chrisandClaude Opus 5.5
6791b62d87
- Fastify API with cookie (web) and bearer (mobile) sessions, follows, pinned friends, featured songs, account deletion, Redis-backed rate limits - Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and server discovery), Jellyfin (token auth, revoked on disconnect) - Worker polls on an adaptive schedule in a Redis sorted set, so polling scales horizontally and API usage tracks whether anyone is watching - Track resolver links songs across services via ISRC (Deezer, Spotify), iTunes search and song.link - Realtime updates over WebSocket fan out through Redis pub/sub - User-supplied server URLs are restricted to public addresses, checked both up front and at connect time to defeat DNS rebinding Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8
70 lines
2.4 KiB
TypeScript
70 lines
2.4 KiB
TypeScript
import cookie from '@fastify/cookie';
|
|
import cors from '@fastify/cors';
|
|
import rateLimit from '@fastify/rate-limit';
|
|
import websocket from '@fastify/websocket';
|
|
import Fastify from 'fastify';
|
|
import { ZodError } from 'zod';
|
|
import { sql } from './db';
|
|
import { env } from './env';
|
|
import { loadUser } from './lib/auth';
|
|
import { HttpError } from './lib/http';
|
|
import { redis } from './lib/redis';
|
|
import { authRoutes } from './routes/auth';
|
|
import { connectionRoutes } from './routes/connections';
|
|
import { meRoutes } from './routes/me';
|
|
import { realtimeRoutes } from './routes/realtime';
|
|
import { trackRoutes } from './routes/tracks';
|
|
import { userRoutes } from './routes/users';
|
|
import { webhookRoutes } from './routes/webhooks';
|
|
|
|
const app = Fastify({ logger: true, trustProxy: true });
|
|
|
|
await app.register(cors, {
|
|
origin: [env.WEB_URL],
|
|
credentials: true,
|
|
methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
|
|
});
|
|
await app.register(cookie);
|
|
// Rate limits are per-route (see `config.rateLimit`); the Redis store makes them global across instances.
|
|
await app.register(rateLimit, { global: false, redis });
|
|
await app.register(websocket);
|
|
|
|
app.decorateRequest('user', null);
|
|
app.decorateRequest('sessionId', null);
|
|
app.addHook('onRequest', loadUser);
|
|
|
|
app.setErrorHandler((err, req, reply) => {
|
|
if (err instanceof ZodError) {
|
|
return reply.status(400).send({ error: err.issues[0]?.message ?? 'Invalid input', issues: err.issues });
|
|
}
|
|
if (err instanceof HttpError) return reply.status(err.status).send({ error: err.message });
|
|
const status = (err as { statusCode?: number }).statusCode;
|
|
if (status && status < 500) return reply.status(status).send({ error: (err as Error).message });
|
|
req.log.error(err);
|
|
return reply.status(500).send({ error: 'Internal server error' });
|
|
});
|
|
|
|
app.get('/health', async () => {
|
|
await Promise.all([sql`select 1`, redis.ping()]);
|
|
return { ok: true };
|
|
});
|
|
|
|
await app.register(authRoutes);
|
|
await app.register(meRoutes);
|
|
await app.register(userRoutes);
|
|
await app.register(trackRoutes);
|
|
await app.register(connectionRoutes);
|
|
await app.register(realtimeRoutes);
|
|
// registered as its own plugin so its permissive body parsers stay scoped to webhook routes
|
|
await app.register(webhookRoutes);
|
|
|
|
for (const signal of ['SIGINT', 'SIGTERM']) {
|
|
process.on(signal, async () => {
|
|
await app.close();
|
|
await sql.end();
|
|
process.exit(0);
|
|
});
|
|
}
|
|
|
|
await app.listen({ port: env.PORT, host: '0.0.0.0' });
|