Secure Banking Transaction Engine

Overview

Secure Banking Transaction Engine is a Flask-based backend service that simulates secure ATM-style banking operations with persistent PostgreSQL storage. The project is designed to demonstrate how a production-oriented financial backend should handle account creation, authentication, transaction processing, and auditability without compromising data integrity.

The system emphasizes security, correctness, and operational readiness rather than just basic CRUD behavior. It is suitable for learning how real banking APIs enforce account protection, transactional consistency, and defensive programming practices.

---

What the System Does

The service exposes REST endpoints for:

• Account creation and account lookup
• Login authentication with failed-attempt lockout
• Deposits and withdrawals
• Transaction history retrieval
• Account summary reporting
• Health checks for service monitoring

These operations are backed by a PostgreSQL database and are implemented with the goal of keeping account state consistent and auditable.

---

Architecture and Tech Stack

The project combines a lightweight web API with a database layer designed for reliability and security.

• Python: Core backend language
• Flask: REST API framework
• psycopg2: PostgreSQL database connectivity
• python-dotenv: Environment-based configuration
• argon2-cffi: Secure hashing for PINs and credentials
• Flask-Limiter: Rate limiting for API protection
• Waitress: Production-style WSGI server
• Postman: API payload validation and manual testing

---

Core Design Principles

Security

• PINs are hashed using Argon2 rather than plain-text storage.
• Repeated failed login attempts increase the risk of lockout and protect against brute-force attacks.
• Sensitive values such as database credentials are expected to be stored in environment variables rather than hardcoded into source files.

Data Integrity

• Account balance updates and transaction logging are handled as part of the database workflow.
• The design is built around transactional correctness so that financial operations are consistent and auditable.

Reliability and Observability

• The API includes a health endpoint for basic status checks.
• Transaction and account operations are structured around predictable, testable responses.
• The project is intended to be extended with stronger logging, monitoring, and automated validation over time.

---

API Endpoints

The Flask app exposes the following routes:

• GET /health — health check
• POST /account — create a new account
• GET /account/<account_number> — fetch account details
• POST /login — authenticate a user with PIN verification
• POST /transaction — process deposit or withdrawal
• GET /account/<account_number>/transactions — fetch transaction history
• GET /account/<account_number>/summary — fetch account summary details

Example request payloads are provided in the repository’s Postman-style JSON file for manual testing.

---

Local Setup

Prerequisites

• Python 3.11+
• PostgreSQL server running locally or remotely
• A configured .env file with database credentials

1. Install dependencies

If a requirements file is present, use:

pip install -r requirements.txt

Otherwise install the required packages directly:

pip install flask psycopg2-binary python-dotenv argon2-cffi flask-limiter waitress

2. Configure environment

Set the PostgreSQL connection details in .env.

DATABASE_URL=postgresql://user:password@localhost:5432/atm_db

You can also use the existing project-style variables if preferred:

DB_NAME=your_database_name
DB_USER=your_username
DB_PASSWORD=your_password
DB_HOST=localhost
DB_PORT=5432

Do not commit this file to version control.

3. Run the server

python app.py

The application starts with Waitress and serves requests on port 8000.

4. Test endpoints

Use Postman or curl to verify the service:

GET http://127.0.0.1:8000/health
GET http://127.0.0.1:8000/account/ACC1001

---

Project Structure

.
├── app.py                # Flask API routes and request handling
├── atm_db.py             # PostgreSQL logic, account handling, and transactions
├── script.py             # Example workflow for account and transaction testing
├── postman_payloads.json # Sample request payloads for API testing
├── README.md             # Project documentation
├── .env                  # Local environment credentials (ignored by Git)
└── test.py               # Local validation helper for database interaction

---

Testing and Validation

The repository includes local validation helpers for checking database connectivity and basic function behavior. For API testing, the bundled Postman payload file provides ready-to-use inputs for the main endpoints.

Recommended next steps for hardening the project further:

• add automated pytest coverage for account creation, login, and transaction flows
• introduce structured logging for requests and failures
• add containerization for easier deployment
• separate the service into modular packages as it grows

---

Real-World Practices Demonstrated

This project already demonstrates several production-oriented engineering practices:

• Production-style serving with Waitress
• Secure password hashing with Argon2
• ACID-compliant database transactions
• Row-level locking with with_for_update()
• Rate limiting for abuse prevention
• Endpoint testing with Postman
• Clear documentation for reproducibility

Future Improvements

Potential enhancements for a more complete platform include:

• JWT authentication for secure sessions
• Dockerization for deployment consistency
• CI/CD pipeline integration
• Monitoring with Prometheus and Grafana
• Redis-based distributed rate limiting

Summary

The ATM Logging System is a complete backend project that demonstrates:

• Secure API design
• Database reliability
• Concurrency control
• Production-level serving
• Defensive security measures