- Introduction
The client for this project is WestJet, a Canadian airline headquartered in Calgary, Alberta. WestJet has over 15,000 employees and in 2025 served more than 22.6 million guests.[1]
This report outlines the design of the Digital Profile Apps Admin Panel, an internal administrative tool intended to replace manual developer requests with a secure, self-serve interface. The application allows authorized users to manage platform features and maintain cache consistency across WestJet’s Digital Platform Services (DPS).
2. Overall System Architecture
The system is designed as a Single-Page Application (SPA) using Vue 3 and TypeScript, ensuring direct compatibility with WestJet’s internal component library. Operating within strict corporate guidelines, the system communicates with backend cloud infrastructure and APIs via Axios, which maintains enterprise-wide interceptor patterns and unified timeout handling.
Core system layers:
- Presentation Layer: A Vue 3 frontend dynamically adjusts user interface visibility based on assigned user roles.
- State Management Layer: Local client state is managed using Pinia. TanStack Query manages asynchronous server-state, handling background re-fetching and automated cache invalidation.
- Data and Persistence Layer: Azure Blob Storage serves as the primary data store. It houses feature flag configurations directly as JSON objects rather than using a traditional database.
- Authentication Layer: Enterprise Single Sign-On (SSO) is integrated with Azure AD using either ForgeRock or SailPoint via OAuth 2.0 / OIDC Authorization Code Flow.
3. Major Workflows and Component Interaction
The Admin Panel facilitates two primary operational workflows that communicate securely with backend services.
DPS Cache Management
Administrators with the cache-admin or super-admin role can trigger DPS cache clearing through the user interface. The application sends requests to protected DPS API endpoints using a Bearer token. To prevent operational accidents, the system requires explicit user confirmation before execution and displays success or error states.
Feature Flag Management
Feature flags are maintained directly in Azure Blob Storage as JSON files. The system fetches these configurations and displays them in a sortable, filterable table. Users with the feature-flag-manager role can toggle flag states, but the system enforces an atomic JSON overwrite using a PUT request to prevent schema fragmentation. To ensure safety, a pre-commit JSON diff preview modal allows operators to visually inspect structural changes before writing to blob storage. If an update fails, the system automatically rolls back the UI toggle and presents an error notification.
4. Security and User Access Control
To ensure a secure environment, the application restricts access exclusively to authenticated internal staff, preventing anonymous or guest access. All network communication is encrypted via HTTPS using TLS 1.2+ with HSTS enforced. Frontend access tokens are secured against Cross-Site Scripting (XSS) by using HttpOnly, Secure, and SameSite cookies.
Authorized roles include super-admin, cache-admin, feature-flag-manager, and read-only. Read-only users can inspect cache status and view feature flag tables, but write and toggle permissions are completely disabled.
5. Testing Strategy and Deployment
Quality assurance is integrated directly into the system’s development model. The testing harness mandates at least 80% code coverage across critical application paths using Vitest and the Vue Testing Library. UI components are isolated and documented within Storybook to verify design continuity. Code changes advance sequentially through an automated CI/CD pipeline spanning Development, Quality Assurance, Staging, and Production environments, ensuring features are thoroughly validated before deployment to the live network.
The combination of strict WestJet architectural standards, atomic cloud storage updates, and authorization provides a secure and scalable foundation for the Admin Panel. By prioritizing isolated component verification and fine-grained access control, the system successfully replaces error-prone manual developer scripts with an intuitive, reliable enterprise application.
6. References
[1] WestJet. (2026). WestJetting Since ‘96. Retrieved from https://www.westjet.com/en-ca/who-we-are/brand