When I joined the SSO project, the existing biometric authentication engine had no documentation, no tests, and the original author was long gone. It was 800 lines of legacy code wired into a WebSocket connection and a handful of API endpoints nobody could explain.
Where I started
Instead of guessing, I treated it like an investigation:
- Traced every WebSocket message to understand the handshake between the client and the biometric device.
- Logged every outbound HTTP call to reconstruct the undocumented API surface.
- Diffed behavior between fingerprint and facial recognition flows, since they shared code paths in ways that weren't obvious from the structure.
What I found
A few things stood out immediately: passwords were being handled in ways that wouldn't pass a basic security review today, and the retry logic for failed scans was effectively absent — a failed scan just looked like a hang to the end user.
The payoff
Mapping the system fully is what made the new .NET implementation with CQRS possible. We could finally separate "what this system does" from "how this 800-line file happens to do it," and rebuild the authentication UI in React with real error states, retry logic, and — for the first time — a documented Swagger spec for the whole flow.
The lesson that stuck with me: legacy code without documentation isn't a wall, it's a puzzle. You just need a method for taking it apart safely.