hr_lite 0.56.0 → 0.57.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5deeac7b0eead75adc631a3fe868844a5db7712aaa8297089d6a7ab305c1c610
-  data.tar.gz: fd6b50aa2589eaba50c53703f3a8d4c22a96c61d469989045e1dc7113005a546
+  metadata.gz: 288b37a483def4fc57b059096e2ee8af708d1245dd2587119855635ea73d9c11
+  data.tar.gz: 65fe286df5fb17b8b369ab499b2980e3456b69f92b4f823f89c75e1053af7f35
 SHA512:
-  metadata.gz: 14b6853b122a691166a5f2b884a52451d3893bff7b82d33df1ab5e69bfbf71dc00644fe07221588f914a2e7082b95e1164a64f7545d830ccb26c88792c82a701
-  data.tar.gz: 5dbf80c20826f0f3baaff056627d2bb7478914dfce0eb3e140976564e8d60fc4e4a98684fdf37b2cc3c77f5fbc5de5314b6048470fec9c33af7baaeb7053f06e
+  metadata.gz: 955e1a2242f0c9585b219c5896b9069253624c9797aaa1028ecc7c068f5e5cde734af64ddfcf4982696a4b066e66bb322ed67e37a46d5b1587d5ff04e4d14ddc
+  data.tar.gz: 57ef0949c6c9f8e4569b8b0157b212ba52ad19f226541f5977d32f8773e1555e444b91eda89ccdc350df84c7bf9db51c279bfd3830aff994c487286c102a6693

data/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.57.1] - 2026-10-19
+
+Forms in the host's iOS and Android staff apps (D24). No migrations.
+
+- **A save shows its confirmation again.** Native pages reload on every Turbo visit, and the page Turbo fetched and threw away used to spend the flash. A GET fetched by Turbo in the app now keeps it for the reload.
+- **A refused form keeps its errors and what was typed.** A 422 used to be discarded and the form reloaded blank. It is now drawn in place (with `turbo-cache-control: no-cache`), and the next visit reloads as before.
+- Browsers are unchanged: they never load Turbo.
+
+## [0.57.0] - 2026-10-19
+
+No migration.
+
+- **Why a day is Absent.** A refused check-in or check-out is now saved with its reason, and the person's attendance summary lists it under that day, for example "Check-in tried 10:09 — refused: You are not within the office location…". When the phone holds a tap because location is blocked or not found, the browser tells the server, and the day shows "Location not picked up on the phone (denied)". A past Absent day with no tries says "No check-in tried". Days before the first refusal was ever saved show neither line, because there is no record to go on. The rows are `attendance.punch_refused` entries in the audit trail.
+
 ## [0.56.0] - 2026-10-17
 
 Owner decisions on the HRMS audit (#133–#138). **Two migrations**: the host runs `bin/rails db:migrate` and refreshes `db/schema.rb`.

data/app/assets/javascripts/hr_lite/geo_punch.js

@@ -88,10 +88,17 @@
       form.submit();
     }
 
-    function hold(headline) {
+    function hold(headline, status) {
       locating = false;
       if (button) { button.disabled = false; button.removeAttribute("aria-busy"); }
       showHelp(label, headline);
+      // Tell the server about the tap, so HR sees why the day has no check-in.
+      if (/\/check_(in|out)$/.test(form.action) && navigator.sendBeacon) {
+        var data = new FormData(form);
+        data.set("held", "1");
+        data.set("geo_status", status);
+        navigator.sendBeacon(form.action, data);
+      }
     }
 
     form.addEventListener("submit", function (event) {
@@ -102,7 +109,7 @@
       if (label) { label.hidden = false; label.classList.replace("hrl-errors", "hrl-muted"); label.textContent = "Getting location…"; }
 
       if (!navigator.geolocation) {
-        if (required) hold("This browser cannot share your location. Open this page in Chrome or Safari.");
+        if (required) hold("This browser cannot share your location. Open this page in Chrome or Safari.", "unavailable");
         else send("unavailable");
         return;
       }
@@ -117,8 +124,8 @@
         function (err) {
           // Browsers ask only once; a past "Don't allow" denies silently forever.
           // Hold the punch so it is never filed (and flagged) without GPS.
-          if (err && err.code === 1) { hold("Location is blocked. To allow it:"); return; }
-          if (required) { hold("Couldn't get your location. Check that location is on:"); return; }
+          if (err && err.code === 1) { hold("Location is blocked. To allow it:", "denied"); return; }
+          if (required) { hold("Couldn't get your location. Check that location is on:", err && err.code === 3 ? "timeout" : "unavailable"); return; }
           send("timeout");
         },
         { enableHighAccuracy: true, timeout: 10000, maximumAge: 60000 }

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -141,6 +141,10 @@ module HrLite
         range = @period.from..@period.to
         @days = DayStatus.new(user: @employee, range: range)
         @punches = AttendancePunch.where(user_id: @employee.id, date: range).order(:at, :id).group_by(&:date)
+        refused = AuditLog.where(action: "attendance.punch_refused")
+        @refused = refused.where(subject_type: HrLite.user_klass.name, subject_id: @employee.id, created_at: range.first.beginning_of_day..range.last.end_of_day)
+                          .order(:created_at).group_by { |log| log.created_at.to_date }
+        @tracked_from = refused.minimum(:created_at)&.to_date # before this, a day with no tries proves nothing
         @penalties = AttendancePenalty.active.where(user_id: @employee.id, date: range).group(:date).sum(:minutes)
         @balances = LeaveType.active.where(paid: true).map { |type| LeaveBalance.for(@employee, type, LeaveYear.current_key) }
         @requests = summary_requests(@employee, range)

data/app/controllers/hr_lite/application_controller.rb

@@ -9,6 +9,9 @@ module HrLite
     before_action :hr_authenticate!
     before_action :hr_set_current_actor
     around_action :hr_use_time_zone
+    # Native pages reload every Turbo visit (see the layout): the page Turbo
+    # fetched and threw away must not spend the flash the reload shows.
+    after_action -> { flash.keep if request.get? && request.headers["X-Turbo-Request-Id"] && HrLite.config.native_app.call(request) }
 
     helper_method :hr_current_user, :hr_admin?, :hr_leadership?, :hr_superadmin?, :hr_operations?, :hr_display_name,
                   :hr_can?, :hr_reaches?, :hr_access

data/app/controllers/hr_lite/attendance_controller.rb

@@ -51,6 +51,13 @@ module HrLite
     private
 
     def punch(kind)
+      # The browser held the tap (location blocked or not found): log it, file nothing.
+      if params[:held]
+        geo = AttendancePuncher::GEO_STATUSES.include?(params[:geo_status]) ? params[:geo_status] : "unavailable"
+        log_refused(kind, "Location not picked up on the phone (#{geo})")
+        return head(:no_content)
+      end
+
       field = params.fetch(:field, {}).permit(:mode, :purpose, :place).to_h
       result = AttendancePuncher.call(user: hr_current_user, kind: kind, field: field, travel: params[:place] == "travel",
                                       save_home: params[:save_home] == "1" || params[:place] == "home", **punch_params.to_h.symbolize_keys)
@@ -58,11 +65,18 @@ module HrLite
         time = Time.current.strftime("%H:%M")
         redirect_to attendance_path, notice: "#{kind == :check_in ? 'Checked in' : 'Checked out'} at #{time}."
       else
+        log_refused(kind, result.error)
         flash[:punch_offer] = result.offer.to_s if result.offer
         redirect_to attendance_path, alert: result.error
       end
     end
 
+    # The person's summary lists these per day, so HR can see why a day is Absent.
+    def log_refused(kind, error)
+      AuditLog.record!(action: "attendance.punch_refused", subject: hr_current_user, actor: hr_current_user,
+                       changes: { "kind" => kind.to_s, "error" => error })
+    end
+
     def punch_params
       params.permit(:lat, :lng, :accuracy_m, :geo_status)
     end

data/app/views/hr_lite/admin/attendances/summary.html.erb

@@ -45,6 +45,12 @@
         <% if punches.size > 2 %><div>All punches: <%= punches.join(" · ") %></div><% end %>
         <% if (minutes = @penalties[date]) %><div><span class="hrl-badge hrl-badge--warn">+<%= minutes %> min</span> penalty</div><% end %>
         <% if rec&.flagged? %><div>Flagged: <%= rec.flag_note %></div><% end %>
+        <% @refused[date].to_a.each do |log| %>
+          <div><%= log.audited_changes["kind"] == "check_out" ? "Check-out" : "Check-in" %> tried <%= log.created_at.strftime("%H:%M") %> — refused: <%= log.audited_changes["error"] %></div>
+        <% end %>
+        <% if day.kind == :absent && !not_in_yet && @refused[date].nil? && @tracked_from && date >= @tracked_from %>
+          <div class="hrl-muted">No check-in tried</div>
+        <% end %>
       </div>
       <% if fix && date <= Date.current %>
         <a class="hrl-btn" href="<%= hr_lite.admin_attendance_path(@employee.id, date: date, month: date.strftime("%Y-%m"), anchor: "regularize") %>">Fix<span class="hrl-sr-only"> <%= date.strftime("%-d %b") %></span></a>

data/app/views/layouts/hr_lite/application.html.erb

@@ -10,8 +10,14 @@
   <% if HrLite.config.native_app.call(request) %>
     <%# The host's iOS/Android shells drive pages through Turbo. "reload" makes
         every visit a full page load, so the plain scripts below run exactly
-        as they do in a browser. Browsers never load Turbo here. %>
-    <meta name="turbo-visit-control" content="reload">
+        as they do in a browser. Browsers never load Turbo here. A refused
+        form (422) is drawn in place instead: the reload would bring the form
+        back blank, with no error. no-cache keeps that render out of history. %>
+    <% if response.unprocessable? %>
+      <meta name="turbo-cache-control" content="no-cache">
+    <% else %>
+      <meta name="turbo-visit-control" content="reload">
+    <% end %>
     <%= javascript_include_tag "hr_lite/vendor/turbo.min", type: "module" %>
   <% end %>
   <%= stylesheet_link_tag "hr_lite/hr_lite", media: "all" %>

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.56.0"
+  VERSION = "0.57.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.56.0
+  version: 0.57.1
 platform: ruby
 authors:
 - kshitiz sinha