Full-stack platform2026
Keyframes
Editorial platform for motion-graphics work, with a moderated public submission pipeline.
A full-stack catalogue of motion-graphics work: a filterable public grid with hover previews and detail pages, a public suggestion form, and a private back-office where an editor approves a suggestion into a live record. The interesting parts are defensive — an allow-listed embed builder, a four-gate upload validator, and accent-insensitive search that works identically on SQLite and Postgres.
ContributionSole author. Monorepo, API, database design, front-end and admin.
6Prisma models
4Upload validation gates
4Video providers supported
66Seeded works
28Countries in seed data
15Route modules
How it works
- npm-workspaces monorepo: an Express + Prisma API and a React 19 + Vite front end sharing type, constant and embed modules.
- Six Prisma models, with parallel SQLite and PostgreSQL schemas kept behaviourally identical (no native enums, JSON columns or scalar lists).
- Accent- and case-insensitive search without Postgres-only features: rows store a pre-normalised search haystack and queries normalise the needle identically.
- Video embeds never take an editor-supplied URL: the host is matched against an allow-list, the id validated per provider, and the embed URL rebuilt from a fixed template.
- Uploads pass four independent gates — declared MIME, matching extension, byte size, and a real magic-byte signature check after write.
- Helmet CSP configured with useDefaults: false and an explicit directive set; the uploads directory gets its own tighter policy.
- Auth is a JWT in an httpOnly SameSite cookie with bcrypt hashes; the seed script creates no user and there are no default credentials in the repo.
- Editorial pages are database rows rendered as React elements from Markdown, so page copy cannot inject markup.