Web Profile Lab MMT Polinema

Case Study

Problem

The Multimedia and Mobile Technology Laboratory (Lab MMT) at State Polytechnic of Malang needed an official digital platform to showcase academic research, student portfolios, interactive 3D assets, and news publications, backed by a Content Management System (CMS) for lab administrators. Off-the-shelf heavy PHP frameworks often carried unnecessary overhead for constrained campus server environments. Furthermore, the laboratory data domain required complex relational handling: project-to-member associations, organizational structure hierarchies, multi-tier categorized media, 3D model asset distribution, and granular Role-Based Access Control (RBAC) across administrative roles.

My role

This project was built as a capstone final project for Semester 3. I acted as the Lead Backend Engineer, designing and building the entire backend system, database architecture, and REST API documentation from scratch:

• Custom PHP 8 Native MVC Architecture (No Framework): Designed and developed an extensible native MVC framework without relying on Laravel or CodeIgniter, writing the core dynamic regex Router, extensible Middleware Pipeline (CORS, JWT Auth, Role Guard), and Request/Response lifecycle handlers.
• 3-Tier Design Pattern (Controller – Service – Repository): Decoupled business logic from persistence using the Repository Pattern with pure PDO prepared statements to ensure full protection against SQL Injection.
• Stateless JWT Authentication & Granular RBAC: Implemented Firebase JWT (firebase/php-jwt) token verification over HTTP Bearer headers, enforcing access rules through roles, permissions, and role_permissions relational database matrices.
• Static Media & 3D Model Asset Streaming: Built secure file upload endpoints for public media and 3D WebGL assets (GLTF/GLB files), complete with web-server-level bypass routing to allow zero-overhead, high-throughput binary asset streaming.
• Automated Database Migration & API Documentation: Authored SQL schema migration scripts (php scripts/migrate.php) and published structured Postman API collections to ensure seamless integration with the frontend team.

System architecture

The backend prioritizes lean resource usage, security, and portability:

• Proprietary Micro-Kernel:
  • Router: Supports nested group routing ($router->group('/api/v1', ...)), dynamic URL parameter extraction ({id}), and per-route middleware binding.
  • MiddlewarePipeline: Sequentially executes request verification stages (CorsMiddleware $\to$ AuthMiddleware $\to$ RoleMiddleware).
  • ErrorHandler: Intercepts PHP runtime exceptions and errors, standardizing outputs into consistent JSON formats via ResponseFormatter.
• Persistence Layer (MySQL via PDO): Every database operation resides in dedicated repositories with strict parameter binding and transaction handling.
• Direct 3D Asset Streaming Bypass: Incoming requests to /uploads/, /3D/, /carousel/, and /struktur/ are served directly by the server before booting the PHP application runtime, eliminating RAM overhead during client-side WebGL rendering.

Key endpoints

A selected overview of critical endpoints across the 20+ supported resources:

Technical challenges

1. Implementing dynamic routing and dependency injection without a framework. Without a framework kernel, resolving variable path patterns like /api/v1/users/{id} required custom parsing. The custom router compiles path tokens into regex capture groups, matches incoming HTTP verbs, maps extracted URI parameters into the Request abstraction, and instantiates controllers using PHP class reflection.

2. Handling high-throughput 3D model distribution. Showcase assets for laboratory projects include heavy 3D mesh files. We built Media3DAssetService to validate binary file headers, sanitize filenames to prevent path traversal exploits, and segregate static storage roots so HTTP reverse proxies can serve large binary files directly without triggering PHP memory allocations.

3. Hierarchical authorization and token validation. Incoming JWT tokens are decoded against expiration timestamps (exp), issued timestamps (iat), and cryptographically verified using server-side HMAC secrets. RoleMiddleware dynamically evaluates whether the caller’s role matches the required permission matrix for the target endpoint before allowing execution.

4. Relational integrity and query optimization. The system manages complex many-to-many associations among projects, members, tags, and categories. Queries in the repository layer leverage parameterized SQL joins to avoid N+1 query patterns, returning compact normalized payloads to frontend consumers.

Future improvements

• Implement a lightweight query builder to reduce repetitive boilerplate SQL syntax across repositories.
• Add automated unit and integration tests for custom router and middleware components using PHPUnit.
• Introduce token- and IP-based rate limiting to harden authentication routes against brute-force attacks.