Bitsmiths HRM

Bitsmiths' internal HR platform. Employees are invited, onboarded and activated; they file leave, medical claims and overtime; admins approve each one, and approved items sweep into a monthly payroll run that calculates payslips, locks them, and exports to Payoneer.

How it's built

Next.js 15 App Router with next-safe-action server actions over Supabase, using Postgres, Auth, Storage and pg_cron. Business logic lives in the database: leave and medical balances, payroll calculation and locking are Postgres functions, guarded by row-level security. Roles mirror into the JWT via trigger so middleware can route on them. Resend sends 12 React Email templates, and a monthly cron job opens each payroll period.

Key features

• Employee dashboard with live balances and latest payslip
• Leave, medical and overtime requests with approval trails
• Admin approvals queue across every request type
• Monthly payroll runs, locked once finalised
• Payslips, released to employees only after lock
• Payoneer export and a policies document store

Challenges & Solutions

1. 01

   Employees could not see their own locked payslips. The visibility policy subqueried an admin-only table, and that subquery runs with the caller's privileges, so it silently returned nothing.

   Moved the check into a SECURITY DEFINER helper that answers only 'is this run locked?', so the policy resolves without exposing the company-wide payroll totals on that table.

2. 02

   Approved medical and overtime could be double-counted, paid once in the run that swept them and again in the next.

   Locking a run stamps each approved item with that run's id in the same transaction, so every item feeds exactly one payroll and late approvals roll forward instead of duplicating.

3. 03

   Admin overrides on a payslip, such as days worked, overtime multiplier and custom adjustments, were wiped whenever payroll was recalculated.

   Made calculation idempotent: it upserts derived figures while preserving admin-entered overrides, so a recalc can be run safely at any point before the period locks.