Be Educated

• Built solo, from the database schema to the admin dashboards.
• Payments can't get lost: the Cashfree webhook activates the enrollment even if the student never makes it back to the site.
• Access control lives in the database (Supabase row-level security), not just in the UI.
• Came back later to harden it: webhook signature checks, server-side exam timing, idempotent payment verification, rate limits on payments, plus unit tests and CI.

Be Educated is a coaching institute for JEE/NEET and foundation classes. I built their whole system: the public site, student enrollment, batches, course content, fee collection with installments and coupons, an online exam engine, announcements, and automatic fee reminders. There are five kinds of users (admin, student, parent, teacher, batch manager) and each one gets its own dashboard and only sees their own data.

The institute was managing fees, batches, tests and parent updates with spreadsheets and manual work, and none of it was connected.

Express + TypeScript backend, split into one module per area (fees, exams, content, and so on), on Supabase Postgres. Clerk handles login, and a webhook keeps Clerk users in sync with the database. Instead of trusting the frontend I put row-level security policies in Postgres, so even a buggy route can't leak another student's data. Payments go through Cashfree, and enrollment only activates from the verified webhook.

• Clerk webhooks (svix-signed) create, update and delete users in Supabase. An attachUser middleware also creates the row if the webhook is late, so the first login never breaks.
• Cashfree PAYMENT_SUCCESS_WEBHOOK goes through enrollmentService.verifyPayment(), so the enrollment gets activated even if the browser never returns to return_url.
• Exam grading happens in SQL (grade_mcq_response): single/multiple choice, true/false, and numerical answers with a tolerance. Ranked results are upserted.
• A timer on the server auto-submits expired attempts every 2 minutes, so closing the tab doesn't stop the clock.
• node-cron runs fee reminders daily at 21:00 IST. They escalate from due-in-7-days to overdue, and a reminder_log table makes sure nobody gets the same reminder twice.
• Content files are served through signed URLs, and the admin API is split into sub-routers per area (fees, students, parents, teachers…).