Usukhbayar

000%
Skip to content
All work

Education · Web platform/2026

NomadKids

A deployed kindergarten portfolio platform, integrated with Mongolia's national education system — teachers record development, parents follow their own child, and each history exports as a printable PDF.

Role

Team Lead · Full-Stack Developer

Two developers, including me. I led the build and wrote the specification the other worked against.

  • Next.js
  • NestJS
  • Prisma
  • PostgreSQL
  • Cloudflare R2
Management dashboard
Kitchen & menu
Teacher dashboard
  • Director
  • Teacher
  • Kitchen
  • Accounting
  • Parent

Overview

NomadKids is a digital portfolio for Mongolian kindergartens: teachers record observations and developmental assessments, parents follow their own child's progress and photographs, and administrators manage kindergartens, groups, and staff.

Problem

Kindergartens track child development on paper. Records scatter when a child changes group, year, or kindergarten, and the family is left with nothing to keep. The client's brief also sets strict rules on who may see a child's data.

Solution

A Next.js front end against a NestJS and Prisma API, with authorization enforced server-side per role and per child rather than in the UI — roles live on membership, so one person can be both a teacher and a parent. Sessions use same-site HttpOnly cookies, a short access token with a rotating refresh, and no token ever stored in localStorage. Photos live in a private Cloudflare R2 bucket behind presigned URLs, and reports are rendered as A4 Mongolian-Cyrillic PDFs by a Puppeteer worker pulling off a BullMQ queue.

Outcome

Deployed and serving: nomadkids.mn with its API on api.nomadkids.mn and media on a private bucket, behind a strict content-security policy and HSTS. The ESIS access token was issued and the connection verified end to end; per-service scope is still being granted by the ministry's IT centre, which is an external gate rather than a code gap.

Role & ownership

Role
Team Lead · Full-Stack Developer
Team
Two developers, including me. I led the build and wrote the specification the other worked against.
Owned end to end
  • The architecture, and the written specification the team built against
  • The 28-table schema, with the authorization boundary designed into it rather than checked in the UI
  • The ESIS integration — 39 services against the ministry's v2 catalogue, chosen on least privilege
  • Deployment: nomadkids.mn, the API, the private media bucket, the content-security policy and HSTS

Roles

Roles live on membership, not on the account — one person can be both a teacher and a parent, and every check runs server-side per role and per child.

  • NomadKids — Director

    Director

    Sees the whole kindergarten — attendance, groups, staff and reports — and runs the ESIS console: pulls child, staff and institution records from Mongolia’s national education system across 39 wired services, with readiness per service, read-only dry runs, sync history and an audit log.

  • NomadKids — Teacher

    Teacher

    Records attendance, observations and developmental assessments, posts to the class board and builds each child’s portfolio.

  • NomadKids — Cook

    Cook

    Owns the kitchen: the weekly menu, ingredients, and technology cards with calories per portion, stock levels and food orders. Product types and food categories are pulled from the ESIS reference catalogue rather than typed by hand.

  • NomadKids — Accountant

    Accountant

    Owns the kindergarten’s own money — funding, invoices and reconciliation against attendance. Distinct from the platform’s revenue, which stays behind a separate boundary.

  • NomadKids — Parent

    Parent

    Follows their own child only — progress, photographs and reports, scoped per child by the authorization boundary.

  • In development

    Mobile app

    In development: the parent experience as a React Native app, so daily updates arrive where families already are.

Engineering highlights

  • Integrated with ESIS, Mongolia's national education information system: 39 services wired against the ministry's v2 catalogue of 198, chosen on least privilege and matched 39-for-39 against the ministry's own official service list, path for path.

  • Technical leadership: led a two-person team and delivered the Next.js frontend, NestJS API and government integration.

  • Multi-tenant by construction — one provider token serves many kindergartens through a per-kindergarten ESIS institution mapping, so tenant data can't leak across the integration.

  • An operator console where a kindergarten admin sees readiness per service, runs a read-only dry run, and reads back sync history and an audit log — without touching live records.

  • Self-assessed line by line against ministerial order A/261: of 51 mandatory criteria, 35 met, 14 partial, 1 outstanding. Self-assessed, not certified — the distinction is the point.

  • 28-table schema with the authorization boundary written into it, and a security acceptance matrix covering RBAC, tenancy, IDOR, media and reports.