12. Ylogx BI codebase — browser to disk

This is a rehearsal notebook for Adarsh Vishwakarma. Read it as yourself. R1 was 13 Aug 2026. R2 was 18 Aug 2026. R3 is done. This folder is Round 4 only. Live Code is Java. This intern product is TypeScript NestJS + React, with Python FastAPI LangChain SQL RAG. Job 10454435 still has no public write-up that names a live-round question. Unnamed stays unnamed. The resume row is Ylogx production BI (November 2024 to October 2025). Repo folders named Conv-BI or Projas are that same intern product, not a second intern. Mechanisms below are from the December 2025 tree. Percents are from the August 2026 PDF only. If they ask how a percent was measured: name the mechanism, say the PDF number, then “I do not have the study protocol on the resume.”

Jump

Walk me through this product from the browser
How does RLS actually work?
How does the chatbot not leak another org?
Cookies or Bearer?
This repo is named Conv-BI / Projas

90s intro of this product from browser to disk

One spoken path. Browser, identity, Postgres role, then disk. Stop after one resume family unless they pick a door.

What they might ask

Walk me through this system from the browser to the database.
What did you ship at Ylogx?
Explain the architecture in ninety seconds.

Resume-derived Ylogx BI walkthrough. Other leftover hours grill a project end to end. Shape evidence, not a forecast for Job 10454435.

What you say

Situation. At Ylogx I interned November 2024 to October 2025 on production BI. Operators needed dashboards, a drag-and-drop report canvas, and English questions against warehouse tables, with three organizational tiers isolated in Postgres.

Task. I owned the identity-to-query path: the React SPA talking REST to NestJS, the request opening a Postgres transaction as the caller’s role, and the chatbot generating SQL on a FastAPI service that Nest still executes on that same transaction.

Action.

The browser loads a React + Vite SPA. Routes in App.tsx sit behind a token check and FeatureAccess. Axios (and the chatbot fetch) send Authorization: Bearer.
Nest on port 5000 runs JwtMiddleware, then RLSMiddleware: BEGIN, SET ROLE or RESET ROLE, set_config('app.*'), store req.dbTransaction.
Dashboard and report GETs/POSTs run Sequelize SQL on that transaction. PostgreSQL RLS filters rows. No LLM on those GETs.
A chatbot turn POSTs /queryDB/chat-query. Nest calls FastAPI LangChain. Generated SELECT comes back. Nest allow-lists tables and runs executeRawSelectQuery on the RLS transaction.
Tally zips go memory → S3 tally-uploads/ → HTTP POST to the Tally gateway. Chat titles live in chats / chat_messages.

Result. Thirty KPI dashboards with no model on the GET, sub-210 milliseconds. Report generation 40 percent faster. SQL RAG +65 percent analysis productivity behind three-tier RLS. Bot-path Redis −35 percent database latency on the resume. Product uptime 99.9 percent on CloudFront / ECS / Docker / ALB / Route 53. I do not have the study protocol on the resume. Pick dashboards, RLS, or the bot and I will unpack that path.

They might ask next

If they ask	You answer
What did you implement versus the team?	I for Nest modules I shipped (JWT/RLS pipeline, queryDB, dashboards, reports, chat CRUD, admin RBAC, Tally upload) and the FastAPI extractor path. Placement-style percents are product outcomes. Intern title.
Where does the JSON live?	Tenant numbers come from Postgres over the RLS transaction. The SPA is static. Resume CloudFront is static assets, not private tenant JSON at the edge.
Is this GraphQL / Prisma / Kafka?	REST. Sequelize. No GraphQL and no Prisma in this tree. Kafka is not on the internship bullets.

Keep straight

This is the Ylogx intern BI product. Conv-BI / Projas / warpflow names are GitHub-adjacent for the same row, not a second intern.
99.9%, sub-210 ms, 40%, +65%, Redis −35%, 30 dashboards +60% are Ylogx. IQVIA has no uptime or latency percent on the resume.
LangChain SQL RAG is this product. LangGraph and LangSmith are IQVIA.
Live Code is Java. This intern tree is TypeScript and Python.

Tighten

Stop after the path and one number family. If they already heard this intern product this hour, speak the locked backup: Horizon GStreamer 60 FPS + costmap (Ownership) or GiftedBooks hours → 3–10 min if they want a different product.

How it was built — two services, Nest vs FastAPI

Two processes on purpose. Nest owns identity and SQL execution. FastAPI owns NL → structured SQL. Isolation stays on Nest’s transaction.

What they might ask

Why two backends?
Why NestJS and FastAPI instead of one service?
Could the LLM execute the SQL itself?

Resume-derived TypeScript NestJS + Python FastAPI SQL RAG. IE-asked leftover hours that ask why this stack. Other loop, not this Job ID.

What you say

Situation. The product needed login, three-tier isolation, dashboards, a report canvas, admin RBAC, and English-to-SQL. Putting the LLM on a table-owner connection would have made a JOIN the security boundary.

Task. I needed a place that knew the caller and a place that knew the schema well enough to write SELECT, without mixing those jobs.

Action.

NestJS (convbi-backend, Nest 11, Sequelize, Postgres pg): auth, JWT, RLS transaction, query engine, dashboards, reports, chat metadata, orgs/roles/policies/features, Tally upload. REST + Swagger at /api.
FastAPI (convbi-ai): POST /chatbot only. SQLQueryAndDetailsExtractor uses LangChain ChatOpenAI, allow-listed tables, Pydantic parser. It returns SQL and chart fields. It does not run warehouse SQL for the user.
Nest executeChatQuery fetches CHATBOT_API_URL (default https://chatbot.projas.in/chatbot), then executeRawSelectQuery on req.dbTransaction.

Result. SQL RAG +65 percent analysis productivity still sat behind three-tier RLS. The model never became the tenant filter.

They might ask next

If they ask	You answer
Why not generate SQL inside Nest?	The extractor is Python LangChain + SQLDatabase table info + a large Postgres prompt. Nest already owned the identity transaction. Split kept SET ROLE on the service that has `req.user`.
Does FastAPI see the JWT?	This tree’s `main.py` takes `query` and `options` only. Isolation is Nest execution, not a user JWT on FastAPI.
Gunicorn?	`convbi-ai/Dockerfile`: gunicorn, 8 Uvicorn workers, bind 0.0.0.0:80, timeout 180s. Nest Dockerfile is Node 18 Alpine, port 5000, `USER node`.

Keep straight

LangChain lives here. LangGraph / LangSmith live on IQVIA.
Sequelize, not Prisma. REST, not GraphQL.
Frontend package.json lists @google/generative-ai. The Ylogx bot path is Nest → FastAPI ChatOpenAI, not Gemini.

Tighten

Stop after the split and +65% if they are on the bot, or RLS if they are on isolation. Do not open IQVIA inside this answer.

Auth flow — signup, OTP, signin, refresh

From auth.service.ts and the frontend interceptor. Tokens live in localStorage in this tree. Bearer on the wire.

What they might ask

Walk me through login.
How do you refresh the token?
What is in the JWT?

Resume-derived from auth.service.ts, jwt.util.ts, authService.tsx, axiosInterceptor.ts, useTokenRefresh.ts.

What you say

Situation. Users register on an organization email domain, activate with OTP, then call authenticated APIs.

Task. I needed signup that does not create an active password on day zero, signin that issues two JWTs, and a browser refresh path that does not wait for the first 401.

Action.

POST /auth/signup: reject if email does not include ORGANISATION_EMAIL. Create user isActive: false, empty password, role USER, 6-digit OTP, email with OTP + activate link (signToken({ email })).
POST /auth/activate: verify token + OTP, bcrypt hash (salt 10), isActive: true, clear OTP.
POST /auth/signin (excluded from JWT middleware): lookup, require active, bcrypt.compare. Access JWT payload: email, guid, role, isActive, passwordUpdatedAt, client_id, organizationId. Refresh JWT: guid + email. Response prefixes both with Bearer . Frontend setAuthData writes localStorage.
Axios request interceptor: strip a leftover Bearer , set Authorization: Bearer ${clean}. useTokenRefresh / initTokenRefresh: default 15 minutes (VITE_TOKEN_REFRESH_INTERVAL), POST /auth/refresh-token with the refresh token (middleware-excluded). Rotate both tokens. App.tsx also re-reads auth every 30s; focus triggers refresh if due. 401 clears storage and goes to /login.

Result. Authenticated GETs carry identity into RLS. Access expiry in this ECS task definition is JWT_EXPIRATION_TIME=1h; refresh 7d. Those are env names from the task file, not a billed SLA.

They might ask next

If they ask	You answer
Forgot password?	`POST /auth/forgot-password` emails a reset token. `POST /auth/update-password` with token + new password. Logged-in reset is `POST /auth/reset-password` with old + new.
Is refresh stored in the DB?	`refreshAccessToken` verifies the refresh JWT and loads the user by `guid`. It does not look up a stored refresh-token column in the snippet I shipped.
Axios timeout?	Interceptor client is 10s. Chatbot `sendChatMessage` uses `fetch` to `/queryDB/chat-query` without that 10s cap, which matches a slow LLM hop.

Keep straight

This tree: Bearer header + localStorage. Cookie markdown exists; see Cookie vs Bearer.
Signup/signin/refresh/activate/forgot/reset/update-password/resend-otp are middleware-excluded in app.module.ts.
99.9% is uptime on the serving path, not “login p99.”

Tighten

Stop after Bearer in, identity on req.user, refresh every 15 minutes. Next door they usually want is RLS, not SMTP details.

Full middleware pipeline

From main.ts, app.module.ts, and architecture-docs/03. FinishTransaction registers first and commits last.

What they might ask

What runs on every request?
Where does the transaction start and end?
Which routes skip auth?

Resume-derived architecture-docs/03 + main.ts + app.module.ts.

What you say

Situation. Every authenticated query had to see the same Postgres role, including generated SQL.

Task. I needed a pipeline that decodes identity, opens one transaction, sets the role, runs the handler, then closes the transaction when the HTTP response finishes.

Action. Order as the process actually boots:

CORS: origin: process.env.CORS_ORIGIN || '*', credentials true.
Body parser JSON + urlencoded, 50mb (report JSON).
Global ValidationPipe: whitelist, forbidNonWhitelisted, transform.
FinishTransactionMiddleware in main.ts: res.on('finish') → tx.commit(), rollback only if commit throws.
JwtMiddleware then RLSMiddleware on path: '*' except health + public auth.
Controller + service use req.dbTransaction.
Global LoggingInterceptor logs method, URL, user email, duration. Global AllExceptionsFilter.

Result. Dashboards and SQL RAG share the same role mapping. Isolation is not a React hide. 99.9 percent uptime is the serving path that already had this pipeline, not a separate security product.

They might ask next

If they ask	You answer
Excluded routes?	`health`, `healthcheck`, `health/simple` (all methods). POST: `auth/signup`, `signin`, `resend-otp`, `activate`, `forgot-password`, `reset-password`, `update-password`, `refresh-token`.
Does FinishTransaction inspect statusCode?	No. The docs diagram says commit on success / rollback on error. The function commits on `finish` whenever `req.dbTransaction` exists. Name that if they open the file. See failure classes.
ValidationPipe vs middleware?	Pipes run on the route handler. JWT/RLS are Nest middleware. Logging is an interceptor around the handler.

Keep straight

JwtMiddleware reads Authorization Bearer. It does not read cookies in this file.
Pool max 20, acquire 30000, idle 10000 lives in sequelize.module.ts — same numbers as backend-docs docker chapter.
Older latex mentions CodeBuild. The resume hop and this repo’s workflows are GitHub Actions → ECR → ECS.

Tighten

Stop after CORS → body → finish-register → JWT → RLS → handler → commit on finish. Unpack SET ROLE on the RLS card, not here.

RLS algorithm — SUPER_ADMIN / ADMIN / USER / rls_no_access

One transaction. One SET ROLE. Fail closed. First db_role_name only.

What they might ask

How does row-level security work?
What if the user has no roles?
Why not filter in the application WHERE clause?

Resume-derived three-tier RLS + RBAC from rls.middleware.ts + architecture-docs/03 and 07.

What you say

Situation. A generated JOIN that was legal SQL could still cross an organizational tier if it ran as table owner. App-only WHERE org_id = ? was the incomplete demo.

Task. I needed every authenticated request — dashboards, report joins, chatbot SELECT — to run as a non-owner Postgres role whose policies already knew the caller.

Action. Algorithm in RLSMiddleware:

sequelize.transaction(). Keep it open on req.dbTransaction.
SUPER_ADMIN: RESET ROLE. set_config app.is_SUPER_ADMIN=true, app.is_admin=true, app.current_user_id, app.user_role=SUPER_ADMIN, empty app.organizationId. Full access path.
ADMIN: load SYSTEM-scope roles. If any have db_role_name, SET ROLE the first one, app.is_admin=true, app.admin_hierarchy_filter=true, org id. If SYSTEM roles exist but none have db_role_name, or zero SYSTEM roles: SET ROLE "rls_no_access" (the old RESET ROLE fallback leaked).
USER: load SYSTEM + ORGANIZATION roles with policies. If any db_role_name: SET ROLE the first (Postgres one active role). Collect policyRole names and allowedModules. Resolve tables from ModuleRegistry.tables onto req.user.allowedTables. Else: rls_no_access and noDataAccess=true.
Zero roles: same rls_no_access + noDataAccess.
set_config(..., true) is transaction-local. On middleware error: rollback, next(error).

Result. Three-tier isolation sat in Postgres. The product held 99.9 percent uptime on the path that already used this mapping. I discarded Nest-only filters as the tenant boundary.

In plain words

Postgres, not the React sidebar, decides which rows exist. A chatbot JOIN that forgets a predicate still loses the other organization’s rows at the policy.

They might ask next

If they ask	You answer
Why only the first db_role_name?	Postgres `SET ROLE` is one role. I pick `rolesWithDbRole[0]`. Extra roles still contribute policy module GUIDs for `allowedTables`.
What is rls_no_access?	A restricted Postgres role used when ADMIN/USER cannot be mapped to a real `db_role_name`. Fail closed. Empty warehouse, not RESET ROLE.
What lands on req.user?	From JWT: userId, role, email, client_id, organizationId. From RLS: dbRoles, dbRoleNames, policyRoleNames, allowedModuleGuids, allowedTables, roleModuleMapping, rlsConfigured, maybe noDataAccess.
GUEST?	Enum exists. Query and dashboard services reject GUEST. RLS still runs if a GUEST token hit a protected route.

Keep straight

Three-tier RLS + RBAC is this Ylogx product. GiftedBooks 99.5% is a different product.
I for the middleware I implemented. Intern, not a named security org.
Dashboards also have an application clientFilter fallback when dbRoleNames is empty. Primary story remains SET ROLE + policies.

Tighten

Stop after fail-closed rls_no_access and first db_role_name. If they already heard Ylogx isolation this hour, speak Horizon GStreamer + costmap.

SQL RAG end to end — Nest chat-query → FastAPI → allow-list → RLS txn

The model writes SELECT. Nest checks tables and runs it as the caller. That is the whole point of the split.

What they might ask

How does the chatbot turn English into rows?
How do you stop the model from reading another tenant?
Show me the sequence.

Resume-derived LangChain SQL RAG +65%. Code: executeChatQuery, extractor.py, chatbot.ts.

What you say

Situation. Operators who were not SQL users still needed warehouse facts. Pasting rows into a prompt truncated data. A chatbot that executed as table owner would have served the wrong customer.

Task. English in, inspectable SELECT and rows out, same isolation as dashboards.

Action.

UI sendChatMessage POSTs /queryDB/chat-query with { query, options } and the Bearer token (chat CRUD of the bubble is a separate /chat/:id/messages call).
Nest executeChatQuery POSTs JSON to FastAPI /chatbot.
FastAPI extractor: schema validate, LangChain prompt + ChatOpenAI temperature 0, Pydantic SQLQueryAndDetails. WITH-only SQL is wrapped to SELECT * FROM (… ) q so Nest’s SELECT prefix check passes.
If eventQuery is present, Nest executeRawSelectQuery: must start with select; regex FROM/JOIN table names; hasTableAccess per table; optional org predicate inject; run on dbTransaction.
Return data + chatMessage + chartType/xAxis/yAxis/series to the SPA. ElementRenderer draws the chart. SQL errors still return the chatbot message with showChart: false.

Result. SQL RAG improved analysis productivity 65 percent. Isolation stayed three-tier RLS. That 65 percent is analysis productivity, not model accuracy. I do not have the study protocol on the resume.

Data flow

Browser → Nest JWT/RLS txn open → FastAPI (no user role) → SQL string → Nest allow-list + execute on txn → Postgres RLS → JSON to browser. Chat title rows use executeWithoutRLS on a different transaction. Warehouse never does.

They might ask next

If they ask	You answer
Which tables can the model see?	`SQLDatabase(include_tables=…)`: accounting_transaction, bs, cashflow_bank, cashflow_others, inventory_stk_masters, inventory_stk_vouchers, outstanding_payable, outstanding_receivable, pl, sales. Nest still allow-lists whatever SQL comes back.
Does FastAPI run the SELECT?	No. `engine.py` exists so LangChain can call `get_table_info()`. User rows execute in Nest on `req.dbTransaction`.
Redis?	Resume: cache-aside on the bot path, −35% bot database latency, tier in the key. This Nest `package.json` has no Redis. See fields Map and 10×.

Keep straight

+65% is SQL RAG productivity on Ylogx. −35% is bot DB latency (Redis on the resume). sub-210 ms is dashboards with no LLM on that GET.
gpt-4.1 is in extractor.py if they open the repo. The resume PDF does not name the model. Do not put the model name on the PDF story unless they have the file open.
Gemini is not this bot.

Tighten

Stop after generate-on-FastAPI, execute-on-RLS, +65%. If they already heard this bot this hour, unpack RLS or dashboards on the same product, or switch to GiftedBooks 3–10 min only if they change product.

convbi-ai prompts, schema validator, WITH wrap, Pydantic, temperature 0

The FastAPI service is a constrained SQL writer, not a free chat model.

What they might ask

How do you keep the model from writing DELETE?
What does the parser enforce?
What is temperature?

Resume-derived from prompts.py, extractor.py, schema_validator.py, main.py.

What you say

Situation. A report-generator chatbot that emitted INSERT or a missing ROUND cast would fail in Postgres or worse.

Task. I needed structured JSON the Nest layer could execute, with schema that matched live tables.

Action.

Pydantic SQLQueryAndDetails: eventQuery (SELECT or null), chatMessage, toFormat, showChart, dataPeriod ISO dates, chartType enum, relevantColumns, xAxis, yAxis, series, interval, has_explicit_limit.
System prompt: read-only; no INSERT/UPDATE/DELETE/…; no trailing semicolon; Postgres ROUND((expr)::NUMERIC, n); qualify joins; treat 0 as data; empty period → polite message, showChart false, chartType table.
ChatOpenAI(model="gpt-4.1", temperature=0) on the SQL extractor override. Parser is LangChain PydanticOutputParser.
If eventQuery is WITH and not SELECT, wrap: SELECT * FROM ({cte}) q.
validate_and_sync_schema compares SQLDatabase.get_table_info() to config.table_descriptions. auto_sync=True rewrites config.py placeholders on drift; extractor logs and continues on ValueError.

Result. The bot returned inspectable SQL plus chart metadata the shared ElementRenderer could draw. Productivity +65 percent is the resume family for this path.

They might ask next

If they ask	You answer
Is temperature 0 perfect SQL?	It reduces sampling noise. Nest still allow-lists and RLS still filters. Temperature is not the tenant boundary.
FastAPI CORS?	`allow_origins=["*"]`, credentials true, all methods/headers. Nest is the browser’s API. Name the star if they open `main.py`.
BaseExtractor default model?	Unused SQL path default in BaseExtractor comments/signature mentions gpt-4o-2024-08-06. The override that runs is gpt-4.1.

Keep straight

Model name is repo fact, not a resume bullet.
LangSmith traces are IQVIA. This extractor logs with Python logging.

Tighten

Stop after Pydantic fields, temperature 0, WITH wrap, schema validator. Do not recite the whole ROUND essay unless they open the prompt file.

executeWithoutRLS honesty

A second transaction with RESET ROLE. Chat metadata tables only. Never warehouse SQL RAG.

What they might ask

I see RESET ROLE in ChatService. Does that bypass RLS?
Why not use req.dbTransaction for chats?

Resume-derived chat.service.ts + architecture-docs/05.

What you say

Situation. After RLSMiddleware, SET ROLE is a warehouse role. Chat tables (chats, chat_messages, favorites, feedback) often were not granted to that role, so conversation CRUD failed even when the user was allowed to talk.

Task. Persist the thread without running warehouse SELECT as table owner.

Action. executeWithoutRLS opens a new Sequelize transaction, RESET ROLE, runs the callback (createChat, getChats, messages, favorites, feedback), commit/rollback on that txn. Application still sets userId / organizationId on chat rows. Warehouse executeChatQuery never calls this helper — it uses executeRawSelectQuery(..., req.dbTransaction).

Result. Threads saved. Isolation for sales/receivables/… stayed on the RLS transaction. Three-tier RLS on the resume is that warehouse path.

They might ask next

If they ask	You answer
Is this fail-open for money tables?	No. It is chat metadata. I will say that in the first sentence if they highlight RESET ROLE.
Two transactions per chatbot turn?	Yes: request txn (SET ROLE, warehouse SQL) plus a short RESET ROLE txn for the message row.
pg_policies listing?	`getAllowedTables` also runs without the RLS transaction so a restricted role can still read policy catalog. That is table-name discovery, not warehouse row read.

Keep straight

RESET ROLE in ChatService ≠ SUPER_ADMIN RESET ROLE in RLSMiddleware. Different call sites, different jobs.
systemAccessibleTables in applicationTables.ts lists chats/users/roles/… — still not the SQL RAG path.

Tighten

One sentence: metadata bypass, warehouse still SET ROLE. Stop.

Query engine — tables, columns, joins, slicers, pagination, fields Map

Report builder and slicers speak this API. The bot speaks chat-query. Same hasTableAccess.

What they might ask

How does the report builder get data?
How do filters work?
Do you cache schema?

Resume-derived queryDB.controller.ts / queryDB.service.ts.

What you say

Situation. The canvas needed table lists, typed columns, joins, distinct slicer values, and filtered row pages — all under the same policies as dashboards.

Task. Dynamic SQL without a GraphQL schema, without Prisma.

Action.

GET /queryDB/tables: SUPER_ADMIN = public base tables minus system names. ADMIN = policy modules → ModuleRegistry tables. USER = req.user.allowedTables or pg_policies via policyRoleNames.
Columns: information_schema via getTableColumnsWithTypes.
POST /queryDB/execute-query: quote main/join tables, INNER/LEFT/RIGHT/FULL JOIN, ON ${joinCondition}, date BETWEEN, org predicate if the table has organizationId, LIMIT default 1000 max 5000, run on RLS txn. Optional monthly/yearly reduction in process.
Slicers: GET .../fields, POST .../field/:col/values (page/pageSize max 1000), POST .../dataset/:table/query (limit max 10000, offset, operators in/equals/greater/less/between/contains/starts_with/ends_with).
fieldsCache: in-memory Map, key fields:${tableName}, 5 minute TTL, SHA1 etag. Column metadata only, not row cache, not Redis.

Result. Report generation 40 percent faster on this identity-to-SQL path. I do not have the study protocol on the resume.

They might ask next

If they ask	You answer
Is the Map per user?	Key is table name only. Values are field names/types. Wrong-tenant column lists would be a metadata leak, not dollar rows. I would namespace by org if we scaled that cache.
Redis in package.json?	No redis/ioredis in Nest dependencies. Resume Redis is the bot cache-aside family (−35%). This tree’s schema cache is the Map.
execute-raw-sql?	Same `executeRawSelectQuery` as the bot. SELECT prefix + table allow-list + org inject.

Keep straight

5 minute TTL is this Map, documented in code. It is not a resume p95 and not the Redis story.
40% is report builder speed. +65% is SQL RAG productivity. Different families.

Tighten

Stop after tables → join execute-query → slicer filters → Map 5 min. Name JOIN interpolation only if they open executeQuery.

Nine dashboard types, filters, no LLM, N+1, Chart.js vs Recharts

Resume speaks 30 KPI tiles. The registry has 9 predefined types, some multi-page. No model on those GETs.

What they might ask

How do dashboards stay fast?
Why does the PDF say 30 and the code say 9?
Recharts or Chart.js?

Resume-derived 30 dashboards +60%, sub-210 ms. Code: dashboards.controller.ts, modules/dashboard/App.tsx PREDEFINED_DASHBOARDS.

What you say

Situation. Operators waited on ad-hoc reports. Putting a model call on every KPI tile would have made the home page a chatbot.

Task. Fixed SQL aggregations, month/year filters, RLS, numbers and labels in JSON.

Action.

Nine types in the frontend registry: overview (1 page), sales (6), receivables (5), payables (3), stock (2), collections (3), profitLoss (1), balanceSheet (1), cashflow (2). APIs: /dashboards/overview|sales|receivables|payables|stocks|collections|profit-loss|balance-sheet|cashflow.
DashboardFiltersProvider: months[], years[], currency lakhs|actual, persisted dashboardFiltersState_v2. Query string ?months=05&years=2025. “All” expands on the client. Empty selection can stub without calling the API.
Service comment: access by Postgres RLS on req.dbTransaction. One GET runs many sequential sequelize.query aggregations (on the order of 80 query call sites in the service file across types) — N+1-style round trips on one transaction, not one SQL per tile from the browser, and not an LLM.
Resume Recharts. Report canvas ElementRenderer is Chart.js. Predefined pages mix: e.g. SalesPage4 Recharts, SalesPage5 / CollectionsPage1 Chart.js. Redux Toolkit is a frontend dependency.

Result. Sub-210 milliseconds on dashboard serving. Thirty tiles, 60 percent operational efficiency. 99.9 percent uptime. I do not have the study protocol on the resume.

They might ask next

If they ask	You answer
30 vs 9?	Speak resume 30 KPI tiles. If they have the registry open, name nine types and page counts. Tiles live across those pages, not nine lonely charts.
Custom dashboards?	Card layout in localStorage `dashboardState`. Predefined financials are API-backed.
last-updated?	`GET /dashboards/last-updated?dashboard=` and detailed-update-info exist on the controller.

Keep straight

sub-210 ms is dashboards, no LLM. Redis −35% is the bot database path on the resume.
Recharts is the resume word. Chart.js is the report canvas library in this tree. Both exist in the SPA.
StratifyLabs −30% is ML iteration, not these dashboards.

Tighten

Stop after no-LLM GET, 30 tiles, sub-210 ms. If they already heard dashboards, unpack RLS on the same product or switch to Horizon only if they leave Ylogx.

Report builder — five phases, react-dnd, saved JSON

Architecture-docs/04. Power-BI-shaped canvas. SQL from queryDB. Charts from ElementRenderer.

What they might ask

How does the report builder work?
How is a report saved?
Drag and drop — what library?

Resume-derived 40% faster reports. Code: reportBuilder + reports.service.ts.

What you say

Situation. Analysts needed custom visuals from warehouse tables without a new dashboard ticket each time.

Task. A canvas that loaded RLS-filtered rows and persisted layout as JSON.

Action. Five phases:

Data source: Utilitybar step 1, GET /queryDB/tables.
Joins and columns: INNER/LEFT/RIGHT/FULL, GET /queryDB/tables/:t/columns-with-types.
Fetch: single table or POST /queryDB/execute-query.
Chart building: DndProvider HTML5Backend, drag columns onto ChartDropZone, ElementRenderer → Chart.js Bar/Line/Pie/Area/Doughnut (and table). react-rnd, 15px snap, PageManager multi-page.
Canvas / slicers / save: SlicerPanel uses dataset fields + values + query. Save: POST /reports name + data JSON (pages, elements, canvasSize). Load GET /reports / GET /reports/:id. Soft delete. GUEST blocked. Export is client html2canvas + jsPDF.

Result. Report generation 40 percent faster. Same identity-to-role path as the bot. I do not have the study protocol on the resume.

They might ask next

If they ask	You answer
Who can load whose report?	List filters `createdBy: userId`. getReport by guid with isDeleted false — I will not claim a second RLS policy on the JSON blob unless they open a Postgres policy file.
Body size?	50mb parser in `main.ts` for that JSON.
Chatbot charts?	Same ElementRenderer, `isChatbotChart=true`, plus normalizeChartType for model strings (stackedcolumn → stackedColumn, unknown → bar).

Keep straight

40% is reports. +60% is dashboard ops. +65% is SQL RAG. Three families.
Canvas charting in this tree is Chart.js. Resume lists Recharts.

Tighten

Stop after five phases and 40%. If they already heard reports, speak RLS or SQL RAG on this product, not a fourth trophy.

Tally zip → S3 → gateway

Ingestion is not the chatbot. Two steps, then an external processor.

What they might ask

How does data get into the warehouse?
Walk me through file upload.

Resume-derived fileUpload.controller.ts / fileUpload.service.ts + backend-docs/06.

What you say

Situation. Client Tally backups arrive as zip files, sometimes two years.

Task. Accept zip only, land in S3, tell the gateway where to read.

Action.

POST /file-upload/tally, multipart, FilesInterceptor max 2 files, 200MB multer cap, memory storage, extension + MIME zip check.
Sanitize filename, key tally-uploads/${Date.now()}-${name}, @aws-sdk/lib-storage Upload, region default ap-south-1, return s3://bucket/key.
POST JSON to TALLY_GATEWAY_URL (default https://tallygw.projas.in/instance/create) with x-api-key, client_id, uploaded_by, period, credentials object, zip S3 URIs, 30s axios timeout.

Result. Step1 S3 URI + step2 gateway response. I did not own the gateway’s unpacker internals. Warehouse queries after load still use RLS.

They might ask next

If they ask	You answer
Why memory storage?	Multer buffer → S3 Upload. Large zips are a scale limit I would move to streaming at 10×. See honest 10×.
Does this skip JWT?	No. file-upload is not in the exclude list. Bearer + RLS still run. Gateway call is a server-side HTTP POST with an API key from config.

Keep straight

S3 here is Tally landing, not CloudFront static hosting. Resume CloudFront is the SPA hop.
Do not paste gateway keys or bucket passwords into the hour.

Tighten

Stop after zip → S3 URI → gateway POST. Spark is not in this upload module; the next hop is the Tally gateway HTTP POST.

Admin RBAC — orgs, roles, policies, features, hierarchy, module registry

Who may open a route is features. Who may see a row is roles → policies → Postgres. Controllers in this tree do not all match the latex short names.

What they might ask

How is RBAC modeled?
What does an admin actually click?

Resume-derived architecture-docs/07 + Nest modules. Three-tier RLS + RBAC on the resume.

What you say

Situation. Multi-tenant BI needed organizations, assignable roles, policies that name modules/tables, and a UI for admins.

Task. CRUD that RLSMiddleware could resolve into SET ROLE and allowedTables.

Action. Graph: User → UserRole → Role (db_role_name, SYSTEM|ORG) → RolePolicy → Policy (allowedModules[], policyRole). Policy modules resolve through ModuleRegistry to table names. Features are a parallel UserFeature graph for routes. Hierarchy: /user-hierarchy sub-admins, assign, bulk-assign, transfer (super-admin operations in the controller summaries). Admin SPA: /dashboard/admin overview, users, roles, policies, features, tables, custom-expressions.

Result. Three-tier isolation could be configured without a code change per customer. 99.9 percent uptime is the serving path, not “admin UI SLA.”

They might ask next

If they ask	You answer
Exact prefixes?	`/organizations`, `/role-management`, `/policy`, `/feature-management`, `/module-registry`, `/user-hierarchy`, `/overview`. Latex diagrams sometimes say /roles /policies /features. Speak the controller path if they open the file.
Who reaches admin?	Architecture: ADMIN or SUPER_ADMIN. FeatureAccess: SUPER_ADMIN all routes; everyone else needs an assigned feature route. ADMIN is not a blanket UI pass.

Keep straight

RBAC config tables are application tables. Warehouse RLS is on business tables like sales.
IEDC / mentee counts are not this story. No mentee number on the resume.

Tighten

Stop after User–Role–Policy–ModuleRegistry and features as a second axis. Unpack SET ROLE on the RLS card.

Chat CRUD vs warehouse

Two APIs on one screen. Do not merge them in the spoken answer.

What they might ask

How are conversations stored?
Is chat history RLS-protected the same way as sales?

Resume-derived architecture-docs/05 + chat.controller.ts.

What you say

Situation. The SPA needed threads, favorites, and feedback, plus answers that were real warehouse numbers.

Task. Persist UX state without putting chat rows on the SQL generator connection.

Action. ChatContext: POST/GET /chat, GET/POST /chat/:id/messages, delete, favorites toggle, message favorite, feedback, liked-messages, PUT message. Those services use executeWithoutRLS. The answer body comes from POST /queryDB/chat-query on the RLS transaction. Frontend maps chart types, then ElementRenderer.

Result. +65 percent analysis productivity is the warehouse answer quality/speed family, not “we stored more chats.”

They might ask next

If they ask	You answer
Metadata on the bot message?	Architecture: sender bot, metadata holds data/chartType/axes. Models: ChatMessage metadata JSON.
Does chat-query persist SQL?	The query endpoint returns JSON to the client. Persistence is the separate createMessage call.

Keep straight

Chat CRUD RESET ROLE ≠ warehouse executeRawSelectQuery.
GiftedBooks RAG is a different product (PDF + VR). This bot is SQL RAG on Tally-shaped tables.

Tighten

Two bullets: metadata CRUD, warehouse SELECT. Stop.

FeatureAccess frontend vs DB RLS

Hiding a menu is not isolation. Both exist. They answer different failures.

What they might ask

How do you authorize routes?
If I hide the chatbot link, can I still POST chat-query?

Resume-derived FeatureAccessContext.tsx + RLS middleware.

What you say

Situation. Not every user should see Report Designer. Every user who can see Sales still must not see another org’s invoices.

Task. Route toggles in the SPA, row filters in Postgres.

Action. FeatureAccessProvider GET /feature-management/user-features/:userId (30s debounce unless forced). hasFeatureAccess(route): SUPER_ADMIN true; else userFeatures.some(f => f.route === route). ProtectedRoute wraps /dashboard, /chatbot, /reportdesigner, /upload. Axios 403 with “feature”/“access” fires a custom event. RLS still SET ROLE on the API even if someone forges a fetch. Features do not replace policies.

Result. Three-tier RLS remained the row boundary. Feature flags remained the product-surface boundary.

They might ask next

If they ask	You answer
Is FeatureAccess a security control?	It is UX + a 403 path. The control I defend for tenant rows is SET ROLE + policies. I will not call a React context “RLS.”
ADMIN blanket access?	No. Only SUPER_ADMIN short-circuits hasFeatureAccess.

Keep straight

Earn Trust backup on Ylogx is 3-tier RLS, not FeatureAccess.
IQVIA ranking/evals are a different intern.

Tighten

One line each: features = routes, RLS = rows. Stop.

Dockerfile, compose, GitHub Actions, ECS task vs service, health

Resume hop: GitHub Actions / CI/CD + ECS. This repo’s workflows match that. Older latex CodeBuild is a docs leftover. Not EKS.

What they might ask

How do you deploy?
ECS task or service?
How does health work?

Resume-derived CloudFront / ECS / Docker / ALB / Route 53. Code: Dockerfiles, convbi-prod.yml, convbi-qa.yml, task-definition.json shape (no secret values spoken).

What you say

Situation. The API had to ship to ap-south-1 without a named SRE title on my intern row.

Task. Containerize Nest, push an image, let ECS run it behind the load balancer the resume names.

Action.

Backend Dockerfile: node:18.18.2-alpine3.18, curl, npm install --force, nest build, EXPOSE 5000, USER node, node dist/main. Compose maps 5000:5000 and injects DB/JWT/SMTP env from a file. Pool max 20 in Sequelize.
Frontend: Node 20 build → nginx:stable-alpine, port 80. AI: python:3.12-slim, gunicorn 8 workers, port 80, HEALTHCHECK /health.
Prod workflow: push main, environment production, AWS ap-south-1, ECR repo convbi-backend, build/push :sha and :latest, render task def, manual approval Arjun-ylogx (timeout 3 minutes, minimum 1), deploy service convbi-backend-service on cluster convbi-cluster, wait for stability.
QA workflow: push qa, environment qa, tag :qa, same cluster/service/task file, no approval step.
Task definition is the recipe: Fargate compat, 1024 CPU / 3072 memory, awsvpc, container port 5000, awslogs /ecs/convbi-backend, health curl -f http://localhost:5000/health. The service is what the workflow updates so tasks stay running. Terminus: /health and /healthcheck ping Postgres; /health/simple is process-alive JSON without a DB ping.

Result. 99.9 percent uptime on that CloudFront / ALB / ECS / Docker path. I did not operate EKS. I do not have the study protocol on the resume.

What I did not own

A named on-call rotation. Desired count is not in the task file I read. Kafka. EKS. I will not quote RDS hostnames, JWT secret strings, or SMTP passwords from the task file.

They might ask next

If they ask	You answer
CodeBuild?	backend-docs/01 and 07 mention CodeBuild on a development branch. The checked-in workflows and the resume hop are GitHub Actions → ECR → ECS.
Launch type?	Task JSON `requiresCompatibilities: ["FARGATE"]`. I will not invent a desired count.
POSTGRES_PASSWORD?	Task file pulls that one from Secrets Manager. Other env vars sit in the plaintext environment array in that JSON. I will name the pattern, not the values.

Keep straight

ECS Fargate task + service in this repo. Kubernetes is listed on the resume skills line; shipped intern hop is ECS. See chapter 11 k8s card if they open the PDF skills list.
99.9% is Ylogx. GiftedBooks is 99.5%.

Tighten

Stop after Actions → ECR → approval (prod) → ECS service, port 5000, Terminus /health. No EKS sentence.

Logging interceptor

Every HTTP call gets a duration line. Debug redacts secrets. SQL logging is a separate Sequelize flag.

What they might ask

How do you debug a slow request?
Do you log passwords?

Resume-derived logging.interceptor.ts, LOGGING_GUIDE.md, Sequelize logging in sequelize.module.ts.

What you say

Situation. A chatbot pause could be the model, the allow-list, or Postgres. Instinct blamed the LLM.

Task. See method, URL, user, status, milliseconds, without writing passwords to stdout.

Action. Global interceptor: inbound → [METHOD] url | User | IP. Outbound duration + status. Errors with stack. If LOG_LEVEL=debug, body is copied with password/token/secret/apiKey/authorization set to ***REDACTED***. QueryDB chat/execute paths add their own event logs (SQL truncated). Sequelize logs SQL when SQL_LOGGING=true or NODE_ENV=development; guide says slow queries >1s warn. CustomLogger is the Winston-like singleton used by AuthService and bootstrap.

Result. Bot database latency could be argued with timestamps. Resume −35% is the Redis family on that measured bot DB path. I do not have the study protocol on the resume.

They might ask next

If they ask	You answer
Datadog?	Not in this tree. CloudWatch awslogs group `/ecs/convbi-backend` from the task definition.
JWT decode logs?	`jwt.middleware.ts` `console.log`s the decoded payload. I will name that if they open the file. The interceptor is the redacting path.

Keep straight

−35% is Redis/bot DB on the resume. Interceptor duration is how I would show a later hour “I looked at timestamps,” not a second percent.
No Datadog, no p95 on the resume.

Tighten

Stop after duration + redact + SQL_LOGGING. Switch to Redis/RLS Dive Deep if they want the LP, still this product.

Cookie markdown vs Bearer in jwt.middleware.ts

If they open the markdown, say what it describes. If they open the middleware, speak Bearer. This tree matches Bearer.

What they might ask

Do you store JWT in cookies?
I found COOKIE_AUTH_IMPLEMENTATION_COMPLETE.md.
How does the browser send the token?

Resume-derived jwt.middleware.ts, package.json, COOKIE_AUTH_IMPLEMENTATION_COMPLETE.md, axiosInterceptor.ts.

What you say

Situation. A markdown file in the repo describes HTTP-only cookies, cookie-parser, req.cookies.accessToken first, tokens omitted from the signin JSON, POST /auth/logout, withCredentials: true.

Task. Answer the tree they have open, not a migration essay.

Action. In the Nest I can point to today: JwtMiddleware splits Authorization, requires the word Bearer, jwt.verify with JWT_ACCESS_SECRET. package.json has jsonwebtoken and bcrypt, not cookie-parser. Signin returns tokens in JSON. Frontend writes localStorage and sets the header. Refresh is a JSON body. I shipped that Bearer path. The markdown is a completed-migration write-up that this snapshot does not implement in middleware.

Result. Honest: XSS can read localStorage. The markdown’s threat model is real. I will not describe internships as cookie-session if they are looking at jwt.middleware.ts.

They might ask next

If they ask	You answer
Would you migrate?	Yes: HTTP-only cookie, CSRF SameSite, CORS explicit origins (Nest already has credentials true; wildcard origin is the loose default). That is a next change, not what this file does.
Swagger?	`addBearerAuth` in `main.ts`. Matches the header path.

Keep straight

Bearer in jwt.middleware.ts. Cookie story in the markdown file. Speak the open file.
GiftedBooks 99.5% is unrelated to this cookie write-up.

Tighten

One sentence: this snapshot is Bearer + localStorage. Stop unless they want the XSS follow-up.

Failure classes from this tree

Things the files actually do. Name them if they open the line. Do not volunteer a confession dump in the 90s intro.

What they might ask

Where can this leak data?
What would you fix first?
Is the SQL generator safe?

Resume-derived from the files named in each row. Not a Job 10454435 question list.

What you say

Situation. They paste a function. I need the real behavior, not the architecture diagram caption.

Task. Name the class, the file, what still holds (RLS on the execute path), what I would change.

Action. I keep a short list:

JOIN leak (app SQL): executeQuery concatenates ON ${joinCondition}. Table names are quoted; the condition is not a bound identifier list. RLS still applies to the SELECT, but a crafted condition is injection into that statement.
FinishTransaction commit-on-finish: commits whenever finish fires. It does not read res.statusCode. Diagrams say rollback on error. HTTP 500 can still commit the open txn.
CORS * on FastAPI: allow_origins=["*"] with credentials true. Nest is the browser origin for product traffic; the AI service is still loosely opened.
SELECT prefix weakness: trimmed.startsWith('select'). Nested statements after a semicolon are not stripped. WITH is wrapped to start with SELECT. This is a prefix check, not a SQL parser. Table regex + hasTableAccess + RLS are the real backstops.

Result. I can still defend SET ROLE as the tenant boundary for warehouse SELECTs, and I can still name where the app is weaker than the diagram.

They might ask next

If they ask	You answer
Org id in SQL?	Several paths interpolate `organizationId` into a string predicate. Prefer bound replacements. RLS policies remain the row filter even if that string is wrong-shaped.
synchronize: true?	`sequelize.module.ts` autoLoadModels + synchronize true. That is schema-from-models in this config, risky in production. Flyway_schema_history is excluded from public table lists — migrations exist as a name, Sequelize sync is still on.
jwt console.log?	Decoded payload printed. Interceptor redaction does not cover that console.log.
fieldsCache key?	Per table, not per org. Metadata only.
Plaintext task env?	Pattern: some secrets in the task JSON environment list; DB password from Secrets Manager. I will not recite values.

Keep straight

These are this Nest/FastAPI tree. IQVIA evals/LangSmith are a different intern.
Fail-closed rls_no_access is the fix that already landed for the old ADMIN RESET ROLE leak. Name it as shipped, not as a future hope.

Tighten

If they open one file, answer that file. Do not list all five classes unless they ask “what else.”

Honest 10×

Same product. What the current mechanisms do under more tenants and more chatbot turns. No invented AWS bill.

What they might ask

What breaks at 10× traffic?
How would you scale this?
Why Redis if I don’t see it in package.json?

IE-asked leftover hours on scale (shape). Resume-derived pool 20, Fargate 1024/3072, N+1 dashboards, Redis resume vs Map in this tree.

What you say

Situation. One request holds a pool connection from RLS BEGIN until HTTP finish. Dashboards fire many SQL statements per GET. Chatbot turns wait on FastAPI (gunicorn timeout 180s, 8 workers) then a SELECT. Tally zips sit in memory before S3.

Task. Say what I would change without pretending the intern already ran a 10× load test. No p95 on the resume.

Action.

Pool vs open txn: max 20. 10× concurrent authenticated requests need more connections or shorter txn scope (SET ROLE still required). I would not skip RLS to free a slot.
Dashboard N+1: collapse aggregations per type into fewer round trips, still on the RLS txn. Keep no LLM on the GET so sub-210 ms stays a serving story.
Bot cache: resume Redis cache-aside, tier in the key, −35% bot DB. This Nest tree’s Map is process-local and fields-only; 10× ECS tasks would not share it. I would put Redis back on the bot path the resume names, still miss → RLS execute.
FinishTransaction: commit vs rollback on status; do not hold a write lock across a 180s LLM wait — generate SQL first, then a short execute txn, or stream status without pinning the role for the whole HTTP call.
Upload: stream to S3, not 200MB buffers. Gateway stays async.
AI: worker count and timeout are Dockerfile facts. Scale the extractor separately from Nest so dashboard GETs do not share that 180s budget.

Result. Isolation stays SET ROLE. Speed families stay split: dashboards sub-210 ms, bot Redis −35% on the resume. I do not have a 10× measurement on the PDF.

They might ask next

If they ask	You answer
Shard Postgres?	Not on the resume. First knobs are pool, query count, cache, txn length. I will not invent a sharding design as shipped.
Kafka?	Not on the internship bullets or this package.json.
Bigger Fargate task?	Current recipe is 1024 CPU / 3072 MB. Spend is a last knob after N+1 and cache, same Frugality story as Redis vs bigger RDS.

Keep straight

Redis −35% belongs on the Ylogx bot path in the PDF. Nest package.json in this snapshot has no Redis client.
Argus 20+ cameras is a different product’s scale story.

Tighten

Three knobs: connection lifetime, dashboard query count, bot cache. Stop. If they already heard Ylogx Frugality, do not restart Redis — they already have −35%.

If they open GitHub — Conv-BI / Projas / warpflow

Resume wins. Folder names are not extra internships.

What they might ask

Your GitHub says Conv-BI / Projas. The resume says Ylogx.
Is warpflow the intern project?
Frontend package name is projas-frontend.

Resume-derived GitHub-adjacent naming. Job 10454435 still none.

What you say

Situation. They have a repo titled Conv-BI or a package projas-frontend, or they saw warpflow.

Task. Map the name to the August 2026 Ylogx row in one sentence, then unpack a mechanism if they stay.

Action. Conv-BI / Projas is the product hostname and repo label for the Ylogx intern BI system (Nest + React + FastAPI SQL RAG). Host strings in code include chatbot.projas.in and the Tally gateway on projas.in. warpflow is a GitHub-adjacent UI experiment, not the intern metrics. I speak Ylogx dates November 2024 to October 2025, 40% reports, 99.9%, +65% SQL RAG, 3-tier RLS, Redis −35%, 30 dashboards +60%, sub-210 ms, CloudFront/ECS/ALB/Route 53.

Result. One intern row. No second company invented from a folder name.

They might ask next

If they ask	You answer
GiftedBooks README is AegisAI?	Different repo. Resume GiftedBooks. Would fix the README. Not this BI product.
StratifyLabs README?	Next scaffold. Speak stratifylabs.design metrics. Not Ylogx.
valAgent / karyanode?	GitHub-adjacent. Not intern bullets. No 200+ merge onto Ylogx.

Keep straight

Ylogx intern = this BI codebase. IQVIA = current role April 2026–present. Horizon = rover 2024.
Login Tracker unverified — do not volunteer.

Tighten

Name map in one breath. Then wait. Do not dump Argus mAP onto a Projas question.

Rapid fire — 45 from this repo

Short answers. One line. If they linger, jump to the card named in the third column.

What they might ask

A burst of stack questions with the repo open.

Resume-derived this December 2025 tree. Other loop, not Job 10454435.

What you say

Situation. They click files faster than a STAR.

Task. Match the open file. One mechanism. Stop.

Action. Use the table. I for modules. Protocol sentence if a percent appears.

Result. They get the tree, not six products.

They might ask next

If they ask	You answer	Card
ORM?	Sequelize + sequelize-typescript.
API style?	REST. Swagger `/api`.
Auth header?	Bearer in jwt.middleware.ts.	18
Port?	Nest 5000. Frontend nginx 80. AI gunicorn 80.	16
Pool?	max 20, min 0, acquire 30s, idle 10s.	16
Body limit?	50mb.	4
Hash?	bcrypt salt 10. argon2 is in package.json unused in the auth path I walked.	3
OTP length?	6 digits.	3
Access TTL?	Env JWT_EXPIRATION_TIME; task file 1h. Refresh 7d.	3
Refresh interval FE?	15 min default.	3
SET ROLE count?	First db_role_name only.	5
No roles?	rls_no_access, noDataAccess.	5
SUPER_ADMIN SQL?	RESET ROLE + is_SUPER_ADMIN true.	5
ADMIN empty SYSTEM?	rls_no_access, not RESET ROLE.	5
Chatbot URL?	CHATBOT_API_URL or https://chatbot.projas.in/chatbot.	6
LLM temp?	0.	7
Model in repo?	gpt-4.1 in extractor override.	7
WITH queries?	Wrapped to SELECT * FROM (cte) q.	7
Redis package?	None in Nest package.json.	9
Fields cache?	Map, 5 min, fields:tableName.	9
Join types?	INNER LEFT RIGHT FULL.	9
execute-query limit?	Default 1000, max 5000.	9
Dashboard types?	9 predefined. Resume 30 tiles.	10
LLM on dashboard GET?	No.	10
Sales pages?	6.	10
Chart on canvas?	Chart.js via react-chartjs-2.	11
DnD?	react-dnd HTML5Backend + react-rnd.	11
Grid snap?	15px.	11
Tally max files?	2 zips.	12
S3 prefix?	tally-uploads/.	12
Region default upload?	ap-south-1.	12
Prod approver?	Arjun-ylogx.	16
ECR repo?	convbi-backend.	16
Cluster / service?	convbi-cluster / convbi-backend-service.	16
Fargate CPU/mem?	1024 / 3072.	16
Health with DB?	/health Terminus sequelize ping.	16
Health without DB?	/health/simple.	16
AI workers?	8 gunicorn UvicornWorker.	2
executeWithoutRLS?	Chat metadata RESET ROLE, new txn.	8
Gemini bot?	No. Package listed; bot is ChatOpenAI via FastAPI.	2
LangGraph here?	No. IQVIA.
Redux?	@reduxjs/toolkit in frontend package.json.	10
Feature controller?	/feature-management not /features.	13
Policy controller?	/policy.	13
Roles controller?	/role-management.	13
Include tables count?	11 warehouse names in extractor.py.	6

Keep straight

Rapid fire stays in this repo. Do not answer StratifyLabs FPS.
If a percent sneaks in, protocol sentence.

Tighten

One line, then silence. If they pick a line to unpack, open that card’s STAR, not a second intern.

80 questions — how / what / where / logic / algo

Rehearsal list from this codebase. Not a forecast for Job 10454435. Speak one row, then the matching card.

What they might ask

Any leftover-hour project grill: how it works, what the type is, where the file is, why the rule, what the algorithm does.

Resume-derived prioritized from Nest + FastAPI + React in this tree. Unnamed stays unnamed.

What you say

Situation. They want coverage, not a memoir.

Task. Answer the column they are in. How = mechanism. What = name the type. Where = file. Logic = why. Algo = ordered steps.

Action. Pick the row. I for what I implemented. Stop after one mechanism plus at most one resume family.

Result. Same Ylogx product the whole list.

They might ask next

#	Kind	If they ask	You answer
1	How	How does a dashboard GET get the right rows?	JWT → SET ROLE → sequelize.query on req.dbTransaction → Postgres policies.
2	How	How does SET ROLE last for many queries?	One open transaction until FinishTransaction commit on HTTP finish.
3	How	How does the bot not run as table owner?	FastAPI returns SQL; Nest executeRawSelectQuery uses the RLS txn.
4	How	How is the token attached?	localStorage token → Axios Bearer (or fetch Authorization on chatbot.ts).
5	How	How does refresh work?	POST /auth/refresh-token with refresh JWT; new Bearer pair; 15 min timer.
6	How	How does fail-closed work?	SET ROLE rls_no_access when mapping is missing.
7	How	How are allowedTables built?	Policy allowedModules → ModuleRegistry.tables on USER path.
8	How	How does chart metadata get to the UI?	Pydantic fields on FastAPI JSON, forwarded by executeChatQuery, ElementRenderer.
9	How	How does WITH pass the SELECT gate?	Extractor wraps SELECT * FROM (cte) q.
10	How	How do Tally files land?	Zip multer memory → S3 tally-uploads/ → gateway POST.
11	How	How does the txn close?	res.on('finish') commit; rollback if commit throws.
12	How	How are routes hidden?	FeatureAccess hasFeatureAccess(route) + ProtectedRoute.
13	How	How is schema cached?	fieldsCache Map 5 min TTL + etag.
14	How	How is org injected into raw SQL?	Regex tables, if organizationId column, splice WHERE or AND.
15	How	How does prod differ from qa?	main vs qa branch; :latest vs :qa; prod waits on Arjun-ylogx.
16	How	How does ECS know the app is alive?	curl localhost:5000/health every 30s, Terminus pings Postgres.
17	How	How are secrets kept out of debug HTTP logs?	sanitizeBody redacts password/token/secret/apiKey/authorization.
18	How	How does signup become a login?	OTP email → activate hashes password → signin issues JWTs.
19	How	How does chat CRUD bypass the warehouse role?	New txn + RESET ROLE in executeWithoutRLS.
20	How	How is a report saved?	POST /reports JSON blob, createdBy userId, soft delete flag.
21	What	What is Nest’s job vs FastAPI’s?	Nest: identity + execute. FastAPI: NL → SQL JSON.
22	What	What is on req.user after JWT?	userId, role, email, client_id, organizationId.
23	What	What app.* keys get set?	is_SUPER_ADMIN, is_admin, current_user_id, user_role, organizationId, admin_hierarchy_filter (ADMIN).
24	What	What are the nine types?	overview, sales, receivables, payables, stock, collections, profitLoss, balanceSheet, cashflow.
25	What	What join enum values?	INNER JOIN, LEFT JOIN, RIGHT JOIN, FULL JOIN.
26	What	What is SQLQueryAndDetails?	Pydantic model: eventQuery, chatMessage, axes, chartType, dataPeriod, …
27	What	What tables can LangChain see?	The 11 include_tables in extractor.py.
28	What	What is the default chatbot URL?	https://chatbot.projas.in/chatbot
29	What	What cache is in Nest?	In-memory Map for dataset fields, not Redis.
30	What	What does the cookie markdown claim?	HTTP-only cookies; this snapshot’s middleware is Bearer.
31	What	What does Terminus ping?	Indicator name postgresDB.
32	What	What is pool max?	20.
33	What	What CPU/memory is the task?	1024 / 3072 Fargate recipe.
34	What	What JWT times are in the task env?	1h access, 7d refresh — env values, not an SLA percent.
35	What	What hashes passwords?	bcrypt in AuthService.
36	What	What does GUEST hit?	Unauthorized on query/dashboard/report create paths.
37	What	What does the interceptor print?	Method, URL, user email, IP, status, duration ms.
38	What	What is synchronize?	true in sequelize.module.ts.
39	What	What is in report.data?	Saved canvas JSON (pages, elements, size).
40	What	What library drags columns?	react-dnd + HTML5Backend.
41	Where	Where is Bearer verified?	src/middleware/jwt.middleware.ts
42	Where	Where is SET ROLE?	src/middleware/rls.middleware.ts
43	Where	Where is bot SQL executed?	QueryDBService.executeRawSelectQuery
44	Where	Where is SQL generated?	convbi-ai/extractor.py + prompts.py
45	Where	Where is Redis in this Nest tree?	It is not in package.json. Resume bot path still names Redis.
46	Where	Where are 9 types declared?	frontend PREDEFINED_DASHBOARDS in dashboard/App.tsx
47	Where	Where is Chart.js on the canvas?	reportBuilder/ElementRenderer.tsx
48	Where	Where is cookie-parser?	Not in this package.json. Markdown only.
49	Where	Where is the prod workflow?	convbi-backend/.github/workflows/convbi-prod.yml
50	Where	Where is FinishTransaction registered?	main.ts app.use(FinishTransactionMiddleware)
51	Where	Where is CORS *?	convbi-ai/main.py CORSMiddleware
52	Where	Where is joinCondition interpolated?	executeQuery in queryDB.service.ts
53	Where	Where is the SELECT prefix?	executeRawSelectQuery start
54	Where	Where is executeWithoutRLS?	chat.service.ts private method
55	Where	Where is fieldsCache?	QueryDBService fields
56	Where	Where is hasFeatureAccess?	FeatureAccessContext.tsx
57	Where	Where is the S3 key prefix?	fileUpload.service.ts tally-uploads/
58	Where	Where is simple health?	GET /health/simple HealthController
59	Where	Where is gpt-4.1?	SQLQueryAndDetailsExtractor.get_llm_chain_object
60	Where	Where is @google/generative-ai?	frontend package.json; not the Nest chat-query path
61	Logic	Why first db_role_name only?	Postgres one SET ROLE. Extra roles still feed allowedTables.
62	Logic	Why RESET ROLE for SUPER_ADMIN?	Drop a prior restricted role; set is_SUPER_ADMIN configs.
63	Logic	Why SYSTEM scope for ADMIN?	Org-level warehouse role comes from SYSTEM roles assigned to that admin.
64	Logic	Why pg_policies outside the txn?	Restricted SET ROLE may not read the catalog. Discovery only.
65	Logic	Why FastAPI must not execute user SQL?	It has no caller SET ROLE. Nest does.
66	Logic	Why temperature 0?	Deterministic SQL/chart JSON. Not a tenant control.
67	Logic	Why features and RLS?	Routes vs rows. Hide chatbot ≠ filter sales.
68	Logic	Why no LLM on dashboard GET?	sub-210 ms family; tiles are aggregations not prose.
69	Logic	Why a new txn for chat CRUD?	Warehouse role often cannot DML chat tables. Reset on a side txn.
70	Logic	Why rls_no_access instead of RESET?	RESET was the ADMIN leak. Fail closed.
71	Algo	RLS resolution	BEGIN → branch SUPER_ADMIN / ADMIN SYSTEM / USER roles / else no_access → set_config → next().
72	Algo	executeChatQuery	fetch FastAPI → parse eventQuery → executeRawSelectQuery → combine JSON without returning eventQuery.
73	Algo	executeRawSelectQuery	SELECT prefix → FROM/JOIN regex → hasTableAccess loop → org WHERE inject → query on txn.
74	Algo	executeQuery	access both tables → SELECT quoted cols → JOIN keyword + ON condition → date/org WHERE → LIMIT → txn.
75	Algo	Slicer WHERE	buildWhereClauseFromFilters operators with bound :pN replacements.
76	Algo	Signup → session	domain check → PENDING/inactive + OTP → activate bcrypt → signin two JWTs → localStorage.
77	Algo	Token refresh	timer 15m or focus + needsRefresh → POST refresh → write tokens → reschedule. Single-flight refreshPromise.
78	Algo	Tally	validate zip → upload current (and optional previous) → fill zip_files URIs → gateway create.
79	Algo	Schema validator	parse CREATE TABLE from get_table_info → diff config columns → optional rewrite config.py.
80	Algo	Dashboard filters	parse comma months/years → EXTRACT MONTH/YEAR IN lists on date columns → many aggregations one GET.

Keep straight

All 80 rows are this Ylogx intern product. IQVIA LangGraph is not a row here.
Job 10454435 still has no public named live-round question.
Percents: 40% reports, +65% SQL RAG, −35% Redis bot DB, +60% / 30 tiles, sub-210 ms dashboards, 99.9% uptime. Protocol sentence if they ask N.

Tighten

One question, one row, stop. If they already spent the hour on this codebase, leftover LP time uses Horizon 17th / 80+ (Deliver) or GiftedBooks 3–10 min (Customer) — second stories, not a fourth Ylogx trophy.