Tarrek Osama

Port Said local time

Colour theme
Tarrek Osama

Port Said local time

Colour theme

Selected workCircuit 2 · Access

Dawamk ERP

Fast, correct permissions across 38+ modules

My role
Software Engineer
When
AcuteBusiness · 2024 – present
Where it stands
Company product
rulescachedeventstalemodules
cached checks · cleared the moment a rule changes

What I built

The core RBAC access control for a 38+ module SaaS ERP, its caching, dynamic subscription engine, Leaflet geofenced attendance, open-source payment packages (Stripe, PayPal, PayTabs, DigiPay, EdfaPay, Al Inma), and the REST API powering 7 mobile apps.

Why it mattered

With 38+ modules, permissions decide what every user can see and do. They have to be right, and they have to be fast. Customers change plans at any time, so many subscription lifecycles run at once.

Try itCheck what a user can open. The first check is computed and cached, the next comes from cache. Then revoke a permission and watch the cache clear itself.
$ can user:42 open *

Illustration running in your browser. It shows the real system’s approach in simplified form; names and numbers are invented, and nothing here touches the real system.

What made it difficult

  • Right and fast

    Permissions are checked constantly, so a check must be quick without ever being out of date.

  • Stale access

    A cached answer that outlives a permission change means someone keeps access they lost.

  • Many plans at once

    Subscriptions start, renew and end on their own schedules, concurrently.

How I solved it

  1. Permissions, not just roles

    Permission-based access control gives each module fine-grained rules instead of a few broad roles.

  2. Cache hard, invalidate on events

    Permission checks are cached aggressively, and an event clears the cache the moment a permission changes.

  3. Plans that run themselves

    Eloquent accessors and scheduled cron jobs move each subscription through its lifecycle, many at the same time.

  4. One API for mobile

    A complete RESTful API serves 7 mobile apps with real-time push notifications.

What I delivered

Re-architected access control for Dawamk, a 38+ module SaaS ERP at AcuteBusiness.

A dynamic subscription engine for concurrent plan lifecycles, geofenced attendance via Leaflet, and REST APIs behind 7 mobile apps.

Open-sourced Composer payment packages (Stripe, PayPal, PayTabs, DigiPay, EdfaPay, Al Inma Bank Pay) with webhooks and idempotency keys.

Built with

  • Laravel 11
  • PHP 8+
  • MySQL
  • Redis
  • Leaflet
  • Supervisor
  • REST API