Sociya Backend

A robust and scalable social media platform backend built with Next.js 16, TypeScript, and MongoDB. This API powers a Twitter-like social media application with features including user authentication, tweet management, likes, image uploads, and real-time email verification.

🚀 Features

Authentication & Security

• JWT-based Authentication with access and refresh tokens
• Email Verification using OTP (One-Time Password)
• Rate Limiting with Upstash Redis (20 requests/minute)
• Password Hashing with bcrypt
• HTTP-only Cookies for secure token storage
• CORS Protection with configurable origins

User Management

• User registration with email verification
• Secure login/logout
• Profile management with avatar uploads
• Username uniqueness validation
• Password change functionality
• Token refresh mechanism

Tweet Features

• Create tweets with optional image attachments
• Update existing tweets
• Delete tweets
• View all tweets (home feed)
• View user-specific tweets
• Like/Unlike tweets
• Tweet aggregation with like counts

Media Handling

• Image Upload to Cloudinary
• Image Optimization with URL transformations
• Automatic Image Deletion when tweets are removed
• Support for formdata and multipart uploads

🛠️ Tech Stack

• Framework: Next.js 16 (App Router)
• Language: TypeScript
• Database: MongoDB with Mongoose ODM
• Authentication: JWT (jsonwebtoken)
• File Upload: Formidable
• Image Storage: Cloudinary
• Email Service: Resend
• Rate Limiting: Upstash Redis + Vercel KV
• Password Hashing: bcrypt
• Email Templates: React Email

📁 Project Structure

sociyabackend/
├── src/
│   ├── app/
│   │   └── api/
│   │       └── v1/
│   │           ├── users/          # User endpoints
│   │           │   ├── create-account/
│   │           │   ├── login/
│   │           │   ├── logout/
│   │           │   ├── verify-otp/
│   │           │   ├── me/
│   │           │   ├── is-username-unique/
│   │           │   ├── new-access-token/
│   │           │   ├── c/password/
│   │           │   ├── r/otp/
│   │           │   └── u/avatar/
│   │           ├── tweet/          # Tweet endpoints
│   │           │   └── t/
│   │           │       ├── upload/
│   │           │       ├── update/[tweetId]/
│   │           │       └── delete/[tweetId]/
│   │           ├── like/           # Like endpoints
│   │           │   └── tweet/[tweetId]/
│   │           ├── home/           # Feed endpoints
│   │           │   ├── all-content/
│   │           │   └── user-content/[username]/
│   │           └── healthcheck/    # Health check
│   ├── models/
│   │   ├── user.model.ts          # User schema
│   │   ├── tweet.model.ts         # Tweet schema
│   │   └── like.model.ts          # Like schema
│   ├── middlewares/
│   │   ├── auth.middleware.ts     # JWT verification
│   │   └── parseImageUpload.middleware.ts
│   ├── utils/
│   │   ├── ApiResponse.ts         # Standardized API responses
│   │   ├── cloudinary.ts          # Cloudinary integration
│   │   ├── dbConnect.ts           # MongoDB connection
│   │   ├── generateAccessAndRefreshToken.ts
│   │   ├── sendVerificationEmail.ts
│   │   ├── deleteFromCloudinary.ts
│   │   ├── getOptimizedUrl.ts     # Image optimization
│   │   └── resend.ts              # Email service
│   ├── emails/
│   │   └── verificationEmail.tsx  # Email template
│   └── middleware.ts              # Rate limiting & CORS
├── public/
│   └── temp/                      # Temporary file storage
├── next.config.ts
├── tsconfig.json
└── package.json

API Endpoints

Health Check

• GET /api/v1/healthcheck - Check API status

Authentication

• POST /api/v1/users/create-account - Register new user
• POST /api/v1/users/login - User login
• POST /api/v1/users/logout - User logout (requires auth)
• POST /api/v1/users/verify-otp - Verify email with OTP
• POST /api/v1/users/r/otp - Resend OTP
• POST /api/v1/users/new-access-token - Refresh access token

User

• GET /api/v1/users/me - Get current user profile (requires auth)
• GET /api/v1/users/is-username-unique - Check username availability
• PATCH /api/v1/users/c/password - Change password (requires auth)
• PATCH /api/v1/users/u/avatar - Update avatar (requires auth)

Tweets

• POST /api/v1/tweet/t/upload - Create new tweet (requires auth)
• PATCH /api/v1/tweet/t/update/[tweetId] - Update tweet (requires auth)
• DELETE /api/v1/tweet/t/delete/[tweetId] - Delete tweet (requires auth)

Feed

• GET /api/v1/home/all-content - Get all tweets
• GET /api/v1/home/user-content/[username] - Get user tweets

Likes

• POST /api/v1/like/tweet/[tweetId] - Toggle like on tweet (requires auth)

🔐 Authentication Flow

1. Registration:

   • User submits credentials
   • Password is hashed
   • OTP is generated and sent via email
   • User account is created (unverified)

2. Email Verification:

   • User enters OTP
   • OTP is validated (5-minute expiry)
   • Account is marked as verified

3. Login:

   • User submits credentials
   • Password is verified
   • Access token (1d) and refresh token (10d) are generated
   • Tokens are set as HTTP-only cookies

4. Protected Routes:

   • Middleware verifies JWT from cookie or Authorization header
   • User information is attached to request

📦 Database Schema

User Model

{
  username: string(unique);
  fullName: string;
  email: string(unique);
  avatar: string;
  avatarId: string;
  password: string(hashed);
  refreshToken: string;
  isVerified: boolean;
  otp: string;
  otpExpiresAt: Date;
  timestamps: true;
}

Tweet Model

{
  content: string
  image: string
  imageId: string
  owner: ObjectId (ref: User)
  timestamps: true
}

Like Model

{
  likedBy: ObjectId (ref: User)
  likedTo: ObjectId (ref: Tweet)
  timestamps: true
}

🌐 CORS Configuration

The API is configured to accept requests from a specific origin (configurable via CORS_ORIGIN env variable). All API routes support:

• Credentials
• Custom headers
• Standard HTTP methods (GET, POST, PATCH, DELETE, OPTIONS)

🚦 Rate Limiting

Built-in rate limiting using Upstash Redis:

• 20 requests per minute per IP address
• Sliding window algorithm
• Returns 429 status when limit is exceeded

📧 Email Verification

Uses Resend service with custom React email templates:

• OTP generation with 6-digit code
• 5-minute expiration
• Resend OTP functionality
• Professional email templates

🖼️ Image Handling

Cloudinary integration for efficient image management:

• Automatic upload to sociya-v1 folder
• Image optimization with URL transformations
• Automatic deletion when content is removed
• Support for avatar and tweet images

🔒 Security Features

• HTTP-only cookies for token storage
• CORS protection
• Rate limiting
• JWT-based authentication
• Password hashing with bcrypt
• Input validation
• MongoDB injection protection via Mongoose

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📄 License

This project is private and proprietary.

👨‍💻 Author

Built with ❤️ for the Sociya social media platform

---

Note: This is a backend API service. Make sure to configure your frontend application to point to the correct API endpoints.