Jamshaid Mehmood

Backend & data

• Express 5 REST API over PostgreSQL with Prisma for schema and migrations.
• Auth stack built from scratch: JWT sessions, bcrypt hashing, Google OAuth token verification, and TOTP two-factor with QR enrolment and recovery codes.
• Role-based access control — admins see the org, reps see their own records — enforced in middleware, not the UI.
• Audit log capturing create / update / delete / merge across every entity, plus multer-backed file attachments.

Frontend & analytics

• React 19 + Vite client with React Query for server state and caching.
• Dashboard of KPI cards, revenue charts, deal-stage distribution, quota progress and a forecast widget (Recharts).
• Drag-and-drop Kanban pipeline via DnD Kit, with configurable stages and lost-reason capture.
• Contacts at scale: search, multi-facet filters, sorting, CSV import/export, duplicate detection and merge.
• Reports on win rate, average deal size, sales-cycle length and lead-source performance.
• i18next EN/DE, persisted dark/light theme, responsive from phone to desktop.

Frontend & 3D tour

• Walkable 3D gallery tour built on three.js, code-split into its own bundle chunk so the WebGL viewer never blocks first paint.
• Artwork loads into the scene as WebGL textures with crossOrigin handled for Cloudinary-hosted images.
• Browse, search and filter the collection, view artwork detail pages, and add pieces to a cart.
• React (CRA) + Tailwind client on Vercel, with SPA deep-links (/tour, /discoverArt) resolving straight to the right view.

Backend, media & hardening

• Node/Express API over MongoDB Atlas with Cloudinary-backed uploads that survive redeploys.
• Upload pipeline with server-side watermarking, perceptual-hash duplicate detection, and authenticated (non-public) original files.
• JWT auth with an email-OTP signup and password-reset flow.
• Production hardening: multi-origin CORS with a Vercel preview-URL wildcard, and fail-fast boot checks that refuse to start on missing config.

Frontend

• React 18 and TypeScript on Redux Toolkit Query — likes, saves and follows apply optimistically and roll back if the request fails.
• One optimistic edit patches the post everywhere it is cached — feed, explore grid, profile grid and permalink — so no stale copy is left on screen to toggle the wrong way.
• Expired sessions funnel through a single in-flight refresh, so a screen full of simultaneous 401s triggers one token rotation instead of tripping the server's reuse detection.
• The API returns image dimensions, so the client reserves the right box before the photo loads and the feed never reflows as you scroll.
• Every colour and spacing value resolves from one token file, which makes light / dark / system theming a single-file change.

API, data & testing

• Express and TypeScript over MongoDB with photos in GridFS, so a feed page is a few hundred bytes per post instead of megabytes of inlined image.
• Keyset pagination on (createdAt, _id) rather than skip — an index seek at any depth, with no rows double-served when new posts land mid-scroll.
• Likes are idempotent by unique index instead of read-then-write, and counters move with atomic $inc alongside the write itself.
• 15-minute access tokens held in memory, refresh tokens in an httpOnly cookie that rotates on use — replaying a spent token revokes the whole family.
• 46 Playwright end-to-end tests across auth, feed, profile, follow, search, saved and responsive layout, driving the real API and client.

Security & payments

• Every actor id is read from the authenticated JWT, never the request body — closing a systemic BOLA/IDOR class where any user could otherwise edit any gig or settle any order.
• Order prices are derived server-side from the gig so amounts can't be tampered with, and settlement is idempotent — an order is never marked paid on the client's word.
• Settlement is verified two ways: a signed Stripe payment_intent.succeeded webhook plus a server-side re-read of the PaymentIntent — so an order settles reliably and can't double-charge.
• A payment-provider abstraction backs both real Stripe and a built-in mock, so the whole checkout-to-settlement flow is demoable offline and demo and production share the exact same settlement code.
• Strict credentialed CORS allowlist, a path-scoped refresh cookie, and token-version session revocation.

Architecture & real-time

• A shared @fiverr-lite/shared package makes one Zod source the single source of truth — generating both runtime validation and the static DTO types imported by the API and the web app, so client and server can't drift.
• Layered backend — routes → controllers → services → models — with one module per domain: auth, gigs, orders, payments, chat, ratings, admin, AI and uploads.
• An escrow-style order state machine allows only legal transitions (awaiting payment → paid → in progress → delivered → completed, plus cancellation), enforced in the service layer with DB-level invariants like one active order per buyer+gig.
• The API parses its entire environment with Zod at boot and refuses to start if misconfigured, instead of failing deep in a request handler.
• Socket.IO powers live buyer↔seller chat and live order-status updates.
• Six competing styling approaches collapsed into a single design-token source feeding Tailwind and MUI v6, with full dark mode and defined loading / empty / error states.