Skip to content
juancespedes.dev
ES: Leer esta página en español
All projects
Case studyAnonymized

A corporate forum platform, from registration to certificate

I designed, built and single-handedly ran the platform for an energy-sector forum, with the agenda, a digital badge with a QR code, surveys, 156 audited PDF certificates and event memories, all behind corporate sign-in.

Project facts

Role
Full-stack developer and sole operator, from design to on-call duty on event day
Period
Jul 2026 to Sep 2026
Public links
Internal system: the code is private, and names, data and diagrams were left out or recreated.

  • 163

    guests received their personal QR code by email, each one verified before sendingSource: Bulk send log, August 2026

  • 156

    PDF certificates generated and checked by two independent automated auditorsSource: Certificate generation and audit scripts, August 2026

  • 9 days

    between the first commit and forum day, with the system running liveSource: Git history, July and August 2026

The problem

The communications team of a power generation company was organizing its first corporate forum and needed one tool for the whole event cycle, from publishing the agenda and speakers to registering and badging guests, measuring satisfaction and delivering certificates and memories.

My role

  • Designed the experience from the official graphic pieces, measuring colors and dimensions straight from the PDFs.
  • Built the SPA, the server, corporate authentication and the email sends.
  • Deployed on Linux with nginx and a hardened systemd unit, and was on call on forum day.
  • After the event, generated the certificates, published the gallery and added a digital business card module.

Constraints

  • Nine days between the first commit and forum day.
  • Hundreds of attendees signing in at once from the same corporate network.
  • Minimal personal data, because the server was not supposed to know names or ID numbers.
  • One person in charge of development, deployment and operations.

Decisions

  1. 01

    Corporate sign-in with OIDC and PKCE

    Guests already had an account in the company directory. Microsoft Entra ID handled identity and roles without new passwords, and Microsoft Graph sent the emails from the institutional mailbox.

    Ruled out

    • A custom sign-up with email and password
  2. 02

    The server only knows opaque identifiers

    Certificates and downloads are served through identifier-to-file manifests generated outside the server. Nobody can request someone else's certificate because the route takes no parameters.

    Ruled out

    • Store names and ID numbers in the server database
  3. 03

    The survey unlocks on the server clock

    The satisfaction survey link only reaches the browser once the server clock passes the closing time, so nobody answers it before the forum ends.

    Ruled out

    • Hide it behind a timer in the browser
  4. 04

    Two keys for dangerous operations

    The bulk send has a dry-run mode, a recipient cap and resume support, and opening it to every guest requires changing two variables at once.

    Ruled out

    • A script that sends straight to the whole list

Architecture

A React SPA talks to an Express server that owns HTTP security, Microsoft Entra ID authentication and Microsoft Graph sends. Certificates and memories are generated on the workstation and reach the server as verified artifacts.

  1. Attendees

    • Forum SPAAgenda, QR badge, surveys and certificates

  2. Edge

    • nginxTLS and per-zone rate limiting

  3. Server

    • Express serverCSP, CSRF, sessions and routes without free parameters
    • Survey gateDecides on the server clock
    • Business cardsSQLite

  4. Microsoft 365

    • Microsoft Entra IDOIDC with PKCE and roles
    • Microsoft GraphRegistration and QR emails

  5. Workstation

    • Python generatorsPDF certificates and memories, audited

How data moves

  1. Forum SPAtonginxHTTPS
  2. nginxtoExpress serverNavigations and API
  3. Express servertoMicrosoft Entra IDSign-in
  4. Express servertoMicrosoft GraphTransactional email
  5. Survey gatetoForum SPASurvey only after closing time
  6. Python generatorstoExpress serverArtifacts through manifests

Results

  • The system ran live on forum day without storing personal data on the server.
  • Each of the 163 QR codes was decoded before sending, and the send happened exactly once.
  • 156 certificates and 77 photos were published, with streamed downloads of the event memories (the largest package was 1.33 GB).
  • Production incidents were resolved and documented with their root cause.

What I would do differently

  • I would load-test event day with simulated traffic from a single IP, instead of sizing only with calculations.
  • I would separate from the start what had to outlive the event, such as the business cards, from what was ephemeral.

Technologies

  • React
  • TypeScript
  • Vite
  • Node.js
  • Express
  • Microsoft Entra ID
  • Microsoft Graph
  • SQLite
  • Python
  • Playwright
  • nginx
  • systemd