Student Voting Management System

Overview

Overview

Overview and Problem Solved: Traditional university and student union elections face significant hurdles: slow manual vote counting, vulnerability to human error, and the persistent challenge of proving that an electronic ballot cannot be traced back to the voter who cast it. The Student Voting Management System solves this classic dilemma by establishing mathematical and physical separation between voter identity and ballot records, while remaining resilient against high-concurrency race conditions during peak polling hours. Key Workflow: 1. Verification Desk: Desk officers verify student credentials and generate cryptographically secure, single-use voting codes. 2. Anonymous Voting Kiosk: Voters access dedicated polling booths, input their code, and submit their ballot. The voting code is permanently burned upon ingestion. 3. Administration and Tallying: Election commissioners manage candidates and monitor voter turnout under a strict results quarantine—running tallies are inaccessible until polls officially close. Backend and Architectural Strengths: • Clean Architecture and CQRS: Strictly decoupled into Domain, Application (MediatR CQRS and FluentValidation), Infrastructure, and WebApi layers, standardizing on RFC 7807 ProblemDetails for error handling. • Zero-Linkability Voter Anonymity: Ballot records contain zero foreign keys, student IDs, or audit metadata linking them to voter profiles, ensuring total privacy. • Deterministic AES-256 Code Protection: Voting codes are encrypted at rest in SQL Server using AES-256 while preserving high-performance O(1) indexed lookups. • High-Concurrency Resilience: Implemented EF Core execution strategies and database rowversion concurrency tokens. Verified via automated stress testing with 15 simultaneous submissions using identical codes—strictly guaranteeing 1 successful ballot ingestion and 14 instantaneous HTTP 409 Conflict rejections. • Kiosk Perimeter Security: Dedicated physical voting booths authenticate using rotating API keys validated via constant-time byte comparisons (CryptographicOperations.FixedTimeEquals) to prevent timing side-channel attacks. • Token Security and Defense-in-Depth: Implemented RFC 6749 Refresh Token Rotation with compromised token-reuse detection that automatically terminates all active sessions upon breach detection, sliding-window IP rate limiting, and automated background cleanup workers. • High-Performance Querying: Turnout metrics and election results are computed through single-pass database-level aggregations (GroupBy and Select) backed by covered composite indexes and cached in-memory with automatic lifecycle invalidation. • Automated Testing Suite: 27 comprehensive integration, concurrency, and security tests built with xUnit and FluentAssertions. Technologies Used: • Backend: .NET 10, C# 13, ASP.NET Core Web API, Entity Framework Core 10, SQL Server, MediatR, FluentValidation, Serilog, ImageSharp. • Frontend: Next.js 15, React 19, TypeScript, Tailwind CSS (Native Arabic RTL interface). • Testing: xUnit, FluentAssertions, Microsoft.AspNetCore.Mvc.Testing.