Overview
A college community app that blends LinkedIn, Discord, and GitHub — connect with people, DM 1:1, join community channels, post projects for collaboration, and resolve others' help requests, all with a gamified profile that levels up with your activity.
- Real-time channels & private chat using Socket.io.
- Secure JWT-based auth across REST and websocket layers.
- Gamified XP loop encouraging helpful, high-signal community interactions.
The problem
Students helping each other had no real-time, focused space — and no incentive to give high-quality help.
My approach
A real-time community messaging platform with channels and private chat, plus a gamified XP system that rewards helpful contributions.
What I owned
Built solo as a learning project. Implemented the real-time channels and 1:1 DMs on Socket.IO, httpOnly-cookie JWT auth across both REST and websocket layers, the help-request lifecycle, the project-collaboration flow, and the gamified XP/levels system.
The hard part
Designing the gamified XP so it couldn't be farmed: a pair-collusion multiplier scales down repeated resolves between the same two users, per-tag falloff stops multi-tag stuffing, grindable actions have daily caps via a rolling 24-hour event window, and leveling is race-safe with atomic increments. Keeping auth consistent across REST and persistent websocket connections was the other half.
Why I built it
After KIIT Events I wanted to learn something new, so I picked real-time messaging — learned websockets, then grew it into a full college community app.
Architecture — REST + real-time around one hub
Shared SocketContext · hand-rolled useQuery cache · service worker
CORS/Helmet → cookie JWT → rate limit → zod validate
user / community / channel / conversation · persist to Mongo, then broadcast
XP engine (anti-collusion, daily caps) · notifications · web-push
owner / admin / moderator / member · muted / banned gating
one shared io instance broadcasts into rooms; Mongo is the shared persistence
Handlers write to Mongo then broadcast into rooms; XP, notifications and push are fire-and-forget side-effects, so they never block the primary response.
Honest caveats: community-message XP is designed (5 XP, 20/day cap) but that one event isn't wired to a route yet; the landing-page mockups are decorative; no automated frontend tests.