StreamNexus is a full-stack streaming rental prototype with role-based admin and streamer workflows, MongoDB persistence, and a simulated checkout flow.
Portfolio status: local/demo-ready documentation. This README does not claim hosted production deployment, real users, payment processing, compliance, final screenshots, or a recorded demo video.
Final portfolio screenshots are not embedded yet. Add them only after capturing real screens from a verified local or demo runtime.
The final demo video is not included yet. The MP4 and thumbnail paths are reserved for a real recording that Yash will add manually.
Planned demo path: docs/assets/videos/streamnexus-demo.mp4
StreamNexus models the core workflows of a streaming rental product:
- Admins manage catalog content and review rental activity.
- Streamers can create a streamer account, browse titles, search and filter content, open floating detail panels or details pages, build a shortlist, rent available content, and complete a simulated rental return.
- Rental access lasts 45 days: 30 rental days plus 15 StreamNexus bonus days.
- MongoDB stores users, content, rentals, and session data.
- Server-rendered EJS views keep the interface simple to inspect, run, and test.
This is a portfolio prototype, not a production OTT platform. It does not include real payment processing, real media playback, subscription billing, a production identity provider, or compliance certification.
| Area | Implemented capability |
|---|---|
| Authentication | Session-based login/logout, streamer signup, and seeded local demo users |
| Authorization | Admin and streamer route guards |
| Admin tools | Dashboard, catalog list, create/edit/delete content, rental capacity, rental summary views |
| Streamer flows | Landing, signup, browse, hero carousel, search, filter, content modal, details, similar titles, shortlist, rentals, simulated completion |
| Persistence | Mongoose models for users, content, and rentals |
| Security basics | Password hashing, CSRF checks, login rate limiting, Helmet headers, validated ObjectIds |
| Assets | Local poster images for seeded demo titles with documented source notes |
| Testing | Syntax, integration, EJS compile, dependency audit, secret scan, and bounded load checks |
| CI | GitHub Actions workflow for install, tests, EJS compile, audit, and secret scan |
| Layer | Technology |
|---|---|
| Runtime | Node.js, CommonJS |
| Server | Express 5 |
| Views | EJS, express-ejs-layouts |
| Styling | Vanilla CSS |
| Browser behavior | Vanilla JavaScript |
| Database | MongoDB |
| ODM | Mongoose |
| Sessions | express-session, connect-mongo |
| Security middleware | helmet, express-rate-limit, custom CSRF middleware |
| Auth utilities | bcryptjs |
| Forms | method-override, server-rendered EJS forms |
| Environment config | dotenv |
| Testing | Node test runner, Supertest, mongodb-memory-server, local load script |
StreamNexus uses a compact MVC/service structure:
Browser
-> Express routes
-> Controllers
-> Services
-> Mongoose models
-> MongoDB
-> EJS response or JSON response
Primary boundaries:
app.jsconfigures Express, middleware, sessions, routes, startup, and demo seeding.routes/defines feature-level HTTP routes.controllers/handles request flow, validation handoff, redirects, and view rendering.services/owns database operations and business rules.models/defines Mongoose schemas.middleware/contains auth, role checks, CSRF handling, rate limiting, and errors.views/renders admin and streamer screens.test/verifies high-risk flows with Supertest and an in-memory MongoDB server.
Supporting docs:
Prerequisites:
- Node.js 20 or newer
- npm
- Local MongoDB or a MongoDB Atlas connection string
Install dependencies:
npm installCreate a local environment file from the safe template:
cp .env.example .envUpdate .env locally. Do not commit .env.
Start the app in watch mode:
npm run devStart without watch mode:
npm startOpen the local app:
http://localhost:3000
Use .env.example as the source of safe placeholder values. The real .env file is local-only and must stay out of git.
Key values:
| Variable | Purpose |
|---|---|
PORT |
Local HTTP port |
NODE_ENV |
Runtime mode |
MONGO_URI |
Local MongoDB or Atlas database URI |
SESSION_SECRET |
Session signing secret, required for production mode |
SEED_DEMO_DATA |
Enables local demo records when set to true |
DEMO_ADMIN_EMAIL / DEMO_ADMIN_PASSWORD |
Optional local admin demo credentials |
DEMO_STREAMER_EMAIL / DEMO_STREAMER_PASSWORD |
Optional local streamer demo credentials |
LOGIN_RATE_LIMIT_WINDOW_MS / LOGIN_RATE_LIMIT_MAX |
Login rate-limit tuning |
LOAD_TEST_ITERATIONS / LOAD_TEST_MAX_AVG_MS / LOAD_TEST_MAX_P95_MS |
Local load-test thresholds |
Default local seeded accounts exist in code when demo overrides are not provided:
| Role | Password | |
|---|---|---|
| Admin | admin@gmail.com |
admin |
| Streamer | streamer@gmail.com |
streamer |
These credentials are for local development only. Override them before any shared demo.
Run the main documentation and release-readiness checks:
git status --short
npm test
npm run test:ejs
npm audit --audit-level=moderate
npm run scan:secrets
npm run test:loadWhat these gates cover:
- JavaScript syntax checks
- Integration tests for auth, roles, CSRF, admin content creation, streamer shortlist/rental flows, search handling, and login rate limiting
- EJS template compilation
- Dependency audit at moderate severity or higher
- Tracked secret-pattern scan
- Bounded local load smoke check
QA evidence lives in docs/qa. Existing QA screenshots under docs/qa/screenshots/ are evidence artifacts, not final README media.
.envand.env.*are ignored;.env.exampleis the tracked safe template.- Local workspace metadata, logs, dumps, generated runtime data, and platform state should remain untracked.
- Do not commit MongoDB credentials, session secrets, service account files, private notes, or raw logs.
- Checkout is simulated and does not process real payments.
- The load test is a local regression smoke check, not a production capacity claim.
- Public docs must avoid private career strategy, internal paths, fake media, fake metrics, and unverifiable claims.
See also:
The README expects these future portfolio media files. Keep the filenames stable so links continue to work after Yash adds real captures.
| Slot | Future path | Capture intent |
|---|---|---|
| 01 | docs/assets/screenshots/01-home-desktop.png |
Desktop landing page |
| 02 | docs/assets/screenshots/02-library-or-dashboard-desktop.png |
Main streamer library or admin dashboard with capacity |
| 03 | docs/assets/screenshots/03-search-filter-desktop.png |
Search and filter behavior |
| 04 | docs/assets/screenshots/04-detail-page-desktop.png |
Content modal or detail page |
| 05 | docs/assets/screenshots/05-empty-state-desktop.png |
Empty or no-results state |
| 06 | docs/assets/screenshots/06-mobile-home.png |
Mobile entry or home state |
| 07 | docs/assets/screenshots/07-mobile-core-flow.png |
Mobile core streamer flow |
| Video thumbnail | docs/assets/videos/streamnexus-demo-thumbnail.png |
Real thumbnail from the demo recording |
| Demo video | docs/assets/videos/streamnexus-demo.mp4 |
Real walkthrough recording |
Do not embed these media paths in public README sections until the matching files exist and have been captured from the verified app.
| Priority | Item | Status |
|---|---|---|
| High | Add real portfolio screenshots and demo video | Planned |
| High | Verify real local runtime after Yash recreates .env |
Planned |
| High | Add a deployment guide after a provider is selected and verified | Planned |
| Medium | Add password reset and stronger non-demo account policy | Planned |
| Medium | Add watch-history UI for the existing model field | Planned |
| Medium | Add pagination for larger catalog and rental lists | Planned |
| Medium | Add richer filtering by genre, rating, price, and availability | Planned |
| Low | Add poster upload or asset management flow | Planned |
Yash Kanadhia
This repository includes an MIT License file: LICENSE.