EMS Universe — Enterprise Management System

ems/
├── apps/
│   ├── api/                     # NestJS Backend
│   │   └── src/
│   │       ├── common/          # Guards, decorators, interceptors
│   │       ├── config/          # Environment config service
│   │       ├── database/        # Prisma schema, service, seeders
│   │       └── modules/
│   │           ├── auth/        # JWT, Passport, WebAuthn
│   │           ├── users/       # User CRUD
│   │           ├── employees/   # Employee lifecycle
│   │           ├── applicants/  # Onboarding flow
│   │           ├── attendance/  # Geofenced check-in/out
│   │           ├── audit/       # Audit trail
│   │           ├── leave-requests/
│   │           ├── payroll/
│   │           ├── performance/ # 360° reviews
│   │           ├── documents/   # PDF generation
│   │           ├── bulk-import/ # Excel/CSV ingestion
│   │           ├── notifications/
│   │           ├── analytics/
│   │           ├── search/      # MeiliSearch
│   │           ├── dr/          # Disaster recovery jobs
│   │           └── queues/      # BullMQ queue definitions
│   │
│   ├── web/                     # Next.js Frontend
│   │   └── src/
│   │       ├── app/
│   │       │   ├── (admin)/     # ADMIN + DEVELOPER routes
│   │       │   ├── (management)/
│   │       │   ├── (accountant)/
│   │       │   ├── (employee)/
│   │       │   └── (public)/    # Login, register, apply
│   │       ├── components/      # Shared UI components
│   │       ├── context/         # Auth context
│   │       ├── lib/             # api.ts, env.ts, utils
│   │       └── i18n/            # Translation files (en/hi)
│   │
│   └── mobile/                  # React Native + Expo
│       └── src/
│           ├── app/             # App.tsx entry
│           ├── screens/         # Feature screens
│           ├── navigation/     # Tab + Stack navigator
│           ├── store/           # Zustand state
│           ├── hooks/           # useSync, useNotifications
│           ├── tasks/           # GeofenceTask (background)
│           ├── lib/             # Axios API client
│           └── components/      # Shared native components
│
├── packages/                    # Shared libraries
├── docs/                        # Architecture documentation
├── infra/k8s/                   # Kubernetes manifests
├── scripts/                    # Deployment & test utilities
├── deploy.sh                    # Production deployment script
├── start.sh                     # Local dev launcher
├── docker-compose.yml           # Local dev containers
└── nx.json                      # Nx workspace config

// packages/shared-types/src/index.ts
export enum UserRole {
  DEVELOPER = 'DEVELOPER',
  ADMIN = 'ADMIN',
  MANAGEMENT = 'MANAGEMENT',
  ACCOUNTANT = 'ACCOUNTANT',
  EMPLOYEE = 'EMPLOYEE',
  APPLICANT = 'APPLICANT',
}

export interface Employee {
  id: string;
  userId: string;
  departmentId: string;
  designation: string;
  doj: Date;
  // Encrypted fields
  aadhaar: string;
  pan: string;
  bankAccount: string;
  bankIfsc: string;
}

export interface Attendance {
  id: string;
  employeeId: string;
  checkIn: Date;
  checkOut: Date | null;
  checkInLocation: { lat: number; lng: number };
  checkOutLocation: { lat: number; lng: number } | null;
  geofenceValid: boolean;
}

// modules/auth/auth.service.ts
async function validateUser(email: string, password: string) {
  const user = await this.userService.findByEmail(email);
  if (!user || !await bcrypt.compare(password, user.password)) {
    throw new UnauthorizedException('Invalid credentials');
  }
  
  // Generate tokens
  const accessToken = this.jwtService.sign({ sub: user.id, role: user.role });
  const refreshToken = this.jwtService.sign({ sub: user.id }, { expiresIn: '7d' });
  
  // Hash and store refresh token
  const hashedRefresh = await bcrypt.hash(refreshToken, 10);
  await this.userService.updateRefreshToken(user.id, hashedRefresh);
  
  return { accessToken, refreshToken };
}

async function refreshToken(oldRefresh: string) {
  const decoded = this.jwtService.verify(oldRefresh);
  const user = await this.userService.findById(decoded.sub);
  
  if (!user || !user.refreshToken) throw new UnauthorizedException();
  if (!await bcrypt.compare(oldRefresh, user.refreshToken)) {
    throw new UnauthorizedException('Invalid refresh token');
  }
  
  // Rotate: generate new tokens
  return this.generateTokens(user);
}

// modules/attendance/attendance.service.ts
const RADIUS_METERS = 100; // Office geofence radius

function haversineDistance(lat1: number, lng1: number, lat2: number, lng2: number): number {
  const R = 6371e3; // Earth's radius in meters
  const φ1 = lat1 * Math.PI / 180;
  const φ2 = lat2 * Math.PI / 180;
  const Δφ = (lat2 - lat1) * Math.PI / 180;
  const Δλ = (lng2 - lng1) * Math.PI / 180;

  const a = Math.sin(Δφ/2) * Math.sin(Δφ/2) +
            Math.cos(φ1) * Math.cos(φ2) *
            Math.sin(Δλ/2) * Math.sin(Δλ/2);
  const c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1-a));

  return R * c; // Distance in meters
}

async function validateCheckIn(employeeId: string, location: { lat: number; lng: number }) {
  const config = await this.configService.getOfficeLocation();
  const distance = haversineDistance(
    location.lat, location.lng,
    config.lat, config.lng
  );
  
  return distance <= RADIUS_METERS;
}

// lib/encryption.ts
import crypto from 'crypto';

const ALGORITHM = 'aes-256-gcm';
const IV_LENGTH = 12;
const TAG_LENGTH = 16;

export function encryptField(plaintext: string, key: Buffer): string {
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
  
  const encrypted = Buffer.concat([
    cipher.update(plaintext, 'utf8'),
    cipher.final(),
  ]);
  
  const tag = cipher.getAuthTag();
  return Buffer.concat([iv, tag, encrypted]).toString('base64');
}

// Encrypt PII in employee service
async function createEmployee(data: CreateEmployeeDto) {
  const key = crypto.scryptSync(process.env.ENCRYPTION_KEY, 'salt', 32);
  
  return this.prisma.employee.create({
    data: {
      ...data,
      aadhaar: encryptField(data.aadhaar, key),
      pan: encryptField(data.pan, key),
      bankAccount: encryptField(data.bankAccount, key),
      bankIfsc: encryptField(data.bankIfsc, key),
    },
  });
}

// modules/auth/webauthn.service.ts
async function generateRegistrationOptions(user: User) {
  const options = await generateRegistrationOptions({
    rpName: 'EMS Universe',
    rpID: process.env.RP_ID,
    userID: user.id,
    userName: user.email,
    timeout: 60000,
    attestation: 'none',
    supportedAlgorithms: [-7, -257],
  });
  
  // Store challenge in session
  await this.redis.setex(`webauthn:challenge:${user.id}`, 300, options.challenge);
  
  return options;
}

async function verifyRegistration(userId: string, response: AuthenticatorAttestationResponse) {
  const challenge = await this.redis.get(`webauthn:challenge:${userId}`);
  const verification = await verifyRegistrationResponse({
    credential: response,
    expectedChallenge: challenge,
    expectedOrigin: process.env.ALLOWED_ORIGIN,
    expectedRPID: process.env.RP_ID,
  });
  
  if (verification.verified) {
    await this.prisma.authenticator.create({
      data: {
        userId,
        credentialID: verification.credentialID,
        credentialPublicKey: verification.credentialPublicKey,
        counter: verification.counter,
      },
    });
  }
  
  return verification;
}

model User {
  id            String    @id @default(cuid())
  email         String    @unique
  password      String
  role          UserRole
  employee      Employee? @relation(fields: [employeeId], references: [id])
  employeeId    String?   @unique
  refreshToken  String?  // bcrypt hashed
  createdAt     DateTime @default(now())
  updatedAt     DateTime @updatedAt
}

model Employee {
  id              String    @id @default(cuid())
  userId          String    @unique
  user            User      @relation(fields: [userId], references: [id])
  departmentId    String
  department      Department @relation(fields: [departmentId], references: [id])
  designation     String
  doj             DateTime
  // Encrypted PII fields
  aadhaar         String    // AES-256-GCM encrypted
  pan             String
  bankAccount    String
  bankIfsc        String
  attendances     Attendance[]
  leaveRequests   LeaveRequest[]
  salaryRecords   SalaryRecord[]
  reviewsGiven    PerformanceReview[] @relation("reviewer")
  reviewsReceived PerformanceReview[] @relation("reviewee")
  createdAt       DateTime @default(now())
  updatedAt       DateTime @updatedAt
}

// Route-based layout segmentation
app/
├── (public)/           # Public routes
│   ├── login/
│   ├── register/
│   └── apply/          # Applicant portal
│
├── (admin)/           # ADMIN + DEVELOPER only
│   ├── dashboard/
│   ├── users/
│   ├── employees/
│   ├── system/dr      # Disaster Recovery War Room
│   └── settings/
│
├── (management)/      # MANAGEMENT + ADMIN
│   ├── dashboard/
│   ├── applicants/
│   ├── leave-requests/
│   └── analytics/
│
├── (accountant)/      # ACCOUNTANT + ADMIN
│   ├── dashboard/
│   ├── payroll/
│   └── reports/
│
└── (employee)/        # EMPLOYEE + above
    ├── dashboard/
    ├── attendance/
    ├── leave/
    └── profile/

// navigation/AppNavigator.tsx
const Tab = createBottomTabNavigator();

function AppNavigator() {
  return (
    <Tab.Navigator>
      <Tab.Screen name="Home" component={HomeScreen} />
      <Tab.Screen name="Attendance" component={AttendanceScreen} />
      <Tab.Screen name="Leave" component={LeaveScreen} />
      <Tab.Screen name="Profile" component={ProfileScreen} />
    </Tab.Navigator>
  );
}

// tasks/GeofenceTask.ts
import * as TaskManager from 'expo-task-manager';

const GEOFENCE_TASK = 'background-geofence-task';

TaskManager.defineTask(GEOFENCE_TASK, ({ data, error }) => {
  if (error) {
    console.error('Geofence error:', error);
    return;
  }
  
  if (data.region === 'OFFICE_GEOFENCE') {
    const { eventType } = data;
    
    if (eventType === 'enter') {
      // Auto-trigger check-in
      api.post('/attendance/check-in', { auto: true });
    } else if (eventType === 'exit') {
      // Prompt check-out
      notifyUser('Ready to check out?');
    }
  }
});

// DR War Room WebSocket Gateway
@WebSocketGateway({ cors: { origin: '*' } })
export class DrGateway {
  @SubscribeMessage('subscribe:dr-logs')
  handleSubscribe(client: Socket) {
    client.join('dr-logs');
  }

  async broadcastDrProgress(log: string) {
    this.server.to('dr-logs').emit('dr:log', {
      timestamp: new Date(),
      message: log,
    });
  }
}

// Frontend consumption
useEffect(() => {
  const socket = io('https://api.swaraniretreat.in');
  socket.on('dr:log', (data) => setLogs(prev => [...prev, data]));
}, []);

// modules/dr/dr-backup.job.ts
@Processor('dr-backup')
export class DrBackupProcessor {
  @Process()
  async handleBackup(job: Job) {
    const logger = job.log('Starting DR backup...');
    
    // 1. Dump PostgreSQL
    const pgDump = await this.exec(`pg_dump ${process.env.DATABASE_URL}`);
    await this.minio.upload('dr-backups', `pg-${Date.now()}.sql`, pgDump);
    logger.log('PostgreSQL dump complete');
    
    // 2. Backup MinIO buckets
    const buckets = await this.minio.listBuckets();
    for (const bucket of buckets) {
      await this.backupBucket(bucket.name);
    }
    logger.log('MinIO backup complete');
    
    // 3. Notify completion
    await this.notificationService.sendAdminAlert('DR Backup Complete');
    logger.log('Backup job finished');
  }
}

# docker-compose.prod.yml
services:
  postgres:
    image: postgres:16-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ems
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ems_universe

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}

  api:
    build: ./apps/api
    environment:
      DATABASE_URL: postgresql://ems:${DB_PASSWORD}@postgres:5432/ems_universe
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
    depends_on:
      - postgres
      - redis

  web:
    build: ./apps/web
    depends_on:
      - api

# Required production secrets
DATABASE_URL=
REDIS_PASSWORD=
JWT_SECRET=
ENCRYPTION_KEY=
MINIO_ACCESS_KEY=
MINIO_SECRET_KEY=
SENTRY_DSN=
MEILISEARCH_KEY=