Student Service Platform
A contracted university information system, rebuilt for the web.
- Kind
- client project
- Context
- In development for a higher-education client
- Domain
- PLATFORMS
Client project — source code is private.
Overview
A modular-monolith web replacement for an existing desktop student-service application, developed for a contracted higher-education client. The system carries the workflows of a real registrar office: enrollment, courses, exams, grading, finances, documents, scheduling, notifications and reporting.
Four role types use the same platform with different authority — students, professors, administrators and head administrators — so authorization is a first-class part of the domain model rather than a filter applied at the edge.
The interesting engineering is not the forms. It is guaranteeing that two people cannot take the last seat in a course, that a grade cannot be silently rewritten, and that a financial operation cannot be applied twice.
Request path
- React
- REST API
- Spring Boot
- Modular monolith
- JPA / Hibernate
- MySQL
Technical challenge
Enrollment, examination and financial operations are all contended: many users act on the same rows at the same moment, and the correct outcome is not "last write wins".
Replacing a desktop application means the new system has to be at least as trustworthy as the one people already rely on, which pushed the work toward explicit transactional boundaries, database-level constraints and pessimistic locking on the contended paths.
Because the records are academic and financial, every privileged action needs to leave a trail that cannot be quietly edited after the fact.
Security
Authentication is session-based with CSRF protection on state-changing requests. Authorization is permission-based on top of roles, so a head administrator and an administrator differ by the permissions they hold rather than by branches scattered through the code.
- 01Session-based authentication
- 02CSRF protection
- 03Role-based access control
- 04Permission-based authorization
- 05BCrypt password hashing
- 06Rate limiting
- 07Tamper-evident audit logging
Concurrency and reliability
The contended paths — taking a course seat, registering an exam result, applying a payment — run inside explicit transactional boundaries with database constraints as the final guarantee. Pessimistic locking is used where two transactions genuinely cannot both proceed, and idempotency keys stop a retried request from applying an operation twice.
- 01Transactional workflows
- 02Database constraints
- 03Pessimistic locking
- 04Idempotency
- 05Protected enrollment, examination and financial operations
Testing and delivery
Schema changes are versioned with Flyway. Integration tests run against a real MySQL container rather than an in-memory substitute, so constraint and locking behaviour is exercised as it will actually behave. Playwright covers the workflows end to end, and the API is validated against its OpenAPI contract.
- 01Docker
- 02nginx
- 03Flyway migrations
- 04GitHub Actions
- 05Testcontainers
- 06Playwright
- 07OpenAPI contract validation
- 08CodeQL
- 09Trivy
What it does
- 01Modular-monolith backend built with Java 21 and Spring Boot
- 02Role-based access control with permission-based authorization across students, professors, administrators and head administrators
- 03Session-based authentication with CSRF protection, BCrypt password hashing and rate limiting
- 04Tamper-evident audit logging for privileged actions
- 05Transactional workflows protected by database constraints and pessimistic locking
- 06Idempotency on operations that must not apply twice
- 07Concurrency protection across enrollment, examination and financial operations
- 08OpenAPI contract validation in CI
- 09Integration tests on real database containers via Testcontainers, end-to-end tests via Playwright
- 10CodeQL and Trivy scanning in the delivery pipeline
Technologies
- Backend
Java 21
Spring Boot
JPA
Hibernate
- Frontend
React
TypeScript
- Data
MySQL
Flyway
- Infrastructure & quality
Docker
nginx
GitHub Actions
Testcontainers
Playwright
OpenAPI
CodeQL
Trivy
More
