@kernhq/module-hr 0.15.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernhq/module-hr",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Kern HR module: people, offices, org chart, calendars",
   "license": "AGPL-3.0-only",
   "type": "module",

package/src/client/messages.ts

@@ -251,6 +251,8 @@ export const en: Record<string, Message> = {
   'hr.approvals_none': 'Nothing waiting on you',
   'hr.approvals_none_desc': 'Requests needing your decision appear here.',
   'hr.approvals_on_behalf': 'On behalf of {name}',
+  'hr.approvals_open': 'Open Approvals',
+  'hr.approvals_open_hint': 'Not one to decide from here — the approvals page shows where it stands.',
   'hr.approvals_request': 'Request',
   'hr.approvals_requested': 'Requested',
   'hr.approvals_requested_by': 'Requested by',
@@ -656,6 +658,7 @@ export const en: Record<string, Message> = {
   'hr.decide_behalf_error':
     'The decision was not recorded. The delegation may have ended — reload and try again.',
   'hr.decide_error': 'The decision could not be recorded',
+  'hr.decide_moved_error': 'This is no longer yours to decide. The list has been updated.',
   'hr.delegate': 'Delegate',
   'hr.delegate_add': 'Add delegation',
   'hr.delegate_all_types': 'All requests',
@@ -1688,6 +1691,8 @@ export const ar: Record<string, Message> = {
   'hr.approvals_none': 'لا شيء بانتظارك',
   'hr.approvals_none_desc': 'تظهر هنا الطلبات التي تنتظر قرارك.',
   'hr.approvals_on_behalf': 'نيابةً عن {name}',
+  'hr.approvals_open': 'فتح الموافقات',
+  'hr.approvals_open_hint': 'ليس مما يُبَتّ فيه من هنا — صفحة الموافقات تُظهر أين وصل هذا الطلب.',
   'hr.approvals_request': 'الطلب',
   'hr.approvals_requested': 'تاريخ الطلب',
   'hr.approvals_requested_by': 'مقدّم الطلب',
@@ -2115,6 +2120,7 @@ export const ar: Record<string, Message> = {
   'hr.days': { zero: 'يوم', one: 'يوم', two: 'يومان', few: 'أيام', many: 'يومًا', other: 'يوم' },
   'hr.decide_behalf_error': 'لم يُسجَّل القرار. ربما انتهى التفويض — أعد تحميل الصفحة وحاول مرة أخرى.',
   'hr.decide_error': 'تعذّر تسجيل القرار',
+  'hr.decide_moved_error': 'لم يعد القرار في هذا الطلب لك. وقد حُدِّثت القائمة.',
   'hr.delegate': 'تفويض',
   'hr.delegate_add': 'إضافة تفويض',
   'hr.delegate_all_types': 'كل الطلبات',
@@ -3172,6 +3178,9 @@ export const de: Record<string, Message> = {
   'hr.approvals_none': 'Keine offenen Freigaben',
   'hr.approvals_none_desc': 'Anträge, die auf Ihre Entscheidung warten, erscheinen hier.',
   'hr.approvals_on_behalf': 'Im Namen von {name}',
+  'hr.approvals_open': 'Freigaben öffnen',
+  'hr.approvals_open_hint':
+    'Von hier aus nicht zu entscheiden — die Freigabenseite zeigt, wo der Antrag steht.',
   'hr.approvals_request': 'Antrag',
   'hr.approvals_requested': 'Eingereicht',
   'hr.approvals_requested_by': 'Beantragt von',
@@ -3595,6 +3604,7 @@ export const de: Record<string, Message> = {
   'hr.decide_behalf_error':
     'Die Entscheidung wurde nicht erfasst. Die Vertretung ist möglicherweise abgelaufen — neu laden und erneut versuchen.',
   'hr.decide_error': 'Die Entscheidung konnte nicht gespeichert werden',
+  'hr.decide_moved_error': 'Diese Entscheidung liegt nicht mehr bei Ihnen. Die Liste wurde aktualisiert.',
   'hr.delegate': 'Vertretung',
   'hr.delegate_add': 'Vertretung hinzufügen',
   'hr.delegate_all_types': 'Alle Anträge',
@@ -4586,6 +4596,9 @@ export const fa: Record<string, Message> = {
   'hr.approvals_none': 'چیزی منتظر تصمیم شما نیست',
   'hr.approvals_none_desc': 'درخواست‌هایی که باید تصمیم بگیرید اینجا می‌آیند.',
   'hr.approvals_on_behalf': 'به نمایندگی از {name}',
+  'hr.approvals_open': 'رفتن به تأییدها',
+  'hr.approvals_open_hint':
+    'از اینجا نمی‌شود دربارهٔ آن تصمیم گرفت — صفحهٔ تأییدها نشان می‌دهد در چه مرحله‌ای است.',
   'hr.approvals_request': 'درخواست',
   'hr.approvals_requested': 'زمان درخواست',
   'hr.approvals_requested_by': 'درخواست‌دهنده',
@@ -4989,6 +5002,7 @@ export const fa: Record<string, Message> = {
   'hr.decide_behalf_error':
     'تصمیم ثبت نشد. شاید واگذاری به پایان رسیده باشد — صفحه را دوباره بارگذاری کنید و دوباره تلاش کنید.',
   'hr.decide_error': 'تصمیم ثبت نشد',
+  'hr.decide_moved_error': 'تصمیم دربارهٔ این درخواست دیگر با شما نیست. فهرست به‌روز شد.',
   'hr.delegate': 'واگذاری',
   'hr.delegate_add': 'افزودن واگذاری',
   'hr.delegate_all_types': 'همهٔ درخواست‌ها',
@@ -5956,6 +5970,8 @@ export const tr: Record<string, Message> = {
   'hr.approvals_none': 'Sizi bekleyen bir şey yok',
   'hr.approvals_none_desc': 'Kararınızı bekleyen talepler burada görünür.',
   'hr.approvals_on_behalf': '{name} adına',
+  'hr.approvals_open': 'Onayları aç',
+  'hr.approvals_open_hint': 'Buradan karara bağlanmaz — talebin nerede olduğunu Onaylar sayfası gösterir.',
   'hr.approvals_request': 'Talep',
   'hr.approvals_requested': 'Talep edildi',
   'hr.approvals_requested_by': 'Talep eden',
@@ -6357,6 +6373,7 @@ export const tr: Record<string, Message> = {
   'hr.decide_behalf_error':
     'Karar kaydedilmedi. Yetki devri sona ermiş olabilir — sayfayı yenileyip yeniden deneyin.',
   'hr.decide_error': 'Karar kaydedilemedi',
+  'hr.decide_moved_error': 'Bu talebin kararı artık sizde değil. Liste güncellendi.',
   'hr.delegate': 'Devret',
   'hr.delegate_add': 'Devir ekle',
   'hr.delegate_all_types': 'Tüm talepler',

package/src/client/widgets/ApprovalsWidget.svelte

@@ -14,8 +14,16 @@ import { summarise } from '../summary.js'
  * Acting on a row rather than linking away from it: the whole value of this card is approving three
  * leave requests without leaving the dashboard, and a card that only counts them is a link with
  * extra steps.
+ *
+ * **A button here only where the decision is certainly the reader's own.** `approvals.inbox` also
+ * returns rows the reader may decide *as somebody's delegate*, and rows resting on a step further
+ * down a chain they are named on. `approvals.decide` refuses both when the decision is filed as the
+ * reader — which is what every approve button on this card did to them — so neither gets one. Which
+ * of the two a row is, and whose name the decision would carry, is what the approvals page has the
+ * queries and the room to say; this card sends the reader there rather than guessing. See
+ * `actionFor`.
  */
-const { workspaceId, editing }: WidgetProps = $props()
+const { workspaceId, workspaceSlug, editing }: WidgetProps = $props()
 const api = getHrApi()
 const queryClient = useQueryClient()
 
@@ -26,6 +34,62 @@ const inboxQuery = createQuery(() => ({
 }))
 const items = $derived(inboxQuery.data?.items ?? [])
 
+/**
+ * Which employee the reader is — the one fact that separates a row this card may decide from one it
+ * may only point at.
+ *
+ * No permission: `people.me` is the caller's own record, and somebody with none gets an empty inbox
+ * from the server anyway. The same key the approvals page fills, so opening one warms the other.
+ */
+const meQuery = createQuery(() => ({
+  queryKey: hrKeys.me(workspaceId),
+  enabled: Boolean(workspaceId),
+  queryFn: () => api.people.me({ workspaceId }),
+}))
+const myPersonId = $derived(meQuery.data?.id ?? null)
+
+/** What this card may offer on a row. */
+type RowAction =
+  /** The reader's own decision, on the step the request has reached. */
+  | 'decide'
+  /** Theirs, and already made — a step still collecting its other approvers. */
+  | 'decided'
+  /** Not the reader's own: whose it is, and whether it can be filed at all, belongs to the page. */
+  | 'elsewhere'
+
+/**
+ * Whether this card may file the decision on a row, and never as whom.
+ *
+ * A reduced form of `describe()` in `pages/ApprovalsPage.svelte`, which stays the authority: that
+ * one derives every identity the reader may file as — themselves, and each colleague who delegated
+ * to them — out of `people.me`, the live delegations and the step's `approverIds`, and hands them to
+ * `DecisionDialog` to be stated or chosen. This asks only the half a dashboard card can answer
+ * honestly on one line: **is this decision the reader's own?**
+ *
+ * The other half is deliberately not asked here. Naming a delegator needs the delegations list —
+ * behind the `approvals` capability *and* `hr.approval.delegate`, so a reader holding a delegation
+ * but not that key would learn nothing and be offered a decision as themselves, which is the refusal
+ * this file exists to stop — plus a directory read for the name, and then a second line to print it
+ * on, in a card whose smallest size is one 43px row. A decision filed under a person the reader was
+ * never shown is the worst thing this module can do, so a row this card cannot name is a link.
+ *
+ * The fallback is the page's, for the same reason: with no `myPersonId` yet, or against a server
+ * whose steps carry no `approverIds`, nothing is claimed and the card offers exactly what it offered
+ * before — the reader's own decision, with the server as the authority.
+ */
+function actionFor(request: ApprovalRequest): RowAction {
+  const step = request.steps.find((s) => s.stepIndex === request.currentStep) ?? null
+  const approvers = step?.approverIds ?? []
+  if (!myPersonId || approvers.length === 0) return 'decide'
+  if (!approvers.includes(myPersonId)) return 'elsewhere'
+  // The unique index on `(step_id, approver_id)` refuses a second decision from the same person, so
+  // an approve button on a step this reader has already settled is one that can only fail. It is a
+  // real row: an `all` step stays pending until everybody named on it has answered.
+  return (step?.decisions ?? []).some((d) => d.approverId === myPersonId) ? 'decided' : 'decide'
+}
+
+const rows = $derived(items.map((item) => ({ item, action: actionFor(item) })))
+
 let asked = $state<{ request: ApprovalRequest; decision: 'approve' | 'reject' } | null>(null)
 let decideError = $state<string | null>(null)
 
@@ -43,6 +107,10 @@ const decide = createMutation(() => ({
       requestId: vars.requestId,
       decision: vars.decision,
       comment: vars.comment.trim() || null,
+      // Stated rather than left out. The field is nullish, so both reach the server the same way —
+      // but this card offers no other identity, and `null` is that promise written where the call
+      // is made rather than inferred from the absence of a line.
+      onBehalfOfId: null,
     }),
   onSuccess: () => {
     asked = null
@@ -79,9 +147,17 @@ const decideRefusalMessages: Record<string, string> = {}
  * those happened, so it is repeated verbatim. Everything else that can fail carries machine text in
  * English, so it falls back to this module's own string. The test is the transport's `code`, never
  * the sentence.
+ *
+ * FORBIDDEN has its own, because this card no longer offers a decision that earns one by design:
+ * `actionFor` keeps the buttons on the steps the reader is named on, so a refusal means the step
+ * moved between the card being drawn and the click. The router's words for it — "You are not an
+ * approver on this step" — are machine text in English, and the only other FORBIDDEN `decide` can
+ * raise is for a caller with no employee record, whose inbox is empty and who therefore has nothing
+ * on this card to click.
  */
 function decideFailure(error: unknown): string {
   const failure = error as { code?: unknown; message?: string; data?: { reason?: unknown } }
+  if (failure.code === 'FORBIDDEN') return t('decide_moved_error')
   if (failure.code !== 'CONFLICT') return t('decide_error')
   const reason = typeof failure.data?.reason === 'string' ? failure.data.reason : null
   const key = reason ? decideRefusalMessages[reason] : undefined
@@ -107,25 +183,49 @@ const confirmDecision = (comment: string) => {
   while `data` is still the last good inbox — an error branch above this one would blank a working
   card, and take its approve buttons with it, on a transient failure. The error is only the whole
   card when there is nothing else to draw.
+
+  `people.me` is waited for alongside the inbox, though. It decides which rows get buttons, and
+  drawing an approve button on a colleague's row for one frame and then taking it away is worse than
+  a skeleton that lasts as long — the two queries go out together, so it costs nothing. A `me` that
+  *fails* leaves `myPersonId` null, which is the fallback `actionFor` documents rather than a card
+  stuck loading.
 -->
-{#if inboxQuery.isLoading}
+{#if inboxQuery.isLoading || meQuery.isLoading}
   <Skeleton height="96px" />
-{:else if items.length > 0}
+{:else if rows.length > 0}
   <ul>
-    {#each items as item (item.id)}
+    {#each rows as row (row.item.id)}
       <li>
-        <span class="summary">{summarise(item)}</span>
+        <span class="summary">{summarise(row.item)}</span>
         <!-- Row actions go while the grid is being rearranged: the data stays, the buttons do not. -->
         {#if editing}
           <Badge tone="upcoming">{t('leave_pending')}</Badge>
-        {:else}
+        {:else if row.action === 'decide'}
           <!--
             Never straight to `decide.mutate`: rejecting somebody's leave is irreversible from the
             interface and notifies them, and a dashboard card is the easiest place in the product to
             hit the wrong button. The dialog says what the decision does and to whom.
           -->
-          <Button size="sm" variant="ghost" onclick={() => ask(item, 'reject')}>{t('reject')}</Button>
-          <Button size="sm" onclick={() => ask(item, 'approve')}>{t('approve')}</Button>
+          <Button size="sm" variant="ghost" onclick={() => ask(row.item, 'reject')}>{t('reject')}</Button>
+          <Button size="sm" onclick={() => ask(row.item, 'approve')}>{t('approve')}</Button>
+        {:else if row.action === 'decided'}
+          <span class="note">{t('approvals_you_decided')}</span>
+        {:else}
+          <!--
+            A link, not a button. This row is either a colleague's decision the reader holds by
+            delegation or a step the request has not reached them on, and the card cannot tell which
+            without the queries the approvals page makes — so it offers the one thing that is true
+            either way. The label carries it: an icon-only arrow here would be a control a screen
+            reader announces as "link" and nothing more.
+          -->
+          <Button
+            size="sm"
+            variant="ghost"
+            href={`/${workspaceSlug}/hr/approvals`}
+            title={t('approvals_open_hint')}
+          >
+            {t('approvals_open')}
+          </Button>
         {/if}
       </li>
     {/each}
@@ -182,6 +282,17 @@ li {
   white-space: nowrap;
   font-size: 12px;
 }
+/*
+  Where a row's buttons would have been. `--kern-ink-600` rather than the `--kern-ink-500` the
+  approvals page mutes with: this sits on the card surface, which is the pair already measured for
+  `.msg` below — 9.86:1 in light, 8.96:1 in dark. Nowrap because the row is one line at every size
+  the card declares, and a wrapped word here is what pushes an `s` card past its 43px body.
+*/
+.note {
+  font-size: 12px;
+  white-space: nowrap;
+  color: var(--kern-ink-600);
+}
 .failed {
   display: flex;
   align-items: center;