Block login access for relieved employees

app/core/security/session_auth.py

@@ -6,6 +6,7 @@ from sqlalchemy import select
 
 from app.core.db.deps import get_common_db
 from app.modules.core.iam.models import User
+from app.modules.employees.models import Employee
 from app.modules.core.tenancy.models import Branch
 from app.modules.core.tenancy.settings_models import BranchSettings
 
@@ -22,6 +23,20 @@ def get_current_user(request: Request, db: Session = Depends(get_common_db)) ->
 
     user = db.execute(select(User).where(User.id == int(user_id))).scalar_one_or_none()
     if not user or not user.is_active or not getattr(user, "allow_login", True) or getattr(user, "is_locked", False) or getattr(user, "deleted_at", None) is not None:
+        request.session.pop(SESSION_USER_ID_KEY, None)
+        request.session.pop(SESSION_LOGIN_AT_KEY, None)
+        return None
+
+    relieved_employee = db.execute(
+        select(Employee.id).where(
+            Employee.user_id == int(user.id),
+            Employee.tenant_id == int(user.tenant_id),
+            Employee.status == "relieved",
+        ).limit(1)
+    ).scalar_one_or_none()
+    if relieved_employee is not None:
+        request.session.pop(SESSION_USER_ID_KEY, None)
+        request.session.pop(SESSION_LOGIN_AT_KEY, None)
         return None
 
     # Enforce session duration from BranchSettings