Architecting an Enterprise Multi-Tenant CMS & HRMS: 23-Role RBAC, Dual Attendance & Supabase RLS

Modern technology organizations face crippling operational fragmentation. A typical mid-sized software agency juggles between six disconnected SaaS subscriptions: a biometric punch-clock portal, an HR leave tracker, spreadsheet billing, Trello or Jira for tasks, an email-based ticketing desk, and offline accounting ledgers.

When developing CMS TechSonance, our goal was to consolidate all daily business workflows into a singular high-throughput platform powered by Next.js 15 App Router, React 19, and Supabase PostgreSQL. In this engineering deep-dive, we share how we designed the multi-tenant architecture, the hybrid attendance engine, and the 23-role security model.

1. Database-Level Multi-Tenancy with PostgreSQL RLS

Traditional multi-tenant systems either create a separate database per client (prohibitively expensive and slow to migrate) or rely on fragile application-level WHERE tenant_id = x clauses in every backend query (prone to developer oversights and catastrophic data leaks).

We implemented PostgreSQL Row-Level Security (RLS) directly on Supabase. Every entity table—from employees and attendance_records to invoices and client_communications—contains an immutable tenant_id column. By setting session variables on each request, the database engine itself enforces strict isolation:

-- Enable RLS on core workforce table
ALTER TABLE employees ENABLE ROW LEVEL SECURITY;

-- Enforce tenant-level isolation for all CRUD operations
CREATE POLICY tenant_isolation_policy ON employees
  FOR ALL
  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
  WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
      

2. The HRMS Suite: Dual-Source Attendance & Geofencing

Workforce attendance is notoriously vulnerable to buddy-punching and time theft. CMS TechSonance bridges physical IoT hardware with mobile web check-ins:

• Hardware NFC Readers: Physical RFID/NFC cards tapped at office reception devices transmit raw UIDs to our local Node.js daemon, which checks local SQLite buffers and syncs verified timestamps to the cloud.
• GPS Geofencing: Remote or field employees clock in via the mobile web portal. The system calculates Haversine distance against tenant-configured office coordinates, rejecting or flagging punches outside the approved perimeter radius.
• IP Whitelisting & Weekend Queues: Check-ins from unrecognized networks or non-working weekend shifts are automatically routed to a manager approval queue with mandatory reason notes.
• Automated Overtime Engine: Evaluates actual clock-in/out timestamps against daily shift configurations to compute overtime and deduction balances automatically.

3. The 23-Role RBAC Matrix & API Guard Wrapper

Enterprise governance requires distinct permissions for Super Admins, Project Managers, Accountants, Developers, Interns, and External Clients. We structured access across 13 core modules (Attendance, Team, Payroll, Invoices, Daily Updates, Projects, Tasks, Help Desk, CRM, Reimbursements, Leaves, Content, and Settings).

All 53+ REST endpoints are guarded by a centralized withApiHandler() wrapper. This higher-order function handles JWT verification, rate limiting, MongoDB audit logging, and module permission validation in a standardized execution envelope:

// Secure route handler pattern
export const POST = withApiHandler({
  module: "payroll",
  permission: "canApprove",
  rateLimit: 100,
  handler: async (req, { user, tenantId }) => {
    const payload = await req.json();
    const approvedBatch = await processPayrollBatch(tenantId, payload.periodId, user.id);
    return { success: true, data: approvedBatch };
  }
});
      

4. Empirical Production Benchmarks

To verify operational stability under enterprise workloads, we stress-tested CMS TechSonance against simulated concurrent tenant activity:

5. Business Outcomes

Deploying CMS TechSonance allowed our organization to eliminate 6 third-party SaaS contracts, saving over $14,000 annually in subscription costs while reducing monthly administrative time by 25+ hours per week. For enterprises looking to build proprietary operations hubs, check out our SaaS Product Development and Custom Software Development services.