chore: add adr for custom file processing logic

mysec/0001-auth-flow-sec-sdt-bypass.md

@@ -1,8 +1,9 @@
 ## Author(s)
-- Wei Jun / @Physium 
-- Lai Ho / @iamlaiho 
-- Wilson / @wholesomewilson 
-- Eileen / @kmye 
+
+- Wei Jun / @Physium
+- Lai Ho / @iamlaiho
+- Wilson / @wholesomewilson
+- Eileen / @kmye
 
 ## Discussion & Voting Timeline
 
@@ -53,20 +54,22 @@ Example payload:
 - JWTs will be signed using RS256.
 - Tokens will expire within 3–5 minutes of issuance.
 - SDT will reject tokens with:
-    - Invalid signature
-    - Expired exp
-    - Unexpected aud or iss fields
+  - Invalid signature
+  - Expired exp
+  - Unexpected aud or iss fields
 
 ### **Token Transfer**
 
 Authentication tokens will be transferred via a redirect using query parameters. This mechanism allows MySEC to hand off users to SDT without introducing additional complexity or workflow.
 
 While redirect-based token transmission introduces several known security considerations—such as:
+
 - Exposure of tokens in browser history and server logs
 - Potential leakage via the Referer header when SDT loads third-party resources
 - Possibility of replay attacks if tokens are intercepted and reused
 
 These risks are mitigated through the following safeguards:
+
 - The JWT contains only non-sensitive user attributes (e.g., email address)
 - Tokens are short-lived (e.g., 3–5 minutes) and single-use
 - SDT validates the iss, aud, and token signature before establishing a session

sdt-datatool/0001-custom-data-upload.md

@@ -0,0 +1,56 @@
+## Author(s)
+
+- Eileen / @kmye
+
+## Discussion & Voting Timeline
+
+- Discussion open until 2025-10-23
+- Voting starts when the author calls for it
+- Voting ends on 2025-10-23 or when consensus is reached
+
+## Summary
+
+This ADR describes the implementation of a custom data upload feature in the Student Data Tool (SDT) to allow users to upload files containing diverse Student Data in a column-row data format.
+
+## Motivation
+
+Currently, SDT only supports uploading Student Data in a specific file contents generated by School Cockpit.
+However, users often their own Excel files that they need to upload. Implementing a custom data upload feature will enhance user experience and broaden the tool's applicability.
+
+## Detailed Design
+
+We propose the following mechanism:
+
+- File will be posted to server via a REST API endpoint.
+- File will then be scanned with an anti-virus scanner to ensure no malicious content.
+- SDT processes the file and extracts Student Data in backend.
+- Custom data is stored in database and will be used to combine with data sources from School Cockpit.
+
+Benefits:
+
+- Unified file processing logic in backend.
+- Reduced complexity in frontend code.
+- Easier to maintain and extend file processing logic in future.
+- Sensitive data is not processed in frontend browser.
+- Reduced load on frontend browser.
+- Easier to combine student data to server side data sources.
+- Easier to implement logging and monitoring of file uploads.
+
+## Alternatives Considered
+
+- Do file processing in frontend browser and send Student Data as JSON payload back to backend for further processing.
+  - Benefits:
+    - Reduced load on backend server.
+    - Sensitive data is not transferred over the internet network.
+    - No need to refactor existing file processing logic.
+  - Drawbacks:
+    - Run validation logic on data for both in frontend and backend code.
+    - Potentially larger payloads leading to performance issues.
+    - More complex to combine student data to server side data sources.
+
+## Drawbacks
+
+- Existing file processing mechanism to be moved to backend to have a consistent and unified file processing logic.
+- Increased attack surface of the application, requires the need to have a anti-virus file scanner in place to scan uploaded files.
+- Needs to handle maximum size of uploaded files.
+- There will be transfer of sensitive data via internet network, needs to ensure data is encrypted in transit and at rest.