system architecture overview
Runtime shape of jsjiit 0.0.22 in the browser against https://webportal.jiit.ac.in:6011/StudentPortalAPI.
Context#
flowchart LR page[Your page or SPA] lib[jsjiit bundle] crypto[Web Crypto subtle] fetchA[fetch] portal[JIIT StudentPortalAPI] page --> lib lib --> crypto lib --> fetchA fetchA --> portal
CORS is the portal’s problem. If the browser blocks the request, __hit may wrap a TypeError whose message contains "CORS".
Module graph#
flowchart TB
subgraph public
I[index.js]
end
subgraph http
W[wrapper.js]
end
subgraph domain
A[attendance.js]
R[registration.js]
E[exam.js]
X[exceptions.js]
end
subgraph cryptoM
C[encryption.js]
U[utils.js]
end
I --> W
I --> A
I --> R
I --> E
I --> X
I --> C
W --> A
W --> R
W --> E
W --> X
W --> C
C --> UClass roles#
classDiagram
class WebPortal {
session
__hit()
student_login()
}
class WebPortalSession {
token
get_headers()
}
class AttendanceMeta
class Registrations
class ExamEvent
WebPortal --> WebPortalSession
WebPortal --> AttendanceMeta
WebPortal --> Registrations
WebPortal --> ExamEventAuthenticated vs open#
flowchart TD hit[__hit] hit --> open[LocalName only] hit --> authed[Bearer plus LocalName] open --> login[student_login] authed --> rest[data methods]
Login is the only unauthenticated public method.
Body styles#
flowchart TB m[method] --> p1[serialize_payload then options.body] m --> p2[serialize_payload then options.json] m --> p3[plain object options.json] m --> p4[download_marks raw GET]
| Style | Examples |
|---|---|
encrypted body |
pret token, generate-token1 |
encrypted json |
attendance detail, exams, grade card, SGPA, fines |
plain json |
personal info, bank, password, attendance meta, hostel, fees |
| GET blob | download_marks |
Token lifetime#
sequenceDiagram participant WP participant JWT as JWT payload participant API WP->>JWT: atob payload exp WP->>WP: session.expiry Date WP->>API: later requests API-->>WP: 401 WP->>WP: throw SessionExpired
No proactive expiry check.
Browser constraints#
flowchart LR subtle[crypto.subtle] --> https[HTTPS or localhost] download[download_marks] --> dom[document.createElement a] fetchC[fetch] --> cors[portal CORS]
run_server exists because crypto.subtle is unavailable on plain HTTP except some localhost cases. The script always serves HTTPS on port 8000.
Build vs source#
flowchart TB src[nine files under src/] src --> bundle[one ESM file] bundle --> min[minified] bundle --> raw[pretty]
Consumers of the CDN never see module boundaries. Source maps point back at src/.