The Fédération de Wushu et Disciplines Associées brings together France's kung-fu wushu clubs (external arts, internal arts and energy arts) across 22 regional leagues covering mainland France, Corsica and the overseas territories. Affiliations and licences were still handled through paper trails and scattered tools. The brief: design and deliver, from scratch, the single platform where clubs, practitioners and federal administrators manage an entire season, from an affiliation request to a verifiable official document. The project was run solo, end to end, in roughly six weeks: a 1,300-line functional and technical specification written before the first line of code (34 sections, two documented architecture decisions, a compliance matrix mapping every requirement in the client brief), an 821-line hand-written design system with no UI framework, a TypeScript monorepo of about 21,500 lines bringing together React 19, Express and a shared contracts package, then the infrastructure, client acceptance and the production release.
The principle that structures the whole back office: every case carries three statuses that stay strictly independent and are never merged, one for the administrative review, one for payment, one for document validation. A paid case is not an approved case. On submission, the case freezes its price and a snapshot of the licensee's data, so official documents are always generated from what was actually approved, even if the profile changes later. Affiliation and licence numbers are issued by strictly increasing atomic counters, and every licence or certificate comes out as a signed, numbered and versioned PDF carrying a SHA-256 fingerprint and a QR code pointing to a public page that confirms its validity without exposing any personal data.
On security: opaque sessions of which only the digest is stored, an HttpOnly cookie, temporary lockout after failed sign-ins, anti-CSRF origin checks on every mutation, rate limiting, Helmet headers, private files served exclusively by the API from sanitised-key storage. The production configuration itself refuses to boot if Stripe, SMTP, HTTPS or the presidential signature are missing. On GDPR: a configurable daily purge, profile anonymisation beyond the retention period, self-service data export, an explicit refusal to erase while a legal accounting obligation still runs, and deliberate minimisation, with no health questionnaire ever passed on to the federation. All of it is covered by 57 Vitest cases, 11 Playwright e2e journeys run on two profiles (desktop and iPhone) and a bespoke visual-regression pipeline, then operated on an OVH VPS through a six-service Docker Compose setup, with atomic ZIP backups whose restore path is rehearsed, scheduled maintenance driven by systemd timers and a fully commented Nginx TLS reverse proxy. Delivered with three illustrated PDF user guides, a video administration guide and the full operations documentation.