Skip to content

CompanyMgmt

Attendance, leave and payroll for any business, from a tea stall with two staff to a company with branches. In English and Bangla.

Code
CompanyMgmt: the owner's home on desktop, and a staff phone in Bangla refused a clock-in 2 km from the branch

The problem

Our CSE327 group project was a 1,000-line FastAPI file with SQLite, in-memory sessions and unsalted passwords: fine for showing design patterns, unsafe for even one real business. I rebuilt it as a product any business can sign up for, that works in Bangla on cheap phones and keeps every company's data walled off.

What I built

  • Tenant isolation enforced by the database: forced Postgres row-level security on every tenant table, composite foreign keys, and a test that calls every route with another workspace's IDs
  • Clock-ins checked against each branch's area on the map, overnight shifts, per-branch time zones, and corrections that someone else has to approve
  • Leave with Bangladesh Labour Act defaults, and payroll runs with four-eyes approval and payslip PDFs in English and Bangla
  • Security aimed at OWASP ASVS Level 2: Argon2id, rotating refresh tokens with reuse detection, TOTP, step-up confirmation and a hash-chained audit log
  • A Next.js 16 static app with a per-page CSP, light and dark themes, and WCAG 2.2 AA checks on every screen
  • A FastAPI modular monolith on Cloud Run, Neon and Cloudflare, provisioned with OpenTofu; it all scales to zero when idle

Outcome

  • 168 API tests at 92% coverage, all against real Postgres
  • Browser journeys on desktop and phone, in English and Bangla, with accessibility and CSP checks
  • Rebuilt from my CSE327 project; deployment is scripted and ready to go live

Screens

  • Owner's home: clock in, who's at work now, team hours and what's waiting
    Owner's home: clock in, who's at work now, team hours and what's waiting
  • Attendance records, with where each clock-in happened
    Attendance records, with where each clock-in happened
  • Placing a branch on the map with the area people must clock in from
    Placing a branch on the map with the area people must clock in from
  • The leave calendar: who is away this month, approved and waiting
    The leave calendar: who is away this month, approved and waiting
  • A finalized pay run with earnings, deductions and how each person is paid
    A finalized pay run with earnings, deductions and how each person is paid
  • The audit log, which can't be edited and checks its own integrity
    The audit log, which can't be edited and checks its own integrity

Stack

  • FastAPI
  • PostgreSQL
  • Next.js
  • TypeScript
  • SQLAlchemy
  • Tailwind
  • Cloud Run
  • Neon
  • Cloudflare
  • OpenTofu