Blogging application

[SRIRAM-PURANIK]

Stack

Next.js 16 (App Router), TypeScript, Prisma with SQLite, Tailwind CSS. Auth is custom: bcryptjs for password hashing, jose for JWTs stored in httpOnly cookies.

Features

• Signup with full name, unique email, unique username, password (8+ chars, 1 special character)
• Login and logout via httpOnly JWT cookie
• Public homepage listing all posts, newest first, 8 per page
• Per-user blog at /[username], also paginated at 8 per page
• Individual post at /[username]/[slug]
• Comments require login. Newest first, with the form above the thread
• Users can delete their own comments. Post authors can delete any comment on their post
• Admin panel at /admin to list, create, edit and delete own posts

Design decisions

Slug uniqueness is scoped per author using @@unique([authorId, slug]) rather than being global. Post URLs are /username/slug, so two users can both have a post titled "Hello World" without collision. If the same author reuses a title, the slug gets a numeric suffix.

Public pages are server components that query the database directly, so there is no client-side fetching for content. Only the interactive parts like forms and delete buttons are client components.

Authorization is checked server-side. Delete buttons are conditionally rendered, but the real permission check is in the API route, since hiding a button is not security.

Every mutation looks the record up by ID and then verifies the owner ID from the JWT before acting. Post edit and delete return 404 instead of 403 on an ownership mismatch, so the response does not reveal whether a post exists.

Setup

npm install
npx prisma migrate dev
npm run dev

Needs a .env file with DATABASE_URL="file:./dev.db" and a JWT_SECRET.

Not implemented

The extra credit items were not attempted. I focused on completing all the core requirements first.