CASE STUDY
Pharma Traceability Platform
NestJS microservices with scoped authorization, explicit database ownership and traceability lifecycle rules.
Problem & constraints
Build a traceability application that separates identity, organisation, product, batch and serialized-unit responsibilities. The current implementation is a local, Docker Compose-based engineering project; it does not establish a deployed regulatory-compliant production service.
Architecture & engineering decisions
The API Gateway fronts Auth, Organisation, Product, Batch and Serialization services. Each service owns its PostgreSQL database and Prisma client. HTTP service-to-service calls and signed internal context make identity propagation explicit without sharing database credentials. The tradeoff is more failure boundaries and local setup than a single application.
Implemented workflows
React, TypeScript, Vite and React Hook Form support organisation, facility, product/GTIN, batch and serialization screens. REST controllers delegate to service and repository layers. Prisma transactions and relational constraints enforce organisation ownership, reference validity, serial uniqueness and lifecycle transitions. Conditional updates reject conflicting transitions.
Authentication & security
JWT access tokens and rotating refresh tokens separate short-lived API access from session renewal. Refresh tokens use HttpOnly cookies, and Argon2id protects passwords. Zod and NestJS DTO validation check boundaries. Organisation-scoped ORG_ADMIN, OPERATOR and VIEWER policies are enforced by services, not only by hidden UI controls. Signed service context binds identity, method, path, body and timestamp.
Reliability & observability
Gateway deadlines and explicit upstream failures keep unavailable dependencies visible. Pino supplies structured logging. Database ownership avoids cross-service SQL coupling; reference checks still depend on HTTP availability. Retrying a write requires an explicit idempotency policy rather than assuming every failure is safe to retry.
Testing & local delivery
Node/Nest integration and service tests exercise authentication, gateway forwarding, scoped access and service behavior. pnpm workspaces coordinate the packages. Docker / Docker Compose provide local infrastructure; ESLint, Prettier and strict TypeScript support consistent checks.
Roadmap / Planned Architecture
Not implemented: Kafka, Redis, DynamoDB, S3, Kubernetes / EKS, Helm, Terraform, GitHub Actions, AWS RDS, MSK, ElastiCache, ECR, ALB, WAF, IAM, Secrets Manager, CloudWatch and OpenTelemetry. These are future architecture and delivery work, not current stack badges.
Lessons & next improvements
Service ownership is useful only when authorization and data boundaries remain enforceable. The next phases should add messaging and cloud deployment incrementally, with contract tests and recovery scenarios before claims of operational readiness.