Blog Platform (Blogify)

The Problem

Most simple blogging demos ship basic CRUD with no real access control. Blogify was built to demonstrate that a full CMS for multiple authors needs a real approval gate — without vetting, spam and low-quality accounts pollute the platform immediately. The challenge was building a three-tier permission model where Admins control who can publish, Authors control their own content, and Readers interact only through comments.

The Solution

A role-based multi-user CMS with a mandatory account approval workflow. New registrations land in a pending queue visible only to Admins, who can approve or reject with one click. Once approved, Authors get access to a rich text editor, category management, and image uploads. Readers can comment on any post. The entire UI runs on a custom premium dark glassmorphism theme built with pure CSS variables — theme switching is instant with no layout shift.

Architecture

• →Presentation Layer: ASP.NET Core MVC controllers and Razor Views with Bootstrap 5 and jQuery for AJAX interactions.
• →Application Layer: Service interfaces, DTOs, and business logic for post management, comments, and user workflows.
• →Domain Layer: Entities and repository interfaces — Post, Category, Comment, ApplicationUser with approval state.
• →Infrastructure Layer: EF Core + SQL Server, ASP.NET Identity for auth and role management.
• →Security: CSRF protection via AntiForgery tokens, XSS sanitization on rich-text content, file-type validation on image uploads.

Key Features

• ✓Account approval workflow — new users must be vetted by an Admin before accessing the system
• ✓Three-tier RBAC — Admin (dashboard/user management), Author (content creation), Reader (commenting)
• ✓Rich text editor for creating fully formatted blog posts with image uploads
• ✓Category and tag management for organizing content at scale
• ✓Nested commenting system with per-post moderation controls
• ✓Author profiles and bio pages with post history
• ✓Full-text search and filtering across posts and categories
• ✓Glassmorphism-inspired dark theme with gradient accents and smooth micro-animations
• ✓CSRF protection, SQL injection prevention, XSS sanitization, and file upload validation
• ✓Admin dashboard with real-time platform statistics and pending-approval queue

Screenshots

Code Highlight

public class PostService : IPostService
{
    private readonly IPostRepository _postRepository;
    private readonly IMapper _mapper;

    public PostService(IPostRepository postRepository, IMapper mapper)
    {
        _postRepository = postRepository;
        _mapper = mapper;
    }

    public async Task<PostDto> CreatePostAsync(CreatePostDto dto, string authorId)
    {
        var post = new Post
        {
            Title      = dto.Title,
            Content    = dto.Content,
            Slug       = GenerateSlug(dto.Title),
            AuthorId   = authorId,
            CategoryId = dto.CategoryId,
            CreatedAt  = DateTime.UtcNow,
            IsPublished = dto.IsPublished
        };

        await _postRepository.AddAsync(post);
        return _mapper.Map<PostDto>(post);
    }

    private string GenerateSlug(string title)
    {
        return title.ToLower()
            .Replace(" ", "-")
            .Replace("--", "-");
    }
}

Challenges & Solutions

Tech Stack

What I Learned

• 💡Role-based access controls (RBAC) require crystal-clear authorization boundaries — a missing [Authorize(Roles="Admin")] attribute on a single controller action is enough to create a privilege escalation vulnerability.
• 💡Client-side debouncing is essential when implementing responsive live search — without it, every keystroke fires a database query and spikes load under concurrent users.
• 💡Designing a custom theme with pure CSS variables makes runtime theme-switching trivially fast compared to swapping framework class sets.

Links