KAP

Search the portfolio.

Quick links

CASE STUDY 03 / BUSINESS WORKFLOWS

From customer request
to accountable records.

A public service website and protected staff workspace for enquiry intake, assignments, follow-ups, and invoice records. The engineering focus is the transition from untrusted input to a reliable business record.

PROJECTKap Services
STATUSDevelopment project
TECHNOLOGIESNext.js · TypeScript · PostgreSQL · Vitest

01 / SYSTEM VIEW

Where the boundaries sit.

A simplified view to support a technical conversation.

USER EXPERIENCE

Public website

Service information and enquiry intake

Staff workspace

Assignments, follow-ups, and invoices

TRUST BOUNDARY

Server workflow

Permission checks · field validation · computed totals

Business records

Requests and invoice history

Notifications

Follow-up after saving the request

Conceptual view of the project summary. Saving an enquiry before attempting notification separates record creation from delivery failures.

02 / ENGINEERING DECISIONS

The reasoning matters.

Implementation choices paired with the tradeoffs they introduce.

01

Treat submitted totals as untrusted

The parser tests exclude client-supplied totals, paid amounts, and paid status from the validated invoice input.

REVIEW CONSIDERATION

The server still needs to enforce permissions and derive authoritative values when the record is saved.

02

Define decimal behavior

The selected tests cover per-line rounding, tax rounding, large values, and amounts that binary floating point cannot represent exactly.

REVIEW CONSIDERATION

Rounding rules are part of the business model and need to remain consistent between previews and saved invoices.

03

Reject malformed data early

Tests exercise invalid quantities, prices, tax rates, dates, missing names, and incomplete edit identity.

REVIEW CONSIDERATION

A convenient form can guide input, but validation must also handle requests that never used that form.

03 / REVIEW SCENARIOS

Look at the unexpected path.

Illustrative explanations of selected test definitions. These controls do not call the application or execute its tests.

SCENARIO 01

Manipulated total

A request supplies a low total, a paid amount, and a paid status alongside invoice fields.

EXPECTED IN THE SELECTED TEST

Recompute from inputs

The selected parser test expects those authority-bearing fields to be excluded from parsed invoice input.

NEXT REVIEW QUESTION

Review the server save path to confirm that calculated values and payment history are the only authority.

SCENARIO 02

Invalid decimal

A unit price contains excess fractional digits, scientific notation, or a non-finite value.

EXPECTED IN THE SELECTED TEST

Input rejected

The invoice tests expect malformed or out-of-range monetary inputs to throw validation errors.

NEXT REVIEW QUESTION

Present a useful field error while preserving the user’s valid entries.

SCENARIO 03

Boundary amount

An invoice reaches the permitted total, then another line pushes it beyond that limit.

EXPECTED IN THE SELECTED TEST

Limit enforced

The selected test accepts the exact maximum and rejects values that exceed it, including through tax.

NEXT REVIEW QUESTION

Apply equivalent limits to imports, edits, and payments as well as initial creation.

04 / TRACEABLE EVIDENCE

From a claim to a test.

Selected source reviewed on November 6, 2026.

Source reviewed · tests not rerun
SELECTED TEST FILEsrc/lib/invoice-model.test.ts
Snapshot9b83e5f14339
  • Client-supplied totals and payment status are excluded
  • Decimal arithmetic, line count, amount, and tax limits
  • Date validation, leap dates, and identity for invoice edits

These statements summarize the test definitions at this repository snapshot. They do not report a passing run, complete coverage, or an independent security audit. Application source stays private.

WHAT I WOULD EXAMINE NEXT

Continue the review.

A fuller production review would verify staff permissions at server endpoints, exercise partial payments and corrections, and test notification failures after a request is saved.

CONTINUE EXPLORING

Hatlangh Beh

Audience rules & personal-data privacy

Discuss this project