01 / PAID CLIENT PROJECT · FULL-STACK
RDM Client Portal
A client–admin portal for RDM Aaya Kar Tatah Mu. Aa. Kar. Paramarsha Kendra, an IT, tax and VAT consultancy and audit firm, so clients can access their audit reports securely.
- The problem
- The firm's clients need their audit reports, tax reports, financial statements and compliance documents, and each client must see only their own.
- What I built
- Everything: the React interface, the Express API, the MySQL schema, and the Google Drive integration. Clients sign in and see only the documents in their own Drive folder. Administrators manage clients, folder mappings, users, uploads and the audit trail.
- Key decision
- Google Drive stays the file store, and the API is the authorisation layer. It checks ownership and streams the file bytes, so no Drive link, file ID or credential ever reaches the browser. Every access failure returns the same 404, so clients can't probe for other clients' document IDs.
- Security
- Rotating refresh tokens in HTTP-only cookies, CSRF tokens, rate limits, single-use password reset, and a full audit log of logins, views, downloads and admin actions.
Paid client engagement. The code and client data are private, so there is no public repository or demo.
Access checks · scratch-database run
404
What client A gets when requesting client B's document: metadata, view and download alike.
| Attempt | Result |
|---|---|
| ?client_id= on list endpoint | ignored |
| Write without CSRF header | 403 |
| Client calls admin endpoint | 403 |
| Refresh-token reuse | session revoked |
