Full Stack project
Build a role-gated admin CMS for blog content
An admin panel with a publish workflow and two roles — the access-control bug here is enforced correctly on the server, not just hidden in the UI.
The brief
Build an admin panel to manage blog posts: list, create, edit, and publish/unpublish, with two roles (editor can create/edit/publish, viewer can only read). Implement optimistic UI updates for publish/unpublish that roll back cleanly if the server request fails.
Suggested stack
What you hand in
- A public GitHub repository with the running app and a README
- The README explains the role model and how to test both roles
- A short note on how the optimistic update and rollback were implemented
Grading happens against the rubric below, so read it before you start — not after.
How this is graded
Published in advance and weighted out of 100. Nothing here is a surprise.
Every write endpoint checks the user's role on the server and rejects a viewer's attempt to create/edit/publish with a 403, not just by hiding the button in the UI.
Posts move correctly between draft and published states, and the list view accurately reflects each post's current state.
Clicking publish updates the UI immediately, and if the server request fails, the UI reverts to the previous state with a visible error, not a silently stuck state.
Required fields are validated in the UI for fast feedback and independently re-validated on the server, since the client check alone is not trustworthy.
No console errors or crashes, no broken layout, no leftover placeholder text or commented-out code.
Why this project is worth your weekend
- Nearly every product has an internal admin tool, and building one end to end is a realistic first project for a full-stack hire.
- Enforcing a role only in the UI while the API accepts the request from anyone is a real, common vulnerability class in production admin tools.
- Optimistic updates that don't roll back correctly are a frequent source of confusing, hard-to-reproduce UI bugs that this project specifically surfaces.
Where people lose points
- Enforcing the editor/viewer distinction only by hiding buttons in the UI while the API endpoint accepts the request from any logged-in user.
- Validating required fields only on the client and trusting the server to receive well-formed data.
- An optimistic update that doesn't roll back on a failed request, leaving the UI showing a published post that the server actually rejected.
Other Full Stack projects
Two or three of these turn an empty resume into a portfolio.
Built it? Get it scored against this rubric.
Submit your work and get a score on every criterion above, written feedback, and three resume bullets you can use straight away.