OW
cd ..~/projects/uniattend

case study 02 / Mobile & identity

UniAttend

An ongoing university attendance platform with a React Native student application and web and backend services maintained by a four-person team.

inspect source
status
In progress
ownership
Team of 4
stages
06
stack
07
  • React Native
  • Expo
  • TypeScript
  • Keycloak
  • OpenID Connect
  • PostgreSQL
  • GitHub Actions

Project overview

01

the problem

University attendance needs a student workflow that can preserve identity sessions securely while coordinating several verification steps.

02

my contribution

Established the Expo mobile foundation and delivered the merged Keycloak login, PKCE session lifecycle, secure token storage, logout, authenticated routing, profile workflow, mobile tests, and CI foundation.

03

key decision

Use OpenID Connect Authorization Code Flow with PKCE and device secure storage, restoring or refreshing sessions before allowing access to student routes.

visual evidence pending

No repository screenshot is published for this project. A real application capture should replace this clearly marked placeholder.

04 / how it works

System flow

implemented — verified against source6

  1. Merged mobile foundation with shared UI, typed feature services, and Expo Router navigation.

  2. Merged Keycloak realm bootstrap plus OpenID Connect login using Authorization Code Flow with PKCE.

  3. Merged secure token persistence, expiry margin, session restoration, token refresh, local/Keycloak logout, and failure states.

  4. Merged authentication-based student route protection and a tested student profile workflow.

  5. Established Jest, React Native Testing Library, and GitHub Actions checks for types, lint, and mobile tests.

  6. Active feature-branch work adds Keycloak token validation, user mapping, profile endpoints, and geofence validation; it is not presented as merged functionality.

What is implemented and what is not

known limitations3

  • This is an ongoing team project, not a finished production attendance system.

  • The student-role-specific guard is present on an unmerged branch; main currently checks authentication rather than the Keycloak student role.

  • Face verification, geofence UI, QR, notification, lecturer, and administrator features are team-owned and are not attributed here.

hardest part

Coordinating browser-based identity redirects with native app routing, token expiry, restoration, refresh, cancellation, and local logout states.

what I learned

Authentication is a state machine, not a login screen; recovery paths and route boundaries deserve first-class design and tests.