Software engineer based in Rabat. I design systems end to end, from the API and the identity layer to the pipeline that ships them, in whatever stack the job needs.
Latest article What Contributing to Two Keycloak Projects Taught Me About Building Authentication ExtensionsHow a request flows through Dr Maroc, from the portals and the website to the data.
Hover or select a part to see what it does.
Products I designed and shipped, from the first commit to production.
A healthcare SaaS live at drmaroc.com, grown from a single app into a platform: four Angular portals in one Nx monorepo, a modular Spring Boot backend, self-hosted Keycloak, shared contracts, and a delivery pipeline where GitHub is the source of truth.
A published npm package that exposes Angular authentication as signals instead of getters, ships Keycloak and HTTP adapters behind a provider-agnostic port, and keeps tokens out of localStorage entirely.
A published npm package extracted from the same api.service.ts I had copied across four Angular projects — configurable versioning, RFC 9457 error normalization, retry with backoff, and zero UI dependencies.
Libraries I own, projects I maintain, and tools I contribute to.
OwnerTypeScriptCase study
A typed, interceptor-driven HTTP layer for Angular — pluggable API versioning, RFC 9457 error normalization, and retry with backoff.
OwnerTypeScriptCase study
A reactive authentication layer for Angular. Auth state as signals, a functional route guard, and feature code free of identity-provider imports.
MaintainerJava
Keycloak authentication provider for two-factor authentication with a one-time code sent by email — SMTP, SendGrid, AWS SES, or Mailgun.
MaintainerJava
Keycloak two-factor authenticator that delivers one-time codes over SMS, Telegram, WhatsApp, and Signal.
ContributorTypeScript
A local HTTP proxy between your frontend and a remote API gateway — mock chosen endpoints with scenario-based responses, forward everything else.
Notes from building real systems: identity, APIs, delivery, and the decisions behind them.
Three easy-to-miss boundaries in Keycloak extensions: selection, enrollment and packaging.
Security
, 10 min read
A single configuration field grows into a domain: definitions, owners, overrides, validation and resolution rules.
Architecture
, 16 min read
Why an endpoint per button breaks down, and how to separate UI actions, resource state and domain commands.
Architecture
, 12 min read
A failed CI job on my pull request became a lesson in pull_request_target and running untrusted code.
Security
, 11 min read
I join teams or take on projects end to end.
End-to-end web applications with modern frameworks and solid architecture
Automated pipelines, containerization, and scalable cloud infrastructure
Architecture reviews and strategic guidance for your engineering team
Ongoing technical support to keep your applications healthy and up to date
Discovery
Understanding your goals, requirements, and technical constraints
Planning
Creating a clear technical roadmap and architecture plan
Development
Building iteratively with clean, well-tested, maintainable code
Delivery
Testing, deploying to production, and post-launch support
Tell me about the project, the team and the timeline, and I will get back to you.
