Online Interview Assessment System

Built during the COVID-19 pandemic, when technical interviews moved fully remote overnight. Interviewers were stitching together a video call, a shared coding pad, and an email thread to assess a single candidate - constant context-switching, and nothing tied the who, when, code, and outcome of an interview together.

Remote technical interviews meant juggling three tools - a video call, a shared coding pad, and a calendar thread - with nothing tying the who, when, code, and outcome together. The goal: collapse all of it into one web app, no installs.

Sole developer - full-stack, design, and infrastructure. Owned the React SPA, the Express + Socket.IO server, the WebRTC mesh, the MongoDB schema, the Firebase-to-JWT auth bridge, and deployment.

Three independent transports run at once. REST (Express) handles stateful CRUD - auth, interview records, schedules. A Socket.IO server, attached to the same Node HTTP process, carries low-latency room state: presence, chat, live code sync, and WebRTC signaling. WebRTC then carries the actual audio/video peer-to-peer, never through the server. MongoDB Atlas is the source of truth; Firebase handles the Google sign-in experience; an external compiler API runs submitted code.

The interview room ties three real-time mechanisms together at once - peer-to-peer video, character-by-character code sync, and live code execution - each on the transport that suits it.

Full-stack, built solo: a React SPA, an Express + Socket.IO server sharing one process, and a MongoDB document model with per-record ownership.

Two auth worlds had to be reconciled. Firebase gives a great login experience (one-click Google) but its identity is only trusted on the client; the Express API has to trust requests on its own terms. The bridge keeps both - Firebase owns the login UX, a backend JWT is the actual key the server trusts.

There's also a full classic path for non-Google users, with production-grade lifecycle features rarely seen in a student project:

• Email/password with bcrypt (salt rounds = 10) and express-validator input rules, issuing the same JWT.
• Forgot/reset password via an emailed, single-use UUID token with same-day expiry (Nodemailer).
• Account deletion as a two-step, email-confirmed flow that cascades and removes the user's interview records.

• 1

  Bridged Firebase auth to a backend JWT

  Firebase gave one-click Google sign-in but its identity is only trusted client-side. On login the client posts to /api/auth/google; the server upserts a MongoDB user and mints its own JWT as the real trust anchor. Decouples the backend from Firebase - the tradeoff is /google trusts the posted email (prod should verify the Firebase ID token).

• 2

  WebRTC mesh over an SFU

  Each participant opens a direct peer connection to every other; Socket.IO relays only the SDP/ICE handshake. Media never touches the server. Perfect for 2-4 person interviews; a mesh would need an SFU to scale past that.

• 3

  Keystroke-diff code sync with a late-joiner replay

  The editor broadcasts CODE_CHANGE over Socket.IO, guarding against echo loops by ignoring programmatic setValue. A late joiner fires SYNC_CODE and is replayed the current buffer so it never starts blank. Lightweight - not conflict-free (no CRDT/OT yet).

• 4

  Offloaded code execution to an external compiler API

  Running untrusted code across 13 languages on my own server is a sandbox I did not want to maintain. The run request ships code + stdin to a compiler API and syncs the result back through the same socket, so both sides see the output simultaneously.

• 5

  A single shared event-name contract (Actions.js)

  Socket event names (JOIN, CODE_CHANGE, SYNC_CODE, DISCONNECTED) live in one module imported by both client and server. Renaming an event can no longer silently desync the two halves of the realtime protocol.

• 6

  Three transports in one Node process

  Express (REST) and Socket.IO (WebSocket) share a single HTTP server, while WebRTC media stays peer-to-peer. One deploy target, two protocols served, and the server never relays video - so it is a matchmaker, not a bottleneck.

• 7

  Soft-delete by default

  Interview records flip an isDeleted flag into a recoverable bin rather than being destroyed; a separate action hard-deletes. Undo-friendly UX at the cost of a little query complexity.

• 8

  Resilient DB connect + per-record ownership

  db.js retries the Mongo connection up to 3 times so a transient Atlas hiccup at boot does not kill the server. Every list/search query is scoped to authorId === req.user.id, so a user physically cannot read another user’s records by ID manipulation.

• 9

  Production-grade account lifecycle

  Password reset and account deletion run on emailed, single-use UUID tokens with expiry (Nodemailer); deletion is a two-step, email-confirmed flow that cascades and removes the user’s interview records. Rare in a student project, and the right default.

This is an older solo codebase that works end to end. Being able to critique my own system is part of the story - here is the path from “student project that works” to a production service.

• Secrets management: move all config to environment variables / a secrets manager and rotate anything that ever lived in the repo - the first thing I'd fix.
• Verify Firebase ID tokens server-side with the Admin SDK instead of trusting the posted email on /api/auth/google.
• JWT expiry + refresh, and move tokens out of sessionStorage toward httpOnly cookies.
• Swap the mesh for an SFU (mediasoup / LiveKit) the moment group interviews need more than ~4 people.
• Conflict-free code sync with a CRDT (Yjs) or OT so simultaneous typing can't clobber.
• Centralize config (hardcoded localhost URLs become env-driven) and add the test suite it currently lacks.
• TypeScript end to end - the realtime protocol is exactly the kind of contract that benefits from static types.

• React
• JavaScript
• Tailwind CSS
• Material UI
• Framer Motion
• WebRTC
• Socket.io
• CodeMirror
• Node.js
• Express
• MongoDB
• Mongoose
• Firebase
• JWT
• Passport