MyBlog - Private Community CMS

Project Use Case & Core Philosophy

MyBlog was engineered as a secure, gated-community content platform. Unlike standard public-facing blogs (like Medium or WordPress), MyBlog is built for private organizations, exclusive networks, or internal enterprise teams where content visibility must be strictly controlled. Unauthenticated access is explicitly blocked at the middleware level—if you aren't logged in, you can't see anything.

The core philosophy behind this project was to build a Decoupled Monolith. It leverages the immense power and security of Django and Django REST Framework (DRF) on the backend, while abandoning heavy frontend frameworks (like React or Next.js) in favor of lightweight, lightning-fast Vanilla ES6 JavaScript.

Granular Role-Based Workflows

The platform enforces strict authorization boundaries via custom Django Mixins and DRF Permissions, creating three distinct user experiences:

1. The Regular User (View-Only):

   • Authenticated users access a secure, dynamic feed of articles.
   • They can consume rich media, interact by liking posts, and participate in community discussions by leaving comments.
   • Constraint: They have absolutely zero access to backend mutation endpoints.

2. The Staff Member (Content Creator):

   • Granted access to the custom-built JavaScript-driven CMS.
   • Capable of drafting complex articles utilizing a fully integrated Quill.js Rich Text Editor.
   • Responsible for uploading featured images and attachments.
   • Empowered to moderate the community by reviewing, approving, or rejecting user comments before they are published.

3. The Administrator (Superuser):

   • Full oversight across the entire ecosystem.
   • Access to an Analytics Dashboard monitoring platform engagement metrics.
   • User Management capabilities: promoting users to Staff, disabling malicious accounts, and overseeing all content categories.

Deep-Dive: Architecture & Engineering

1. Custom JWT Security Architecture

Instead of relying on standard LocalStorage (which is highly vulnerable to XSS attacks), the authentication system was built entirely around HttpOnly Cookies.

• A custom Django middleware intercepts incoming requests to read the JWT tokens.
• If an Access Token is expired, the middleware automatically validates the Refresh Token and silently rotates the credentials without disrupting the user's session.
• Token blacklisting and CSRF protections are strictly enforced.

2. Frontend Engineering (Vanilla SPA)

The custom CMS was engineered to feel like a modern Single Page Application (SPA) without the massive bundle size of React.

• ES6 Modules: Logic is neatly organized into separate modules (api.js, endpoints.js).
• Asynchronous DOM Manipulation: Utilizing the native Fetch API, tables, forms, and modals update asynchronously.
• Design System: Built with Bootstrap 5 and custom CSS (featuring glassmorphism aesthetics) to deliver a premium, responsive UI.

3. Scalable Media Management

Handling media uploads dynamically was a major priority.

• The platform utilizes django-storages and boto3.
• Controlled via a single USE_S3 environment variable, the application seamlessly toggles between Local Storage (for rapid local development) and AWS S3 (for highly available production environments).
• File uploads are validated for size and type before ever hitting the cloud.

4. Database & ORM Efficiency

• Custom User Model: Extends Django's AbstractUser to include profile management and status tracking.
• Optimized Querying: DRF serializers utilize select_related and prefetch_related to prevent N+1 query problems when fetching posts with their respective authors, categories, and approved comments.