Friday, July 25, 2025

🧠 Basic ReactJS Programming Language Tutorial: Getting Started with Modern Web Development

 ReactJS is one of the most popular JavaScript libraries for building modern, interactive user interfaces — especially for single-page applications (SPAs). Developed and maintained by Facebook, React allows developers to build reusable UI components and manage the state of their applications efficiently.

In this tutorial, we’ll walk through the basics of ReactJS, including how to set up your first project, understand components, and manage simple state using hooks. Whether you're a complete beginner or transitioning from plain HTML/JavaScript, this guide is for you.


✅ Why Learn ReactJS?

  • ⚡ Fast and efficient rendering with the Virtual DOM

  • ♻️ Reusable components for cleaner, modular code

  • 🌎 Huge ecosystem and community support

  • 🔄 Easy state management with React Hooks


🛠️ Prerequisites

Before diving in, make sure you have the following installed:


📦 Setting Up Your First React App

React offers a powerful command-line tool called Create React App to bootstrap your project:


npx create-react-app my-first-react-app

cd my-first-react-app

npm start

 After running this, your browser should open a development server at http://localhost:3000.


📁 Understanding the File Structure

my-first-react-app/
├── public/
├── src/
│   ├── App.js
│   ├── index.js

 

  • index.js: Entry point of the app
  • App.js: Main application component

🧩 Creating Your First Component

React components can be written as JavaScript functions:

1
2
3
4
5
6
7
8
// src/components/Greeting.js
import React from 'react';

function Greeting() {
  return <h2>Hello, welcome to React!</h2>;
}

export default Greeting;

Now use this in App.js:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
import React from 'react';
import Greeting from './components/Greeting';

function App() {
  return (
    <div>
      <Greeting />
    </div>
  );
}

export default App;

🧠 Introducing State with Hooks

React Hooks allow you to use state and lifecycle features in functional components.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
import React, { useState } from 'react';

function Counter() {
  const [count, setCount] = useState(0);

  return (
    <div>
      <p>You clicked {count} times</p>
      <button onClick={() => setCount(count + 1)}>Click me</button>
    </div>
  );
}

Then include <Counter /> in your App.js.


🎨 Styling in React

You can apply inline styles or use CSS files.

Using CSS:

1
2
3
4
5
/* App.css */
.title {
  color: blue;
  font-family: Arial;
}

1
2
3
4
5
6
// App.js
import './App.css';

function App() {
  return <h1 className="title">Styled Title</h1>;
}

📦 Bonus: JSX Basics

JSX is a syntax extension that lets you write HTML inside JavaScript:

const element = <h1>Hello JSX!</h1>;

JSX must return a single parent element — wrap multiple tags in a <div> or React Fragment (<> </>).


Technical Design Document: To-Do List Web Application

 

1. Introduction

Purpose of this document

This document provides a comprehensive technical overview and design of the To-Do List Web Application. It serves as a blueprint for developers, testers, and stakeholders.

Overview of the system

The system allows users to manage personal tasks through a web interface. Users can add, edit, toggle (mark complete/incomplete), and delete tasks. Admin users can view all users and manage task logs.

Scope and objectives

  • Implement a minimal, interactive to-do list using modern web technologies.

  • Ensure responsive UI/UX.

  • Support user authentication and role-based access.

  • Create a RESTful backend to persist data.

Intended audience

  • Developers

  • QA engineers

  • System architects

  • Stakeholders/product owners


2. References


3. System Overview

High-level description of the system

The system comprises:

  • A React frontend 

  • A Spring Boot backend (REST API)

  • A MySQL database

Summary of key features and components

  • Add/Edit/Delete/Toggle Tasks

  • User login and registration

  • Role-based views (Admin/User)

  • Data persistence and error handling

Assumptions and constraints

  • Internet access is required.

  • Only modern browsers are supported.

  • No offline mode.


4. Class Diagram Overview

Visual representation

Description of the structure

The system centers around a Task class, connected to a User entity. Tasks are owned by users and can be independently modified.

Major relationships

  • Association: A User has many Task objects.

  • Composition: Tasks are dependent on the User; deleting a User deletes their tasks.



5. Class Descriptions

5.1 Task

  • Responsibilities: Represent an individual task item.

  • Attributes:

    • id: Integer — Unique task identifier

    • title: String — The task description

    • completed: Boolean — Task status

  • Methods:

    • toggleStatus(): void — Marks the task as complete/incomplete

    • delete(): void — Deletes the task

  • Relationships:

    • Belongs to User

  • Notes:

    • Stored in the tasks table

5.2 User

  • Responsibilities: Represent the user who owns tasks.

  • Attributes:

    • id: Integer — Unique user ID

    • username: String — User login

    • email: String — Contact info

    • role: Enum — ADMIN or USER

  • Methods:

    • addTask(Task): void — Adds a new task

    • getTasks(): List<Task> — Returns all user tasks

  • Relationships:

    • Has many Task objects

  • Notes:

    • Stored in the users table


6. Interactions and Workflows

Key interactions

  • Users send task actions to backend via HTTP requests.

  • Backend updates database and returns updated task list.

  • Frontend reflects changes immediately.

Sequence Diagram

  1. User enters task

  2. Clicks "Add"

  3. Task is POSTed to API

  4. Response is rendered in the UI


7. Data Model

Database Tables

users

FieldTypeDescription
id    INT (PK)    User ID
username    VARCHAR    Unique username
email    VARCHAR    User email
password    VARCHAR    Hashed password
role    ENUM    ADMIN or USER

tasks

FieldTypeDescription
id    INT (PK)    Task ID
title    VARCHAR    Task description
completed    BOOLEAN    Status
user_id    INT (FK)    Owner user ID



Persistence Strategy

  • JPA with Hibernate for ORM

  • Repositories handle CRUD


8. API and Interfaces

TaskController (REST)

MethodEndpointDescription
GET/api/tasks    List all tasks
POST/api/tasks    Add new task
PUT/api/tasks/{id}    Toggle/update task
DELETE/api/tasks/{id}    Delete task

AuthController
MethodEndpointDescription
POST/api/login    Authenticate user
POST/api/register    Create new user

9. Error Handling and Logging

Strategy

  • HTTP status codes for client errors (400s) and server errors (500s)

  • Backend uses @ControllerAdvice for global exception handling

Logging

  • Spring Boot logger with SLF4J

  • Logs include user actions, errors, and system events


10. Security Considerations

  • Passwords are hashed using BCrypt

  • JWT for session tokens

  • Role-based method security using @PreAuthorize

  • No sensitive data in frontend or local storage


11. Performance Considerations

  • Lightweight UI for fast load

  • Indexed DB fields for speed

  • API caching for GET requests

  • Lazy loading for user-specific task lists


12. Testing Strategy

Unit Tests

  • Service and controller unit tests using JUnit and Mockito

Integration Tests

  • Full API flow using Spring Boot Test

  • React components tested with Jest & React Testing Library


13. Deployment and Maintenance

Deployment

  • Dockerized backend and frontend

  • Hosted on Render or Vercel

  • CI/CD pipeline using GitHub Actions

Maintenance

  • Modular structure supports extension

  • Feature toggles for new functionality

  • Admin panel for user and task monitoring


14. Appendix

Glossary

  • Task: A to-do list item

  • CRUD: Create, Read, Update, Delete

  • JWT: JSON Web Token

Acronyms

AcronymMeaning
APIApplication Programming Interface
UIUser Interface
DBDatabase
JWTJSON Web Token
ORMObject Relational Mapping

Wednesday, July 23, 2025

🛠️ Technical Specification Document

 

📌 Project: Construction Project Management Web Application

📅 Date: July 23, 2025


1. Overview

A web-based construction project management system designed to manage projects by breaking them down into subprojects, mini-projects, and tasks. The system supports team assignments, role definitions, equipment tracking, time and budget management, and communication.


2. Core Features

ModuleDescription
Project HierarchyCreate and manage a hierarchy: Project → Subproject → Mini Project → Task
Team ManagementAssign teams per mini-project; define roles and responsibilities
Role & Responsibility DefinitionDefine duties for Team Lead, Engineers, Operators, Laborers, etc.
Equipment AssignmentAllocate equipment (e.g., excavators, tools, PPE) to team members/tasks
Task AssignmentAssign tasks with due dates, budgeted time, assignees, dependencies
Time TrackingLog daily time per task; compare with estimated time
Budget TrackingTrack time and cost overruns; visualize budget vs actual
Commenting & DiscussionTask-specific communication threads
NotificationsAlerts for task due, time overrun, unassigned resources
Reports & DashboardsSummary views per project, user, team, and equipment

3. Technical Stack

Frontend

  • Framework: React.js

  • State Management: Redux Toolkit (or Context API)

  • Routing: React Router

  • Styling: Tailwind CSS / Styled Components

  • Forms & Validation: Formik + Yup

  • Charts: Recharts or Chart.js

Backend

  • Framework: Spring Boot (Java)

  • Database: MySQL / PostgreSQL

  • API: RESTful APIs

  • Authentication: Spring Security + JWT

  • Task Scheduling: Quartz Scheduler (for reminders/notifications)

DevOps / Hosting

  • Version Control: Git (GitHub)

  • CI/CD: GitHub Actions or Jenkins

  • Hosting: Render.com / AWS / DigitalOcean

  • Containerization (optional): Docker


4. Data Models (Simplified)

Project Structure

Project └── Subproject └── MiniProject └── Task

Key Entities

  • User: id, name, email, role, team_id

  • Team: id, name, project_id

  • Equipment: id, name, type, status, assigned_to

  • Task: id, title, description, mini_project_id, assignee_id, estimated_time, logged_time, due_date, status, priority

  • Comment: id, task_id, user_id, message, timestamp

  • TimeLog: id, task_id, user_id, hours_logged, date


5. User Roles

RoleAccess
AdminManage all data, assign roles, system config
Project ManagerCreate projects, assign teams and tasks
Team LeadAssign duties within the team, report progress
Engineer/OperatorView and update assigned tasks
LaborerLog time and mark task status

6. UI Modules (Frontend Pages)

PageDescription
DashboardSummary of projects, tasks, alerts
Project HierarchyExpandable view of project > subproject > mini-project > tasks
Task Detail PageLike the image you uploaded — full task breakdown, team info, comments
Team ManagementAssign members, define duties
Equipment TrackerAssign tools and monitor usage
ReportsTime, cost, resource utilization, task delays

7. API Design (Sample Endpoints)

MethodEndpointDescription
GET/api/projects/:idGet project with subprojects
POST/api/tasksCreate new task
PUT/api/tasks/:id/assignAssign task to user
POST/api/timelogLog time for task
GET/api/reportsGet summary reports

8. Security

  • Password encryption (BCrypt)

  • JWT-based session management

  • Role-based access control (RBAC)

  • CSRF and CORS protection


9. Performance Considerations

  • Lazy loading for task trees

  • Indexed queries for task and user filters

  • API pagination for logs and comments


10. Scalability

  • Microservice-ready backend (modular design)

  • Database sharding (in future)

  • CDN usage for static assets


11. Integration (Future Phase)

  • Email/SMS notifications (e.g., SendGrid, Twilio)

  • Calendar sync (Google Calendar, iCal)

  • Equipment telemetry (IoT data support)


✅ Deliverables

  • Web-based project management platform (MVP)

  • Admin panel

  • User manual and system documentation

  • Training for client staff


 

Case Study: Implementing Project Management Tool for ApexBuild Construction Inc.

 This example illustrates how a construction company leverages a project management tool to manage projects through subprojects and tasks, assign teams, track time and budgets, and manage equipment.

Company Overview

ApexBuild Construction Inc. is a mid-sized general contracting company specializing in commercial and residential projects. Projects range from single-house builds to multi-story office complexes. The company adopts a digital transformation initiative by integrating a project management tool tailored to their operations.


Project Overview: Midtown Commercial Complex

1. Project Structure

The Midtown Commercial Complex is a large-scale construction project broken down hierarchically:

  • Main Project: Midtown Commercial Complex

    • Subproject A: Foundation and Earthworks

      • Mini Project A1: Excavation

      • Mini Project A2: Foundation Pouring

    • Subproject B: Structural Framework

      • Mini Project B1: Steel Structure Installation

      • Mini Project B2: Concrete Slabs

    • Subproject C: Electrical and Plumbing

      • Mini Project C1: Underground Plumbing

      • Mini Project C2: Electrical Conduits

    • Subproject D: Finishing Works

      • Mini Project D1: Interior Painting

      • Mini Project D2: Flooring

Each Mini Project contains multiple Tasks, which are the smallest work unit.


2. Team Management and Role Assignment

Each Mini Project has a team assigned, selected via the tool’s Team Assignment Module, which includes:

Team for Mini Project A1: Excavation

  • Team Lead: John Reyes – Oversees work progress and coordinates with the project manager.

  • Excavator Operator: Marco Santos – Operates heavy equipment.

  • Site Engineer: Liza Dela Cruz – Ensures specifications and quality standards are met.

  • Laborers (3): Assist in manual tasks, measurement, and on-ground support.

Defined Responsibilities (in the tool):

  • Team Lead: Report daily progress, escalate issues.

  • Operator: Operate machinery according to plan.

  • Engineer: Conduct inspections, submit compliance reports.

  • Laborers: Execute manual excavation, support operator.


3. Equipment Allocation

Through the Equipment Management Feature, the following resources are assigned:

  • Excavator (CAT 320D) – Assigned to Marco Santos

  • Laser Level Tool – Assigned to Liza Dela Cruz

  • Shovels, Picks, Wheelbarrows – Assigned to laborers

  • Safety Equipment (PPE) – Assigned to all team members


4. Task Assignment and Scheduling

Each team is assigned tasks within the mini-project. Example for Mini Project A1 – Excavation:

Task IDTask DescriptionAssigned ToBudgeted TimeDeadlineStatus
T-A1-01Mark excavation areaSite Engineer4 hoursDay 1In Progress
T-A1-02Excavate to depth 1.5mOperator + Laborers24 hoursDay 3Not Started
T-A1-03Check levelsSite Engineer3 hoursDay 3Not Started
T-A1-04Move excavated soilLaborers12 hoursDay 3Not Started

Each task entry in the tool includes:
  • Time Tracking: Each worker logs daily hours on the task.

  • Budgeted Time Comparison: Tool highlights overruns or delays.

  • Dependency Mapping: For example, Task T-A1-02 cannot begin until T-A1-01 is completed.


5. Time and Budget Tracking

Daily Reporting

  • Every team member logs in via the mobile app.

  • Reports time spent per task.

  • Notes issues (e.g., weather delay).

Budget vs. Actual Analysis

  • For Task T-A1-02:

    • Budgeted Time: 24 hours

    • Time Spent After 2 Days: 20 hours

    • Estimated Completion: 28 hours → Overrun alert generated

Tool flags the task and notifies the Project Manager and Team Lead for review and adjustment.


6. Real-Time Dashboard Features

The management tool includes:

  • Gantt Chart View: Shows subprojects and mini-project timelines

  • Daily Activity Feed: Summarizes time spent, status updates

  • Equipment Usage Reports: Tracks usage hours, idle time

  • Personnel Allocation Summary: Who is assigned where

  • Budget Utilization Graphs: Actual vs. Planned time and cost


7. Results and Benefits

After using the project management tool for 6 months:

MetricBefore ToolAfter Tool
Project Completion Timeliness78% on-time            92% on-time
Equipment Idle Time30%                    12%
Task Delay DetectionManual & Late            Real-time
Labor EfficiencyModerate            High due to task clarity
Communication GapsFrequent            Minimal via task-linked chats

Conclusion

By implementing a structured project management system with subprojects, team management, task assignments, and real-time tracking, ApexBuild significantly improved project visibility, team coordination, and efficiency. The granularity of control (from project > subproject > mini project > task) helped isolate problems early and allocate resources effectively.

Thursday, July 17, 2025

🚀 Upgrading My Java Spring Boot + React ToDo App: Day 1 – Email Verification on Sign Up

 Yesterday, I began working on the Email Verification feature for my Java Spring Boot + React ToDo app. At first, I thought it would be a quick and easy task—but it turned out to be more complex and insightful than expected. Behind a simple idea like “email verification” lies a good amount of planning, coding, and debugging.


✅ Project Goals for Email Verification:

  1. Send a verification email after a user signs up.

  2. Prevent login access until the user has verified their email.

  3. Track email verification status in the backend securely.

  4. Expire the verification token after a certain time (default: 24 hours).


🔨 What I’ve Done So Far:

Backend (Spring Boot)

  1. Configured SMTP settings in application.properties to send emails.

  2. Updated pom.xml to include necessary dependencies (Java Mail Sender, etc.).

  3. Created AppConstants.java in the config folder to define token expiration (e.g., 2 minutes for testing).

  4. Modified AuthController.java to:

    • Enhance the signup and login logic

    • Add a new /verify endpoint to process verification links

  5. Extended the User entity to include an emailVerified boolean field.

  6. Created VerificationToken.java in the model layer to represent token info.

  7. Created VerificationTokenRepository.java and updated UserRepository.java.

  8. Implemented EmailService.java for sending out emails.

  9. Updated UserService.java to manage token generation, expiration, and verification flow.

Frontend (React)

  1. Modified signup.js to include email input and send it to the backend.

  2. Enhanced login.js to block users who haven’t verified their email yet.

  3. Planned:

    • A dedicated /verify page that will be opened from the email link and call the backend to confirm the token.

    • A resend verification button in case the user missed or the token expired.

Even though those last two tasks weren’t initially requested, I realized they’re essential for a smoother user experience—so I plan to include them as part of this upgrade.


💡 Key Takeaways

This task may sound simple in theory, but in practice, it required modifying almost every core layer of the app—model, controller, service, config, repository, and even the build files. It was a full-stack challenge that deepened my understanding of secure user registration.

Wednesday, July 16, 2025

Upgrading My Java Spring Boot + React ToDo App: Setting Up for Local Testing

 After organizing my codebase into a dedicated /dev folder to isolate local revisions from production, the next big task was getting the app fully functional for local development and testing. My project had been set up primarily for deployment on Railway, which meant environment variables, CORS configuration, and endpoint access were all geared toward production. So, I had to carefully backtrack and make the necessary changes to restore local development support.


Step 1: Reverting to Local Database and Backend

I ensured my application.properties (or application-dev.properties) pointed to the local MySQL/PostgreSQL instance rather than Railway's cloud database. This included adjusting:

1
2
3
4
spring.datasource.url=jdbc:mysql://localhost:3306/tododb
spring.datasource.username=root
spring.datasource.password=
server.port=8080

Step 2: Fixing CORS for Localhost

Originally, the SecurityConfig was allowing only Railway’s frontend origin (https://optimistic-creativity-production-e88d.up.railway.app). That broke things when I started testing from http://localhost:3000.

To fix that, I updated the CorsConfigurationSource bean like this:

1
2
3
4
config.setAllowedOrigins(List.of(
    "http://localhost:3000",
    "https://optimistic-creativity-production-e88d.up.railway.app"
));

This way, both local development and deployed environments can access the backend APIs.


Step 3: Fixing the Login Flow in React

My Login.js component was originally making two fetch requests: one to /api/auth/login (which is correct), and a second one to /api/todos, which still pointing to the railway server based app.

I cleaned that up by keeping only the necessary login fetch:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
const reslogin = await fetch("http://localhost:8080/api/auth/login", {
  method: "POST",
  headers: {
    Authorization: "Basic " + btoa(`${username}:${password}`),
  },
});

if (reslogin.ok) {
  const data = await reslogin.json();
  setAuth(username, password, data.role);
  navigate("/", { replace: true });
} else {
  setError("Invalid credentials. Please try again.");
}

This eliminated the unnecessary and failing fetch to /api/. I continued same process for the listing/editing/deleting/marking as complete of tasks.


Step 4: Testing with curl Locally

To verify my endpoints independently, I used curl from the command line:

1
2
3
curl -X POST -H "Content-Type: application/json" \
-d "{\"username\":\"user1\",\"password\":\"pass123\"}" \
http://localhost:8080/api/auth/signup

And tested a secure POST to the protected endpoint with:

1
2
3
curl -X POST -u user1:pass123 -H "Content-Type: application/json" \
-d "{\"title\":\"Write blog post\"}" \
http://localhost:8080/api/todos

Everything returned the expected response, confirming the backend was working fine locally.


Final Thoughts

Migrating back from production to local development isn't always as straightforward as flipping a switch—especially when security configurations, CORS policies, and environment-specific properties are involved. But with careful setup, testing, and cleanup, my fullstack Java Spring Boot + React ToDo app is now ready for efficient local testing.

Pentesting My To-Do List App: Automating Workflow Attacks

 As part of improving the security of my To-Do List application (built with Spring Boot, MySQL, and React), I performed a pentest to evaluat...