Secure Banking System — FastAPI + PostgreSQL
A production-style banking backend with strict RBAC, hashed PIN authentication, account lock policies, immutable history logs, and fully ACID-safe money movement.
System Architecture
Modular structure for security, clarity and maintainability.
- Next.js client → FastAPI backend
- JWT-based session and role enforcement
- Atomic SQL transactions for all money movement
- Centralised audit pipeline for traceability
Role-Based Access Control
Responsibilities clearly separated across Customer, Teller and Admin.
| Capability | Customer | Teller | Admin |
|---|---|---|---|
| View Balance | ✔️ | ✔️ | ✔️ |
| Deposit / Withdraw | ✔️ (self) | ✔️ | ✔️ |
| Transfer Money | ✔️ (self) | ✔️ | ✔️ |
| Create Account | ❌ | ✔️ | ✔️ |
| Lock/Unlock Account | ❌ | ✔️ | ✔️ |
| View All Users | ❌ | ❌ | ✔️ |
| View Audit Logs | ❌ | ❌ | ✔️ |
Permission checks run at both API and SQL layers to block privilege escalation.
Database Schema
Ledger-style financial design.
users (id, user_name, password, role) accounts (id, account_no, name, pin_hash, balance, failed_attempts, is_locked, user_id) history (id, account_id, amount, type, timestamp) audit_logs (id, actor, action, details, ip, user_agent, timestamp)
PINs are hashed using bcrypt. The history table acts as an append-only mini ledger recording all movement.
Concurrency Guarantees
BEGIN; SELECT * FROM accounts WHERE id='A' FOR UPDATE; SELECT * FROM accounts WHERE id='B' FOR UPDATE; UPDATE accounts ... INSERT INTO history ... COMMIT;
Row-level locks ensure that two withdrawals on the same account cannot run in parallel or corrupt balance.
Audit Logging
Every action leaves a trace.
- Stored: actor, action, IP, device, timestamp
- Crucial for fraud detection and misuse investigation
- Real banks enforce WORM — demo allows clearing logs
Challenges & Solutions
• Eliminating race conditions → row-level locks
• Brute-force PIN attempts → auto lockout
• Guaranteed traceability → strict audit logs
Limitations
• No 2FA for high-risk ops
• Audit logs not append-only
• No AML/KYC pipeline
• Single database (non-distributed)
What I Learned
✓ ACID-safe financial transactions
✓ Secure auth (bcrypt + JWT)
✓ Ledger and audit design
✓ Modular FastAPI architecture