HERON (GEK TERNA Group)

Enterprise KPI Analytics Platform

Summary

A full-stack internal portal for corporate KPI management: dashboards, quarterly goal/actual editing, field-level audit with revert, threaded comments, cross-year comparison, and server-side export to Excel, PDF, and PowerPoint. Access control runs on manual Microsoft Entra ID token verification with role-based access control, and the service is backed by 100% line coverage.

Architecture

A user signs in through Microsoft Entra ID, works in a KPI dashboard table that branches into quarterly goal editing, an audit trail view and a comment list, all of which call a backend API that applies role and CSRF checks before reading and writing a document store or building a workbook or PDF that returns to the browser.
KPI management portal with quarterly editing, field level audit and server generated document export.
  • The service worker refuses to cache any non GET request and any response that is not same origin, so authenticated API payloads can never be persisted to the browser cache while static assets still load cache first.
  • The batch actuals update in the API client was deliberately reduced to a no op that warns and resolves, instead of being deleted, so that any remaining caller is pushed onto the single quarter endpoint rather than silently performing a multi field write with partial failure semantics.
  • The comment surface and the metric type explainer are mounted as routed overlays rather than local component state, so each gets a real URL and correct back button behaviour, while ordinary confirmation dialogs elsewhere in the app stay as local state.
  • The client holds no data fetching or caching library at all. The KPI context refetches on every page, sort and filter change, which keeps request and response semantics predictable and avoids a cache invalidation layer on top of the app’s hand written session handling.

Highlights

  • Manual JWKS-based Microsoft Entra ID token verification, RBAC, HttpOnly cookie sessions with double-submit CSRF, correctly bypassed for bearer-token callers.
  • Identity-keyed sliding-window rate limiting that follows the user rather than the shared corporate egress IP.
  • Three export formats from one query contract, including Unicode font registration for Greek glyphs and programmatically generated, on-brand slide decks.
  • Proactive token-refresh session model on the frontend with cross-tab logout broadcast.
  • Backed by 100% line coverage and 24 architecture decision records.
  • Every mutable field of a record persists in a single read modify write cycle against the document store, replacing a per section write path that permitted stale overwrites.
  • Batch profile photo retrieval degrades per subject, so one upstream timeout yields a null entry for that subject instead of failing the whole response.

Technologies

  • Python
  • FastAPI
  • Azure Cosmos DB
  • React 19
  • TypeScript
  • MSAL
  • Chart.js
All projectsView ResumeGet in touch