Institutional Platform
KIIT IQAC Website
KIIT University's official quality-assurance portal and back office, rebuilt from static HTML into a 64-page full-stack platform with 5,000+ users.
Institutional · built for KIIT · code not public
- Users
- 5,000+
- SLP turnaround
- ~1 week → ~1 day
- Pages
- 64
- Schema
- 32 tables
- Roles
- 7
- MoUs
- 697 on record
Problem
The Internal Quality Assurance Cell ran on a static HTML/CSS/JavaScript site. Every content change needed a developer, and the cell's operational records (MoUs, guest and partnership data, internal documents and approval paperwork) lived in paper files and disconnected Excel sheets, which made them hard to find, audit or reuse as ranking and accreditation evidence.
Approach
A ground-up rebuild on Next.js 15, React 19, TypeScript and Tailwind CSS v4, backed by a 32-table schema on Neon Postgres through Drizzle ORM. A protected admin panel with 7 roles and per-role privilege overrides lets non-technical staff run the site themselves, with every admin mutation written to an audit log. On top of the public site sit a private document management system, an MoU register of 697 MoUs on record (2001–2026), and a paperless School Level Presentation workflow: a three-stage approval chain, single-use signing links for school QA cells that need no account, and server-generated PDFs, with the approval history made append-only by a database trigger. Files live on Cloudflare R2 behind presigned URLs, mail goes through the Gmail API with an SMTP fallback, and public endpoints are rate-limited with Upstash.
Highlights
- 7-role RBAC with per-role privilege overrides, server-side checks on every admin action, and a full audit log of admin mutations
- Paperless School Level Presentation approvals used by about 1,500 faculty, cutting turnaround from about a week to about a day: a three-stage review chain, single-use signing links for school QA cells, server-generated PDFs, and an append-only approval history enforced by a Postgres trigger
- Private document management system and an MoU register holding 697 MoUs on record since 2001
- One guest and resource-person form with live goal tracking, replacing per-school Excel sheets that were reconciled by hand
- CI quality gates covering type-checking, linting, unit tests, end-to-end tests and automated accessibility checks
Screens
Home page, iqac.kiit.ac.in
Reports & Publications register
MoU register at a glance
Architecture
Select a layer to read why it is there.
Public pages render on the server, so content arrives as HTML with little client JavaScript.
Admin writes go through Server Actions that re-check the caller's permission on the server; public forms use route handlers.
Migrations only move forward; a database branch is taken before a risky change instead of relying on a rollback script.
Each admin action lists the roles allowed to perform it, a Super Admin can override that per role, and every mutation is logged.
File bytes go straight from the browser to R2; mail uses SMTP by default, with an opt-in Gmail API path that falls back to SMTP.
Rate limiting fails open if Upstash is unreachable, trading strictness for availability; errors are reported to Sentry.
Decisions & trade-offs
Append-only approval history, enforced in the database
A Postgres trigger rejects any update or delete on the School Level Presentation event table, so the approval record cannot be rewritten from the app or by hand. The cost: applications can only be soft-deleted, and the trigger sits outside the ORM's schema model, so it is maintained in the SQL migrations.
Signing links instead of accounts for school QA cells
Reviewers in school QA cells approve through a single-use link rather than a login. Only a hash of the random token is stored, the link expires after seven days, and it is consumed in one conditional update. Whoever holds the link can act on it, so single use, a short lifetime and recording the acting address in the append-only history keep that risk contained.
Send-only Gmail API, with SMTP as the fallback
Mail can go out through the Gmail API with only the send scope, and a failure is retried once over SMTP. Sending never throws into the request, so a failed message cannot break the action that triggered it; the trade-off is that delivery problems show up in the email log rather than as an error.
Uploads that bypass the app server
Documents go directly to Cloudflare R2 on presigned URLs, with the file size checked when the URL is issued and bound into it. The server never streams file bytes, at the cost of a two-step upload flow.
Impact
Replaced manual code edits and spreadsheet tracking with a self-service system of record for the cell. School Level Presentation approvals for about 1,500 faculty went from roughly a week on paper to about a day online. Guest and resource-person details, which schools used to send as separate Excel sheets over email to be reconciled, de-duplicated and verified by hand, now come in through one form with live progress against collection goals. Routine content and record updates are a staff action rather than a developer request, and the MoU and partnership data feeds KIIT's ranking and accreditation submissions.
Outcome
- The cell's pages, documents and MoU records are maintained by staff through the admin panel rather than by code edits.
- 64 pages over a 32-table schema, built through 29 forward-only migrations.
- CI gates every change on type-checking, linting, formatting, tests (78 test files) and a production build.
- Weekly database dumps to R2 on top of the database provider's point-in-time recovery.
- The School Level Presentation workflow is in use by about 1,500 faculty; an approval that took about a week on paper now takes about a day.
- Over 5,000 people use the site: roughly 1,500 faculty on SLP, about 1,000 guest and resource-person users and around 3,000 visitors a month.