portfolio-core
One backend, several portfolio sites that look nothing like each other.
Problem
Three people needed the same thing — a public profile plus a private professional record that can be released to one recruiter at a time and revoked — and none of them wanted the same design, the same sections or the same language.
Approach
A single source-only Astro package holds the whole backend: KV store, hashed access tokens, one-time redemption, grant sessions, audit log, mail, backups, CV and cover-letter generation with ATS scoring, and the admin dashboard. Each site supplies only a profile directory against a documented contract — its data, its components, its palette — and the shared pages inherit the design without knowing anything about it.
Outcome
- Three deployed sites share one backend and no fork: aviation, academic research and software engineering.
- A new profile is a directory of data and components; the backend needs no change at all.
- Access links are hashed at rest, redeemed once, scoped per section and revocable — a leaked link is a dead link.
The interesting constraint was not technical. It was that a shared package which knows what an aircraft type is cannot also serve a researcher, so every trade-specific decision had to be pushed out to the profile: what the AI may never invent, what a CV bullet is quantified with, which counts the dashboard shows.
The token model is the part worth reading. The link is shown once and stored only as a SHA-256 hash; redeeming it at /r/<code> exchanges it for a signed HttpOnly grant cookie, so the token appears in exactly one request and a reload does not spend a view.
- 3
- Sites on one backend
- ~4.5k lines
- Shared backend