Editorial Backend API
A REST API for an independent art and culture magazine: six material types, a role-based permission model and scheduled publishing, built to let a small editorial team run the whole publication without a developer.
Overview
Challenge & approach
The starting point was a flat prototype that returned fixed content. The goal was a backend that can be run in production by non-developers and survive being exposed to the internet:
Architecture — Domain-sliced layout (entities, features, shared) on Express 5 and TypeScript. Every content type is described by a Zod schema that validates input and drives the admin forms. A parity check proves that every field the API accepts is editable in the admin.
Security — Four roles with a permission matrix (including a manager role with no user management); tokens revoked on password change; allowlist sanitization of submitted HTML; rate limiting on login, sign-up, forms and AI calls; uploaded files served in a sandbox; one-time password-reset links. A dedicated audit closed an open subscriber list and a stored-XSS vector in uploads.
Publishing — A background clock publishes scheduled articles and starts scheduled newsletters, catching up after downtime. Directories refuse to delete a category or file that is still in use and rename it across all articles.
Operations — Paged and searchable lists, WebP thumbnails, one-command database backup and restore, a demo-content purge with a dry run, a runbook for accounts and mail, 50 tests.