LendFlow — Multi-Role Lending & Underwriting Platform
Loan origination, underwriting review, and repayment interfaces organized around borrower, lender, and administrator workflows. Shared loan records keep review outcomes visible across the product.
Problem & context
Organize loan applications and review outcomes across borrower, lender, and administrator interfaces using shared loan records.
My contribution
React role-oriented views, Express loan handlers, JWT account access, and relational loan/user modeling.
Inspect the workflow.
Explore the sample workflow without creating an account. The application renders bundled fixtures through its public preview interface.
Open sample workspaceRead-only fixtures · no sign-in · no real generation or financial action
Failure path: A reviewer submits an approval or rejection for a loan identifier that cannot be found.
The handler returns a 404 response before assigning a status. Other caught errors return 500; this review did not execute database failures or verify a general rollback mechanism.
Authenticated app ↗An engineering decision.
a common enum makes application creation and approve/reject handlers write the same vocabulary. It does not by itself enforce authorized state transitions or prevent concurrent review updates.
Implemented approach
Represent review outcomes as pending, approved, and rejected values on a shared Sequelize loan record.
Alternative & tradeoff
Track approval only as separate interface flags or an unstructured status string.
Follow the system.
Verified behavior & limitations.
What the evidence establishes
- Source review: application creation writes the authenticated account identifier and an initial pending status.
- Source review: approval and rejection look up a loan, return 404 if absent, assign an explicit status, and save it.
- Source review: principal and interest use DECIMAL fields and borrowerId references a user record.
- Source review: loan routes use JWT authentication middleware.
Boundaries & remaining work
- Role-oriented screens do not establish complete server-side role authorization. The reviewed loan routes apply authentication without a demonstrated reviewer-role check.
- The source snapshot contains a hard-coded demonstration JWT secret; it is not evidence of production-ready account security.
- The risk classification is example amount/term logic. No regulated underwriting accuracy, funds transfer, concurrent decision safety, or live database result is asserted here.
Inspect the source.
References are pinned to the reviewed revision. Public sample screens demonstrate the interface with fixtures; source review and executed checks are labelled separately.