Three systems, in detail

Workforce management for a charcoal-grill restaurant in Gulberg, Lahore, built for a single manager account with complete access. Face-recognition terminals feed an attendance rules engine; its verdicts flow into a payroll run that reconciles to the payslip.

The hard part was never the CRUD. It was the exceptions — an overnight shift that crosses midnight, a missed punch, approved overtime, Ramadan hours, a loan instalment due this month. The rules engine is configurable and explains how it reached each outcome, so a disputed day can be answered rather than argued.

• An attendance rules engine covering overnight and split shifts, grace periods, early leave, overtime with approval, breaks, missing punches, half-days, holidays and Ramadan hours
• Payroll staged draft → review → approved → paid, with advances and loans on instalment plans recovered automatically, so the ledger and the payslip always agree
• Ships empty by default — the seed creates one manager account and system settings, and nothing else. No fabricated staff, no demo numbers on a live deploy
• Deterministic fixtures seeded by a PRNG rather than Math.random or Date.now, so server and client renders always agree and there are no hydration mismatches

Role-based portals for students, parents, teachers and administrators behind a single sign-in gateway, on a NestJS API. Every domain row carries a school ID; the super administrator is the only account without one, and services verify ownership server-side rather than trusting an ID sent by the client.

The marketing site was deliberately removed and replaced by that gateway. A school portal that opens on a brochure is a school portal nobody can find the login for — and an administrator can now build the entire school from the browser: sessions, classes, sections, subjects, teachers, students, guardians and assignments.

• Authorisation is permission-based, not role-name-based: roles hold dot-notation permissions with per-user overrides, and a permission string absent from the catalogue can never pass
• Routes fail closed — a global guard protects everything unless a handler explicitly opts out, so forgetting to guard a new controller denies access rather than granting it
• Refresh tokens are stored only as SHA-256 hashes and rotated on every use; presenting a rotated token revokes the whole token family, treating replay as compromise rather than as a retry
• Unknown accounts are compared against a dummy hash so sign-in takes the same time either way and the endpoint cannot be used to enumerate who has one
• Thirty-nine data models, with an audit interceptor and boot-time environment validation

The foundation for a catalogue of free online tools and calculators. Version one deliberately ships no tools at all; it ships the thing they hang off — the design system, the category taxonomy, the MDX editorial engine and the SEO layer.

That ordering is the point. A hundred tools on a weak platform is a hundred pages that cannot be found, cannot be retired cleanly and cannot be moved. The platform makes each of those a configuration concern.

• Every absolute URL — canonicals, Open Graph, sitemap, RSS and JSON-LD identifiers — derives from a single environment variable
• Middleware normalises casing with 308 redirects and serves 410 Gone for retired URLs, so link equity is never quietly lost
• robots.txt serves a blanket Disallow until a real site URL is set, which is what keeps preview deployments out of the index
• MDX editorial pipeline with syntax highlighting, frontmatter and GitHub-flavoured markdown