_id == hr_current_user.id
       end
 
       def structure_params

data/app/controllers/hr_lite/admin/tax_declarations_controller.rb

@@ -45,7 +45,7 @@ module HrLite
 
         AuditLog.record!(action: "tax_proof.downloaded", subject: declaration, actor: hr_current_user,
                          changes: { "file" => file.filename.to_s, "owner" => HrLite.display_name(declaration.user) })
-        redirect_to Rails.application.routes.url_helpers.rails_blob_path(file, disposition: "attachment", only_path: true),
+        redirect_to Rails.application.routes.url_helpers.rails_blob_path(file, disposition: "attachment", only_path: true, expires_in: 5.minutes),
                     allow_other_host: false
       end
 
@@ -57,6 +57,8 @@ module HrLite
           declaration.tax_declaration_items.each do |item|
             item.update!(verified_amount: item.declared_amount) if item.verified_amount.nil?
           end
+          AuditLog.record!(action: "tax_declaration.accepted_all", subject: declaration, actor: hr_current_user,
+                           changes: { "owner" => HrLite.display_name(declaration.user) })
           declaration.verify!(actor: hr_current_user, note: "Proof accepted")
         end
         redirect_to admin_tax_declarations_path, notice: "Accepted and verified — payroll uses these amounts now."
@@ -66,9 +68,16 @@ module HrLite
 
       def update
         @declaration = find_manageable
+        return redirect_to admin_tax_declaration_path(@declaration), alert: "Only a submitted declaration can be checked." unless @declaration.submitted?
+
         # Recording what the proof supported is a separate act from deciding
         # — an amount can be corrected while the decision is still pending.
-        if @declaration.update(verification_params)
+        recorded = TaxDeclaration.transaction do
+          @declaration.update(verification_params) &&
+            AuditLog.record!(action: "tax_declaration.amounts_recorded", subject: @declaration, actor: hr_current_user,
+                             changes: { "owner" => HrLite.display_name(@declaration.user) })
+        end
+        if recorded
           return verify if params[:verify] # "Record and verify": the typed amounts are saved first
           redirect_to admin_tax_declaration_path(@declaration), notice: "Amounts recorded."
         else
@@ -82,7 +91,8 @@ module HrLite
         declaration.verify!(actor: hr_current_user, note: params[:note])
         redirect_to admin_tax_declarations_path, notice: "Verified — payroll will use the checked amounts."
       rescue ActiveRecord::RecordInvalid
-        redirect_to admin_tax_declaration_path(declaration), alert: "Only a submitted declaration can be verified."
+        redirect_to admin_tax_declaration_path(declaration),
+                    alert: declaration.errors.full_messages.first || "Only a submitted declaration can be verified."
       end
 
       def reject

data/app/controllers/hr_lite/approvals_controller.rb

@@ -9,6 +9,7 @@ module HrLite
   class ApprovalsController < ApplicationController
     def index
       @approvals = paginate(Approval.pending_for(hr_current_user).includes(:step, :subject).order(:created_at))
+      @in_flow = Approval.pending_for(hr_current_user).pluck(:subject_type, :subject_id) # their queue rows would repeat them
       @delegations = ApprovalDelegation.live_on(Date.current)
                                        .where(from_user_id: hr_current_user.id)
                                        .includes(:to_user)

data/app/controllers/hr_lite/home_controller.rb

@@ -3,12 +3,12 @@ module HrLite
     def index
       @latest_kudos = Kudo.recent.includes(:giver, kudo_mentions: :user).limit(3)
       @awards = Award.current
-      @out_week = LeaveRequest.approved.overlapping_range(Date.current.beginning_of_week, Date.current.end_of_week)
+      @out_week = LeaveRequest.approved.overlapping_range(Date.current, Date.current.end_of_week)
                               .includes(:user).where(user_id: HrLite.active_employees.map(&:id))
                               .sort_by { |leave| hr_display_name(leave.user).downcase }
       @attention = attention_days
       @waiting = Approval.pending_for(hr_current_user).count
-      @mine_pending = [ LeaveRequest.includes(:leave_type), RegularizationRequest, CompOffRequest ]
+      @mine_pending = [ LeaveRequest.includes(:leave_type), RegularizationRequest, CompOffRequest, WfhRequest ]
                       .flat_map { |scope| scope.pending.where(user_id: hr_current_user.id).order(created_at: :desc).limit(5) }
                       .max_by(5, &:created_at)
     end

data/app/controllers/hr_lite/regularization_requests_controller.rb

@@ -22,19 +22,19 @@ module HrLite
     def cancel
       request = RegularizationRequest.where(user_id: hr_current_user.id).find(params[:id])
       request.cancel!(actor: hr_current_user)
-      redirect_to regularization_requests_path, notice: "Ticket cancelled."
+      redirect_to regularization_requests_path, notice: "Day fix cancelled."
     rescue ActiveRecord::RecordInvalid
-      redirect_to regularization_requests_path, alert: "Only pending tickets can be cancelled."
+      redirect_to regularization_requests_path, alert: "Only pending day fixes can be cancelled."
     end
 
     private
 
     def create_notice
       rule = HrLite.config.self_regularization
-      return "Ticket raised — an admin will review it." unless rule
+      return "Sent for approval — your manager or HR will review it." unless rule
       return "Fixed. #{helpers.pluralize(@request.self_fixes_left, 'self-fix')} left this week." if @request.approved?
 
-      "Sent to HR as a ticket — you can fix only a missed punch or short day on a working day in the last #{rule[:within_days]} days yourself, " \
+      "Sent for approval — you can fix only a missed punch or short day on a working day in the last #{rule[:within_days]} days yourself, " \
         "#{rule[:per_week]} times a week."
     end
 

data/app/controllers/hr_lite/tax_declarations_controller.rb

@@ -28,10 +28,11 @@ module HrLite
                      TaxDeclaration.new(user_id: hr_current_user.id,
                                         financial_year: financial_year, regime: employee_regime)
       # A verified declaration is what payroll is deducting against; changing
-      # it would silently re-open a decision HR has already made.
-      if @declaration.verified?
+      # it would silently re-open a decision HR has already made. A submitted
+      # one is what HR is checking, so it cannot shift under them either.
+      if @declaration.verified? || @declaration.submitted?
         return redirect_to tax_declaration_path,
-                           alert: "This year's declaration is verified. Ask HR to reopen it."
+                           alert: "This year's declaration is #{@declaration.status}. Ask HR to reopen it."
       end
 
       if @declaration.update(declaration_params)
@@ -59,10 +60,13 @@ module HrLite
 
     private
 
+    # This year or last (late proof); any other year falls back to this one.
     def financial_year
-      FinancialYear.start_for(params[:financial_year].present? ? Date.parse(params[:financial_year]) : Date.current)
+      current = FinancialYear.start_for(Date.current)
+      asked = FinancialYear.start_for(Date.parse(params[:financial_year].to_s))
+      asked.between?(current.prev_year, current) ? asked : current
     rescue Date::Error
-      FinancialYear.start_for(Date.current)
+      current
     end
 
     def current_declaration