The problem
A campus marketplace needs more than listings. People need to understand who is selling, recover access to their accounts, upload photographs, and contact sellers without exposing internal credentials or giving other users control over their listings.
Team origins, individual contribution
The original application was a four-person York University course project. My original contributions included registration and recovery email notifications, password recovery, York email OTP verification, item search and live suggestions, and listing/homepage workflow fixes.
I then maintained an independent portfolio edition, adding production infrastructure, security improvements, cloud media storage, verification tiers, a protected demo, automated tests, and deployment work. The original team repository and contributor credit remain distinct from these later improvements.
A complete marketplace journey
Visitors can browse public listings. Sellers register and verify an email address; York email verification adds a York Verified Student badge. Listing ownership determines who can change or delete an item.
Reviewers can choose the read-only demo from the sign-in screen. Buyers use controlled email inquiries to contact sellers; payments and exchanges happen outside the application.
Architecture
- Java 17 + Spring Boot + Thymeleaf: service for server-rendered pages and application workflows.
- Spring Security: sessions, route protection, BCrypt password hashing, OTP verification, ownership policies, and demo restrictions.
- RabbitMQ: asynchronous message queue for email verification, password resets, and user notifications.
- Kubernetes & Docker: containerized deployment orchestrating marketplace services with high reliability.
- PostgreSQL + Flyway: persistent accounts/listings and versioned database migrations.
- Cloudflare R2 & AWS SDK: photograph storage with delivery through application-controlled routes.
- GitHub Actions CI/CD: automated Maven build and test suite running on every commit.
Making the course project durable
Moving beyond local development meant addressing data and image persistence, expiring verification and recovery credentials, owner-only mutations, and safe reviewer access.
The verification model also needed precise language: a Public Seller is not necessarily a York student, while the York badge indicates verified institutional email ownership.
Result and scope
The portfolio edition is a deployed marketplace with public browsing, persistent listings and photographs, account recovery, verification tiers, and a read-only reviewer path. The repository includes automated coverage of authentication, ownership, recovery, and media behavior.
This is a portfolio MVP. Payments, escrow, delivery, and real-time chat are outside its scope. The hosted application may take time to wake after inactivity.
What the project taught me
Production readiness often lives in the less visible paths: recovery, retries, persistence, ownership, and test coverage. Improving an existing team project also requires clear attribution and careful preservation of its original work.