Overview

A case management system for the organisations that run UNICEF-supported child-protection centres in Egypt. Case workers open a file for each child at risk and carry it through six stages: the initial report, a case study, a rehabilitation plan, follow-up, a final evaluation and closure. Each stage has to be approved by a supervisor before the next one opens, so nothing moves forward unreviewed. The interface is Arabic and right-to-left, and a companion mobile app works against the same data through an API. Everything shown in the demo video and the screenshots is invented data in a separate demo database. No real child, family or staff member appears.

Key Features

• Gated case file: Six stages per case, each with its own request, approve and reject actions. The next stage's tab appears only once the previous one is approved, and every decision notifies the other side.
• Long forms as wizards: A nine-step case study and a ten-step rehabilitation plan, covering family, schooling, work, health, legal status and risk, with one plan step per service type.
• Nine service types: Shelter, health, psychological, emergency aid, cash support, education, legal, family reintegration and services for the family, each with a provider, a target date and a delivery record.
• Overdue services: A watchlist of services that were planned, are past their date and have not been delivered, across every centre.
• Role-scoped access: Six roles, from case worker to administrator. A case worker sees only the children assigned to them, a supervisor the centres they cover, a project admin their partner organisation.
• Database-driven permissions: Pages, routes and permissions are rows in the database, edited from a permission matrix per role rather than in code.
• Programme dashboard: Seven tabs of filterable charts: nationalities, governorates, age groups, service providers, services, gender and types of violence.
• Exports: Every table exports to CSV, Excel and PDF, with selectable columns.

Tech Stack

Laravel 10 on PHP 8.2 with MySQL. The admin interface is server-rendered Blade on Bootstrap 5 with full RTL support, server-side DataTables for every list, and Highcharts and amCharts for the dashboard. Spatie Permission handles roles, Spatie Activitylog records changes to case records, and Laravel Sanctum secures the API used by the mobile app.

My Role & Impact

I worked on the backend as part of a small team. My work covered role-based data scoping for centres and partner organisations, the mobile API endpoints, and validation across the report, case study and plan forms. I also led a security-hardening pass: progressive rate limiting on login, a strong password policy with a forced change for new accounts, single-session sign-in, protection against HTML injection, and API error responses that no longer leak exception details, backed by feature tests for the password-reset flow. The demo video above was recorded straight from the running app with a Playwright and Remotion pipeline, against a database of invented cases built for the purpose.