THE LABS GADGET — HR FULL ADMIN V1.8
===================================== 

Purpose
-------
Designated HR accounts can administer ALL Finance HR modules without Owner approval: HR/Employees, weekly shift roster, GPS attendance, payroll, PV creation/approval/payment, cash flow, bank/cash accounts, opening balance edits, expenses, supplier AP, recurring bills, reconciliation and POS import.
The Owner account is protected: HR Full Admin cannot assign itself the Owner role, reset the Owner login password, or deactivate the Owner account.
This does not grant access to the separate original CRM; it grants access within /financehub only.

Compatibility
-------------
Requires standard Finance V1.1 + GPS V1.4 + PV template V1.3 + Combined HR V1.7, unchanged core files.
Updater stops if any files differ; do NOT manually overwrite app files.
Only Finance database fh_users.role ENUM gets an additional hr_admin value. Existing roles, transactions, attendance, payroll and shift data remain.

INSTALL STEPS
-------------
1. In cPanel, BACK UP entire Finance database and financehub folder. Do not edit original CRM.
2. Upload ZIP to Finance application's existing /financehub/ root (the folder with index.php); choose Extract.
3. Ensure upgrade_hr_full_v1_8.php is at the same level as index.php, and patch_hr_full_v1_8 is its sibling.
4. Sign in as the ORIGINAL Owner/Admin and visit https://crm.thelabsgadget.com/financehub/upgrade_hr_full_v1_8.php
5. Verify the screen reads "Existing PHP files compatible: Yes", "Extracted patch files verified: Yes".
6. Click "Install HR Full Admin V1.8" once and wait for confirmation. If error, stop and share error text (not passwords).
7. Employees -> Edit the intended HR employee -> Access Role "HR · Full Admin" -> enter reason -> Save Employee Changes.
8. HR logs out then in again. Test Employees, Weekly Shifts, Cash Flow, PV Print, payroll and GPS page, using a test PV (do not post a real payment).
9. Remove upgrade_hr_full_v1_8.php and patch_hr_full_v1_8 folder AFTER testing; leave app/ and backup folder.

Security notes
--------------
- This is a privileged role: HR can edit bank balances (before transactions), financial data, PV approvals and payroll without Owner approval. Grant ONLY to a highly trusted employee. Audit entries continue to record identity and changes.
- This patch does not provide two-person financial approval; HR may create and approve its own PV, according to requested access.
- Prevent staff from sharing logins. Strong individual passwords are required; reset if compromised.
- This is a source-level static analysis release, not tested against your live cPanel/MySQL; confirm correct role behavior in live testing.
