Building an AI-assisted full-stack portfolio

The site needed to do more than present a résumé. It had to publish technical writing, let readers participate through accounts and comments, and make projects discoverable. Those flows connect the interface, application routes, authentication, stored content, and deployment.

This is my personal portfolio. I directed an AI-assisted improvement process: identifying problems through real user journeys, setting requirements, reviewing the proposed behavior, and checking the deployed result. The work covered the public interface, reader profiles, email verification, password recovery, blog publishing, and search visibility.

Next.js App Router serves the public pages and application endpoints. React components provide interactive account forms and profile controls. MongoDB stores users, articles, projects, and comments through Mongoose models. NextAuth handles authentication, while server endpoints validate requests and enforce access rules.

Blog pages render article content on the server. Rich-text content is sanitized before display, and canonical metadata, structured data, topic pages, and a dynamic sitemap describe published content to search engines.

Testing exposed a confusing flow: signup asked for a password, then the verification link asked the reader to choose one again. Email ownership also needed to be established before a reader could participate.

The revised flow collects name and email first. The verification page checks the link, then the owner chooses a password to finish setup. Verification tokens are stored as SHA-256 hashes, expire, and are consumed through a conditional database update. This keeps the setup sequence clear while tying account activation to control of the email address.

The tradeoff is that password setup happens after opening the email. Clear waiting, verification, success, and expired-link states are essential to make that extra navigation understandable.

A real recovery test showed that the form accepted the current password as the replacement. The endpoint now compares the proposed password with the stored bcrypt hash and returns a useful error when they match, leaving the reset token available for another attempt.

A successful reset updates the password, removes recovery tokens, and increments a session version so previous sessions no longer remain valid. Conditional updates also prevent an already-consumed token from being reused.

A collection of 100 technical articles needed navigation as well as individual pages. The blog uses pagination, search, and topic hubs so readers can narrow the collection. Server-rendered article bodies and dynamic sitemap entries make the published content available without relying on client-side loading.

The collection is live, but publication alone does not demonstrate search traffic or business impact. Those outcomes need to be measured separately.

The workflow follows problem, plan, implementation, review, and refinement. Browser tests surfaced unclear account behavior; source inspection connected those symptoms to application logic; focused changes were checked with tests and production builds before deployment.

AI helped explore the codebase, implement changes, and draft content. Human review set the intended behavior and corrected assumptions. This process required inspecting real routes and data models rather than accepting plausible-looking output as evidence.

The deployed site includes email-first account setup, email verification, reader profiles, password recovery with current-password rejection, and a navigable 100-article technical collection. The account changes were checked with automated tests and hands-on browser journeys, and deployments were checked on the live site.

The next evidence to collect is search indexing and impressions, article engagement, contact conversion, and performance under measured conditions. No traffic gains or conversion improvements are claimed here.