01
Identity that supports two entry points
Email/password accounts and Google OAuth converge on the same user model. JWTs work through an httpOnly browser cookie or a Bearer token for API clients.
Google OAuthJWTbcrypt
Est. 2026 · Independent
Cards in,
cards out.
A full-stack trading card collection and marketplace platform.
Scan cards, catalog what you own, show it off in your binder, and trade with collectors—on your terms, directly.
Browser-only demoListing-scoped chatPhoto-scan catalog
LISTEDCharizardBase 4/102$892.00@foilfiend◆ON HOLDMewtwoBase 10/102$245.00@kintsugi◆LISTEDBlastoiseBase 2/102$380.00@oxblood◆SOLDVenusaurBase 15/102$285.00@goldleaf_77◆LISTEDRaichuBase 14/102$92.50@ashen_lake◆LISTEDGyaradosBase 6/102$145.00@duskmoth◆LISTEDCharizardBase 4/102$892.00@foilfiend◆ON HOLDMewtwoBase 10/102$245.00@kintsugi◆LISTEDBlastoiseBase 2/102$380.00@oxblood◆SOLDVenusaurBase 15/102$285.00@goldleaf_77◆LISTEDRaichuBase 14/102$92.50@ashen_lake◆LISTEDGyaradosBase 6/102$145.00@duskmoth◆LISTEDCharizardBase 4/102$892.00@foilfiend◆ON HOLDMewtwoBase 10/102$245.00@kintsugi◆LISTEDBlastoiseBase 2/102$380.00@oxblood◆SOLDVenusaurBase 15/102$285.00@goldleaf_77◆LISTEDRaichuBase 14/102$92.50@ashen_lake◆LISTEDGyaradosBase 6/102$145.00@duskmoth◆
03application services
09connected product domains
20k+offline catalog records
100%backend-free public demo
02Product walkthrough
One collection. Every workflow around it.
The portfolio build uses deterministic mock data and local browser state to reconstruct the application's major workflows without calling the original infrastructure.
01
Scan a physical card
Validate and normalize an upload, extract text, rank catalog matches, then confirm the card before it enters the binder.
02Curate a digital binder
Organize cards in tactile 3×3 pages, manage card details and visibility, and turn owned cards into listings.
03Trade with context
Browse condition-aware listings, inspect seller profiles, and open conversations tied to the exact card being discussed.
04Build marketplace trust
Keep buyers and sellers informed through status changes, unread notifications, and post-transaction reviews.
03Interactive product demo
Try the connected experience.
Run a simulated scan, save the result to a binder, filter listings, message a seller, clear notifications, and leave a review. Every action is local, reversible, and clearly labeled.
Launch browser demo04Original system architecture
Three services, separated by responsibility.
The deployed application used a Next.js client, a FastAPI domain API, and an independently deployable FastAPI scanner. PostgreSQL held durable state; Redis, AWS, and Google provided supporting capabilities.
Client
Web applicationNext.js · React · TypeScriptApp Router UI, Tailwind design system, REST client
Edge
AWS EC2 hostNginx reverse proxyTLS termination · request limits · service routing
Services
Core serviceFastAPI REST APIAuth · profiles · binder · marketplace · chat · notifications · reviews
Scanner serviceFastAPI scannerImage preprocessing · OCR orchestration · catalog matching
Data & integrations
PostgreSQLDomain data + durable counters
RedisRate-limit windows
S3 + RekognitionScan image + text detection
Google OAuthOIDC identity provider
Containerized with Docker ComposeSchema migrations with AlembicOpenAPI-documented REST boundaries
05What I built
Engineering across product, platform, and operations.
The source repository preserves the full implementation: application code, migrations, tests, containers, API specifications, and deployment configuration.
02
A marketplace built from the collection model
Binder inventory is the source for listings. Listing states, buyer/seller ownership, scoped conversations, notifications, and reviews form one connected domain.
SQLAlchemyRESTstate model
03
A separately deployable scanner service
The scanner has its own FastAPI boundary and resource profile: image normalization, S3 upload, Rekognition OCR, and fuzzy matching against a local card catalog.
PillowS3Rekognition
04
Production-minded operating controls
Docker health checks, Nginx request and connection limits, Redis-backed registration throttling, durable usage caps, and environment-driven configuration control runtime risk and cost.
DockerNginxRedis
06Security engineering
Controls that are visible in the code.
This is a source-backed summary, not a claim of formal certification. Each item below maps to an implemented control in the preserved application.
Credential protection
Passwords are hashed with bcrypt through Passlib. Password-reset tokens are generated with a cryptographic RNG and stored as HMAC-SHA-256 digests rather than raw tokens.
Session and token handling
Signed JWT access tokens carry issued-at and expiry claims. Browser sessions use an httpOnly, SameSite=Lax cookie with a configurable Secure flag; API clients may use Bearer auth.
Authorization boundaries
Protected FastAPI dependencies resolve active users from validated tokens, while binder, marketplace, chat, notification, profile, and review routes enforce resource ownership and participant checks.
Edge and abuse controls
Credentialed CORS uses configured origin allowlists. Nginx applies endpoint-specific body, request, and connection limits; Redis and PostgreSQL back application-level rate and usage limits.
Configuration hygiene
Runtime credentials are read from environment-backed settings. The committed example file contains key names and safe defaults, while the real .env path is ignored by Git.
Transport and upload safeguards
The production proxy is configured for HTTPS through Certbot. Upload paths constrain request sizes and accepted formats, and the scanner decodes, rotates, converts, and bounds images before OCR.
07Technology
Built with a practical full-stack toolkit.
Next.js 15React 19TypeScriptTailwind CSSFastAPIPydanticSQLAlchemy 2AlembicPostgreSQL 16Redis 7Docker ComposeNginxAWS EC2AWS S3AWS RekognitionGoogle OAuthJWTPillowOpenCVRapidFuzzPytestVitest
08Explore the work
The product is simulated. The engineering is preserved.
Use the browser demo for the product story, then inspect the repository for the original services, domain models, migrations, tests, infrastructure, and API contracts.