CampusPro

Overview

Built for: Education SaaS operators and the institutions they serve: platform admins, institution admins, teachers, accountants, students and parents.

Main features

• Multi-tenant institutions

  The platform admin creates, edits, suspends and deletes schools, academies and colleges. Each institution has its own login domain, slug, logo and feature flags such as sections, multiple enrollments and online students.

• Per-tenant roles and permission matrix

  A catalog of modules with view, create, edit and delete keys lets each institution define custom roles in a toggle matrix. The app launcher shows only the apps a user is allowed to open.

• Users, students and bulk import

  Staff, students and parents get server-generated sign-in IDs, parent linking and activation status. Admins can import users from an Excel template after validation and export lists back to Excel.

• Academic structure

  Classes, sections or batches, per-group curriculum and teacher assignments. Enrollments support transfer, completion and withdrawal while keeping history.

• Attachments and audit trail

  Per-tenant attachment categories with in-browser preview of PDF and DOCX files. Every data change writes an audit record with an old and new value diff, with secret fields excluded.

• Activation-code onboarding

  I replaced password-less first login with one-time codes issued by an admin. Only a hash is stored, and each code expires after 72 hours, works once, is tied to one user and tenant, and is revoked after five failed attempts.

• Grant-ceiling access control

  I changed role management so a user can grant, copy or assign only the permissions they already hold. Platform-only permissions are rejected for institution roles and ignored at runtime.

• Session and abuse protection

  Login is rate-limited per IP and per account, all failures return the same generic response, and logout revokes the refresh session. The refresh cookie stays secure behind a reverse proxy.

Development and architecture

Tenant isolation at the data layer

Global query filters and tenant stamping cover 22 entity types, and the tenant ID is taken only from the token. This makes isolation a property of the data layer instead of something each endpoint has to remember.

Grant ceiling for permissions

I chose a simple rule that is easy to test: nobody can hand out access they do not have. It closes escalation through role editing without changing how institutions manage their own roles.

Hashed, expiring activation codes

Codes have about 79 bits of entropy and are stored only as SHA-256 hashes, with expiry, single use, an attempt cap and binding to one user and tenant. Admins can issue a new code or reset a login from the user screen.

Fail-fast secrets and bootstrap CLI

The API refuses to start with a missing or known-weak signing key outside development. A one-time command creates the platform admin and reads the password from an environment variable, never the command line.

Data integrity under failure

Activity rows are now written through an isolated database context, so a failed request no longer commits half-finished changes. Student edits use PostgreSQL xmin optimistic concurrency to catch conflicting saves.

Logging without personal data

I replaced request-body logging with one metadata line per request and an X-Correlation-ID header. An integration test asserts that secrets never reach the log files.

Integration tests on real PostgreSQL

39 xUnit tests use WebApplicationFactory against a throwaway PostgreSQL database and cover escalation, grant ceilings, activation, rate limits, logging and data integrity. I also hand-reviewed the new migration to keep it additive only.

Technology

• .NET
• ASP.NET Core
• C#
• Entity Framework Core
• PostgreSQL
• React
• TypeScript
• Vite
• Tailwind CSS
• xUnit
• Serilog
• Recharts

Results

Integration tests added

39Integration tests addedThe project's first automated tests, run against a real PostgreSQL database.

Critical and high-severity findings addressed

7Critical and high-severity findings addressedFive critical and two high-severity audit findings fixed in the Phase 1A patch, plus session hardening.

Existing files changed in the patch

42Existing files changed in the patch+1,312 / -522 lines, plus new services, a migration, an operator guide and the test suite.

API controllers audited

22API controllers auditedAbout 92 endpoints, inventoried in the Phase 0 repository audit.