Evaluation — Expense Tracker (React + Django)

Stack: React (TypeScript) + Django REST Framework

Evaluator: ___________

Submission Date: ___________

Pass Threshold: 90%

How to Mark

[✓] Fully correct
[~] Partial — note the gap below the item
[✗] Missing or wrong

1. Django — `Expense` Model

workspace FK → Workspace, ON DELETE CASCADE, related_name='expenses'
submitted_by FK → settings.AUTH_USER_MODEL, ON DELETE CASCADE, related_name='expenses'
amount is DecimalField with max_digits and decimal_places set — NOT FloatField
category CharField using TextChoices (e.g. travel, meals, accommodation, supplies, other)
description TextField, blank=True, default=''
receipt FileField or ImageField, nullable, upload_to uses a callable that generates unique paths (not static folder)
status CharField using TextChoices: submitted, approved, rejected
reviewed_by FK → AUTH_USER_MODEL, null=True, blank=True, ON DELETE SET_NULL
reviewed_at DateTimeField, null=True, blank=True
review_notes TextField, blank=True, default=''
created_at DateTimeField, auto_now_add=True
CheckConstraint: amount > 0
Meta ordering: ['-created_at']
Migration generated and committed

2. Django — `ExpenseService`

submit_expense(workspace, submitted_by, amount, category, description='', receipt=None) method
submit_expense: validates amount > 0 — raises ValidationError if not
submit_expense: validates category is a valid TextChoices value
submit_expense: if receipt provided, validates MIME type server-side (not just extension)
submit_expense: does NOT trust file extension — reads actual content type
approve_expense(expense, reviewed_by, review_notes='') method
approve_expense: raises ValidationError if status != 'submitted'
approve_expense: sets status='approved', reviewed_by, reviewed_at=now()
reject_expense(expense, reviewed_by, review_notes) method
reject_expense: validates review_notes is not blank — required for rejection
reject_expense: raises ValidationError if status != 'submitted'
delete_expense(expense, actor) method
delete_expense: raises PermissionDenied if expense status is not 'submitted' (cannot delete approved/rejected)
delete_expense: deletes associated receipt file from storage on deletion
All methods are @staticmethod — no ORM calls in view body

3. Django — Serializers

ExpenseReadSerializer: includes all fields, submitted_by and reviewed_by as names (not just IDs)
ExpenseWriteSerializer: separate serializer for create/update input
ExpenseWriteSerializer: amount validated as > 0
ExpenseWriteSerializer: category validated against valid choices
ExpenseWriteSerializer: MIME type of uploaded file validated (image/jpeg, image/png, application/pdf allowed; reject others)
fields = '__all__' is NOT used
read_only_fields: id, status, reviewed_by, reviewed_at, created_at, submitted_by

4. Django — Permission Class

IsWorkspaceMember permission class in permissions.py
Queries DB for active workspace membership — not JWT-only check
IsWorkspaceAdmin or role check for admin-only views

5. Django — Views

ExpenseListCreateView at GET+POST /workspace/{id}/expenses/
List GET: returns only the authenticated user's own expenses (not all workspace expenses)
List supports ?status= filter
Create POST: calls ExpenseService.submit_expense() — no ORM in view
ExpenseDetailView at GET+DELETE /workspace/{id}/expenses/{id}/
DELETE: only submitter can delete their own expense, and only if status='submitted'
AdminExpenseListView at GET /workspace/{id}/admin/expenses/
Admin list: returns 403 if caller is not admin/owner
Admin list: supports ?status= and ?submitted_by= filters
ApproveExpenseView at POST /workspace/{id}/admin/expenses/{id}/approve/
Approve: 403 if not admin/owner
Approve: calls ExpenseService.approve_expense()
RejectExpenseView at POST /workspace/{id}/admin/expenses/{id}/reject/
Reject: 403 if not admin/owner
Reject: review_notes from POST body — error returned if blank
Reject: calls ExpenseService.reject_expense()
All views return correct HTTP status codes
Error responses follow format: { "error": "ERROR_CODE", "message": "..." }

6. React — My Expenses Page

Custom hook useMyExpenses(workspaceId) returns { data, isLoading, error, refetch }
Expense TypeScript interface defined (no any types)
Status filter: ?status= passed to API — not client-side filtered
Loading state: skeleton rows or cards
Empty state: "No expenses yet." message
Error state: error message + retry button
Submit Expense button: opens modal
Amount displayed with currency formatting (not raw number)
Receipt: download link or preview for submitted receipts
Delete button: visible only for submitted status expenses (not for approved/rejected)
Delete confirmation: "Delete this expense?" with loading state on confirm
On delete success: expense removed from list, "Expense deleted." toast

7. React — Submit Expense Modal

Single component used (not duplicated)
amount field: number input, shows error if ≤ 0
category field: dropdown with all valid options
description field: optional textarea
receipt field: file input, MIME type validated before upload on client (image/jpeg, image/png, application/pdf)
Receipt MIME error shown immediately — not after submit attempt
Submit button shows loading state
On success: modal closes, expense list refreshes, "Expense submitted." toast
API validation errors shown per field

8. React — Manager Review Page

Page accessible by admin/owner — 403 state shown for member role
All workspace expenses shown (not just own)
?status= and ?submitted_by= filters applied via API (server-side)
Status badge per expense row
Approve button: visible for submitted status expenses only
Approve: calls approve API, loading state on button, "Expense approved." toast on success
Reject button: visible for submitted status expenses only
Reject: opens inline form requiring review_notes text
Reject: cannot submit without review_notes — field error shown
After approve/reject: status badge updates, action buttons disappear

9. Standards Compliance

DecimalField used for amounts — never FloatField for money
MIME type validated server-side (not trusting file extension)
Receipt file deleted from storage when expense is deleted
No business logic (ORM, conditionals) in view methods — all in service
serializer.is_valid(raise_exception=True) used
No any TypeScript types
All errors shown in UI — no silent failures
Mobile responsive at 375px and 768px

Score Summary

Section	Total Items	✓ Pass	~ Partial	✗ Fail
1. Model	13
2. Service	14
3. Serializers	7
4. Permission Class	3
5. Views	18
6. My Expenses Page	12
7. Submit Modal	8
8. Manager Page	10
9. Standards	8
Total	93

Score: ___ / 93 (___%) — Pass / Conditional / Fail

Evaluator Notes

_Record specific failures, partial items, or other observations here._