Yo - A Twitter Clone

Backend API for Yo using Nest framework (NodeJS + TypeScript + MySQL)

About

Yo is a Twitter Clone.

🖼️ Avatar Upload to AWS S3 (Presigned URL)

Methodology

1. Generate Presigned URL
   Backend provides a presigned S3 URL and object key for secure direct image upload.

2. Upload Image
   Frontend uses the URL to upload the image directly to S3 via a PUT request.

3. Save Image Key
   The S3 object key is saved in the database as the user's avatar reference.

4. Access Avatar
   The avatar can later be accessed using a signed URL generated by the backend.

To-Do

• Implement presigned upload flow
• Store avatar key in user table
• Fix CORS and bucket policy issues
• Add validation for file type and size

🔁 Kafka Integration

Methodology

1. Kafka Config Setup
   Kafka broker and client settings are loaded via ConfigService and made globally available. Broker connects to multiple topics dynamically.

2. Kafka Producer/Consumer Modules
   Services use Kafka client to emit and consume events (e.g., user created).

3. Microservice Communication
   Kafka enables decoupled communication between services for handling async operations.

To-Do

• Add Kafka config module using @nestjs/config
• Setup Kafka producer and consumer service
• Emit and listen to example events (e.g., user.created)
• Add retry logic and dead-letter queue (DLQ) support
• Document event schemas and versioning

TODOs

🔐 TODO: Migrate to JWT-Based Hybrid Authentication Model

This plan outlines the steps to transition from the current auth system to a scalable JWT-based model that supports both access and refresh tokens.

---

✅ Phase 1: Setup JWT Infrastructure

• Install necessary packages (@nestjs/jwt, passport-jwt, etc.)
• Configure JwtModule in the Auth module
• Define JWT secret, expiration, and refresh settings in .env
• Create utility methods for signAccessToken and signRefreshToken
• Add centralized TokenService to manage token lifecycle

---

🧠 Phase 2: Hybrid Login Flow

• Update login endpoint to return:
  • Access Token (short-lived, e.g., 15 mins)
  • Refresh Token (long-lived, e.g., 7 days)
• Save refresh token in HttpOnly cookie or secure storage
• Add logic to hash and store refresh token in DB (optional for security)

---

🔄 Phase 3: Token Refresh Mechanism

• Create /auth/refresh endpoint
• Validate refresh token (DB or verify)
• Issue new access token (and optionally new refresh token)
• Add logic to rotate or blacklist old refresh tokens (optional)

---

🛡️ Phase 4: Secure Routes

• Implement JwtAuthGuard using PassportStrategy
• Protect authenticated routes with @UseGuards(JwtAuthGuard)
• Create decorator to extract user info from JWT (@CurrentUser())

---

🧹 Phase 5: Logout & Cleanup

• Create logout endpoint to:
  • Invalidate refresh token in DB
  • Clear cookie/session
• Optional: Add token revocation list (blacklist)

---

🧪 Final Tasks

• Write unit tests for token generation and guards
• Add E2E tests for login, refresh, and access
• Update frontend to handle:
  • Storing and refreshing tokens
  • Auto-logout on token expiry
• Document auth flow in README

---

Installation

$ npm install

Running the app

# development
$ npm run start

# watch mode
$ npm run start:dev

# production mode
$ npm run start:prod

Test

# unit tests
$ npm run test

# e2e tests
$ npm run test:e2e

# test coverage
$ npm run test:cov

Setup Database

create database yoodb;
create user yooadmin with password 'yoopass';
grant all privileges on database yoodb to yooadmin;

Endpoints

• auth

  • POST /auth/login

• users

  • GET /users 📃
  • GET /users/@{username}
  • GET /users/{userid}
  • POST /users
  • PATCH /users/{userid} 🔒
  • PUT /users/{userid}/follow 🔒
  • DELETE /users/{userid}/follow 🔒
  • GET /users/{userid}/followers 📃
  • GET /users/{userid}/followees 📃

• posts

  • GET /posts 📃
    • filter by author
    • filter by replyTo
    • filter by origPosts
    • full-text-search on post content
  • GET /posts/{postid}
  • POST /posts 🔒
    • simple posts
    • reply to a post
    • repost / quote post
    • #hashtags
    • @mentions
  • DELETE /posts/{postid} 🔒
  • PUT /posts/{postid}/like 🔒
  • DELETE /posts/{postid}/like 🔒

• hashtags

  • GET /hashtags 📃
  • GET /hashtags/{tag}/posts 📃