iTrust2

Project context

iTrust2 was a semester-long team project at NC State, developed by eight students. I contributed 27 of 344 commits, focusing on both core features and collaborative design. The codebase is private, as it is graded coursework.

The system

iTrust2 closely models a real hospital information system. Patients schedule appointments; providers document visits, prescribe medications, and record diagnoses with ICD codes; administrators manage hospitals, drugs, and code registries. All actions are audit-logged to ensure traceability and security.

Java source files

144

REST controllers

17

Persisted entities

21

User roles

9

Authorization

A central challenge was implementing granular authorization for nine distinct roles: patient, provider, administrator, emergency responder, lab technician, optometrist, ophthalmologist, virologist, and vaccinator. Roles are non-hierarchical, with permissions tailored to specific workflows (for example, emergency responders access records without appointments, and vaccinators document vaccinations but cannot prescribe). Authorization was enforced at the method level with Spring Security's @PreAuthorize.

COVID-19 vaccination features

Our team added end-to-end vaccination management, requiring changes across the schema and permission model. Key contributions included:

• Vaccine records: tracked multi-dose regimens and intervals.
• Vaccinator role: scoped access for vaccination documentation.
• Vaccination appointment flow: separate logic from standard appointments.
• Vaccination visits: recorded doses and updated patient status.
• Vaccination certificates: generated downloadable PDF proof of course completion.

Our team's process

We ran two-week sprints in Jira, branching per use case. Each feature began with a written workflow (main use case, preconditions, flows, alternates), followed by acceptance tests derived from requirements. This requirements-first approach highlighted alternate paths and potential defects early.

Testing & quality

Integration tests were implemented per controller using MockMvc and a real database. JaCoCo ensured code coverage; Checkstyle enforced standards. This practical test structure directly influenced similar approaches I later led at Deutsche Bank.

Reflections & lessons learned

With experience, I recognize areas for improvement: mandatory authorization annotations, automated tests to catch missing permissions, and more robust data validation practices. These insights now inform how I approach security and reliability in larger production systems.