Club Infin8 · Campus calendar
Infin8 Calendar
What's happening on campus — no sign-in required.
- Type
- Club Infin8 · Campus calendar
- Role
- [Add role]
- Year
- 2026
- Status
- Active
(01)The problem
Students shouldn't need an account — or a group chat — to find out what's happening on campus today. And the people running it all need more than a list of dates: who's responsible for what, whether an event is actually ready, and what clashes with what.
(02)The idea
Two experiences, one application. The public calendar is the product, not a stripped-down admin panel: month, week, day and agenda views, search, filters, deadlines. Signing in adds capability to the same surface — events, responsibilities, notes, attachments and history, for three authorised administrators.
(03)The build
A two-workspace monorepo: a React single-page app and an Express API on SQLite, with WAL mode and migrations. The client only ever talks to a same-origin /api, so there's no base URL to configure anywhere — not in development, not in production.
The server decides what you can do; a hidden button is never the control. scrypt password hashing, server-side sessions stored as HMAC digests, CSRF protection, per-IP and per-email login throttling, parameterised SQL and a strict content-security policy.
Speed is a feature: the public landing page is one request, administration is code-split so visitors never download it, identical requests are coalesced and cached, and the first public load is roughly 95 KB of gzipped JavaScript and CSS.
- 01→AnyoneMonth · week · day · agenda
- 02→An eventDetails, public tasks, readiness
- 03→Staff adminCreate, edit, archive, notes, files
- 04■Super adminAccounts, organisers, venues
03 roles, each with its own workflow
- R01Super AdminOne. Full control, including admin accounts and settings.
- R02Staff AdminTwo. Day-to-day event operations.
- R03Public viewerEveryone else. Read-only, no account.
- Frontend
- React/TypeScript/Vite
- Backend
- Express/zod
- Data
- SQLite
- Security
- scrypt/HMAC sessions/CSRF guard/CSP
- Deploy
- Cloudflare Pages/Node host
(04)The hard part
- 01
Readiness has to be true
Event readiness is computed over every responsibility, internal ones included. Counting only the public subset would show 'Ready' while preparation was still outstanding — so when a visitor sees fewer tasks than the total, the page says so.
- 02
Warn, don't block
Double-booking a venue, or a team that's already busy at that hour, raises a warning that names the clash — and leaves the decision to an administrator.
- 03
Private means private
Quick notes are scoped to their author in every query. One admin can't read another's — not even the Super Admin — and the API answers 'not found' rather than confirming they exist.
- 04
Nothing is destroyed
Deadlines are events of their own type, so every query and filter works on them unchanged. Deleting an event sets a timestamp; the archive restores it.
(05)The result
A working calendar with public and admin experiences, a relational schema, a security model and a split deployment setup: the static client on Cloudflare Pages, the API on a Node host.
[ADD — is it live yet, and who uses it?]
(06)What's next
- 01Sit behind the Club Infin8 backend with shared authentication.
- 02A dashboard calendar widget and Google / Outlook sync.
- 03Registration, QR attendance, notifications and analytics — only once they're actually needed.
(07)Under the hood
L01 · Client
React SPA
- React
- TypeScript
- Vite
Typed API client with a caching query hook; admin pages lazy-loaded.
L02 · API
Express
- Express
- zod
Routes for events, responsibilities, notes, attachments, search and admin.
L03 · Data
SQLite
- WAL
- Migrations
Users, sessions, events, venues, responsibilities, notes, activity log.
L04 · Security
Sessions & guards
- scrypt
- HMAC sessions
- CSRF
- CSP
Authorisation on every mutating endpoint.
L05 · Deploy
Pages + Node
- Cloudflare Pages
- Node host
Static client at the edge, API on a host with a persistent disk.
- 1
- 2
- 3Workshop
- 4
- 5
- 6
- 7
- 8
- 9Deadline
- 10
- 11
- 12Club fair
- 13
- 14
- 15
- 16Seminar
- 17
- 18
- 19
- 20
- 21
- 22Hackathon
- 23
- 24
- 25
- 26
- 27Meeting
- 28
- 29
- 30
⚠ Venue already booked at this hour — warning, not a block
The same picture the film runs — an illustration of how Infin8 Calendar thinks, not a screenshot.