PluginZ HR / ATS
Multi-tenant HR, recruitment and staff-outsourcing platform
Role: Full-stack: schema, RLS, RPCs, edge functions and UI
- Postgres tables, all under RLS
- 85
- surfaces from one codebase
- 6
- routes
- 64
- lines of TypeScript
- ~42k
Overview
PluginZ HR is the HR, applicant-tracking and staff-outsourcing product inside Ops360. One Next.js application serves six distinct audiences: a public, indexable marketing site plus super-admin, HR-company, client-company, employee and candidate portals, each with its own navigation, permissions and data.
The public careers board aggregates published openings across every tenant on the platform, with faceted filtering, multi-currency salary display and a no-account application pipeline: server action, CV upload to object storage, IP rate limiting and consent capture, then recruiter-side review with stage tracking.
Behind it, business logic lives in Postgres. An asynchronous document pipeline renders contract, offer and payslip PDFs from a pg_cron-driven job queue into private storage. A tenant-branded email outbox delivers through Resend with credentials held in Vault.
The screens
16PluginZ HR super-admin overview: tenant configuration and platform figures
Captured from the running system. Records shown are demonstration data.
The interesting part
The JWT carries claims. Postgres enforces them.
A custom access-token hook injects tenant, role and permission claims into the JWT at sign-in. Middleware reads those claims to gate routes, but that is a UX layer only. The real boundary is RLS policies on all 85 tables, which read the same claims through helper functions in the database. Front-end permission checks mirror the policies; they never replace them. Vitest RPC contract tests and Playwright role smoke tests run on every pull request to keep the two in step.
What it does
- Six role-based surfaces: platform, tenant, client, employee, candidate and public marketing
- Unified candidate identity: one login works across every company's postings
- Public job board with faceted filtering and JSON-LD JobPosting markup for Google Jobs
- No-account application flow with CV upload, IP rate limiting and consent capture
- Full ATS: pipelines, assessments with timed quizzes and recorded interviews, offers
- HR core: employees, org chart, branches, attendance, schedules, leave, payroll
- Async PDF pipeline for contracts, offers and payslips on a pg_cron queue
- Tenant-branded transactional email outbox delivered through Resend
- View-as mode: admins inspect the product through any role without leaving their session
- Service desk, approval workflows, reports and a full audit log
- Vitest unit and RPC contract tests, Playwright role smoke tests, CI on every PR
Built with
- Framework
- Next.js 16
- React 19
- App Router
- RSC
- Server Actions
- Turbopack
- Language
- TypeScript (strict)
- UI
- Tailwind v4
- shadcn/ui (Base UI)
- Framer Motion
- Recharts
- Leaflet
- Data
- Supabase
- PostgreSQL
- TanStack Query
- TanStack Table
- Zustand
- Forms
- React Hook Form
- Zod
- Backend
- Row Level Security
- Postgres functions
- Edge Functions
- pg_cron
- Resend
- Vault
- Testing
- Vitest
- Playwright
- GitHub Actions
Next project
AkhshabZ
Arabic RTL invoicing and accounts system for a wood retailer