Build with AutoSecure
The canonical documentation lives in the repository under docs/. This page summarises the essentials.
Quickstart
- Requirements: Node 20+, pnpm 9, PostgreSQL 16, Redis 7.
- Copy .env.example to .env, then run: pnpm install, pnpm db:generate, pnpm db:migrate, pnpm db:seed.
- Start the API with pnpm dev:api and check http://localhost:4000/v1/health.
Architecture
- Monorepo: apps/api (NestJS), apps/web + apps/admin (Next.js), apps/worker (BullMQ), apps/bot (Discord).
- Shared packages: shared (types/Zod), core (state machines), security (hashing/redaction), ui + design-tokens, api-client.
- PostgreSQL is the source of truth; Redis is ephemeral; S3 stores files.
Security
- Argon2id password hashing; hashed session/API tokens verified in constant time.
- Server-side authorization on every protected access; tenant scoping on tenant rows.
- Webhook signatures verified and event IDs deduplicated; no full card data stored.
- See docs/security/threat-model.md for the full threat model.
Operations
- Local: docker compose up -d postgres redis.
- Migrations: pnpm db:migrate (dev) / pnpm db:deploy (production).
- Backups: pg_dump custom format; restore drills are documented in docs/operations/backup-restore.md.
API
- Base path: /v1. Errors use a single envelope: { error: { code, message, requestId, status } }.
- Every response carries x-request-id.
- Health: GET /v1/health (liveness) and GET /v1/health/ready (database readiness).