- In production
- Professional
- 2026
GPE — Gestión de Prácticas Empresariales
A production system for the full internship lifecycle
Screenshots
Web client
- React 18 + TypeScriptVite + Radix UI
- TanStack QueryServer-state cache
- React Hook Form + ZodValidated forms
- → HTTPS · JSON · JWT
REST API · Express + TS
- 33 módulos verticalesrouter → controller → service
- MiddlewaresAuth, RBAC, uploads, errors
- Esquemas ZodInput validation
- → Prisma Client
Persistence
- Prisma ORM66 models, migrations
- PostgreSQLRelational store
- StorageServiceFiles, swappable backend
Cross-cutting concerns
Documents
- Handlebars + Puppeteer
- 20 plantillas PDF
Scheduled jobs
- node-cron diario
- Recordatorios y alertas
Notifications
- Nodemailer (SMTP)
- En plataforma
Auditing
- AuditLog
- Antes y después
Overview
A platform that digitizes internships at a technical institute: job postings, applications, requirements, occupational insurance, follow-up visits, hour logs, reports, signatures and certificates.
The process ran on paper forms and spreadsheets, with five roles (coordination, management, administration, students and company tutors) who had to approve, return and sign things in order.
- Role
- Sole author: functional analysis, data model, backend, frontend, document generation, deployment and ongoing changes driven by the institute's real business rules.
- Period
- 2026
- Status
- In production
- Code
- Private, described with permission
- Node.js
- TypeScript
- Express
- Prisma
- PostgreSQL
- Zod
- JWT
- React 18
- Vite
- TanStack Query
- React Hook Form
- Radix UI
- Tailwind CSS
- Puppeteer
- Handlebars
- Jest
- Supertest
- Docker
Context
Sysdatec manages internships for its technical students. Each internship goes through posting, application, requirements, start or renewal, occupational-insurance enrollment, visits, hour logs, reports and closing, and every stage produces an institutional form that has to be signed.
Architecture
The backend is organized into 33 vertical feature modules (router, controller, service, repository and Zod schema), with cross-cutting layers for authentication, RBAC, uploads, error handling and auditing. Prisma is the single source of truth for the schema, with versioned migrations.
Technical decisions
- Storage sits behind a StorageService interface, so moving from local disk to S3 or Azure Blob only takes a new implementation.
- Uploaded files never keep the client's filename. The service decides the path, which prevents path traversal, and only PDF, JPG and PNG are accepted.
- Institutional documents are generated from Handlebars templates rendered by Puppeteer.
- A daily node-cron job checks upcoming visits, missing evidence and incomplete insurance, and notifies in-app and by email.
- Rejections require a reason, enforced with Zod
superRefineon every review schema.
Challenges and solutions
- My own RBAC audit turned up three cross-role data leaks, which I fixed in the affected routes and services.
- The rules change with real use: return a record instead of rejecting it, let only management waive insurance, require monthly social security before approving a renewal. Each change went in as a small, traceable commit.
- I bounded the valid date range in hour logging to stop a 500 error that showed up in production.
Quality
- Unit and integration tests with Jest and Supertest.
- Strict type checking in backend and frontend.
- An audit trail for every relevant mutation, with before and after state.
Outcome
The system is in production at gpe.sysdatec.edu.co, with a public portal for companies and students and internal management for all five roles.