BookYourPTO

Changelog

Stay up to date with the latest changes, improvements, and bug fixes in BookYourPTO.

v1.0.8

UI Redesign — Navigation & Settings

This release is a comprehensive redesign of the application's navigation and settings architecture, modeled after modern dashboard dashboard patterns.

New Features

  • Sidebar navigation — Replaced the horizontal header with a fixed left sidebar on desktop. Includes org logo, grouped nav sections (core, apps, management, admin), collapsible width with persisted state, user profile dropdown with logout, and theme toggle.
  • Mobile navigation drawer — Slide-in drawer from the left with backdrop blur, replacing the old hamburger dropdown. Sticky top bar with org logo, notification bell, and theme toggle on small screens.
  • Sidebar collapse with tooltips — Sidebar collapses to icon-only mode (68px) with hover tooltips showing labels. Collapsed state persists across sessions via localStorage.
  • Active route indicator — Sidebar nav items show a colored left accent bar on the active route, matching modern dashboard visual pattern.
  • Settings overview page — New card grid hub at /settings with grouped sections (Personal, Organization, Executive). Each card shows icon, title, description, and feature lock badges. Cards have shadow-on-hover effect with dark mode support.
  • Individual settings routes — Every settings section now has its own URL (/settings/password, /settings/general, /settings/quickbooks, etc.) instead of query parameters (?tab=password). 22 new route pages created.
  • Settings breadcrumb navigation — Each settings sub-page shows a back arrow linking to the settings overview, plus a page title with icon matching the overview cards.
  • Settings feature gating on sub-pages — Locked features show an upgrade prompt directly on the sub-page with plan badge and CTA button, consistent across all gated sections.
  • Inline QuickBooks sync history — The Sync History tab in QuickBooks settings now renders the full audit log inline with filtering and pagination, replacing the placeholder link.

Improvements

  • Documents page — sidebar removed — Replaced the left sidebar with horizontal horizontal tabs (My Documents, All Documents, Action Required, Completed, Drafts) with count badges and active underline indicator.
  • Documents quick links relocated — Templates and Bulk Send links moved from the sidebar to inline buttons in the page header, next to the Start dropdown.
  • QuickBooks sidebar → horizontal tabs — Converted the vertical sidebar navigation (Overview, Employees, Vendors, etc.) to a horizontal tab bar with a Disconnect button at the right end.
  • QuickBooks sync-history breadcrumbs — The full-page sync history now shows a breadcrumb trail (Settings → QuickBooks → Sync History) instead of a back-button card.
  • Settings backward compatibility — Old URLs (/settings?tab=password, ?changePassword=true, ?setup2fa=true, ?tab=calendar) automatically redirect to the new path-based routes.
  • Forced password/2FA on sub-routes — Middleware path matching updated from exact /settings to startsWith('/settings') so users aren't bounced away from settings sub-pages during forced flows.
  • Duplicate headers removed — Removed redundant title/description headers from all 20 settings components since the page wrapper now provides the heading.
  • Settings overview dark mode — Cards use gray-900 base with gray-800 hover and stronger shadow in dark mode for visual distinction.

v1.0.7

New Features

  • E-Signature Platform — Complete document signing system with drag-and-drop field placement, sequential and parallel signing workflows, typed or drawn signatures, and multi-signer support.
  • Drag-and-drop field placement — Place signature, initials, date signed, name, email, company, and title fields directly onto PDF documents. Fields are color-coded per signer.
  • Sequential and parallel signing — Configure signing order when assigning documents. Sequential mode notifies each signer only when it's their turn. Multiple signers can share the same order number to sign in parallel.
  • Typed signatures — Choose from 8 cursive font styles to generate a typed signature, in addition to drawing freehand. Signatures can be saved for reuse across documents.
  • Signature validation — Canvas signatures are validated for quality: minimum size, ink coverage, and stroke complexity. Trivial scribbles are rejected with a clear error message.
  • Audit trail PDF — Every signed document can be downloaded with a full audit trail appended, showing all signers' names, emails, timestamps, and signing status.
  • Document sharing without signature — Documents can be shared for review without requiring a signature. Recipients receive a notification and email.
  • Department head document permissions — Configurable read and create permissions for department heads. Create access implies read. Bulk Send remains admin/executive only.
  • Breached password detection — Passwords are checked against the Have I Been Pwned database in real-time as users type during registration and password changes. Breached passwords are blocked from being set. Existing users with breached passwords are notified via in-app notification and email on their next login.
  • Remember Me — Server-enforced session vs persistent login. Unchecked by default — users must opt in to stay logged in across browser sessions.
  • Leave approval from detail modal — Approvers can now approve or reject leave requests directly from the leave detail modal without navigating away.
  • Group booking restricted — Group leave booking is now restricted to administrators and executives only.

Improvements

  • Documents index redesigned — Sidebar navigation with My Documents, All Documents (admin), Action Required, Completed, and Drafts views. Admins and executives can see all documents across the organization.
  • Table layout rebuilt — Documents table uses a proper table layout with status badges, action buttons, and a Recipient column in Action Required view for admins.
  • Browser back button support — Switching between document views now uses pushState so the browser back button works correctly.
  • Signature timestamp on PDF — Each signature and initials field in the rendered PDF shows the signer's name and timestamp.
  • Email messaging for shared documents — Emails for non-signature documents say "shared a document with you" instead of "sent for signing."
  • Due date timezone handling — Due dates are now inclusive with a 24-hour buffer. A document due on March 20 is not marked overdue until March 21.
  • Dept head uploader filtering — When department heads upload documents, the user autocomplete is filtered to their department only.
  • Self-approval prevention — Users can no longer approve their own leave requests, even if they have approver permissions.
  • Dashboard scroll optimization — Scrollbar only appears on screens below 1320px width.

Security

  • Data encryption at rest — Sensitive personal data (phone numbers, addresses, tax IDs, emergency contacts, bank details, webhook URLs, leave reasons) is now encrypted at the application level using AES-256-GCM, in addition to database-level encryption.
  • HttpOnly cookie authentication — Refresh tokens are now stored in HttpOnly secure cookies instead of browser-accessible storage, protecting against cross-site scripting (XSS) token theft.
  • Security headers — Content Security Policy, Strict Transport Security, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers are now set on all responses.
  • SSRF protection — Webhook URLs (Slack, Teams) are validated against private IP ranges, localhost, and cloud metadata endpoints before making server-side requests.
  • SSO domain verification — DNS-based domain verification for SSO prevents cross-organization domain hijacking. HMAC-signed state parameters protect against CSRF in SSO flows.
  • Breached password blocking — New passwords are checked against 900M+ known breached passwords via Have I Been Pwned before being accepted.
  • Auth gate hardening — Unauthenticated users no longer see a brief flash of authenticated UI. API requests are blocked immediately when no session exists.
  • Guided tour security — Tours no longer fire for unauthenticated users.

Privacy & Data Protection

  • Data export — Users can export all their personal data in machine-readable JSON format from their account settings.
  • Data deletion — Users can request deletion of their personal data. Data is anonymized to preserve organizational reporting integrity.
  • Data sharing opt-out — Users can opt out of third-party data sharing.
  • Data retention automation — Automated cleanup of data beyond the configurable retention period (default 7 years for tax/financial record-keeping).
  • Privacy policy updated — Added sections for legal basis of processing, international data transfers, data breach notification, children's privacy, and Do Not Track signals.
  • Cookie policy updated — Added details for authentication cookies and security cookies.
  • Terms of use updated — Added sections for data processing, data portability, and service availability.

Bug Fixes

  • Completed view duplicates — Fixed documents appearing multiple times when they had multiple signers.
  • Action Required filtering — Shared documents no longer appear in Action Required. View now only shows documents assigned to the current user.
  • Unassigned fields not rendering — Legacy fields with null assignment correctly render in the PDF.
  • Billing: immediate charge on upgrade — Plan upgrades and add-on purchases now charge proration immediately instead of deferring to the next invoice.
  • Settings access — Fixed /settings being blocked for non-admin users.
  • TOTP login flow — Fixed 2FA verification being blocked by the API interceptor during login.
  • Email verification resend — Fixed resend verification endpoint missing auth headers.
  • Password change token refresh — Fixed token handling after password change to prevent unnecessary logouts.

v1.0.6

New Features

  • Hourly / time-slot leave booking — Employees can now book leave for specific time windows (e.g. 09:00 - 13:00) in addition to full or half days. The system calculates the leave fraction automatically based on the employee's work schedule.
  • Per-leave-type "Allow hourly booking" toggle — Admins and executives can enable or disable time-slot booking on each leave type individually from Leave Type settings. Enabled by default for Working from Home and Paid Sick Leave. Shows a warning if no organization schedule is configured, directing admins to Time & Projects settings.
  • Schedule-aware time slots — When booking hourly leave, the available start/end times are generated from the employee's assigned shift, personal work schedule, or organization default hours (15-minute intervals).
  • Half-day visual indicators — Calendar and dashboard views now show a gradient-filled half circle for half-day leaves: morning off shows the left half colored, afternoon off shows the right half colored. Time-based partial leaves show a proportional bottom-up gradient fill.
  • Half-day and hourly leave tooltips — Tooltips on calendar days and dashboard cells now display "(Morning)", "(Afternoon)", or the actual time range (e.g. "09:00 - 13:00") for partial-day leaves.

Improvements

  • Leave balance display — Balance summary values (allowance, used, carried over, remaining) now display rounded to 2 decimal places, supporting fractional day tracking from hourly bookings.
  • Leave request modal — User avatar and name now always shown in the modal header. Paid/Unpaid status displayed as a colored pill badge (green for paid, amber for unpaid) instead of inline text.
  • View mode for time-based leaves — Leave detail view now shows start/end times, total hours with day equivalent, and a proportional gradient fill on the leave type badge.

Bug Fixes

  • Expense tab disappearing — Fixed an issue where toggling Company Card Expenses or saving any expense setting caused the Expenses tab to disappear from the header navigation until page refresh.

v1.0.5

New Features

Introducing MCP for BookYourPTO

  • Connect your AI assistant (Claude Code, Cursor, Claude Desktop) to BookYourPTO and manage PTO, expenses, time tracking, and more through natural language
  • 28 tools across leave management, expense reports, time tracking, calendar, approvals, org settings, and user profiles
  • Secure OAuth 2.0 login — sign in via your browser, passwords never touch the AI
  • One-click authorize when already logged in, full login with 2FA support otherwise

In-App Support

  • Submit bug reports, feature requests, general issues, and security vulnerabilities directly from the app
  • Attach files and screenshots to your support tickets
  • Rate limiting to prevent spam

Bulk Scanning

  • Bulk receipt scanning with redesigned scanner UI

Company Card Expense Settings

  • Enable/disable company card expenses per organization via Expense Settings
  • Role-based access control: Admins can allow all roles to create company card reports, or restrict to admins/executives only
  • Optional approval workflow: Company card expenses can optionally require approval before being marked as paid. When disabled, admins can mark as paid directly from draft status

QuickBooks Bill Payment Sync

  • When an expense is marked as paid and a Payment Account is configured, a BillPayment is automatically created so bills show as "Paid" in QuickBooks
  • If a bill's total changes after the initial payment, the amount is automatically updated on re-sync
  • Multi-currency support: payment amounts now correctly match the QuickBooks bill total regardless of currency

Tax & Gratuity in QBO Bills

  • Line item descriptions in QBO now include a tax breakdown and gratuity amounts for full financial visibility

Gratuity/Tip Field

  • Added gratuity/tip input to the bulk receipt import scanner (desktop and mobile)
  • Gratuity field available on individual purchase add/edit forms

Bug Fixes

  • Fix PDF receipts not viewable in purchases tab and receipts tab — PDFs now render inline instead of showing as broken images
  • Fix avatar errors cascading across all pages — gracefully falls back to initials when avatar file is missing
  • Fix calendar header misalignment on mobile
  • Fix dashboard mobile view — stack avatar and name vertically to prevent name overflow onto calendar dates
  • Fix email verification failing after registration
  • Fix support form not pre-populating when opened from a direct link
  • Fix expense data (purchases, per diems, receipts) disappearing after submit, approve, reject, or mark-paid actions
  • Fix QuickBooks Payment Account selection not persisting after page refresh
  • Fix "Sync All" not updating existing bills in QuickBooks for paid reports
  • Fix BillPayment amounts not matching bill totals for multi-currency expenses
  • Fix "All" status pill count not matching the number of visible expense rows

Theming / White-Label

  • Replaced all hardcoded purple/violet colors with theme-aware primary colors across Company Card UI elements

Improvements

  • QuickBooks integration now shows official logo in navigation (full color when active, grayscale when inactive)
  • Fix QuickBooks connect failing in production due to missing environment variable mappings

v1.0.4

New Features

QuickBooks Online Integration

BookYourPTO now integrates directly with QuickBooks Online, bringing your leave management, expense tracking, and time tracking into your accounting workflow. Available on Business and Enterprise plans.

  • OAuth 2.0 Connection: Securely connect your QuickBooks Online company with a single click. Disconnect at any time — your QBO data is never modified without your explicit action.
  • Employee Sync: Sync your employee directory between BookYourPTO and QuickBooks Online. Smart conflict detection compares records and highlights differences, so you always know what will change before it happens.
  • Expense Report Push: When an expense report is approved, it can automatically be pushed to QuickBooks Online as a Bill. Vendors are auto-created for reimbursements, with duplicate name handling built in.
  • Time Entry Push: Approved time entries are pushed to QuickBooks Online as TimeActivities, keeping your billable hours in sync with your accounting records.
  • Chart of Accounts Mapping: Map your BookYourPTO expense categories to your QBO chart of accounts. Auto-map suggestions make initial setup quick — just review and confirm.
  • Department & Client Mapping: Map your BookYourPTO departments, clients, and projects to their corresponding QBO entities for accurate cost allocation.
  • Leave Liability Journal Entries: Generate and push leave liability journal entries to QBO, helping your finance team track accrued leave obligations.
  • Sync History & Audit Trail: Every sync operation is logged with full audit history. Filter by sync type, status, and date range. Paginated history view keeps everything accessible.
  • Scheduled Sync: A configurable cron-based sync keeps your data up to date automatically across all active connections.
  • Settings UI: A dedicated QuickBooks settings section with a 7-panel sidebar covering connection status, employee mapping, account mapping, department mapping, sync history, leave liability, and payroll — fully mobile responsive.

Timesheets Redesign with Calendar View

The timesheets module has been completely redesigned. The old time board has been replaced with a modern calendar view that gives you a clear, visual overview of your team's tracked hours across the week or month. Navigate between days, weeks, and months with ease, and see at a glance who logged what and when.

Leave & Holiday Integration in Timesheets

Approved leave requests and public holidays now appear directly in your timesheets — no more switching between modules to understand why someone wasn't logging hours.

  • Calendar view: A compact leave summary strip sits between day headers and the time grid, showing per-day leave pills. When 4 or more employees are on leave, it collapses to a clean "X on leave" summary with a hover tooltip listing everyone.
  • Calendar view: Public holidays are highlighted with emerald-colored labels and subtle column tints, so holiday days are instantly recognizable.
  • List view: Holiday badges appear on day cards, with an emerald banner for selected holidays and an amber leave summary showing employee name pills.
  • Mobile view: Holiday dots appear on day tabs with a leave count in each day header.
  • Top bar: New "on leave" and "holiday" summary stat chips give a quick snapshot.
  • CSV export: Enhanced with a new Type column (Time Entry / Leave / Holiday), leave rows include portion info, a holiday column, and a per-employee summary section at the bottom of the export.

Scheduling System Redesign & User Detail Page

The scheduling interface has been overhauled with a fresh design. A new /user/:id detail page gives managers and admins a dedicated view for any team member, consolidating their schedule, leave history, and profile information in one place.

Per-Leave-Type Privacy Controls

Leave types can now be marked as private, giving organizations control over which leave information is visible to other employees.

  • When a leave type is marked private, other employees will see a gray "Private" label with an eye-off icon instead of the leave type name, reason, or notes.
  • Role-based visibility: Employees see only their own leave details. Department heads see their own department. Admins and executives see everything.
  • Annual Leave and Sick Leave default to private during onboarding.
  • A new isPrivate toggle is available in the leave type create and edit forms.
  • Leave balance badges are hidden from unauthorized viewers for private leave types.

Digest Privacy Filtering

Email digests now respect per-leave-type privacy settings. Private leave types are masked in digest emails using the same role-based rules as the dashboard — employees only see their own private leave details, department heads see their department, and admins/executives see all.

Smart Digest Scheduling

Daily digests are now smarter about when they send:

  • Business day awareness: Digests skip non-business days based on your organization's configured business days (e.g., no digest on Saturday/Sunday if your org runs Mon–Fri).
  • Holiday awareness: Digests are also skipped on public holidays specific to each user's assigned holiday calendar.
  • Upcoming holidays: Daily digests now include an "Upcoming This Week" section with a green-highlighted list of public holidays in the next 7 days, so your team knows what's coming.

Redesigned Welcome Email Flow

When admins add new users, the experience is now cleaner and more secure:

  • New users receive a "Set Up Your Account" email with a secure 24-hour setup link instead of a temporary password.
  • A new dedicated /setup-account page provides a streamlined onboarding experience — simpler than the standard password reset flow.
  • The Add User modal no longer displays or copies passwords. The success state now shows a clear "setup email sent" confirmation.
  • Password change and account setup flows now issue fresh session tokens automatically, so users don't need to log out and back in after completing setup.

Department Head Leave Allowance Editing

Department heads can now edit leave allowance settings (custom allowance, carry forward, manual carry over) for members within their department, giving them more autonomy over day-to-day team management without needing to involve an admin.

Expense Submission Notifications

When any expense report is submitted, all administrators and executives in the organization now receive an in-app notification — not just the assigned approver. This ensures visibility across leadership and prevents expense reports from getting stuck in a single approver's queue.


Bug Fixes

Fixed: Date of Birth Displaying the Wrong Day

Dates of birth and start dates could appear one day off depending on the user's timezone (e.g., October 19 showing as October 18). This was caused by the browser interpreting UTC midnight dates in the local timezone. Dates are now displayed in UTC consistently for date-only fields, so the displayed date always matches what was entered.

Fixed: Department Heads Seeing Their Own Expense Claims in Approvals

Department heads and managers were seeing their own expense claims in the approvals list, inflating pending counts and creating confusion. Their own claims are now excluded from the approvals view — they'll only see claims from team members they can actually approve.

Fixed: Expense Approval Counts for Department Heads

The pending approvals badge count on the expenses page was computed from the general expense list, which for department heads included their own pending claims. The count is now derived from the dedicated approvals endpoint with proper role-based scoping.

Fixed: Expense Report Controls Visibility

Non-owners could see edit and delete controls on draft expense reports. These controls are now properly gated behind submitter or admin role checks.

Fixed: Expense Reports User Filter for Department Heads

The user dropdown on the expense reports page now correctly scopes to department members for department heads, instead of showing all organization users.

Fixed: Avatar PNG Upload Failing on Windows

PNG file uploads were failing on Windows because certain browsers report an empty MIME type for PNG files. The upload flow now falls back to file extension detection on the client, and the server uses magic byte detection to confirm the actual file format regardless of what the browser reports.

Fixed: Avatar Not Updating Immediately After Upload

After uploading a new avatar, the old image would persist until a page refresh. The avatar component now properly invalidates its cache after upload, and all instances across the page refresh immediately with the new image.

Fixed: Avatars Not Loading Across the App

Avatars were failing to load in various components because they were using raw storage keys as URLs instead of the authenticated API endpoint. All 18 components that render avatars now use the authenticated fetch path, with a shared blob URL cache to avoid redundant network requests.

Fixed: Avatars in Expense List Views

Expense cards and table rows were rendering broken avatar images. These now use the standard UserAvatar component with proper authenticated loading.

Fixed: App Randomly Getting Stuck on Loading Spinners

Users were experiencing a frustrating bug where parts of the app would get stuck on infinite loading spinners, requiring a manual page refresh (sometimes twice) to recover. This happened randomly across the entire app — dashboard, settings, documents, time tracking, everywhere.

What was happening: When multiple API requests fired simultaneously with an expired authentication token, the first request would successfully refresh the token, but late-arriving responses from other requests would trigger redundant refresh attempts. This cascade left some requests unresolved, causing permanent loading states.

What changed: The app now detects when a token has already been refreshed by another concurrent request and skips unnecessary refresh attempts. All pending requests silently retry with the new token. Additionally, authentication headers are now managed in a single place, ensuring retries always use the freshest token.

Impact: Pages now load completely and reliably every time. Users can leave the app open, come back after their session token expires, and their next action works seamlessly — no more random loading freezes.

Fixed: "Takes X Days" Preview Not Counting Business Days Correctly

The leave request modal's "Takes X days" preview was counting raw calendar days instead of business days. It now uses your organization's configured business days, timezone, and public holiday calendar to give an accurate count. This also fixes an issue where holidays could shift to the wrong day in western timezones due to UTC date conversion.

Fixed: Session Becoming Unresponsive After 2FA Setup

After completing two-factor authentication setup, all API calls would fail because the session still carried outdated authentication state. Users had to log out and log back in to get a working session. The system now issues a fresh session immediately after 2FA setup completes.

Fixed: Department Head User List Showing All Organization Users

The user management page was showing all organization users to department heads instead of only their department members. Additionally, action buttons (edit, etc.) weren't appearing even when the department head had permission. Both the filtering and permission checks now work correctly.

Fixed: Email Addresses Getting Truncated in User List

Long email addresses were getting cut off in the user table. The email column has been widened, and a native hover tooltip now reveals the full address. The Add User modal success summary also now shows the full email without overlapping adjacent fields.

Fixed: Weekly Digest Duration Labels

Weekly digest emails were showing redundant duration information for leave entries that span multiple days. The weekly view now shows the employee name and pending status badge only, since the same leave naturally repeats across multiple days in the weekly layout.

Fixed: Digest Date Calculations Using Wrong Timezone

Digest date range calculations were using UTC midnight instead of the organization's configured timezone, which could cause off-by-one errors in which leaves appeared in a given digest. Date calculations now consistently use the organization's timezone.

Fixed: Settings Page Not Loading After 2FA Setup

The settings page could fail to load in certain scenarios after completing 2FA setup due to a route matching issue. The route matcher now correctly handles both the settings root and all sub-routes.

Fixed: Settings Navigation Items Briefly Showing Locked State

Settings navigation items would briefly flash lock icons on page load before the subscription data finished loading. The feature-locked check is now deferred until the subscription data is available, eliminating the visual flicker.

Fixed: Stale Authentication in Time Tracking and Expense Settings

The time tracking settings and expense settings pages were capturing authentication tokens at call time instead of using the app's automatic token injection. This meant that after a token refresh, these pages would retry with the old expired token. They now use the standard automatic authentication flow.


For questions or feedback about this release, contact support@anhourtec.com.

v1.0.3

New Features

Per-User Holiday Override Toggle

  • Added a "Use custom holidays instead of organization defaults" toggle to the Edit User > Holiday Overrides tab
  • When enabled, the user no longer follows the organization's public holidays — admins can configure a custom country, exclude specific holidays, or add custom ones
  • When disabled, the toggle clears any previously set custom holiday country/region and the user reverts to organization defaults
  • Dashboard calendar, leave requests, public holidays, and email digests all respect the new setting

Carry-Over Expiry Date

  • The carry-over balance now supports an optional expiry date — expired carry-over days are automatically excluded from balance calculations
  • Expiry is evaluated using the organization's timezone to prevent off-by-one date issues across time zones
  • The expiry date is cleared automatically when carry-over balance is set to zero

Improved Leave Balance Calculations

  • Manual carry-over adjustments are now included on top of automated carry-forward calculations in balance views
  • User-specific carry-forward day limits now correctly override the organization-level cap
  • Carry-forward eligibility threshold is now exposed in organization settings for accurate frontend display

Bug Fixes

Date of Birth Timezone Handling

  • Fixed date of birth shifting by one day in western timezones (e.g., Feb 25 displaying as Feb 24) by using the organization's timezone instead of UTC
  • Prevented selecting future dates in the date of birth picker

Department Filter Toggle

  • Fixed the users filter modal where unchecking "All departments" did not deselect individual department checkboxes

Leave Balance Carry-Forward Edge Case

  • Fixed an issue where setting a user's custom leave allowance to 0 was incorrectly treated as "use organization default" instead of zero

Guided Tour Popover Appearing After Logout

  • Fixed guided tour popovers occasionally persisting on the login page after signing out
  • Tour state is now fully reset on logout, preventing stale tour data from carrying over between sessions

Improvements

Quick Edit via Avatar Click

  • Clicking a user's avatar on the Users page now opens their Edit Profile modal directly
  • Available for Administrators, Executives, and Department Heads (restricted to their own department members)

Leave Allowance Tab

  • Simplified the Edit User leave allowance tab with a cleaner, settings-focused layout

SSO Domain Validation

  • Added validation to prevent public email domains (e.g., gmail.com, yahoo.com) from being added to SSO allowed domains
  • Instant client-side feedback with inline error messages

Plan Downgrade Handling

  • Paid integrations (notification channels, calendar sync) now gracefully pause when an organization downgrades and automatically resume on re-upgrade without losing configuration

v1.0.2

BookYourPTO v1.0.2 — Release Notes

Trusted Devices — Skip 2FA for 30 Days
Employees can now check "Remember this device for 30 days" when logging in with 2FA. Trusted devices can be viewed and revoked anytime from Settings > Trusted Devices. Disabling 2FA automatically revokes all trusted devices.

Slack & Teams Notifications Get your BookYourPTO notifications delivered straight to Slack or Microsoft Teams.

  • Personal: Each employee can connect their own webhook in Settings > Connected Apps > Slack & Teams to receive personal notifications (leave approvals, rejections, etc.)
  • Organization-wide: Admins can set up a shared channel for team notifications in Settings > Notifications Channel — pick which notification types get posted

Settings Redesign Calendar Integration and Slack & Teams are now combined under a single "Connected Apps" tab with a cleaner tabbed layout.

v1.0.1

Birthday Indicators

  • Users with a date of birth now see a 🎂 pink cake icon on their birthday in the /calendar yearly view and dashboard calendar grid
  • Hovering shows a "Birthday" tooltip (dashboard shows full name)
  • Birthday cells get a subtle pink border and background highlight

Balance Display Settings

  • Dashboard badge — controls which leave balance is shown on each user's avatar badge (Annual / Sick / Both)
  • Calendar balance summary — controls which leave buckets appear in the calendar sidebar (Annual / Sick / Both)
  • Configurable from Settings > General by administrators and executives

Birthday Reminder Emails

  • Monthly cron endpoint sends a birthday digest email on the 1st of each month to admins, executives, and department heads
  • Lists all team birthdays sorted by date with name, department, and date
  • Department heads only receive birthdays from their own department

Dashboard UX Improvements

  • User names in the dashboard are now clickable links to their /calendar page (for admins, executives, and same-department heads)
  • Weekend columns have consistent muted background across the full column height

v1.0.0

We're excited to announce the first official release of BookYourPTO — an all-in-one leave, time tracking, expense, and document management platform for modern teams.

Available as an open-source community edition for self-hosting and a cloud-hosted version with Pro, Business, and Enterprise plans at bookyourpto.com.

Development began on December 22, 2025, and v1.0.0 marks the culmination of six weeks of active development.


Core Platform (All Plans)

Leave Management

  • Submit, approve, reject, and cancel leave requests with full workflow support
  • Configurable leave types with custom allowances and accrual rules
  • Leave balance tracking with fiscal year awareness
  • Leave approvals and policies
  • Dashboard calendar with monthly navigation and team-wide visibility
  • Leave transaction audit trail

Time Tracking

  • Clock in/out with real-time timer
  • Manual time entry creation, editing, and deletion
  • Project and task management with client association
  • Billable hours tracking
  • Work schedules with customizable shift patterns
  • Timesheet approvals with individual and bulk actions
  • Geolocation capture for clock-in/out events

Expense Management

  • Expense submission with AI-powered receipt scanning
  • Mileage and per diem expense types
  • Receipt upload with secure access via short-lived Redis tokens
  • Expense approval workflow
  • Expense reports with filtering and export

Digital Document Signing

  • Upload and assign documents to single or multiple recipients
  • ESIGN Act compliant digital signature capture
  • Searchable documents with OCR
  • Document preview, view, sign, and decline workflows
  • Browser timezone capture displayed on signed documents
  • Document encryption for sensitive files

Notifications

  • In-app notification system with real-time bell indicator
  • Notifications for leave submissions, approvals, rejections, and cancellations
  • Notification management page with mark-as-read, clear-all actions
  • Pending items widget on dashboard with role-based display

Reports & Exports

  • Leave usage reports with filtering and export
  • Timesheet reports with date range selection
  • Time tracking billing reports
  • Security audit log export (CSV)
  • Sign-in log export

Calendar Integrations

  • Google Calendar sync for approved leave events
  • Microsoft Outlook calendar integration
  • iCal feed support for any calendar application

Role-Based Access Control

  • Four roles: Employee, Department Head, Administrator, Executive
  • Department Head role for team-level approvals and oversight
  • Role-based permissions across all modules
  • Granular permissions system with per-user overrides
  • Designate approvers with cross-department approval capabilities
  • Locked dates to prevent bookings on specific dates (admin/executive controlled)
  • Executive override for booking on locked dates
  • Project member roles: Owner, Manager, Member

Authentication & Security

  • JWT-based authentication with refresh token rotation
  • Force password change on first login
  • Redis rate limiting on authentication endpoints
  • Token audit logging
  • Sign-in logs with export

Pro Plan Features

  • Up to 10 users
  • 500 receipts/month
  • 1,000 documents with OCR
  • Email support

Business Plan Features

  • Up to 30 users
  • Unlimited receipts and documents with OCR
  • Advanced approval workflows
  • Custom reports
  • Email digest notification system with daily/weekly scheduling
  • Multi-currency expense support with role-based visibility

White-Labeling

  • Branding settings with logo, colors, and theme configuration
  • Domain-specific branding (custom domains show org branding)
  • Branding API with cache-control headers

Auth0 Integration (OIDC)

  • Enterprise Single Sign-On via Auth0
  • Configurable "Enable Auth0" and "Require Auth0 Login" settings
  • SSO enforcement option for organizations
  • Auto-create users on first SSO login with configurable default role and department

Audit Logs

  • Comprehensive audit logs with entity types for all modules
  • Security violations tracking and management
  • Time tracking compliance dashboard

Custom Domains

  • Custom domain support with DNS verification
  • Single custom domain per organization enforcement
  • Public branding endpoint for unauthenticated access

Priority Support

Enterprise Plan Features

  • Unlimited users
  • Everything in Business
  • Custom limits
  • Dedicated support
  • SLA guarantee

Stripe Billing

  • Subscription management with plan-based feature gating
  • Checkout session creation with discount/coupon support
  • Invoice tracking and billing history
  • Webhook processing with idempotency protection
  • Plan limits enforced across all API endpoints
  • Plan-based UI gating in settings
  • Refund processing with hardened input validation
  • Free plan default for new organizations

Email System

  • Configurable SMTP settings per organization
  • Test email functionality for verifying configuration
  • Branded email templates with organization logo support
  • Fallback to platform SMTP logo when org has no custom logo
  • Email notifications for leave workflows, document assignments, and more

Organization & Multi-Tenancy

  • Multi-tenant architecture with organization-scoped data isolation
  • Organization onboarding workflow
  • Department management (create, update, delete)
  • User management with role-based access control (Employee, Department Head, Administrator, Executive)
  • Organization statistics dashboard
  • Data backup/export endpoint

Public Holidays

  • Country-based public holiday management
  • Regional subdivision holiday support
  • Per-user holiday override system
  • Dashboard calendar displays user-specific holidays

Infrastructure & Deployment

  • Docker containerization with multi-stage builds
  • Docker Compose with PostgreSQL, Redis, and application services
  • Environment variable configuration for all services (Stripe, SMTP, OAuth)
  • Persistent document storage via Docker volumes
  • Nuxt 3 full-stack framework
  • Prisma ORM with PostgreSQL
  • Redis for caching, rate limiting, and session management
  • Cloudflare integration for domain management

UI/UX

  • Responsive design across all pages (mobile, tablet, desktop)
  • Dark/light mode support
  • App Launcher navigation for unified approvals and reports
  • Sticky dashboard calendar with team visibility
  • Custom modal components with scroll support and mobile optimization
  • Area charts for analytics visualization