Dev Log: June 15 Wrap-up

Overview

Today was one of those days where I felt like a bridge builder. I spent a good chunk of time porting a security mechanism between two different backends (Java and Python) and then switched gears to some much-needed cleanup on my professional portfolio and clinical dashboard work.

What I Worked On

Hardening the Auth Flow

I finally got around to upgrading the password encryption for the ecommerce-backend. We were using the legacy PKCS1v15 padding for RSA, which is... fine, but it’s susceptible to certain types of attacks (like Bleichenbacher). I decided to move everything over to OAEP-SHA-256.

I implemented an ephemeral key mechanism where the server generates a 2048-bit RSA key pair on startup and serves the public key via a new endpoint. Now, the client fetches that PEM key, encrypts the password, and sends it over. It was a bit of a puzzle getting the Java side and the Python side to play nice with the same padding scheme, but I eventually got the OAEP/MGF1/SHA-256 configuration synced up across both.

// Sanitized example of the public key endpoint logic
@GetMapping("/public-key")
public ResponseEntity<Map<String, String>> getPublicKey() {
    // Wrap the encoded key in standard PEM headers
    String pem = "-----BEGIN PUBLIC KEY-----\n"
            + Base64.getMimeEncoder(64, new byte[]{'\n'}).encodeToString(rsaPublicKey.getEncoded())
            + "\n-----END PUBLIC KEY-----\n";
    return ResponseEntity.ok(Map.of("publicKey", pem));
}

I also had to bump the Java version to 17 and pin Lombok to get the annotation processors working correctly with Maven. Getting all 13 auth tests to green-light on the new padding scheme felt like a solid win.

Portfolio Reality Check

I realized my portfolio was still screaming "React / Next.js Developer," which isn't quite accurate anymore given my current focus. Most of my day-to-day at KareXpert involves building complex clinical dashboards in Angular. I spent some time updating my PortfolioMain to reflect that shift—swapping out the tech stack descriptions and updating my skills breakdown to highlight RxJS and NgRx over the React hooks I used to live in.

Clinical Dashboard UX

On the enterprise side, I worked on some partner lead management modules. We had an issue where users could accidentally edit sensitive fields after a lead was already created. I added a helper to dynamically toggle the disabled state of specific form blocks when a user enters "edit" mode.

Sometimes the simplest UX changes—like graying out a field so someone doesn't break a database relationship—save the most support tickets in the long run.

I also refactored the deals section to use a common data-grid component. It's less code to maintain and keeps the UI consistent across the entire platform.

Wrapping Up

Encryption is one of those things that's easy to get wrong and hard to test, so I'm glad that's behind me. Tomorrow I’ll probably dive deeper into some RxJS state management stuff that's been bugging me in the lead module. Peace out.