The problem
The project needed to bring product discovery, purchasing, account management, and administrative operations into one coherent mobile workflow while keeping authentication, business rules, and persistence behind a dedicated API.
Back to selected work
Academic full-stack system
TFG Commerce
My 2025 final degree project: an Android commerce and order-management application backed by a Kotlin and Spring Boot API, documented as an academic system rather than a production service.
Role
Android and backend development
Year
2025
Status
Academic project · source code available
Stack
Kotlin · Jetpack Compose · Spring Boot · MongoDB
My contribution
I built the Android client with Kotlin and Jetpack Compose and developed its Kotlin and Spring Boot backend. The work covers the catalog, search, product details, cart, authentication, profile, orders, and role-based administration.
The solution
The Android application uses Compose for the interface, Retrofit for the API boundary, coroutines for asynchronous work, and local preferences for session state. The backend exposes the domain through Spring Boot, persists it in MongoDB, and applies JWT authentication and USER or ADMIN authorization.
04
System architecture
A separated client-server design keeps mobile presentation concerns independent from authentication, domain operations, and persistence.
Android client
Jetpack Compose screens and state
Retrofit boundary
Typed HTTP communication
Spring Boot API
JWT, roles, orders, email
MongoDB
Users, products, and orders
Key decisions
- The Android client and backend live in separate repositories so each can be built and reviewed independently.
- The API base URL is configurable at build time instead of being fixed to a deployed service.
- No public demo is presented because the academic system has no maintained production environment or public test accounts.
Security and privacy
- Backend credentials and RSA key locations are supplied through the environment and are not stored in the current repository state.
- Passwords are hashed with BCrypt, routes use JWT and role checks, and user responses exclude password hashes.
- The Android client no longer logs token values and excludes authentication preferences from backup; migrating token storage to Android Keystore remains a documented next step.
Validation
- The backend test suite and executable WAR build pass with Java 21.
- The Android unit tests, debug APK build, and lint task complete successfully with no lint errors.
- Both repositories document local configuration, project boundaries, security considerations, and reproducible build commands.
05
Public evidence
The two repositories provide the source, setup instructions, architecture boundary, and an honest record of the controls that are complete or still planned.
Next case studyDefensive Identity Lab