Mojolicious Personal Blog Web App

Project roadmap

1. 01

   Create the Mojolicious app

   ~1h

   Install Mojolicious and create a full application with mojo generate app Blog. Remove the example controller and add a home route that renders a template with a layout (header, navigation and footer). Add DBI and DBD::SQLite to a cpanfile. Done when: morbo script/blog starts the app, and the home page shows your layout.

2. 02

   Create the database

   ~1.5h

   Write schema.sql with a posts table (id, title, slug unique, body_markdown, published boolean, created_at, updated_at) and a comments table (id, post_id, author_name, body, created_at), with a foreign key and an index on post_id. Add a helper in the app that returns a DBI handle to the SQLite file, and a command that creates the schema. Done when: running the command creates blog.db with both tables.

3. 03

   Show posts

   ~2h

   Make the home page list published posts, newest first, with their title, date and first paragraph, 10 per page. Add /posts/:slug showing the full post with its Markdown converted to HTML with Text::Markdown, and its comments. Unknown slugs show a 404 page. Always use DBI placeholders in queries. Done when: sample posts inserted in the database appear on the home page and on their own pages.

4. 04

   Add author login

   ~2h

   Store the author's username and a bcrypt password hash (Crypt::Bcrypt or Authen::Passphrase) in configuration, never the plain password. Add /login and /logout routes; on successful login, store the user in the signed session cookie. Protect the admin routes under an under() check that redirects to /login when not logged in. Done when: the admin area is only reachable after logging in.

5. 05

   Create and edit posts

   ~2.5h

   Add admin pages to create, edit and delete posts, with a form for title, body (Markdown) and a published checkbox. Generate the slug from the title and make it unique. Validate with Mojolicious's validation helper (title required, at most 150 characters). Add CSRF protection with the csrf_token helper, and ask for confirmation before deleting. Done when: posts can be created, edited, published and deleted from the admin pages.

6. 06

   Add comments

   ~2h

   Add a comment form under each post (name and comment, both required, comments at most 1,000 characters) with CSRF protection. Store comments with placeholders and show them oldest first. Since Mojolicious templates escape output by default, check that a comment containing <script> is shown as text. Let the author delete comments. Done when: visitors can comment, and HTML in comments is never executed.

7. 07

   Test the app

   ~2h

   Write tests in t/ with Test::Mojo using a temporary SQLite database: the home page lists published posts only, a post page shows its comments, admin pages redirect when logged out, logging in works, creating a post works, and a comment with HTML is escaped. Done when: prove -l t/ passes.

Resources

• DocsMojolicious guides
• DocsMojolicious growing guide (full apps)
• DocsTest::Mojo
• DocsDBI on MetaCPAN
• DocsText::Markdown on MetaCPAN