system://hasnat.dev/projects/sarkar-group-smd

project_overview

Enterprise Internal Platform

Sarkar Group SMD modernizes operations for a 1000-employee construction and marine engineering firm. It replaces disconnected manual processes (email approvals, spreadsheet equipment tracking, paper HR forms) with a unified, role-scoped platform that every employee can use confidently.

Role: Full-Stack Architect & Solo Developer Scope: Enterprise-Grade Internal Platform Focus: Role-Based Access Control + Workflow Automation + Real-Time Infrastructure

TypeScript Express Prisma MongoDB Next.js Redux Toolkit MUI TailwindCSS Docker

// screenshots

Admin Dashboard — Overview of all company operations with KPI cards and trend indicators

Engineer Dashboard — Personal task list, assigned projects, and equipment status

Project Manager Dashboard — Project portfolio with team assignment and equipment tracking

All Projects View — Company-wide project portfolio with filters and status tracking

Employee Directory — Searchable staff roster with roles and department assignments

Media Library — Company press releases, announcements, and blog posts with rich text

Employee Profile — Personal information, role details, and assignment history

// overview

vision

Replace fragmented manual workflows with a single, permission-driven platform that every role can trust — from CEO approving requisitions to engineers submitting leave and uploading site photos.

audience

1000+ internal company staff: HR admins, department heads, project managers, engineers, field crews, and clients — each with a purpose-built dashboard.

outcome

Production-live system active for day-to-day operations. 15+ API modules, 20+ database models, 5 role dashboards, real-time SSE notifications, and Dockerized deployment on Vercel + MongoDB Atlas.

// problem

The company managed operations through disconnected processes: equipment tracked in spreadsheets, financial approvals via email chains, HR forms submitted on paper, project updates via messaging threads. Core challenges: (1) Enforcing strict role-based permissions without duplicating authorization logic; (2) Tracking complex equipment lifecycle with request/approval flows; (3) Running 3 parallel approval workflows (payments, requisitions, equipment) each needing document upload, multi-level approval, and decline tracking; (4) Supporting 8 distinct HR application types with audit trails; (5) Delivering real-time feedback on approvals without WebSocket infrastructure; (6) Building 15+ API modules without query code duplication.

// solution

Designed the entire platform with separation of concerns: Express backend with JWT auth, role-array authGuard middleware on every route, and a generic PrismaQueryBuilder class serving all 15+ modules. A singleton NotificationService maintains a Map<userId, Set<Response>> for all SSE connections, broadcasts on workflow submissions, and sends targeted notifications on approval/rejection. Role-specific dashboards use Prisma $transaction to run 10-15 parallel aggregation queries in a single round trip. Frontend uses Next.js 16 with role-gated route groups, Redux Toolkit state management, MUI + TailwindCSS UI, and TipTap for rich editing.

// my_role

Full-Stack Architect & Solo Developer

› Designed full MongoDB schema: 20+ Prisma models, enums, relations, and join tables
› Built generic PrismaQueryBuilder — chainable class with .search/.filter/.sort/.paginate/.includeRelations reused across all modules
› Implemented JWT auth: sign/verify/decode/blacklist Token utilities, authGuard middleware, sseAuthGuard for SSE routes
› Architected and implemented 15+ API modules covering every business domain
› Built singleton NotificationService: SSE registry, broadcast-to-roles, targeted send, keepalive pings, lifecycle cleanup
› Designed dashboard aggregation: Prisma $transaction with 10-15 parallel queries and month-over-month deltas
› Implemented equipment assignment validation chain: reusable across request approval and project operations
› Built structured Rocket server class (load/initiate/launch) with modular routing and global error handling
› Set up Next.js with role-gated route groups, Redux Toolkit + redux-persist, next-auth sessions

// tech_stack

backend

TypeScript, Express.js, Prisma ORM, MongoDB, JWT, Zod, Bcrypt, Nodemailer, Multer, CORS, cookie-parser

frontend

Next.js 16 (App Router), React 18, Redux Toolkit, redux-persist, next-auth, MUI v6, TailwindCSS, Lucide React, Sonner, react-hook-form

realtime

Server-Sent Events (SSE), Express res.write(), singleton NotificationService

richContent

TipTap (rich editor), react-pdf, pdfjs-dist

storage

Cloudinary (profile images, documents, media), Multer (uploads)

infrastructure

Docker, Docker Compose, Vercel, MongoDB Atlas, dumb-init

// key_features

› 5 isolated role dashboards with complete permission scoping
› Project lifecycle management: assignment, equipment linking, status tracking, client visibility
› Equipment registry with status lifecycle (WORKING/RUNNING/STAND_BY/BREAK_DOWN) and crew assignment
› Equipment request workflow: request → admin approval → auto-assignment
› 3 parallel financial workflows: payments, requisitions, equipment requests — all with document upload, multi-level approval, and decline reasons
› 8 HR application types: leave, resignation, transfer, salary advance, loan, complaint, grievance, expense
› Server-Sent Events (SSE) real-time push notifications to all relevant stakeholders
› Rich media system with TipTap editor, image uploads, keyword tagging, and comment threads
› Role-specific dashboards with KPI aggregations and month-over-month deltas

// contributions

› Designed 20+ Prisma models with complex relations, enum-driven status fields, and atomic $transaction blocks
› Built PrismaQueryBuilder — generic chainable class eliminating query duplication across 15+ modules
› Implemented JWT auth with blacklist, authGuard middleware, and sseAuthGuard for streaming
› Built NotificationService: SSE client registry, broadcast-to-roles, targeted send, keepalive, cleanup
› Designed dashboard endpoints: Prisma $transaction with parallel aggregation, KPI deltas, trend indicators
› Implemented equipment assignment validation: reused in request approval and project operations
› Built approval workflow engine: PENDING → APPROVED/REJECTED with decline reason enforcement
› Set up Next.js role-gated routing, Redux Toolkit state management, TipTap rich editor integration
› Configured Docker multi-stage build, non-root user, health checks, and Docker Compose orchestration

// challenges_&_solutions

Query Duplication Across 15+ Modules

Problem: Every module needed search, filter, sort, paginate, and relation-include. Duplicating this would mean hundreds of lines of near-identical Prisma code with no consistency or maintainability.

Solution: Built a generic PrismaQueryBuilder<TModel> class accepting any Prisma delegate and chaining operations. One class across 15+ modules, zero duplication, consistent behavior everywhere.

Real-Time Notifications Without WebSocket Complexity

Problem: Employees needed instant feedback when approvals were made, but adding WebSocket infrastructure (socket.io) would complicate deployment and resource costs.

Solution: Implemented SSE via Express res.write(). A singleton NotificationService holds all active connections, broadcasts on workflow events, sends keepalive pings every 20 seconds, and cleans up automatically on connection close.

Equipment Assignment Validation Reusability

Problem: Equipment can only be added to a project if the project is active AND the equipment is STAND_BY. Request-product approval needed to auto-assign without bypassing these rules or duplicating logic.

Solution: All assignments route through ProjectService.addProduct which validates both conditions. When RequestProductsService.declineOrAccept approves, it calls ProjectService.addProduct internally — one source of truth, no bypass possible.

// impact

15+ API Modules

Complete coverage of every business domain with consistent query patterns, permission enforcement, and error handling.

5 User Roles — Zero Data Leakage

Complete permission isolation: Super Admin sees everything, Project Managers see only their projects, Engineers see only their assigned equipment. No data crosses role boundaries.

Real-Time SSE Notifications

Instant delivery to all relevant users on every workflow event — zero polling, zero missed updates, zero WebSocket infrastructure complexity.

Production Live

Active in day-to-day operations for 1000+ employees handling equipment, projects, approvals, and HR — processing hundreds of requests daily without downtime.

// what_i_learned

This project deepened my understanding of designing permission-scoped enterprise systems, the value of generic abstractions (PrismaQueryBuilder eliminated hundreds of lines of code), and practical implementation of SSE for real-time updates. Building with Prisma $transaction taught me how to minimize database round trips for complex aggregations. The equipment validation chain reinforced the importance of single sources of truth for business logic — one place to enforce rules, never scattered through multiple handlers.