EXP-003 · ACADEMIC

Construction management backend

University capstone (2025): co-built the backend for a house-building startup and designed its file-security layer.

Team of four. I co-built essentially all of the backend with one teammate (projects, inventory, and file management for contracts, receipts and images). I did no UI work.

The problem

Much of the system revolved around files — contracts, receipts, photos — that belonged to specific construction projects and their customers. A customer must never see another customer’s files.

The design

1. Authorization lives in the application. Only an administrator, or a customer registered by email as a member of that project, passes a series of membership checks.
2. Blobs are private. A plain blob URL is useless on its own.
3. If the checks pass, the backend asks Azure for a SAS link to that one file.
4. The link lives about one minute — a deliberate trade-off: long enough not to regenerate links on every refresh, short enough that a shared or leaked link expires fast. When it expires, the app re-runs the checks and issues a new one.

Honest limits

Within that minute, a leaked link would still work. We accepted that risk for this application; no single-use or IP-bound links. The startup shut down right after the project ended, so the system was never used in production.