Streaming, End to End

Context

MiniVod is a commercial video-on-demand product built for ViewMini — premium short-form series and films for English, Greek, and Arabic audiences. What began as an AI-assisted frontend scaffold grew into a production system: a React SPA hosted on Lovable, a Django REST API on Heroku, and a native iOS app with TestFlight beta distribution.

Goals

• Catalog, search, series detail, and episodic playback with embedded streaming (SproutVideo / Bunny CDN).
• Full authentication — registration, login, password reset, Google/Facebook/Apple OAuth, and JWT session persistence.
• Subscription monetization — Stripe Checkout on web; App Store and Google Play in-app purchases on mobile.
• Multilingual UX — English, Greek, and Arabic with RTL layout support.
• Account hub — profile editing, watchlist, viewing history, subscription management, and account deletion.
• Native iOS client — StoreKit billing, Apple-compliant account deletion, and TestFlight beta distribution.
• API-first entitlement model — one backend decides who can play what for web and mobile clients.
• Compliance and hardening — cookie consent, security headers, rate limiting, and Apple account-deletion requirements.

Constraints

• Integrating a UI-first codebase with a Django API built in parallel — replacing mocks with live data incrementally.
• Serving the Lovable-hosted web app, local dev, and native iOS clients from one API with correct CORS and per-environment OAuth clients.
• Independent release tracks — Lovable web deploys, Heroku API migrations, and iOS builds (Codemagic → TestFlight) ship on separate schedules.
• Embedding third-party video instead of self-hosting — playback URLs and gating logic must stay consistent.
• JWT security at scale — short-lived access tokens, refresh rotation, blacklist, and hard rejection of deleted accounts.

Approach

• Modular Django apps — authentication, content, subscriptions, billing, and engagement behind a versioned REST API.
• Typed React client — TanStack Query, Axios interceptors, route guards, lazy-loaded routes, and vendor code splitting.
• Unified billing — Stripe on web; StoreKit 2 JWS validation for iOS; shared entitlement helpers across channels.
• ActiveUserJWTAuthentication and scoped throttling on auth and payment endpoints.
• i18next with RTL document switching; sanitized errors and OWASP-aligned security headers on the Lovable-hosted web app.

Results

• Production API on Heroku serving catalog, auth, subscriptions, and playback for web and mobile.
• 20+ routed web pages — from splash and catalog to profile, plans, checkout, and legal compliance.
• Full subscription commerce — Stripe on web; plan tiers with cancel-at-period-end in profile.
• Dynamic catalog — series, episodes, categories, and featured sections driven by the API.
• iOS app on TestFlight — native client with in-app billing validation and Apple-compliant account deletion.
• Backend test coverage across auth, OAuth, subscriptions, billing, and account deletion.

Stack