CiB Group 11

Overview

This was a one-week group project for the Computing in Business unit in May 2025. The university put the teams together from different computing courses, so I didn't know anyone in mine beforehand. BAE Systems supported the week and set the brief: a referral system where employees and their managers can raise cases (medical, mental health, harassment) and HR can track and act on them.

I wrote the code. Of the 54 commits in the repo, 53 are mine: the database models, the API, login and sessions, the email notifications, and the Vue frontend. The rest of the team worked on the design with me, which I needed: at the time I didn't have a good sense of how to lay out dashboards or web pages, and it's something I've got better at in later projects. They also put the presentation together and kept what I was building in line with the brief, so the demo and the presentation matched.

The brief

During the week we interviewed BAE Systems. The interview didn't give us detailed requirements, but it was enough to settle on what to build:

• four kinds of user: employees, line managers, HR, and system admins
• referrals with a type, a priority, a status, notes and attached files
• HR manages departments and user accounts
• new accounts get their temporary password by email

The deadline was the end of the week, so the goal was a working prototype we could demo, not a finished product.

How it works

Backend. An Express 5 API in TypeScript using sequelize-typescript, which defines the tables as decorated classes. On startup it syncs the schema, creates the two base departments, and creates an admin account with a temporary password. Roles are an enum: User (employee), EnhancedUser (line manager), EnhancedUserPlus (HR) and Admin. Each group of routes has its own folder of controllers and routes. Referrals use Sequelize's soft delete ("paranoid" tables), so archiving one is reversible, and the tables have a "show deleted" switch and a restore button.

Login and sessions. This was the part I spent the most care on:

1                const user = await UserClass.findOne({2                    where: {3                        emailAddress: userEmail4                    }5                });67                const passwordMatch = await bcrypt.compare(password, user?.password!);89                if (passwordMatch) {10                    const newSession = await UserSessionClass.create({11                        userId: user?.userId12                    })1314                    res.cookie('sessionId', jwt.sign(newSession?.sessionId.toString(), JWT_SECRET), {15                        expires: new Date(Date.now() + 3600000),16                        secure: false,17                        httpOnly: true18                    });1920                    if (user?.tempPassword) {21                        return res.status(200).json({22                            success: true,23                            message: 'Logged In',24                            data: {25                                changePassword: true,26                                goTo: (user?.role === EUserRole.Admin || user?.role === EUserRole.EnhancedUser || user?.role === EUserRole.EnhancedUserPlus) ? `dashboard` : `account`27                            }28                        });29                    }

Passwords are stored as bcrypt hashes and checked with bcrypt.compareL7. A successful login creates a session rowL10-12 in the database. The cookie only holds that session's ID, signed as a JWT and marked httpOnlyL14-18, so the server can end a session by deleting the row. If the account still has a temporary passwordL20, the response tells the frontend to make the user change it first.

Creating users. HR fills in a two-step form (details, then department and permissions). The API makes the account with a random temporary password and emails it with nodemailer. If the email fails, the account is deleted again, so nobody ends up with an account they can't get into.

Frontend. Vue 3 with file-based routing. My README says I used shadcn/vue, but the frontend is actually built with Vuetify 3 (plus Tailwind). Its data tables, steppers and dialogs got the admin pages done quickly. Each role gets its own dashboard with summary cards and a recent referrals table, and the buttons use BAE's red so it looked like it belonged to them in the demo.

Outcome

We had a working demo by the end of the week: login with forced password change, user and department management, referral tables with archive and restore, and a two-step referral form. It wasn't finished. File uploads, real referral types and priorities (new referrals are hard-coded to "Medical" and "Low"), and the deadline cards were still missing.

The presentation went well. Other teams were interested in what we'd built, and the judges gave us useful feedback on what we could have improved or done better within the week. Most of us had tired voices by the end of the day, and it finished with drinks with the other teams.

I study cyber security, so reading this back, the server-side checks are what stand out:

1    static async createUser(req: Request, res: Response): Promise<any> {2        try {3            const { name = '', emailAddress = '', department = 0, permission = EUserRole.User } = req.body;45            const lower = "abcdefghijklmnopqrstuvwxyz";6            const upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";7            const numbers = "0123456789";8            const symbols = "!@#$%^&*()-_=+[]{}|;:,.<>?";910            const allChars = lower + upper + numbers + symbols;11            let password = "";1213            for (let i = 0; i < 5; i++) {14                const randomIndex = Math.floor(Math.random() * allChars.length);15                password += allChars[randomIndex];16            }1718            const salt = await bcrypt.genSalt(10);19            const hash = await bcrypt.hash(password, salt);2021            const user = await UserClass.create({22                name: name,23                emailAddress: emailAddress,24                role: permission,25                departmentId: department,26                password: hash,27                tempPassword: true28            });

• No authorisation on the HR routes. createUser takes the role straight from the request bodyL3 and saves itL21-28 without checking who is asking. Hiding pages from users who shouldn't see them happens only in the frontend, so anyone who can reach the API could create an admin account. The session check in the login controller should have been shared middleware in front of every /plus and /enhanced route, with a role check.
• Weak temporary passwords. Five characters from Math.randomL13-16 is too short and not cryptographically random. The seeded admin / admin account and secure: false on the cookie were fine for a demo laptop and nowhere else.
• A request that never ends. Creating a referral without a session cookie never sends a response at all, so the request just hangs.

The good parts were also mine: hashing, server-side sessions, and the email rollback. Building a whole stack in five days taught me to get the risky parts (login, data model) working first, and that the demo-only shortcuts need writing down at the time, so they don't get forgotten afterwards.

The decorated model classes are the same idea I tried to build myself in Savers a year earlier. Using sequelize-typescript here showed me what a finished version of that idea looks like.