Building an Auditable Laravel Document Workflow

From editable forms to a controlled document lifecycle

A Berita Acara Serah Terima (BAST) records a handover between parties. In software, the challenge is not merely saving the form fields; it is preserving what the record means after a user finalizes it, revises it, completes the handover, or archives it.

The project models Draft, Finalized, Completed, and Archived as meaningful states. Reopening, revision, cancellation, and restoration are separate workflow operations. This makes the distinction between an editable draft and an accountable completed record visible in application logic instead of leaving each screen to interpret status independently.

Permissions must be enforced beyond the interface

Hiding an action in React is helpful usability, not authorization. The backend still receives direct HTTP requests, so every sensitive lifecycle operation needs a server-side check against the current user's role and capabilities.

The Laravel application enforces these boundaries for administrative and staff workflows. Frontend navigation can reflect permissions, but it cannot grant them. This is important for document changes, attachments, user management, and restoration of archived records.

UUID route identifiers reduce accidental exposure of sequential database IDs in URLs. They are not a substitute for authorization: an unguessable identifier still requires ownership and permission checks before a record can be read or modified.

Numbering, files, and PDFs belong to the domain

A finalized handover document needs consistent numbering and output. The implementation uses dedicated sequence records for automatic BAST numbers and server-side DomPDF generation for export. Number assignment therefore follows application rules rather than relying on browser-generated values.

Attachments have their own validation, relationship checks, download authorization, and deletion behavior. Treating a file as an authorized document resource matters as much as protecting the database row that references it.

• Document information and parties are collected through a structured multi-step workflow.
• State transitions determine whether revisions and cancellation are allowed.
• Document numbering follows backend-managed sequences.
• PDF output is rendered from server-controlled record data.
• Audit records preserve contextual change history.

Auditing means explaining what changed

For operational records, a changed status without a reason or trace is difficult to trust. The documented activity log records the resource and before/after values alongside contextual details such as actor-related request information, IP address, user agent, and timestamp.

The goal is traceability: staff should be able to connect a document's current state with the series of permitted actions that produced it. Audit trails also help developers debug surprising transitions without treating the client interface as the source of truth.

A demo should be inspectable without exposing real records

This project originated during a 2024 internship at Diskominfo Kabupaten Cianjur. The public portfolio repository and hosted demo are not an official production system or institutional repository.

The recruiter demo is intentionally read-only and uses synthetic data. This keeps the document workflow inspectable without publishing operational records or privileged credentials. The repository also documents quality checks including Pest tests, static analysis, and front-end validation.