# HumR — Case Study

> HumR is ARITS Limited's in-house HR suite: a multi-tenant, permission-gated system that runs a company's entire employment lifecycle — from onboarding through payroll disbursement — across three separate web applications that behave like one product.

Canonical page: https://portfolio-shafin580s-projects.vercel.app/projects/humr
Author: Shafin Ahmed, Full-Stack Software Engineer (https://portfolio-shafin580s-projects.vercel.app)
Client: in-house product at ARITS Limited
Timeline: 2024 – present
Role: Frontend Lead
Published: 2026-08-04 · Updated: 2026-08-04
Live site: https://dev-hrms-app.aritsltd.com/

## Key takeaways
- HumR splits HR into three independently deployable Next.js applications — core HR, attendance, and payroll — that share one login and one company context.
- A single JWT session travels across subdomains in encrypted cookies, so moving between the three apps never asks the user to sign in again.
- Auth, the design system, and the form and report builders are Turborepo workspace packages, so a fix lands once and reaches all three apps.

## Key figures
- 3 — web applications, one session
- 7 — modules across the platform
- 4 — permission personas

## The problem
HR software is rarely one workflow. Core HR, time-and-attendance, and payroll each have their own domain model, release cadence, and permission surface, and cramming them into a single application produces a codebase nobody can ship independently. Splitting them into separate apps solves that — but only if a user never notices the seam: one login, one company context, one design language across all three.

## The approach
Three independent Next.js applications sit on a shared Turborepo package graph — auth, design system, ShadCN primitives, form builder, and report builder are all workspace packages, so a fix lands once and propagates. The apps share a single JWT session through encrypted cookies scoped across subdomains, and the active company travels in the URL as an encrypted identifier, so deep links stay valid across app boundaries without leaking tenant ids. Permission gating is advisory on the frontend and enforced by the backend, which keeps the UI honest without making it the security boundary.

## What it does
- Subdomain SSO — one login carries across all three apps via encrypted cookie sharing
- Multi-company tenancy with a company switcher and encrypted company id in every route
- Dynamic form builder — employee creation renders from a server-supplied schema rather than a fixed form
- Weekly routine and shift/schedule builder with clock in/out and attendance claims
- Payroll cycles: salary structure, disbursement, tax, loans, reimbursements, and PF ledger
- Report builder producing dynamic cross-module reports
- Turborepo workspace packages shared across every app (auth, design system, form and report builders)

## Stack
Next.js 16, TypeScript, Turborepo, Cryptography, TanStack Query, ShadCN UI

## Outcome
- Three apps ship on independent release cycles while presenting a single product to the user
- Shared packages removed the duplicated auth, theming, and table code the split would otherwise have created
- Permission-gated UI mirrors backend enforcement, so no screen renders an action the API will reject

## Frequently asked questions
### What is HumR?
HumR is a multi-company, permission-gated Human Resource Management System built in-house at ARITS Limited. It covers the full employment lifecycle — onboarding, organisation structure, attendance, leave, payroll, and compliance — across three web applications that share a single authentication session.

### How does single sign-on work across the three HumR apps?
The three apps share one JWT session carried in encrypted cookies scoped across subdomains. The active company travels in the URL as an encrypted identifier, so a deep link stays valid when a user crosses from core HR into attendance or payroll without re-authenticating or leaking the tenant id.

### Why is HumR three applications instead of one?
Core HR, attendance, and payroll have separate domain models, release cadences, and permission surfaces. Keeping them as three Next.js apps lets each ship independently; a shared Turborepo package graph for auth, the design system, and the form and report builders is what keeps them feeling like one product.

### What was Shafin Ahmed's role on HumR?
Frontend Lead. The work covered the subdomain SSO flow with encrypted cookie sharing, the Turborepo shared-package architecture, the dynamic form builder, the weekly routine builder, and attendance clock in/out.

## Organisations named
- ARITS Limited (Employer) — https://arits.tech

---
Full project index: https://portfolio-shafin580s-projects.vercel.app/llms.txt