# Role Mapping

The existing demo data contains generic roles such as **System Admin**, **Manager**, and **Staff**. To align with the new scope, map or create roles as follows:

| Existing Role      | New Purpose/Mapping              |
|--------------------|----------------------------------|
| System Admin       | HR Administrator (full access)   |
| Manager            | Location Officer                 |
| Staff (Internal)   | Employee                         |
| Staff (External)   | Contractor/Visitor               |
| Guest / Viewer     | Read‑only user                   |

Additional roles required for procurement should be created using the ACL system:

- **Procurement Manager** – manages requisitions and vendor interactions.
- **Finance Approver** – reviews and approves purchase orders.
- **CEO Approver** – final approval authority on high value orders.
- **Finance Officer** – manages ratepayer billing and payments.
- **Counsel Clerk** – maintains property registers and assists with billing.
- **Driver** – operates company vehicles and logs trips.

Update the `roles_permissions` table so these roles only have permissions for the Time & Attendance and Procurement resources.

## Time & Attendance ACL

The `roles_permissions` table defines which API endpoints each role may call.
Below are the recommended permissions:

### Employee
* `attendance`: `create`, `update`, `getById`
* `employeeportal`: `clockIn`, `clockOut`, `profile`, `submitLeave`, `payslips`

### Location Officer
* `attendance`: `getAll`, `update`, `approve`, `reject`
* `employees`: `getAll` *(filtered to their location)*
* `reports`: `location`, `daily`, `summaryToday`, `absenteesToday`, `locationAlerts`
* `performance_dashboard`: `teamPerformance`
* `manager`: `audit`
Location-level endpoints automatically limit results to employees managed by the
current user.

### HR Team
* `attendance`: `getAll`, `create`, `update`, `delete`, `approve`, `reject`
* `employees`: `getAll`, `create`, `update`, `delete`
* `users`: `getAll`, `create`, `update`, `delete`
* `time_clock_locations`: `getAll`, `create`, `update`, `delete`
* `reports`: `company`, `daily`, `summaryToday`, `absenteesToday`, `locationAlerts`, `disciplinaryTrends`, `caseDurations`, `training`
* `performance_dashboard`: `trainingCompletion`
* `ohs_reports`: `view`
* `interview_reports`: `view`

## Finance ACL

Roles that manage the general ledger require explicit permissions.

### Finance Manager
* `glaccounts`: `getAll`, `create`, `update`, `delete`, `toggle`
* `gltransactions`: `getAll`, `create`, `update`, `delete`, `import`, `postBatch`, `split`, `parseText`
* `payroll`: `reports`
* `reports`: `profitLoss`, `cashFlow`, `vatReport`, `trialBalance`, `balanceSheet`

### Accountant
* `glaccounts`: `getAll`, `update`
* `gltransactions`: `getAll`, `create`, `postBatch`, `split`
* `payroll`: `reports`
* `reports`: `profitLoss`, `cashFlow`, `vatReport`, `trialBalance`, `balanceSheet`

### Auditor
* `glaccounts`: `getAll`
* `gltransactions`: `getAll`
* `reports`: `profitLoss`, `cashFlow`, `vatReport`, `trialBalance`, `balanceSheet`
* `audit`: `logs`

### Finance Officer
* `properties`: `getAll`, `create`, `update`, `delete`
* `ratepayers`: `*`
* `property_rates`: `*`
* `rates_billing`: `generate`
* `rate_payments`: `create`

### Counsel Clerk
* `properties`: `getAll`, `create`, `update`, `delete`
* `ratepayers`: `*`
* `property_rates`: `*`
* `rates_billing`: `generate`
* `rate_payments`: `create`
### Exit Workflow Access
HR managers, department heads, IT, Admin, and Legal should be able to manage the employee exit process. Grant these roles access to:
* `employee_exits`: `getAll`, `create`, `update`, `approve`, `decline`, `completeClearance`
* `exit_approvals`: `getAll`, `create`, `update`
* `exit_clearances`: `getAll`, `create`, `update`
* `exit_interviews`: `getAll`, `create`, `update`
* `exit_feedback`: `getAll`, `create`, `update`