DocGen-Mongo: automated offer letters, certificates & audit trails

HR teams generate the same documents over and over — offer letters, appointment letters, experience letters, certificates. Each one is a template with a few fields swapped in, yet most places still do it by hand. DocGen-Mongo automates the whole loop: templates live in MongoDB with placeholders, records fill them in, and the finished document comes out as PDF or DOCX — with every generation logged.

I built it as my assignment for the AICTE × Learnzo Python full-stack internship, and it grew past the assignment: 23 files reviewed, 45 production fixes, and a documented hardening pass that took the project from "demo" to "deployable."

Repo: github.com/SabarishR08/DocGen-Mongo

What it does

• Template management — offer/appointment/experience letter and certificate templates stored in MongoDB with {{name}}, {{date}} style placeholders
• Single & bulk generation — fill one record by hand or upload a CSV/Excel file and generate dozens of documents in one pass
• Preview before download — check the rendered document before it's exported
• PDF / DOCX export — pdfkit for PDFs, docxtpl + python-docx for editable Word files
• Role-based access — Admin / HR / Staff logins with different privileges (Flask-Login)
• Audit trail — who generated what, from which template, and when
• Optional email delivery — send documents straight out via the Brevo API

The production pass that made it interesting

The repo carries its own review history (SUMMARY.md), and that's the part worth stealing. A code review flagged 45 issues — hardcoded secret-key fallbacks, missing security headers, unindexed queries — and each one was fixed and documented. The stated before/after is the honest headline: security score 45 → 85/100, code quality C+ → A-, production readiness 50% → 95%.

Concretely, that meant:

• Auto-generated secrets instead of fallbacks; 7+ security headers
• MongoDB connection pooling and indexed query paths
• Rate limiting via Flask-Limiter
• A test suite using mongomock so tests run without a live database
• Deployment docs covering a real server setup

The pattern that carries over

This is the same shape as my other full-stack work — models, auth middleware, rate limits, audit logs — the difference is the domain: instead of scanning ports or scoring prompts, the "object" being protected is a human-resources document. HR paperwork is a compliance surface; treating it like one is the whole point.

Honest notes

• The README bills the internship as "Python with Django," and the implementation is Flask — the Django framing came from the program materials, Flask is what shipped
• Bulk generation from CSV assumes clean headers; schema validation is the natural next step
• Email delivery is optional and keyed to Brevo, so it's simple to swap

Templates + placeholders + an audit log: three ideas, one workflow that removes a genuinely tedious job.