Web Engineering
Vant — Freelance Marketplace
Built a production-oriented MERN marketplace with clean MVC architecture — engineered unified auth across email/password and OAuth 2.0 with PKCE (Google, GitHub, LinkedIn) with cross-provider account linking by verified email, a single-JWT pipeline with role embedded in payload, and server-side RBAC enforced at the middleware layer.
Project Overview
Built a production-oriented MERN marketplace with clean MVC architecture. Engineered unified auth across email/password and OAuth 2.0 with PKCE (Google, GitHub, LinkedIn) with cross-provider account linking by verified email, a single-JWT pipeline with role embedded in payload, and server-side RBAC enforced at the middleware layer preventing any cross-role access. Implemented the full project lifecycle — clients post with tech stack and budget, developers bid, owners accept one offer which auto-rejects remaining bids and moves the project to in-progress — backed by an event-driven notification system (NEW_BID, BID_ACCEPTED, PROJECT_CONNECTED), centralized error handling with no stack trace leakage in production, and a fully Postman-tested REST API.
The Challenge
Enforcing robust role-based access control (RBAC) at the middleware layer to prevent cross-role access, while maintaining a unified JWT authentication flow across traditional email/password and multiple OAuth 2.0 providers (Google, GitHub, LinkedIn) with cross-provider account linking.
The Approach
I designed a secure single-JWT authentication pipeline that embeds the user's role within the token payload, backed by strict server-side RBAC middleware. The application manages the complete lifecycle of projects and bids dynamically, leveraging an event-driven notification architecture for real-time status updates (NEW_BID, BID_ACCEPTED, PROJECT_CONNECTED). Centralized error handling was implemented to prevent stack trace leakage, and the entire REST API was rigorously tested with Postman.
Project Deliverables
A fully secured marketplace platform with role-based access controls, event-driven updates, and extensive REST API coverage.
OAuth 2.0
Auth PKCE
RBAC
Server-Side
Event
Driven Alerts
MVC
Architecture
Technology Stack
Frontend
ReactReact RouterCSSFramer Motion
Backend
Node.jsExpress.jsJWTOAuth 2.0PKCERBAC Middleware
Database & Testing
MongoDBMongoosePostman
Process Gallery
MERN Marketplace Dashboard
OAuth 2.0 with PKCE & Linkage
Postman API Testing Suite
Key Features
State-of-the-art authentication and secure marketplace workflows.
Unified Auth & PKCE
Auth across email/password and OAuth 2.0 with PKCE (Google, GitHub, LinkedIn) featuring cross-provider account linking by verified email.
Lifecycle & Notifications
Bidding workflow that automatically accepts one offer, auto-rejects others, and transitions projects to in-progress, supported by an event-driven notification system.
Server-Side RBAC
Role-based access control enforced at the middleware layer using a single-JWT pipeline with embedded roles, securing sensitive actions.