NU Result Archive & Notice API

A Secure, Scalable Developer Platform for Bangladesh National University Results and Notices

Project Overview

NU Result Archive & Notice API is an independent web platform designed to provide structured access to Bangladesh National University examination results and official notices through developer-friendly REST APIs.

Built with Next.js App Router, React, Supabase PostgreSQL, and Supabase Authentication, the platform combines result archiving, notice management, API access control, account administration, and secure database operations into a centralized system.

The project focuses on building a reliable backend infrastructure with efficient caching, verified authentication, strict permission boundaries, and transaction-safe data management.

It operates independently and is not an official National University service.

The Engineering Challenge

Educational data platforms must handle several important technical challenges:

Data Accessibility: Providing structured API access to result archives and university notices.
API Security: Preventing unauthorized requests, credential misuse, and quota bypassing.
Database Protection: Restricting direct client access to sensitive tables and privileged operations.
High Request Volume: Reducing repeated database operations through efficient caching.
Account Management: Supporting different user roles with strictly controlled permissions.
Data Consistency: Preventing duplicate records, incomplete updates, and conflicting transactions.
Secure Authentication: Ensuring user account operations are performed only by verified account owners.

The platform addresses these challenges using server-controlled database access, transactional PostgreSQL functions, authentication validation, and purpose-built API security.

Core Features & Technical Implementation

1. Developer-Friendly Results & Notice APIs

The platform provides REST endpoints for retrieving archived examination results and National University notices.

Results API

Retrieve archived results using normalized source URLs.
Submit structured examination results through authenticated API requests.
Automatically update existing records using unique URL-based atomic upserts.
Maintain consistent response structures for existing API consumers.
Cache result responses for faster repeated access.

Notices API

Retrieve available university notices through authenticated requests.
Support automated notice ingestion from authorized sources.
Replace the current notice collection through a single database transaction.
Maintain sequential notice identifiers after successful synchronization.
Roll back incomplete updates to protect data consistency.

The API design maintains compatibility with supported legacy authentication headers while encouraging secure bearer-token usage.

2. Secure API Key Authentication & Request Quotas

A dedicated API key system controls access to result and notice endpoints.

Key features include:

Server-side API key validation.
Account-specific request authorization.
Daily request quota enforcement.
UTC-based daily quota calculations.
Atomic quota updates for concurrent requests.
Protected administrative API key management.
Separate authentication requirements for user accounts and data APIs.

Quota validation is performed before serving cached responses, preventing caching from becoming a method of bypassing request limits.

3. Supabase Authentication & Account Ownership

The platform integrates Supabase Auth with Google sign-in to provide secure account authentication.

Account-management endpoints require verified Supabase access tokens rather than trusting client-supplied user identifiers.

Security measures include:

Verified JWT-based session authentication.
Server-validated account ownership.
Idempotent API key creation for authenticated users.
Protection against unauthorized role assignment.
Separation of user session tokens and developer API keys.
Private, non-cacheable responses for protected account endpoints.

This prevents users from impersonating other accounts through modified request headers or identifiers.

4. Role-Based Access Control & Administrative Security

The platform includes a structured permission system supporting Owner, Admin, and User roles.

Administrative features include:

Protected account listing and pagination.
Search, sorting, and filtering by role and account status.
API key status and expiration management.
Secure account information updates.
Database-enforced administrative authorization.
Restricted role modification privileges.
Protected owner accounts that cannot be demoted or deactivated through the account management API.

Authorization is enforced at both the API and database transaction levels, reducing the risk of privilege escalation.

5. Optimized Data Caching & Performance

The platform uses Next.js Data Cache to reduce repeated database operations and improve API response efficiency.

Caching strategies include:

120-second cache: University notice responses.
900-second cache: Archived result responses, keyed by normalized URLs.
Tag-based invalidation: Relevant cached content is invalidated immediately after successful mutations.
Authorization-first execution: API key permissions and quotas are validated before cached content is accessed.

This design balances response performance, data freshness, and secure API usage.

6. Transaction-Safe Database Architecture

PostgreSQL serves as the central database, with sensitive operations handled through server-controlled functions and transactional procedures.

Important implementations include:

Atomic result upserts based on unique URLs.
Transactional notice synchronization.
Automatic rollback when notice ingestion fails.
Database-enforced role protection.
Concurrency-safe request quota operations.
Duplicate transaction prevention.
Controlled account and API key creation.

Direct database access is restricted for anonymous and ordinary authenticated clients. Privileged database operations execute through a server-only service client.

This approach separates publicly accessible authentication features from sensitive database infrastructure.

7. Secure Redemption & Transaction Processing

The platform includes a protected redemption workflow with account ownership verification and transaction safeguards.

Security features include:

Verified user authentication before redemption.
Account ownership checks before contacting the transaction provider.
Duplicate transaction hash detection.
Prevention of concurrent pending redemption requests.
Preservation of uncertain transactions for manual reconciliation.

These safeguards reduce duplicate processing and help maintain consistent transaction states.

8. SEO-Optimized Public Website

The public-facing website is designed for accessibility, search engine discovery, and fast initial rendering.

Implemented features include:

Statically rendered landing pages and API documentation.
Search engine-friendly page metadata.
Canonical URLs and Open Graph tags.
Twitter social preview metadata.
Structured data using WebSite JSON-LD.
Dynamic robots.txt and sitemap.xml routes.
Bilingual educational content.
Noindex protection for private account and login pages.
Dedicated privacy policy and terms pages.

Public content loads independently of user authentication, improving accessibility and search engine indexing.

9. Responsive Dashboard & Account Management

The platform provides a responsive interface for users and administrators.

Core dashboard capabilities include:

Google-based account sign-in.
Individual API key management.
Account information and access status.
Role-specific administration controls.
Paginated account listing.
Search and filtering options.
Secure account editing.
Expiration and account status management.

The interface uses consistent layouts, status indicators, and accessible modal interactions to simplify administrative operations.

Technology Stack

Frontend: Next.js App Router, React, TypeScript, Responsive UI

Backend: Next.js Route Handlers, Node.js, REST API

Database: Supabase PostgreSQL, SQL, PostgreSQL RPC Functions, Database Transactions

Authentication: Supabase Auth, Google OAuth, JWT Bearer Tokens, API Keys

Security: Role-Based Access Control, Server-Side Authorization, Database Privilege Restrictions, Account Ownership Validation

Performance: Next.js Data Cache, Cache Tag Invalidation, Server-Side Rendering, Static Page Generation

SEO: Canonical Metadata, Open Graph, Twitter Cards, JSON-LD, Sitemap, Robots.txt

Testing: Python Integration Tests, Node.js Verification Scripts, Concurrent Request Testing

Testing & Reliability

The project includes automated tests covering important authorization and database operations.

Verification focuses on:

Database table and function permissions.
Owner and administrator role restrictions.
API key uniqueness.
Concurrent request quota validation.
Daily quota resets.
Transaction rollback during failed notice ingestion.
Redemption transaction safeguards.
Account management authorization and pagination.
Date handling across multiple time zones.

The database security suite includes a 40-concurrent-request quota test to verify consistency under simultaneous API requests.

Engineering Highlights

Secure API Architecture: Verified authentication with separated user and API credentials.
Database-Level Authorization: Sensitive functions restricted to privileged server-side execution.
Efficient API Caching: 120-second notice caching and 900-second result caching.
Concurrency Protection: Atomic quota management and transaction-safe updates.
Data Integrity: Duplicate prevention, atomic upserts, and rollback protection.
Protected Administration: Role-based permissions with strict owner-level safeguards.
Backward Compatibility: Supported legacy API headers and preserved response formats.
SEO-Friendly Frontend: Statically rendered public content with structured metadata.

Project Outcome

NU Result Archive & Notice API demonstrates how a developer-focused educational data platform can combine secure authentication, efficient data access, role-based administration, and reliable database operations within a modern full-stack architecture.

The system provides a structured foundation for accessing archived academic information while prioritizing performance, account security, backward compatibility, and operational reliability.

The project highlights hands-on expertise in Full-Stack Web Development, REST API Engineering, PostgreSQL Database Design, Authentication Systems, Transaction Management, Performance Optimization, and Backend Security.

An Independent Developer Platform for Bangladesh National University Data

Designed and developed with a focus on secure APIs, reliable data management, and scalable architecture.