Case study
TRC-LU VMS
Overview
The visitor management system for TRC-LU. Visitors self-register on a phone with a live camera photo, the guard desk checks them in with RFID badges, sections log arrivals, and a nightly cron redacts old personal data.
Problem
A DOH treatment facility can't run walk-ins on paper: no control over which sections a visitor entered, no accountability for surrendered IDs, no badge tracking, and nothing an auditor could reconcile afterward.
Approach
Two-sided. Visitors run through an 8-step mobile wizard: contact details, affiliation, purpose, destination sections, and a camera gate that requires three consecutive frontal face detections before capture. The guard desk verifies identity, records only the surrendered-ID type (never the number), and assigns an RFID badge; checkout re-scans the badge and auto-files an incident when one goes missing. Section desks log arrivals per department, and admins export date-range Excel reports.
Architecture
Three deliverables share one backend: a visitor PWA, a guard/admin workspace shipped both in the browser and as a Tauri Windows installer, and a single-file Hono Worker (1,382 lines) over Turso and private R2. Photos never leave the server raw; an outgoing middleware rewrites every reference into an HMAC-signed URL that expires within 600 seconds, and a nightly cron redacts PII for visits older than a year, deleting the photo, masking contacts, and logging a security event. Every mutation carries an idempotency key plus a SHA-256 body hash, and each write bumps a revision counter that drives cross-device polling.
Challenges
Physical-world invariants over an eventually-connected system: a partial unique index on active badge assignments makes double-assigning one RFID badge impossible at the database level, and daily visitor numbering stays race-free through an atomic upsert counter in the same transaction. Legacy PBKDF2 hashes heavier than Workers' compute budget still had to let people log in, so sign-in does a constant-time client-proof challenge and transparently upgrades the hash. MediaPipe face detection runs on-device from a self-hosted WASM bundle inside a locked-down CSP.
Results
Live in production with CI deploying main. Lighthouse 100/100 in all four categories on mobile (FCP 1.0s, TBT 0ms), 17 migrations from core schema to section-arrival logging, automated PII retention as a policy-level deliverable, and a shipped Tauri installer for the guard desk.