ShareFile
Self-hosted file sharing with JWT/OAuth2 authentication
| Role | Solo full-stack developer |
|---|---|
| Period | May 2025 – Jun 2025 |
| Stack | Next.js 15, NestJS 11, TypeORM, Docker |
| Repo | https://github.com/AdrianRCV/ProyectoIntegrado-ASIR |
No public deployment — built as the final project for my Network Systems Administration (ASIR) degree and demoed locally.
Context
A self-hosted file-sharing platform built as the final project for my Network Systems Administration (ASIR) degree — the brief was to design and ship a complete, deployable system end to end, not just a proof of concept. ShareFile lets a user upload files and share them with specific people or via a link, with control over who can access what and for how long.
Role & scope
Solo full-stack developer, May 2025 – Jun 2025. Designed the data model, built the NestJS API and the Next.js frontend, and packaged the whole thing with Docker so it could be handed in and run anywhere without manual setup.
Architecture
The frontend (Next.js) talks to a NestJS REST API backed by TypeORM. Two authentication paths feed the same authorization model: email/password with JWT for direct accounts, and OAuth2 (Google) for users who'd rather not create another password. Uploaded files are stored on disk behind the API — never served directly — so every download goes through a permission check first. Docker Compose bundles the API, the frontend, and the database into one reproducible stack.
| Layer | Choice |
|---|---|
| Frontend | Next.js |
| Backend | NestJS 11 |
| Data | TypeORM |
| Auth | JWT + OAuth2 (Google) |
| Packaging | Docker Compose |
Key decisions
Hard problem
Making sure a shared file could be revoked instantly was harder than it sounds. A share link needed to stop working the moment access was revoked — not "eventually," not "after the next cache expiry." That meant every download request had to re-check permissions against the live database rather than anything cached, which is straightforward in isolation but easy to accidentally undermine with any layer (a CDN, a signed URL with its own expiry, a static file server) that doesn't know about revocation. Keeping the whole path — from request to bytes on the wire — behind one live permission check was the actual constraint the rest of the design had to respect.
Results
Delivered as the final project for the ASIR degree, packaged with Docker so it could be built and run in a clean environment without manual setup — the requirement the project was actually graded against.