- Changed routes structure (1db5c68)
- Organized plugins and routes (76a64c9)
- Migrated from Supabase to Railway, added backup (bbb80ee)
- Switched to PostgreSQL (Supabase) (7deb59c)
- Added tests (542a835)
- Added search functionality (42abefa)
- Migrated to Fastify (2264677)
- Initial commit (1bbdaa9)
When deploying on Railway, the default port is 8080. To switch to port 3000, you need to set the PORT environment variable. This behavior is due to Railway's default configuration.
This API is designed for personal use to manage and view data inputs. The UI aims to make editing and viewing more convenient.
Example references:
- Move
seriesentries fromdata/movies.jstodata/series.js(a large task). - Transfer marked content from NeoDB to the API (only records remain).
- Merged route files into
server.js. - Added pagination, limit, and search capabilities.
- Implemented security measures.
- Refactored code structure (source).
- Added tests.
- Conducted pressure tests with Artillery.
- Migrated JSON data to PostgreSQL DB.
Supabase was abandoned due to its auto-paused free project policy. Data updates occur only after redeployment, possibly due to Vercel's behavior.
References:
References:
Solution: Use GitHub Actions.
Cause: Asynchronous import() in app.register() caused a race condition.
Reference: Fastify Async/Await
Code fix:
async function createRoute(path, data, opts) {
app.get(path, { schema: opts.schema }, async (request, reply) => {
const { page, limit, search } = request.query;
- reply.send(paginatedData);
+ return reply.send(paginatedData);
});
}Solution: Explicitly set baseUrl to https://api.tianheg.org.
- (Solved)Magic Links Storage: Currently stored in memory, which may cause DoS attacks and data loss on restart. Use Redis or a database.
- (Solved)Rate Limiting: Add rate-limiting middleware to authentication endpoints.
- CSRF Protection: Add CSRF protection for state-changing POST requests.
- Backup File Access: Ensure SQL backup files are not publicly accessible.
- Error Information: Simplify error responses to avoid exposing internal details.
- CORS Policy: Set a strict CORS policy to limit API call origins.
- Environment Variables: Ensure sensitive variables like
JWT_SECRETare strong and well-managed.
The API uses passwordless authentication with magic links.
-
POST /auth/magic-link- Request:
{ "email": "[email protected]" } - Response:
{ "success": true, "message": "Magic link sent to your email" }
- Request:
-
POST /auth/verify- Request:
{ "token": "your-token-here" } - Response:
{ "token": "jwt-token", "user": { "email": "[email protected]" } }
- Request:
-
GET /auth/me- Headers:
Authorization: Bearer your-jwt-token - Response:
{ "user": { "email": "[email protected]" } }
- Headers: