Shorteny — URL Shortener

End-to-end ownership. Both the Go API and the Next.js frontend are mine — schema, handlers, middleware, and every page in the app.

Two flows in one product. Anonymous shortening through the public landing page, plus a full authenticated experience with a dashboard, history, profile, QR modal, and password-reset email loop.

Production-grade backend. Rate-limited Gin router, Redis cache warmer, Postgres-backed GORM models with soft-delete, structured logging, graceful shutdown, and SQL migrations.

Containerized + deployed. Frontend on Vercel, Go API packaged with the repo Dockerfile and run behind nginx — Postgres and Redis run as separate services.

App Router pages. 17 routes across the public site, auth flows, the user dashboard, and a resources cluster (blog, guide, documentation, api-docs).

Two service layers. src/services/api.ts handles auth, src/app/services/api.ts handles URL and QR calls. Base URL injected through NEXT_PUBLIC_API_URL.

UI. Tailwind for layout, Framer Motion for transitions, react-icons for the icon set.

Auth state. JWT persisted in localStorage; protected pages redirect on missing or expired tokens. Dashboard re-pulls URL stats on a timer while the tab is active.

Routing. Gin router split into /api public, /v1/auth, and JWT-guarded /v1/api groups. CORS, structured logger, and rate limiter middleware on every route.

Models. GORM models for User and URL over Postgres, with UUID primary keys, soft-delete on URLs, and ownership helpers (IsOwnedBy, CanBeEditedBy).

Rate limiting. Redis-backed token-bucket limiter keyed by client IP, with auto-block on excess requests and a TTL countdown returned to the caller.

Cache warmer. Background service that periodically loads the top URLs into Redis to keep redirects hot.

Auth. JWT access + refresh tokens generated per user UUID. Forgot-password flow sends reset links via SMTP using a dedicated email service.

Migrations. Versioned SQL migrations under migrations/: users, urls, anonymous-url support.

Lifecycle. Graceful shutdown via signal context, health-check endpoint, and 404 fallback wired into the router.