dynamic navigation
The FE sidebar is built from the BE response that lists modules the user is allowed to access.
StockFlow
Internal warehouse & inventory application: race-safe stock IN/OUT, audit chain, role-based access, and Excel reporting.
Quick Facts
- Role
- Full-Stack Developer
- Year
- 2026
- Sector
- Logistics
- Website
- stockflow.akbari.online
- Stack
-
- Laravel 11
- React 18
- MySQL 8
- Sanctum
- maatwebsite/excel 3.1
- Vite
- Tailwind
Problem & Solution
StockFlow - Overview
StockFlow is an internal application used by the warehouse & inventory operations team to record stock movements, manage module-level access per role, and produce Excel reports. It is designed to stay stable during peak hours and to be maintainable by the next engineer who joins.
Short lead: this application translates operational warehouse requirements, which usually arrive in business language, into clear REST APIs and frontend flows, so requirement changes do not always mean renegotiating the contract.
Screenshot Gallery
Architecture Diagram
Feature Highlights
rbac
Request passes auth:sanctum, then module:xxx middleware, then role_module lookup.
stock movement create
Validate, transaction begin, lock item row, INSERT stock_movements, INSERT movement_logs (type_activity=CREATE), applyMovementDelta, COMMIT.
stock movement update
Validate, transaction begin, lock item row, capture oldQty, compute delta, UPDATE stock_movements, INSERT movement_logs (type_activity=UPDATE), applyMovementDelta(delta), COMMIT.
Engineering Case Studies
- feature Dynamic Module-Based Navigation The FE sidebar is built from the BE response so the menu always reflects the current user's role and module access.
- feature Role-Based Access Control - Module-Level Granularity mst_modules + role_module pivot + module:xxx middleware - CRUD-level granularity without hardcoded role checks.
- challenge Stock Movement Integrity - Race-Safe & Audit Chain lockForUpdate + immutable movement_logs + delta-based recompute for stock consistency.
- feature Grouped Reporting - Consistent Aggregation report-grouped endpoint with filters consistent with the raw report, so the FE does not need two parsers.
- challenge Test Database Safety - Guard Before RefreshDatabase TestCase guard validates APP_ENV and DB_DATABASE before RefreshDatabase wipes the DB.
- security Security Hardening - Formula Injection, Self-Delete, Last-Admin Four targeted security patches and one custom exception handler for consistent JSON responses.
Security & Quality
- Formula injection escape on every user-controlled Excel field.
- Self-delete guard prevents admin from removing their own account.
- Last-admin guard prevents running without an active admin.
- Token revoke on user soft-delete prevents token reuse.
- Test DB safety guard (APP_ENV + DB prefix) prevents dev DB wipe.
Want to discuss this project?
Want to discuss this project?