Publishing API
A Medium-style blogging backend. Articles, tags, comments and likes, with email flows and metric syncing pushed onto a Celery worker instead of the request.
What is in it
Articles with slugs, tags, search, a feed and per-user likes. Comments with authorization that distinguishes the comment author from the article author. JWT auth with access and refresh tokens, and email verification and password reset over six-digit codes.
The parts worth pointing at
Nothing slow happens in the request. Email delivery goes to Celery. So does the periodic job that syncs view and like counters out of Redis and into Postgres. A user waiting on an HTTP response should never be waiting on an SMTP server.
Counters live in Redis first. Same reasoning as the streaming project: a counter incremented on every read is the wrong thing to put in a relational database on the hot path.
Rate limiting sits on the auth endpoints, which are the ones worth attacking, rather than uniformly across an API where it mostly annoys legitimate clients.