PROJECT_04

Asistencia y Nómina Hikvision

System that takes clock-ins from the Hikvision reader and turns them into payroll automatically, with no manual work.

CONTEXT

The biometric terminal recorded attendance, but payroll was still calculated by hand from those records. The system closes that gap end to end.

Automatic payroll from real clock-ins: entries, exits, overtime and late arrivals.
Configurable rules per role (tolerance, rounding, shifts, holidays).
Reconciliation of missing clock-ins with supervisor approval.

Clock-ins read from /ISAPI/AccessControl/AcsEvent, filtering major type 5 and minors 38 (card), 75 (face) and 113 (fingerprint).
Staff created and removed through /ISAPI/AccessControl/UserInfo, with employeeNo as the same key that identifies the employee in payroll.
Face enrolment posted as multipart to /ISAPI/Intelligent/FDLib/FaceDataRecord: JSON metadata plus the JPEG, within the 200 KB and 80×80 px limits the terminal enforces.
Real-time events over httpHosts — the terminal POSTs to the backend — with alertStream as a fallback when push drops.
Paginated searches with a fixed searchID and searchResultPosition advancing by numOfMatches, until responseStatusStrg stops saying MORE.

HTTP Digest authentication (MD5, qop=auth) with a per-request nonce count; Basic ships disabled on current firmware.
Terminal clock kept on NTP: a drift over five minutes is enough for Digest itself to stop validating.
Account lockout handled: after repeated failures the admin is locked out and the 401 carries lockStatus and unlockTime, which are read to avoid a retry loop.
The outcome is decided by subStatusCode, not the HTTP code: deviceUserAlreadyExist is treated as an idempotent create rather than an error.

Spring Boot 3 + MySQL API and a React/Vite SPA, dockerized behind Nginx with TLS.
The protocol is documented separately, in a public reference repository covering the endpoints, the event codes and the Digest implementation.