NU Result Archive & Notice API is an independent web platform designed to provide structured access to Bangladesh National University examination results and official notices through developer-friendly REST APIs.
Built with Next.js App Router, React, Supabase PostgreSQL, and Supabase Authentication, the platform combines result archiving, notice management, API access control, account administration, and secure database operations into a centralized system.
The project focuses on building a reliable backend infrastructure with efficient caching, verified authentication, strict permission boundaries, and transaction-safe data management.
It operates independently and is not an official National University service.
The Engineering Challenge
Educational data platforms must handle several important technical challenges:
Data Accessibility: Providing structured API access to result archives and university notices.
API Security: Preventing unauthorized requests, credential misuse, and quota bypassing.
Database Protection: Restricting direct client access to sensitive tables and privileged operations.
High Request Volume: Reducing repeated database operations through efficient caching.
Account Management: Supporting different user roles with strictly controlled permissions.
Data Consistency: Preventing duplicate records, incomplete updates, and conflicting transactions.
Secure Authentication: Ensuring user account operations are performed only by verified account owners.
The platform addresses these challenges using server-controlled database access, transactional PostgreSQL functions, authentication validation, and purpose-built API security.
Core Features & Technical Implementation
1. Developer-Friendly Results & Notice APIs
The platform provides REST endpoints for retrieving archived examination results and National University notices.
Results API
Retrieve archived results using normalized source URLs.
Submit structured examination results through authenticated API requests.
Automatically update existing records using unique URL-based atomic upserts.
Maintain consistent response structures for existing API consumers.
Cache result responses for faster repeated access.
Notices API
Retrieve available university notices through authenticated requests.
Support automated notice ingestion from authorized sources.
Replace the current notice collection through a single database transaction.
Maintain sequential notice identifiers after successful synchronization.
Roll back incomplete updates to protect data consistency.
The API design maintains compatibility with supported legacy authentication headers while encouraging secure bearer-token usage.
2. Secure API Key Authentication & Request Quotas
A dedicated API key system controls access to result and notice endpoints.
Key features include:
Server-side API key validation.
Account-specific request authorization.
Daily request quota enforcement.
UTC-based daily quota calculations.
Atomic quota updates for concurrent requests.
Protected administrative API key management.
Separate authentication requirements for user accounts and data APIs.
Quota validation is performed before serving cached responses, preventing caching from becoming a method of bypassing request limits.
3. Supabase Authentication & Account Ownership
The platform integrates Supabase Auth with Google sign-in to provide secure account authentication.
Account-management endpoints require verified Supabase access tokens rather than trusting client-supplied user identifiers.
Security measures include:
Verified JWT-based session authentication.
Server-validated account ownership.
Idempotent API key creation for authenticated users.
Protection against unauthorized role assignment.
Separation of user session tokens and developer API keys.
Private, non-cacheable responses for protected account endpoints.
This prevents users from impersonating other accounts through modified request headers or identifiers.
4. Role-Based Access Control & Administrative Security
The platform includes a structured permission system supporting Owner, Admin, and User roles.
Administrative features include:
Protected account listing and pagination.
Search, sorting, and filtering by role and account status.
API key status and expiration management.
Secure account information updates.
Database-enforced administrative authorization.
Restricted role modification privileges.
Protected owner accounts that cannot be demoted or deactivated through the account management API.
Authorization is enforced at both the API and database transaction levels, reducing the risk of privilege escalation.
5. Optimized Data Caching & Performance
The platform uses Next.js Data Cache to reduce repeated database operations and improve API response efficiency.
Caching strategies include:
120-second cache: University notice responses.
900-second cache: Archived result responses, keyed by normalized URLs.
Tag-based invalidation: Relevant cached content is invalidated immediately after successful mutations.
Authorization-first execution: API key permissions and quotas are validated before cached content is accessed.
This design balances response performance, data freshness, and secure API usage.
6. Transaction-Safe Database Architecture
PostgreSQL serves as the central database, with sensitive operations handled through server-controlled functions and transactional procedures.
Important implementations include:
Atomic result upserts based on unique URLs.
Transactional notice synchronization.
Automatic rollback when notice ingestion fails.
Database-enforced role protection.
Concurrency-safe request quota operations.
Duplicate transaction prevention.
Controlled account and API key creation.
Direct database access is restricted for anonymous and ordinary authenticated clients. Privileged database operations execute through a server-only service client.
This approach separates publicly accessible authentication features from sensitive database infrastructure.
7. Secure Redemption & Transaction Processing
The platform includes a protected redemption workflow with account ownership verification and transaction safeguards.
Security features include:
Verified user authentication before redemption.
Account ownership checks before contacting the transaction provider.
Duplicate transaction hash detection.
Prevention of concurrent pending redemption requests.
Preservation of uncertain transactions for manual reconciliation.
These safeguards reduce duplicate processing and help maintain consistent transaction states.
8. SEO-Optimized Public Website
The public-facing website is designed for accessibility, search engine discovery, and fast initial rendering.
Implemented features include:
Statically rendered landing pages and API documentation.
Search engine-friendly page metadata.
Canonical URLs and Open Graph tags.
Twitter social preview metadata.
Structured data using WebSite JSON-LD.
Dynamic robots.txt and sitemap.xml routes.
Bilingual educational content.
Noindex protection for private account and login pages.
Dedicated privacy policy and terms pages.
Public content loads independently of user authentication, improving accessibility and search engine indexing.
9. Responsive Dashboard & Account Management
The platform provides a responsive interface for users and administrators.
Core dashboard capabilities include:
Google-based account sign-in.
Individual API key management.
Account information and access status.
Role-specific administration controls.
Paginated account listing.
Search and filtering options.
Secure account editing.
Expiration and account status management.
The interface uses consistent layouts, status indicators, and accessible modal interactions to simplify administrative operations.