QuizMaster Turbo is a full-scale real-time multiplayer quiz platform, architected as a proper Turborepo monorepo with independent services, a custom real-time engine, and a from-scratch authentication system built to production-grade security standards — not a weekend project.

• Live quiz rooms powered by a Socket.IO microservice running independently of the main API, so gameplay traffic never blocks core business logic
• Supports multiple concurrent rooms with isolated game state per room (players, scores, current question, timers)
• Server-authoritative question timer & scoring sync — every player's clock is reconciled against the server so no one can cheat by manipulating client-side timers
• Event-driven architecture for room lifecycle: create room → join → ready-up → question broadcast → answer submission → live leaderboard update → next round
• Built for low-latency state broadcasting across all connected clients in a room simultaneously
• Designed to scale horizontally — the socket layer is decoupled so more instances can be added behind the service as load grows

The auth layer (internally called Auth2) was built from the ground up instead of dropping in an off-the-shelf auth library. Here's what it uses and how the pieces fit together:

• JWT access tokens — short-lived tokens used for actual API authorization, kept deliberately short-lived to limit the damage window if one leaks
• DPoP (Demonstrating Proof-of-Possession) — every request is bound to a private key held by the client, so even a stolen access token is useless without the matching key; this is layered on top of the standard bearer-token model
• Rotating refresh tokens — every time a refresh token is used to get a new access token, it's invalidated and replaced with a new one; if an old/used refresh token ever gets replayed, the system can detect it and kill the whole session chain
• Passwordless login flow (OTP-based) — no passwords stored at all; users authenticate via a one-time code, removing password database breaches as an attack surface entirely
• Session chain tracking — refresh token rotation is tracked per-device/session so a compromised session can be revoked without logging the user out everywhere
• Redis-backed token/session store — fast lookups for token validation and revocation checks without hammering the primary database

• Built on Turborepo — frontend, backend, and the socket microservice all live as separate packages sharing common types/utilities, with cached, parallelized builds
• Clear separation of concerns: apps/ for deployable services, packages/ for shared logic (types, auth utils, UI components)
• Docker-ready service setup for consistent local dev and deployment
• MCA project report generated programmatically using Python + ReportLab, pulling structure straight from the codebase for academic submission

📌 This is my MCA major project — a full-scale build with a real-time multiplayer engine and a hardened, from-scratch auth system (Auth2). Check the pinned repo for source code!

✨ Thanks for visiting! If you like what you see, drop a ⭐ on something — it means a lot!