Core Features
- Real-Time Alerts: WebSockets for instant alert updates.
- Multi-Channel Notifications: Web, Email and SMS alert notifications.
- Zone-Based Location Tracking: Continuously map user's live location against predefined geographic boundaries
- Audit Trail: Log alert creation and updates for traceability.
- Automatic Escalation: Alerts escalate if unresolved after a set time.
- Admin Interface:
- View & manage all alerts.
- View & manage notifications.
- Manage users & roles.
- View & manage safety tips.
- Embedded Safety Tips: Promoting a culture of crisis prevention and preparedness.
System Architecture
- Frontend (Svelte):
- Intuitive UI for alert creation, real-time notifications, and a dashboard for safety teams.
- WebSockets for real-time communication between frontend and backend.
- Responsive design for mobile use.
- Backend (Python):
- Django API to handle alerts, user authentication, and updates.
- PostgreSQL database for storing alerts and user data.
- JWT for secure authentication.
- WebSockets for live alerts & real time location tracking.
API Endpoints
- Alerts:
- POST /alerts/create – Create a new alert Authenticated Users
- GET /alerts/latest – Retrieve today's alerts Authenticated Users
- GET /alerts?search={query} – Retrieve all alerts that satisfy the search criteria Authenticated Admin, Safety & Super Users
- GET /alerts/{id} – Get details of a specific alert Authenticated Users
- GET /alerts/user/{user_id} – Get alerts of a specific user Authenticated Users
- PUT /alerts/{id}/update – Update alert details Authenticated Admin, Safety & Super Users
- PUT /alerts/bulk/update – Bulk update alerts Authenticated Admin, Safety & Super Users
- Users & Authentication: Authenticated & Anonymous Users
- POST /auth/token – Authenticate users (JWT-based).
- POST /auth/logout – Invalidate user tokens.
- POST /auth/token/refresh – Refresh users (JWT-based).
- POST /auth/token/verify – Verify user tokens.
- Audit Trail: Authenticated Admin, Safety & Super Users
- GET /audit?search={query} – Retrieve all alert logs that satisfy the search criteria.
- GET /audit/report?search={query} – Generate a report detailing alert history.
- WebSockets: Authenticated Users
- /ws/alerts – Real-time alert updates and zone-based location tracking for active users.
- Safety Tips: Authenticated Users
- GET /safety_tips – Get latest safety tips.
Data Model
- Users Table:
Field Type Description id UUID (PK) Unique user ID username String(Unique) User's profile name first_name String User's first name last_name String User's last name phone_number String Contact number for emergency notifications email String User's email department String User departmental block location password Hashed String Secure password storage group Enum Role-based access (worker, safety_officer, admin, agent, senior_officer, external_emergency_responder) last_login Timestamp Tracks the last time the user logged in is_active Enum User account status (Active, Inactive) is_staff Boolean Tracks if user is a staff is_superuser Boolean Tracks if user is a superuser - Alerts Table:
Field Type Description id UUID (PK) Unique alert ID category Enum Nature of danger (Fire, Electrical, Chemical, Accident, incident, Other) location String Location associated with an alert severity Enum Urgency level (Low, Medium, High, Critical) status Enum Current alert state (New, Dismissed, Confirmed, Resolved, escalated) description_notes Text Notes explaining reasons for the alert and the current situation created_date Timestamp The date and time the alert was created reported_by UUID (FK) User who created the alert confirmed_by UUID (FK) Safety officer or admin who confirmed the alert resolution_notes Text Notes explaining how the alert was resolved resolved_by UUID (FK) User who marked the alert as resolved response_time Integer Time taken (in minutes) from alert creation to acknowledgment - Notifications Table:
Field Type Description id UUID (PK) Unique notification ID alert UUID (FK) Linked alert recipient UUID (FK) User receiving the notification medium Enum Notification type (Email, SMS) sent_at Timestamp Time the notification was sent status Enum Notification status (Pending, Sent, Failed) - Safety Table:
Field Type Description id UUID (PK) Unique tips ID category Enum Tips type (Personal, Machinery, Hazards, Fire, Slips, Handling, Emergency, Workplace, Supervision, Behavior) tips_note Text Notes explaining the safety tips tips_image Image Store the illustration image for each safety tip - Audit Table:
Field Type Description id UUID (PK) Unique log entry ID alert UUID (FK) Reference to the alert being acted upon user UUID (FK) Who performed the action role Enum Role of the user (worker, safety_officer, admin, agent) action Enum Type of action (Created, Dismissed, Confirmed, Resolved, Escalated.) timestamp Timestamp Time action occurred ip_address String User's IP for security tracking device_info Text Browser, mobile device details
Scalability & Performance
- Asynchronous Tasks: Celery for background tasks (e.g., Email and SMS notifications).
- Caching: Redis to cache frequently accessed data.
Security
- Role-Based Access: Different access levels for employees and safety staff.
- Encryption: SSL/TLS for secure communication, password hashing for user credentials.
- Input Validation & Sanitization: Prevent security vulnerabilities like SQL injection & XSS attacks.
- WebSockets Security: Authenticate WebSocket connections and prevent data leaks.
- JWT Authentication:
- JWTs in Authorization headers instead of cookies to prevent CSRF attacks.
- Store JWTs only in memory (not localStorage) to avoid XSS risks.
- Implement short-lived access tokens with refresh tokens for added security.
- Obfuscate Sensitive Endpoints: Use dynamically generated URLs for admin routes.
- Rate-Limiting & IP Whitelisting:
- Protect critical API routes from brute-force attacks using rate limiting (e.g., X requests per minute).
- Implement IP whitelisting for admin and internal endpoints.
- CORS Protection:
- Allow API requests only from trusted frontend domains.
- Block requests from unknown origins.
Testing & Documentation
- Testing: Unit and integration tests with pytest & testcase (Python), Jest (React) and postman(API).
- Documentation: drf-spectacular for auto-generated API docs from your Django REST Framework views; storybook for documenting and visually testing React components.
Deployment & Monitoring
- Docker: For containerization.
- CI/CD: Automate testing and deployment with GitHub Actions.
- Cloud Deployment: For reliability, flexibility and cost.
- Monitoring: Prometheus and Grafana for system health; centralized logging with Logstash.