LSOE CRM

A consultancy team worked leads across spreadsheets that were mailed around, so two counsellors regularly called the same student and nobody could tell which version of a record was current. Leads also arrived in bulk from partners as CSV and XLSX exports, full of duplicates.

The system had to give each tier of staff a different slice of the same data, keep everyone's view live, and absorb messy imports without creating a second copy of every student.

React with Redux Toolkit on the client, Node.js and Express over MongoDB behind it, Socket.IO carrying record-level events. Permissions are resolved server-side per request; the client only decides what to draw. Files and mail go through AWS S3 and SES, and the app is served through Nginx with PM2 keeping the processes up.

Client

React with Redux Toolkit; the UI renders what the server says the role may see.

API

Express middleware resolving per-route permissions from the user's tier.

Real time

Socket.IO rooms per record, broadcasting updates and edit presence.

Import

CSV and XLSX parsing with deduplication before anything is written.

Operations

AWS S3 and SES, Nginx, PM2.

1. 01

   Permissions on the server, never in the client

   Each of the five tiers has its own view of a student record. The API decides what a request may read and write, and the client is treated as untrusted display. Hiding a button is never the control.

   Trade-off More endpoints and more test cases; the client sometimes asks twice to know what it can render.

2. 02

   Socket.IO rooms per record, not a global channel

   Counsellors joining a student record enter a room and receive only that record's events, with presence so they can see who else is in it. A single broadcast channel would have flooded every client as the team grew.

   Trade-off Room lifecycle and reconnection handling became real work, especially on flaky connections.

3. 03

   Deduplicate at import, not afterwards

   Partner exports overlap heavily. Imports are matched against existing records on the way in and merged rather than appended, so nobody has to clean up duplicates later.

   Trade-off Import runs slower, and the matching rules need agreement with the business before they can be trusted.

5

Role tiers on one dataset

2

Bulk formats ingested (CSV, XLSX)

0

Spreadsheets left in the workflow