Building a platform on a locked-down desktop
No admin rights, no database server, no open ports. How the order platform's architecture came out of its constraints.
The machine I build on is a shared Windows host. I am a standard user: no admin rights, nothing that needs them can be installed, no inbound firewall rules, no service accounts, and everyone is signed out on Saturday night. No IT team is on call for this project. Every design decision below came from those limits.
Why the browser extensions had to go
My first tools reached the ERP from the browser. That ran into two walls. Browser security rules stop a public web page from calling internal services directly, so the logic had to live in an extension. And an extension's background worker is suspended when idle: its poll counter did not add up to one poll a minute, so polls were going missing. Logic inside an extension is also out of reach for any agent.
One local server per person
The answer was a small Node server for each person, listening only on their own machine. The desk page talks to it, and it talks to the ERP's service API with that person's own ERP account. It installs into the person's profile, runs as their own scheduled task, and keeps credentials sealed with Windows DPAPI.
On a host where several people share one machine, four things must be private to each person: the port, the install folder, the task name and the key.
A shared folder as the database
There is no database server, so the source of truth is a folder on the file share. Only two ways of writing are allowed:
- create a new file that must not exist yet, or
- write a temporary file and rename it into place.
Who may create which file is the concurrency control. There are no locks to forget. Taking an order is creating a claim file; the highest-numbered claim wins, and nobody deletes another person's file.
A background service for the slow work
A scheduled background service does everything that should not wait for a person: reading new purchase orders with two readers, mirroring every open ERP order onto a card, following deliveries and invoices, building indexes, archiving. It never writes to the ERP. Writes happen only from a person's desk, under that person's account, after the ERP's own rules have run.
Shipping without touching anyone's machine
Each desk has an updater that checks every hour and installs only bundles signed with the release key (RSA-3072). So a release is a production deployment: every desk picks it up within the hour, including mine, and I see every change in my own daily work. Two hand-brake files can stop publishing and updating. One version number names one build; a reused number is refused.
Opening production without flipping a switch
Production access follows people. A person is either on the production list or works against the test company, and the list is written from the user list, never by hand. Removing someone from the user list stops their production writes immediately.
Before go-live, the background service mirrored every open ERP order onto the desk, read-only. A new order typed directly into the ERP showed up as a card in about 17 seconds. Going live was then a matter of people starting to use it.
The pivot that took a day
In the first week, management decided the desk must not read or write the work board the team had used until then. Four constraints set a few days earlier made that cheap: every feature is a module, every module talks through one transport layer, no dashboard is shared, and rules live outside the code. The change took 24 hours and nothing was rewritten.
What the constraints bought
- Nothing needs admin rights, so nothing waits for anyone.
- Every desk runs the same signed build, so a bug report names a version.
- The weekly sign-out is a known outage, not a mystery: the desk shows a lost-connection light and recovers when someone signs in.
What I would do differently
The host itself became the risk. When the old workstation was shut down at a few hours' notice, the signing key, private history and scheduled tasks lived on it. Off-machine copies existed by then, but the move taught me more: measure the new machine before touching it. The background service is moving to a dedicated machine.