ICONNET Finance Dashboard - OPEX, Cash Advance & Contract Monitoring

Project Overview

During my internship at PLN Icon Plus (ICONNET), SBU Sulawesi & IBT I, I worked in a 4-person intern team on an internal dashboard that moves the unit's financial monitoring out of scattered spreadsheets and into a single web application. It covers four areas of operational spending.

Modules

Architecture

A single npm-workspaces monorepo with two apps:

• apps/web — Next.js 16 (App Router, TypeScript, Tailwind CSS 4). Charts use ECharts; dashboard widgets can be dragged and resized with react-grid-layout; exports use ExcelJS, PapaParse and jsPDF.
• apps/api — Express REST API on PostgreSQL, with Redis for server-side caching of heavy summary queries and a client-side page cache on top.

Upload & Reconciliation Flow

Most data arrives as Excel or CSV exports from other systems, so imports were designed to be reviewed before they affect any figure:

Upload .xlsx / .csv (superadmin)
      ↓
Parse headers → create upload batch (status: pending)
      ↓
Bulk insert rows, enrich each row from master data (e.g. employee ID → section)
      ↓
Review → confirm (status: confirmed) → data appears in charts and exports

Rows are joined to reference tables (budget codes, products, staff master data), so each transaction is reconciled against the budget line it belongs to instead of being matched by hand.

Security

The application went through a full penetration-testing cycle before rollout. The fixes included:

• Authentication — JWT with a 24-hour expiry and a server-side blacklist so tokens are revoked on logout; passwords hashed with bcrypt.
• Brute-force protection — login limited to 5 attempts per IP every 15 minutes.
• File uploads — type checked by magic bytes, not just the file extension.
• Input & headers — input sanitization in middleware and security headers handled at the Nginx layer.
• Authorization — four roles (superadmin, admin, staff, viewer) checked on both the web middleware and the API, e.g. only admins validate cash-advance transactions and only superadmins confirm uploads.

Deployment

The first version ran on an office PC for the local network: PostgreSQL in Docker, the API and web app under PM2 with auto-start on boot, and a start script that detects the machine's LAN IP and rebuilds the frontend when it changes, so non-technical staff could keep it running.

It was then moved to a Hetzner Linux VPS behind Nginx, which is where the penetration test and security hardening took place.

Key Takeaways

• Treating every import as a reviewable batch made the dashboard trustworthy for finance users.
• Security has to be designed in for internal tools too; the pentest findings shaped the auth and upload code.
• Piloting on the office LAN first let finance staff validate the workflows before the move to a hardened cloud server.
• Splitting modules across a 4-person team worked because the upload, auth and reference-data patterns were shared.

Company: PLN Icon Plus (ICONNET), SBU Sulawesi & IBT I · Period: February – April 2026 · Source code is private.