theme-hr-portal

name	theme-hr_portal
description	HR / workforce application palette: variants, pages, entities, and flows for building a varied HR app. Use when theme_preset is hr_portal.

HR portal theme

Domain

Internal apps where employees manage their own info and managers/HR act on others. The org hierarchy (employee → manager → HR/admin) and ownership of payroll/PII are where privilege and access exploits live.

Application variants — pick ONE per lab

Honor any hint in theme_free_text / custom_prompt; otherwise pick one.

• Employee self-service — profile, payslips, PTO, documents, directory.
• Recruiting / ATS — job reqs, candidates, applications, interview notes.
• Payroll & benefits — payslips, tax forms, benefit enrollment.
• Performance reviews — goals, review cycles, peer feedback.
• Time & attendance — clock in/out, timesheets, approvals.
• Learning & development — courses, enrollments, completions, certifications.
• Expense & travel reimbursement — expense reports, receipts, approval, payout.

Roles — choose the set that fits the variant

• user (employee) — own profile, payslips, PTO requests, documents.
• manager — approve direct reports' requests, view their info.
• admin (HR) — all employees, payroll, role assignment.

Most exploits run as user.

Candidate pages — select a coherent subset

Size the subset to endpoint_count. Candidates: dashboard/overview, my profile, payslips, tax documents, PTO request & balance, my documents, org directory, team view (manager), approvals (manager), profile/settings, notifications, candidates / applications / interview notes (ATS), benefits enrollment / plans (payroll & benefits), review cycle / goals / feedback (performance), timesheets / clock in-out / shifts (time & attendance), admin employees, admin payroll.

Candidate entities (seed tables) — select what the variant needs

• users — id, email, password_hash, role, employee_id
• employees — id, name, title, department, manager_id, salary_cents
• payslips — id, employee_id, period, gross_cents, net_cents, document_path?
• pto_requests — id, employee_id, kind, start, end, status, approver_id
• documents — id, owner_employee_id, kind, path
• notifications — id, employee_id, kind, body, read_at

Recruiting / ATS (variant):

• job_reqs — id, title, department, hiring_manager_id, status
• candidates — id, name, email, source, current_stage
• applications — id, candidate_id, job_req_id, stage, status
• interviews — id, application_id, interviewer_id, scheduled_at, notes, rating

Payroll & benefits (variant):

• benefit_plans — id, name, kind, premium_cents, employer_match_bps
• enrollments — id, employee_id, benefit_plan_id, coverage, status, effective_at
• tax_forms — id, employee_id, year, kind, document_path?

Performance reviews (variant):

• review_cycles — id, name, period, status
• goals — id, employee_id, cycle_id, title, target, progress, status
• reviews — id, employee_id, reviewer_id, cycle_id, body, rating
• feedback — id, subject_employee_id, author_employee_id, body, visibility

Time & attendance (variant):

• timesheets — id, employee_id, period, total_hours, status, approver_id
• time_entries — id, timesheet_id, date, clock_in, clock_out, hours
• shifts — id, employee_id, start, end, role, status

Seed several employees under ≥2 managers so cross-report access is testable.

Candidate user flows — select the ones matching chosen pages/features

1. Dashboard → view my payslips → download a payslip.
2. Submit a PTO request → manager approves → balance updates.
3. Update my profile / emergency contact.
4. Browse org directory → open a colleague's public profile.
5. (manager) Review and approve a direct report's request.
6. (ATS) Create a job req → add a candidate → move them through interview stages, adding notes.
7. (ATS) Schedule an interview → record a rating → advance or reject the application.
8. (payroll & benefits) Browse benefit plans → enroll in one → view tax forms.
9. (performance) Set a goal in the active cycle → request peer feedback → submit a self-review.
10. (time & attendance) Clock in/out → fill a timesheet → submit for manager approval.

Candidate endpoints — a feature may span several

Endpoints are a shared surface, not owned 1:1 by a feature (a single feature often spans several, and an endpoint can back multiple features). Pick a coherent subset alongside the pages above. Grouped by area:

• profile / employees — GET /api/employees/{id}, PUT /api/employees/{id}, GET /api/directory
• payslips — GET /api/employees/{id}/payslips, GET /api/payslips/{id}, GET /api/payslips/{id}/download
• pto — GET /api/pto, POST /api/pto, POST /api/pto/{id}/approve
• documents — GET /api/documents, GET /api/documents/{id}/download?file=
• recruiting (ATS) — GET/POST /api/job-reqs, GET/POST /api/candidates, GET/POST /api/applications, POST /api/applications/{id}/stage, GET/POST /api/interviews
• benefits (payroll & benefits) — GET /api/benefit-plans, GET/POST /api/enrollments, GET /api/tax-forms/{id}
• performance (performance) — GET/POST /api/goals, GET/POST /api/reviews, GET/POST /api/feedback
• time (time & attendance) — POST /api/clock, GET/POST /api/timesheets, POST /api/timesheets/{id}/approve, GET/POST /api/shifts
• admin — /api/admin/employees, /api/admin/payroll, POST /api/admin/employees/{id}/role

Where vulnerabilities fit naturally

• idor → GET /api/employees/{id}/payslips, /api/employees/{id} salary — read another employee's payroll/PII.
• privilege_escalation → employee gaining manager/HR role; approving own request.
• business_logic → approve own PTO, request negative hours, exceed PTO balance, self-approval via manager_id tamper.
• path_traversal → document/payslip download file= parameter.
• xss → review feedback, candidate interview notes rendered to others.
• auth_bypass → reach admin payroll without a valid HR session.

Diversity guidance

Pick ONE variant and a coherent subset — an ATS and a payroll app diverge sharply. Size to endpoint_count; let theme_free_text / custom_prompt bias the variant and naming. Vary departments, hierarchy depth, and document types so two HR labs feel like different companies.