Live infrastructure and authenticated member surfaces; broader guest access is intentionally gated.
Behind the Build / Production Platform / Access Gated
Garage-Pass gives each real car a digital home: identity, ownership context, service records, parts, receipts, events, awards, and community activity connected to one vehicle record.
The engineering summary is public. The production member experience remains intentionally authenticated and launch-gated.
The product problem
Car history is usually fragmented across social posts, receipts, event photos, service notes, ownership paperwork, and memory. Garage-Pass makes the vehicle—not a generic feed—the durable center of that story.
Exact ownership
I own the product direction and work hands-on across interaction design, the SvelteKit frontend, Express services, API and data contracts, release tooling, deployment decisions, and production operations. This is an owned product, not a redesign exercise or isolated front-end mockup.
Architecture
The active frontend is a statically deployed SvelteKit 2 application using Svelte 5 runes and route-based code splitting. Firebase Hosting serves the frontend and rewrites API traffic to an Express 5 service on Cloud Run. Firestore is the production database; local development and most fast tests use SQLite through a shared adapter so business logic is not tied directly to either store.
Security and access
Short-lived JWT access tokens pair with rotating, hashed refresh tokens. Auth, route guards, rate limiting, input sanitization, and explicit production exposure rules protect member and administrative surfaces. The current public gate is deliberate product policy, not a broken homepage.
Tradeoffs
A static frontend plus independently scaled API keeps CDN delivery and server capacity separate, but requires disciplined client/API contracts. A dual SQLite/Firestore data layer makes local iteration and tests fast, but adapter parity becomes a release responsibility. The public launch gate reduces casual product review, so this page exposes the engineering proof without exposing member workflows.
Test layers
Behavior is checked at the right boundary.
- Jest and Supertest cover backend units, service behavior, routes, and integrations.
- Vitest covers Svelte components and frontend logic.
- Firestore emulator and rules suites exercise production-store behavior separately.
- Playwright checks authenticated end-to-end paths in the full release command.
Release gate
More than a build check.
- Svelte diagnostics and production build.
- OpenAPI coverage, link, asset, organization, and adapter-parity checks.
- Secret scanning plus unsafe HTML and UI-state scanners.
- Authenticated browser coverage after the lower-level suites.
Validated outcome
Production behavior, labeled honestly.
garage-pass.comreturned HTTP 200 during this portfolio validation.- Guests intentionally enter the current launch gate.
- Member routes remain authenticated; the portfolio does not present them as public demos.
- This claim verifies reachability and gate behavior, not the entire production suite.