Modernizing the legacy portal
Ported the four role-based experiences from WebForms and Kendo UI onto Next.js, React,
TypeScript, Material UI, and Redux Toolkit, backed by an ASP.NET Core Web API. Each
feature was traced through the old application first, then rebuilt against the same
stored procedures, so the new screens returned the same data as the ones they
replaced. I worked to a repeatable sequence: discover the existing behavior, trace it
through the stack, validate it against the database, map it to the new architecture,
then implement.
Removing legacy technical debt
The codebase carried parallel SOAP and REST stacks, LINQ-to-SQL data contexts, dead
code paths, and undocumented mismatches between stored procedures and the code calling
them. I audited repositories against sys.parameters and the actual result
set columns before merging. One example: the original
EnrollmentFormRepository had every stored procedure parameter name wrong,
including @ProspectEvalID against an actual @ProspectEvaluationID
and missing output parameters. That was caught and fixed before it reached production.
Testing and quality
The greenfield backend started with no test scaffolding and the legacy code had
effectively no coverage. I built out a test layer of 1,678 unit tests across 57 files
covering the repository, service, and controller layers. Tests were drafted with AI
assistance and then audited by hand for assertion validity, mock fidelity, and
security-relevant edge cases. Twenty-three of the twenty-eight submittable forms were
verified end to end through the interface, the API, and the database.
Security
A 2022 penetration test and the production logs had documented real attack vectors
against the legacy portal, mostly file-upload abuse and injection patterns. The rebuild
routes every upload endpoint through a shared validation step: filename sanitization,
a 10 MB size cap, and an extension allowlist limited to PDF, DOC, DOCX, JPG, PNG, and
TXT. Stored procedure calls use parameter binding rather than string concatenation.
None of the vulnerabilities in the earlier pentest scope were reintroduced.
Engineering workflow
Delivering across four portals and a shared backend creates constant context switching.
I built reusable development workflows for codebase analysis, stored procedure
auditing, feature implementation, and test generation, implemented with Claude Code,
and ran paired front-end and back-end checkouts so separate pieces of work could
progress without colliding. A two-week sprint plan tracked delivery state. Output that
came out of those workflows was reviewed and tested like any other change before merge.