Skip to content
Vince.

Work

Case studies

Problems where the off-the-shelf answer was wrong, and what it took to do them properly. Each one links to a repository you can build and test.

Backend

Java services

Streaming, middleware and API security — the work closest to what I do professionally.

  1. 01 · Streaming · Kafka · Quarkus

    Stream processor

    Subscriber usage in real time, on Kafka Streams

    A pipeline that parses raw usage events, de-duplicates redeliveries, aggregates volume per subscriber into event-time windows, raises threshold alerts, and dead-letters anything unusable. The whole topology is tested without a broker.

    • Event-time windowing with an explicit grace period — late data lands in the window it belongs to
    • Suppression until window close, so consumers get one answer per window instead of a stream of partial ones
    • Poison payloads routed to a dead-letter topic rather than killing the stream thread
    • 23 tests drive the real topology through TopologyTestDriver — no broker, no Docker, event time controlled to the millisecond
    • `docker compose up` and one script runs the whole scenario against a real broker
    • Java 21
    • Kafka Streams
    • Quarkus
    • JUnit
    Read the case study23 tests

  2. 02 · Middleware · Camel · Spring Boot

    Integration gateway

    One REST interface over a SOAP backend and a REST one

    A middleware layer that gives callers one interface over two very different provisioning backends, and answers the questions a gateway exists for: what to retry, what to give up on, and what a caller gets back when the far end is down.

    • Retry policy that distinguishes transient from permanent — 5xx and 429 back off, 4xx fails immediately
    • Idempotent by request id, and a duplicate gets an answer rather than being silently dropped
    • SOAP envelopes escaped against XML injection; responses parsed with DTDs disabled against XXE
    • 26 tests against a WireMock backend that can be told to fail twice and then recover
    • A stub profile runs it end to end with no Docker and no external services
    • Java 21
    • Apache Camel
    • Spring Boot
    • WireMock
    Read the case study26 tests

  3. 03 · API security · Spring Security

    Secure API

    Personal data behind authorization that actually checks the record

    A subscriber API carrying personal data, with JWT authentication, object-level authorization, field-level encryption, per-caller rate limiting and an audit trail that records refusals as well as successes.

    • Object-level authorization: a valid token with someone else's record id gets nothing
    • A foreign record and a missing one return byte-identical responses, so refusals cannot confirm which ids exist
    • National IDs encrypted per field with AES-256-GCM, bound to the record so ciphertext cannot be moved between rows
    • 38 tests, including a token bucket driven by an injected clock so nothing sleeps
    • Runs standalone with no database or identity provider, and a script that mints tokens and walks the security behaviour
    • Java 21
    • Spring Security
    • OAuth2 / JWT
    • AES-GCM
    Read the case study38 tests

Products

Booking, menus and inventory

The half of a product worth building carefully — the rules that decide what can be sold and what happens when the answer is no.

  1. 04 · Product · Booking · Pricing

    Resort booking

    Availability that counts units, not overlaps

    The booking half of a resort site: per-night availability across room types, seasonal and length-of-stay pricing, and refusals that name the night that blocked the stay rather than shrugging.

    • Availability is a per-night unit count, so one booking does not close a room type with four units
    • Half-open stays — a guest checking out on the 5th frees the room for one checking in on the 5th
    • Season and weekend multipliers compound; tax applies after the discount, not before
    • Every amount is an integer number of centavos, so the total always equals the sum of its parts
    • TypeScript
    • React
    • Vitest
    Read the case studyOpen the demo33 tests

  2. 05 · Product · Reservations · Menu

    Coffee shop

    Reservations that know a table is busy for ninety minutes

    Table reservations with turn times and table combining, plus a menu whose modifiers actually affect the price. Slots are offered only when a real table can seat the party for as long as it will be sitting there.

    • Turn time scales with party size, so a booking blocks the slots it spills into
    • Smallest table that fits, and combining only when nothing single will do
    • Unavailable slots are shown with a reason rather than hidden, so a busy service does not look like a closed one
    • Menu modifiers fold into the unit price before quantity, so two large lattes cost twice the large price
    • TypeScript
    • React
    • Vitest
    Read the case studyOpen the demo31 tests

  3. 06 · Product · Inventory · Billing

    Sari-sari store

    Stock as a ledger, so a wrong count can be explained

    Inventory, costing and billing for a neighbourhood shop. Quantities are derived from stock movements rather than stored, costs are weighted-average, and receipts extract VAT from prices that already include it.

    • Movements are the record; the quantity is a fold over them, so every count can be traced
    • Weighted-average costing, re-averaged on each delivery and captured at the moment of sale
    • Stock cannot go negative — the bug that silently destroys stock value, margin and the reorder report
    • VAT extracted from tax-inclusive prices, with net plus VAT exactly equal to the total
    • TypeScript
    • React
    • Vitest
    Read the case studyOpen the demo33 tests

  4. 07 · Product · Identity · Consent

    CRM

    Knowing that three records are one person

    One CRM across the resort, the coffee shop and the store. Scored identity resolution rather than a customer table, segments derived from transactions rather than tags, and consent that has to be proved before anybody can be contacted.

    • Matching returns a score and a reason, and only a shared phone or email can clear the automatic threshold
    • Two people who share a name are flagged for review and never merged automatically
    • Segments are recomputed from transactions, so nobody's opinion of a customer can go stale
    • Consent defaults to no and is stored as events, so a withdrawal can be evidenced rather than asserted
    • TypeScript
    • React
    • Vitest
    Read the case studyOpen the demo55 tests

Lab

Browser audio

Real-time problems taken apart in the browser, where you can hear the result.

  1. 08 · Web Audio · DSP

    Tuner

    Real-time pitch detection from the microphone

    A chromatic instrument tuner that listens through the microphone and reports the note and its deviation in cents. The pitch detection is a from-scratch implementation of the YIN algorithm — no library — and it is accurate to under a cent on synthetic signals.

    • YIN autocorrelation with cumulative mean normalisation, implemented from the 2002 paper
    • Parabolic interpolation recovers sub-sample periods: 4 cents of rounding error becomes under 0.5
    • Correctly tracks a fundamental that is quieter than its harmonics, and one that is missing entirely
    • 33 unit tests drive the detector with synthetic tones in Node — no browser, no microphone, no flake
    • Web Audio API
    • TypeScript
    • Canvas
    Read the case studyOpen the demo

  2. 09 · Web Audio · Timing

    Sequencer

    Sample-accurate drum machine with synthesised voices

    A step sequencer whose timing does not drift, does not stutter under load, and does not fall apart in a background tab. Every drum sound is synthesised from oscillators and shaped noise, so the whole instrument ships as zero bytes of audio assets.

    • Two-clock scheduling: a coarse timer schedules ahead, the audio clock places the notes
    • Verified drift-free over 200 deliberately irregular polling intervals, to nine decimal places
    • Swing shifts reported times without touching the underlying grid, so it cannot accumulate error
    • Kick, snare, hats, clap and toms synthesised from oscillators and filtered noise — no samples
    • Web Audio API
    • TypeScript
    • React
    Read the case studyOpen the demo

  3. 10 · Search · Music theory

    Fretboard

    Chord shapes derived, not tabulated

    An interactive fretboard that finds playable fingerings for any chord in any tuning by searching the neck under physical constraints. It ships no chord dictionary, which is why it works in tunings nobody has tabulated.

    • Constraint search over hand positions, pruned by which chord tones remain reachable
    • Independently derives the shapes guitarists actually use: x32010, 133211, x02210
    • Works unchanged in DADGAD, open G, and on a reentrant-tuned ukulele
    • Chord recognition in the other direction: an unordered set of notes back to a name
    • TypeScript
    • SVG
    • Web Audio
    Read the case studyOpen the demo