StockFlow · Year 2026
StockFlow
Internal application for port operations: race-safe stock IN/OUT, audit chain, role-based access, and Excel reporting.
Quick Facts
- Role
- Full-Stack Developer
- Year
- 2026
- Sector
- Logistics
- Website
- stockflow.akbari.online
- Stack
-
- Laravel 11
- React 18
- MySQL 8
- Sanctum
- maatwebsite/excel 3.1
- Vite
- Tailwind
Problem & Solution
StockFlow - Overview
StockFlow is an internal application used by the port operations team to record stock movements, manage module-level access per role, and produce Excel reports. It is designed to stay stable during peak hours and to be maintainable by the next engineer who joins.
Short lead: this application translates operational port requirements, which usually arrive in business language, into clear REST APIs and frontend flows, so requirement changes do not always mean renegotiating the contract.
Screenshot Gallery
Architecture Diagram
Engineering Case Studies
- feature Dynamic Module-Based Navigation The FE sidebar is built from the BE response so the menu always reflects the current user's role and module access.
- feature Role-Based Access Control - Module-Level Granularity mst_modules + role_module pivot + module:xxx middleware - CRUD-level granularity without hardcoded role checks.
- challenge Stock Movement Integrity - Race-Safe & Audit Chain lockForUpdate + immutable movement_logs + delta-based recompute for stock consistency.
- feature Grouped Reporting - Consistent Aggregation report-grouped endpoint with filters consistent with the raw report, so the FE does not need two parsers.
- challenge Test Database Safety - Guard Before RefreshDatabase TestCase guard validates APP_ENV and DB_DATABASE before RefreshDatabase wipes the DB.
- security Security Hardening - Formula Injection, Self-Delete, Last-Admin Four targeted security patches and one custom exception handler for consistent JSON responses.
Security & Quality
- Formula injection escape on every user-controlled Excel field.
- Self-delete guard prevents admin from removing their own account.
- Last-admin guard prevents running without an active admin.
- Token revoke on user soft-delete prevents token reuse.
- Test DB safety guard (APP_ENV + DB prefix) prevents dev DB wipe.
Want to discuss this project?
Want to discuss this project?