trbureiyan/devurityweb

Purpose and entry points

DevurityWeb is a single Next.js platform for Devurity’s public presence and internal member operations: projects, content updates, profiles, membership administration, and QR attendance. App Router pages begin at app/page.tsx; global composition is in app/layout.tsx; request-wide authorization starts in middleware.ts.

Presentation and route boundary

Server-rendered public routes cover institutional content, projects, updates, gallery, and auth. Protected routes group internal role-specific areas: admin, content manager, project leader, and profile pages.

• app/projects/page.tsx

• app/updates/[slug]/page.tsx

• app/(protected)/admin/layout.tsx

• app/(protected)/profile/[id]/page.tsx

Client components provide interactive page behavior while routes remain the primary SSR/SEO boundary.

• components/projects/ProjectsPageClient.tsx

• components/updates/UpdatesPageClient.tsx

• components/admin/AdminDashboardClient.tsx

Authentication, authorization, and request security

Custom JWT authentication is verified in edge-compatible code; middleware applies RBAC before protected pages are reached. Auth route handlers implement login, refresh, registration approval/token flow, profile access, and password recovery. State is exposed to the UI through an auth context/hooks layer.

• middleware.ts

• lib/auth/middleware.ts

• lib/auth/jwt-edge.ts

• app/api/auth/login/route.ts

• contexts/AuthContext.tsx

Mutating flows are protected by double-submit CSRF, while login attempts are rate limited. ALTCHA challenge handling protects applicable public interactions.

• lib/csrf.ts

• lib/rateLimit.ts

• app/api/altcha/challenge/route.ts

API and business operations

Route handlers under app/api are the server boundary for browser mutations and client-driven reads. Domains include users/admin, projects, skills, updates, attendance, QR issuance, and contact.

• app/api/admin/users/[id]/role/route.ts

• app/api/projects/[id]/route.ts

• app/api/asistencia/route.ts

• app/api/qr-dinamico/route.ts

The attendance flow generates dynamic QR data, accepts attendance submissions, and supports administrative review/export.

• app/api/qr-dinamico/route.ts

• app/api/asistencia/route.ts

• app/api/admin/attendances/export/route.ts

Data-access architecture

Server Components and handlers consume domain data modules, which delegate persistence to repositories; repositories isolate Prisma/PostgreSQL access. This is the principal data boundary and keeps database queries out of UI and API orchestration.

• lib/data/projects.ts

• lib/data/updates.ts

• repositories/projects/projects.repositories.ts

• repositories/users/users.repositories.ts

• lib/postgresDriver.ts

Public data can be cached through Next server caching/tag mechanisms.

• lib/cache-tags.ts

• lib/data/landing.ts

Persistence, deployment, and integrations

PostgreSQL is modeled with Prisma, including seeded reference/domain data for roles, programs, skills, projects, and updates.

• prisma/schema.prisma

• prisma/seed.ts

• prisma/seeders/01-roles.ts

The runtime is Next.js 15/React 19 with TypeScript, deployed for Vercel serverless execution and edge middleware. Email-backed recovery and operational notifications are abstracted behind:

• lib/email.ts

• vercel.json