Leveling Up: Shared Access, Smart Forms, and a Canvas Certificate Designer

Week two kicked off with a flag ceremony on Monday morning before heading back to the keyboard. This week was all about depth — refining what was built last week, adding major new features, and pushing the system closer to production-ready. By the end of it, CAFÉ was already live.

What I Built This Week

Monday picked up right where last week left off. I finished and refined the conditional question logic — ensuring that hidden fields are properly skipped during validation, answer saving, and response display across all form views (admin, HEI, and public). I also wired up the Repeater field to display correctly in summaries, connected the File Gate to the HEI account flow, and built the Excel export for form responses.

Tuesday and Wednesday were heavily focused on field type expansion and file uploads. I added the Date field type, built out the Repeater sub-field validation, and significantly overhauled the file upload system — extending it to support multiple file uploads per question. I also added date range filters to the forms table and Excel export, implemented the multi-file FileGate, and introduced the Stakeholder role with its own scoped access to forms and dashboard widgets. I also shipped the REST API with personal access tokens (Laravel Sanctum), giving administrators a scoped API to interact with the system programmatically.

Thursday brought two big additions: the Rating question type (configurable star count), an entirely new audience type for Data Requesters, and — Shared Form Access for CHED staff, allowing forms to be co-managed by multiple staff members. I also implemented HEI User Management, letting an HEI admin create and manage sub-users for their institution, and added institution-wide response tracking so HEI managers can see submissions from all users under them.

Friday was a major milestone on two fronts. On the development side, I completed a thorough access control and policy pass — implementing formal Laravel Policies for FileGate and FormResponse, adding created_by ownership tracking to FileGates, building an audience-aware "Access Link" column in the FileGates table, and enforcing API middleware so only enabled admins can access the API. On the operations side, this was the day CAFÉ officially went live — the CHED Staff from our division, HEMIS (Higher Education Management Information System), deployed the application to production. Seeing a system I helped build from scratch get deployed within the same week I started was a moment I won't forget.

Saturday closed the week with the Certificate Template Designer — a Canva-style canvas editor (powered by Konva.js) that lets CHED staff design certificates, map form response fields onto text layers, and bulk-generate and export them as a ZIP of PDFs. I added font options, keyboard shortcuts, PDF A4 orientation support, a live preview overlay, and static text support. I also shipped a Form Copy feature that duplicates a form along with all its sections, fields, and settings.

Laravel, Antigravity, VS Code, XAMPP, Git, GiHub

The conditional logic touching every layer of the app (form builder, public form, HEI form, admin views, export) made it easy for edge cases to slip through — a field showing when it shouldn't, or getting validated while hidden. I solved this by centralizing the visibility check into a single reusable closure passed consistently into every view and DB transaction.

The multi-file upload introduced a tricky separation: regular answers live in $formAnswers, but uploaded files needed their own $fileAnswers array to avoid mixing temporary file objects with plain values. Keeping those two cleanly separated was key to getting validation and storage right.

The Certificate Designer was the most technically interesting challenge — rendering text on a background image using PHP's GD library, converting browser-scaled canvas coordinates into real pixel positions for server-side image generation, then packaging everything into a downloadable ZIP.

And perhaps the biggest pressure of the week: knowing the app was going to production by Friday meant there was no room for loose ends.