Case study · 05
Nippyy backend
Backend foundations, web and mobile apps for a cross-border fintech product.
- Role
- Software Engineer (part-time, remote)
- Period
- Oct 2025 – present
- Stack
- TypeScript, Fastify, MongoDB, Mongoose, Next.js, React Native, Expo
- Status
- Private
Private repository. Diagrams and descriptions only.
01 The problem
A cross-border fintech product needs foundations that regulators, operators and auditors can all rely on before the first feature ships.
That means fine-grained access control with approvals, transaction identifiers that match the national switch's spec, wallet balances that stay correct when a flow fails halfway, and requests that can be traced across services.
02 What I built
- fastify api
fastify api: TypeScript
- correlation ids
correlation ids: Distributed tracing across every request
- access control
access control: RBAC + ABAC + maker-checker across nine roles
- nibss utilities
nibss utilities: Session IDs and transaction references
- fund reservations
fund reservations: Balance locks as ledger records, TTL sweep, reconciliation
- integrations
integrations: 9PSB wallet-as-a-service and VAS, Afriex
Every request through the Fastify API carries a correlation ID, so a single operation can be traced across services and queues.
The access-control module combines role-based and attribute-based rules with maker-checker approvals across nine fintech roles: one person proposes a sensitive action and another approves it.
Fund reservations turn wallet balance locks into ledger records inside MongoDB transactions. Each lock has a TTL; a sweep job releases stuck funds, and reconciliation flags any drift between ledger and balance.
The NIBSS utilities generate and validate session IDs and transaction references. They were checked against real transaction samples, which surfaced discrepancies in the spec itself.
03 Decisions and trade-offs
Decision 01
Chose Combining RBAC, ABAC and maker-checker approvals over roles alone.
Why: Fintech operations need rules that depend on the record, not only the role, and sensitive actions need a second person.
Cost: A larger policy surface to test across nine roles.
Decision 02
Chose Ledger records for wallet balance locks over a held-balance flag on the wallet.
Why: Every reservation is traceable, and a TTL sweep can recover funds a failed flow left locked.
Cost: A sweep job and reconciliation to run and watch for balance drift.
04 Results
- Faster API responses
- 60%
- Source: Lucky's résumé (Oct 2026): optimised database indexes, fewer round trips and a caching layer
- Fewer duplicate records
- 50%
- Source: Lucky's résumé (Oct 2026): database schema redesign
What shipped
- Access-control module combining RBAC, ABAC and maker-checker approvals across nine fintech roles, shipped as a reusable Mongoose plugin.
- Fund reservation system that turns wallet balance locks into traceable ledger records, with MongoDB transactions for atomicity, TTL expiry plus a sweep job to recover stuck funds, and reconciliation to detect balance drift.
- 9PSB wallet-as-a-service and value-added services (VAS) integrations.
- Led the web app (Next.js) and native mobile app (React Native, Expo) built on these APIs, with Zustand for state and TanStack Query for data fetching.
- NIBSS-compliant session ID and transaction reference utilities, validated against real transaction samples, including spec discrepancies found along the way.
- Correlation IDs for end-to-end request tracing.
Want this kind of work on your team?