@kernhq/module-hr 0.3.0 → 0.5.0

package/dist/server/services/attendance.js

@@ -0,0 +1,239 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, asc, eq, gte, inArray, isNull, lte, sql } from 'drizzle-orm';
+import { weekdayOf } from '../../policy/calendar.js';
+import { businessDateFor, computeDay, } from '../../policy/working-time.js';
+import { attendanceDays, leaveRequestDays, punches, scheduleAssignments, schedules } from '../schema.js';
+import { inForceOn } from './db.js';
+/** A schedule with no shifts: somebody with no assignment still clocks in, they just owe no hours. */
+export const NO_SCHEDULE = {
+    shiftFor: () => null,
+    rounding: { stepMinutes: 0, direction: 'nearest' },
+    autoClockOutAfterMinutes: null,
+    scheduleId: null,
+};
+export class AttendanceService {
+    /** The schedule in force for a person on a date, as something the pure layer can use. */
+    async scheduleFor(tx, workspaceId, personId, on) {
+        const [assignment] = await tx
+            .select()
+            .from(scheduleAssignments)
+            .where(and(eq(scheduleAssignments.workspaceId, workspaceId), eq(scheduleAssignments.personId, personId), inForceOn(scheduleAssignments.effectiveFrom, scheduleAssignments.effectiveTo, on)))
+            .limit(1);
+        if (!assignment)
+            return NO_SCHEDULE;
+        const [schedule] = await tx
+            .select()
+            .from(schedules)
+            .where(and(eq(schedules.workspaceId, workspaceId), eq(schedules.id, assignment.scheduleId)))
+            .limit(1);
+        if (!schedule)
+            return NO_SCHEDULE;
+        const week = (schedule.week ?? {});
+        return {
+            scheduleId: schedule.id,
+            shiftFor: (date) => {
+                const day = week[weekdayOf(date)];
+                if (!day)
+                    return null;
+                return {
+                    start: day.start,
+                    end: day.end,
+                    breakMinutes: day.breakMinutes ?? 0,
+                    graceInMinutes: schedule.graceInMinutes,
+                    graceOutMinutes: schedule.graceOutMinutes,
+                };
+            },
+            rounding: {
+                stepMinutes: schedule.roundingStepMinutes,
+                direction: schedule.roundingDirection,
+            },
+            autoClockOutAfterMinutes: schedule.autoClockOutAfterMinutes,
+        };
+    }
+    /**
+     * Record a punch.
+     *
+     * `at` is the server's clock, always. `clientReportedAt` is kept beside it with the measured skew
+     * so an offline sync can be told from a device whose clock is wrong — and a claim beyond the
+     * threshold is marked `disputed` rather than silently accepted or silently dropped.
+     */
+    async record(tx, workspaceId, input, schedule) {
+        const serverNow = new Date();
+        const at = input.claimedAt ?? serverNow;
+        const clientAt = input.clientReportedAt ? new Date(input.clientReportedAt) : null;
+        const skewMs = clientAt ? clientAt.getTime() - serverNow.getTime() : null;
+        // A claim more than an hour out is not a slow network; it is a clock somebody should look at.
+        const trust = input.claimedAt ? (Math.abs(skewMs ?? 0) > 3600_000 ? 'disputed' : 'claimed') : 'trusted';
+        const businessDate = businessDateFor(at.getTime(), input.timezone, schedule.shiftFor(new Date(at.getTime()).toISOString().slice(0, 10)));
+        const [row] = await tx
+            .insert(punches)
+            .values({
+            id: uuidv7(),
+            workspaceId,
+            personId: input.personId,
+            direction: input.direction,
+            at,
+            clientReportedAt: clientAt,
+            skewMs,
+            businessDate,
+            timezone: input.timezone,
+            method: input.method,
+            officeId: input.officeId ?? null,
+            geo: input.geo ?? null,
+            trust,
+            idempotencyKey: input.idempotencyKey ?? null,
+            note: input.note ?? null,
+        })
+            .returning();
+        return row;
+    }
+    /** Live punches for a person on a business date, oldest first. Voided rows are excluded. */
+    async punchesOn(tx, workspaceId, personId, businessDate) {
+        return tx
+            .select()
+            .from(punches)
+            .where(and(eq(punches.workspaceId, workspaceId), eq(punches.personId, personId), eq(punches.businessDate, businessDate), isNull(punches.voidedByPunchId)))
+            .orderBy(asc(punches.at));
+    }
+    /**
+     * Rebuild one day from its punches.
+     *
+     * Idempotent by construction, which is what makes it safe to call on every punch, from a nightly
+     * sweep, and from a support request without thinking about it. A locked day is left alone and
+     * reported, never silently skipped — a recomputation that quietly declines to touch a closed
+     * month looks identical to one that had nothing to do.
+     */
+    async recomputeDay(tx, workspaceId, personId, businessDate, timezone, schedule) {
+        const [existing] = await tx
+            .select({ locked: attendanceDays.locked })
+            .from(attendanceDays)
+            .where(and(eq(attendanceDays.workspaceId, workspaceId), eq(attendanceDays.personId, personId), eq(attendanceDays.businessDate, businessDate)))
+            .limit(1);
+        if (existing?.locked)
+            return { locked: true };
+        const rows = await this.punchesOn(tx, workspaceId, personId, businessDate);
+        const punchInputs = rows.map((r) => ({
+            at: r.at.getTime(),
+            direction: r.direction,
+        }));
+        // Approved leave excuses the day: somebody on holiday is not absent, and a sheet that says
+        // otherwise generates a disciplinary conversation about a day HR themselves approved.
+        const [onLeave] = await tx
+            .select({ requestId: leaveRequestDays.requestId })
+            .from(leaveRequestDays)
+            .where(and(eq(leaveRequestDays.workspaceId, workspaceId), eq(leaveRequestDays.personId, personId), eq(leaveRequestDays.date, businessDate), eq(leaveRequestDays.counted, true), eq(leaveRequestDays.status, 'approved')))
+            .limit(1);
+        const computed = computeDay({
+            businessDate,
+            timeZone: timezone,
+            shift: schedule.shiftFor(businessDate),
+            punches: punchInputs,
+            rounding: schedule.rounding,
+            excused: !!onLeave,
+        });
+        const status = onLeave && computed.workedMinutes === 0 ? 'leave' : computed.status;
+        await tx
+            .insert(attendanceDays)
+            .values({
+            id: uuidv7(),
+            workspaceId,
+            personId,
+            businessDate,
+            scheduledMinutes: computed.scheduledMinutes,
+            workedMinutes: computed.workedMinutes,
+            breakMinutes: computed.breakMinutes,
+            overtimeMinutes: computed.overtimeMinutes,
+            lateMinutes: computed.lateMinutes,
+            earlyLeaveMinutes: computed.earlyLeaveMinutes,
+            status,
+            leaveRequestId: onLeave?.requestId ?? null,
+            anomalies: computed.anomalies,
+            firstIn: computed.firstIn ? new Date(computed.firstIn) : null,
+            lastOut: computed.lastOut ? new Date(computed.lastOut) : null,
+            policyHash: hashSchedule(schedule),
+            computedAt: new Date(),
+        })
+            .onConflictDoUpdate({
+            target: [attendanceDays.workspaceId, attendanceDays.personId, attendanceDays.businessDate],
+            set: {
+                scheduledMinutes: computed.scheduledMinutes,
+                workedMinutes: computed.workedMinutes,
+                breakMinutes: computed.breakMinutes,
+                overtimeMinutes: computed.overtimeMinutes,
+                lateMinutes: computed.lateMinutes,
+                earlyLeaveMinutes: computed.earlyLeaveMinutes,
+                status,
+                leaveRequestId: onLeave?.requestId ?? null,
+                anomalies: computed.anomalies,
+                firstIn: computed.firstIn ? new Date(computed.firstIn) : null,
+                lastOut: computed.lastOut ? new Date(computed.lastOut) : null,
+                policyHash: hashSchedule(schedule),
+                computedAt: new Date(),
+            },
+        });
+        return { locked: false };
+    }
+    /** Which business dates a person has punches on, in a range. Drives a bulk recompute. */
+    async datesWithPunches(tx, workspaceId, personId, from, to) {
+        const rows = await tx
+            .selectDistinct({ businessDate: punches.businessDate })
+            .from(punches)
+            .where(and(eq(punches.workspaceId, workspaceId), eq(punches.personId, personId), gte(punches.businessDate, from), lte(punches.businessDate, to)));
+        return rows.map((r) => r.businessDate).sort();
+    }
+    /**
+     * Void a punch by writing a correcting row that points at it.
+     *
+     * The original stays exactly as it was. Two rows is the point: "this was recorded and then
+     * corrected" and "this was never recorded" are different facts, and only one of them is true.
+     */
+    async voidPunch(tx, workspaceId, punchId, reason, actorPersonId) {
+        const [original] = await tx
+            .select()
+            .from(punches)
+            .where(and(eq(punches.workspaceId, workspaceId), eq(punches.id, punchId)))
+            .limit(1);
+        if (!original)
+            throw KernError.notFound('Punch');
+        if (original.voidedByPunchId)
+            throw KernError.conflict('That punch is already voided');
+        const [correction] = await tx
+            .insert(punches)
+            .values({
+            id: uuidv7(),
+            workspaceId,
+            personId: original.personId,
+            direction: original.direction,
+            at: original.at,
+            businessDate: original.businessDate,
+            timezone: original.timezone,
+            method: 'manual',
+            trust: 'trusted',
+            note: `Voids ${punchId}: ${reason}`,
+        })
+            .returning();
+        await tx
+            .update(punches)
+            .set({ voidedByPunchId: correction.id })
+            .where(and(eq(punches.id, punchId), eq(punches.businessDate, original.businessDate)));
+        // The correcting row is itself voided: it exists to carry the reason and to point at what it
+        // replaced, not to be counted as a punch.
+        await tx
+            .update(punches)
+            .set({ voidedByPunchId: correction.id })
+            .where(and(eq(punches.id, correction.id), eq(punches.businessDate, original.businessDate)));
+        void actorPersonId;
+        return { original, correction: correction };
+    }
+}
+/**
+ * A short stamp of what produced a derived row.
+ *
+ * Not cryptographic — it only has to change when the schedule does, so a recomputation can tell a
+ * stale row from a current one without re-deriving it.
+ */
+function hashSchedule(schedule) {
+    return `${schedule.scheduleId ?? 'none'}:${schedule.rounding.stepMinutes}:${schedule.rounding.direction}`;
+}
+export { inArray, sql };
+//# sourceMappingURL=attendance.js.map

package/dist/server/services/attendance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attendance.js","sourceRoot":"","sources":["../../../src/server/services/attendance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACpD,OAAO,EACL,eAAe,EACf,UAAU,GAIX,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxG,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAsBnC,sGAAsG;AACtG,MAAM,CAAC,MAAM,WAAW,GAAqB;IAC3C,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;IACpB,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;IAClD,wBAAwB,EAAE,IAAI;IAC9B,UAAU,EAAE,IAAI;CACjB,CAAA;AAED,MAAM,OAAO,iBAAiB;IAC5B,yFAAyF;IACzF,KAAK,CAAC,WAAW,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB,EAAE,EAAU;QACzE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,WAAW,CAAC,EAChD,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC1C,SAAS,CAAC,mBAAmB,CAAC,aAAa,EAAE,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC,CAClF,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,UAAU;YAAE,OAAO,WAAW,CAAA;QAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;aAC3F,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAA;QAEjC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAiB,CAAA;QAClD,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;gBACjC,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAA;gBACrB,OAAO;oBACL,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;oBACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;oBACvC,eAAe,EAAE,QAAQ,CAAC,eAAe;iBAC1C,CAAA;YACH,CAAC;YACD,QAAQ,EAAE;gBACR,WAAW,EAAE,QAAQ,CAAC,mBAAmB;gBACzC,SAAS,EAAE,QAAQ,CAAC,iBAAgD;aACrE;YACD,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;SAC5D,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,KAYC,EACD,QAA0B;QAE1B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAA;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAEzE,8FAA8F;QAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEvG,MAAM,YAAY,GAAG,eAAe,CAClC,EAAE,CAAC,OAAO,EAAE,EACZ,KAAK,CAAC,QAAQ,EACd,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CACrE,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,EAAE;YACF,gBAAgB,EAAE,QAAQ;YAC1B,MAAM;YACN,YAAY;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;YACtB,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;SACzB,CAAC;aACD,SAAS,EAAE,CAAA;QACd,OAAO,GAAI,CAAA;IACb,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB,EAAE,YAAoB;QACjF,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EACpC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC9B,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,EACtC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAChC,CACF;aACA,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,YAAoB,EACpB,QAAgB,EAChB,QAA0B;QAE1B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;aACzC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACrC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAC9C,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,QAAQ,EAAE,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAE7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC1E,MAAM,WAAW,GAAiB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE;YAClB,SAAS,EAAE,CAAC,CAAC,SAAoC;SAClD,CAAC,CAAC,CAAA;QAEH,2FAA2F;QAC3F,sFAAsF;QACtF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC;aACjD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACvC,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,EACvC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,EAClC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CACxC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QAEX,MAAM,QAAQ,GAAG,UAAU,CAAC;YAC1B,YAAY;YACZ,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YACtC,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;QAElF,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ;YACR,YAAY;YACZ,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,MAAM;YACN,cAAc,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;YAC1C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC;YAC1F,GAAG,EAAE;gBACH,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gBAC7C,MAAM;gBACN,cAAc,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;gBAC1C,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC7D,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC7D,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC;gBAClC,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB;SACF,CAAC,CAAA;QAEJ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,gBAAgB,CACpB,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,IAAY,EACZ,EAAU;QAEV,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;aACtD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EACpC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC9B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,EAC/B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAC9B,CACF,CAAA;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,EAAM,EACN,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,aAA4B;QAE5B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;aACzE,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,QAAQ;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAChD,IAAI,QAAQ,CAAC,eAAe;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAA;QAEtF,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,SAAS,OAAO,KAAK,MAAM,EAAE;SACpC,CAAC;aACD,SAAS,EAAE,CAAA;QAEd,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,eAAe,EAAE,UAAW,CAAC,EAAE,EAAE,CAAC;aACxC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAEvF,6FAA6F;QAC7F,0CAA0C;QAC1C,MAAM,EAAE;aACL,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,eAAe,EAAE,UAAW,CAAC,EAAE,EAAE,CAAC;aACxC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,UAAW,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAE9F,KAAK,aAAa,CAAA;QAClB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAW,EAAE,CAAA;IAC9C,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,QAA0B;IAC9C,OAAO,GAAG,QAAQ,CAAC,UAAU,IAAI,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAA;AAC3G,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA"}

package/dist/server/services/ledger.d.ts

@@ -79,12 +79,12 @@ export declare class LedgerService {
         reason: string | null;
         kind: string;
         requestId: string | null;
+        policyHash: string | null;
         leaveTypeId: string;
         effectiveOn: string;
         amountMinutes: number;
         periodYear: number;
         reversesEntryId: string | null;
-        policyHash: string | null;
         createdBy: string | null;
     }>;
     /**
@@ -102,12 +102,12 @@ export declare class LedgerService {
         reason: string | null;
         kind: string;
         requestId: string | null;
+        policyHash: string | null;
         leaveTypeId: string;
         effectiveOn: string;
         amountMinutes: number;
         periodYear: number;
         reversesEntryId: string | null;
-        policyHash: string | null;
         createdBy: string | null;
     }>;
     /** Every entry a request produced, for cancelling it. */

package/migrations/0003_attendance.sql

@@ -0,0 +1,206 @@
+CREATE TABLE "mod_hr"."attendance_days" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"business_date" date NOT NULL,
+	"scheduled_minutes" integer DEFAULT 0 NOT NULL,
+	"worked_minutes" integer DEFAULT 0 NOT NULL,
+	"break_minutes" integer DEFAULT 0 NOT NULL,
+	"overtime_minutes" integer DEFAULT 0 NOT NULL,
+	"late_minutes" integer DEFAULT 0 NOT NULL,
+	"early_leave_minutes" integer DEFAULT 0 NOT NULL,
+	"status" text DEFAULT 'absent' NOT NULL,
+	"leave_request_id" uuid,
+	"anomalies" text[] DEFAULT '{}'::text[] NOT NULL,
+	"first_in" timestamp with time zone,
+	"last_out" timestamp with time zone,
+	"policy_hash" text,
+	"locked" boolean DEFAULT false NOT NULL,
+	"computed_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."punches" (
+	"id" uuid DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"direction" text NOT NULL,
+	"at" timestamp with time zone DEFAULT now() NOT NULL,
+	"client_reported_at" timestamp with time zone,
+	"skew_ms" integer,
+	"business_date" date NOT NULL,
+	"timezone" text DEFAULT 'UTC' NOT NULL,
+	"method" text DEFAULT 'web' NOT NULL,
+	"office_id" uuid,
+	"device_id" uuid,
+	"geo" jsonb,
+	"trust" text DEFAULT 'trusted' NOT NULL,
+	"voided_by_punch_id" uuid,
+	"idempotency_key" text,
+	"note" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+) PARTITION BY RANGE ("business_date");
+--> statement-breakpoint
+-- Partitioned, because five hundred people punching four times a day is half a million rows a year
+-- and retrofitting partitioning onto a live table of those is a migration nobody wants. drizzle-kit
+-- cannot express PARTITION BY, so this block is hand-maintained: **after `pnpm db:generate`,
+-- re-add the `PARTITION BY`, the primary key and the partitions below.**
+--
+-- A partitioned table's primary key must contain the partition column, which is why it is
+-- (id, business_date) rather than (id). Same for the idempotency index: without business_date in it
+-- Postgres refuses to create it at all.
+ALTER TABLE "mod_hr"."punches" ADD PRIMARY KEY ("id", "business_date");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_punches_idem_uq"
+  ON "mod_hr"."punches" ("workspace_id", "idempotency_key", "business_date")
+  WHERE "idempotency_key" IS NOT NULL;
+--> statement-breakpoint
+-- A DEFAULT partition catches anything outside the ranges below, so a missing monthly partition
+-- degrades to a slow insert rather than a failed punch. Attendance that refuses to record because
+-- a maintenance job did not run is worse than attendance that records into the wrong file.
+CREATE TABLE IF NOT EXISTS "mod_hr"."punches_default"
+  PARTITION OF "mod_hr"."punches" DEFAULT;
+--> statement-breakpoint
+ALTER TABLE "mod_hr"."punches_default" ENABLE ROW LEVEL SECURITY;
+--> statement-breakpoint
+ALTER TABLE "mod_hr"."punches_default" FORCE ROW LEVEL SECURITY;
+--> statement-breakpoint
+CREATE POLICY "punches_ws_isolation" ON "mod_hr"."punches_default"
+  USING (workspace_id::text = current_setting('app.workspace_id', true))
+  WITH CHECK (workspace_id::text = current_setting('app.workspace_id', true));
+--> statement-breakpoint
+-- Creating a partition is not just `CREATE TABLE ... PARTITION OF`.
+--
+-- A policy on a partitioned parent applies when you query **through the parent**. Query a partition
+-- directly and its own row-level security setting applies — and a fresh partition has none. Any
+-- deployment that runs `GRANT SELECT ON ALL TABLES IN SCHEMA mod_hr` therefore hands out an
+-- unfiltered view of one month's punches, silently, to every role that grant touched.
+--
+-- So partition creation goes through this function, which secures what it creates. The monthly job
+-- calls the same function, which is the only way it cannot forget.
+CREATE OR REPLACE FUNCTION "mod_hr".ensure_punch_partition(month_start date)
+RETURNS text
+LANGUAGE plpgsql
+AS $fn$
+DECLARE
+  part_name text := 'punches_' || to_char(month_start, 'YYYY_MM');
+BEGIN
+  EXECUTE format(
+    'CREATE TABLE IF NOT EXISTS %I.%I PARTITION OF %I.%I FOR VALUES FROM (%L) TO (%L)',
+    'mod_hr', part_name, 'mod_hr', 'punches', month_start, (month_start + interval '1 month')::date
+  );
+  EXECUTE format('ALTER TABLE %I.%I ENABLE ROW LEVEL SECURITY', 'mod_hr', part_name);
+  EXECUTE format('ALTER TABLE %I.%I FORCE ROW LEVEL SECURITY', 'mod_hr', part_name);
+  -- `IF NOT EXISTS` on CREATE POLICY needs Postgres 18; the catalogue check works everywhere and
+  -- keeps this function safe to call repeatedly, which the monthly job relies on.
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'mod_hr' AND tablename = part_name AND policyname = 'punches_ws_isolation'
+  ) THEN
+    EXECUTE format(
+      'CREATE POLICY "punches_ws_isolation" ON %I.%I
+         USING (workspace_id::text = current_setting(''app.workspace_id'', true))
+         WITH CHECK (workspace_id::text = current_setting(''app.workspace_id'', true))',
+      'mod_hr', part_name
+    );
+  END IF;
+  RETURN part_name;
+END
+$fn$;
+--> statement-breakpoint
+-- Seeds a window either side of today so a fresh instance can record punches immediately.
+-- `hr.ensure-partitions` keeps it rolling.
+DO $$
+DECLARE
+  m date := (date_trunc('month', now()) - interval '3 months')::date;
+  stop date := (date_trunc('month', now()) + interval '12 months')::date;
+BEGIN
+  WHILE m < stop LOOP
+    PERFORM "mod_hr".ensure_punch_partition(m);
+    m := (m + interval '1 month')::date;
+  END LOOP;
+END $$;
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."regularizations" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"business_date" date NOT NULL,
+	"punch_id" uuid,
+	"proposed" jsonb NOT NULL,
+	"reason" text NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"approval_request_id" uuid,
+	"applied_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."schedule_assignments" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"schedule_id" uuid NOT NULL,
+	"effective_from" date NOT NULL,
+	"effective_to" date,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."schedules" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"kind" text DEFAULT 'fixed' NOT NULL,
+	"week" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"tz_mode" text DEFAULT 'office' NOT NULL,
+	"tz" text,
+	"grace_in_minutes" integer DEFAULT 0 NOT NULL,
+	"grace_out_minutes" integer DEFAULT 0 NOT NULL,
+	"rounding_step_minutes" integer DEFAULT 0 NOT NULL,
+	"rounding_direction" text DEFAULT 'nearest' NOT NULL,
+	"auto_clock_out_after_minutes" integer,
+	"archived_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_attendance_days_uq" ON "mod_hr"."attendance_days" USING btree ("workspace_id","person_id","business_date");--> statement-breakpoint
+CREATE INDEX "hr_attendance_days_date_idx" ON "mod_hr"."attendance_days" USING btree ("workspace_id","business_date","status");--> statement-breakpoint
+CREATE INDEX "hr_punches_person_idx" ON "mod_hr"."punches" USING btree ("workspace_id","person_id","business_date");--> statement-breakpoint
+CREATE INDEX "hr_regularizations_idx" ON "mod_hr"."regularizations" USING btree ("workspace_id","person_id","business_date");--> statement-breakpoint
+CREATE INDEX "hr_schedule_assign_idx" ON "mod_hr"."schedule_assignments" USING btree ("workspace_id","person_id","effective_from");--> statement-breakpoint
+CREATE INDEX "hr_schedules_ws_idx" ON "mod_hr"."schedules" USING btree ("workspace_id","archived_at");--> statement-breakpoint
+-- ---------------------------------------------------------------------------------------------
+-- Row-level security on the attendance tables.
+--
+-- A policy on a partitioned parent applies to every partition, including ones created later — which
+-- is what makes the rolling partition job safe. The test asserts a freshly created partition
+-- returns nothing without `app.workspace_id`, because "it inherits" is the kind of thing that is
+-- true until a Postgres upgrade says otherwise.
+alter table "mod_hr"."schedules" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."schedules" force row level security;--> statement-breakpoint
+create policy "schedules_ws_isolation" on "mod_hr"."schedules"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."schedule_assignments" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."schedule_assignments" force row level security;--> statement-breakpoint
+create policy "schedule_assignments_ws_isolation" on "mod_hr"."schedule_assignments"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."punches" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."punches" force row level security;--> statement-breakpoint
+create policy "punches_ws_isolation" on "mod_hr"."punches"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."attendance_days" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."attendance_days" force row level security;--> statement-breakpoint
+create policy "attendance_days_ws_isolation" on "mod_hr"."attendance_days"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."regularizations" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."regularizations" force row level security;--> statement-breakpoint
+create policy "regularizations_ws_isolation" on "mod_hr"."regularizations"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));