Projects and systems

What Dawit Bayou Kassie has built: three enterprise platforms for an employer and the release security behind them, four open-source applications and public showcases of the private systems.

Enterprise platforms (employer systems, private source)

Identity platform

Employer system, private · Node.js, Express, TypeScript, PostgreSQL, Next.js, OpenID Connect

Every internal system used to have its own login. I replaced them with one custom OpenID Connect provider on the company's existing Active Directory.

• Authorization code with PKCE, signed tokens, an admin console and an application launcher for every connected system.
• The hard part is signing out: when someone signs out, leaves or is deactivated, a signed back-channel notice reaches every connected app and ends their sessions there, not only in the portal.
• Licences are signed offline and verified without calling home, and a system tied to single sign-on stops when single sign-on does.

• 834 automated tests
• Back-channel logout
• Offline-signed licences
• Signed releases, tamper watcher

Document and records platform

Employer system, private · Node.js, Express, TypeScript, Next.js, PostgreSQL, MinIO, Redis, BullMQ, Meilisearch

An archive staff can search, govern and question, with every access rule and every change on record.

• The full records lifecycle: capture, approval, e-signatures, retention schedules and legal hold, with full-text search across the archive.
• An opt-in AI assistant answers questions over documents and audit logs, summarises documents and extracts metadata, behind per-tenant consent and usage controls.
• Fifty-three permissions across seven roles with per-document access rules; audit logs are hash-chained so an edit shows, and files are encrypted at rest with AES-256-GCM.

• 1,639 automated tests
• 53 permissions, 7 roles
• Hash-chained audit
• Legal hold and retention

Guest management platform

Employer system, private · Node.js, Express, TypeScript, Next.js, PostgreSQL, Redis, BullMQ, WebSockets, Docker

Visitors, approvals and door access across several offices, live on the company's own server.

• Seven roles and an approval and escalation workflow, with credentials delivered to the visitor in real time over WebSockets.
• Door-access hardware, one-time-code sign-in, QR and PIN credentials, and ID scanning with watchlist screening at reception.
• Taken through QA and UAT to a live deployment behind an Apache reverse proxy, and I trained the IT staff who operate it.

• 605 automated tests
• 7 roles
• Real-time WebSockets
• IT staff trained

Release and licensing security

Employer platform, private · Node.js, PowerShell, Cryptographic signing

A repeatable, verifiable way to ship the platform to a server that only a few people may touch.

• Every release runs preflight checks first. Settings change only at apply time, with a backup taken beforehand and automatic rollback if anything fails.
• Releases are signed and a tamper watcher reports changes. Owner-only operations stay outside any automated agent's permissions.
• Every change is rehearsed in a production-like environment first, and independent reviews of my own work are fixed before release.

• Rehearsed, with rollback
• Signed releases
• Tamper watcher
• Preflight checks

Open-source reference applications

Four applications on one stack that show the same discipline in public. Retail OS enforces double-entry accounting with a deferred database trigger. JobPilot isolates tenants with row-level security and submits no job application until a person approves it. All four use OpenID Connect sign-in.

• NestJS 12, Drizzle
• PostgreSQL 18
• Next.js 16
• OpenAPI contracts

Retail OS

NestJS 12, Drizzle, PostgreSQL 18, Next.js 16

A point of sale where the shelf and the books cannot disagree.

• Every journal entry balances: the application checks it, and a deferred database trigger checks it again at commit.
• Posted history is append-only in the database itself; a void is the only change allowed, so a hand-typed UPDATE cannot rewrite the books.
• Two tills cannot sell the last unit twice or push a customer past a credit limit, and money is integer minor units, never a float. Sales analytics, forecasts and a cash-flow statement sit on top.

JobPilot

NestJS 12, Drizzle, PostgreSQL 18, Row-level security

Job search where the software proposes and only a person approves.

• Tenant isolation is the database's job: with row-level security, a session that names no tenant sees nothing.
• Applications move through an 18-state machine, and a database constraint refuses an approval recorded by the AI or the browser worker.
• AI-drafted documents are checked sentence by sentence against the candidate's record, and anything flagged stops for a person. The audit trail is hash-chained.

Martronics

NestJS 12, Drizzle, PostgreSQL 18, Next.js 16

An electronics store with a catalogue, cart and checkout, built as enterprise-grade services.

• Rotating refresh tokens with reuse detection, and optimistic concurrency on every write.
• Checkout is idempotent, so a retried request never places an order twice, and events leave through a transactional outbox.
• An OpenAPI contract, and sign-in through OpenID Connect with back-channel logout.

Library Management

NestJS 12, Drizzle, PostgreSQL 18, Next.js 16

A public catalogue and a staff circulation desk.

• Holds are queued fairly: a returned copy goes to the member who has waited longest.
• Overdue loans accrue fines, and unpaid fines above a limit block further borrowing.
• Idempotent lending, optimistic concurrency, an OpenAPI contract and OpenID Connect sign-in with back-channel logout.

Platform showcases

The identity, document and guest platforms are private code, so each has a public showcase repository: what it does, how it is built, screenshots and the live demo. Source access is granted on request.

• Identity platform (SSO): OpenID Connect provider, admin console and app launcher. Live demo
• Document platform (DMS): Records lifecycle, approvals, e-signing, retention and search. Live demo
• Guest platform (GMS): Visits, approvals, door credentials and reception check-in. Live demo

Live demos

Company-neutral editions on demo data; they run on one machine, so one may occasionally be offline.

• Identity portal (Single sign-on): The launcher every other demo signs in through.
• Document management (DMS): Approvals, e-signing, retention and search.
• Guest management (GMS): Visitors, approvals and door credentials.
• Retail OS (Point of sale and accounting): Sales, stock, double-entry books and forecasts.
• JobPilot (Job search): Matching and an application pipeline.
• Martronics (E-commerce): An electronics storefront with checkout.
• Library (Library catalogue): Public catalogue and staff desk.