Caftral Belur is a secure, identity-verified event management and collaborative deliberation platform built on Node.js, Express, and MongoDB. It provides a structured backend for organizing academic and community events—workshops, seminars, conferences, hackathons, and more—while ensuring that every participant is authenticated, profiled, and authorized through rigorous schema-level validation and multi-tier access control.
At its core, Belur introduces Cafts: structured documents that serve as the unit of discussion within events. Cafts support threaded replies, media attachments, and a democratic feedback mechanism called Stances, where participants express votes, vetoes, neutral positions, or remands. Together, these primitives enable organized, auditable group deliberation around event submissions, proposals, and outcomes.
Large-scale events—especially those involving certificates, team submissions, or collective decision-making—require more than a simple sign-up form. Organizers need to know who is participating, teams need to be validated against event rules, and discussions need structure rather than unstructured chat.
Belur addresses this by combining:
- Verified identity at registration, including nationality proof, education level, and residency details
- Event-scoped roles that govern who can organize, coordinate, host, or participate
- Structured documents (Cafts) tied to events and teams, with submission tracking
- Deliberation through Stances, giving groups a formal way to signal agreement, objection, neutrality, or requests for revision
The application's domain is defined by seven interconnected MongoDB models, each enforcing strict validation at the schema layer.
The foundation of trust in the system. Every user account is validated against a comprehensive set of constraints before it can exist in the database:
- Identity: unique username, validated email (regex), optional E.164 phone number, required first name, age (minimum 5), and gender
- Security: passwords hashed with bcrypt, minimum 8 characters, and scored with zxcvbn (score ≥ 3 required)
- Verification: nationality from a full country enum, nationality proof type (Aadhaar, Passport, Voter ID, Driving License, or Other), education qualification from a defined ladder, and Indian residency details (state, district) when applicable
- Authentication: JWT-based access and refresh tokens, owner fingerprint binding (JTI, IP, user agent) for sensitive operations, and automatic stripping of sensitive fields from API responses
Represents an organized gathering with a defined scope:
- Title, description, theme, location, and event type (Workshop, Seminar, Conference, Competition, Hackathon, Webinar, Training, or Other)
- Required document types that participants may submit
- Certificate types and issuance tracking
- Scheduling through one or more date ranges, automatically sorted chronologically
- Links to an organizer, organizational team (roles), and participant records
Groups participants within an event context:
- Optional team name and member list, each tied to an Account
- Certificate type assignments per member, validated against the parent event's allowed certificate types
- Scoped to a single event
The central artifact of collaboration and discussion:
- Authored by an Account, optionally linked to an Event and Team
- Title, subtitle, content, and description fields
- Media attachments via references to the Media model
- Threaded structure through self-referencing parent Caft relationships (comments and replies)
- Aggregated stance counts (votes, vetoes, neutrals, remands) with methods to recalculate from live Stance data
- Submission status and timestamp tracking
Formal participant positions on a Caft:
- Each stance is tied to an Account and a parent Caft
- One of four enumerated positions: vote, veto, neutral, or remand
- Indexed for efficient per-Caft and per-user queries
Attachments linked to Cafts:
- Typed as image, video, or document
- URL storage with owner reference back to the originating Caft
Event-scoped authorization:
- Role names: host, coordinator, organizer, admin, or participant
- Bound to both an Account and an Event
- Automatically synchronized to the Account's roles array on create or remove, scoped to the last 30 days
Belur implements defense in depth across models, middleware, and token management.
| Layer | Mechanism |
|---|---|
| Registration | Schema validators for email, phone (E.164), password strength (zxcvbn), age, gender, nationality, and education |
| Storage | bcrypt hashing on password save; unique indexes on username, email, and phone |
| Session | Short-lived access tokens (15 minutes) and long-lived refresh tokens (30 days) |
| Sensitive actions | Owner authentication requiring refresh token, stored JTI fingerprint, matching user agent, and token presence in the account's token list |
| API responses | Passwords, tokens, owner fingerprints, and personal name fields removed before serialization |
| Authorization | Role-based access with event-scoped role lookup and middleware tiers (access, refresh, owner) |
The server exposes REST endpoints under two route groups:
/apis/acc— Account lifecycle: signup, login, logout (single device and all devices), profile and credential updates, token refresh, and account deletion/apis/caft— Caft CRUD: create, read, update (owner only), delete (owner only), and fetch threaded child Cafts
All protected routes pass through the appropriate authentication middleware before reaching controller logic.
- Runtime: Node.js (ES modules)
- Framework: Express 5
- Database: MongoDB via Mongoose 8
- Authentication: JSON Web Tokens (jsonwebtoken)
- Validation: express-validator, Mongoose schema validators, validator, zxcvbn
- Security: bcryptjs, cookie-parser, UUID session identifiers
Belur is designed for organizations—educational institutions, community programs, and event coordinators—who need a backend that treats participant identity seriously. It is suited for events where document submission, team-based participation, certificate issuance, and structured group deliberation must coexist under a single, auditable system of record.
The strict model-layer validation ensures that user verification is enforced consistently regardless of which API route or client application interacts with the server, making Caftral a reliable foundation for trust-sensitive event platforms.