A real-time, multi-tenant workspace platform built end to end, NestJS backend, Next.js frontend, production infrastructure included.
The Brief
I set out to build something past the portfolio-project ceiling, a real multi-tenant workspace tool with the parts that actually separate a working demo from production software: authentication that survives a stolen token, permissions that hold up when three people share a workspace, and infrastructure that doesn't fall over under load. Huddle is the result, built solo, backend to frontend to deploy.
The Problem
Anyone can wire up a login form. Fewer people handle what happens after: a refresh token needs rotating without logging the user out, a workspace invite needs a role attached before it means anything, a background job needs to fail safely instead of silently. Those are the decisions this project was built around.
My Approach
JWT access tokens paired with rotating refresh tokens in httpOnly cookies, plus Google OAuth as a second entry path. Tokens are revocable server-side, so a compromised session can actually be shut down, not just expired.
Workspaces are multi-tenant with owner, editor, and viewer roles. Invites go through an accept/reject flow, ownership can transfer, and every action checks both identity and role, not just whether a token is valid.
Redis handles per-user caching with real invalidation, and BullMQ processes background jobs like thumbnail generation asynchronously. The whole backend runs in Docker on a non-root user with a health check, deployed independently from the frontend.
What Shipped
Members, roles, and an invite flow with a pending-invite queue, accept or reject per invite, live in the UI shown here.
Notes sync across sessions over WebSockets. Two tabs open, one edit, both update. No refresh, no polling.
Under the Hood
17 verified Pact contract interactions between frontend and backend, k6 load testing against the live deployment, structured logging through nestjs-pino, and Sentry catching errors in production, not just in a terminal during development.
The Outcome
Every piece here, auth, permissions, caching, queues, testing, monitoring, was built and shipped inside this one codebase. Frontend on Vercel, backend on Render via Docker, database on Supabase-hosted Postgres, all wired to a live domain.
