From 58157a28655ed5552d8bb721f4afc584d5a50dc6 Mon Sep 17 00:00:00 2001
From: Jonas Millard <jonas.millard@gmail.com>
Date: Fri, 3 Jul 2026 09:54:32 +0200
Subject: [PATCH] =?UTF-8?q?feat:=20rollanpassat=20UI,=20korrekta=20beh?=
 =?UTF-8?q?=C3=B6righeter/scoping=20och=20mobiloptimering?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Svarar på tre frågor: ser varje roll rätt UI, har de rätt behörigheter,
och är appen mobilanpassad. Bygge grönt, tester gröna.

Roll-anpassat UI:
- Startsidan (Home.razor) är nu rollmedveten: Anställd ser personligt
  (saldon, att-göra, nästa pass, senaste lönespec) — INTE org-KPI:er som
  tidigare; Chef ser enhets-scopad chefsöversikt; HR ser org-överblick;
  Admin ser driftöversikt.
- Fixade tre scoping-läckor: MinSida/TotalRewards visade första anställdas
  lön till användare utan profil; Chef/OneOnOne satte slumpmässigt chef-id
  och visade alla chefers möten; Chef/Scorecard visade godtycklig chefs
  styrkort. Alla nu scopade till inloggad användare.

Behörigheter/scoping:
- Chef kunde nå hela organisationens löner via rapportvägen
  (lönetransparens/lönekartering/FlightRisk/rapportkörare) — nu spärrat i
  RouteAccessPolicy.
- UnitScopeService var fail-open (chef utan enhet såg alla) → fail-closed.
- Kompetens/Medarbetarsamtal/Tidrapporter saknade enhets-scoping — chef såg
  alla ~11 000 → scopat till chefens enhet.
- NavMenu rättad per roll (anställd ser inte LAS/lönetransparens; självservice
  och utbildning/resor synliga för anställd).
- /auth/oidc/complete och /utbildning/externa fått korrekta regler.

Mobiloptimering:
- Sidomenyn gick inte att öppna på mobil (ingen hamburgare) → åtgärdat,
  drawer temporär på små skärmar, persistent på desktop.
- Bottennavigering renderas nu (BottomNav.razor) på mobil.
- Viewport tillåter zoom + safe-area; MudTable får horisontell scroll på
  mobil; touch-vänliga mål. PWA-manifest-ikoner (192/512) tillagda.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114SipfUPpV6WRPh9jMRfUL
---
 src/Web/Components/App.razor                  |   5 +-
 src/Web/Components/Layout/AdminLayout.razor   |  14 +-
 src/Web/Components/Layout/BottomNav.razor     |  39 +
 src/Web/Components/Layout/NavMenu.razor       |  28 +-
 src/Web/Components/Layout/Shared/TopBar.razor |   8 +-
 src/Web/Components/Pages/Chef/Index.razor     |  16 +-
 src/Web/Components/Pages/Chef/OneOnOne.razor  |  63 +-
 src/Web/Components/Pages/Chef/Scorecard.razor |  27 +-
 src/Web/Components/Pages/Home.razor           | 677 +++++++++++++++---
 .../Components/Pages/Kompetens/Index.razor    |  14 +-
 .../Pages/Medarbetarsamtal/Index.razor        |  13 +-
 .../Pages/MinSida/TotalRewards.razor          |  35 +-
 .../Pages/Rapporter/FlightRisk.razor          |  15 +-
 .../Pages/Rapporter/KorRapport.razor          |  15 +
 .../Components/Pages/Tidrapporter/Index.razor |  13 +-
 src/Web/Services/RouteAccessPolicy.cs         |  19 +-
 src/Web/Services/UnitScopeService.cs          |  35 +-
 src/Web/wwwroot/css/mobile.css                |  34 +-
 src/Web/wwwroot/css/pwa-enhancements.css      |   8 +
 src/Web/wwwroot/icon-192.png                  | Bin 0 -> 2778 bytes
 src/Web/wwwroot/icon-512.png                  | Bin 0 -> 7754 bytes
 .../Pages/HomeDashboardVariantTests.cs        |  50 ++
 tests/Web.Tests/RouteAccessPolicyTests.cs     |  52 ++
 23 files changed, 982 insertions(+), 198 deletions(-)
 create mode 100644 src/Web/Components/Layout/BottomNav.razor
 create mode 100644 src/Web/wwwroot/icon-192.png
 create mode 100644 src/Web/wwwroot/icon-512.png
 create mode 100644 tests/Web.Tests/Pages/HomeDashboardVariantTests.cs

diff --git a/src/Web/Components/App.razor b/src/Web/Components/App.razor
index 0a155eb..9206f66 100644
--- a/src/Web/Components/App.razor
+++ b/src/Web/Components/App.razor
@@ -2,7 +2,7 @@
 <html lang="sv">
 <head>
     <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
     <title>OpenHR</title>
     <base href="/" />
     <link href="_content/MudBlazor/MudBlazor.min.css" rel="stylesheet" />
@@ -15,7 +15,8 @@
     <link rel="stylesheet" href="css/performance.css" />
     <link rel="stylesheet" href="css/pwa-enhancements.css" />
     <link rel="manifest" href="/manifest.json" />
-    <meta name="theme-color" content="#0e7490" />
+    <meta name="theme-color" content="#0e7490" media="(prefers-color-scheme: light)" />
+    <meta name="theme-color" content="#0d1117" media="(prefers-color-scheme: dark)" />
     <meta name="apple-mobile-web-app-capable" content="yes" />
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
     <meta name="apple-mobile-web-app-title" content="OpenHR" />
diff --git a/src/Web/Components/Layout/AdminLayout.razor b/src/Web/Components/Layout/AdminLayout.razor
index 7ff79ed..39853d7 100644
--- a/src/Web/Components/Layout/AdminLayout.razor
+++ b/src/Web/Components/Layout/AdminLayout.razor
@@ -29,10 +29,13 @@
         <MudLayout>
             <TopBar UserName="@(Auth.UserName!)" UnreadCount="5"
                     IsDarkMode="_isDarkMode"
-                    IsDarkModeChanged="OnDarkModeToggled" />
+                    IsDarkModeChanged="OnDarkModeToggled"
+                    OnHamburgerClick="ToggleDrawer" />
+            @* Responsive: temporär overlay-drawer under Md (960px), persistent på desktop.
+               Hamburger-knappen i TopBar öppnar/stänger den. *@
             <MudDrawer @bind-Open="_drawerOpen" Variant="DrawerVariant.Responsive"
                        Elevation="1" ClipMode="DrawerClipMode.Always"
-                       Breakpoint="Breakpoint.Lg">
+                       Breakpoint="Breakpoint.Md">
                 <NavMenu />
             </MudDrawer>
             <MudMainContent Class="pt-16" id="main-content" role="main">
@@ -49,6 +52,8 @@
                     }
                 </MudContainer>
             </MudMainContent>
+            @* Bottennavigering — visas endast på mobil (< 960px) via CSS. *@
+            <BottomNav UnreadCount="5" />
             <RegionHR.Web.Components.Shared.OhrAssistant />
         </MudLayout>
     }
@@ -62,6 +67,11 @@
     private bool _drawerOpen = true;
     private bool _isDarkMode;
 
+    private void ToggleDrawer()
+    {
+        _drawerOpen = !_drawerOpen;
+    }
+
     protected override void OnInitialized()
     {
         Nav.LocationChanged += OnLocationChanged;
diff --git a/src/Web/Components/Layout/BottomNav.razor b/src/Web/Components/Layout/BottomNav.razor
new file mode 100644
index 0000000..17815a6
--- /dev/null
+++ b/src/Web/Components/Layout/BottomNav.razor
@@ -0,0 +1,39 @@
+@namespace RegionHR.Web.Components.Layout
+@using Microsoft.AspNetCore.Components.Routing
+
+@* ────────────────────────────────────────────────────────────
+   Bottennavigering för mobil. Döljs på desktop via CSS
+   (.ohr-bottom-nav i pwa-enhancements.css, display:none som default,
+   display:flex under 960px). Ger snabb åtkomst till de vanligaste
+   anställd-flödena. NavLink lägger på klassen "active" automatiskt.
+   ──────────────────────────────────────────────────────────── *@
+<nav class="ohr-bottom-nav" aria-label="Snabbnavigering">
+    <NavLink class="ohr-bottom-nav-item" href="/" Match="NavLinkMatch.All">
+        <MudIcon Icon="@Icons.Material.Filled.Home" Class="ohr-bottom-nav-icon" Size="Size.Medium" />
+        <span class="ohr-bottom-nav-label">Start</span>
+    </NavLink>
+    <NavLink class="ohr-bottom-nav-item" href="/minsida" Match="NavLinkMatch.Prefix">
+        <MudIcon Icon="@Icons.Material.Filled.AccountCircle" Class="ohr-bottom-nav-icon" Size="Size.Medium" />
+        <span class="ohr-bottom-nav-label">Min sida</span>
+    </NavLink>
+    <NavLink class="ohr-bottom-nav-item" href="/minsida/schema" Match="NavLinkMatch.All">
+        <MudIcon Icon="@Icons.Material.Filled.CalendarMonth" Class="ohr-bottom-nav-icon" Size="Size.Medium" />
+        <span class="ohr-bottom-nav-label">Schema</span>
+    </NavLink>
+    <NavLink class="ohr-bottom-nav-item" href="/ledighet" Match="NavLinkMatch.All">
+        <MudIcon Icon="@Icons.Material.Filled.BeachAccess" Class="ohr-bottom-nav-icon" Size="Size.Medium" />
+        <span class="ohr-bottom-nav-label">Ledighet</span>
+    </NavLink>
+    <NavLink class="ohr-bottom-nav-item" href="/notiser" Match="NavLinkMatch.Prefix">
+        <MudIcon Icon="@Icons.Material.Filled.Notifications" Class="ohr-bottom-nav-icon" Size="Size.Medium" />
+        @if (UnreadCount > 0)
+        {
+            <span class="ohr-badge">@(UnreadCount > 99 ? "99+" : UnreadCount.ToString())</span>
+        }
+        <span class="ohr-bottom-nav-label">Notiser</span>
+    </NavLink>
+</nav>
+
+@code {
+    [Parameter] public int UnreadCount { get; set; }
+}
diff --git a/src/Web/Components/Layout/NavMenu.razor b/src/Web/Components/Layout/NavMenu.razor
index 01edda8..98953eb 100644
--- a/src/Web/Components/Layout/NavMenu.razor
+++ b/src/Web/Components/Layout/NavMenu.razor
@@ -73,13 +73,26 @@
         <MudNavLink Href="/kompetens/endorsements">@L["Endorsements"]</MudNavLink>
     </MudNavGroup>
 
+    @* Självservice: förmåner, utbildning och resor är nåbara för ALLA inloggade
+       (RouteAccessPolicy: /formaner/*, /utbildning, /resor = AllaInloggade). Låg tidigare
+       gömda i chefsblocket → en anställd saknade menyväg till sina egna förmåner. *@
+    <MudNavGroup Title="@L["Benefits"]" Icon="@Icons.Material.Filled.CardGiftcard"
+                 Expanded="@_formanerOpen" ExpandedChanged="@(v => _formanerOpen = v)">
+        <MudNavLink Href="/formaner">@L["BenefitsOverview"]</MudNavLink>
+        <MudNavLink Href="/formaner/enrollment">@L["BenefitsEnrollment"]</MudNavLink>
+        <MudNavLink Href="/formaner/val">@L["OpenEnrollment"]</MudNavLink>
+        <MudNavLink Href="/formaner/livshandelse">@L["LifeEvent"]</MudNavLink>
+        <MudNavLink Href="/formaner/sammanstallning">@L["BenefitsSummary"]</MudNavLink>
+    </MudNavGroup>
+    <MudNavLink Href="/utbildning" Icon="@Icons.Material.Filled.School">Utbildning</MudNavLink>
+    <MudNavLink Href="/resor" Icon="@Icons.Material.Filled.Flight">Resor</MudNavLink>
+
     @if (Auth.IsInitialized && Auth.IsChef)
     {
         <MudNavLink Href="/godkannanden" Icon="@Icons.Material.Filled.CheckCircle">@L["Approvals"]</MudNavLink>
         <MudNavLink Href="/journeys" Icon="@Icons.Material.Filled.Route">@L["EmployeeJourneys"]</MudNavLink>
         <MudNavLink Href="/halsosam" Icon="@Icons.Material.Filled.LocalHospital">@L["HalsoSAM"]</MudNavLink>
         <MudNavLink Href="/arbetsmiljo" Icon="@Icons.Material.Filled.Shield">@L["WorkEnvironment"]</MudNavLink>
-        <MudNavLink Href="/las" Icon="@Icons.Material.Filled.Warning">@L["LAS"]</MudNavLink>
         <MudNavLink Href="/dokument" Icon="@Icons.Material.Filled.Description">@L["Documents"]</MudNavLink>
         <MudNavLink Href="/medarbetarsamtal" Icon="@Icons.Material.Filled.RecordVoiceOver">@L["PerformanceReviews"]</MudNavLink>
         <MudNavLink Href="/chef/1-1" Icon="@Icons.Material.Filled.Forum">1:1-möten</MudNavLink>
@@ -89,14 +102,6 @@
             <MudNavLink Href="/rekrytering/vakanser">@L["Vacancies"]</MudNavLink>
             <MudNavLink Href="/rekrytering/talangpool">@L["TalentPool"]</MudNavLink>
         </MudNavGroup>
-        <MudNavGroup Title="@L["Benefits"]" Icon="@Icons.Material.Filled.CardGiftcard"
-                     Expanded="@_formanerOpen" ExpandedChanged="@(v => _formanerOpen = v)">
-            <MudNavLink Href="/formaner">@L["BenefitsOverview"]</MudNavLink>
-            <MudNavLink Href="/formaner/enrollment">@L["BenefitsEnrollment"]</MudNavLink>
-            <MudNavLink Href="/formaner/val">@L["OpenEnrollment"]</MudNavLink>
-            <MudNavLink Href="/formaner/livshandelse">@L["LifeEvent"]</MudNavLink>
-            <MudNavLink Href="/formaner/sammanstallning">@L["BenefitsSummary"]</MudNavLink>
-        </MudNavGroup>
         <MudNavGroup Title="@L["Reports"]" Icon="@Icons.Material.Filled.BarChart"
                      Expanded="@_rapporterOpen" ExpandedChanged="@(v => _rapporterOpen = v)">
             <MudNavLink Href="/rapporter">@L["ReportLibrary"]</MudNavLink>
@@ -105,7 +110,6 @@
             <MudNavLink Href="/rapporter/prediktion">@L["PredictiveAnalysis"]</MudNavLink>
             <MudNavLink Href="/rapporter/workforce-plan">@L["WorkforcePlanning"]</MudNavLink>
             <MudNavLink Href="/rapporter/flight-risk">@L["FlightRisk"]</MudNavLink>
-            <MudNavLink Href="/rapporter/lonetransparens">@L["PayTransparency"]</MudNavLink>
             <MudNavLink Href="/rapporter/scenarioplanering">@L["ScenarioPlanning"]</MudNavLink>
         </MudNavGroup>
         <MudNavGroup Title="@L["ContractStaff"]" Icon="@Icons.Material.Filled.GroupWork"
@@ -152,6 +156,10 @@
             <MudNavLink Href="/admin/formaner/perioder">@L["EnrollmentPeriods"]</MudNavLink>
         </MudNavGroup>
         <MudNavLink Href="/admin/ona" Icon="@Icons.Material.Filled.Hub">Nätverksanalys (ONA)</MudNavLink>
+        @* HR/Admin-only: LAS-hantering och lönetransparens (flyttade hit ur chefsblocket —
+           chef nekas dessa i RouteAccessPolicy och ska därför inte se dem i menyn). *@
+        <MudNavLink Href="/las" Icon="@Icons.Material.Filled.Warning">@L["LAS"]</MudNavLink>
+        <MudNavLink Href="/rapporter/lonetransparens" Icon="@Icons.Material.Filled.Insights">@L["PayTransparency"]</MudNavLink>
         <MudNavLink Href="/gdpr" Icon="@Icons.Material.Filled.Security">@L["GDPR"]</MudNavLink>
         <MudNavLink Href="/audit" Icon="@Icons.Material.Filled.History">@L["AuditLog"]</MudNavLink>
     }
diff --git a/src/Web/Components/Layout/Shared/TopBar.razor b/src/Web/Components/Layout/Shared/TopBar.razor
index e205b47..9e012a6 100644
--- a/src/Web/Components/Layout/Shared/TopBar.razor
+++ b/src/Web/Components/Layout/Shared/TopBar.razor
@@ -5,9 +5,14 @@
 @using RegionHR.Web
 
 <MudAppBar Fixed="true" Color="Color.Primary" Elevation="1">
+    @if (OnHamburgerClick.HasDelegate)
+    {
+        <MudIconButton Icon="@Icons.Material.Filled.Menu" Color="Color.Inherit" Edge="Edge.Start"
+                       OnClick="OnHamburgerClick" aria-label="Växla sidomeny" />
+    }
     <MudText Typo="Typo.h6" Class="ml-3" Style="font-weight: 700; cursor: pointer;" @onclick="@(() => Nav?.NavigateTo("/"))">OpenHR</MudText>
 
-    <div style="margin-left: 1rem; max-width: 320px; flex: 1;">
+    <div class="ohr-appbar-search" style="margin-left: 1rem; max-width: 320px; flex: 1;">
         <MudAutocomplete T="string" Placeholder="@L["Search"]"
                          SearchFunc="Search" Variant="Variant.Filled" Dense="true"
                          Style="background: rgba(255,255,255,0.15); border-radius: 8px;"
@@ -74,6 +79,7 @@
     [Parameter] public int UnreadCount { get; set; }
     [Parameter] public bool IsDarkMode { get; set; }
     [Parameter] public EventCallback<bool> IsDarkModeChanged { get; set; }
+    [Parameter] public EventCallback OnHamburgerClick { get; set; }
 
     private string _currentLang = "sv";
     private List<string> _recentSearches = new();
diff --git a/src/Web/Components/Pages/Chef/Index.razor b/src/Web/Components/Pages/Chef/Index.razor
index 71e2e3a..3a90654 100644
--- a/src/Web/Components/Pages/Chef/Index.razor
+++ b/src/Web/Components/Pages/Chef/Index.razor
@@ -162,12 +162,16 @@ else if (!_loading)
                 ? franvaroAll.Count
                 : franvaroAll.Count(r => scopeIds.Contains(r.AnstallId));
 
-            // Coaching nudges
-            _nudges = await db.CoachingNudges
-                .Where(n => !n.ArLast)
-                .OrderByDescending(n => n.SkapadVid)
-                .Take(5)
-                .ToListAsync();
+            // Coaching nudges — bara den inloggade chefens egna (CoachingNudge.ChefId),
+            // aldrig en annan chefs insikter. Admin/HR utan chefskoppling får inga.
+            if (Auth.EmployeeId is Guid chefId)
+            {
+                _nudges = await db.CoachingNudges
+                    .Where(n => !n.ArLast && n.ChefId == chefId)
+                    .OrderByDescending(n => n.SkapadVid)
+                    .Take(5)
+                    .ToListAsync();
+            }
         }
         catch (Exception ex) { _error = $"Kunde inte hämta data: {ex.Message}"; }
         finally { _loading = false; }
diff --git a/src/Web/Components/Pages/Chef/OneOnOne.razor b/src/Web/Components/Pages/Chef/OneOnOne.razor
index 78d2a70..ddc6481 100644
--- a/src/Web/Components/Pages/Chef/OneOnOne.razor
+++ b/src/Web/Components/Pages/Chef/OneOnOne.razor
@@ -2,8 +2,12 @@
 @layout RegionHR.Web.Components.Layout.AdminLayout
 @using RegionHR.Infrastructure.Persistence
 @using RegionHR.Performance.Domain
+@using RegionHR.SharedKernel.Domain
+@using RegionHR.Web.Services
 @using Microsoft.EntityFrameworkCore
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
+@inject AuthService Auth
+@inject UnitScopeService Scope
 @inject ISnackbar Snackbar
 
 <PageTitle>OpenHR - 1:1-möten</PageTitle>
@@ -37,8 +41,12 @@
             <MudTextField Label="Agenda (valfri)" @bind-Value="_nyAgenda" Variant="Variant.Outlined" />
         </MudItem>
     </MudGrid>
+    @if (Auth.EmployeeId == null)
+    {
+        <MudAlert Severity="Severity.Warning" Dense="true" Class="mt-3">Bokning kräver en kopplad chefsprofil — logga in med en chef.</MudAlert>
+    }
     <MudButton Variant="Variant.Filled" Color="Color.Primary" Class="mt-3" Style="min-height: 44px;"
-               OnClick="SkapaMote" Disabled="@(_nyAnstallId == Guid.Empty)">Boka möte</MudButton>
+               OnClick="SkapaMote" Disabled="@(_nyAnstallId == Guid.Empty || Auth.EmployeeId == null)">Boka möte</MudButton>
 </MudPaper>
 
 @* === UPCOMING MEETINGS === *@
@@ -148,7 +156,17 @@ else
         await using var db = await DbFactory.CreateDbContextAsync();
         try
         {
-            var emps = await db.Employees.OrderBy(e => e.Efternamn).Take(200).ToListAsync();
+            // Medarbetar-listan scopas till chefens EGET team (UnitScopeService).
+            // En chef ska bara kunna boka 1:1 med sina egna medarbetare — inte hela
+            // organisationen. HR/Admin (null scope) ser alla, som tidigare.
+            var scopeIds = await Scope.GetEmployeeIdsInScopeAsync();
+            IQueryable<RegionHR.Core.Domain.Employee> empQuery = db.Employees;
+            if (scopeIds is not null)
+            {
+                var scopeEmpIds = scopeIds.Select(g => EmployeeId.From(g)).ToList();
+                empQuery = empQuery.Where(e => scopeEmpIds.Contains(e.Id));
+            }
+            var emps = await empQuery.OrderBy(e => e.Efternamn).Take(500).ToListAsync();
             _employees = emps.Select(e => (e.Id.Value, $"{e.Fornamn} {e.Efternamn}")).ToList();
             _employeeNames = emps.ToDictionary(e => e.Id.Value, e => $"{e.Fornamn} {e.Efternamn}");
 
@@ -160,29 +178,56 @@ else
     private async Task LaddaData()
     {
         await using var db = await DbFactory.CreateDbContextAsync();
-        var now = DateTime.UtcNow;
-        _upcoming = await db.OneOnOneMeetings
+
+        // Möten scopas till den inloggade chefens egna (OneOnOneMeeting.ChefId).
+        // Tidigare visades ALLA chefers 1:1-möten och deras privata anteckningar.
+        // Admin utan kopplad profil (ChefId saknas) faller tillbaka på att visa alla.
+        IQueryable<OneOnOneMeeting> baseQ = db.OneOnOneMeetings;
+        if (Auth.EmployeeId is Guid chefId)
+            baseQ = baseQ.Where(m => m.ChefId == chefId);
+
+        _upcoming = await baseQ
             .Where(m => m.Status == MeetingStatus.Scheduled)
             .OrderBy(m => m.Datum).Take(50).ToListAsync();
 
-        _past = await db.OneOnOneMeetings
+        _past = await baseQ
             .Where(m => m.Status != MeetingStatus.Scheduled)
             .OrderByDescending(m => m.Datum).Take(50).ToListAsync();
 
-        _actionItems = await db.MeetingActionItems
-            .Where(a => a.Status != ActionItemStatus.Done)
-            .OrderBy(a => a.Deadline).Take(50).ToListAsync();
+        // Åtgärdspunkter begränsas till chefens egna möten.
+        if (Auth.EmployeeId is Guid cid)
+        {
+            var myMeetingIds = await db.OneOnOneMeetings
+                .Where(m => m.ChefId == cid).Select(m => m.Id).ToListAsync();
+            _actionItems = await db.MeetingActionItems
+                .Where(a => a.Status != ActionItemStatus.Done && myMeetingIds.Contains(a.MeetingId))
+                .OrderBy(a => a.Deadline).Take(50).ToListAsync();
+        }
+        else
+        {
+            _actionItems = await db.MeetingActionItems
+                .Where(a => a.Status != ActionItemStatus.Done)
+                .OrderBy(a => a.Deadline).Take(50).ToListAsync();
+        }
     }
 
     private string GetNamn(Guid id) => _employeeNames.GetValueOrDefault(id, "Okänd");
 
     private async Task SkapaMote()
     {
+        // Mötet måste ägas av den inloggade chefen (ChefId) — annars går det inte
+        // att scopa listan till "mina möten". Tidigare sattes ett slumpmässigt
+        // Guid.NewGuid() som chef, vilket frikopplade varje möte från sin chef.
+        if (Auth.EmployeeId is not Guid chefId)
+        {
+            _error = "Bokning kräver en kopplad chefsprofil — logga in med en chef.";
+            return;
+        }
         await using var db = await DbFactory.CreateDbContextAsync();
         try
         {
             var datum = _nyDatum ?? DateTime.Today.AddDays(7);
-            var meeting = OneOnOneMeeting.Skapa(Guid.NewGuid(), _nyAnstallId, datum, _nyAgenda);
+            var meeting = OneOnOneMeeting.Skapa(chefId, _nyAnstallId, datum, _nyAgenda);
             await db.OneOnOneMeetings.AddAsync(meeting);
             await db.SaveChangesAsync();
             Snackbar.Add("Möte bokat!", Severity.Success);
diff --git a/src/Web/Components/Pages/Chef/Scorecard.razor b/src/Web/Components/Pages/Chef/Scorecard.razor
index 6ff5729..89b74fa 100644
--- a/src/Web/Components/Pages/Chef/Scorecard.razor
+++ b/src/Web/Components/Pages/Chef/Scorecard.razor
@@ -2,8 +2,10 @@
 @layout RegionHR.Web.Components.Layout.AdminLayout
 @using RegionHR.Infrastructure.Persistence
 @using RegionHR.Performance.Domain
+@using RegionHR.Web.Services
 @using Microsoft.EntityFrameworkCore
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
+@inject AuthService Auth
 
 <PageTitle>OpenHR - Chefsstyrkort</PageTitle>
 
@@ -116,16 +118,23 @@ else
         await using var db = await DbFactory.CreateDbContextAsync();
         try
         {
-            // Get latest scorecard (in real app, filter by logged-in chef)
-            _scorecard = await db.ManagerScorecards
-                .OrderByDescending(s => s.GenereradVid)
-                .FirstOrDefaultAsync();
+            // Styrkortet är chefs-specifikt (ManagerScorecard.ChefId). Visa ENDAST
+            // den inloggade chefens eget styrkort och egna coaching-insikter — aldrig
+            // en annan chefs (tidigare togs "senast genererade" oavsett chef).
+            // HR/Admin utan egen chefskoppling ser inget styrkort (de leder inget team här).
+            if (Auth.EmployeeId is Guid chefId)
+            {
+                _scorecard = await db.ManagerScorecards
+                    .Where(s => s.ChefId == chefId)
+                    .OrderByDescending(s => s.GenereradVid)
+                    .FirstOrDefaultAsync();
 
-            _nudges = await db.CoachingNudges
-                .Where(n => !n.ArLast)
-                .OrderByDescending(n => n.SkapadVid)
-                .Take(20)
-                .ToListAsync();
+                _nudges = await db.CoachingNudges
+                    .Where(n => !n.ArLast && n.ChefId == chefId)
+                    .OrderByDescending(n => n.SkapadVid)
+                    .Take(20)
+                    .ToListAsync();
+            }
         }
         catch (Exception ex) { _error = $"Kunde inte hämta data: {ex.Message}"; }
         finally { _loading = false; }
diff --git a/src/Web/Components/Pages/Home.razor b/src/Web/Components/Pages/Home.razor
index 920285e..41714d6 100644
--- a/src/Web/Components/Pages/Home.razor
+++ b/src/Web/Components/Pages/Home.razor
@@ -5,176 +5,615 @@
 @using RegionHR.Positions.Domain
 @using RegionHR.SharedKernel.Domain
 @using RegionHR.CaseManagement.Domain
+@using RegionHR.HalsoSAM.Domain
+@using RegionHR.Leave.Domain
+@using RegionHR.IntegrationHub.Infrastructure
+@using RegionHR.Web.Components.Shared
+@using RegionHR.Web.Services
 @using Microsoft.EntityFrameworkCore
 @using Microsoft.Extensions.Localization
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
 @inject NavigationManager Nav
 @inject IStringLocalizer<SharedResources> L
+@inject AuthService Auth
+@inject SelfServiceApiClient SelfService
+@inject UnitScopeService Scope
 
 <PageTitle>OpenHR — @L["Dashboard"]</PageTitle>
 
-<div class="d-flex justify-space-between align-center mb-4">
-    <MudText Typo="Typo.h4" Style="font-weight: 700;">@L["Dashboard"]</MudText>
-    <MudButton Variant="Variant.Outlined" Color="Color.Primary" Size="Size.Small"
-               StartIcon="@Icons.Material.Filled.Tune"
-               OnClick="@(() => _showCustomize = !_showCustomize)">@L["Customize"]</MudButton>
-</div>
-
-@if (_showCustomize)
+@if (_error != null)
 {
-    <MudPaper Class="pa-4 mb-4" Elevation="2">
-        <MudText Typo="Typo.subtitle1" Class="mb-2" Style="font-weight: 600;">@L["ShowSections"]</MudText>
-        <MudStack Row="true" Spacing="4">
-            <MudCheckBox T="bool" @bind-Value="_showKpi" Label="@L["KPICards"]" Color="Color.Primary" />
-            <MudCheckBox T="bool" @bind-Value="_showBemanning" Label="@L["StaffingPerUnit"]" Color="Color.Primary" />
-        </MudStack>
-    </MudPaper>
+    <MudAlert Severity="Severity.Error" Class="mb-4">@_error</MudAlert>
 }
 
-@if (_error != null)
+@* ══════════════════════════════════════════════════════════════════════
+   Rollmedveten startsida: varje roll ser sin egen "höjd".
+   - Anställd  → personlig översikt (nästa pass, saldon, att-göra, lönespec)
+   - Chef      → chefsöversikt scopad till egen enhet (attester, frånvaro idag)
+   - HR        → org-bred HR-överblick (bemanning, LAS, rehab, attestköer)
+   - Admin     → driftöversikt (systemstatus, lönekörning, integrationer)
+   Fail-safe: okänd/saknad roll behandlas som Anställd → ingen org-KPI läcker.
+   Variant väljs i VariantFor(Auth.Role) och låses av HomeDashboardVariantTests.
+   ══════════════════════════════════════════════════════════════════════ *@
+
+@* ─────────────────────────────  ANSTÄLLD  ───────────────────────────── *@
+@if (_variant == DashboardVariant.Personal)
 {
-    <MudAlert Severity="Severity.Error" Class="mb-4">@_error</MudAlert>
+    <MudText Typo="Typo.h4" Class="mb-1" Style="font-weight: 700;">Hej @(_personal?.Fornamn ?? "")!</MudText>
+    <MudText Typo="Typo.body1" Class="mb-6" Style="color: var(--mud-palette-text-secondary);">Din personliga översikt</MudText>
+
+    @if (Auth.EmployeeId == null)
+    {
+        <MudAlert Severity="Severity.Warning" Class="mb-4">
+            Din inloggning saknar en kopplad personalprofil — logga in med en anställd för att se din översikt.
+        </MudAlert>
+    }
+    else
+    {
+        @if (_tips.Count > 0)
+        {
+            <MudStack Spacing="2" Class="mb-4">
+                @foreach (var tip in _tips)
+                {
+                    <MudAlert Severity="@tip.Severity" Variant="Variant.Text" Dense="true">@tip.Text</MudAlert>
+                }
+            </MudStack>
+        }
+
+        @* Personliga nyckeltal — INTE organisationsövergripande *@
+        <MudGrid Spacing="3" Class="mb-6">
+            <MudItem xs="6" sm="6" md="3">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/minsida/ledighet"))">
+                    <MudText Typo="Typo.h4" Color="Color.Info" Style="font-weight: 700;">@(_personal?.SemesterdagarKvar ?? 0)</MudText>
+                    <MudText Typo="Typo.body2">Semesterdagar kvar</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="6" md="3">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/minsida/arenden"))">
+                    <MudText Typo="Typo.h4" Color="@((_personal?.OppnaArenden ?? 0) > 0 ? Color.Warning : Color.Success)" Style="font-weight: 700;">@(_personal?.OppnaArenden ?? 0)</MudText>
+                    <MudText Typo="Typo.body2">Att göra</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="6" md="3">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/notiser"))">
+                    <MudText Typo="Typo.h4" Color="@((_personal?.OlastaNotiser ?? 0) > 0 ? Color.Primary : Color.Success)" Style="font-weight: 700;">@(_personal?.OlastaNotiser ?? 0)</MudText>
+                    <MudText Typo="Typo.body2">Olästa notiser</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="6" md="3">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/minsida/schema"))">
+                    <MudText Typo="Typo.h6" Color="Color.Primary" Style="font-weight: 700; margin-top: 4px;">@(_personal?.NastaPass ?? "-")</MudText>
+                    <MudText Typo="Typo.caption" Style="display: block; color: var(--mud-palette-text-secondary);">@(_personal != null && _personal.NastaPassTid != "-" ? _personal.NastaPassTid : "Inga pass i veckan")</MudText>
+                    <MudText Typo="Typo.body2">Nästa pass</MudText>
+                </MudPaper>
+            </MudItem>
+        </MudGrid>
+
+        @* Senaste lönespecifikation *@
+        @if (_senasteLon != null)
+        {
+            <MudPaper Class="pa-4 mb-6" Elevation="2">
+                <div class="d-flex justify-space-between align-center flex-wrap gap-2">
+                    <div>
+                        <MudText Typo="Typo.h6" Style="font-weight: 600;">💰 Senaste lönespecifikation</MudText>
+                        <MudText Typo="Typo.body2" Style="color: var(--mud-palette-text-secondary);">
+                            Period @_senasteLon.Period · Brutto @_senasteLon.Brutto.ToString("N0") kr · Netto @_senasteLon.Netto.ToString("N0") kr
+                        </MudText>
+                    </div>
+                    <MudButton Variant="Variant.Outlined" Color="Color.Primary" Size="Size.Medium"
+                               Style="min-height: 44px;" Href="/minsida/lonespecifikationer">Se alla</MudButton>
+                </div>
+            </MudPaper>
+        }
+
+        @* Snabbgenvägar till självservice *@
+        <MudText Typo="Typo.h6" Class="mb-3" Style="font-weight: 600;">Snabbval</MudText>
+        <MudGrid Spacing="4">
+            <MudItem xs="12" sm="6" md="4">
+                <OhrBigCard Icon="📅" Title="Mitt schema" Description="Se dina kommande pass"
+                            BadgeValue="@(_personal != null && _personal.NastaPass != "-" ? _personal.NastaPass : null)"
+                            Href="/minsida/schema" />
+            </MudItem>
+            <MudItem xs="12" sm="6" md="4">
+                <OhrBigCard Icon="🌴" Title="Ledighet" Description="Ansök om semester och ledighet"
+                            BadgeValue="@($"{_personal?.SemesterdagarKvar ?? 0} dagar kvar")"
+                            Href="/minsida/ledighet" />
+            </MudItem>
+            <MudItem xs="12" sm="6" md="4">
+                <OhrBigCard Icon="📊" Title="Mina saldon" Description="Flex, komptid och semester" Href="/minsida/saldon" />
+            </MudItem>
+            <MudItem xs="12" sm="6" md="4">
+                <OhrBigCard Icon="😷" Title="Sjukanmäl" Description="Anmäl frånvaro direkt" Href="/minsida/sjukanmalan" />
+            </MudItem>
+            <MudItem xs="12" sm="6" md="4">
+                <OhrBigCard Icon="⏱️" Title="Stämpla" Description="Registrera kom- och gå-tid" Href="/minsida/stampling" />
+            </MudItem>
+            <MudItem xs="12" sm="6" md="4">
+                <OhrBigCard Icon="👤" Title="Min sida" Description="All din självservice på ett ställe" Href="/minsida" />
+            </MudItem>
+        </MudGrid>
+    }
 }
 
-@if (_showKpi)
+else if (_variant == DashboardVariant.Chef)
 {
+    <MudText Typo="Typo.h4" Class="mb-1" Style="font-weight: 700;">Chefsöversikt</MudText>
+    <MudText Typo="Typo.body1" Class="mb-6" Style="color: var(--mud-palette-text-secondary);">@(_chefEnhetNamn ?? "Ditt team")</MudText>
+
+    @* Enhetens nyckeltal — scopade till chefens egen enhet *@
     <MudGrid Spacing="3" Class="mb-6">
-        <MudItem xs="6" sm="2">
-            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/anstallda"))">
-                <MudText Typo="Typo.h4" Color="Color.Primary" Style="font-weight: 700;">@_headcount</MudText>
-                <MudText Typo="Typo.body2">@L["Employees"]</MudText>
+        <MudItem xs="6" sm="4">
+            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/chef/team"))">
+                <MudText Typo="Typo.h4" Color="Color.Primary" Style="font-weight: 700;">@_chefTeamAntal</MudText>
+                <MudText Typo="Typo.body2">I mitt team</MudText>
             </MudPaper>
         </MudItem>
-        <MudItem xs="6" sm="2">
-            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/las"))">
-                <MudText Typo="Typo.h4" Color="Color.Warning" Style="font-weight: 700;">@_lasAlarm</MudText>
-                <MudText Typo="Typo.body2">@L["LASAlarm"]</MudText>
+        <MudItem xs="6" sm="4">
+            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/godkannanden"))">
+                <MudText Typo="Typo.h4" Color="@(_chefVantandeAttester > 0 ? Color.Warning : Color.Success)" Style="font-weight: 700;">@_chefVantandeAttester</MudText>
+                <MudText Typo="Typo.body2">Väntar på attest</MudText>
             </MudPaper>
         </MudItem>
-        <MudItem xs="6" sm="2">
-            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/positioner"))">
-                <MudText Typo="Typo.h4" Style="font-weight: 700;">@_vakantaPositioner</MudText>
-                <MudText Typo="Typo.body2">@L["VacantPositions"]</MudText>
+        <MudItem xs="6" sm="4">
+            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/chef/franvarokalender"))">
+                <MudText Typo="Typo.h4" Color="@(_chefFranvaroIdag > 0 ? Color.Info : Color.Success)" Style="font-weight: 700;">@_chefFranvaroIdag</MudText>
+                <MudText Typo="Typo.body2">Frånvarande idag</MudText>
             </MudPaper>
         </MudItem>
-        <MudItem xs="6" sm="2">
-            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/godkannanden"))">
-                <MudText Typo="Typo.h4" Color="Color.Warning" Style="font-weight: 700;">@_godkannanden</MudText>
-                <MudText Typo="Typo.body2">@L["AwaitingApproval"]</MudText>
-            </MudPaper>
+    </MudGrid>
+
+    @* Väntande attester (påminnelse) *@
+    @if (_chefVantandeAttester > 0)
+    {
+        <MudPaper Class="pa-4 mb-6" Elevation="2" Style="border-left: 4px solid var(--mud-palette-warning);">
+            <div class="d-flex justify-space-between align-center flex-wrap gap-2">
+                <div>
+                    <MudText Typo="Typo.h6" Style="font-weight: 600;">@_chefVantandeAttester ärenden väntar på ditt beslut</MudText>
+                    <MudText Typo="Typo.body2" Style="color: var(--mud-palette-text-secondary);">Ledighetsansökningar från ditt team</MudText>
+                </div>
+                <MudButton Variant="Variant.Filled" Color="Color.Warning" Size="Size.Medium"
+                           Style="min-height: 44px;" Href="/chef">Hantera</MudButton>
+            </div>
+        </MudPaper>
+    }
+
+    @* Coaching-påminnelser *@
+    @if (_chefNudges.Count > 0)
+    {
+        <MudPaper Class="pa-4 mb-6" Elevation="2" Style="border-left: 4px solid var(--mud-palette-info);">
+            <MudText Typo="Typo.h6" Class="mb-3" Style="font-weight: 600;">Påminnelser (@_chefNudges.Count)</MudText>
+            <MudStack Spacing="2">
+                @foreach (var nudge in _chefNudges)
+                {
+                    <div class="d-flex align-center gap-2 flex-wrap">
+                        <MudChip T="string" Size="Size.Small" Color="Color.Info">@nudge.Typ</MudChip>
+                        <MudText Typo="Typo.body2">@nudge.Meddelande</MudText>
+                    </div>
+                }
+            </MudStack>
+        </MudPaper>
+    }
+
+    @* Snabbval för chefen *@
+    <MudText Typo="Typo.h6" Class="mb-3" Style="font-weight: 600;">Snabbval</MudText>
+    <MudGrid Spacing="4">
+        <MudItem xs="12" sm="6" md="4">
+            <OhrBigCard Icon="@("\U0001F465")" Title="Mitt team" Description="Se dina anställda"
+                        BadgeValue="@($"{_chefTeamAntal} anställda")" Href="/chef/team" />
         </MudItem>
-        <MudItem xs="6" sm="2">
-            <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/rapporter/workforce-plan"))">
-                <MudText Typo="Typo.h4" Color="@(_bemanningsgrad >= 90 ? Color.Success : _bemanningsgrad >= 70 ? Color.Warning : Color.Error)" Style="font-weight: 700;">@_bemanningsgrad%</MudText>
-                <MudText Typo="Typo.body2">@L["StaffingRate"]</MudText>
-            </MudPaper>
+        <MudItem xs="12" sm="6" md="4">
+            <OhrBigCard Icon="@("\U0001F7E2")" Title="Bemanning idag" Description="Se schemalagda pass" Href="/chef/bemanning" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="4">
+            <OhrBigCard Icon="@("\U0001F4CA")" Title="Frånvaro" Description="Se vem som är borta"
+                        BadgeValue="@($"{_chefFranvaroIdag} frånvarande")" Href="/chef/franvarokalender" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="4">
+            <OhrBigCard Icon="@("✅")" Title="Godkännanden" Description="Attestera ansökningar"
+                        BadgeValue="@(_chefVantandeAttester > 0 ? $"{_chefVantandeAttester} väntar" : null)" Href="/godkannanden" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="4">
+            <OhrBigCard Icon="@("\U0001F4C5")" Title="Schema" Description="Se och ändra schemat" Href="/schema" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="4">
+            <OhrBigCard Icon="@("\U0001F91D")" Title="Chefsportal" Description="Full chefsvy med insikter" Href="/chef" />
         </MudItem>
     </MudGrid>
 }
 
-@if (_showBemanning && _bemanningPerEnhet.Count > 0)
+else if (_variant == DashboardVariant.HR)
 {
-    <MudPaper Class="pa-4" Elevation="2">
-        <MudText Typo="Typo.h6" Class="mb-3" Style="font-weight: 600;">@L["StaffingPerUnit"]</MudText>
-        <MudSimpleTable Dense="true">
-            <thead><tr><th>@L["Unit"]</th><th>@L["Active"]</th><th>@L["Vacant"]</th><th>@L["Status"]</th></tr></thead>
-            <tbody>
-                @foreach (var e in _bemanningPerEnhet)
-                {
-                    var total = e.Aktiva + e.Vakanta;
-                    var grad = total > 0 ? (int)Math.Round(100.0 * e.Aktiva / total) : 0;
-                    <tr>
-                        <td>@e.Namn</td>
-                        <td>@e.Aktiva</td>
-                        <td>@e.Vakanta</td>
-                        <td>
-                            <MudChip T="string" Size="Size.Small" Color="@(e.Vakanta == 0 ? Color.Success : e.Vakanta <= 1 ? Color.Warning : Color.Error)">
-                                @grad%
-                            </MudChip>
-                        </td>
-                    </tr>
-                }
-            </tbody>
-        </MudSimpleTable>
-    </MudPaper>
+    <div class="d-flex justify-space-between align-center mb-4">
+        <MudText Typo="Typo.h4" Style="font-weight: 700;">HR-överblick</MudText>
+        <MudButton Variant="Variant.Outlined" Color="Color.Primary" Size="Size.Small"
+                   StartIcon="@Icons.Material.Filled.Tune"
+                   OnClick="@(() => _showCustomize = !_showCustomize)">@L["Customize"]</MudButton>
+    </div>
+
+    @if (_showCustomize)
+    {
+        <MudPaper Class="pa-4 mb-4" Elevation="2">
+            <MudText Typo="Typo.subtitle1" Class="mb-2" Style="font-weight: 600;">@L["ShowSections"]</MudText>
+            <MudStack Row="true" Spacing="4">
+                <MudCheckBox T="bool" @bind-Value="_showKpi" Label="@L["KPICards"]" Color="Color.Primary" />
+                <MudCheckBox T="bool" @bind-Value="_showBemanning" Label="@L["StaffingPerUnit"]" Color="Color.Primary" />
+            </MudStack>
+        </MudPaper>
+    }
+
+    @if (_showKpi)
+    {
+        <MudGrid Spacing="3" Class="mb-6">
+            <MudItem xs="6" sm="4" md="2">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/anstallda"))">
+                    <MudText Typo="Typo.h4" Color="Color.Primary" Style="font-weight: 700;">@_headcount</MudText>
+                    <MudText Typo="Typo.body2">@L["Employees"]</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="4" md="2">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/las"))">
+                    <MudText Typo="Typo.h4" Color="Color.Warning" Style="font-weight: 700;">@_lasAlarm</MudText>
+                    <MudText Typo="Typo.body2">@L["LASAlarm"]</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="4" md="2">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/positioner"))">
+                    <MudText Typo="Typo.h4" Style="font-weight: 700;">@_vakantaPositioner</MudText>
+                    <MudText Typo="Typo.body2">@L["VacantPositions"]</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="4" md="2">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/godkannanden"))">
+                    <MudText Typo="Typo.h4" Color="Color.Warning" Style="font-weight: 700;">@_godkannanden</MudText>
+                    <MudText Typo="Typo.body2">@L["AwaitingApproval"]</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="4" md="2">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/halsosam"))">
+                    <MudText Typo="Typo.h4" Color="@(_oppnaRehab > 0 ? Color.Info : Color.Success)" Style="font-weight: 700;">@_oppnaRehab</MudText>
+                    <MudText Typo="Typo.body2">Öppna rehabärenden</MudText>
+                </MudPaper>
+            </MudItem>
+            <MudItem xs="6" sm="4" md="2">
+                <MudPaper Class="pa-4 text-center" Elevation="2" Style="cursor: pointer;" @onclick="@(() => Nav.NavigateTo("/rapporter/workforce-plan"))">
+                    <MudText Typo="Typo.h4" Color="@(_bemanningsgrad >= 90 ? Color.Success : _bemanningsgrad >= 70 ? Color.Warning : Color.Error)" Style="font-weight: 700;">@_bemanningsgrad%</MudText>
+                    <MudText Typo="Typo.body2">@L["StaffingRate"]</MudText>
+                </MudPaper>
+            </MudItem>
+        </MudGrid>
+    }
+
+    @if (_showBemanning && _bemanningPerEnhet.Count > 0)
+    {
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.h6" Class="mb-3" Style="font-weight: 600;">@L["StaffingPerUnit"]</MudText>
+            <div style="overflow-x: auto;">
+                <MudSimpleTable Dense="true">
+                    <thead><tr><th>@L["Unit"]</th><th>@L["Active"]</th><th>@L["Vacant"]</th><th>@L["Status"]</th></tr></thead>
+                    <tbody>
+                        @foreach (var e in _bemanningPerEnhet)
+                        {
+                            var total = e.Aktiva + e.Vakanta;
+                            var grad = total > 0 ? (int)Math.Round(100.0 * e.Aktiva / total) : 0;
+                            <tr>
+                                <td>@e.Namn</td>
+                                <td>@e.Aktiva</td>
+                                <td>@e.Vakanta</td>
+                                <td>
+                                    <MudChip T="string" Size="Size.Small" Color="@(e.Vakanta == 0 ? Color.Success : e.Vakanta <= 1 ? Color.Warning : Color.Error)">
+                                        @grad%
+                                    </MudChip>
+                                </td>
+                            </tr>
+                        }
+                    </tbody>
+                </MudSimpleTable>
+            </div>
+        </MudPaper>
+    }
+    else if (_showBemanning && _bemanningPerEnhet.Count == 0 && !_loading)
+    {
+        <MudAlert Severity="Severity.Info" Variant="Variant.Text">@L["NoPositionsRegistered"]</MudAlert>
+    }
 }
-else if (_showBemanning && _bemanningPerEnhet.Count == 0 && !_loading)
+
+else if (_variant == DashboardVariant.Admin)
 {
-    <MudAlert Severity="Severity.Info" Variant="Variant.Text">@L["NoPositionsRegistered"]</MudAlert>
+    <MudText Typo="Typo.h4" Class="mb-1" Style="font-weight: 700;">Driftöversikt</MudText>
+    <MudText Typo="Typo.body1" Class="mb-6" Style="color: var(--mud-palette-text-secondary);">Systemstatus, lönekörning och integrationer</MudText>
+
+    <MudGrid Spacing="4" Class="mb-6">
+        @* Systemstatus *@
+        <MudItem xs="12" sm="6" md="4">
+            <MudPaper Class="pa-4" Elevation="2" Style="height: 100%;">
+                <MudText Typo="Typo.h6" Class="mb-2" Style="font-weight: 600;">🟢 Systemstatus</MudText>
+                <MudChip T="string" Color="Color.Success" Size="Size.Small">Drift OK</MudChip>
+                <MudText Typo="Typo.body2" Class="mt-2" Style="color: var(--mud-palette-text-secondary);">
+                    @_headcount aktiva anställda i systemet
+                </MudText>
+            </MudPaper>
+        </MudItem>
+
+        @* Senaste lönekörning *@
+        <MudItem xs="12" sm="6" md="4">
+            <MudPaper Class="pa-4" Elevation="2" Style="height: 100%;">
+                <MudText Typo="Typo.h6" Class="mb-2" Style="font-weight: 600;">💰 Senaste lönekörning</MudText>
+                @if (_senasteKorning != null)
+                {
+                    <MudText Typo="Typo.subtitle1" Style="font-weight: 600;">@_senasteKorning.Period</MudText>
+                    <MudChip T="string" Color="@_senasteKorning.StatusFarg" Size="Size.Small">@_senasteKorning.StatusText</MudChip>
+                    <MudText Typo="Typo.body2" Class="mt-2" Style="color: var(--mud-palette-text-secondary);">
+                        @_senasteKorning.AntalAnstallda anställda · @_senasteKorning.TotalBrutto.ToString("N0") kr brutto
+                    </MudText>
+                }
+                else
+                {
+                    <MudText Typo="Typo.body2" Style="color: var(--mud-palette-text-secondary);">Ingen lönekörning registrerad ännu.</MudText>
+                }
+            </MudPaper>
+        </MudItem>
+
+        @* Integrationsstatus *@
+        <MudItem xs="12" sm="6" md="4">
+            <MudPaper Class="pa-4" Elevation="2" Style="height: 100%;">
+                <MudText Typo="Typo.h6" Class="mb-2" Style="font-weight: 600;">🔌 Integrationer</MudText>
+                <MudChip T="string" Color="@((_outboxFailed + _outboxDeadLetter) > 0 ? Color.Error : _outboxPending > 0 ? Color.Warning : Color.Success)" Size="Size.Small">
+                    @((_outboxFailed + _outboxDeadLetter) > 0 ? "Fel i utflödet" : _outboxPending > 0 ? "Bearbetar" : "Allt levererat")
+                </MudChip>
+                <MudText Typo="Typo.body2" Class="mt-2" Style="color: var(--mud-palette-text-secondary);">
+                    Kö: @_outboxPending · Misslyckade: @_outboxFailed · Dead-letter: @_outboxDeadLetter
+                </MudText>
+            </MudPaper>
+        </MudItem>
+    </MudGrid>
+
+    @* Snabbval för admin *@
+    <MudText Typo="Typo.h6" Class="mb-3" Style="font-weight: 600;">Snabbval</MudText>
+    <MudGrid Spacing="4">
+        <MudItem xs="12" sm="6" md="3">
+            <OhrBigCard Icon="@("⚙️")" Title="Konfiguration" Description="Systeminställningar" Href="/admin/konfiguration" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="3">
+            <OhrBigCard Icon="@("\U0001F50C")" Title="Integrationer" Description="Externa system" Href="/integrationer" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="3">
+            <OhrBigCard Icon="@("\U0001F4B0")" Title="Lönekörningar" Description="Kör och godkänn lön" Href="/lon/korningar" />
+        </MudItem>
+        <MudItem xs="12" sm="6" md="3">
+            <OhrBigCard Icon="@("\U0001F4DC")" Title="Granskningslogg" Description="Alla ändringar" Href="/audit" />
+        </MudItem>
+    </MudGrid>
 }
 
 @code {
-    private bool _showCustomize;
-    private bool _showKpi = true;
-    private bool _showBemanning = true;
+    /// <summary>
+    /// Vilken variant av startsidan en roll ska se. En roll ser sin EGEN "höjd",
+    /// inte en superset — Admin ser drift, HR ser org-HR, Chef ser sin enhet,
+    /// Anställd ser sig själv.
+    /// </summary>
+    public enum DashboardVariant { Personal, Chef, HR, Admin }
+
+    /// <summary>
+    /// Rollen → startsidevariant. Exakt matchning (ingen superset-logik): en HR-roll
+    /// ska t.ex. inte tryckas ner till chefsvyn. Okänd eller saknad roll är fail-safe
+    /// och behandlas som <see cref="DashboardVariant.Personal"/> så att inga
+    /// organisationsövergripande nyckeltal någonsin läcker till en icke-priviligierad
+    /// användare. Publik + statisk så beteendet kan låsas med enhetstester.
+    /// </summary>
+    public static DashboardVariant VariantFor(string? role) => role switch
+    {
+        RouteAccessPolicy.Admin => DashboardVariant.Admin,
+        RouteAccessPolicy.HR => DashboardVariant.HR,
+        RouteAccessPolicy.Chef => DashboardVariant.Chef,
+        _ => DashboardVariant.Personal,
+    };
+
+    private DashboardVariant _variant = DashboardVariant.Personal;
     private bool _loading = true;
     private string? _error;
 
-    private int _headcount;
-    private int _lasAlarm;
-    private int _vakantaPositioner;
-    private int _godkannanden;
-    private int _bemanningsgrad;
+    // Anställd
+    private DashboardData? _personal;
+    private LonespecData? _senasteLon;
+    private readonly List<TipData> _tips = [];
+
+    // Chef
+    private string? _chefEnhetNamn;
+    private int _chefTeamAntal, _chefVantandeAttester, _chefFranvaroIdag;
+    private readonly List<NudgeVm> _chefNudges = [];
+
+    // HR (org)
+    private bool _showCustomize;
+    private bool _showKpi = true;
+    private bool _showBemanning = true;
+    private int _headcount, _lasAlarm, _vakantaPositioner, _godkannanden, _bemanningsgrad, _oppnaRehab;
     private List<EnhetBemanningVm> _bemanningPerEnhet = [];
 
+    // Admin
+    private KorningVm? _senasteKorning;
+    private int _outboxPending, _outboxFailed, _outboxDeadLetter;
+
     protected override async Task OnInitializedAsync()
     {
-        await using var db = await DbFactory.CreateDbContextAsync();
+        _variant = VariantFor(Auth.Role);
         try
         {
-            var idag = DateOnly.FromDateTime(DateTime.Today);
-
-            // Headcount: anställda med aktiv anställning — SQL COUNT + EXISTS, inga entiteter
-            // materialiseras (skalar till tiotusentals anställda).
-            _headcount = await db.Employees.CountAsync(e => e.Anstallningar.Any(a =>
-                a.Giltighetsperiod.Start <= idag &&
-                (a.Giltighetsperiod.End == null || a.Giltighetsperiod.End >= idag)));
-
-            // LAS-alarm
-            _lasAlarm = await db.LASAccumulations
-                .CountAsync(l => l.Status == LASStatus.NaraGrans || l.Status == LASStatus.KritiskNara);
-
-            // Positioner per enhet — aggregeras i databasen (GROUP BY), inte i minnet.
-            var perEnhetRaw = await db.Positions_Table
-                .GroupBy(p => p.EnhetId)
-                .Select(g => new
-                {
-                    EnhetId = g.Key,
-                    Aktiva = g.Sum(p => p.Status == PositionStatus.Aktiv ? 1 : 0),
-                    Vakanta = g.Sum(p => p.Status == PositionStatus.Vakant ? 1 : 0)
-                })
-                .ToListAsync();
+            switch (_variant)
+            {
+                case DashboardVariant.Personal: await LaddaPersonalAsync(); break;
+                case DashboardVariant.Chef: await LaddaChefAsync(); break;
+                case DashboardVariant.HR: await LaddaHrAsync(); break;
+                case DashboardVariant.Admin: await LaddaAdminAsync(); break;
+            }
+        }
+        catch (Exception ex)
+        {
+            _error = $"{L["ErrorLoadingDashboard"]}: {ex.Message}";
+        }
+        finally { _loading = false; }
+    }
+
+    private async Task LaddaPersonalAsync()
+    {
+        if (Auth.EmployeeId == null) return;
+        var empId = EmployeeId.From(Auth.EmployeeId.Value);
+        _personal = await SelfService.GetDashboardAsync(empId);
 
-            var aktiva = perEnhetRaw.Sum(x => x.Aktiva);
-            var vakanta = perEnhetRaw.Sum(x => x.Vakanta);
-            _vakantaPositioner = vakanta;
+        var lon = await SelfService.GetSalaryHistoryAsync(empId, limit: 1);
+        _senasteLon = lon.FirstOrDefault();
 
-            // Väntande godkännanden
-            _godkannanden = await db.Cases
-                .CountAsync(c => c.Status == CaseStatus.VantarGodkannande);
+        var fornamn = _personal.Fornamn;
+        if (_personal.SemesterdagarKvar > 15)
+            _tips.Add(new(Severity.Info, $"{fornamn} har {_personal.SemesterdagarKvar} semesterdagar kvar att planera."));
+        if (_personal.OppnaArenden > 0)
+            _tips.Add(new(Severity.Warning, $"{fornamn} har {_personal.OppnaArenden} pågående ärenden att följa upp."));
+        if (_tips.Count == 0)
+            _tips.Add(new(Severity.Success, "Allt ser bra ut — inget kräver din uppmärksamhet just nu."));
+    }
+
+    private async Task LaddaChefAsync()
+    {
+        await using var db = await DbFactory.CreateDbContextAsync();
+        var idag = DateOnly.FromDateTime(DateTime.Today);
 
-            // Bemanningsgrad
-            var total = aktiva + vakanta;
-            _bemanningsgrad = total > 0 ? (int)Math.Round(100.0 * aktiva / total) : 0;
+        // Enhets-scoping: chef ser bara sin egen enhet. null = ingen scoping
+        // (chef utan enhetskoppling → visa hela org som fallback, likt Chef/Index).
+        var scopeIds = await Scope.GetEmployeeIdsInScopeAsync();
 
-            // Bemanning per enhet — enhetsnamn (liten tabell) slås upp för de grupperade raderna.
-            var enhetNamn = await db.OrganizationUnits.ToDictionaryAsync(e => e.Id.Value, e => e.Namn);
+        _chefTeamAntal = scopeIds?.Count ?? await db.Employees.CountAsync();
 
-            _bemanningPerEnhet = perEnhetRaw
-                .Select(g => new EnhetBemanningVm(
-                    enhetNamn.TryGetValue(g.EnhetId, out var namn) ? namn : L["UnknownUnit"].Value,
-                    g.Aktiva,
-                    g.Vakanta))
-                .OrderByDescending(e => e.Vakanta)
-                .ToList();
+        var enhetId = await Scope.GetCurrentUnitIdAsync();
+        if (enhetId is Guid uid)
+            _chefEnhetNamn = (await db.OrganizationUnits.FirstOrDefaultAsync(o => o.Id == OrganizationId.From(uid)))?.Namn;
+
+        // Väntande attester (ledighetsansökningar) — scopade till enheten.
+        var pendingLeave = await db.LeaveRequests
+            .Where(r => r.Status == LeaveRequestStatus.Inskickad)
+            .ToListAsync();
+        _chefVantandeAttester = scopeIds is null
+            ? pendingLeave.Count
+            : pendingLeave.Count(r => scopeIds.Contains(r.AnstallId));
+
+        // Frånvarande idag — scopade till enheten.
+        var franvaroAll = await db.LeaveRequests
+            .Where(r => r.FranDatum <= idag && r.TillDatum >= idag
+                && (r.Status == LeaveRequestStatus.Inskickad || r.Status == LeaveRequestStatus.Godkand))
+            .ToListAsync();
+        _chefFranvaroIdag = scopeIds is null
+            ? franvaroAll.Count
+            : franvaroAll.Count(r => scopeIds.Contains(r.AnstallId));
+
+        // Coaching-påminnelser (senaste 3) — bara den inloggade chefens egna
+        // (CoachingNudge.ChefId), aldrig en annan chefs insikter. Admin/HR utan
+        // egen chefskoppling får inga (nudges är chefsriktade).
+        if (Auth.EmployeeId is Guid chefId)
+        {
+            var nudges = await db.CoachingNudges
+                .Where(n => !n.ArLast && n.ChefId == chefId)
+                .OrderByDescending(n => n.SkapadVid)
+                .Take(3)
+                .ToListAsync();
+            foreach (var n in nudges)
+                _chefNudges.Add(new NudgeVm(n.Typ, n.Meddelande));
         }
-        catch (Exception ex)
+    }
+
+    private async Task LaddaHrAsync()
+    {
+        await using var db = await DbFactory.CreateDbContextAsync();
+        var idag = DateOnly.FromDateTime(DateTime.Today);
+
+        // Headcount — SQL COUNT + EXISTS, materialiserar inga entiteter.
+        _headcount = await db.Employees.CountAsync(e => e.Anstallningar.Any(a =>
+            a.Giltighetsperiod.Start <= idag &&
+            (a.Giltighetsperiod.End == null || a.Giltighetsperiod.End >= idag)));
+
+        _lasAlarm = await db.LASAccumulations
+            .CountAsync(l => l.Status == LASStatus.NaraGrans || l.Status == LASStatus.KritiskNara);
+
+        // Positioner per enhet — aggregeras i databasen (GROUP BY).
+        var perEnhetRaw = await db.Positions_Table
+            .GroupBy(p => p.EnhetId)
+            .Select(g => new
+            {
+                EnhetId = g.Key,
+                Aktiva = g.Sum(p => p.Status == PositionStatus.Aktiv ? 1 : 0),
+                Vakanta = g.Sum(p => p.Status == PositionStatus.Vakant ? 1 : 0)
+            })
+            .ToListAsync();
+
+        var aktiva = perEnhetRaw.Sum(x => x.Aktiva);
+        var vakanta = perEnhetRaw.Sum(x => x.Vakanta);
+        _vakantaPositioner = vakanta;
+
+        _godkannanden = await db.Cases
+            .CountAsync(c => c.Status == CaseStatus.VantarGodkannande);
+
+        _oppnaRehab = await db.RehabCases
+            .CountAsync(r => r.Status != RehabStatus.Avslutad);
+
+        var total = aktiva + vakanta;
+        _bemanningsgrad = total > 0 ? (int)Math.Round(100.0 * aktiva / total) : 0;
+
+        var enhetNamn = await db.OrganizationUnits.ToDictionaryAsync(e => e.Id.Value, e => e.Namn);
+
+        _bemanningPerEnhet = perEnhetRaw
+            .Select(g => new EnhetBemanningVm(
+                enhetNamn.TryGetValue(g.EnhetId, out var namn) ? namn : L["UnknownUnit"].Value,
+                g.Aktiva,
+                g.Vakanta))
+            .OrderByDescending(e => e.Vakanta)
+            .ToList();
+    }
+
+    private async Task LaddaAdminAsync()
+    {
+        await using var db = await DbFactory.CreateDbContextAsync();
+        var idag = DateOnly.FromDateTime(DateTime.Today);
+
+        _headcount = await db.Employees.CountAsync(e => e.Anstallningar.Any(a =>
+            a.Giltighetsperiod.Start <= idag &&
+            (a.Giltighetsperiod.End == null || a.Giltighetsperiod.End >= idag)));
+
+        var latest = await db.PayrollRuns
+            .OrderByDescending(r => r.Year).ThenByDescending(r => r.Month)
+            .FirstOrDefaultAsync();
+        if (latest != null)
         {
-            _error = $"{L["ErrorLoadingDashboard"]}: {ex.Message}";
+            _senasteKorning = new KorningVm(
+                $"{latest.Year}-{latest.Month:D2}",
+                KorningStatusText(latest.Status),
+                KorningStatusFarg(latest.Status),
+                latest.AntalAnstallda,
+                latest.TotalBrutto.Amount);
         }
-        finally { _loading = false; }
+
+        _outboxPending = await db.OutboxMessages.CountAsync(m => m.Status == OutboxStatus.Pending);
+        _outboxFailed = await db.OutboxMessages.CountAsync(m => m.Status == OutboxStatus.Failed);
+        _outboxDeadLetter = await db.OutboxMessages.CountAsync(m => m.Status == OutboxStatus.DeadLetter);
     }
 
+    private static string KorningStatusText(PayrollRunStatus s) => s switch
+    {
+        PayrollRunStatus.Skapad => "Skapad",
+        PayrollRunStatus.Paborjad => "Påbörjad",
+        PayrollRunStatus.Beraknad => "Beräknad",
+        PayrollRunStatus.Granskad => "Granskad",
+        PayrollRunStatus.Godkand => "Godkänd",
+        PayrollRunStatus.Utbetald => "Utbetald",
+        PayrollRunStatus.Felaktig => "Felaktig",
+        _ => s.ToString()
+    };
+
+    private static Color KorningStatusFarg(PayrollRunStatus s) => s switch
+    {
+        PayrollRunStatus.Utbetald or PayrollRunStatus.Godkand => Color.Success,
+        PayrollRunStatus.Felaktig => Color.Error,
+        _ => Color.Info
+    };
+
+    private record TipData(Severity Severity, string Text);
+    private record NudgeVm(string Typ, string Meddelande);
     private record EnhetBemanningVm(string Namn, int Aktiva, int Vakanta);
+    private record KorningVm(string Period, string StatusText, Color StatusFarg, int AntalAnstallda, decimal TotalBrutto);
 }
-
diff --git a/src/Web/Components/Pages/Kompetens/Index.razor b/src/Web/Components/Pages/Kompetens/Index.razor
index 10b9430..2debff5 100644
--- a/src/Web/Components/Pages/Kompetens/Index.razor
+++ b/src/Web/Components/Pages/Kompetens/Index.razor
@@ -7,6 +7,7 @@
 @using Microsoft.EntityFrameworkCore
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
 @inject NavigationManager Nav
+@inject RegionHR.Web.Services.UnitScopeService Scope
 
 <PageTitle>OpenHR - Kompetensregister</PageTitle>
 <div class="d-flex justify-space-between align-center mb-4">
@@ -231,7 +232,18 @@ else
         using var db = DbFactory.CreateDbContext();
         try
         {
-            _certs = await db.Certifications
+            // Enhets-scoping: en chef ser bara sin egen enhets certifieringar; HR/Admin ser alla.
+            // Fail-closed — kan chefens enhet inte härledas (tom mängd) visas inga certifieringar
+            // i stället för hela organisationens (certifieringar är känslig persondata).
+            var scope = await Scope.GetEmployeeIdsInScopeAsync();
+            IQueryable<Certification> certQuery = db.Certifications;
+            if (scope is not null)
+            {
+                var scopeIds = scope.ToList();
+                certQuery = certQuery.Where(c => scopeIds.Contains(c.AnstallId));
+            }
+
+            _certs = await certQuery
                 .OrderByDescending(x => x.GiltigTill)
                 .Take(50)
                 .ToListAsync();
diff --git a/src/Web/Components/Pages/Medarbetarsamtal/Index.razor b/src/Web/Components/Pages/Medarbetarsamtal/Index.razor
index cece759..939a405 100644
--- a/src/Web/Components/Pages/Medarbetarsamtal/Index.razor
+++ b/src/Web/Components/Pages/Medarbetarsamtal/Index.razor
@@ -4,6 +4,7 @@
 @using RegionHR.Performance.Domain
 @using Microsoft.EntityFrameworkCore
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
+@inject RegionHR.Web.Services.UnitScopeService Scope
 
 <PageTitle>OpenHR - Medarbetarsamtal</PageTitle>
 <div class="d-flex justify-space-between align-center mb-4">
@@ -78,7 +79,17 @@
         using var db = DbFactory.CreateDbContext();
         try
         {
-            _reviews = await db.PerformanceReviews
+            // Enhets-scoping: en chef ser bara sin egen enhets medarbetarsamtal; HR/Admin ser alla.
+            // Fail-closed — kan chefens enhet inte härledas (tom mängd) visas inga samtal.
+            var scope = await Scope.GetEmployeeIdsInScopeAsync();
+            IQueryable<PerformanceReview> reviewQuery = db.PerformanceReviews;
+            if (scope is not null)
+            {
+                var scopeIds = scope.ToList();
+                reviewQuery = reviewQuery.Where(r => scopeIds.Contains(r.AnstallId));
+            }
+
+            _reviews = await reviewQuery
                 .OrderByDescending(x => x.SkapadVid)
                 .Take(50)
                 .ToListAsync();
diff --git a/src/Web/Components/Pages/MinSida/TotalRewards.razor b/src/Web/Components/Pages/MinSida/TotalRewards.razor
index f3dbf6d..4a277b1 100644
--- a/src/Web/Components/Pages/MinSida/TotalRewards.razor
+++ b/src/Web/Components/Pages/MinSida/TotalRewards.razor
@@ -3,10 +3,10 @@
 @using RegionHR.Infrastructure.Persistence
 @using RegionHR.Compensation.Domain
 @using RegionHR.SharedKernel.Domain
+@using RegionHR.Web.Services
 @using Microsoft.EntityFrameworkCore
-@using Microsoft.AspNetCore.Components.Authorization
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
-@inject AuthenticationStateProvider AuthState
+@inject AuthService Auth
 
 <PageTitle>OpenHR - Total Rewards</PageTitle>
 <MudText Typo="Typo.h4" Class="mb-2" Style="font-weight: 700;">Din totala kompensation</MudText>
@@ -14,7 +14,13 @@
     Oversikt av din fullstandiga ersattning inklusive lon, pension, forsakringar och formaner.
 </MudText>
 
-@if (_loading) { <MudProgressCircular Color="Color.Primary" Indeterminate="true" /> }
+@if (Auth.EmployeeId == null)
+{
+    <MudAlert Severity="Severity.Warning" Class="mb-4">
+        Total Rewards visar din personliga kompensation och kraver en kopplad personalprofil — logga in med en anstalld.
+    </MudAlert>
+}
+else if (_loading) { <MudProgressCircular Color="Color.Primary" Indeterminate="true" /> }
 else if (_error != null) { <MudAlert Severity="Severity.Error" Class="mb-4">@_error</MudAlert> }
 else if (_statement == null)
 {
@@ -110,25 +116,16 @@ else
 
     protected override async Task OnInitializedAsync()
     {
+        // Personlig sida: bind ALLTID till den inloggades egen anställning (som
+        // övriga MinSida-sidor via AuthService.EmployeeId). Ingen fallback till
+        // "första anställd" — det läckte en annan persons totala kompensation till
+        // en användare utan kopplad profil (t.ex. Admin).
+        if (Auth.EmployeeId == null) { _loading = false; return; }
+        var anstallId = Auth.EmployeeId.Value;
+
         await using var db = await DbFactory.CreateDbContextAsync();
         try
         {
-            var auth = await AuthState.GetAuthenticationStateAsync();
-            var employeeIdClaim = auth.User.FindFirst("EmployeeId")?.Value;
-
-            // Fallback to first employee for demo
-            Guid anstallId;
-            if (employeeIdClaim != null && Guid.TryParse(employeeIdClaim, out var parsedId))
-            {
-                anstallId = parsedId;
-            }
-            else
-            {
-                var first = await db.Employees.FirstOrDefaultAsync();
-                if (first == null) { _error = "Ingen anstalld hittad"; return; }
-                anstallId = first.Id.Value;
-            }
-
             var year = DateTime.Now.Year;
             _statement = await db.TotalRewardsStatements
                 .FirstOrDefaultAsync(s => s.AnstallId == EmployeeId.From(anstallId) && s.Ar == year);
diff --git a/src/Web/Components/Pages/Rapporter/FlightRisk.razor b/src/Web/Components/Pages/Rapporter/FlightRisk.razor
index e48d8b5..2761790 100644
--- a/src/Web/Components/Pages/Rapporter/FlightRisk.razor
+++ b/src/Web/Components/Pages/Rapporter/FlightRisk.razor
@@ -5,6 +5,7 @@
 @using Microsoft.EntityFrameworkCore
 @inject FlightRiskService RiskService
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
+@inject RegionHR.Web.Services.UnitScopeService Scope
 
 <PageTitle>OpenHR — Uppsägningsrisk</PageTitle>
 
@@ -154,9 +155,17 @@ else
         await using var db = await DbFactory.CreateDbContextAsync();
         try
         {
-            var employees = await db.Employees
-                .Include(e => e.Anstallningar)
-                .ToListAsync();
+            // Enhets-scoping: en chef ser bara sin egen enhets uppsägningsrisk (raderna
+            // innehåller namn, befattning OCH månadslön per anställd). HR/Admin analyserar
+            // hela organisationen. Fail-closed — tom scope (chef utan enhet) → inga rader.
+            var scope = await Scope.GetEmployeeIdsInScopeAsync();
+            IQueryable<Employee> empQuery = db.Employees.Include(e => e.Anstallningar);
+            if (scope is not null)
+            {
+                var scopeIds = scope.Select(g => new EmployeeId(g)).ToList();
+                empQuery = empQuery.Where(e => scopeIds.Contains(e.Id));
+            }
+            var employees = await empQuery.ToListAsync();
 
             _results = RiskService.BeraknaForAlla(employees);
         }
diff --git a/src/Web/Components/Pages/Rapporter/KorRapport.razor b/src/Web/Components/Pages/Rapporter/KorRapport.razor
index 5d6b9ca..1755750 100644
--- a/src/Web/Components/Pages/Rapporter/KorRapport.razor
+++ b/src/Web/Components/Pages/Rapporter/KorRapport.razor
@@ -7,6 +7,7 @@
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
 @inject ExportService Export
 @inject IJSRuntime JS
+@inject RegionHR.Web.Services.UnitScopeService Scope
 
 <PageTitle>OpenHR - @Namn</PageTitle>
 <MudButton StartIcon="@Icons.Material.Filled.ArrowBack" Variant="Variant.Text" Color="Color.Primary" Href="/rapporter" Style="margin-bottom: 1rem;">Tillbaka</MudButton>
@@ -87,6 +88,13 @@ else if (_result != null)
         await using var db = await DbFactory.CreateDbContextAsync();
         await Task.Delay(500); // Simulate generation time
 
+        // Enhets-scoping: en chef får bara sin egen enhets rader (annars läcker t.ex.
+        // "Löneregister" och "Personalförteckning" hela organisationens löne-/persondata
+        // via rapportvägen). scope == null ⇒ HR/Admin utan scoping. Fail-closed: en tom
+        // scope (chef utan härledbar enhet) filtrerar bort alla rader.
+        var scope = await Scope.GetEmployeeIdsInScopeAsync();
+        var scopedUnit = Scope.IsUnitScoped ? await Scope.GetCurrentUnitIdAsync() : (Guid?)null;
+
         switch (Namn)
         {
             case "Personalförteckning":
@@ -94,6 +102,7 @@ else if (_result != null)
                 try
                 {
                     var emps = await db.Employees.Include(e => e.Anstallningar).ToListAsync();
+                    if (scope is not null) emps = emps.Where(e => scope.Contains(e.Id.Value)).ToList();
                     _result = emps.Select(e => new List<string>
                     {
                         $"{e.Fornamn} {e.Efternamn}",
@@ -114,6 +123,7 @@ else if (_result != null)
                     var payroll = await db.PayrollResults
                         .OrderByDescending(r => r.Year).ThenByDescending(r => r.Month)
                         .ToListAsync();
+                    if (scope is not null) payroll = payroll.Where(r => scope.Contains(r.AnstallId.Value)).ToList();
                     var loneEmpIds = payroll.Select(r => r.AnstallId).Distinct().ToList();
                     var loneEmps = await db.Employees.Include(e => e.Anstallningar)
                         .Where(e => loneEmpIds.Contains(e.Id)).ToListAsync();
@@ -144,6 +154,7 @@ else if (_result != null)
                 try
                 {
                     var leaves = await db.LeaveRequests.ToListAsync();
+                    if (scope is not null) leaves = leaves.Where(l => scope.Contains(l.AnstallId)).ToList();
                     _result = leaves.GroupBy(l => l.Typ).Select(g => new List<string>
                         { g.Key.ToString(), g.Count().ToString(), g.Sum(l => l.AntalDagar).ToString() }).ToList();
                 }
@@ -155,6 +166,7 @@ else if (_result != null)
                 try
                 {
                     var accs = await db.LASAccumulations.ToListAsync();
+                    if (scope is not null) accs = accs.Where(a => scope.Contains(a.AnstallId.Value)).ToList();
                     var lasEmpIds = accs.Select(a => a.AnstallId).Distinct().ToList();
                     var lasEmps = await db.Employees.Where(e => lasEmpIds.Contains(e.Id)).ToListAsync();
                     var lasNames = lasEmps.ToDictionary(e => e.Id.Value, e => $"{e.Fornamn} {e.Efternamn}");
@@ -174,6 +186,9 @@ else if (_result != null)
                     var empEnhBem = new Dictionary<Guid, Guid>();
                     foreach (var be in bemEmps) { var ba = be.AktivAnstallning(idagBem); if (ba != null) empEnhBem[be.Id.Value] = ba.EnhetId.Value; }
                     var enhBem = await db.OrganizationUnits.ToListAsync();
+                    // En chef ser bara sin egen enhets bemanning (fail-closed: okänd enhet → inga rader).
+                    if (Scope.IsUnitScoped)
+                        enhBem = scopedUnit is Guid su ? enhBem.Where(u => u.Id.Value == su).ToList() : enhBem.Where(_ => false).ToList();
                     _result = enhBem.Select(enhet => {
                         var es = todayShifts.Where(s => empEnhBem.GetValueOrDefault(s.AnstallId.Value) == enhet.Id.Value).ToList();
                         return new List<string> { enhet.Namn, es.Count(s => s.PassTyp == RegionHR.Scheduling.Domain.ShiftType.Dag).ToString(), es.Count(s => s.PassTyp == RegionHR.Scheduling.Domain.ShiftType.Kvall).ToString(), es.Count(s => s.PassTyp == RegionHR.Scheduling.Domain.ShiftType.Natt).ToString(), es.Count.ToString() };
diff --git a/src/Web/Components/Pages/Tidrapporter/Index.razor b/src/Web/Components/Pages/Tidrapporter/Index.razor
index fb04f94..6827fa7 100644
--- a/src/Web/Components/Pages/Tidrapporter/Index.razor
+++ b/src/Web/Components/Pages/Tidrapporter/Index.razor
@@ -4,6 +4,7 @@
 @using RegionHR.Scheduling.Domain
 @using Microsoft.EntityFrameworkCore
 @inject IDbContextFactory<RegionHRDbContext> DbFactory
+@inject RegionHR.Web.Services.UnitScopeService Scope
 
 <PageTitle>OpenHR - Tidrapporter</PageTitle>
 <div class="d-flex justify-space-between align-center mb-4">
@@ -77,7 +78,17 @@ else
         await using var db = await DbFactory.CreateDbContextAsync();
         try
         {
-            var timesheets = await db.Timesheets
+            // Enhets-scoping: en chef ser bara sin egen enhets tidrapporter; HR/Admin ser alla.
+            // Fail-closed — kan chefens enhet inte härledas (tom mängd) visas inga tidrapporter.
+            var scope = await Scope.GetEmployeeIdsInScopeAsync();
+            IQueryable<Timesheet> tsQuery = db.Timesheets;
+            if (scope is not null)
+            {
+                var scopeIds = scope.ToList();
+                tsQuery = tsQuery.Where(t => scopeIds.Contains(t.AnstallId));
+            }
+
+            var timesheets = await tsQuery
                 .OrderByDescending(t => t.Ar).ThenByDescending(t => t.Manad)
                 .Take(50).ToListAsync();
 
diff --git a/src/Web/Services/RouteAccessPolicy.cs b/src/Web/Services/RouteAccessPolicy.cs
index 471ee34..f748673 100644
--- a/src/Web/Services/RouteAccessPolicy.cs
+++ b/src/Web/Services/RouteAccessPolicy.cs
@@ -30,8 +30,13 @@ public static class RouteAccessPolicy
 
     /// <summary>
     /// Öppna rutter (även oinloggade). Endast dessa nås utan session.
+    /// <c>/auth</c> = federerad inloggnings-landning (OIDC-completion sker innan sessionen
+    /// finns; sidan ligger dessutom på EmptyLayout utanför behörighetsvakten).
+    /// <c>/utbildning/extern</c> = publik utbildningsportal för externa deltagare där en
+    /// personlig token är bäraren (ingen inloggning) — policyn speglar det så att den
+    /// förblir en sann single-source-of-truth.
     /// </summary>
-    private static readonly string[] OpenRoutes = { "/login", "/trust", "/error" };
+    private static readonly string[] OpenRoutes = { "/login", "/trust", "/error", "/auth", "/utbildning/extern" };
 
     /// <summary>
     /// Prefix-regler. En regel matchar en path om path == prefix eller path börjar
@@ -76,6 +81,14 @@ private static (string Prefix, string[] Roles)[] BuildRules()
             ("/medarbetarsamtal", ChefHrAdmin),
             ("/journeys", ChefHrAdmin),
             ("/rekrytering", ChefHrAdmin),
+
+            // Rapporter: operativa team-/enhetsrapporter är chef-nåbara (och enhets-scopade
+            // i vyn). Men löne-/pekvitetsrapporter och lagstadgad SCB/SKR-statistik är
+            // HR/Admin-domän — en chef ska aldrig nå organisationens löner via rapportvägen.
+            ("/rapporter/lonetransparens", HrAdmin),
+            ("/rapporter/lonekartering", HrAdmin),
+            ("/rapporter/statistik", HrAdmin),
+            ("/rapporter/scb", HrAdmin),
             ("/rapporter", ChefHrAdmin),
             ("/vms", ChefHrAdmin),
 
@@ -88,6 +101,10 @@ private static (string Prefix, string[] Roles)[] BuildRules()
             ("/kompetens/endorsements", AllaInloggade),
             ("/formaner", AllaInloggade),
             ("/resor", AllaInloggade),
+            // Utbildning är självservice för alla — MEN administrationen av externa
+            // deltagare (access-tokens) är en kursadministrativ HR/Admin-funktion, inte
+            // "personligt". (Den publika token-portalen /utbildning/extern är öppen ovan.)
+            ("/utbildning/externa", HrAdmin),
             ("/utbildning", AllaInloggade),
         };
         // Mest specifik (längsta) prefix först.
diff --git a/src/Web/Services/UnitScopeService.cs b/src/Web/Services/UnitScopeService.cs
index 6924ae6..076a354 100644
--- a/src/Web/Services/UnitScopeService.cs
+++ b/src/Web/Services/UnitScopeService.cs
@@ -1,5 +1,6 @@
 using Microsoft.EntityFrameworkCore;
 using RegionHR.Infrastructure.Persistence;
+using RegionHR.SharedKernel.Domain;
 
 namespace RegionHR.Web.Services;
 
@@ -49,27 +50,41 @@ public UnitScopeService(AuthService auth, IDbContextFactory<RegionHRDbContext> d
 
     /// <summary>
     /// Mängden anställd-id (Guid) som den inloggade får se.
-    /// Returnerar <c>null</c> när ingen scoping ska ske (Admin/HR, eller en chef
-    /// utan enhetskoppling) — anropande vy visar då alla. För en chef med känd
-    /// enhet returneras de anställda vars aktiva anställning ligger på den enheten.
+    /// Semantik (entydig och fail-closed):
+    /// <list type="bullet">
+    ///   <item><c>null</c> = ingen scoping ska ske (Admin/HR) → anropande vy visar alla.</item>
+    ///   <item>en icke-null mängd = exakt de anställda den inloggade får se. Mängden kan
+    ///   vara <b>tom</b> — då ska vyn visa INGET (aldrig "alla").</item>
+    /// </list>
+    /// En chef vars enhet inte kan härledas får en TOM mängd (fail-closed): hellre
+    /// visa inget än att läcka hela organisationen (kritiskt vid ~11 000 anställda).
+    /// Frågan körs på SQL-sidan och laddar aldrig hela Employee-tabellen i minnet.
     /// </summary>
     public async Task<HashSet<Guid>?> GetEmployeeIdsInScopeAsync()
     {
         if (!IsUnitScoped)
-            return null;
+            return null; // Admin/HR: ingen scoping.
 
         var unitId = await GetCurrentUnitIdAsync();
         if (unitId is null)
-            return null; // Chef utan enhetskoppling → behåll nuvarande beteende (visa alla).
+            return new HashSet<Guid>(); // Fail-closed: chef utan härledbar enhet ser inget.
 
         await using var db = await _dbFactory.CreateDbContextAsync();
         var idag = DateOnly.FromDateTime(DateTime.Today);
-        var employees = await db.Employees.Include(e => e.Anstallningar).ToListAsync();
+        var oid = OrganizationId.From(unitId.Value);
+
+        // Hämta bara id för anställda med en aktiv anställning på chefens enhet.
+        // Where-villkoret översätts till SQL (samma mönster som AnstallningService),
+        // så vi materialiserar aldrig hela personaltabellen.
+        var ids = await db.Employees
+            .Where(e => e.Anstallningar.Any(a =>
+                a.EnhetId == oid &&
+                a.Giltighetsperiod.Start <= idag &&
+                (a.Giltighetsperiod.End == null || a.Giltighetsperiod.End >= idag)))
+            .Select(e => e.Id)
+            .ToListAsync();
 
-        return employees
-            .Where(e => e.AktivAnstallning(idag)?.EnhetId.Value == unitId.Value)
-            .Select(e => e.Id.Value)
-            .ToHashSet();
+        return ids.Select(id => id.Value).ToHashSet();
     }
 
     /// <summary>
diff --git a/src/Web/wwwroot/css/mobile.css b/src/Web/wwwroot/css/mobile.css
index c2d6e4a..6da5c7b 100644
--- a/src/Web/wwwroot/css/mobile.css
+++ b/src/Web/wwwroot/css/mobile.css
@@ -11,8 +11,10 @@
     /* Forms full width */
     .mud-input, .mud-select { width: 100% !important; }
 
-    /* AppBar: hide search on mobile */
-    .mud-appbar > div:nth-child(2) { display: none; }
+    /* AppBar: hide the omnisearch on mobile (hamburger + icons stannar).
+       Klass-baserad selector (ohr-appbar-search i TopBar) — robust mot att
+       hamburger-knappen läggs till som första barn i appbaren. */
+    .ohr-appbar-search { display: none !important; }
 
     /* Reduce padding */
     .mud-container { padding-left: 8px !important; padding-right: 8px !important; }
@@ -33,7 +35,31 @@
 @media (max-width: 960px) {
     /* Medium: 2 KPI cards per row */
     .mud-grid > .mud-item-xs-3 { flex-basis: 50% !important; max-width: 50% !important; }
+}
+
+/* ── Responsiva tabeller (MudTable / MudDataGrid) ──
+   MudTable stackar redan till kort under Xs (via DataLabel), men för
+   tabeller utan DataLabel och för medelstora skärmar säkrar vi horisontell
+   scroll så inga kolumner klipps bort. Ligger utanför media query så att
+   scroll-behållaren alltid finns; min-width tvingar scroll bara på små skärmar. */
+.mud-table-container,
+.mud-datagrid .mud-table-container {
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+}
+
+@media (max-width: 600px) {
+    /* Data-täta tabeller (icke-stackade) blir scrollbara i stället för hopträngda. */
+    .ohr-scroll-table .mud-table-container table { min-width: 640px; }
+}
 
-    /* Hide less important table columns */
-    .hide-mobile { display: none; }
+/* ── Kolumn-döljande hjälpklasser (opt-in i sidmarkup på <MudTh>/<MudTd>) ── */
+@media (max-width: 600px) {
+    .hide-sm-down { display: none !important; }
+}
+
+@media (max-width: 960px) {
+    /* Dölj mindre viktiga kolumner/element på liten skärm. */
+    .hide-mobile,
+    .hide-md-down { display: none !important; }
 }
diff --git a/src/Web/wwwroot/css/pwa-enhancements.css b/src/Web/wwwroot/css/pwa-enhancements.css
index 58e9fd9..c7cefae 100644
--- a/src/Web/wwwroot/css/pwa-enhancements.css
+++ b/src/Web/wwwroot/css/pwa-enhancements.css
@@ -158,6 +158,7 @@
     }
 
     .ohr-bottom-nav-item {
+        position: relative;
         display: flex;
         flex-direction: column;
         align-items: center;
@@ -228,6 +229,13 @@
     .mud-main-content {
         padding-bottom: 80px !important;
     }
+
+    /* Lyft OpenHR-assistentens FAB ovanför bottennavigeringen på mobil så de
+       inte överlappar. Kräver att OhrAssistant-wrappern får klassen
+       .ohr-assistant-fab (se wiring_behov) — regeln ligger redo. */
+    .ohr-assistant-fab {
+        bottom: calc(72px + env(safe-area-inset-bottom, 0)) !important;
+    }
 }
 
 
diff --git a/src/Web/wwwroot/icon-192.png b/src/Web/wwwroot/icon-192.png
new file mode 100644
index 0000000000000000000000000000000000000000..2c9f70b364b6c3e268a82ac6c1eb275dda61550f
GIT binary patch
literal 2778
zcmds(=QkS)8^G;#DXsQ$OU%;JQnRS2ak;c=#fp$pqtq;Etq`he)NE1JD7ANpy;p10
ztQs*AsnMosB!VWQF<$rk`xo4Ep7G&1=XuU~&hNu7+1k=nfbSw73k!?DZ8KxgY486x
zdDu=Xu9s=e!opW{+t|=9JfDn%+szUHBRiM+GCA0ujzTF~DQvzyEX58=_Cn3=O%V99
zqHSB~6Oxl22p5d3AbGXS!yY?pVN!A<uHkC+AiCU@(3(nv7MWtu1rz>|5w}<aw%c@W
zD4}YS{gYONk#-@b@JR1?_dNbcZhDXT@`XL;iU|w-ReL1c*Hs~*OerZTLj!}j*jNr$
zR$ex?a~vF(czDeILjyCY-qRCXh0Ugo!E%#?yF3C()IDAsg&t3dkSaG(6=K?v5;QW+
z!EqKFY&i>p)DX8c+ar6W&LtbW+Yf|drVKKZV6WC4%H{OWNv=urlU``M-6-swX{cEL
z;ytg$HSqv>Px(fFeaPRvEhU;t0HX80z@D8S!2&MlUEWespPL<^bDRT!g=a3gtG=DU
zag{jWG4IKpGpiA3G}*JR9JR4ZwOYTV+{>n9nGV+sbMTKXw1~N*_;SJ`DIX~m;as!w
zcyn%`nlzP%Gm}1>asgy0P2;zYl;@}>q@{=-5^|Bt`*tqN&cRhd{hN&)9Y3Fsge&mH
zG={q#%Q%xdTuUJ>gr$7;nmxAcf^_8D6*E48#YRuc678y*`=E;^H-<w)*$moACt^#%
ziTMEt_s7KLip%i~-A(_%%b>cO3~WZ@$VmI<JXFXU<YTb&wrmY?>kN<pcHJ)4G{2m{
zd6SwSXe@n!jv6g<87B|xz8A{b-LTJK>aGDsrfqv;>{r3AL5YP+N~2|i3v#f7K4pyH
zj63>APetQkLML70aVS~;#9}6=Ghqrvr`(GvlW`$u<%sTWW`C?yRUDS&w^s<emG!P`
zL%3;Z{d00x;zVL`@lkZp4)krXfR9(?SbjXuFiX?WE<u=pzoMXyZL9V9Len5dPAzEl
zJ?UP@?9JYLt7V~xj$E5a;)Np?N&#ge;@SaIy=^&C!W{b7BitKe?%jz(K-AzB9&7QU
zQzw+e)xqqLjI=+#EO{W%CyV8>75ol=mL19O`3-qZpKM%V{%$-*YvdRO?gLFPmVBC9
zF4K3aaSEfRVEX`W^@|np+%V*#6oR$xt~u{7x;uY3li~QB;F|!PemYij3WX|H>JI2o
z!=rd|55|3=?JYgqQJt$HW^k%sK?)6S_Wg&?qd%Z7kVMe$4r0F7M?|1nEyhI~6!lDG
z{#;Sf-?wqG9nt=oI?pRs5i4;<Fx^90?Zg@sNPb5$e75bC%6itfaIW(6n$>g~mbm3E
zP9{r!y^&>@&o<^B2&2&jqaaYfS>6;Bc8-RoR6Iz_XeGu|;-b9*NDDCJCn-x-uaBu-
z;!0IjvtrDEn??8gf7P37{l)&EJunPkB{Nr>mRhY_hkc-yWNVN$7$<6aHBfUYc<ROP
zf4*PkN*~KG+;aYNq_>K2dJ;%~8W+_arRPNYIX+1a&8Oe7<=&{wosgZwAdiyQ3^$$~
zZ3i6W0J7F(W##=Nd|$Pc<OnF829O}TE^Pf~TgZ7D<LqRv=!a@u^%CUSZ_;^xcJ%K|
zMueh#{BJ_p$9l7t&X+!|;Cr`z$>FP#jicE3s1oi0RrC8x!4PQSfcsh1)pADA3+?!5
z#{pWRWqw^y=y23xcof&}FE=k=HRmnoD9E*9iIN!#2A~<q<i5us%<NCwb!^T@9437O
zJq>QoXm~Q?Ax?cgz6HnG^n137*LKo<ck+IB-E^FMYHF|rFydUhS(J@F-lB%d<6i!=
zLTk!+G5!;5ZgVEQ`#HK^HO|-{4^IPM+kF+G!bQcu{-$6=-rE)_V9W~V-O(W>e)R{U
z3<7XHTdatJ5Z&X(=*^JCpz)j3HZ|?cq@ja{pRztY+g;W5!5e*Kg?*)7OxsTYn_uQg
zLvJ(-a@H)dQyzz|1Vh@?6|VjGaA=b1U7G)5<U(bOb3I92rC{bZAMF%QG_6_Kh)vX#
zHheq`5B%$Mn4=*Yys4Bc$5AbEdE_W+!E=~Nn^<g!n;;@H>>uTSZwvSILnl>JnpL?<
zP0*BVrz6{$S|(XUYz2EX;E-Z6H}4Ise|Qi*lb5%`7v$$;UiTz#c7r{!{gN(w1!<Lt
z3==hN8a7?|tpkzgNqMy{%I?w&46a3z-&s+B6O7U;!tt08@16WFr?};)NIpA#4zS={
z&@8Wr{7~a|J=%2!FyH*x{}yCQG&AeGuBJ@<N)%TxUu9#_w+Hac9{t0dM78_vOav%-
zv&~6elwD(4nMt8$Jc?23`P|>#)rLSQwteDXKc6`yvpf{_Mr#=#2L1l)egSz%$99+#
zy}BLdXxGK$elO{%k=Lpsc{nK{nFV~^()vgn;n#=zmb)mXE+%2_d_yjHbnjZ;n}&z?
zxjbSW@cYNalpE927Uv7<9)6*zaGeK^(PTbee;@d4XR@UBNjdo1GTMLOs*ZXc?!&Io
zB{7lG?I?L<PYh#WhmSss3Y_#&>w&EUJq%VqGC0!5RZ(45U1Qf9_u(AL;pFazuJzL=
zP<krSM!HC`?5>cJ-B{IG>C+{J@Q9&=gNIvyrpC_UFsqL5y&76wV>R0leAw%xAwS7?
z!vSh8lHm<t<LPL--Gh|z#Xg*P5nW;QuF`1p0SH@5a)N?^iuy-btDr5s4dg(KG@j&T
zdkznTpk{W%-=yy!hh?F>iKq{$C$U=#OMc)^(yR@YXZ=w(yt8`6jplTv%6RvSi=~LP
z2-ctjJ6CX&n*m^I;YvxLmV&>^!1~}C9T-2xSAM@Ds=qI&K`?_`4GQC?_>yo=D|{)a
z2E=u5M!IWVVNV@3Bumfgdsls!rGwgy@(ZA~Tv&O?n}qS+bqcC?y9!sRgonrPTD-g%
zfT<QtK^zW9ANN@kLIQBVqrI=IbJbc}*}xU@^#nv>tbVQiT&@Z_i9T4BJ?RMT!fRl+
zodGIHD;G>H)=?v3ufR&#1@@EQw2|x@HOVMa_$J}^K!0mXr~TLu(YHZTh`FSExU!w>
zz~o?F`Bw=HRo>j~Ibjz3xH<_S1Zw53`aGK7v!&|EUXgla%5Vj+{3jjh|485o=O6L{
VQ^=SSol|FJxou);j52bI`yUH55Ay&3

literal 0
HcmV?d00001

diff --git a/src/Web/wwwroot/icon-512.png b/src/Web/wwwroot/icon-512.png
new file mode 100644
index 0000000000000000000000000000000000000000..c15d9e93c63bc65770d8cc9a165c9f3c209ee775
GIT binary patch
literal 7754
zcmeHs_g7P0(C(oKyh@WQ28hTDh)7X72tisbRH@Px1f@4=CIm%9K|lpW3{85kQUgRp
z2t}GyX`vH3gb)ZNe8=yu`xo4`?oaPpd!6Kmot)V-vuB>?nYTs;aF(+d&jJ9za_6@8
zeE^^ZztRFse?OjI)G7f0!Si>tZ<z+AY)l0Q4eh0V-|2KJo#Yh~VuW+)F(u6=6mjXu
z@km<H=onkK6+UrWGbzDLEdKGBsvgq0*X`M273Z5TX=Te!uRP=}#&khL<I;lYtI1?N
z=No@u9X!=9Z17&8vb(`p>e}vDAEL)`DHTs)i9)REZ~_{FRRiY$;6gY6gc;ETz^lsu
zaEXfs0KPH-0Fw>?Xj}o!)I1LW>{0)1`Oh!^CBy&oCFy!ZqIEc1Va3p<BLatKYs0g3
z;n_d6|Aj}umE48Q-QEmyJgRzSd5yKGZGKOoUM<GcFn(fiY~7O>)H^KCV=>BWKFVzd
zuHn>@Ldk*x#X~$p82%E#P|kps<(RL$&slk&1AN}#n7_6Z%hvX?rzPN?x9OXcv!{BG
z!*?|X>KlI$|94dq8+4x)F|a>*c{x2~fFOVSJY@BA@^!+eU*Fcs_}E>m$Unr=^7F0I
zQLb9lq@%N4jU^>b+i$0KDOGsGn72ksGMg)p1<NdEzxUR8{G1ux>M>XH{uA4XqT&s?
zSWT&Zn>W4OiZE?!o=<&hgV5HEz0QHvgJ#2Hri<<k{r#r*t?j+PlGh`~U!Idc9{!D1
zqV1Ow9lGx2e;D}M7CH4j+riJsE0i>I@EK|dIhlW&C9w*DDfu2srz0!owI6y(0d*bx
zTu!z06Ot_g)c9)sQZ12XHtuv)Q=5vs4AKzA^`t018h9dit)TD6Tj6D=oJdO+sxmGz
zQtCody@SmX@3K^JhjN|h{*&--kM)mX0Xiz{@q-`5@<i;9)6ej_)(XHdi$N_*S$XK2
zlI^9E+w6d3rR*S&e$N-u>FN2SShvIWW|^ajXs<NVG7@e#-i-ZL(?Z~;vAA(bfk^$Q
zbu(S2xTbS&^J~1<lHdu+v|=FoEI++Qg_{XSsJvSgTj(Cj>{TndBf)sz@B;Zac`~VH
zSwX>14zTB4DYw5Fr3Rj4A**Q%75Y1}%$35DMrS0dtn#SMR<>5{dLIsZaw_%HHQ2fR
zpfPU?<Fan#XH;gF0yKDN`yNBidHy*We4b~Q>PoUY7NjwnfALSNAF9T|)4TzX{6LOo
zJ~~O^LknX3G~BZX+-OuJ)P%?<kzS|i!HVs#Ro>Y}Lxlk~Zpf-7^0b(D>$B%U;&j>t
z#SHu2_}yja97q#;#<|UlsXHt2foz6RiXlSOD1g*a%aFHuyrNd?l*`w|e&#ZN4R>IV
zP4MV1rpO*bHISOfFHjLYkn*6lOd&)l^ey0z|8Ykck9-n<?U2dh&HSBGOo|gsNAr99
zn%C4&d}S$FHtpx<a4ay=&7`4tvev_ygb1|Kuv2Zy^;-X=<9CB&?wuV|{{x;Xis8PK
zVg1!MLc{?dZU1AQs$j|_A1qmYgb?v0fs4C&r$V(1lHf$r4C}45erb<UR28~B1a9V}
z?U!#^${6LHyn*^<1e##$|K?;WqSg>Hi6=w=socCg#3N<dcXkmlA;7kZL|*YVkXO0Z
zQnZPQu)a0}cg|*8aIWbU25h%?A!3t?p`Qne2xhYZ6ZWCrXydZ?^bNCrAYzu`6z4Ur
zP`%V@FzIAv+aXP7>HgJyUGm&JfH`jByCL(t=mr<}+<~HPHu?;cb{0Y{DRxD-?1zlj
zVSD3^(<P0@`F~zKoz4EBE8PM+*l8_l5}ow42Ho20KAxl9R78oFjwYV%HZ(O&EzU1>
z_g0X@Kx{nS%9STQ&sA9;;j~#}<LX6)0=mq^wK$)zIQOh*9iDm<^G~S@Rnruu46)au
z?J>7wVWu_@Nty@&8p7DeEd$5}-kc+o6wkhfaGb@KYGq!=(A4i<PjkVt(G{}k5W3fN
z1c9jZuuuBgQNI4`8)G{g^h5E<{f)WxPE`XgLGhxYlUo{nJw12D0D;SZz~2gi!8tuS
zdBc$Oe1&`>;mbOrWNUkJ`e|69v2tx&0>c_7@ctkgE$WJdWwvr06Q>lBN40LY>)kZ*
zokMR+6vJQYk!Kt*!yLRkzZGx#8`%t%XRA9N?L!7(#`~K=gOSWK$)=w9eD9gQCu&EI
z*$*LBQ68HW_Qj{!%SRcT5?9cBk<b1lKfTwiDycIO&41%)kFr9l=tI_74<hJ4kC>ap
z=jC(`-k<kRRk3e6(t9gD>U1Odk(NN<yN0C?;#sAuoFyw+vK(`dGzH9J^uH`IGDy+d
zcbbgG4enR|VMsdqDvuVl!`zvb8iNoG_3au$w5Z}{bf*KHgSw1kYjOQYQgR9<lfmAT
z9~G$-6zr+zfUgE0m(!dvne}{F_bQaLV9W01@A20w-6PG3fqImM!uDK@9TL^~si{lM
zp6gNdP1Ri${Z^qU+?s8T@YV>dxF}G5?Q?qXQL&09Am!#m{ud)+iCg$l*nm#LB8!h-
z#?JDd_zsq~L44&{(qYa|%BGO7!fMz2JK4-VhAOc0mrnLQ4^(OUn~lYhUQlIi+}~GP
zTNJC>KFD%Bu#lXpIgN-TuYBfrXSGUEyMuG;__jk>sb$TFT@?Kr)eUPo`Fl7&L&37Z
z76`;3wagsWpmy5)bU8$Al+M|i`QmRyUGPVwboBle7}M>AM`my)4b?;4SJMib-3(gT
z$-1?z+U@<9Bj$rzZVG87g~Qj6Ti)Ju|K~CIU%kp^*#XX<dkO;_W`ux^I<I3H>+-{@
zQ^u$+6h_#BGA7~XT@OVa2@Aw;38tQRUgl-)LIkb98-Eenq#w9-3BYr?vmR1k&355x
zf~=uPKfh>;)|}E<cbE@321)6{=_<MJR+7{&GaCE$eJT*R&~;t|&h%Ze=hp?WWRxP-
zS0{xTnzd&wAc68vgAf*QaiNi&sH@d<O)8#}XRp!Epq*JvP-JX<&LXAfc|zPqBN)3x
zWyZufflotuD7|cA#ruNH=AAC-PlT(}4}J^LZp$xaWI$vYu0k=+rvpC<RTdpF3ppG0
zDuVUDc&cC*{oOp|<rOg8tV1NkgG)kyy=<rhR{fz+7p}STsGOK=Yi5i;pw3Ds#`Or^
z1v2#fo^Q2m)DRmOA_i$WXb!%h<q@e!bN|h%OusH%KzJ;xzTUl9|FOil2tC%EzUib9
z_AplVu(IUj>$fSt<m=&yed}q4*lYJgMY}G#r>SRS$CKZSkMU=dn^WTp%dRpC(t6*?
zZVlDPTP`|QH>0bH)Ri(rug^1(Ow>7PMYLZfC#s`R-%@&_RWtx8zQo@alr<>vUY}bC
zd+l@oM!vc6q2?|Z%?##YuM5A_tV{nlj!8~A`KOmBh&nHb$!Z_`3OiQF`Kih`3d+V|
zla~g^sBh2aB@Qd3%y1cju@HGs@K2Y^rsNef^(wJRNxMah?ACR2JLbqV%+vfX3GZfd
zZIahzAjzgk2slDq14PyI8x(X-;#f184WlfM><7Tw#cgoTwDDSj{+r><<F6x`t11x_
zYK4{ddk_mfQIn9DhtbPw#+2iEU1=KIT|-&1D=FspO|bLYTTKC@C?EQMU7YT!Jz;XU
zXu=@H1ocSn!Gr?o{of`!4)-=+;5R)of2*Mbj1vyds{XNtVEsD_x?C5fJAZ#LWV$Yl
zoblRfyfyp1uwB$Xh&(OL9;P5Zu!;v((S2X*Zc6G5M?o2d0RjU?<Y0ww9*>wYuVw?J
zDNnp&26Ma}fcc9W5CQv#F4716oPfQV_gC|cGjXBD50^47O*cmyM6t1@q7$jDomuxC
zxlX4Au9jMUoo%aq5e0l3@HtCBgqu+GM0!Uh>^`@-8@ywdC@8Q{<)KPl>2Q)~R4x8A
zCIf$@ZE2OBKYM3qo{@}E5V?h`64p=q6gleYD}l_iaS#SP9%&9?2Yv<8^=DA0vkB~~
zH1FF-H*2g&BhGZSwnVrM-IMwLa^w@8roJh<5aWndVIV#YdZ|AcJNa#GgU<d!(^;4n
zFn$FOYp5O`nz>((iO_tezpB{fK<9aZ08^iAa_Y9rvY163<alsCGC9ubuQ>U1Rb@mM
zaA1lXJ&J!eVK=c`KX7j6-tq4mA4^ll?~(h$!xaj&Vbd0-w)_37`l^P!AQnNjNqayR
z@%GIK`V7Y^_fnb+#p;?b=F5T<%5$h+H_CAP-h}AwJ^iQ6h<lB()#9f#v`O*SmgHY}
zb#k@E#-T86zb?g^xY2SI>S=lpH=b|`yg+?h)>}Dez3-tCGERt~XQJ(IUol7EV)a)B
zH(XaN(N%xoUcs6`zE8unn*ZFQZ6qtV#f7F%VVc0W(o~dT^aO&!q@e|TQKAhKbn}Z-
z+ntUD^B{|tBP@tDBZjzDmT}1>AFOV<S7!tE&Y9R5&142=4aS{xhr4a2%Zp3?Aym^}
z1nt7{y*t=uUzAOJ!^UQ&ZbDI(o7v+3Gz0crmN>*#I2@~}yE4-9<9wLHu>Pu-=o)7(
z^||?5^^0AmJySvbUUL}>Y*2KS(({kf>5uk==`-|wst<XSR}Rw5G7Ue^MN|h_cduO>
z>ZKp&c4rMCPB<z^e;HK#0YCjt6t<!FG${^=<BIRhM#MifOOP%uu4!&t(=t^5sn%4y
zA4uQ$e{lciA{)1x>0P{J^ir=Kr8h~vek%<-!<3=_^)+B404+f{_x*VpZeqr$fiq;Q
ztE8#;@E3S`Bi@0Lb)?UTi4_hjLK0y;w|tCSoZAdHR+U~b_+L@KNt%kN;#A@tvIVVv
zn0N><udGGWT=>Xdgb;-TGI#I#|13Om_R+6<&ZGg!o5(^Gk*L={s0XFq#o7Afx}~qA
z|KtCAjOH!&i+mfw>_7x;*S;C$Hk6TV$0M=QK3GnGGh56sdl;S0VwcO0{p#lxYF9eA
zoU3$H+>Kd}W}2@Hf1Inj&zTEiXqJ(K<s}fT)}|_9T5zGG2q;b6zqRFvk?o@4UVcTH
z&OBO&>u7NEP_KW3ntjSV6X0QGt-n{g6k_3bNB?Ai*tO4^E|;w5^H8V?&T1zo?`C9^
zklTk`iCx=I5icPP$J8M?^TMQ*jr<KLzaX!fjlhy8nkyoKr_4C)D5p0ta;fK6wor(@
zTJxyg_Bj^in2>46nBrwp{R5L{daMrgGatcoloVoduSNFm#26#23dB4+^-R=d%iiz8
z2wX{dk5_6=Mx~#d;M90U<DX6wNCg&otDpJv!8$8%FuHSgFYiWWWZ`M=MvXfQ&6tHz
zE<%)c>_cT&ayMSx<S!s7!yZXSCzn<C&WY{Gqhr&I)%~Uk%!{%Zm-|+gM3*o%yDd2G
z+)%IfcZt$c^a&B8(mU$%?@#1u1K5KZu7dp!`lQYQo%luOva%gz%rnU0<)QsM+q`>Y
z3EWfOtB5_iBK3ZsJpxz@TQ?LI9qIlyHMKJ$D%7jN+YRTtTmsB&EIUdHw|s6S>rDnl
zdQSLcZs%+qCB|)V@({D0W+le4+@_y#vuZ4X3aVxy)*A=-It$Zf2!&96NQt9xISZT#
zXxOS}3tUc0vrs1wh-ZQD4m3@Wc3Xc7s$PJ|o#HqqvCRK%<{+$%h}XReMcaqi4d&cr
zn)TeF9+X)p;*q?bwI_rLM=mxNZ4d+~2&kFd&!P@H@8Vc{Zoe^6uZd4<@_9*|IMo*&
zl)$h_r2q4j%#%>sqgseq2WjY>>DKe}K_JcuZk)E*N0cIp+uW%qlaK`L>nhn?o5V_o
zNts2*HQOGrW{5-2y`XM{ry2~SeIv(<4ZTG&zzZx;wyD1EX^c(nAPoJ~F{w(3YpOIt
z?*#@<vuA%*b@PoI!F(C+i?}Hwzb6qWcwhZfco+yU0}@8%oAYMxhIKj}CZR<Q4DO9w
zueZH*E0=rMlRtlXLqfuD=(Jt4ILCTlzK#of`SOr6a?ZNxL@WsfqA%+jVM9uUczmZ5
zivrdMA1H?uKFxCRYBZp%ZAgtH)|sWl!Zmp>qRrQD<|Ed%IN`qR-e>4DkRVvYEBo8v
z7RHQlc)>4I=O)g;c1nuVSL*jVCdLoTAin;3ubsLB7Q|78HlL>sl^AJ~;2@UWd7ZNK
ziANxwv0cX_WZj_TC_+uv@feGOkMi&pk)Z=VTMDm=+`UWteMKDp?W4D0rKu}^d9GT*
zcL*A9_m}bQ?F0wDyO@da1qof>K5}_k(ZEQZayf5ecQSYC%WJK=#}j_f`02e>`xn{6
zBpy^g_A+yf&z(KbIw7&^Wv3pfi>Ryg5O#59J|uNgs$SdXxX!?=Kquh*I6x1o;AarQ
zNr#d5l$h%HX}v{;4MyYFYFtm=P#j-}l7As#O`-1Dt<&+!StgvPHQr=vJl1TDOh?IC
zM(qyRA$MQkJ^Re4dVmG3R3zX(lNv5IvQUW9+bR07QDZ+Tw{svZcs!K?5oNu*`Fr9Q
z=Vi^UbeZ*eD872{ZT%p_{%Gy(_|665x0~Ob<GZsK8<@O}b&&JWz^8Q_GH=7f0?Ng_
zacLngM?Y_M(mmRnuH}4GJ*ld&J6)0dOuq+;dXQjY8Jd~7>ZD_4=4jH?J=H(yE{|?q
zukpsn%ZvJYBlJQv*At5FgA8e)p|H%VQ7F<4OE@F#(Rb4FOn9id@n4XB%E_<c6*f(k
zWC8ZD*kQ~Us8!WYIDB(Gl~-9?$sJSxR>m+DVl@J=BYe7`Ob9potc~q_dH^)kzpL66
zr+zbdp)zilWIMbIPoZ5+P;<Ha%$|AsF|N-{t$dYEz_6WWBjo9G&-m5&7?4iSH&LZ{
zpm0ECty(P|h7FDzD3Z~5;L*Avjcvv26Z9Wfvy{08jjp%G!`r<@W+a$2cyI2{ZjSCR
zL7JlM%(h&q)6i3MOEVXe=B3`~39<ypeg2-oY$sU+s|z$Nbz(hjrJXr{iW+twkB&g4
z3S>fr-sgX-nU!aec18vLzQRgNjRpK;K<c%9cxZMMccF=W!!@P!kHqw!(7ED)b1!V}
z$@9~LCyy&=Zd}JQX(WO78;+lB^hY1|6eHna576(%PX{-Q5h66cef)B$D3{`YGP__r
zAfy(udBcG{%oFtUvdfm|KEqt<b<htz2UFJYuB$P2Ob&--9!H7T`0GC&uAP)5BRFXY
z&9DXjlqTX-<v7D%;l!R5;d4@{7+qMudM@3_#&&<XX|=Boyo2Xy2p=}YdJT@t%pkOL
zmENFO5a|XxZdr|~)|bi}rL`gc7(sT`K8f)j6P&*k29Rt(jj+@Lf7;pL(S>&yMw8Pe
z(ck>5H){oHri@H&YhBZ0!^1xC)3XEe)Vj6)&-Pd<`GxfHX6D~;%zJqy?_g>{Y2ZQ=
zPX-eEr@?}9OC!6r^w@(lG!nRC0%EqA)tJGglD#Cf3#cuW)vh;@DWi6HH1xei)p?n-
zMXTm+b^C`P-OhA^f-h+Ubqy~&Y7)jCi5gwu$Qt#10H!diL;3UGu^V>$+dT?{UKp#i
z`_%GIA&iL~yi#6t!;g^Ef;~#!Yq2&Mm}dLBwprx18a1C|o8hRG@FKrBxw?btNSJt?
z5k_>M(BvpP9E)`7%EzO8Gup*T?ToR2oQlo;3POn_ANF{@4}TQ2yfVjA_Au{3ucFdv
z<5q`<#55mfVJ}gYjkv*vBBA5H@zdXK=9rN{B{P(R40<u0-;&z-qOSZs`Ub;emt0#^
zPuR4w=m8P2cX(_9Az~-}auceKw*y_Sx=sI5RRE=@YDZ}54cGdi@UV=IJUh7%mO0Dt
zp5&85ryNlm^hX&Lc_B3+gJE-7u*9lMs3cifezLGkv#_+gXvtPUV-yWskpAg<XN@zJ
zL*N6rE^_{Ta&Zf;lq(m1GAe3&SPhD4|5s5q2#l`!vq1_<=}C(^Y@b^_{IS}Q39iD1
zmxbex(q_)|KTV;%kv6!|DXrEQfB{1Icwf-`HwgM~K=$8M@c+*!H2;*&r?t0krK3~;
QoDl<ebPTjhH633559`zLWB>pF

literal 0
HcmV?d00001

diff --git a/tests/Web.Tests/Pages/HomeDashboardVariantTests.cs b/tests/Web.Tests/Pages/HomeDashboardVariantTests.cs
new file mode 100644
index 0000000..d8081e7
--- /dev/null
+++ b/tests/Web.Tests/Pages/HomeDashboardVariantTests.cs
@@ -0,0 +1,50 @@
+using RegionHR.Web.Components.Pages;
+using RegionHR.Web.Services;
+using Xunit;
+
+namespace RegionHR.Web.Tests.Pages;
+
+/// <summary>
+/// Låser den rollmedvetna startsidan (Home.razor): varje roll ska mötas av sin
+/// EGEN variant. Det viktigaste testet är att en Anställd (eller en okänd/saknad
+/// roll) ALDRIG får HR-/org-varianten — det var det kända problemet där en
+/// anställds startsida visade en HR-dashboard med organisationsövergripande KPI:er.
+/// </summary>
+public class HomeDashboardVariantTests
+{
+    [Theory]
+    [InlineData(RouteAccessPolicy.Admin, Home.DashboardVariant.Admin)]
+    [InlineData(RouteAccessPolicy.HR, Home.DashboardVariant.HR)]
+    [InlineData(RouteAccessPolicy.Chef, Home.DashboardVariant.Chef)]
+    [InlineData(RouteAccessPolicy.Anstalld, Home.DashboardVariant.Personal)]
+    public void VariantFor_maps_each_role_to_its_own_view(string role, Home.DashboardVariant expected)
+    {
+        Assert.Equal(expected, Home.VariantFor(role));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("Okänd")]
+    [InlineData("Administrator")] // nästan-men-inte "Admin" → får inte tolkas som Admin
+    public void VariantFor_defaults_to_Personal_for_unknown_or_missing_role(string? role)
+    {
+        // Fail-safe: en icke-igenkänd roll får den personliga vyn, aldrig org-KPI:er.
+        Assert.Equal(Home.DashboardVariant.Personal, Home.VariantFor(role));
+    }
+
+    [Fact]
+    public void Anstalld_never_gets_the_HR_or_Admin_org_view()
+    {
+        var variant = Home.VariantFor(RouteAccessPolicy.Anstalld);
+        Assert.NotEqual(Home.DashboardVariant.HR, variant);
+        Assert.NotEqual(Home.DashboardVariant.Admin, variant);
+        Assert.Equal(Home.DashboardVariant.Personal, variant);
+    }
+
+    [Fact]
+    public void Chef_gets_unit_scoped_chef_view_not_the_HR_org_view()
+    {
+        Assert.Equal(Home.DashboardVariant.Chef, Home.VariantFor(RouteAccessPolicy.Chef));
+    }
+}
diff --git a/tests/Web.Tests/RouteAccessPolicyTests.cs b/tests/Web.Tests/RouteAccessPolicyTests.cs
index 05873f0..5bf5495 100644
--- a/tests/Web.Tests/RouteAccessPolicyTests.cs
+++ b/tests/Web.Tests/RouteAccessPolicyTests.cs
@@ -200,4 +200,56 @@ public void UnknownRoute_IsDenied_ForEveryone()
         Assert.False(RouteAccessPolicy.IsAllowed("/nagon/helt/okand/rutt", Admin));
         Assert.Empty(RouteAccessPolicy.AllowedRolesFor("/nagon/helt/okand/rutt"));
     }
+
+    // ── Federerad inloggnings-landning (OIDC) + publik utbildningsportal: öppna (pre-login) ──
+    [Theory]
+    [InlineData("/auth/oidc/complete")]
+    [InlineData("/utbildning/extern/abc123-token")]
+    public void LoginLandingAndPublicPortal_AreOpen(string path)
+    {
+        Assert.True(RouteAccessPolicy.IsOpen(path));
+        Assert.True(RouteAccessPolicy.IsAllowed(path, null));
+        Assert.True(RouteAccessPolicy.IsAllowed(path, Anstalld));
+    }
+
+    // ── Löne-/pekvitetsrapporter + lagstadgad SCB/SKR-statistik: HR/Admin, ALDRIG chef ──
+    [Theory]
+    [InlineData("/rapporter/lonetransparens")]
+    [InlineData("/rapporter/lonetransparens/00000000-0000-0000-0000-000000000001")]
+    [InlineData("/rapporter/lonekartering")]
+    [InlineData("/rapporter/statistik")]
+    [InlineData("/rapporter/scb")]
+    public void SalaryAndStatutoryReports_AreHrAdminOnly(string path)
+    {
+        Assert.False(RouteAccessPolicy.IsAllowed(path, Anstalld));
+        Assert.False(RouteAccessPolicy.IsAllowed(path, Chef));
+        Assert.True(RouteAccessPolicy.IsAllowed(path, Hr));
+        Assert.True(RouteAccessPolicy.IsAllowed(path, Admin));
+    }
+
+    // ── Operativa enhetsrapporter förblir chef-nåbara (scopas till enheten i vyn) ──
+    [Theory]
+    [InlineData("/rapporter")]
+    [InlineData("/rapporter/analytics")]
+    [InlineData("/rapporter/flight-risk")]
+    [InlineData("/rapporter/kpi")]
+    public void OperationalReports_RemainChefAccessible(string path)
+    {
+        Assert.True(RouteAccessPolicy.IsAllowed(path, Chef));
+        Assert.False(RouteAccessPolicy.IsAllowed(path, Anstalld));
+    }
+
+    // ── Administration av externa utbildningsdeltagare: HR/Admin (ej självservice) ──
+    // Självservice-utbildningen (/utbildning, /utbildning/elearning) är fortsatt öppen för alla.
+    [Fact]
+    public void ExternalParticipantAdmin_IsHrAdminOnly_ButSelfServiceTrainingStaysOpen()
+    {
+        Assert.False(RouteAccessPolicy.IsAllowed("/utbildning/externa", Anstalld));
+        Assert.False(RouteAccessPolicy.IsAllowed("/utbildning/externa", Chef));
+        Assert.True(RouteAccessPolicy.IsAllowed("/utbildning/externa", Hr));
+        Assert.True(RouteAccessPolicy.IsAllowed("/utbildning/externa", Admin));
+
+        Assert.True(RouteAccessPolicy.IsAllowed("/utbildning", Anstalld));
+        Assert.True(RouteAccessPolicy.IsAllowed("/utbildning/elearning", Anstalld));
+    }
 }