Application overview, onboarding guide, and architecture diagrams
Every route is behind middleware.ts (withAuth); each API handler re-validates the session with getServerSession(authOptions) before touching the database. Notifications are dispatched synchronously on state transitions.
Leave request approval is representative of most request/approval workflows in the platform (overtime, claims, internal mobility, contracts): a worker-initiated write, a manager-facing pending queue, and a multi-channel notification on every status change.