develop full initial module

Frontend/erp-system/components/Layouts/AppSidebar.tsx

@@ -4,12 +4,17 @@ import { useEffect, useState } from "react"
 import Link from "next/link"
 import { usePathname } from "next/navigation"
 import {
+  Banknote,
   Boxes,
   Building2,
+  CalendarCheck,
+  CalendarClock,
   ChevronRight,
   ClipboardList,
+  FileBarChart,
   FileText,
   HelpCircle,
+  IdCard,
   LayoutGrid,
   ListTree,
   Menu,
@@ -81,6 +86,22 @@ const navItems: {
   { title: "Stock", code: "stock", href: "/dashboard/stock", icon: Warehouse, chevron: true },
   { title: "Warehouses", code: "warehouses", href: "/dashboard/warehouse", icon: Building2, chevron: true },
   { title: "Orders", code: "orders", href: "/dashboard/orders", icon: ShoppingCart, chevron: true },
+  {
+    title: "HRM",
+    code: "hrm",
+    href: "/dashboard/hrm",
+    landingHref: "/dashboard/hrm/employees",
+    icon: IdCard,
+    chevron: true,
+    children: [
+      { title: "Employees", code: "hrm.employees", href: "/dashboard/hrm/employees", icon: Users },
+      { title: "Attendance", code: "hrm.attendance", href: "/dashboard/hrm/attendance", icon: CalendarCheck },
+      { title: "Leave", code: "hrm.leave", href: "/dashboard/hrm/leave", icon: CalendarClock },
+      { title: "Payroll", code: "hrm.payroll", href: "/dashboard/hrm/payroll", icon: Banknote },
+      { title: "Reports", code: "hrm.reports", href: "/dashboard/hrm/reports", icon: FileBarChart },
+      { title: "Settings", code: "hrm.settings", href: "/dashboard/hrm/settings", icon: SlidersHorizontal },
+    ],
+  },
   {
     title: "Settings",
     code: "settings",
@@ -294,17 +315,21 @@ export function AppSidebar() {
   // flashing the full menu to a restricted role. Once resolved, a nav item
   // is visible if its own code is granted, or (for parents) if any child is.
   //
-  // "procurement" is exempted from that check (frontend-only): no role is currently
-  // seeded with NAV:procurement or its children server-side, which would hide the whole
-  // section for everyone. Remove this bypass once roles are granted the permission
-  // properly (Settings → Roles → Sidebar permissions) or a backend seed grants it.
+  // "procurement" and "hrm" are exempted from that check (frontend-only): no role is
+  // currently seeded with NAV:procurement/NAV:hrm or their children server-side, which
+  // would hide the whole section for everyone. Remove each bypass once roles are granted
+  // the permission properly (Settings → Roles → Sidebar permissions) or a backend seed
+  // grants it. This is also flagged in 02-SECURITY.md as the AR-09 sidebar-visibility
+  // stopgap for HRM's salary/PII data — it hides HRM from the UI but doesn't enforce
+  // anything server-side.
+  const bypassCodes = new Set(["procurement", "hrm"])
   const visibleItems = loading
     ? []
     : navItems
-        .filter((item) => item.code === "procurement" || navCodes.includes(item.code) || item.children?.some((c) => navCodes.includes(c.code)))
+        .filter((item) => bypassCodes.has(item.code) || navCodes.includes(item.code) || item.children?.some((c) => navCodes.includes(c.code)))
         .map((item) => ({
           ...item,
-          children: item.code === "procurement" ? item.children : item.children?.filter((c) => navCodes.includes(c.code)),
+          children: bypassCodes.has(item.code) ? item.children : item.children?.filter((c) => navCodes.includes(c.code)),
         }))
 
   // Close mobile menu on route change