Full App Build - Prompt Series

P1: Initialize RubanHR SaaS project structure.
    Multi-tenant: each company is a tenant.
    Tables use tenant_id for isolation.
    Stack: PHP 8.2, MySQL 8, Bootstrap 5, no framework.
    Create CLAUDE.md with architecture notes.

P2: Database schema - tenants (companies), users, employees,
    departments, attendance, leave_requests, payroll, plans, subscriptions.
    All tables have tenant_id FK except tenants.

P3: Super admin vs tenant admin vs employee roles.
    Auth middleware that enforces role + tenant isolation.
    "You can only see data from your own tenant_id."

P4: Tenant registration flow:
    Company signup (company name, admin email, password).
    Creates tenant record + admin user.
    Sends welcome email with setup link.

P5: Tenant login and session:
    Login with email + subdomain (or tenant_id).
    Session stores: user_id, tenant_id, role.
    All authenticated pages auto-scope to tenant.

P6: Company settings page:
    Edit company name, logo, timezone, currency,
    fiscal year start, working hours, holidays.

P7: Employee management:
    Add/edit/delete employees.
    Employee profile: personal details, department, designation,
    employment type, joining date, documents.

P8: Department management:
    Create departments, assign managers,
    department head, employee count.

P9: Employee self-service portal (ESS):
    Login, view own profile, attendance, payslips, leave balance.
    Separate view from HR admin.

P10: Attendance system:
     Manual clock-in/clock-out.
     Monthly attendance report per employee.
     Flag late arrivals, early departures, absences.

P11: Leave management:
     Leave types (earned, sick, casual, LOP).
     Leave request form (dates, reason, type).
     Manager approval/rejection flow with email notification.
     Leave balance tracker.

P12: Dashboard (HR admin):
     Today's attendance summary,
     pending leave approvals,
     upcoming birthdays/anniversaries,
     recent joiners, headcount by department.

P13: Reports module:
     Attendance report (filter by employee/month),
     Leave report, Headcount report.
     Export to CSV + PDF.

P14: Document management:
     Upload documents per employee (offer letter, ID proof, etc.).
     Secure download links, expiry option.
     Document types management.

P15: Notifications center:
     In-app notifications for: leave approved/rejected,
     attendance flagged, payslip published.
     Email + in-app. Notification preferences.

P16: Subscription plans:
     Free (5 employees), Basic (₹999/mo, 25 employees),
     Professional (₹2499/mo, 100 employees), Enterprise (custom).
     Plans table, feature gates per plan.

P17: Razorpay subscription integration:
     Create subscription on plan selection.
     Webhook: payment.captured -> activate plan.
     Webhook: subscription.cancelled -> downgrade to free.

P18: Billing portal for tenants:
     Current plan, usage (employee count vs limit),
     Upgrade/downgrade plan, cancel subscription,
     Invoice history with PDF download.

P19: Trial period:
     14-day free trial on signup.
     Trial banner in UI, day countdown.
     Prompt to upgrade when trial ends.
     Automatic downgrade to free on trial expiry.

P20: Payroll module:
     Monthly payroll calculation (basic + allowances - deductions).
     Salary components configurable per employee.
     Generate payslips (PDF).
     Mark as paid (manual), export to bank transfer format.

P21: Tax calculation:
     Indian TDS calculation (configurable tax slabs).
     Form 16 generation.
     Tax summary report.

P22: Super admin billing dashboard:
     All tenants, their plan, MRR, churn,
     Razorpay subscription statuses.
     Manual plan override for support.

P23: Failed payment handling:
     Razorpay retry logic.
     Email when payment fails (day 1, day 3, day 7).
     Grace period 7 days, then suspend.
     Reactivate on payment.

P24: Coupon codes for plans:
     Admin creates discount codes (% off, first month free).
     Apply at checkout.
     Usage limits, expiry dates.

P25: Referral program:
     Unique referral link per tenant.
     Credit: 1 free month when referred company activates.
     Referral tracking dashboard.

P26: REST API for all core resources:
     /api/v1/employees, /api/v1/attendance, /api/v1/leaves.
     Bearer token auth (per-tenant API keys).
     Same tenant isolation as web app.

P27: API key management:
     Tenant generates API keys from settings.
     Key scopes (read-only, read-write, specific resources).
     Rate limiting (100 req/min per key).
     Key revocation.

P28: Webhooks:
     Tenant configures webhook URLs.
     Events: employee.created, leave.approved, payroll.generated.
     HMAC signature on payload.
     Retry with exponential backoff on failure.

P29: Zapier / Make.com integration:
     Webhook-based triggers and actions.
     Document the integration for users.
     Test events in integration settings.

P30: Mobile-ready API (React Native ready):
     API endpoints optimized for mobile:
     Compact employee list, attendance check-in/out endpoint,
     Leave request via API.

P31: Employee bulk import:
     CSV upload with validation.
     Preview before import (show errors, warnings).
     Process in background job.
     Email report on completion.

P32: Data export (GDPR compliance):
     Tenant can export all their data as ZIP (JSON + CSV).
     Employee can export their own data.
     Process asynchronously, email when ready.

P33: Audit log:
     Log all data changes: who changed what when.
     Admin can view audit trail per employee or per user.
     Immutable (no delete/update on log entries).

P34: SSO (Single Sign-On):
     Google Workspace SSO using OAuth.
     Auto-provision employees from Google directory.
     Sync on each login (update name/photo).

P35: Public API documentation:
     Generate API docs from PHPDoc annotations.
     Or write static docs in /docs/api.md.
     Include: authentication, endpoints, request/response examples, error codes.

P36: Background job queue:
     Job table + worker script (run via cron).
     Queue: email sending, PDF generation, CSV import.
     Retry failed jobs 3 times with delay.

P37: Redis caching layer:
     Cache: tenant settings, employee list, plan limits.
     Invalidate on update.
     Session storage in Redis.

P38: Multi-language support (i18n):
     Language files: /lang/en.php, /lang/ta.php (Tamil).
     Language switcher in UI.
     All user-facing strings use __('key') helper.

P39: Accessibility (WCAG 2.1):
     ARIA labels on all form fields,
     keyboard navigation for all interactive elements,
     color contrast check,
     screen reader announcements for dynamic content.

P40: Onboarding flow:
     New tenant wizard (5 steps): company setup, first employee,
     department setup, working hours, invite team.
     Progress bar, skip option, complete = dismisses wizard.

P41: In-app chat support:
     Integrate Tawk.to or Crisp (free tier).
     Pre-fill user name/email from session.
     Show plan information to support agents.

P42: Status page:
     Public status.domain.com.
     Manual incident reporting.
     Service uptime history.
     Subscribe to incidents by email.

P43: Security audit:
     Review all forms for CSRF.
     Review all queries for SQL injection.
     Review all output for XSS.
     Add security headers (CSP, HSTS, X-Frame-Options).

P44: Performance profiling:
     Add query timer to development mode.
     Log queries over 100ms.
     Add indexes for top 10 slow queries.

P45: Automated testing:
     PHPUnit for all models (100% coverage).
     Integration tests for auth, billing, API.
     Test fixture: create tenant + admin + 5 employees.

P46: CI/CD pipeline:
     GitHub Actions: run tests on PR.
     Deploy to staging on merge to develop.
     Deploy to production on tag.

P47: Backup strategy:
     Daily DB dump to S3 (cron job).
     7-day retention.
     Alert on backup failure.
     One-command restore script.

P48: Monitoring + alerting:
     Log all errors to Sentry (free tier).
     Alert email when error rate spikes.
     Uptime monitoring (UptimeRobot free).

P49: Documentation:
     README.md with setup instructions.
     CONTRIBUTING.md for developers.
     User guide in /docs/ (markdown).

P50: Production deployment script:
     Zero-downtime deployment:
     maintenance mode on, git pull, composer install --no-dev,
     run migrations, clear cache, reload PHP-FPM, maintenance mode off.
     Rollback script if deployment fails.