LOCAL ENGINEERING CASE / 01

College Materials Archive

Keeping ownership, versions and review decisions consistent across file search, downloads and exports.

Vue 3Spring BootAuthorizationFile lifecycle

Source review: 2026.10.13
Public material: Case analysis & synthetic sketch
Validation scope: Source review; no integration rerun

01 / PROBLEM & DESIGN

A file is more than an attachment

Teaching materials belong to both an individual uploader and a college. Uploading a file with the same name should preserve its version relationship. Reviewers need pending materials and rejection reasons, while every route to a file needs the same access boundary.

Stage	Implementation observed in source
Upload	Per-file progress; server checks empty input, size, extension and category permissions.
Versions	Active same-name files from the same uploader increment their version number and link to the previous version.
Access	Teachers view their own files; administrators and super administrators query files within their college.
Review	Management roles approve or reject. Rejection requires a reason; reviewer and time are recorded.
Export & audit	Lists, CSV and print reuse the query scope. Upload, review, download, export, preview and logical deletion write operation logs.

02 / ENGINEERING DECISIONS

Three boundaries to keep explicit

Authorization lives on the server

Hiding a button improves the interface but does not protect the resource. Download, review and export endpoints must verify ownership and college scope independently.

A version is not a review state

Version history expresses content evolution; review state expresses whether the current material meets requirements. They require separate fields and transitions.

Database and disk can diverge

The implementation removes a newly written file if metadata insertion fails. Interruptions, logging failures and orphan-file cleanup still need explicit recovery strategies.

03 / SYNTHETIC POLICY SKETCH

Ownership and college scope

Synthetic resources and simplified client-side policy. This is not the original system or an application screenshot.

File	Owner	Version	Review state

The sample needs JavaScript. The source case remains readable below.

Read the engineering note →Inspect the synthetic policy →

04 / EVIDENCE & NEXT STEPS

What the case demonstrates

Evidence and limits

The case was prepared from local implementation and interface source on 13 October 2026. The archive system was not started and integration tests were not rerun during this portfolio update. No verified business screenshot was available.

Concurrent version increments need further tests. Extension validation does not scan malicious files, and persistent logs are not tamper-proof audit records. Office previews, resumable uploads and external scanning require separate integration.

A testable research extension

For a fixed role and resource, do query, download, review and export agree on authorization? The next step is a role × college × file-state test matrix with explicit unauthorized counterexamples.

Public material contains engineering analysis and a synthetic sketch. Original configuration, databases, attachments, user records and full application source are excluded.

Next case: counselor release verification →Return to projects →