Complete Agile SDLC Documentation for a Personal Expense Dashboard Web Application

Architecture, UI, data, security, and privacy design

Design activity

Design is performed incrementally for sprint-ready stories while the project maintains a stable target architecture and data model.

System context

User Browser
    |
   HTTPS
    |
Responsive Web Application
    |
Application Services / API
    |
Authentication + Authorization + Business Rules
    |
Relational Database
    |
Backup Storage

Logical components

• DES-01 Authentication: registration, login, logout, password reset, session management, and authorization.
• DES-02 Transactions: CRUD operations, validation, categories, filtering, ownership rules, and persistence.
• DES-03 Dashboard: monthly totals, balance, category summaries, and reporting datasets.
• DES-04 Categories: supported categories, user-defined categories, and transaction-type association.
• DES-05 Budgets: monthly limits, category limits, utilization, and over-budget states.
• DES-07 Analytics UI: category distribution, income/expense trend, responsive charts, loading states, and empty states.

Data entities

• User: id, name, email, password_hash, currency, created_at, updated_at.
• Category: id, user_id or system_scope, name, transaction_type.
• Transaction: id, user_id, category_id, type, amount, transaction_date, note, created_at, updated_at.
• Budget: id, user_id, month, year, overall_limit.
• CategoryBudget: id, budget_id, category_id, amount_limit.

Data integrity rules

• Every transaction belongs to one user.
• Every user-specific query is scoped to the authenticated user's identifier.
• Amounts use fixed-precision decimal storage.
• A user may have only one overall budget for a specific month and year.
• Category deletion is blocked when dependent transactions exist unless a controlled reassignment process is implemented.

Primary UI pages

• Registration.
• Login and password reset.
• Dashboard.
• Transactions list.
• Create/Edit transaction.
• Budgets.
• Categories.
• Profile settings.

UI states

• Loading state while reporting data is requested.
• Empty state when no transactions exist.
• Validation errors associated with relevant fields.
• Over-budget and near-budget status states.
• Responsive table or compact transaction representation on small screens.

Security and privacy controls

• Server-side authorization for every private record operation.
• Server-side validation of all user input.
• Parameterized database access through the approved framework or ORM.
• Secure password hashing.
• Secure production transport using HTTPS.
• Secure session or authentication-token configuration.
• Authentication rate limiting where supported.
• Financial details and credentials excluded from routine logs.
• Only data required for the approved product functionality is collected.

Design gate

G-02: Development begins only when required user flow, UI states, data behavior, validation, security impact, and acceptance criteria are sufficiently defined for the selected story.