Credentials authentication and JWT sessions
Auth.js Credentials authentication uses encrypted JWT sessions because database-session support is not used for this provider strategy. It is a fit for this architecture, not a universal default.
Full-stack product · Career management
CareerFlow
2026 / v1.0A production-deployed application for organizing job opportunities, application progress, deadlines, and targeted resume versions.
01
The problem
A serious job search quickly produces more information than a simple list can handle: opportunities at different stages, follow-up dates, salary ranges, deadlines, and multiple resume versions.
That information often fragments across notes, bookmarks, spreadsheets, calendars, and files. CareerFlow was designed to bring the workflow into one focused, account-scoped system without turning it into a noisy productivity suite.
02
The product
The central workflow follows an opportunity from first capture to final outcome while keeping the resume used for that application connected to the record.
- 01Register and sign in
- 02Save an opportunity
- 03Track status and dates
- 04Search and filter
- 05Review dashboard insight
- 06Connect a resume version
03
Product experience
04
Architecture
CareerFlow is one Next.js application: React interfaces and Server Components call server-owned application logic, Auth.js establishes identity, and Prisma persists owned data in PostgreSQL on Neon. Vercel hosts the application and health endpoint.
InterfaceReact browser UI
ApplicationNext.js on VercelServer Components · Actions · routes
Identity + dataAuth.js + PrismaCredentials · JWT sessions
PersistencePostgreSQL on Neon
05
Important engineering decisions
Ownership isolation
Every application and resume operation is scoped to the authenticated user on the server. Knowing another record’s URL or identifier is never authorization to read or change it.
Money in minor units
Salary ranges are stored in ISO 4217 minor units, then formatted with the runtime’s internationalization support to avoid floating-point currency errors.
A consistent date model
Version 1.0 uses UTC consistently instead of introducing partially implemented user-time-zone behavior.
Resume families and versions
A shared resume family can contain independently labeled versions, and each application can reference the version used for that opportunity.
Stable migration history
Once deployment history was established, existing database migrations were retained rather than rewritten for presentation convenience.
06
Quality and validation
The release-readiness suite completed with 179 passing tests when the PostgreSQL-backed test environment was enabled. The default suite reports 150 passing tests and gates 29 database tests until that disposable environment is available.
- 179
- passing tests with the PostgreSQL-backed release environment enabled
- 150 + 29
- default passing tests plus database-gated tests in the full baseline
- 0
- known npm audit vulnerabilities at the v1.0 release checkpoint
Validation also covered the production build, migration application, authentication and protected routes, ownership isolation, desktop and mobile browser behavior, and an accessibility review. These are release-baseline results, not a claim that the software is formally certified or bug-free.
07
Accessibility
Accessibility was treated as product behavior: semantic controls, keyboard navigation, visible focus, managed dialogs, connected validation errors, an accessible mobile drawer, screen-reader labels, and reduced-motion awareness.
The work was reviewed across common keyboard and responsive paths; it is not presented as formal WCAG certification.
08
Deployment and operations
The portfolio release runs within a zero-cost operating constraint on Vercel Hobby and Neon Free. Production environment variables are encrypted by the hosting platform, and a minimal health endpoint checks database readiness without disclosing connection data.
- Free-tier provider quotas apply.
- Neon may scale to zero, so the first request after inactivity can be slower.
- Authentication rate limiting is process-local rather than shared infrastructure.
- The release is a portfolio deployment, not a commercial service with an SLA.
09 / Product preview
Ten seconds through the core workspace.
The silent preview shows the dashboard, opportunity tracking, application editor, and resume organization. The adjacent text provides the same overview without requiring playback.
10
Result
CareerFlow demonstrates the complete product lifecycle: scoped product design, authentication, relational data, responsive and accessible interfaces, automated testing, deployment, and honest release documentation.