Cherished Lives

Overview

Cherished Lives lets families create memorial profiles for people, couples, or pets; collaborate through owner/manager/viewer roles; collect and moderate tributes; compose photo/video slideshows with background music; and link physical QR tags to living memorial pages. The same codebase powers multiple branded tenants (white-label apps) across English, Spanish, French, and German.

My role

Full-stack engineer owning flagship feature implementation end-to-end — slideshow engine, life events, family members, tribute moderation, and the private-profile access pipeline — plus auth infrastructure, caching, and the integration test suite.

• Implemented the AccessRequest approval pipeline for private profiles, supporting both authenticated users and anonymous guests with full audit trails and email/Pusher notifications at every state change
• Built tribute moderation: pending state when a profile requires approval, approve/reject endpoints, and real-time + email notifications to authors and managers
• Created the invitation system with tokenized emails and automatic promotion of pending managers on signup — including Google sign-in paths
• Engineered the slideshow builder: ordered media, drag-to-reorder persistence, up to three synchronized background tracks, transition effects, and a full-screen viewer
• Delivered QR tag lifecycle tooling: bulk generation with branded CSV export, CSV import with error reporting, camera-scanned linking flows, and printable QR pages
• Added optional Redis read-through caching for hot profile reads with invalidation on writes, degrading gracefully without Redis
• Covered core flows with 14 Vitest integration suites running against mongodb-memory-server (auth, profiles, tributes, moderation, comments, likes, slideshows, access management)

Architecture & technical decisions

Three-app system

Next.js 16 / React 19 main app (App Router), an Express 5 admin backend sharing the same database, and a Next.js 16 admin panel — MongoDB modeled with Prisma across all three.

Multi-tenancy by appId

Every model is scoped by appId; white-label Apps define localized logos and branding, with locale-aware assets served per tenant.

Auth

next-auth with Google OAuth and credentials providers: bcrypt passwords gated by email-verification OTPs, suspension checks, and an impersonation token path where the admin backend signs short-lived JWTs the main app verifies against NEXTAUTH_SECRET.

Media pipeline

Direct browser uploads via presigned PUTs to S3-compatible storage; heavy processing (ffmpeg video re-encode and thumbnails, sharp image optimization, audio conversion) runs in the admin backend service.

Realtime & i18n

Pusher private channels with server-side authorization endpoints for profile-specific events; next-intl with middleware detecting locale from Vercel geo headers, Accept-Language, and cookies across 60+ country mappings.

Key features

• Private-profile access requests

  Visitors request access (guests included); owners/managers approve or deny with reasons; grants revoke instantly; every transition is audited and communicated via email and realtime notifications.

• Collaborative family management

  Owners invite managers/viewers by email, manage roles per profile, and coordinate galleries, life-event timelines, family trees, and connected sites.

• Moderated tributes

  Profiles can require pre-approval of guest tributes; pending queues notify managers, decisions notify authors, and counters stay consistent across denormalized aggregates.

• Physical-to-digital QR flow

  Admins bulk-generate branded tags; scanning a tag URL resolves to its linked profile or walks the visitor through claiming/linking it — including scanning stickers with the device camera.

• Two-step admin login & impersonation

  Admin sign-in emails a 5-digit code; support staff can impersonate users through signed short-lived tokens for debugging real account issues safely.

Challenges & solutions

1. Challenge 01

   Privacy had to model real families — guests without accounts requesting access to private memorials was a hard UX/security balance.

   Solution — One AccessRequest model handles both requesters, with status transitions, deny reasons, approver identity, and timestamps captured for accountability, surfaced through manager dashboards and notification fan-out.

2. Challenge 02

   Support teams needed to reproduce user-reported issues without password sharing.

   Solution — Implemented cross-service impersonation: the admin backend issues 1-hour JWTs flagged isImpersonating; the main app's credentials provider verifies them against the shared secret and opens a normal session, keeping the audit boundary explicit.

3. Challenge 03

   Media-heavy memorial pages were the performance risk, especially video and large galleries.

   Solution — Moved uploads to presigned direct-to-storage PUTs, offloaded transcoding/thumbnails to a dedicated service, and layered optional Redis caching over hot profile reads with careful invalidation on mutations.

Outcome & what makes it interesting

Production platform powering the Cherished Lives brand and white-label tenants, with a documented feature set (FEATURES.md / TECHNICAL.md) and a repeatable demo-provisioning pipeline for onboarding new branded tenants.

• ✦Designing permissions around grief — access control as a human process (requests, approvals, revocations), not just a boolean flag
• ✦White-label multi-tenancy down to localized logo assets per language
• ✦Choosing integration tests over aspirational e2e coverage to actually protect core flows during rapid feature work