Group project
A collaborative LoFi music and productivity platform combining music discovery, a Pomodoro-style focus timer and user accounts in a Blazor application.
Overview
Calico was built as a group project during the Northcoders Enterprise Engineering Bootcamp. The goal was to combine music discovery with productivity tools in a single application, giving the team a chance to design and build a full-stack product together rather than working solo.
Users can search for and play LoFi music, register and log in, and run a task timer or a 25-minute Pomodoro session alongside the music. The Blazor frontend communicates with an ASP.NET Core Web API over HTTP, which uses Entity Framework Core for data access, while Supabase handles user authentication and issues the tokens the API uses to protect its endpoints.
Playlists and organising timed sessions by project are part of the original design and already modelled in the database, but the UI for them isn't built yet — that's next on the list to finish.
Since the group project, I've gone back to Calico independently — carrying out a full security review, fixing what it found, and deploying the finished application.
My contribution
Collaboration
I worked primarily through pair programming, taking part as both driver and navigator across frontend and backend tasks. We held daily stand-ups, managed our tasks with Trello and reviewed and merged our Git changes together at the end of each day.
Individual work
As navigator, I contributed to the user account settings page and paired on the YouTube feature across its backend, frontend, API integration and search page. Independently, I implemented the API and database health checks and built the initial Pomodoro timer prototype.
Since the bootcamp
After the bootcamp, I went back to Calico independently and ran a full security review of the backend. I fixed what it found, including missing authorisation checks that let any logged-in user view or edit someone else's projects and account, and a mass-assignment flaw that let users self-promote to admin. I also restored the real YouTube search integration, which the group had replaced with a hardcoded list of results because of API quota limits.
Since the bootcamp
I then fixed the frontend, where login, signup and the dashboard had never worked correctly end-to-end. I rebuilt login and signup to work properly with Supabase, connected the dashboard to the real logged-in user instead of a placeholder, added a working logout, and merged in and fixed an unfinished Pomodoro timer.
Features
Discover LoFi videos through YouTube-powered results and play embedded content directly in the app.
Track a session with a simple count-up timer, or run a 25-minute Pomodoro session with play and pause synced between the timer and the embedded video.
Support registration, authentication and profile management.
Icon-only controls like play, pause and the Pomodoro button use descriptive ARIA labels, decorative icons are hidden from screen readers, and the interface supports keyboard navigation with visible focus states.
Playlists and organising timed sessions by project are already modelled in the database and part of the original design, but the UI for them isn't built yet — planned as the next feature to finish.
Integrations
User accounts and login are handled by Supabase, which issues a JWT on sign-in. The backend verifies each token's signature against Supabase's public keys and uses its claims to identify the caller and enforce ownership and admin checks on every protected endpoint.
I worked as the navigator while my pair and I built the backend, frontend, API integration and a dedicated YouTube search page. With limited time before the demo, we fell back to a hardcoded list of results shown on the home page instead of the real API, due to YouTube quota limits. After the bootcamp, I restored the real API integration with a caching layer to manage quota, and decided to keep search permanently merged into the home page rather than reviving the separate page.
The Blazor Server frontend runs entirely on its own server, so every request to the backend happens server-side through a centrally configured HttpClient rather than directly from the browser. Since the login token lives in a cookie set by the frontend rather than being forwarded automatically, each request attaches it manually as a Bearer token so the backend can verify who's calling.
Deployment
I used Docker to package the frontend and backend, tested each container locally to make sure it worked the same way it would in production, and deployed them to Railway as individual services. I also set up a GitHub Actions pipeline for each project, so every push automatically builds and checks that nothing is broken before it goes anywhere near production.
The backend uses SQLite for local development and an Azure SQL Database in production, with separate configuration for each so the right settings are picked up automatically. The frontend is available through a custom subdomain of my portfolio domain.
Reflection
Working on Calico strengthened my experience of pair programming in both driver and navigator roles and contributing to a shared full-stack codebase. Daily stand-ups, Trello planning and end-of-day Git reviews and merges taught me how a development team coordinates work, shares knowledge and delivers features together. Going back to Calico independently afterwards taught me a different set of skills — carrying out a proper security review, working through what it found methodically, and taking an application all the way from a group project to something genuinely deployed and working end-to-end.