Academic Journal Platform
An OJS-style open-access publishing platform that runs several peer-reviewed journals under one roof
Project Summary
An OJS-style (Open Journal Systems) publishing platform that runs several peer-reviewed journals under one roof. Each journal publishes at its own path on the platform or on its own domain; a new journal is added from the panel without any change to the architecture.
Users have a single account. They can hold a different role in each journal (journal manager, editor, reviewer), and anyone can submit to any journal as an author.
My Role
I built the platform’s architecture, editorial workflow, security layer, Crossref, ORCID and OAI-PMH integrations, the DergiPark migration tool and the bilingual journal interface. The test suite and CI setup were my teammate’s contribution.
Editorial Workflow and Publishing
- Submission, editor screening, double-blind review, decision (accept, revise, reject), revision rounds, issue assignment and publication
- A DOI prefix per journal and Crossref XML per issue, downloadable as a file or deposited automatically through the API
- Authors can link a verified ORCID iD by signing in with ORCID
- Highwire Press and Dublin Core tags for Google Scholar; APA, MLA, Chicago, Harvard, IEEE and Vancouver citations per article, plus RIS and BibTeX downloads
- An in-browser PDF viewer and server-sanitised HTML full text
- An OAI-PMH 2.0 endpoint and a LOCKSS/CLOCKSS permission page for archiving
- A re-runnable migration tool that imports the journals’ DergiPark archive with metadata and PDFs
Security
- Database-backed sessions: the cookie carries a 256-bit random token and the database stores only its SHA-256 hash
- Argon2id password hashing and a breached-password check through Have I Been Pwned that never sends the password off the server
- TOTP two-factor authentication with secrets encrypted using AES-256-GCM and single-use recovery codes
- Rate limiting with atomic counters in PostgreSQL, so no extra service is needed
- A strict per-request nonce CSP, same-origin enforcement on every state-changing request, and HSTS
- Every page and Server Action re-checks authorisation on the server; other users’ resources return 404, and reviewers cannot see who the author is
- Security events go to an audit log that is deleted automatically after one year (data minimisation under Turkey’s KVKK)
Interface, Language and Testing
- The journal sites follow the page layout of Nivo, a commercial OJS theme, rebuilt with the project’s own code; colours, images and metrics are set from the panel
- The reader, author and reviewer interface is in Turkish and English; the language switcher works without JavaScript and emails go out in the recipient’s language
- A canonical URL on every page, JSON-LD (ScholarlyArticle, Periodical, PublicationIssue), per-domain sitemaps, an Atom feed per journal and generated share images
- Unit tests plus integration tests that apply the real migrations to an in-memory PostgreSQL (PGlite) per file; GitHub Actions runs lint, type checks, tests and a production build on every push