hr_lite 0.9.0 → 0.12.0

data/app/models/hr_lite/loan_repayment.rb

@@ -0,0 +1,14 @@
+module HrLite
+  # One month's deduction actually taken. Written when the run is finalized,
+  # so recomputing a draft never books a repayment twice — and the unique
+  # index on [loan, month] means a retry cannot either.
+  class LoanRepayment < ApplicationRecord
+    include EncryptedMoney
+
+    encrypted_money :amount
+
+    belongs_to :loan, class_name: "HrLite::Loan"
+
+    validates :period_month, presence: true, uniqueness: { scope: :loan_id }
+  end
+end

data/app/models/hr_lite/payroll_line_item.rb

@@ -0,0 +1,57 @@
+module HrLite
+  # A one-off on one month's payslip: a bonus, an incentive, arrears after a
+  # backdated revision, a reimbursement, a one-time deduction.
+  #
+  # Dated to the MONTH, not to the run, so deleting a draft run and computing
+  # it again does not lose them.
+  class PayrollLineItem < ApplicationRecord
+    include EncryptedMoney
+    include Audited
+
+    encrypted_money :amount
+
+    belongs_to :component, class_name: "HrLite::SalaryComponent"
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :created_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :period_month, presence: true
+    validate :period_is_first_of_month
+    validate :amount_is_positive
+    validate :period_is_not_already_paid, on: :create
+
+    scope :for_month, ->(month) { where(period_month: month) }
+
+    def self.for_slip(user, period_month)
+      where(user_id: user.id, period_month: period_month).includes(:component)
+    end
+
+    private
+
+    def period_is_first_of_month
+      return if period_month.nil? || period_month.day == 1
+
+      errors.add(:period_month, "must be the 1st of a month")
+    end
+
+    # Amounts are signed by the component's KIND, not by the number: a
+    # deduction of -500 and a deduction of 500 would otherwise both be
+    # storable and mean opposite things.
+    def amount_is_positive
+      return if amount.nil? || amount.positive?
+
+      errors.add(:amount, "must be more than zero — a deduction is a deduction by its component, not by a minus sign")
+    end
+
+    # A published slip is immutable. Adding a line to that month afterwards
+    # would show on no payslip and quietly change the year-to-date totals the
+    # TDS projector reads.
+    def period_is_not_already_paid
+      return if user_id.nil? || period_month.nil?
+
+      settled = SalarySlip.settled.exists?(user_id: user_id, period_month: period_month)
+      return unless settled
+
+      errors.add(:period_month, "has already been paid — put this on the next open month")
+    end
+  end
+end

data/app/models/hr_lite/payroll_run.rb

@@ -64,6 +64,7 @@ module HrLite
         # Finalizing freezes every slip in the run. Who did it, to how many
         # people, is the row an investigation starts from.
         audit!("payroll.finalized", actor, "slips" => salary_slips.count)
+        book_loan_repayments!
       end
       Notifications.publish(
         "payroll.finalized",
@@ -77,6 +78,10 @@ module HrLite
       raise_unless %w[finalized]
       transaction do
         update!(status: "review")
+        # The slips are editable again, so the repayments booked at finalize
+        # have to come back off the loans — otherwise unlocking and
+        # refinalizing takes the instalment twice.
+        unbook_loan_repayments!
         # Reopening frozen slips for editing is the single most sensitive
         # transition in the module — it is the one that has to leave a trace.
         audit!("payroll.unlocked", actor, "slips" => salary_slips.count)
@@ -124,6 +129,35 @@ module HrLite
 
     private
 
+    # A repayment is booked when the run is FINALIZED, never at compute: a
+    # draft is recomputed as often as the operator likes, and each pass would
+    # otherwise take another instalment off the loan.
+    def book_loan_repayments!
+      salary_slips.includes(:user).find_each do |slip|
+        taken = slip.deduction_amount("loan_repayment")
+        next unless taken.positive?
+
+        remaining = taken
+        Loan.active.where(user_id: slip.user_id).order(:starts_on).each do |loan|
+          break unless remaining.positive?
+
+          share = [ loan.instalment_for(period_month), remaining ].min
+          next unless share.positive?
+
+          loan.record_repayment!(period_month, share)
+          remaining -= share
+        end
+      end
+    end
+
+    def unbook_loan_repayments!
+      LoanRepayment.where(period_month: period_month)
+                   .where(loan_id: Loan.where(user_id: salary_slips.select(:user_id)))
+                   .destroy_all
+      Loan.where(user_id: salary_slips.select(:user_id), status: "closed")
+          .each { |loan| loan.update!(status: "active") if loan.outstanding.positive? }
+    end
+
     # Amounts stay out of it on purpose: audit_logs is a plaintext table and
     # every slip amount in this module is encrypted. The row records WHO
     # moved the run and HOW FAR, never what anyone is paid.

data/app/models/hr_lite/policy.rb

@@ -0,0 +1,59 @@
+module HrLite
+  # A written policy people are held to. Versioned, because "you agreed to
+  # this" is only true of the version somebody actually read.
+  class Policy < ApplicationRecord
+    include Audited
+
+    has_many :policy_acknowledgements, class_name: "HrLite::PolicyAcknowledgement",
+                                       dependent: :destroy
+
+    validates :title, presence: true, uniqueness: { scope: :version }
+    validates :body, presence: true
+    validates :effective_from, presence: true
+    validates :version, numericality: { greater_than: 0 }
+
+    scope :published, -> { where(published: true) }
+    scope :live_on, ->(date) { published.where(effective_from: ..date) }
+    scope :newest_first, -> { order(effective_from: :desc, version: :desc) }
+
+    # The version in force today for each title — an older one stays for the
+    # acknowledgements attached to it, but nobody should be reading it.
+    def self.current
+      live_on(Date.current).group_by(&:title).values.map do |versions|
+        versions.max_by(&:version)
+      end
+    end
+
+    # Re-issuing asks everybody again, which is the whole point of versioning
+    # it: an acknowledgement of v1 says nothing about v2.
+    def supersede!(body:, effective_from: Date.current, acknowledgement_required: nil)
+      self.class.create!(
+        title: title, body: body, version: version + 1, effective_from: effective_from,
+        acknowledgement_required: acknowledgement_required.nil? ? self.acknowledgement_required : acknowledgement_required,
+        published: true
+      )
+    end
+
+    def acknowledged_by?(user)
+      policy_acknowledgements.exists?(user_id: user.id)
+    end
+
+    def outstanding_for
+      return HrLite.user_klass.none unless acknowledgement_required && published
+
+      HrLite.user_klass.where(id: HrLite.active_employees.map(&:id))
+            .where.not(id: policy_acknowledgements.select(:user_id))
+    end
+
+    # Clicking twice is not an error and must not read as one. The
+    # find_or_create handles the second click; the rescue handles two
+    # requests arriving at once, which the unique index refuses.
+    def acknowledge!(user)
+      policy_acknowledgements.find_or_create_by!(user_id: user.id) do |ack|
+        ack.acknowledged_at = Time.current
+      end
+    rescue ActiveRecord::RecordNotUnique
+      policy_acknowledgements.find_by!(user_id: user.id)
+    end
+  end
+end

data/app/models/hr_lite/policy_acknowledgement.rb

@@ -0,0 +1,13 @@
+module HrLite
+  # "I have read this." Kept per VERSION, and never edited — it is the
+  # evidence, and evidence that can be changed afterwards is not evidence.
+  class PolicyAcknowledgement < ApplicationRecord
+    belongs_to :policy, class_name: "HrLite::Policy"
+    belongs_to :user, class_name: HrLite.config.user_class
+
+    validates :acknowledged_at, presence: true
+    validates :user_id, uniqueness: { scope: :policy_id }
+
+    def readonly? = persisted?
+  end
+end

data/app/models/hr_lite/salary_component.rb

@@ -0,0 +1,59 @@
+module HrLite
+  # An earning or deduction head. Data, so an install can add "Night shift
+  # allowance" without a gem release — and so a payslip line says what it
+  # was for instead of disappearing into "other".
+  class SalaryComponent < ApplicationRecord
+    include Audited
+
+    KINDS = %w[earning deduction].freeze
+
+    # Heads the structure itself owns. A line item may not use these — they
+    # already have a column, and two sources for one number is how a payslip
+    # stops adding up.
+    STRUCTURAL_CODES = %w[basic hra special_allowance other_earnings].freeze
+
+    has_many :payroll_line_items, class_name: "HrLite::PayrollLineItem",
+                                  foreign_key: :component_id, dependent: :restrict_with_error
+
+    validates :code, presence: true, uniqueness: { case_sensitive: false },
+                     format: { with: /\A[a-z0-9_]+\z/, message: "is lowercase letters, numbers and underscores" }
+    validates :label, presence: true
+    validates :kind, inclusion: { in: KINDS }
+    validate :code_is_not_a_structural_one, on: :create
+
+    scope :active, -> { where(active: true) }
+    scope :earnings, -> { where(kind: "earning") }
+    scope :deductions, -> { where(kind: "deduction") }
+    scope :ordered, -> { order(:position, :label) }
+
+    KINDS.each { |k| define_method("#{k}?") { kind == k } }
+
+    def self.seed_defaults!
+      [
+        { code: "bonus", label: "Bonus", prorated: false, position: 10 },
+        { code: "incentive", label: "Incentive", prorated: false, position: 20 },
+        { code: "arrears", label: "Arrears", prorated: false, position: 30 },
+        { code: "lta", label: "Leave travel allowance", prorated: false, position: 40 },
+        { code: "reimbursement", label: "Reimbursement", prorated: false, taxable: false,
+          counts_for_esi: false, position: 50 },
+        { code: "loan_repayment", label: "Loan repayment", kind: "deduction",
+          prorated: false, taxable: false, counts_for_esi: false, position: 60 },
+        { code: "other_deduction", label: "Other deduction", kind: "deduction",
+          prorated: false, taxable: false, counts_for_esi: false, position: 70 }
+      ].filter_map do |attributes|
+        next if exists?(code: attributes[:code])
+
+        create!(attributes)
+        attributes[:code]
+      end
+    end
+
+    private
+
+    def code_is_not_a_structural_one
+      return unless STRUCTURAL_CODES.include?(code.to_s)
+
+      errors.add(:code, "is already a salary-structure field — pick another name")
+    end
+  end
+end

data/app/models/hr_lite/tax_declaration.rb

@@ -0,0 +1,93 @@
+module HrLite
+  # What an employee claims for the year, section by section, replacing the
+  # single `declared_annual_deductions` figure an admin used to type in.
+  #
+  # The whole year's TDS is projected from this number, so it matters that it
+  # is broken down, that the employee submitted it themselves, and that HR
+  # can record what the proof actually supported.
+  class TaxDeclaration < ApplicationRecord
+    include Audited
+
+    STATUSES = %w[draft submitted verified rejected].freeze
+    REGIMES = %w[new old].freeze
+
+    has_many :tax_declaration_items, -> { order(:section) },
+             class_name: "HrLite::TaxDeclarationItem",
+             foreign_key: :declaration_id, dependent: :destroy
+    accepts_nested_attributes_for :tax_declaration_items, allow_destroy: true
+
+    belongs_to :user, class_name: HrLite.config.user_class
+    belongs_to :verified_by, class_name: HrLite.config.user_class, optional: true
+
+    validates :status, inclusion: { in: STATUSES }
+    validates :regime, inclusion: { in: REGIMES }
+    validates :financial_year, presence: true, uniqueness: { scope: :user_id }
+    validate :financial_year_opens_in_april
+
+    STATUSES.each { |s| define_method("#{s}?") { status == s } }
+
+    def self.for(user, period_month)
+      find_by(user_id: user.id, financial_year: FinancialYear.start_for(period_month))
+    end
+
+    def label = "FY #{FinancialYear.label(financial_year)}"
+
+    def declared_total = tax_declaration_items.sum(BigDecimal(0)) { |i| i.declared_amount || 0 }
+
+    # What payroll should actually deduct against. Until HR has verified it,
+    # the declared figure stands — asking somebody to overpay tax all year
+    # because paperwork is slow is its own kind of wrong — but once verified,
+    # only what the proof supported counts.
+    def allowable_total
+      return declared_total unless verified?
+
+      tax_declaration_items.sum(BigDecimal(0)) { |i| i.verified_amount || BigDecimal(0) }
+    end
+
+    def submit!(actor:)
+      raise ActiveRecord::RecordInvalid.new(self), "not a draft" unless draft? || rejected?
+
+      update!(status: "submitted", submitted_at: Time.current)
+      Notifications.publish(
+        "tax.declaration_submitted",
+        title: "#{HrLite.display_name(user)} submitted a #{label} tax declaration",
+        path: "/admin/tax_declarations/#{id}",
+        bell_to: HrLite.users_holding("tax.manage").to_a
+      )
+      true
+    end
+
+    def verify!(actor:, note: nil)
+      raise ActiveRecord::RecordInvalid.new(self), "not submitted" unless submitted?
+
+      update!(status: "verified", verified_by_id: actor.id, verified_at: Time.current,
+              note: note.presence)
+      notify_employee("Your #{label} tax declaration was verified")
+      true
+    end
+
+    def reject!(actor:, note:)
+      raise ArgumentError, "a rejection needs a reason" if note.blank?
+
+      update!(status: "rejected", verified_by_id: actor.id, verified_at: Time.current, note: note)
+      notify_employee("Your #{label} tax declaration needs attention")
+      true
+    end
+
+    private
+
+    def notify_employee(title)
+      Notifications.publish(
+        "tax.declaration_decided", title: title, body: note.presence,
+        path: "/tax_declaration", bell_to: [ user ], email_to: [ user ]
+      )
+    end
+
+    def financial_year_opens_in_april
+      return if financial_year.blank?
+      return if financial_year == FinancialYear.start_for(financial_year)
+
+      errors.add(:financial_year, "must be 1 April — a declaration covers a whole year")
+    end
+  end
+end

data/app/models/hr_lite/tax_declaration_item.rb

@@ -0,0 +1,32 @@
+module HrLite
+  # One line of a declaration: "80C — ELSS — ₹1,50,000".
+  #
+  # `verified_amount` is what the proof actually supported, which is often
+  # less than what was claimed and is the number payroll uses once HR has
+  # looked. Both are encrypted: what somebody invests is their business.
+  class TaxDeclarationItem < ApplicationRecord
+    include EncryptedMoney
+
+    SECTIONS = %w[80c 80d 80ccd_1b 24b hra other].freeze
+
+    encrypted_money :declared_amount, :verified_amount
+
+    belongs_to :declaration, class_name: "HrLite::TaxDeclaration"
+
+    validates :section, inclusion: { in: SECTIONS }
+    validate :amounts_are_not_negative
+
+    def section_label
+      { "80c" => "80C — investments", "80d" => "80D — health insurance",
+        "80ccd_1b" => "80CCD(1B) — NPS", "24b" => "24(b) — home loan interest",
+        "hra" => "HRA exemption", "other" => "Other" }.fetch(section, section)
+    end
+
+    private
+
+    def amounts_are_not_negative
+      errors.add(:declared_amount, "cannot be negative") if declared_amount&.negative?
+      errors.add(:verified_amount, "cannot be negative") if verified_amount&.negative?
+    end
+  end
+end

data/app/services/hr_lite/slip_builder.rb

@@ -33,8 +33,17 @@ module HrLite
       earnings = Calculators::Proration.call(
         structure: @structure, payable_days: payable, days_in_month: days_in_month
       )
+      # One-off heads for this month: a bonus, arrears after a backdated
+      # revision, a reimbursement. A prorated head is scaled like basic; a
+      # bonus is not halved because somebody joined mid-month.
+      extra_earnings, extra_deductions = one_off_lines(payable, days_in_month)
+      earnings += extra_earnings
+
       gross_earned = earnings.sum(BigDecimal(0)) { |row| row[:amount] }
       basic_earned = earnings.find { |row| row[:code] == "basic" }&.fetch(:amount) || BigDecimal(0)
+      # ESI is assessed on wages, and a reimbursement is not one. Heads that
+      # opt out are excluded from the gross it reads.
+      esi_gross = gross_earned - earnings.sum(BigDecimal(0)) { |row| row[:excluded_from_esi] ? row[:amount] : 0 }
 
       deductions = []
       employer_costs = {}
@@ -50,7 +59,7 @@ module HrLite
         )
       end
 
-      esi = Calculators::Esi.call(monthly_gross: esi_reference_gross, gross_earned: gross_earned,
+      esi = Calculators::Esi.call(monthly_gross: esi_reference_gross, gross_earned: esi_gross,
                                   applicable: @structure.esi_applicable, rates: @rates[:esi])
       if esi.applicable?
         deductions << { code: "esi_employee", label: "ESI", amount: esi.employee }
@@ -61,9 +70,13 @@ module HrLite
                                              period_month: @run.period_month, rates: @rates[:pt])
       deductions << { code: "pt", label: "Professional tax", amount: pt } if pt.positive?
 
+      deductions.concat(extra_deductions)
+      loan = loan_instalment
+      deductions << loan if loan
+
       fy = SalarySlip.fy_to_date(@user, @run.period_month)
       tds = Calculators::Tds.call(
-        regime: @profile.tax_regime,
+        regime: tax_regime,
         structure_monthly_gross: @structure.monthly_gross,
         gross_earned_this_month: gross_earned,
         # Plus anything paid this FY that this install never ran — a previous
@@ -73,7 +86,7 @@ module HrLite
         fy_gross_paid: fy[:gross] + Money.d(@profile.fy_opening_gross),
         fy_tds_paid: fy[:tds] + Money.d(@profile.fy_opening_tds),
         months_remaining: months_remaining_in_fy,
-        declared_annual_deductions: @profile.declared_annual_deductions,
+        declared_annual_deductions: annual_deductions,
         rates: @rates[:income_tax],
         override: @tds_override
       )
@@ -107,6 +120,66 @@ module HrLite
 
     private
 
+    # The declaration if the employee filed one, else the single figure an
+    # admin typed on the profile. Old-regime deductions came from that one
+    # opaque number, with nothing to show what it was made of and nowhere to
+    # keep the proof; a filed declaration supersedes it, and once HR has
+    # verified the proof only what the proof supported counts.
+    # A declaration names the regime the employee chose for that year, which
+    # is a per-YEAR decision; the profile column is only the fallback for
+    # somebody who never filed one.
+    def tax_regime
+      TaxDeclaration.for(@user, @run.period_month)&.regime || @profile.tax_regime
+    end
+
+    def annual_deductions
+      declaration = TaxDeclaration.for(@user, @run.period_month)
+      return @profile.declared_annual_deductions if declaration.nil?
+      return @profile.declared_annual_deductions if declaration.draft?
+
+      declaration.allowable_total
+    end
+
+    # Splits this month's one-off lines into earnings and deductions, in the
+    # component order an install configured. Returns [earnings, deductions].
+    def one_off_lines(payable, days_in_month)
+      rows = PayrollLineItem.for_slip(@user, @run.period_month)
+                            .sort_by { |item| [ item.component.position, item.component.label ] }
+      earnings = []
+      deductions = []
+
+      rows.each do |item|
+        component = item.component
+        amount = if component.prorated
+          Money.round2(item.amount * (Money.d(payable) / Money.d(days_in_month)))
+        else
+          item.amount
+        end
+        next unless amount.positive?
+
+        row = { code: component.code, label: component.label, amount: amount }
+        if component.earning?
+          earnings << row.merge(excluded_from_esi: !component.counts_for_esi)
+        else
+          deductions << row
+        end
+      end
+
+      [ earnings, deductions ]
+    end
+
+    # The month's loan instalment, as one deduction line. Computed here and
+    # BOOKED only when the run is finalized — a draft is recomputed freely,
+    # and booking at compute would take a repayment on every pass.
+    def loan_instalment
+      total = Loan.active.where(user_id: @user.id).sum(BigDecimal(0)) do |loan|
+        loan.instalment_for(@run.period_month)
+      end
+      return nil unless total.positive?
+
+      { code: "loan_repayment", label: "Loan repayment", amount: total }
+    end
+
     # Months left in the Indian FY (Apr–Mar) including the run month itself:
     # April = 12, December = 4, January = 3, March = 1. Capped at the exit
     # month for a leaver, so a final settlement is not spread over months

data/db/migrate/20260818002627_create_hr_lite_payroll_components_and_loans.rb

@@ -0,0 +1,72 @@
+class CreateHrLitePayrollComponentsAndLoans < ActiveRecord::Migration[8.1]
+  # Payroll knew exactly four earning heads — basic, HRA, special allowance,
+  # "other" — because they were columns on the salary structure. A bonus, an
+  # incentive, an LTA or a reimbursement had nowhere to go but "other", which
+  # is one number on a payslip that should have said what it was for.
+  #
+  # Heads are DATA now. Amounts stay encrypted for the same reason every
+  # amount in this engine is: a payslip line is somebody's pay.
+  def change
+    create_table :hr_lite_salary_components do |t|
+      t.string :code, null: false
+      t.string :label, null: false
+      # earning | deduction
+      t.string :kind, null: false, default: "earning"
+      # Prorated by attendance like basic, or paid whole (a bonus is not
+      # halved because somebody joined mid-month).
+      t.boolean :prorated, null: false, default: true
+      t.boolean :taxable, null: false, default: true
+      # Counts toward the gross ESI is assessed on.
+      t.boolean :counts_for_esi, null: false, default: true
+      t.integer :position, null: false, default: 0
+      t.boolean :active, null: false, default: true
+      t.timestamps
+    end
+    add_index :hr_lite_salary_components, :code, unique: true
+    add_check_constraint :hr_lite_salary_components, "kind IN ('earning', 'deduction')",
+                         name: "hr_lite_salary_components_kind_check"
+
+    # A one-off on a single month's payslip: a bonus, an incentive, an
+    # arrears line after a backdated revision, a reimbursement. Dated to the
+    # month rather than to the run, so it survives a run being deleted and
+    # recomputed.
+    create_table :hr_lite_payroll_line_items do |t|
+      t.bigint :user_id, null: false
+      t.date :period_month, null: false
+      t.references :component, null: false, index: true,
+                   foreign_key: { to_table: :hr_lite_salary_components }
+      t.text :amount, null: false # encrypted BigDecimal
+      t.string :note
+      t.bigint :created_by_id
+      t.timestamps
+    end
+    add_index :hr_lite_payroll_line_items, %i[user_id period_month]
+
+    create_table :hr_lite_loans do |t|
+      t.bigint :user_id, null: false
+      t.text :principal, null: false      # encrypted
+      t.text :monthly_instalment, null: false # encrypted
+      t.date :starts_on, null: false
+      t.string :reason
+      # active | closed | cancelled
+      t.string :status, null: false, default: "active"
+      t.bigint :approved_by_id
+      t.timestamps
+    end
+    add_index :hr_lite_loans, %i[user_id status]
+    add_check_constraint :hr_lite_loans, "status IN ('active', 'closed', 'cancelled')",
+                         name: "hr_lite_loans_status_check"
+
+    # One row per month actually deducted. The outstanding balance is derived
+    # from these rather than stored, so a recompute cannot double-count and a
+    # deleted run cannot leave the balance wrong.
+    create_table :hr_lite_loan_repayments do |t|
+      t.references :loan, null: false, index: true,
+                   foreign_key: { to_table: :hr_lite_loans, on_delete: :cascade }
+      t.date :period_month, null: false
+      t.text :amount, null: false # encrypted
+      t.timestamps
+    end
+    add_index :hr_lite_loan_repayments, %i[loan_id period_month], unique: true
+  end
+end

data/db/migrate/20260818003616_create_hr_lite_documents_and_declarations.rb

@@ -0,0 +1,73 @@
+class CreateHrLiteDocumentsAndDeclarations < ActiveRecord::Migration[8.1]
+  # Two gaps that were table stakes and simply absent: nowhere to keep an
+  # employee's documents, and a tax declaration that was ONE opaque number.
+  #
+  # `declared_annual_deductions` on the profile is a single figure an admin
+  # types in. Nobody can see what it is made of, the employee cannot submit
+  # their own, and there is nowhere to put the proof. That is the number the
+  # whole year's TDS is projected from.
+  def change
+    create_table :hr_lite_documents do |t|
+      t.bigint :user_id, null: false
+      # aadhaar | pan | passport | bank | offer_letter | ... — data, so an
+      # install can add its own without a release.
+      t.string :category, null: false
+      t.string :title, null: false
+      t.string :reference_number
+      t.date :issued_on
+      t.date :expires_on
+      # self | hr | money — who may open the file. A payslip and a passport
+      # are not the same kind of secret.
+      #
+      # No column default on purpose: the model derives one from the category
+      # when none was chosen, and a column default would make "unset" and
+      # "deliberately hr" indistinguishable.
+      t.string :visibility, null: false
+      # pending | verified | rejected
+      t.string :verification, null: false, default: "pending"
+      t.bigint :verified_by_id
+      t.datetime :verified_at
+      t.string :verification_note
+      t.bigint :uploaded_by_id
+      t.timestamps
+    end
+    add_index :hr_lite_documents, %i[user_id category]
+    add_index :hr_lite_documents, :expires_on
+    add_check_constraint :hr_lite_documents, "visibility IN ('self', 'hr', 'money')",
+                         name: "hr_lite_documents_visibility_check"
+    add_check_constraint :hr_lite_documents,
+                         "verification IN ('pending', 'verified', 'rejected')",
+                         name: "hr_lite_documents_verification_check"
+
+    create_table :hr_lite_tax_declarations do |t|
+      t.bigint :user_id, null: false
+      # 1 April of the financial year it covers.
+      t.date :financial_year, null: false
+      t.string :regime, null: false, default: "new"
+      # draft | submitted | verified | rejected
+      t.string :status, null: false, default: "draft"
+      t.datetime :submitted_at
+      t.bigint :verified_by_id
+      t.datetime :verified_at
+      t.string :note
+      t.timestamps
+    end
+    add_index :hr_lite_tax_declarations, %i[user_id financial_year], unique: true
+    add_check_constraint :hr_lite_tax_declarations,
+                         "status IN ('draft', 'submitted', 'verified', 'rejected')",
+                         name: "hr_lite_tax_declarations_status_check"
+
+    create_table :hr_lite_tax_declaration_items do |t|
+      t.references :declaration, null: false, index: true,
+                   foreign_key: { to_table: :hr_lite_tax_declarations, on_delete: :cascade }
+      # 80c | 80d | hra | 80ccd_1b | 24b | other
+      t.string :section, null: false
+      t.string :label
+      t.text :declared_amount, null: false # encrypted
+      # What proof actually supported, once HR has looked. Null until then.
+      t.text :verified_amount
+      t.timestamps
+    end
+    add_index :hr_lite_tax_declaration_items, %i[declaration_id section]
+  end
+end