Complete Backend Prototype #8

Jax0312 · 2026-01-15T09:29:26Z

Implemented all backend API per previously discussed specifications.

…no more than 12 hrs ago

Copilot

Pull request overview

This PR implements a complete backend prototype for a QueueBot application using Fastify, Prisma, and TypeScript. It includes JWT-based authentication, admin management, and queue operations with Telegram Mini App integration.

Changes:

Migrated from CommonJS to ES modules with updated TypeScript configuration
Implemented JWT authentication with Telegram Mini App validation
Created database schema with Prisma (Admin, Queue, QueueConfig, AdminRequester models)
Built REST API with public and private routes for queue and admin management

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
backend/tsconfig.json	Updated to ESNext/NodeNext with stricter type checking
backend/package.json	Added dependencies (jose, fastify plugins, pg adapter) and switched to ESM
backend/src/server.ts	Main server setup with CORS, JWT auth, and route autoloading
backend/src/types.ts	Type definitions for Fastify extensions and Telegram data
backend/src/shared.ts	Admin authorization middleware
backend/src/prismaPlugin.ts	Prisma client plugin with PostgreSQL adapter
backend/src/queueConfigPlugin.ts	Queue configuration caching plugin
backend/src/routes/public/auth/index.ts	Telegram Mini App authentication endpoint
backend/src/routes/private/queue/*.ts	Queue management endpoints (status, config, next, entries)
backend/src/routes/private/admins/*.ts	Admin and admin request management endpoints
backend/prisma/schema.prisma	Database schema with 4 models
backend/README.md	Comprehensive API documentation

Files not reviewed (1)

backend/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-20T04:47:25Z

backend/src/routes/private/queue/status.ts

+        let config = await fastify.prisma.queueConfig.findFirst().then((queueConfig) => queueConfig);
+
+        if (config === null) {
+            reply.code(500);
+            throw new Error("No queue configured");
+        }
+
+        config.isOpen = request.query.open;


Missing input validation: The 'open' query parameter is parsed from stringbool but there's no validation that the config exists before trying to update it. The check happens after attempting to set the property on a potentially null object.

no issue here

Copilot · 2026-01-20T04:47:26Z

backend/src/routes/private/queue/next.ts

+            // hit Telegram API to send user message
+            fetch(`https://api.telegram.org/bot${BOT_TOKEN}/test/sendMessage?${queryString}`, {
+                method: 'POST',
+            })


Missing error handling for the Telegram API fetch request. If the request fails, there's no catch block or error handling, which could lead to unhandled promise rejections.

Suggested change

})

}).catch((error) => {

fastify.log.error({ err: error }, 'Failed to send Telegram notification');

});

Copilot · 2026-01-20T04:47:27Z

backend/src/routes/private/queue/next.ts

+import type {FastifyPluginAsyncZod} from "fastify-type-provider-zod";
+import {isAdmin} from "../../../shared.js";
+
+const BOT_TOKEN = process.env.BOT_TOKEN;


The BOT_TOKEN is accessed without the non-null assertion operator, unlike other files, and could be undefined. Add validation or use the non-null assertion consistently.

Suggested change

const BOT_TOKEN = process.env.BOT_TOKEN;

const BOT_TOKEN = process.env.BOT_TOKEN!;

Copilot · 2026-01-20T04:47:28Z

backend/src/prismaPlugin.ts

+    const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })
+


The database URL environment variable is accessed without validation. If DATABASE_URL is undefined, the PrismaClient will fail to initialize. Add validation at startup.

Suggested change

const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })

const databaseUrl = process.env.DATABASE_URL

if (!databaseUrl) {

throw new Error('DATABASE_URL environment variable is not set. Please configure it before starting the server.')

}

const adapter = new PrismaPg({ connectionString: databaseUrl })

Copilot · 2026-01-20T04:47:28Z

backend/src/routes/public/index.ts

+        fastify.prisma.admin.count().then((count) => console.log(count));
+
+    });
+


The public index route logs admin count to console but doesn't return any response. This will cause Fastify to timeout or send an empty response. Either remove this TODO endpoint or add a proper reply.

Suggested change

fastify.prisma.admin.count().then((count) => console.log(count));

});

const count = await fastify.prisma.admin.count();

console.log(count);

return reply.send({ adminCount: count });

});

will remove this example endpoint

Copilot · 2026-01-20T04:47:30Z

backend/src/shared.ts

+        reply.code(500);
+        throw new Error(e.message);


The error from catch block is being re-thrown, but the reply code has already been set. This will cause Fastify to log a warning about attempting to send headers after they've been sent. The catch block should return or handle the error properly without throwing.

Suggested change

reply.code(500);

throw new Error(e.message);

// Handle internal errors without re-throwing after setting the reply code

if (request.log && typeof request.log.error === "function") {

request.log.error(e, "Error while checking admin privileges");

}

if (!reply.sent) {

reply.code(500).send({ error: e.message });

}

Copilot · 2026-01-20T04:47:30Z

backend/src/routes/private/queue/next.ts

+            const queryString = new URLSearchParams(
+                {'chat_id': allEntries[i]!.telegram_id, 'text': message, 'parse_mode': 'Markdown'}).toString();
+            // hit Telegram API to send user message
+            fetch(`https://api.telegram.org/bot${BOT_TOKEN}/test/sendMessage?${queryString}`, {


Incorrect Telegram API endpoint: The URL includes "/test/" which is not a valid part of the Telegram Bot API path. The correct endpoint should be "https://api.telegram.org/bot{BOT_TOKEN}/sendMessage" without the "test" segment.

Suggested change

fetch(`https://api.telegram.org/bot${BOT_TOKEN}/test/sendMessage?${queryString}`, {

fetch(`https://api.telegram.org/bot${BOT_TOKEN}/sendMessage?${queryString}`, {

URL is correct, "/test/" points to Telegram API for staging environment. Should add check to switch between staging and production based on Node Env

Copilot · 2026-01-20T04:47:31Z

backend/src/routes/private/queue/entries/me/index.ts

@@ -0,0 +1,67 @@
+import {z} from 'zod';


Unused import z.

Suggested change

import {z} from 'zod';

Copilot · 2026-01-20T04:47:31Z

backend/src/routes/private/queue/entries/me/index.ts

@@ -0,0 +1,67 @@
+import {z} from 'zod';
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+import { isAdmin } from "../../../../../shared.js";


Unused import isAdmin.

Suggested change

import { isAdmin } from "../../../../../shared.js";

Copilot · 2026-01-20T04:47:31Z

backend/src/server.ts

+        fastify.log.error(err)
+        process.exit(1)
+    }
+}


Avoid automated semicolon insertion (91% of all statements in the enclosing script have an explicit semicolon).

Jax0312 and others added 19 commits December 25, 2025 13:54

feat: Telegram and JWT auth

d4b2415

set up prisma client and connected it to dev pg instance

15d2c92

set up zod type validation

dedce2c

added hook for admin check

321fc03

added endpoint for querying and updating queue status

aaf701d

added new adminRequester table and renamed organiser table to admin

073d0de

added endpoints to request, add and remove admin access

09204e1

refactored error handling

2ba86c0

added endpoints for updating and getting queue configuration

0f57e10

updated endpoint documentations

7cacac6

updated configs

6c84e02

added validation checks to ensure Telegram auth string was generated …

f5f3723

…no more than 12 hrs ago

Implemented backend API endpoints

fff0672

Update README.md

803775d

Update README.md

d21ede7

cache queueConfig

068c824

added endpoint to advance queue

f536a02

improved advance queue endpoint output

375cd6b

added documentation for auth endpoint

86456e6

Jax0312 assigned Jax0312, andrewsoonqn, duyLeu and sarinake and unassigned andrewsoonqn and duyLeu Jan 15, 2026

Jax0312 requested review from andrewsoonqn and duyLeu January 15, 2026 09:30

andrewsoonqn requested review from Copilot and yihao03 January 15, 2026 10:53

Copilot started reviewing on behalf of andrewsoonqn January 20, 2026 04:44 View session

Copilot AI reviewed Jan 20, 2026

View reviewed changes

switched to adapter-neon to bypass NUS WI-FI TCP block

197c3e2

duyLeu approved these changes Jan 22, 2026

View reviewed changes

Jax0312 merged commit a8ee651 into main Jan 22, 2026

-            })
+            }).catch((error) => {
+                fastify.log.error({ err: error }, 'Failed to send Telegram notification');
+            });

	const BOT_TOKEN = process.env.BOT_TOKEN;
	const BOT_TOKEN = process.env.BOT_TOKEN!;

		const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })

-    const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })
+    const databaseUrl = process.env.DATABASE_URL
+    if (!databaseUrl) {
+        throw new Error('DATABASE_URL environment variable is not set. Please configure it before starting the server.')
+    }
+    const adapter = new PrismaPg({ connectionString: databaseUrl })

		fastify.prisma.admin.count().then((count) => console.log(count));

		});

-        fastify.prisma.admin.count().then((count) => console.log(count));
-    });
+        const count = await fastify.prisma.admin.count();
+        console.log(count);
+        return reply.send({ adminCount: count });
+    });

-        reply.code(500);
-        throw new Error(e.message);
+        // Handle internal errors without re-throwing after setting the reply code
+        if (request.log && typeof request.log.error === "function") {
+            request.log.error(e, "Error while checking admin privileges");
+        }
+        if (!reply.sent) {
+            reply.code(500).send({ error: e.message });
+        }

	fetch(`https://api.telegram.org/bot${BOT_TOKEN}/test/sendMessage?${queryString}`, {
	fetch(`https://api.telegram.org/bot${BOT_TOKEN}/sendMessage?${queryString}`, {

Complete Backend Prototype #8

Complete Backend Prototype #8

Uh oh!

Conversation

Jax0312 commented Jan 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Jax0312 Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Jax0312 Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Jax0312 Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants