Block login access for relieved employees

app/ui/routes/auth.py

@@ -25,6 +25,7 @@ from app.modules.core.rbac.models import Permission, Role, RolePermission, UserR
 from app.modules.core.tenancy.models import Branch, FinancialYear, Tenant
 from app.modules.core.tenancy.settings_models import BranchSettings
 from app.modules.email_integration.services import send_auth_otp_email, send_password_changed_email
+from app.modules.employees.models import Employee
 
 router = APIRouter()
 
@@ -237,10 +238,21 @@ def _post_login_redirect(must_change_password: bool, permissions: set[str], role
 
     return "/employee/dashboard"
 
-def _is_user_login_allowed(user: User) -> tuple[bool, str | None]:
+def _is_user_login_allowed(user: User, db=None) -> tuple[bool, str | None]:
     if not user:
         return False, "Invalid credentials"
 
+    if db is not None:
+        relieved_employee = db.execute(
+            select(Employee.id).where(
+                Employee.user_id == int(user.id),
+                Employee.tenant_id == int(user.tenant_id),
+                Employee.status == "relieved",
+            ).limit(1)
+        ).scalar_one_or_none()
+        if relieved_employee is not None:
+            return False, "Login is disabled because this employee has been relieved."
+
     if not getattr(user, "is_active", True):
         return False, "User account is inactive."
 
@@ -517,7 +529,7 @@ def _submit_login(
             else bool(user and not is_client_only)
         )
 
-        can_login, blocked_reason = _is_user_login_allowed(user)
+        can_login, blocked_reason = _is_user_login_allowed(user, db)
         password_ok = bool(user and verify_password(password, user.password_hash))
 
         if not user or not portal_allowed or not can_login or not password_ok:
@@ -861,7 +873,7 @@ def forgot_password_submit(
                 status_code=200,
             )
 
-        can_login, _ = _is_user_login_allowed(user)
+        can_login, _ = _is_user_login_allowed(user, db)
         if not can_login:
             return _render_forgot_password(
                 request,