TAQA Field Operations Platform

Built during a seven-week Computer Engineering internship (CEN399) at the Water Control Centre of TAQA Distribution Company in Al Ain. Alongside a control-room programme covering field instrumentation, SCADA architecture and OT/IT segregation, I designed and implemented a field operations reporting platform for the Maintenance and Field Operations department. Field workers record observations (leaks, damaged chambers, unsafe sites) from their phone with GPS position and photographs attached; the report appears on the supervisor's map instantly over a Socket.IO channel, and supervisors can dispatch a check to a named worker at a given location. Three separately deployed components talk over a versioned REST API. The backend was hardened with token versioning for session revocation, short-lived presigned S3 URLs for photo access, content-based upload validation, Zod validation of every payload, layered rate limiting and a constant-time login path, and the whole system is covered by 196 automated tests.

Maintenance crews in the field encounter conditions that must be recorded and communicated: a visible leak, a damaged chamber, an inaccessible valve, an unsafe site. What matters about such an observation is spatial and visual, but the existing route was verbal or on paper: it lost the precise location, carried no photographic evidence, and reached the supervisor late.

A system that lets a worker record an observation as they observe it, with the device's GPS position and photographs attached, appearing immediately on the supervisor's map without refreshing or polling, and allowing the supervisor to work in the opposite direction by dispatching a check to a named worker at a given location. Three separately deployed components (mobile app, backend server, web dashboard) communicate over a versioned REST API with a real-time channel from server to dashboard.

1. 01Field worker logs in on the mobile app; the JWT is stored in encrypted on-device storage
2. 02Worker drops a report at their GPS position, adds a description and attaches photos from camera or gallery
3. 03Backend validates the payload with Zod, checks the image content type against its bytes, and stores photos privately in S3
4. 04Report is persisted in MongoDB via Prisma and broadcast over Socket.IO to admitted dashboard clients
5. 05Supervisor dashboard updates instantly: map marker, stat cards and report table, filtered by role scope
6. 06Supervisor opens the report detail panel, views photos via short-lived presigned URLs, and moves it through the status workflow
7. 07Supervisor can create an assignment at a location for a named worker, who sees it on their own map
8. 08Logout bumps the user's token version so every previously issued token is rejected server-side

Versioned REST API

backend is independent of both clients and could support further ones unmodified

Token versioning

logout increments a per-user version so old JWTs are revoked without a token blacklist

Presigned S3 access

object keys in the database are useless on their own; every read goes through a short-lived signed URL

Content-based validation

uploads are checked by magic bytes, not by the client-supplied extension or MIME type

Constant-time login

identical generic error and a dummy password comparison for unknown emails to prevent account enumeration

Real-time channel admission

Socket.IO connections are authenticated and scoped before joining rooms

Decision

Layered rate limiting and Helmet headers on the HTTP surface

Test coverage directed at security-critical and role-dependent paths

82 backend, 48 mobile, 66 dashboard cases

• Cross-platform mobile app (iOS and Android) with native map, marker clustering, GPS capture and camera/gallery photo attachment
• Standalone Node.js/Express backend in TypeScript persisting to MongoDB through Prisma, independent of both clients
• Real-time supervisor dashboard in Next.js with a clustered Leaflet map that updates over Socket.IO without polling
• Two-way workflow: worker reports flow up to supervisors, supervisors dispatch assignments down to named workers
• Role hierarchy (worker, supervisor, admin) with role-scoped data visibility and role-based authorisation on every endpoint
• Status workflow for every report and assignment (open, in progress, resolved) with a detail panel and time-range statistics
• Private, server-side-encrypted photograph storage in Amazon S3 with short-lived presigned read URLs
• JWT authentication with bcrypt hashing, token versioning for logout revocation and encrypted on-device token storage
• Content-based upload validation, Zod runtime validation of all request payloads, Helmet, CORS and layered rate limiting
• 196 automated tests across backend (Supertest), mobile and dashboard (Jest, React Testing Library)

Authentication and session management, the role hierarchy, report and assignment creation with photo upload, the status workflow, real-time dashboard updates, clustered map views on both clients, user administration and the statistics endpoint were all implemented and tested by the end of the placement (29 June to 21 August 2026, 322 hours). Remaining work at handover: production deployment, push notifications for new assignments, and offline capture with deferred sync for areas of poor cellular coverage. Supervised by Eng. Maher Abu Atwan, Senior Water Control Centre Engineer.