Problem
I wanted to manage posts, projects and service content without changing code for every update. The platform also needed Turkish and English content, with distinct permissions for visitors, readers and administrators.
My contribution
I connected a Next.js and TypeScript frontend to a .NET 8 Web API with Entity Framework Core and SQLite. I implemented the role-based CMS, comment moderation and TR/EN content workflows. Project kind, access status, a technical decision in both languages and a case-study link are managed through the admin panel.
Architecture
This diagram summarizes authentication and protected content management.
Browser
→ Next.js BFF / server actions
→ .NET 8 API: identity and role checks
→ EF Core → SQLite
Login response → BFF → httpOnly JWT cookie
Protected request → BFF → Bearer token to APIBrowser JavaScript cannot read the JWT. The API performs the final administrator authorization check; hiding a control in the interface does not enforce access.
One decision and its tradeoff
I chose a BFF that stores the JWT in an httpOnly cookie and forwards it to the API from the server. This prevents client code from reading the token, while adding a server intermediary and responsibility for cookie-based request security.
Evidence
The local source review dated includes tests addressing administrator, reader and anonymous access, plus content persistence. The local backend suite passed 58 tests on that date, including bilingual persistence and role-boundary scenarios. The public product can be explored on my personal website. The source repository and tests are private, so no public repository or CI link is offered.
Limitations
An accessible homepage does not verify every admin workflow. Backend tests, TypeScript checks and the production build were run before release. Passing checks do not prove that every possible user flow or security property is covered. I make no high-traffic or multi-server scaling claim for the SQLite setup.