# Interacta — Live Audience Engagement Platform

> An event-driven microservice platform where a host runs a live session and the audience joins by QR code — asking questions, upvoting and voting in polls without ever creating an account.

- **Exhibit:** B
- **Kind:** Event-Driven Microservices
- **Role:** Backend developer, team of four
- **Status:** In Development
- **Stack:** Java 25, Spring Boot 4, Spring Cloud Gateway, Apache Kafka, Keycloak / OIDC, PostgreSQL, STOMP over WebSocket, MinIO (S3), Docker Compose, Angular, Python
- **Source:** https://github.com/dahalutsab/interacta_services
- **Canonical page:** https://dahalutsab.com.np/case-files/interacta

## The brief

Interacta is a live audience-engagement platform split into seven Spring Boot services and a Python worker, talking over Kafka rather than HTTP. A host creates a session, puts a join code on screen, and the room participates in real time — questions, upvotes, live polls and shared handouts — while STOMP over WebSocket fans every change out to the connected clients.

The defining constraint is that listeners never create an account. Joining a session mints a signed, PII-free participant token, so an anonymous listener is still a first-class API caller and one upvote per person is still enforceable. Every service validates two token issuers — Keycloak for staff, session-service for participants — and asks the same question of both: is this caller the host of this session, or a participant scoped to it?

The API, not the UI, is the security boundary: a hidden poll tally is zeroed in the DTO rather than merely unrendered, realtime frames are deliberately thin so the server decides what each viewer may see, and every service verifies its own tokens instead of trusting one check at the gateway. A Python AI worker screens questions for toxicity and clusters near-duplicates before they ever reach the room.

## What it does

- Anonymous participant tokens — join by QR code, no account, no PII
- Two-issuer authentication with per-session authorization in every service
- Kafka event topology with a local session read-model per service
- Realtime fan-out over STOMP/WebSocket with per-destination authorization
- Live polls with server-side result withholding and recounted tallies
- AI moderation: MuRIL toxicity screening and BGE-M3 semantic grouping
- S3-compatible file storage with policy fixed on the upload category
- Per-caller rate limiting, RFC 9457 error shape, one-database-per-service

---

Source: https://dahalutsab.com.np/case-files/interacta
From The Utsab Dahal Times — the record of Utsab Dahal, Backend Developer — Spring Boot & DevOps, Kathmandu, Nepal.
Full record: https://dahalutsab.com.np/llms-full.txt