portfolio-core
One backend, several portfolio sites that look nothing like each other.
Problem
Three people needed the same thing, a public profile plus a private professional record that can be released to one recruiter at a time and revoked, and none of them wanted the same design, the same sections or the same language.
Approach
A single source-only Astro package holds the whole backend: one MongoDB database, hashed access tokens, one-time redemption, grant sessions, audit log, mail, backups, CV and cover-letter generation with ATS scoring, and the admin dashboard. Each site supplies only a profile directory against a documented contract covering its data, its components and its palette, and the shared pages inherit the design without knowing anything about it.
Outcome
- Three deployed sites share one backend and no fork: aviation, academic research and software engineering.
- A new profile is a directory of data and components; the backend needs no change at all: a fourth, for a PhD researcher, went in without touching it.
- Access links are hashed at rest, redeemed once, scoped per section and revocable, so a leaked link is a dead link.
- A program that edits the record gets its own credential rather than the owner’s password: scoped, dated, revoked with one click, every call written down, and barred at any scope from minting an access link, reading a backup, or minting another token.
The interesting constraint was not technical. It was that a shared package which knows what an aircraft type is cannot also serve a researcher, so every trade-specific decision had to be pushed out to the profile: what the AI may never invent, what a CV bullet is quantified with, which counts the dashboard shows.
The token model is the part worth reading. The link is shown once and stored only as a SHA-256 hash; redeeming it at /r/<code> exchanges it for a signed HttpOnly grant cookie, so the token appears in exactly one request and a reload does not spend a view.
The agent token is the same idea one layer up. The obvious way to let a program edit the record is to hand it the dashboard password, and that credential is unscoped, lasts eight hours, ends up in shell history, and cannot be revoked without rotating the secret that signs every recipient’s grant cookie, so revoking one script would sign every recruiter out mid-read. A scoped token is narrower in every direction. The part that took the thought was not the scope list but the three routes no scope reaches: minting an access link, reading a backup, and minting another agent token. Each of those is a path from a limited credential to an unlimited one, since a backup carries the private record in full, so they stay behind the password.
- 3
- Sites on one backend
- ~16.4k lines
- Shared backend