Company leave desk
Dashboard
AH
Today at Al Habib
Welcome
Leave management workspace
Leave Requests
Company leave requests, status, and approval progress.
| Employee | Type | Dates | Days | Status | Details |
|---|
Apply for Leave
Submit a leave request for your signed-in account.
Leave Requests
Review leave history and request status.
| Employee | Type | Start | End | Deducted | Status | Details |
|---|
Approvals
Pending requests waiting for manager or CEO/COO action.
Leave Reports
Filter leave requests by employee, status, and date range, then export the result.
| Employee | Type | Start | End | Calendar | Deducted | Status | Reason |
|---|
Users & Roles
Manage the employee directory, account changes, imports, approvals, and recovery requests.
User Directory
Employee directory, account status, and role information.
| Name | Title | Department | Role | Status | Action |
|---|
Request User Change
HR changes are submitted for CEO/COO approval. Full-permission changes are applied directly.
Import Users CSV
Upload a prepared CSV, review detected new and existing users, then submit changes for approval.
| Status | Full Name | Title | Department | Role | Note |
|---|
User Changes Waiting for Approval
CEO/COO and system admin can approve or reject HR-submitted user changes.
Account Recovery Requests
Review unlock and password reset requests submitted from the login screen.
Official Holidays
Holidays are excluded from deductible leave days.
Workflow Builder
Define approval stage labels per leave type. Changes are audited.
Leave Balance Management
Set yearly annual entitlement, carry forward, and sick entitlement.
| Employee | Year | Annual | Carry forward | Total annual | Sick | Note |
|---|
Audit Log
System activity and login activity for full-permission users.
System Activity
Login Activity
Production Settings
Security, backup, upgrade, and notification administration.
Security Settings
- Set the failed login lockout counter. Recommended value: 10.
- Keep password minimum length at 10 or higher.
- Keep uppercase, lowercase, number, and symbol requirements enabled.
- Review login audit from the Audit page after user testing.
Admin Checklist
- Use full-permission accounts only for system administration.
- Keep HR account access limited to HR tasks and user-change requests.
- Use Settings tabs for production configuration instead of editing application files.
- Create a backup before major configuration or data changes.
Where Values Come From
- Lockout counter is a company policy decision. Recommended: 10.
- Password length and complexity are company policy decisions. Keep all complexity options enabled.
- Account unlocks and password resets are handled from user administration and recovery requests.
- Login success and failure history is reviewed from the audit/log screens by full-permission users.
SMTP Questions
- Is the sender mailbox created? Recommended: leave@alhabib.com.sa.
- Is SMTP AUTH enabled for the sender mailbox?
- Can the server reach smtp.office365.com on port 587?
- Will authentication use a mailbox password or OAuth-supported SMTP?
- Who receives the first test email before real delivery is enabled?
Microsoft Graph Questions
- What is the Microsoft tenant ID?
- What is the app registration client ID?
- Which mailbox is approved for sending system email?
- Is Mail.Send permission approved?
- Is mail sending restricted to the selected sender mailbox?
Where Values Come From
- SMTP host, port, and STARTTLS come from your mail provider. Microsoft 365: smtp.office365.com, port 587. Gmail: smtp.gmail.com, port 587.
- SMTP username is the sender mailbox, usually leave@alhabib.com.sa.
- Sender email must match the SMTP username. Gmail and Microsoft 365 both reject or silently rewrite a From address that is not the authenticated account or one of its verified aliases - so mail appears to send and never arrives.
- For Gmail the secret must be a 16-character App Password, not the account password. App Passwords require 2-Step Verification to be on.
- Tenant ID and Client ID come from Microsoft Entra app registration Overview.
- Secret reference is the server environment variable name that stores the secret.
- Graph sender mailbox is the approved mailbox used by the system.
Deployment
Record the production hosting, domain, and HTTPS plan for the system.
Deployment Questions
- Where will the system be hosted: on-premise, Azure, AWS, VPS, or private cloud?
- What operating system will the server use?
- What is the production subdomain? Recommended: leave.alhabib.com.sa.
- Which reverse proxy or hosting layer will serve HTTPS?
- Which server name or IP should be recorded for support?
Go-Live Steps
- Deploy the application to the selected server.
- Create DNS record for the production subdomain.
- Enable HTTPS on the reverse proxy or hosting platform.
- Test login and leave request flow using the production URL.
- Enable secure cookies after HTTPS is working.
Where Values Come From
- Hosting type and operating system come from the final hosting decision.
- Production URL is the exact link users will open.
- Domain/subdomain comes from DNS records for alhabib.com.sa.
- Server name/IP comes from the production server or hosting portal.
- Reverse proxy is IIS, Nginx, Azure App Service, or the hosting gateway serving HTTPS.
Storage & Backup
Configure where attachments and backups should live in production.
Recent Backups
Attachment Storage Checklist
- Choose where sick notes and supporting files will be stored.
- Use a folder or container that only authorized server/admin accounts can access.
- Confirm files are included in backup or replicated storage.
- Confirm the maximum allowed file size and retention requirement.
- Test one sick note upload before go-live.
Backup Checklist
- Choose backup location: server folder, network folder, or OneDrive.
- Recommended local example: D:\LeaveSystem\backups.
- Set retention days, usually 90 or more.
- Choose a daily backup time, usually 02:00.
- Create one manual backup and confirm authorized administrators can access the file.
OneDrive Setup
- Create a Microsoft Entra app registration for the leave system.
- Grant Microsoft Graph application permission for file access to the storage account.
- Create a client secret and save it as a server environment variable.
- Enter the tenant ID, client ID, secret reference, account email, and folder names here.
- Click Test OneDrive before selecting OneDrive for attachments or backups.
Where Values Come From
- Tenant ID and Client ID come from Microsoft Entra app registration Overview.
- Secret reference is the server environment variable name, for example ALHABIB_ONEDRIVE_SECRET.
- OneDrive account is the licensed mailbox/storage account, for example leave@alhabib.com.sa.
- Root folder is created by the system, for example AlHabibLeaveDesk.
- Attachment and backup folders are folder names inside the root folder.
Maintenance
Export system data and validate/apply configuration restores. Create and review backups under Storage & Backup.
| Status | Version | Exported | Summary | Backup | Date |
|---|
Routine Maintenance
- Create a manual backup (Storage & Backup) before major configuration changes.
- Export system data before deployment or migration work.
- Validate any restore file before applying it.
- Apply restore only after confirming an automatic backup was created.
Restore Safety
- Use restore for configuration data only.
- Do not use restore as the only disaster recovery method.
- For full recovery, restore the database backup and attachment folder together.
Support Diagnostics
Describe what went wrong, then download a single report to send to your support contact - no need to find or copy log files yourself.
What's Included
- Your description, timestamp, and account.
- The installed version and current system health.
- Recent system and login activity (last 200 entries of each).
- Recent server log output, to catch the actual error if something crashed.
- Current production settings - no passwords or secrets are ever included, only the environment variable names that reference them.
- Employee names, email addresses and login times appear in the activity sections. The report is confidential - send it only to a support contact entitled to see staff records.
Before You Send It
- The file includes employee names and email addresses from recent activity - send it only to your trusted support contact, the same way you'd handle any other internal report.
- One report per issue is usually enough - avoid including unrelated history.
Upgrade Package
Upload a code update package to update this installation. Build one with
scripts/build-upgrade-package.py after making and testing changes locally.
| Status | Name | Version | Type | Summary | Date |
|---|
Upgrade Steps
- Make and test changes locally, then run
scripts/build-upgrade-package.pyto produce a package file. - Upload the package here and click Validate - it is checked for version, file paths, and checksums before anything happens.
- Review the file list and whether a restart is required, then click Apply Update.
- A database backup and a backup of every file being replaced are created automatically before anything is written.
- If any file in the package is under
server/, the service restarts itself automatically a couple of seconds after applying (only when running as a Windows Service - a manually started server needs a manual restart).
Notification Outbox
Queued email notifications waiting for Microsoft 365 delivery setup.
| Status | Event | Recipients | Subject | Related | Created |
|---|
Notification Templates
Email titles, recipients, and message wording for production notifications.