Architecture
- FastAPI + PostgreSQL backend with 63 REST endpoints, 18 tables and 31 database constraints, so the database itself enforces the rules, not just the app.
- React 19 frontend served by FastAPI from the same domain: one service, no CORS.
KICA Management System
A full-stack platform that runs a chess club of 60+ players: a public website for parents and a secure app for the club's executives.
60+players managed
63API endpoints
200integration tests
21DB migrations
BUILT WITH
PythonFastAPIPostgreSQLReact 19AlembicpytestRenderCloudflare
THE PROBLEM
KICA ran attendance, fees and member records through Excel sheets and WhatsApp messages. Fee balances depended on manual calculation, cash was spread across several volunteers with no running totals, there was no record of who changed what, and new members registered informally. As the club grew past 60 players, this became slow, error-prone and hard to audit.
THE HARD PARTS
Keeping club money correct under concurrent use, designing fee logic that matches how the club actually charges, and securing a public-facing system that holds children's and parents' personal data.
WHAT I BUILT
A full-stack platform with two sides: a public website where parents learn about the club and register new players, and a secure executive app for running the club day to day.
- Executive app: players, attendance sessions, fee collection, expenses, income, transfers between executives, opening balances, fee adjustments, an activity log and Excel exports
- Public site: 4 animated, responsive pages and an online registration form with automatic confirmation emails
- Registration workflow: parents submit online, then executives approve (which creates the player) or reject with a reason
INSIDE THE EXECUTIVE APP
The executive app needs a login, so here's a look inside, using made-up sample data.
UNDER THE HOOD
Data integrity
EXCLUSIVEtable locks prevent race conditions when two executives add players at the same moment. A functional unique index on(lower(name), date_of_birth)blocks duplicate players.- Nothing financial is ever deleted. Entries are reversed with a reason, and every change goes into an audit log with old and new values.
Money logic
- Fees come from attendance, and payments are allocated oldest-first. Every balance is computed live from the records, so totals can never drift out of sync.
- Money is stored as
NUMERIC(10,3)to match the Kuwaiti dinar's 3 decimal places, with no floating-point rounding errors.
Security
- Argon2 password hashing and SHA-256 hashed session tokens in HttpOnly, Secure cookies, with role-based access and admin approval for new accounts.
- Timing-attack-resistant login and rate limiting by IP and email, working correctly behind Render's reverse proxy.
Testing & deployment
- 200 pytest integration tests against a real PostgreSQL database, not mocks, so the actual SQL, constraints and locks are tested.
- Continuous deployment to Render with Cloudflare DNS and HTTPS: every push to
mainruns the Alembic migrations first and goes live only if the health check passes.