Leave Permissions Reference
Summary
Authentication and tenant context are confirmed, while a complete extracted-service capability/role catalog and manager-team scope parity require confirmation.
Audience
Security reviewers, administrators, developers, QA, support, architects, and product owners.
Reference Content
| Capability | Authentication evidence | Authorization evidence | Tenant requirement | Employee/self scope | Approver/team scope | Tenant-wide/admin scope | UI guard evidence | API enforcement evidence | Workflow-managed behavior | Maturity | Requires confirmation |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Access Leave page | Client token required | Route module/capability check | Tenant user required | Employee menu entry | Manager menu entry | Admin menu entry | ProtectedRoute and filtered navigation | Protected service group and tenant context | None at route access | Transitional | Client/API parity |
| List requests | Authenticated tenant context | Query and client scope behavior | Required | ESS is self-oriented | Team intent exists in menu | Legacy admin sees loaded collection | Route plus local filtering | Tenant-scoped query; granular scope incomplete | None | Transitional | Final team and tenant-wide scope |
| Create request | Authenticated employee/tenant | Employee resolution and server validation | Required | ESS/self supported | Not separately confirmed | Legacy admin can select employee | Route and form rendering | Tenant/employee validation | Workflow may start after creation | Transitional | Admin authorization parity |
| Approve/reject | Authenticated tenant context | Local action visibility plus API checks | Required | No self-decision claim | Other-employee Pending action visible locally | Local admin action visible | Client status/identity/admin checks | Admin-role extraction exists; final policy incomplete | Optional Workflow delegation restricts direct decision | Transitional | Approver/team and extracted policy |
| Cancel | Authenticated tenant context | Client ownership/status plus domain state | Required | Pending self cancellation visible | Not confirmed | No special admin cancellation UI | Identity/status visibility | Source-defined state enforcement | No cancellation workflow confirmed | Transitional | Direct/compatibility parity |
| View balances | Authenticated tenant context | Client filtering and tenant query | Required | Current-user ledger | Team view hint exists | Wider view for local admin | Local role/scope calculation | Granular extracted authorization incomplete | None | Transitional | Team/tenant-wide scope |
| Save/delete balances | Authenticated tenant context | Local admin control | Required | Not available | Not confirmed | Local admin UI | isAdmin visibility | Extracted endpoint granularity incomplete | None | Transitional | Final admin policy |
| Manage holidays/weekly offs | Authenticated tenant context | Protected settings capability | Required | Not exposed | Not exposed | Admin-oriented menu | Settings route guard | Tenant-scoped API; final role policy incomplete | None | Transitional | Extracted authorization parity |
| Manage types/policies | Authenticated tenant context | Direct API exists | Required | No UI | No UI | No management UI | None | Final authorization granularity incomplete | None | Not implemented in UI | Administrative authorization |
| Workflow callback | Service-to-service context | Dedicated protected integration | Tenant correlation required | Not a user capability | Not a user capability | Not a user capability | No UI | Dedicated callback handling | Completes managed decision | Transitional | Operational trust details intentionally excluded |
Do not convert client role strings or feature flags into a final business permission catalog without security review.
Source References
UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsxUI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsxUI/salary-ui/apps/client-hrms-portal/src/pages/hr/PayrollFeaturePages.tsxmicroservices/src/leave-service/Api/LeaveEndpoints.csControllers/LeaveRequestsController.cs
Related Articles
See Also
Keywords
- Leave reference
- Leave Permissions Reference
- Workforce management
Revision Information
- Status: Draft
- Last reviewed: 2026-07-15
- Review cycle: Quarterly