Block login access for relieved employees

app/modules/employees/service.py

@@ -298,6 +298,24 @@ def create_login_user_for_employee(
     return user
 
 
+def _disable_relieved_employee_login(db: Session, emp: Employee) -> None:
+    """Revoke login for a relieved employee without deleting the user identity.
+
+    Historical engagements, attendance, payroll, documents and audit references
+    continue to point to the same User row. Authentication is disabled through
+    allow_login, while the session/auth layer independently blocks any employee
+    whose HR status is relieved.
+    """
+    if (getattr(emp, "status", "") or "").strip().lower() != "relieved":
+        return
+    user_id = getattr(emp, "user_id", None)
+    if not user_id:
+        return
+    linked_user = db.get(User, int(user_id))
+    if linked_user is not None:
+        linked_user.allow_login = False
+
+
 def create_employee(db: Session, actor: User, scope: EmployeeScope, data: dict[str, Any]) -> Employee:
     cleaned = _clean_payload(data)
     partner_staff_mode = bool(scope.is_partner and not scope.is_system_admin and not scope.is_firm_admin)
@@ -388,6 +406,8 @@ def create_employee(db: Session, actor: User, scope: EmployeeScope, data: dict[s
         updated_by_user_id=actor.id,
     )
     db.add(emp)
+    db.flush()
+    _disable_relieved_employee_login(db, emp)
     db.commit()
     db.refresh(emp)
     return emp
@@ -426,6 +446,7 @@ def update_employee(db: Session, actor: User, emp: Employee, data: dict[str, Any
         setattr(emp, field, cleaned.get(field))
     emp.updated_by_user_id = actor.id
     emp.updated_at_utc = datetime.now(timezone.utc)
+    _disable_relieved_employee_login(db, emp)
     db.commit()
     db.refresh(emp)
     return emp
@@ -441,6 +462,7 @@ def change_employee_status(db: Session, actor: User, emp: Employee, status: str,
         emp.date_of_leaving = date_of_leaving
     emp.updated_by_user_id = actor.id
     emp.updated_at_utc = datetime.now(timezone.utc)
+    _disable_relieved_employee_login(db, emp)
     db.commit()
     db.refresh(emp)
     return emp
@@ -2269,6 +2291,7 @@ def complete_offboarding_request(db: Session, user: User, req: EmployeeOffboardi
         employee.is_active = False
         employee.date_of_leaving = req.approved_relieving_date or req.requested_relieving_date or date.today()
         employee.updated_by_user_id = user.id
+        _disable_relieved_employee_login(db, employee)
     req.status = "completed"
     req.completed_by_user_id = user.id
     req.completed_at_utc = datetime.now(timezone.utc)