Repository navigation
docs: propose ADR 0002 for student portfolios - #54
Conversation
Record the proposed model for student portfolios: fixed fields filled through an editor or a Markdown import, project-owned themes, shared validation rules, /u/<username> addresses with subdomains later, opt-in search visibility, and operator moderation. List the decisions that still need the owner's call. Link the record from the documentation index, the development guide and the architecture guide. Refs #41
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
procoder-ji
left a comment
procoder-ji
left a comment
There was a problem hiding this comment.
Reviewed the four-file diff against ADR 0001, the current Google/cookie/BFF implementation, and issues #40, #41, #43 and #48. No blocking findings for merging this as a Proposed ADR. The fixed portfolio model, shared validation, trusted backend, private draft states and explicit moderation boundary fit the existing architecture.
Checked 27 relative documentation links; all resolve. Frontend and backend CI pass; browser/SEO CI is still running at review time.
Three nonblocking wording/source notes are inline. The owner decisions remain open, and this review does not change the ADR to Accepted or clear the launch prerequisites.
| ### Address | ||
|
|
||
| Phase 1 serves portfolios at `/u/<username>` on the main site. No DNS work is needed, and the | ||
| feature can launch as soon as the pages exist. |
There was a problem hiding this comment.
Nonblocking wording: this launch statement is broader than the prerequisites listed in the status and owner questions. Suggest: 'Phase 1 does not require DNS changes.' Public launch still needs the backend, moderation and owner/legal decisions tracked by #40.
There was a problem hiding this comment.
Agreed. Changed to "Phase 1 does not require DNS changes" and added that public launch still needs the backend, moderation, and the owner and legal decisions tracked in #40.
|
|
||
| ## Open questions for the owner | ||
|
|
||
| 1. **Age requirement.** India's DPDP Act requires verifiable parental consent before processing |
There was a problem hiding this comment.
Nonblocking source/timing clarification for #48: please cite the commencement notification and distinguish the statutory requirement from the proposed product policy. Section 9 is scheduled to commence 18 months after 13 November 2025, so the present-tense statement is premature on this ADR's date. Keeping age/consent review as a launch prerequisite is sensible. Source: MeitY commencement notification.
There was a problem hiding this comment.
Thanks, you are right about the timing. The ADR now cites the DPDP Rules, 2025 notification (MeitY, 13 November 2025, G.S.R. 843(E)), states that Section 9 is scheduled to commence 18 months after that date and is not yet in force, and separates the statutory requirement from the proposed 18+ product policy.
| 3. **Phase 2 domain.** Serve subdomains under `procoderji.com`, or buy a separate domain for | ||
| student pages (as GitHub uses `github.io`)? A separate domain protects the main site's | ||
| reputation if a page is abused. Wildcard certificates on Vercel need Vercel nameservers or | ||
| delegation of the `_acme-challenge` record. |
There was a problem hiding this comment.
Nonblocking Phase 2 clarification: Vercel's managed wildcard certificate documentation specifies the nameservers method. Please remove the generic _acme-challenge delegation alternative or link a Vercel-supported workflow before treating it as a deployment option in #49. Generic ACME delegation alone does not establish support in Vercel's managed certificate service.
There was a problem hiding this comment.
The alternative is Vercel's own documented workflow: https://vercel.com/kb/guide/wildcard-domain-without-vercel-nameservers (enable Vercel DNS, add NS records for _acme-challenge pointing to Vercel's nameservers, add a wildcard CNAME to cname.vercel-dns-0.com). I kept it and linked that guide next to the nameservers guide so #49 has a supported reference for both options.
Narrow the Phase 1 statement to "no DNS changes required" and point to the launch prerequisites tracked in #40. Cite the DPDP Rules, 2025 notification and distinguish the statutory timeline for Section 9 from the proposed age policy. Link Vercel's documented _acme-challenge delegation guide for the Phase 2 wildcard alternative.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
Summary
Closes #41. Part of #40.
Adds
docs/decisions/0002-student-portfolios.md, the decision record that the Phase 1 portfolio issues (#42 to #48) build on. It records:shared/portfolio/, validated in both TypeScript and .NET: field limits,https/mailto:links, username format, reserved names and blocked phishing words./u/<username>in Phase 1; subdomains in Phase 2 viasrc/proxy.ts, with host-only cookies guarded by a test.The record is linked from
docs/README.md,docs/development.mdanddocs/architecture.md.Checks
npm run lint/typecheck/test/build(not applicable: documentation only)Review notes
Status is Proposed. The open questions are the owner's decisions; once answered, update the ADR status to Accepted in a follow-up.