Art Gallery
uni · SIT331 · T1 2026A catalogue for an imagined gallery of Aboriginal Australian art. Anyone can browse the published works and exhibitions. Curators sign in with Google to edit the catalogue, through a REST API on Express and MongoDB with a Next.js site in front.
Every screen here is from a copy running on my laptop with placeholder data. The artists are Demo Artist A to E and the pictures are flat shapes I drew with a script. They are not real artworks. The repo's own seed names real artists, so I kept it out of the shots.
Task 5.2HD in SIT331 at Deakin. The brief was to pick three to five bounded contexts in a real domain and build a documented, tested service for them. I picked a gallery catalogue with five: artists, artifacts (the code's word for the works), art styles, exhibitions and tags, each with its own model, routes and service.
It was built in 23 commits between 21 and 30 May 2026, with a requirements document, architecture and data model notes, diagrams and a Postman collection alongside the code. It was never deployed, so there is no live site.
Visitors can search titles and descriptions through a MongoDB text index, filter by style or tag, and open a work or an exhibition, and each work comes back from the API with its artist, style and tags already filled in. None of it needs an account.
There are two roles. Anyone who signs in with Google is a viewer, and an email on the curator list gets the curator role, which includes everything a viewer can do. All 24 routes that change data need a valid token with the curator role. The 12 read routes are public.
The front end checks the same role. The Curator link only shows for curators, and the dashboard turns anyone else away. Google sign-in is not set up on my copy, so for these shots I made the session cookies locally with Auth.js's own encoder and a local secret.
The API enforces the same rules on its own. I ran this against my copy as nobody, as a viewer and as a curator, plus a curator token signed with the wrong key.
anonymous GET /artifacts -> 200 total=9 curator (drafts included) GET /artifacts -> 200 total=12 anonymous GET /exhibitions/:id -> 200 works=4 curator (drafts included) GET /exhibitions/:id -> 200 works=5 anonymous POST /artifacts -> 401 UNAUTHORIZED: Unauthorized curator role, wrong signing key POST /artifacts -> 401 UNAUTHORIZED: Unauthorized viewer POST /artifacts -> 403 FORBIDDEN: Forbidden curator POST /artifacts -> 201 created curator, no title POST /artifacts -> 400 VALIDATION_ERROR: Validation failed curator, artist still has works DELETE /artists/:id -> 409 CONFLICT: Cannot delete artist with existing artifacts curator, ends before it starts POST /exhibitions -> 422 UNPROCESSABLE: endDate must be greater than or equal to startDate curator, publish it PATCH /artifacts/:id -> 200 updated curator, published back to draft PATCH /artifacts/:id -> 422 UNPROCESSABLE: Cannot return an artifact to draft once it has been published curator DELETE /artifacts/:id -> 204
The tests drive the real Express app through Supertest against a throwaway MongoDB that runs in memory, so each request goes through the same middleware and services as in production. There are 126 of them in 9 files. The README says 128, but my re-run counted 126 and all passed.
view data
| category | covered |
|---|---|
| lines | 93.4% |
| statements | 91.6% |
| functions | 92.5% |
| branches | 69.8% |
Branch coverage is the weak one. The error handler's cases for Mongoose validation errors and duplicate keys never run in a test. Separately, the Postman collection was run through Newman on 30 May: the committed report shows 190 requests and 405 assertions over 5 iterations, none failed. I did not re-run that one.
I would make roles revocable. A curator's role is fixed inside the token for 7 days, so taking an email off the list does nothing until the token runs out. A small users collection, or short tokens that get refreshed, would fix that.
Refuse to start without secrets. If the signing secret is missing, the front end falls back to "secret" and the API to a development string. Both should stop at boot instead.
The curator side also needs finishing. The exhibition page never sends the curator's token, so curators do not see drafts there even though the API would return them. On a phone the curator menu runs off the edge of the screen.