Skip to main content

Leave Permissions Reference

Summary

Authentication and tenant context are confirmed, while a complete extracted-service capability/role catalog and manager-team scope parity require confirmation.

Audience

Security reviewers, administrators, developers, QA, support, architects, and product owners.

Reference Content

CapabilityAuthentication evidenceAuthorization evidenceTenant requirementEmployee/self scopeApprover/team scopeTenant-wide/admin scopeUI guard evidenceAPI enforcement evidenceWorkflow-managed behaviorMaturityRequires confirmation
Access Leave pageClient token requiredRoute module/capability checkTenant user requiredEmployee menu entryManager menu entryAdmin menu entryProtectedRoute and filtered navigationProtected service group and tenant contextNone at route accessTransitionalClient/API parity
List requestsAuthenticated tenant contextQuery and client scope behaviorRequiredESS is self-orientedTeam intent exists in menuLegacy admin sees loaded collectionRoute plus local filteringTenant-scoped query; granular scope incompleteNoneTransitionalFinal team and tenant-wide scope
Create requestAuthenticated employee/tenantEmployee resolution and server validationRequiredESS/self supportedNot separately confirmedLegacy admin can select employeeRoute and form renderingTenant/employee validationWorkflow may start after creationTransitionalAdmin authorization parity
Approve/rejectAuthenticated tenant contextLocal action visibility plus API checksRequiredNo self-decision claimOther-employee Pending action visible locallyLocal admin action visibleClient status/identity/admin checksAdmin-role extraction exists; final policy incompleteOptional Workflow delegation restricts direct decisionTransitionalApprover/team and extracted policy
CancelAuthenticated tenant contextClient ownership/status plus domain stateRequiredPending self cancellation visibleNot confirmedNo special admin cancellation UIIdentity/status visibilitySource-defined state enforcementNo cancellation workflow confirmedTransitionalDirect/compatibility parity
View balancesAuthenticated tenant contextClient filtering and tenant queryRequiredCurrent-user ledgerTeam view hint existsWider view for local adminLocal role/scope calculationGranular extracted authorization incompleteNoneTransitionalTeam/tenant-wide scope
Save/delete balancesAuthenticated tenant contextLocal admin controlRequiredNot availableNot confirmedLocal admin UIisAdmin visibilityExtracted endpoint granularity incompleteNoneTransitionalFinal admin policy
Manage holidays/weekly offsAuthenticated tenant contextProtected settings capabilityRequiredNot exposedNot exposedAdmin-oriented menuSettings route guardTenant-scoped API; final role policy incompleteNoneTransitionalExtracted authorization parity
Manage types/policiesAuthenticated tenant contextDirect API existsRequiredNo UINo UINo management UINoneFinal authorization granularity incompleteNoneNot implemented in UIAdministrative authorization
Workflow callbackService-to-service contextDedicated protected integrationTenant correlation requiredNot a user capabilityNot a user capabilityNot a user capabilityNo UIDedicated callback handlingCompletes managed decisionTransitionalOperational trust details intentionally excluded

Do not convert client role strings or feature flags into a final business permission catalog without security review.

Source References

  • UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsx
  • UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsx
  • UI/salary-ui/apps/client-hrms-portal/src/pages/hr/PayrollFeaturePages.tsx
  • microservices/src/leave-service/Api/LeaveEndpoints.cs
  • Controllers/LeaveRequestsController.cs

See Also

Keywords

  • Leave reference
  • Leave Permissions Reference
  • Workforce management

Revision Information

  • Status: Draft
  • Last reviewed: 2026-07-15
  • Review cycle: Quarterly