Case study · Web Application
ResolveOps
ResolveOps is a lightweight IT service and incident-management platform. The AWS-deployed application uses Cognito, Spring Boot, and PostgreSQL. The public Interactive Demo is a separate read-only Angular surface with local fixture data so recruiters can explore without accounts.
Product
AWS
Project snapshot
At a glance
- Role
- Full-Stack Developer
- Project type
- ITSM / incident management
- Frontend
- Angular 22 · TypeScript
- Backend
- Java 21 · Spring Boot · PostgreSQL 17 · pgvector
- Cloud
- CloudFront · Cognito · ECS Fargate · RDS · private S3
- Testing
- Angular unit tests · Playwright / axe smoke · responsive QA
- Architecture
- Cognito proves identity; PostgreSQL system_role is authoritative for RBAC. Public demo never calls protected APIs.
- Status
- Live demo + deployed V1
Public surface
/demo
No sign-in · sample data · read-only
Default role
Technician
Richest core workflow for recruiters
Live AI
Off
Fixture sample shown; Bedrock disabled
Problem
Small technical teams need real tickets, assets, SLAs, and audit without jumping to enterprise ITSM—and AI must stay advisory, not become the workflow engine.
Approach
I built an Angular SPA and a Spring Boot modular monolith on PostgreSQL. Cognito handles identity with Authorization Code + PKCE. Authorization lives in PostgreSQL system_role. For portfolio visitors, a public /demo surface reuses the product UI with local fixtures so exploration never requires Cognito or protected APIs.
How it works
Authenticated traffic hits CloudFront → Cognito-protected SPA → Spring on ECS → RDS. Ticket mutations use expectedVersion with JPA @Version (409 on conflict). SLA clocks are server state. AI triage and similarity search are human-reviewed. The Interactive Demo loads the same SPA routes under /demo with DemoModeService fixtures—no Spring calls, no Bedrock.
- Angular SPA (CloudFront)
- Cognito PKCE (production only)
- Spring Boot on ECS Fargate
- PostgreSQL RBAC + SLA + audit
- pgvector similarity (Bedrock disabled live)
- Public /demo fixtures (no auth)
Engineering decisions
Public demo isolated from production auth
For portfolio visitors, ResolveOps provides a read-only interactive demo using local fixture data. It never calls protected production APIs and does not weaken the Cognito → Spring Security → PostgreSQL authorization path used by the deployed application.
Identity in Cognito; authorization in PostgreSQL
Cognito proves who signed in. PostgreSQL system_role answers what they may do. Frontend guards are UX only.
AI is advisory
Triage suggestions and similarity search require human ACCEPT / MODIFY / REJECT. The live environment has Bedrock disabled; the Interactive Demo shows sample AI output labeled as demo-only.
Optimistic concurrency on writes
expectedVersion plus JPA @Version returns 409 instead of last-write-wins on tickets, assets, incidents, and knowledge.
Verification
Built, not mocked.
What was deployed, executed, or observed.
Deployed
ResolveOps V1 is deployed on AWS with CloudFront, Cognito, ECS Fargate, RDS PostgreSQL, and private S3. The public Interactive Demo is published on the same CloudFront origin at /demo.
Secure
Production routes stay behind Cognito → Spring Security → PostgreSQL RBAC. The Interactive Demo uses local fixtures only and does not call protected /api/v1 endpoints or weaken production auth.
Tested
Angular suites cover demo isolation, role projections, and API-safety regressions. Responsive and automated accessibility checks cover representative production and demo surfaces.
Accessible
Validated with automated accessibility checks plus keyboard, responsive, and cross-browser QA; a complete manual WCAG audit was not performed.
Integrated
Ticket lifecycle, assets, SLA clocks, audit/history separation, and human-reviewed AI triage architecture are implemented in the modular monolith.
Known limits
- Bedrock providers are implemented but disabled in the live AWS environment.
- The Interactive Demo shows fixture-backed sample AI output and does not invoke a live model.
- A complete manual WCAG audit was not performed.
Current state
Recruiters can open the Interactive Demo without an account, switch Employee / Technician / Administrator previews, and inspect INC-1042 end to end. Production /dashboard, /tickets, and /admin remain authentication-required.
Implemented
- ✓ Ticket lifecycle with optimistic concurrency
- ✓ Asset context and requester-safe projections
- ✓ SLA engine with policy snapshots
- ✓ Audit / history separation
- ✓ Human-reviewed AI triage architecture
- ✓ Incident intelligence candidates (human promotion)
- ✓ AWS CDK topology (CloudFront, Cognito, ECS, RDS, S3)
- ✓ Public Interactive Demo at /demo
Demo / seeded
- △ Anonymous Interactive Demo with Technician default, Employee and Administrator previews, and fixture AI review
What I learned
Separating a fixture-backed public demo from Cognito production auth is an engineering decision: visitors get a real workflow tour without weakening the authorization path.
Next
- 01Optional lightweight guided tour only if user testing shows the UI alone is not enough
- 02Enable Bedrock models in a controlled environment when ready—without changing the human-review contract