Balcão de Atendimento
liveScheduling & auditable service records
Full-stack platform that schedules ~110 schools into 200 in-person slots and turns every session into tamper-evident proof for federal oversight bodies. Built and shipped solo.
- Next.js
- TypeScript
- PostgreSQL
- Drizzle ORM
- Tailwind
- Docker
● Public repo is a demo build with fictional data — the production instance is internal.
// the case
- problem
- Schools told oversight bodies they were never trained on how to account for federal funds; the department said it did train them. Neither side could prove it.
- solution
- Every session becomes an immutable record with an author and a timestamp — corrections are appended as signed addenda, never overwrites. Schools book through a passwordless signed-token link; coordination and analysts get their own roles.
- impact
- In production. The rules that matter live in the database, not just the app: partial unique indexes make a double-booked slot impossible. Shipped onto a shared corporate database behind a reverse proxy I didn't control.
// my role
Sole developer — from requirements gathering and data modelling through to production deployment, including working with the department's database and infrastructure teams.
// overview
Three roles share one system. Coordination runs the drive; analysts work the desk day to day; schools book through their own link — no password, because the signed token in the URL already identifies them. A single screen covers booking, tracking, rescheduling, cancelling and downloading the session report.
The work went end to end: data modelling, business rules, the public portal, server-side PDF generation for the attendance slip and the session report, and the deployment itself — onto a shared corporate database, behind a reverse proxy, on infrastructure I had no control over.
// engineering notes
Integrity as evidence
The rules that matter live in the database, not only in the application: partial unique indexes make a double-booked slot — or one school holding two active bookings — impossible rather than merely unlikely. A completed record is immutable; a correction is an addendum signed with its author and date.
Public access without passwords
A school's link is an HMAC carrying its own validity window and purpose. No account to create, no password to lose — and no way to enumerate schools by name or CNPJ.
Shipping into infrastructure I didn't control
The app reads its database from a single variable and resolves the schema through search_path; it runs under a basePath when served from a subpath; and it handles LATIN1 databases by converting the typographic punctuation the encoding would reject. Every one of those decisions only surfaced at deploy time, behind a corporate reverse proxy.
Documentation as part of the delivery
Stack, user flow, business rules and the database diagram are versioned alongside the code — so the next person to touch it doesn't have to reverse-engineer the reasoning.