The front door for everything else. Students and faculty sign in with LMU single sign-on, and every other app delegates login here through a standards-compliant OAuth 2.0 / OpenID Connect provider. Instructors take attendance from a kiosk that reads a OneCard swipe or a short check-in code, and every record keeps whether it came from a scan or was entered by hand.
Highlights
- Full OIDC provider: discovery document, authorize, token and userinfo endpoints; authorization-code only, PKCE S256 required, hashed client secrets with admin rotation, exact-match redirect URIs.
- Auth codes and access tokens live in Redis with 5-minute and 1-hour TTLs; sessions are HMAC-signed cookies.
- Role model (student, instructor, admin) derived from the LMU email domain, Google and GitHub account linking, and impersonation with an audit trail.
- Admin console for users, roles, teams, courses, attendance, OAuth apps and settings.
- Counts-only public usage API, plus a separately signed endpoint for personal data, feeding the analytics on this site.
- CI runs typecheck, lint, format and tests as separate jobs; a security audit is committed in the repo.
Stack
- Next.js 16
- React 19
- TypeScript
- Tailwind 4
- Neon Postgres
- Drizzle ORM
- Upstash Redis
- Auth0 / LMU SSO
- Jest
- GitHub Actions
- Vercel
Since March 2026 · 130+ commits · 59 API routes
Applications from the TA survey land in one table. Faculty filter by availability, see each applicant's course interests, draft them to a course as a tutor, grader, in-class or recitation TA, and track Workday hiring status through to hired. Ownership is enforced server-side, so an instructor can only change their own drafts.
Highlights
- Hand-rolled OAuth 2.0 authorization-code + PKCE client against lmucs.org and an HMAC-signed 7-day session cookie, with no auth library.
- Signed roster feed consumed by the scheduling app and the lab display: HMAC-SHA256 over key id, method, path, canonical query and timestamp, 5-minute replay window, constant-time comparison.
- Admin tools: live presence, "view as" impersonation with an audit log that records the impersonator, activity log and an in-app test-coverage page.
- 36 numbered SQL migrations applied under an advisory lock. CI applies them twice from an empty database to prove idempotence, then seeds and smoke-loads every page with a forged admin session.
- A custom ESLint rule, written after a production incident, blocks non-serializable values from crossing the server/client boundary. 80% coverage gate on the logic tier.
Stack
- Next.js 16
- React 19
- TypeScript
- Tailwind 4
- Neon Postgres (raw SQL)
- Jest + Testing Library
- Prettier
- GitHub Actions
- Vercel
Since August 2026 · 125 commits · 36 migrations · 33 test files
Shows the semester draft, TA preferences and course coverage, and owns the in-lab tutoring schedule: TAs claim weekly shifts, admins manage the roster, and the result feeds the public calendar, the lab TV and the class schedule site through a signed API. In Fall 2026 it replaced Google Calendars that had been kept by hand.
Highlights
- Aggregates five upstreams at request time: the recruiting roster (signed), Google Sheets TSV, Google Calendar ICS feeds, the class schedule API and lab card scans, then publishes its own signed feeds.
- Interactive OpenAPI documentation generated from the code, served as Swagger UI and Redoc.
- server-only guards on every credential-bearing module (52 files); 8-character Nano IDs are the only identifiers exposed outside the database.
- Layered caching: hourly revalidation for class data, immutable versioned photo URLs with stale-while-revalidate for bare paths.
- Admin audit log, presence, stats snapshots, "view as", photo uploads and in-app docs with Mermaid diagrams that CI link-checks.
- Nightly GitHub Actions integration run against live infrastructure; a build-trace check guards the Vercel bundle size.
Stack
- Next.js 16
- React 19
- TypeScript
- Tailwind 4
- Neon Postgres (raw SQL)
- NextAuth v5
- OpenAPI / Swagger
- Zustand
- Luxon
- Jest
- GitHub Actions
- Vercel
Since November 2025 · 200+ commits · 18 migrations · ~135 test files
Each TA gets a personal QR code. A kiosk in the lab reads it, or a library number, from a hardware scanner, records the scan and flips their shift to on duty. TAs see their shifts, attendance and scan history; admins get a generic table browser and editor.
Highlights
- Supabase Postgres with row-level security (32 policies plus a dedicated hardening migration), Supabase SSR auth, Google sign-in by ID token and a realtime channel for shift updates.
- Kiosk mode with auto-focused scanner input, an optional password gate, a health check and a configurable result display.
- Public shifts API with CORS and Swagger/Redoc docs; outbound HMAC-signed calls to the scheduling app.
- A deploy-update notifier polls the deployment id and asks users to refresh after a release.
- Two committed security audits, including a black-box test of the live site.
Stack
- Next.js 16
- React 19
- TypeScript
- MUI 5
- Tailwind
- Framer Motion
- Supabase
- Zustand
- React Query
- Zod
- Luxon
- Jest
- Vercel
Since February 2024 · 239 commits · 32 routes
The public front door for tutoring: students see which TAs are in the lab and when, across the whole semester, without signing in. It pulls the live schedule from the TA Draft app over a signed connection, caches each response for a minute, strikes through cancelled sessions and flags delayed ones as "Running late".
Highlights
- Holds a single API key and only ever reads shifts; TA photos and full names stay upstream.
- Repeats each shift over its own date range, so one-week changes and mid-semester moves render without duplicates.
- Leaves a semester off entirely when upstream term dates are missing, rather than repeating it forever.
Stack
- Public calendar
- Signed HMAC API client
- 60-second response cache
A fast, searchable schedule of CS, Math and ECE courses by year and semester, with table, weekly-calendar and print views plus a TA tutoring calendar. Course data is parsed from registrar exports into versioned JSON that ships with the app, so pages render with no database at all. Other suite apps call its API for course titles, instructors and term dates.
Highlights
- Dynamic department / year / semester / type routing with automatic "latest term" ordering.
- Tutoring calendar reads the TA Draft feed over signed requests with a 60-second in-memory cache and in-flight de-duplication; earlier terms fall back to Google Calendar ICS.
- Path-traversal validation on the data endpoint; version endpoints expose the commit and deployment ids.
- CI with SHA-pinned actions: typecheck, lint, format, tests, build and a docs link check.
Stack
- Next.js 16
- React 19
- TypeScript
- Tailwind 4
- Axios
- Luxon
- Zustand
- Jest
- GitHub Actions
- Vercel
Since August 2025 · 64 commits · 9 API routes
Rotates full-screen views of who is on duty right now, with photo cards that re-lay out for one to five tutors, and the day's full list. Any date and time can be replayed from the URL for testing. Running since 2022, it is the longest-lived app in the suite.
Highlights
- Polls the TA Draft shifts feed every 60 seconds through its own signed serverless functions, so keys never reach the browser.
- Marks same-day schedule changes "TODAY ONLY"; the campus time zone is pinned and handled with Luxon.
- The build injects the commit SHA and Vercel deployment id, shown in an in-app version tooltip.
Stack
- React 18
- TypeScript
- Create React App
- React Router 7
- MUI
- React Query
- Supabase
- Luxon
- Vercel Functions
- Jest
- GitHub Actions
Since August 2022 · 400+ commits
The hub that ties the suite together: quick links for students, TAs and faculty, curated hardware and tech catalogs, and this analytics dashboard, the only place the department can see how many distinct people use the apps each day, week and month.
Highlights
- Privacy-preserving cross-app analytics: each app returns HMAC-keyed pseudonymous ids, this site unions them so a person using three apps counts once, ids never leave the server, and names come only from a separately signed endpoint shown to admins.
- A nightly Vercel cron archives every app's usage into this site's own Postgres tables, so DAU / WAU / MAU, stickiness, retention cohorts, per-term reach, weekday patterns and attendance outlive each app's retention window.
- Charts are hand-written SVG with a custom pointer-following tooltip and a table fallback. No chart library.
- OAuth 2.0 + PKCE against lmucs.org and GitHub App OAuth, both without an auth library; HMAC-signed httpOnly session; same-origin checks on every admin mutation.
- Admin-editable, drag-to-reorder links and catalogs; React Compiler enabled; CDN cache headers with stale-while-revalidate on public analytics.
Stack
- Next.js 16
- React 19 + React Compiler
- TypeScript
- Tailwind 4
- Neon Postgres (raw SQL)
- Inline SVG charts
- nanoid
- Jest
- Vercel Cron
- Vercel
Since February 2026 · 22 API routes
