Targeted Modernization of a Legacy ERP
A ground-up rewrite was off the table, but targeted fixes kept the system running.
A B2B hardware reseller in Vancouver ran their daily operations on a custom ERP platform. It was reliable, but starting to show its age. Integrations with major distributors like Synnex and Ingram Micro were built on much older APIs (SOAP/XML) that were facing a planned shutdown. Without action, this would introduce a serious supply chain disruption.
In addition, the application was originally built to only work with Internet Explorer. Microsoft’s current browser still maintains a compatibility mode than can be enabled, but it’s a source of friction, and locks out non-Windows devices entirely.
Tasked with keeping the existing system viable, I had full discretion over the technical approach. The application (mid-2000s Java with J2EE and Struts) had no documentation or test coverage, but the codebase was reasonably organized. The newer distributor APIs (REST/JSON) were well documented, making the transition a smooth process. The part that required the most planning was integrating OAuth client credentials for suppliers that used it, as the existing framework had assumed API keys would always be static.
The browser incompatibility came down to an old version of a commercial JavaScript data grid library (ActiveWidgets). Pagination and sorting were handled server-side, the library was only used as a simple table, so I couldn’t justify upgrading the commercial license. I wrote a lightweight replacement from scratch, closely matching the existing look and feel so the change would be transparent to employees.
As part of my review, I audited the codebase for common security issues. Authorization for privileged actions was correctly enforced in JSP:
<% if ( user.canDoPrivilegedThing() ) { %>
<a href="privileged.do" class="button">Privileged</a>
<% } %>
But in some cases, the Java action itself never verified the authorization. This meant any authenticated employee could bypass the check by navigating directly to the right URL. I added proper server-side enforcement to close this gap.
The end result was an ERP free of looming deprecation risks and browser constraints, with a stronger security baseline than it started with. Targeted modernization extended the system’s useful life while keeping the scope and cost well below a ground-up rewrite.