IMMAR

The problem

Every teacher runs an isolated workspace with its own courses, team, subscription codes and revenue, on one shared codebase and one database, so a forgotten filter has to fail closed rather than surface another teacher's data.

The content has to stop leaking: video served as encrypted HLS behind short-lived, per-viewer playback tokens with an on-screen watermark, PDFs stamped with the student's details, and every account capped to a small number of registered devices.

Access is sold as printed single-use codes redeemed from a phone over unreliable mobile networks, so a code must never unlock a course twice or be lost to a retried request, and every paid redemption has to record a sale with the commission frozen at that moment.

Identity is phone-number-only with OTP, the product is Arabic-first and RTL with English second, and the same rules for exams, codes and permissions have to hold across a Flutter app and a web dashboard talking to one API.

Role & responsibilities

Backend lead on a two-engineer team: the initial architecture and most of the code, 60 of the 63 API controllers, 364 HTTP endpoints across 6 audience surfaces, 74 domain entities mapped 1:1 to 74 PostgreSQL tables, 20 of the 24 EF Core migrations, and review of 57 of its 61 pull requests.

Identity, access and tenancy: phone-only registration with OTP, JWT with workspace-scoped permission claims and refresh-token rotation with reuse detection, the per-student device limit, 6 named rate-limit policies, a permission-first RBAC of 60 keys and 8 system roles on 286 controller actions, and a fail-closed EF Core global filter on every workspace-scoped entity.

The money and exam flows: subscription-code batches and race-safe redemption in one transaction with the commission frozen onto each sale, the settlement lifecycle (draft, approved, paid) with append-only adjustments and receipts, server-clock exam attempts with autosave, auto-grading and an expiry sweep (exam sections and grading concurrency co-built with his teammate), and 23 notification event types drained to FCM by background jobs.

Provider adapters, jobs and tests: the Cloudflare Stream, S3, FCM HTTP v1 and SMS adapters with a dev double behind each port (PDF watermarking by his teammate), the 17-job Hangfire platform with a job-runs ledger and dead-letter handling, the PostgreSQL-backed integration-test harness, most of the 1,520 xUnit test methods, CI and the Dockerfile.

Beyond the backend: the founding design pack the team built from (SRS, architecture, conventions, runbook); the React 19 dashboard's scaffold, typed API layer (37 service objects, 270 methods), permission-first routing and platform console, with the visual system, data tables and assessment builder by his teammate; and push notifications, announcements and video-player fixes in the Flutter app his teammate leads.

Tenancy that cannot be forgotten

Every workspace-scoped entity gets one composed EF Core global filter (soft-delete and workspace) built at model time, a per-request scope that fails closed to an empty workspace when nothing resolves, and a background-job mode that throws instead of silently returning zero rows when a job never declared its scope; the SaveChanges interceptor stamps and validates the workspace on every write. Teacher permissions travel in the token as workspace-qualified claims, so a right held in one workspace never resolves in another, and a cross-workspace read answers 404, not 403. A missed filter shows up as an empty page or an exception in the 91 PostgreSQL-backed integration tests, never as another teacher's data.

A subscription code is a money event

Redeeming a code has to flip the code, create the enrollment, record the sale with the commission rate frozen onto it and bump the course counter as one unit, from a phone that may retry. It runs in one explicit transaction with a row lock on the renewal path, a partial unique index on active (student, course) refuses concurrent duplicates, and his teammate added a dedicated rate-limit policy on the activation endpoint plus an Idempotency-Key store so a timed-out retry gets the original response back instead of an ambiguous already-enrolled error. Later rate changes never rewrite history, because the rate lives on the sale, not on the teacher.

Video that costs one signature per play

Protected lessons stream from Cloudflare Stream as encrypted HLS, but asking the provider's API for a signed URL on every play would be slow and rate-limited. The backend mints the short-lived playback token locally in the provider's exact format, bound to the student, device, lesson, asset and IP and audited on every issue, and returns the per-student watermark text alongside the manifest for the app to render. Quality selection, which the provider does not expose, comes from parsing the HLS master playlist once at transcode time and re-signing each rendition at play time, and the transcode webhook is read as raw bytes and HMAC-verified before any model binding.

Outcome

One backend serving both apps: 63 controllers and 364 endpoints over 74 tables, 60 permission keys and 8 system roles on 286 gated actions, 17 catalogued Hangfire jobs, 5 production provider adapters and 86 stable error codes with Arabic and English catalog entries, backed by 1,951 passing unit test cases and 91 PostgreSQL-backed integration tests. Around it, a React 19 dashboard with 57 routed screens, 3,343 i18n keys at exact Arabic/English parity and 679 Vitest tests, a Flutter student app for Android and iOS with 43 screens and 711 localisation keys per locale, and a public landing page. An ongoing client engagement built by two engineers, in development since July 2026.

What I learned

Tenant isolation has to be a property of the data layer, not a habit of the developer: a filter that can be forgotten will be, so make the missing filter fail closed and let integration tests prove it.

On a product sold through codes, the transaction boundary is the product: redemption, enrollment, the sale and its frozen commission have to commit together, and a retry from a bad network needs an idempotent answer, not an error.

Two engineers move in parallel across four repos only if the contract is written down: the design pack, the shared error and permission vocabularies and a pull-request gate on every repo did more for velocity than any framework choice.