Angel Barbosa
es

Professional experience

Experience

My role and what I delivered at ACP, framed around the position and its outcomes. The full technical detail (problem, architecture, security) lives in the case study.

  1. in production

    Full-Stack Developer

    Autocamiones del Pacífico (ACP)

    Sole developer · Jalisco, Mexico (remote) · December 2025 - Present

    Sole developer of ACP, the ticketing and parcel platform that replaced the fully manual operations of an intercity passenger transport company, live in production on Oracle Cloud today.

    • I owned the entire cycle, on my own: requirements, architecture, code, cloud infrastructure, deployment, and documentation, replacing a paper-based operation with a system running in production.
    • Built the backend in Go: two REST APIs (public, and internal with role-based access control), transactional seat sales, and a full audit trail on every admin change over PostgreSQL, with type-safe queries (sqlc) and versioned migrations.
    • Implemented authentication from scratch: JWT (RS256), mandatory TOTP 2FA (RFC 6238), and rotated refresh tokens with real server-side session revocation.
    • Delivered 6 client surfaces: a React admin panel, a Next.js public site, and 4 offline-first Flutter apps (ticket office, driver, parcels, customer) sharing in-house design-system, API-client, and printing packages.
    • Engineered offline-first operation for field staff: encrypted queues (AES-256-GCM), on-device folio generation, offline QR validation, and photo + signature delivery evidence that syncs on reconnection.
    • Integrated payments with Stripe, Mercado Pago, and PayPal, confirmed only through verified webhooks and with automatic expiration of unpaid orders.
    • Provisioned and operate production on Oracle Cloud (4 VMs with a load balancer, PostgreSQL primary and replica) with Terraform and Ansible, and built the CI/CD on GitHub Actions with vulnerability scanning as a mandatory gate.
    • Ensured quality with 150+ automated tests, API and UI E2E suites (Playwright), a k6 load baseline (public API p95 < 100 ms), and PII anonymization compliant with Mexico’s LFPDPPP.