Repository navigation
Portfolio: backend storage and API #43
Description
Part of #40. Depends on #41 and #42.
Scope
- A
Portfoliostable: user ID, unique username, portfolio data (JSON), status (draft, published, suspended), search visibility, created and updated times. Add the EF Core migration for SQLite and PostgreSQL. - Signed-in endpoints under
/api/platform/portfolio, with antiforgery on changes: get own portfolio, save draft, check and claim a username, publish, unpublish, delete. - A public read endpoint by username that returns published portfolios only. Drafts, suspended pages and unknown usernames return 404.
- Validate on the server with the shared rules. Use the authenticated identity, never a browser-supplied account ID.
- Deleting the account also deletes the portfolio.
- Rate-limit saves and username checks.
Done when
Integration tests in backend/tests/ cover sign-in, antiforgery, validation errors, publish states, deletion, and that one student cannot read another's draft or change their portfolio.
Activity
Coding-Professional commentedon Nov 10, 2026
Starting #43. I will add provider-backed portfolio storage and authenticated APIs using the shared validator, with separate draft/published snapshots, username uniqueness, antiforgery, rate limits, and isolation/state/deletion tests. Neon/PostgreSQL remains the selected hosted provider; existing SQL Server and MongoDB adapters will retain the same contract.
Public publishing will default to disabled until the owner decisions and launch wording tracked by #48 are complete. Account-deletion cascading will be enforced by relational foreign keys and Mongo's account document ownership; this issue does not add an account-management UI.