HMS Mini — Human Resource Management
Status: DONE = implemented and checked without browser automation; IN PROGRESS = active work; TODO = not implemented. Manual browser acceptance is owned by the project owner. Admin features are delivered before employee features.
Shared infrastructure
| Feature | Status | Scope |
|---|---|---|
| PostgreSQL, Redis, separate location database | DONE | Private backend environment mapping; account/session persistence; location database reserved |
| Yup validation | DONE | Matching frontend/API schemas, field errors, strict input types |
| Staging → primary uploads | DONE | Signed upload to hms-mini-staging, completion verification, durable AMQP job, copy to hms-mini, status and private downloads |
| CORS | DONE | Exact portal origins on API and staging bucket |
| DM Sans / mobile-first HR interface | DONE | Phone-first navigation with a full-screen employee mobile menu, responsive forms/tables, aligned 44px filter controls, human-resource terminology |
| Shared appearance and React Icons | DONE | next-themes light/dark/device appearance with direct shared color tokens, explicit dark surfaces including modal headers, themed table-row hover, dividers and scrollbars, hydration-safe controls and native-control support; stable hover colors and semantic icons throughout all pages |
| SMTP and queued email | DONE | Transactional notification outbox, durable RabbitMQ delivery, retry/backoff, admin history and audited retries; no passwords emailed |
| Production hosting configuration | DONE | Private .env.prod files, public templates, explicit production commands, separate HTTPS app/API domains, secure cookies, production Compose configuration and explicit Docker build dependencies under production environment settings |
| Public documentation | DONE | /docs, /docs/features, /docs/changelogs, /docs/readme, /docs/deploy; public Markdown synchronization and placeholder-based self-hosting guide |
| Linked sample organization | DONE | Repeatable seed, demo accounts, organization/attendance/leave/projects/tasks data, help and cancelled email previews; optional real staging-to-primary sample attachments |
Admin roadmap
| Order | Status | Module | Feature | UI and API scope |
|---|---|---|---|---|
| 1 | DONE | Admin Auth & Dashboard | Admin Login & RBAC Session | Login, role/session guards; POST /admin/auth/login, tracked JWT sessions |
| 2 | DONE | Admin Auth & Dashboard | Master Admin Dashboard | Org headcount, daily attendance, pending approvals, projects/issues; GET /admin/dashboard/metrics |
| 3 | DONE | Roles & Permissions | Role Management | Role CRUD, hierarchy, activation; /admin/roles |
| 4 | DONE | Roles & Permissions | Permission Matrix | Module/action checkbox matrix; GET/PUT /admin/roles/:id/permissions |
| 5 | DONE | Roles & Permissions | User Role Assignment | Role selector/access preview; PATCH /admin/users/:id/role, stale-access invalidation |
| 6 | DONE | Departments | Department Management | Searchable CRUD, code/head; prevent deletion with active employees |
| 7 | DONE | Designations | Designation Management | Department-linked titles/grades/hierarchy; /admin/designations |
| 8 | DONE | Org & Employees | Employee Directory & Onboarding | Filtered employee CRUD, account, department/designation/role/manager/shift |
| 9 | DONE | Org & Employees | Reporting Hierarchy | Manager reassignment with circular-hierarchy prevention |
| 10 | DONE | Org & Employees | Account & Password Controls | Activate/suspend, force password reset |
| 11 | DONE | Shift Management | Shift Master & Roster | Timings, grace, full/half thresholds; employee/department assignment |
| 12 | DONE | Attendance | Attendance Logs | Date/department/employee/status filtering, pagination and totals |
| 13 | DONE | Attendance | Punch Photo Audit | Signed photo viewer with timestamps and metadata |
| 14 | DONE | Attendance | Hours & Undertime Analytics | Aggregated daily/monthly hours, lateness, CSV/Excel exports |
| 15 | DONE | Attendance | Manual Override | Attendance edits with recalculation and audit trail |
| 16 | DONE | Regularization | Master Queue | Org-wide status/department-filtered requests |
| 17 | DONE | Regularization | Attachment & Reason Review | Request details and one signed attachment |
| 18 | DONE | Regularization | Approve / Reject | Single/bulk decisions, remarks, attendance recalculation |
| 19 | DONE | Leave Management | Types & Quota Policies | Sick/casual, annual quotas, accrual/carry-forward, half/full day |
| 20 | DONE | Leave Management | Balances Ledger | Employee balances and audited credit/debit adjustments |
| 21 | DONE | Leave Management | Requests & Approvals | Org leave requests; approve/reject/cancel with balance accounting |
| 22 | DONE | Tasks & Projects | Projects | Portfolio CRUD, project lead/members, dates and progress |
| 23 | DONE | Tasks & Projects | Global Task Board | Project/individual tasks, assignee/creator/priority filters |
| 24 | DONE | Tasks & Projects | Assignment & Reassignment | Create tasks and bulk reassign; preserve creator metadata |
| 25 | DONE | Tasks & Projects | Reviews & Issues | Review/issue triage and resolution |
| 26 | DONE | App Settings & CMS | Guide & Tutorial CMS | Editable help articles and onboarding steps |
| 27 | DONE | App Settings & CMS | App Configuration | Languages, about/store links, minimum client version |
| 28 | DONE | System & Audit | Audit Logs & Exports | Overrides/decisions security history, CSV/PDF compliance reports |
Employee roadmap
| Order | Status | Module | Feature | UI and API scope |
|---|---|---|---|---|
| 1 | DONE | Auth & Profile | User Login & Session | Yup login, JWT/session lifecycle; POST /auth/login; missing employee sessions redirect once, with portal-scoped expiry and recoverable connection errors |
| 2 | DONE | Auth & Profile | Profile | Employee/shift/avatar; GET /profile |
| 3 | DONE | Auth & Profile | Change Password | Current/new password verification and update |
| 4 | DONE | Auth & Profile | Logout | Session invalidation and navigation |
| 5 | DONE | Home | Dashboard & Navigation | Daily status and leave/attendance/tasks/approvals summaries |
| 6 | DONE | Home | Quick Add | Mobile action sheet for leave/regularization |
| 7 | DONE | Attendance | Logs | Shift, logged hours, undertime and calendar/list |
| 8 | DONE | Attendance | Punch Photos | Camera upload and time in/out metadata |
| 9 | DONE | Regularization | Trigger | Regularize from logs or Quick Add; current status |
| 10 | DONE | Regularization | Request Form | Requested time in/out and reason validation |
| 11 | DONE | Regularization | Single Attachment | One attachment, preview/removal, staged upload |
| 12 | DONE | Regularization | Form Actions | Cancel/apply, transaction and manager notification |
| 13 | DONE | Leave | Request Form | Leave type/date range, balance and overlap checks |
| 14 | DONE | Leave | Duration & Actions | Full/half-day calculation, cancel/apply |
| 15 | DONE | Approvals | Leave Approvals | Manager-scoped requests and decisions |
| 16 | DONE | Approvals | Regularization Approvals | Manager-scoped review, attachment, attendance update |
| 17 | DONE | Tasks & Projects | Dashboard | Project summaries/task counts |
| 18 | DONE | Tasks & Projects | Categories | Project/individual filters |
| 19 | DONE | Tasks & Projects | Status Views | Ongoing/review/issues and transitions |
| 20 | DONE | Tasks & Projects | Assigned By | Creator identity on task cards |
| 21 | DONE | Settings | Theme & Language | Persistent employee preferences |
| 22 | DONE | Settings | App Clean Up | Clear temporary app storage/cache |
| 23 | DONE | Help | Guide & Tutorial | CMS content and tutorial steps |
| 24 | DONE | Help | Rate / Share / About | Share API, store/legal links, current version |
Verification and acceptance
Implementation complete: 28/28 admin features, 24/24 employee features, and shared infrastructure. Build, lint and API check results are recorded in PROGRESS.md (repository tracking file). The frontend remains a static export, including the public documentation routes. The real S3 → RabbitMQ → S3 pipeline was verified with a disposable file and cleaned up. Docker and HTTP deployment checks are recorded in PROGRESS.md.
Browser/device acceptance remains pending with the owner, as requested. DONE means implemented and checked through builds/API contracts; it does not claim that every UI flow has been browser-tested.
Explicit behavior boundaries
- Employee punches reference ready staged-upload IDs instead of sending multipart file bytes through NestJS, following the requested direct-to-staging architecture. Mobile capture is provided by the camera-capable file input.
- Attendance lists contain recorded punches/manual records/approved regularizations; missing dates are available through the regularization date selector. No synthetic absent punches are inserted automatically.
- Theme and locale are persisted; navigation translations cover English, Hindi and Tamil with English fallback. HR-authored content remains in the language in which it was published.
- Bulk regularization applies the individual transactional decision endpoint and reports partial failures; it is not an all-or-nothing batch transaction.
- Staged originals are retained after promotion; a bucket lifecycle retention policy has not been imposed.
- Location PostgreSQL is configured and reachable. Location/vector search is outside this roadmap and the vector extension is not installed.