Optimizing TypeScript Full‑Stack Development with Postgres, JWT Authentication, and LLM‑Based Automation for Cost‑Effective Deployments

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile
      - run: pnpm run lint
      - run: pnpm run test
  guard:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Check node_modules size
        run: |
          size=$(du -s node_modules | cut -f1)
          if [ "$size" -gt 2000000 ]; then
            echo "node_modules too large ($size KB)"
            exit 1
          fi
      - name: Smoke test DB connection
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: |
          npx ts-node -e "import { Client } from 'pg'; \
            const c = new Client({ connectionString: process.env.DATABASE_URL }); \
            c.connect().then(() => console.log('OK')).catch(e => { console.error(e); process.exit(1); })"

// src/auth.ts
import { sign, verify, JwtPayload } from 'jsonwebtoken';
import { Pool } from 'pg';
import { randomUUID } from 'crypto';

const pool = new Pool({ connectionString: process.env.DATABASE_URL });
const ACCESS_TTL = '5m';
const REFRESH_TTL = 60 * 60 * 24 * 30; // 30 days

export async function createTokens(userId: string, role: string) {
  const access = sign({ sub: userId, role }, process.env.JWT_SECRET!, { expiresIn: ACCESS_TTL });

  const refreshId = randomUUID();
  await pool.query(
    `INSERT INTO refresh_tokens (id, user_id, expires_at) VALUES ($1, $2, now() + interval '${REFRESH_TTL}s')`,
    [refreshId, userId],
  );

  const refresh = sign({ jti: refreshId }, process.env.JWT_SECRET!, { expiresIn: `${REFRESH_TTL}s` });
  return { access, refresh };
}

export async function verifyRefresh(token: string) {
  const payload = verify(token, process.env.JWT_SECRET!) as JwtPayload;
  const { rows } = await pool.query(
    `DELETE FROM refresh_tokens WHERE id = $1 AND expires_at > now() RETURNING user_id`,
    [payload.jti],
  );
  if (!rows.length) throw new Error('Invalid or expired refresh token');
  return rows[0].user_id;
}

# render.yaml
services:
  - type: web
    name: api
    env: node
    plan: free
    buildCommand: pnpm install && pnpm run build
    startCommand: pnpm start
    envVars:
      - key: DATABASE_URL
        fromSecret: neon_url
      - key: JWT_SECRET
        fromSecret: jwt_secret
    healthCheckPath: /api/health
    autoDeploy: true
    concurrency: 1

// src/db.ts
import { Pool } from 'pg';

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  // Keep the pool tiny; Render workers are short‑lived.
  max: 3,               // three concurrent queries is enough for our API
  idleTimeoutMillis: 5_000,
  // Neon recommends `application_name` for debugging.
  application_name: 'api-worker',
});

export async function query<T>(text: string, params?: any[]): Promise<T[]> {
  const client = await pool.connect();
  try {
    const res = await client.query<T>(text, params);
    return res.rows;
  } finally {
    client.release();
  }
}

// src/middleware/connectionGuard.ts
import type { Request, Response, NextFunction } from 'express';
import { query } from './db';

export async function connectionGuard(
  req: Request,
  _res: Response,
  next: NextFunction,
) {
  try {
    // A cheap ping that also forces the pool to allocate a client.
    await query('SELECT 1');
    next();
  } catch (err: any) {
    if (err.code === '57P03') { // too_many_connections
      // Return 503 so the client retries later.
      _res.status(503).json({ error: 'Service overloaded, try again.' });
    } else {
      next(err);
    }
  }
}

// src/server.ts
import http from 'http';
import app from './app';
import { pool } from './db';

const server = http.createServer(app);

process.on('SIGTERM', async () => {
  console.log('SIGTERM received – closing HTTP server and DB pool');
  server.close(() => console.log('HTTP server closed'));
  await pool.end(); // closes all idle connections
  process.exit(0);
});

-- migrations/2024-09-01-create-refresh-token.sql
CREATE TABLE refresh_tokens (
  id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id       UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  token_hash    TEXT NOT NULL,
  issued_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
  expires_at    TIMESTAMPTZ NOT NULL,
  revoked_at    TIMESTAMPTZ,
  UNIQUE (user_id, token_hash)
);

// src/auth/refresh.ts
import crypto from 'crypto';
import { query } from '../db';
import { signJwt } from './jwt';

export async function issueRefreshToken(userId: string) {
  const raw = crypto.randomBytes(48).toString('base64url');
  const hash = crypto.createHash('sha256').update(raw).digest('hex');
  const expires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days

  await query(`
    INSERT INTO refresh_tokens (user_id, token_hash, expires_at)
    VALUES ($1, $2, $3)
  `, [userId, hash, expires]);

  // Return the raw token to the client (it never touches the DB)
  return raw;
}

// src/auth/rotate.ts
import { query } from '../db';
import { signJwt } from './jwt';
import { verifyRefreshToken } from './verify';

export async function rotateRefreshToken(
  rawToken: string,
): Promise<{ accessToken: string; newRefreshToken: string }> {
  const hash = crypto.createHash('sha256').update(rawToken).digest('hex');

  // 1️⃣ Find the record, ensure it isn’t revoked or expired
  const rows = await query<{
    id: string;
    user_id: string;
    expires_at: string;
    revoked_at: string | null;
  }>(`
    SELECT *
    FROM refresh_tokens
    WHERE token_hash = $1
      AND revoked_at IS NULL
      AND expires_at > now()
    FOR UPDATE
  `, [hash]);

  if (!rows.length) throw new Error('Invalid or expired refresh token');

  const token = rows[0];

  // 2️⃣ Revoke the old token
  await query(`
    UPDATE refresh_tokens
    SET revoked_at = now()
    WHERE id = $1
  `, [token.id]);

  // 3️⃣ Issue a fresh one
  const newRaw = await issueRefreshToken(token.user_id);

  // 4️⃣ Return a fresh access JWT
  const accessToken = signJwt({ sub: token.user_id }, '5m');

  return { accessToken, newRefreshToken: newRaw };
}

// src/routes/auth.ts
router.post('/refresh', async (req, res) => {
  const raw = req.cookies['rt']; // HttpOnly, Secure
  try {
    const { accessToken, newRefreshToken } = await rotateRefreshToken(raw);
    res
      .cookie('rt', newRefreshToken, {
        httpOnly: true,
        secure: true,
        sameSite: 'lax',
        maxAge: 30 * 24 * 60 * 60 * 1000,
      })
      .json({ accessToken });
  } catch (e) {
    res.clearCookie('rt').status(401).json({ error: 'Refresh failed' });
  }
});

// src/ci/llmBatch.ts
import { execSync } from 'child_process';
import fetch from 'node-fetch';

interface FileChange {
  path: string;
  diff: string;
}

function getStagedDiffs(): FileChange[] {
  const raw = execSync('git diff --cached', { encoding: 'utf8' });
  // Very naive split – good enough for a small repo.
  return raw
    .split('\ndiff --git')
    .filter(Boolean)
    .map(chunk => {
      const [header, ...body] = chunk.split('\n');
      const path = header.match(/b\/(.+)$/)?.[1] ?? 'unknown';
      return { path, diff: body.join('\n') };
    });
}

function buildPrompt(changes: FileChange[]): string {
  const intro = `You are a senior TypeScript engineer. Review the following diffs and suggest improvements. Return a JSON array with objects {file, suggestion}.`;
  const bodies = changes.map(c => `--- ${c.path} ---\n${c.diff}`).join('\n');
  return `${intro}\n${bodies}`;
}

async function callGroq(prompt: string) {
  const resp = await fetch('https://api.groq.com/openai/v1/chat/completions', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.GROQ_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      model: 'llama3-70b-8192',
      messages: [{ role: 'user', content: prompt }],
      temperature: 0,
    }),
  });

  if (!resp.ok) {
    // Fallback to OpenRouter free tier
    return callOpenRouter(prompt);
  }

  const data = await resp.json();
  return JSON.parse(data.choices[0].message.content);
}

async function runBatchReview() {
  const changes = getStagedDiffs();
  if (!changes.length) return;

  const prompt = buildPrompt(changes);
  const suggestions = await callGroq(prompt);

  for (const { file, suggestion } of suggestions) {
    console.log(`🛠️ ${file}: ${suggestion}`);
    // Optionally, write a comment file for the PR.
  }
}

// src/middleware/logger.ts
import morgan from 'morgan';
import { v4 as uuidv4 } from 'uuid';

export const requestId = (req, res, next) => {
  req.id = uuidv4();
  res.setHeader('X-Request-Id', req.id);
  next();
};

export const jsonLogger = morgan((tokens, req, res) => {
  return JSON.stringify({
    ts: new Date().toISOString(),
    rid: req.id,
    method: tokens.method(req, res),
    url: tokens.url(req, res),
    status: Number(tokens.status(req, res)),
    time: Number(tokens['response-time'](req, res)),
    user: req.user?.id ?? null,
  });
});

// src/routes/metrics.ts
import { Router } from 'express';
import { pool } from '../db';

const router = Router();

router.get('/metrics', async (_req, res) => {
  const client = await pool.connect();
  try {
    const { rows } = await client.query(`
      SELECT
        count(*) FILTER (WHERE state = 'idle') AS idle,
        count(*) FILTER (WHERE state = 'active') AS active,
        count(*) FILTER (WHERE state = 'idle in transaction') AS idle_tx
      FROM pg_stat_activity
      WHERE datname = current_database()
    `);
    res.json({
      db: rows[0],
      uptime: process.uptime(),
    });
  } finally {
    client.release();
  }
});

export default router;

name: Cold‑Start Alert
on:
  schedule:
    - cron: '*/10 * * * *'   # every 10 minutes
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - name: Pull logs
        run: |
          curl -s "https://api.render.com/v1/services/${{ secrets.RENDER_SERVICE_ID }}/logs?since=10m" \
            -H "Authorization: Bearer ${{ secrets.RENDER_API_KEY }}" \
            | grep STARTUP && exit 1 || exit 0
      - name: Notify Slack
        if: failure()
        uses: slackapi/slack-github-action@v1.23.0
        with:
          payload: '{"text":"⚡️ Render container started (cold‑start)"}'
          channel-id: ${{ secrets.SLACK_CHANNEL }}

// src/client.ts
export { fetchPosts } from './api/posts';
export { renderMarkdown } from './ui/markdown';

// src/server.ts
export { createPost } from './api/posts';
export { generateDraft } from './llm/draft';

{
  "compilerOptions": {
    "module": "ESNext",
    "target": "ES2022",
    "outDir": "./dist",
    "rootDir": "./src",
    "paths": {
      "@client/*": ["client.ts"],
      "@server/*": ["server.ts"]
    }
  },
  "include": ["src/**/*.ts"]
}

// src/api/draft.ts
import type { Request, Response } from 'express';

export async function generateDraft(req: Request, res: Response) {
  // Guard against accidental browser execution
  if (process.env.NODE_ENV !== 'production' && typeof window !== 'undefined') {
    return res.status(400).json({ error: 'LLM endpoint not available in the browser' });
  }

  const { generate } = await import('../llm/client'); // <-- dynamic import
  const { prompt } = req.body;

  try {
    const draft = await generate(prompt);
    res.json({ draft });
  } catch (err) {
    console.error('LLM error', err);
    res.status(502).json({ error: 'LLM service unavailable' });
  }
}

{
  "outputs": {
    "dist/client.js": {
      "bytes": 287432,
      "imports": [
        { "path": "src/ui/markdown.js", "bytes": 12458 },
        { "path": "src/api/posts.js", "bytes": 56231 }
      ]
    }
  }
}

-- posts table stores markdown and optional cover image reference
CREATE TABLE posts (
  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  title       TEXT NOT NULL,
  slug        TEXT UNIQUE NOT NULL,
  body_md     TEXT NOT NULL,
  cover_key   TEXT,               -- key in object storage, nullable
  created_at  TIMESTAMPTZ DEFAULT now(),
  updated_at  TIMESTAMPTZ DEFAULT now()
);

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { Pool } from 'pg';
import { randomUUID } from 'crypto';
import { Readable } from 'stream';

const s3 = new S3Client({
  endpoint: `https://${process.env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com`,
  region: 'auto',
  credentials: {
    accessKeyId: process.env.R2_ACCESS_KEY_ID!,
    secretAccessKey: process.env.R2_SECRET_ACCESS_KEY!,
  },
});

const pg = new Pool({ connectionString: process.env.DATABASE_URL });

export async function storeCoverImage(
  postId: string,
  mime: string,
  data: Buffer
): Promise<void> {
  const key = `covers/${postId}/${randomUUID()}`;
  // 1️⃣ Upload to R2
  await s3.send(
    new PutObjectCommand({
      Bucket: process.env.R2_BUCKET!,
      Key: key,
      Body: data,
      ContentType: mime,
    })
  );

  // 2️⃣ Update the row
  const client = await pg.connect();
  try {
    await client.query(
      `UPDATE posts SET cover_key = $1, updated_at = now() WHERE id = $2`,
      [key, postId]
    );
  } finally {
    client.release();
  }
}

import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
import { GetObjectCommand } from '@aws-sdk/client-s3';

export async function handleRequest(request: Request) {
  const url = new URL(request.url);
  const postId = url.pathname.split('/')[2]; // /cover/:postId

  const client = await pg.connect();
  try {
    const { rows } = await client.query(
      `SELECT cover_key FROM posts WHERE id = $1`,
      [postId]
    );
    if (!rows[0]?.cover_key) return new Response('No cover', { status: 404 });

    const command = new GetObjectCommand({
      Bucket: process.env.R2_BUCKET!,
      Key: rows[0].cover_key,
    });
    const signed = await getSignedUrl(s3, command, { expiresIn: 300 });
    return Response.redirect(signed, 302);
  } finally {
    client.release();
  }
}

import type { Request, Response, NextFunction } from 'express';
import LRU from 'lru-cache';

const ssrCache = new LRU<string, { html: string; expires: number }>({
  max: 500,                     // store up to 500 pages
  ttl: 1000 * 60 * 5,           // 5 minutes default TTL
  allowStale: true,             // serve stale while revalidating
});

export function ssrCacheMiddleware(req: Request, res: Response, next: NextFunction) {
  if (req.method !== 'GET' || req.headers['x-no-cache']) return next();

  const key = req.originalUrl;
  const cached = ssrCache.get(key);
  if (cached) {
    // Serve stale copy immediately
    res.setHeader('x-cache', 'HIT');
    res.send(cached.html);

    // If stale, re‑render in the background
    if (Date.now() > cached.expires) {
      renderAndStore(key, req).catch(err => console.error('SSR revalidate failed', err));
    }
    return;
  }

  // No cache – render and store
  renderAndStore(key, req)
    .then(html => {
      res.setHeader('x-cache', 'MISS');
      res.send(html);
    })
    .catch(next);
}

// Helper that runs the actual rendering
async function renderAndStore(key: string, req: Request): Promise<string> {
  const html = await renderPage(req); // your Astro/Next render function
  ssrCache.set(key, { html, expires: Date.now() + 1000 * 60 * 5 });
  return html;
}

import express from 'express';
import { ssrCacheMiddleware } from './middleware/ssrCache';

const app = express();

app.use(ssrCacheMiddleware);
app.use('/api', apiRouter); // JWT‑protected API routes
app.use(express.static('public'));

app.listen(process.env.PORT ?? 3000, () => {
  console.log('🚀 Server ready');
});

router.get('/cache-stats', (_req, res) => {
  res.json({
    size: ssrCache.size,
    hits: ssrCache.stats?.hits ?? 0,
    misses: ssrCache.stats?.misses ?? 0,
  });
});