Web Full-Stack Technologies

Our Full Stack Capability

KEANT Technologies designs and delivers production-grade web applications across the full technology stack — from database schema and server-side business logic through to responsive, component-driven user interfaces. Our engineering practice spans two proven architectural styles: classic server-side rendered LAMP-stack portals for stable, cost-effective deployments, and modern API-first single-page applications for enterprise-scale, high-interactivity platforms.

PART 1 — SERVER-SIDE RENDERED WEB APPLICATIONS

LAMP Stack Portal Development

Linux · Apache · MySQL · PHP

A server-side rendered, LAMP-stack web application for infrastructure management, operational data consolidation, and field-to-office workflow integration.

1.1 System Context

KEANT Technologies designs and builds web-based operational portals that help infrastructure and utilities organisations consolidate field data, maintenance records, asset health indicators, and compliance documentation into a single operator-accessible system. Built on the proven LAMP stack — Linux, Apache, MySQL, and PHP — our portals deliver stable, cost-effective solutions deployable on-premises or on private cloud infrastructure, meeting the data residency and security requirements typical of regulated industries.

These platforms are well suited for organisations that require:

A single source of truth for asset data, inspection records, and operational history
Role-based access with clear separation between administrative, operational, and reporting functions
Offline-capable field data submission with server-side validation and audit trail
Compliance documentation and report generation without third-party SaaS dependencies
On-premise or private cloud deployment to meet data sovereignty requirements

1.2 Technology Stack

PHP 8.x	Server-side language
MySQL 8.0	Relational database
Linux (Ubuntu)	OS / Server
Apache / Nginx	Web server
HTML5 / CSS3	Frontend markup
jQuery / JS	Client interactivity

1.3 Architectural Layers

Our LAMP-stack portals follow a classic Model-View-Controller (MVC) architecture implemented in PHP, with server-side rendering delivering complete HTML responses to the browser. The layering is as follows:

Layer	Responsibility & Technology
Presentation	HTML5 templates rendered server-side by PHP view scripts. CSS3 with Bootstrap grid for responsive layouts. jQuery and vanilla JavaScript handle client-side form validation, AJAX partial-page refreshes for data grids, and dynamic map overlays for geospatial data visualisation.
Application (PHP)	PHP 8.x MVC controllers handle all business logic: user authentication via session-based tokens, record CRUD operations, job scheduling, alert threshold evaluation, and PDF/CSV report generation using TCPDF and PhpSpreadsheet libraries.
Data Access	PHP PDO (PHP Data Objects) layer with prepared statements for all database interactions, enforcing SQL injection protection. Repository pattern abstracts MySQL queries from business logic, enabling unit testing of controllers without database dependency.
Database (MySQL)	MySQL 8.0 relational schema storing asset registry, operational records, fault logs, maintenance schedules, user accounts, and audit trails. InnoDB engine with foreign key constraints ensures referential integrity. Indexed on primary entity IDs, zone references, and date fields for query performance.
Infrastructure	Ubuntu Linux server (LTS) hosting Apache/Nginx web server and PHP-FPM process manager. Cron jobs scheduled via Linux crontab trigger nightly reminder emails, maintenance window alerts, and database backup jobs using mysqldump to encrypted S3 or NAS storage.

1.4 Key Functional Modules

Asset & Data Registry

Hierarchical asset structure fully navigable in the UI
GIS-lite route/location map rendered via Leaflet.js with MySQL-stored coordinate data
Asset attribute forms with server-side validation and history tracking
Document attachment store (photos, PDFs, reports) served from Linux filesystem via PHP streams

Inspection & Field Data Management

Mobile-friendly inspection forms submitted via AJAX; PHP controller validates and persists to MySQL
Scheduled inspection calendar with overdue alerts generated server-side and emailed via PHPMailer
Inspection history timeline per asset with fault severity classification (Critical / Major / Minor)
Bulk CSV import for migrating legacy records into the platform database

Maintenance & Work Orders

Work order creation from inspection faults with auto-population of asset details and recommended action
Technician assignment, status tracking (Open / In Progress / Closed), and completion sign-off workflow
Maintenance cost tracking with MySQL aggregation queries powering cost-per-asset and cost-per-zone reports
Preventive maintenance schedule generator based on asset age and last inspection date

Reporting & Compliance

Dynamic PDF reports generated server-side with TCPDF — operational summaries, asset health scorecards, zone compliance status
Excel exports via PhpSpreadsheet for audit data hand-off to regulatory bodies
Role-based dashboards: Admin sees all zones; Operator sees assigned zones only — enforced at PHP controller layer
Audit log table in MySQL records every data mutation with user ID, timestamp, and before/after values

1.5 Security & Infrastructure Practices

Area	Implementation
Authentication	PHP session-based login with bcrypt password hashing (password_hash / password_verify). CSRF token on every form POST. Session timeout after 30 minutes of inactivity.
Authorisation	Role and permission table in MySQL. PHP middleware checks role on every controller action before processing. No client-side trust — all access decisions are server-side.
Database Security	PDO prepared statements eliminate SQL injection. MySQL user accounts scoped to minimum required privileges (SELECT/INSERT/UPDATE only; no DROP/GRANT from the application user).
Linux Hardening	SSH key-only access; firewall (ufw) allows only 80/443 and 22 from whitelisted IPs; PHP open_basedir restricts file access to application directory; error_reporting Off in production.
Backup & Recovery	Nightly mysqldump to encrypted archive; 30-day retention. Application files version-controlled in Git; deployment via bash scripts with rollback capability.
Performance	MySQL query cache and indexed foreign keys. PHP opcode caching via OPcache. Static assets (CSS/JS/images) served via Nginx with long-lived cache headers; PHP-FPM for concurrent request handling.

PART 2 — MODERN API-FIRST SINGLE-PAGE APPLICATIONS

Compliance & Audit Management Platform

React · Node.js · JavaScript · MS SQL Server

A modern, API-first, single-page web application for enterprise compliance tracking, audit lifecycle management, and regulatory reporting.

1. Technology Stack

React 18	SPA Frontend
Node.js 20 LTS	API server
JavaScript / TS	Full-stack language
MS SQL Server	Enterprise DB
Express.js	REST framework
Sequelize / Knex	ORM / Query builder

2. Architectural Layers

An API-first architecture. The React SPA communicates exclusively with the Node.js REST API over HTTPS/JSON; the server holds all business logic and is the sole client of MS SQL Server. This separation enables independent scaling, versioned API contracts, and the ability to expose the same API to future mobile clients or third-party integrations.

React SPA	React 18 component tree with React Router v6 for client-side navigation across Compliance Register, Audit Programme, Finding Tracker, and Report Builder modules. Redux Toolkit manages global state (user session, active audit context, notification queue). Axios handles API calls with interceptor-based JWT attachment and 401 auto-refresh. Material UI (MUI) component library provides the design system; custom theme tokens enforce KEANT brand colours.
Node.js API	Express.js REST API organised into route → controller → service → repository layers. JWT (JSON Web Tokens) issued on login and validated on every protected route via middleware. Business logic lives in service modules: compliance rule evaluation, audit scheduling, finding severity scoring, CAPA (Corrective and Preventive Action) workflow state machine, and notification dispatch via Nodemailer / MS Graph API.
Data Access	Sequelize ORM for entity modelling (Users, Audits, Controls, Findings, CAPAs, Reports) with migrations and seeders for schema version control. Raw Knex.js query builder used for complex multi-join reporting queries where ORM abstraction is insufficient. All parameterised — no string-interpolated SQL — protecting against injection. MS SQL Server transactions wrap multi-step compliance state changes to ensure atomicity.
MS SQL Server	SQL Server 2019/2022 hosts the CAM relational schema. Key design choices: temporal tables (system-versioned) for compliance record history and regulatory immutability; row-level security (RLS) policies enforce tenant and role data isolation at the database engine layer; Stored Procedures used for complex audit summary aggregations called by the report service. Full-Text Search enabled on finding descriptions for keyword-based audit search.
Infrastructure	Node.js deployed on Linux (Ubuntu) containers via Docker; orchestrated with Docker Compose (development) or Kubernetes (production). NGINX reverse proxy handles TLS termination, static React build serving, and API upstream routing. MS SQL Server runs on a dedicated Windows Server VM or Azure SQL Managed Instance for enterprise deployments.

3. Key Functional Modules

Compliance Register

Hierarchical control framework: Regulation → Policy → Control Objective → Control Activity — navigable in a React tree view
Control ownership assignment with due-date tracking; overdue controls surface in the dashboard summary widget
Evidence attachment (PDFs, spreadsheets) uploaded via multipart POST to Node.js, stored on filesystem or Azure Blob Storage
Control effectiveness rating (Effective / Partially Effective / Ineffective) with trend chart rendered using Recharts

Audit Programme Management

Audit plan creation with scope, timeline, lead auditor assignment, and department mapping
Audit checklist builder — React drag-and-drop interface persisted to SQL Server via Node.js PATCH endpoints
Audit status lifecycle: Planned → In Progress → Under Review → Closed, with transition guards in Node.js service layer
Calendar view of upcoming audits with iCal export for auditor scheduling integration

Finding & CAPA Tracker

Finding raised during audit with severity (Critical/High/Medium/Low), category, root-cause, and responsible owner
CAPA workflow state machine in Node.js: Finding Raised → CAPA Assigned → Action Taken → Verified → Closed
Automated email reminders via Nodemailer when CAPA due dates approach or are breached
Finding aging report — SQL Server temporal query shows average days-to-close by department and severity

Reporting & Dashboard

Executive dashboard: KPI tiles (open findings, overdue CAPAs, upcoming audits, compliance score) powered by Node.js aggregation endpoints
Dynamic report builder — user selects date range, audit type, and department; Node.js constructs parameterised SQL Server query and returns JSON for React rendering
PDF export of audit reports via Puppeteer (headless Chrome) on the Node.js server — renders React report template server-side
Role-scoped data: Auditors see assigned audits; Compliance Managers see all; Auditees see only their findings — enforced via SQL Server RLS and JWT claims

4. Security, DevOps & Enterprise Integration

Authentication & SSO	JWT-based authentication with 15-minute access tokens and 7-day refresh tokens stored in httpOnly cookies. SAML 2.0 / OAuth 2.0 integration with enterprise identity providers (Azure AD, Okta) for single sign-on in corporate deployments.
Authorisation	RBAC enforced at three layers: React (UI element visibility), Node.js middleware (route-level guard), and SQL Server RLS (row-level data filter). JWT claims carry user role and tenant ID — no client-side role escalation possible.
Data Integrity	SQL Server system-versioned temporal tables retain full history of compliance record mutations. Node.js service writes an immutable audit_log entry (user, action, timestamp, diff) for every state change — queryable by compliance officers.
API Security	Helmet.js sets security HTTP headers. Rate limiting (express-rate-limit) on login and API endpoints. Input validation via Joi schemas on all POST/PUT payloads before reaching business logic. CORS restricted to known frontend origins.
DevOps	CI/CD pipeline (GitHub Actions / Azure DevOps): lint → unit test (Jest) → integration test → Docker build → deploy. Environment-specific config via .env and Azure Key Vault secrets injection. Sequelize migrations run automatically on deploy.
MS SQL Integration	Named instance or Azure SQL Managed Instance. Connection pooling via Sequelize pool (min 2, max 10). Encrypted connection (TLS) enforced. SQL Server Agent jobs handle nightly compliance score recalculation and archived finding purge per retention policy.