PROJECT FILE 09 / Backend & permissions / Backend assessment
Finance Access Control
The right information. For the right role.
A finance API that gives administrators, analysts, and viewers different levels of access to records and reports. Clear permission rules, from sign-in to every protected request.
- 01Identify the user
- 02Check their role
- 03Return allowed data
The problem
Financial records and reports serve different people. A backend needs to distinguish who can change data, who can inspect records, and who should only see summaries.
What I built
- Built modular Express APIs for authentication, user management, financial records, and dashboard summaries.
- Enforced administrator, analyst, and viewer permissions through shared authorization middleware and active-user checks.
- Implemented hashed refresh-token storage, token rotation, and server-side logout revocation.
- Added record filters, pagination, date validation, and consistent response and error formats.
Inside the engineering
Sessions that can be revoked
Refresh sessions are stored as hashes. Refresh rotates the session token, while logout revokes it on the server as well as clearing the browser cookies.
Explicit reporting boundaries
Overview, category, recent-record, weekly, and monthly endpoints separate reporting needs from record-editing operations. Shared validators check query parameters and date ranges.
What this demonstrates
Demonstrates backend design through access rules, session lifecycle management, validation, and readable reporting APIs.
- Node.js
- Express
- MongoDB
- Mongoose
- JWT
- Postman
Built as a backend assessment. The process diagram explains the implemented flow; it is not a dashboard screenshot or a claim of production deployment.
LATEST GITHUB PUSH /