RASIT · DEV · DEFENSE
Back to selected work

Full-stack product

Ruta

A private travel-planning product with itinerary, budget, maps, saved places, and a self-contained guided demo that never touches private data.

Editorial travel artwork from the self-contained Ruta portfolio demo
Role

Full-stack development and technical documentation

Year

2026

Status

Private product · public guided demo

Stack

Angular 22 · TypeScript · NestJS 11 · Prisma 7

01

The problem

Travel plans are usually split between notes, maps, spreadsheets, and booking references. Ruta brings the itinerary, daily activities, budget, saved places, and route context into one coherent workspace while keeping the real product invite-only.

02

My contribution

I developed the Angular client and its sibling NestJS API, kept their contract synchronized through generated OpenAPI code, documented local and production workflows, and created a portfolio demo that can be reviewed without an account or backend access.

03

The solution

The Angular SPA uses signals, reactive forms, and Leaflet. Its generated client consumes the API contract exported by NestJS. Prisma and PostgreSQL persist the private product, while the public demo loads a versioned Valencia snapshot into an isolated localStorage key.

04

System architecture

A typed client-server boundary keeps the frontend and API aligned, while external providers and secrets remain behind NestJS.

Key decisions

  • The public demo uses a frozen, fictional travel snapshot and does not initialize a private session.
  • Maps in the demo use a local vector background; geographic and routing providers are not called during a visit.
  • The generated API client is committed and updated through a shared synchronization command instead of manual edits.

Security and privacy

  • Open registration is disabled; personal invitations fix the email, expire, and can be used only once.
  • Access tokens remain in memory and refresh uses a rotating opaque token in an HttpOnly cookie.
  • Provider keys stay in the API, and production protections include Turnstile, rate limits, reauthentication, export, and account deletion flows.

Validation

  • Unit, coverage, build, lint, and browser end-to-end workflows are documented in both repositories.
  • Playwright exercises the real API, PostgreSQL, and Mailpit while mocking credit-consuming providers.
  • The demo test blocks API and map-provider traffic, runs Axe, checks keyboard navigation, and covers desktop, tablet, and mobile.
05

Public evidence

The client and API repositories document the product boundary, security model, demo limitations, and reproducible verification commands.

01

Angular application

Client architecture, guided demo, maps, account flows, and validation.

Review client repository
02

NestJS API

Authentication, providers, limits, persistence, OpenAPI contract, and tests.

Review API repository
Angular workspaceNestJS APIOpen guided demo
Next case studyTFG Commerce
Discuss this workDownload résumé