Hackmate Server

The system is organized into three concentric layers. The API layer (src/api/controllers and src/api/routes) handles HTTP request routing, delegating to core services (core/services/*.service.ts) that encapsulate business rules such as authentication, matching, profile management, chat handling, network interactions, project lifecycle, group coordination, and notification processing. All services are pure TypeScript classes injected into controllers, enabling isolated unit testing.

The infrastructure layer (infrastructure/*) provides adapters for external resources: MongoDB models (infrastructure/database/models), Redis client configuration, and a dedicated Socket.IO service (infrastructure/socket/socket.service.ts). This layer abstracts persistence and real‑time messaging, allowing the core to remain agnostic of implementation details.

Data flow follows a clear path: client → Fastify → route → controller → service → repository/model → database. Validation occurs early using Zod schemas defined in shared/validators, guaranteeing type safety before business logic execution. Errors are funneled through a global error handler that normalizes validation errors, MongoDB duplicate key conflicts, JWT failures, and unexpected exceptions into consistent HTTP responses.

Security guardrails include Helmet for HTTP header hardening, CORS configuration, rate limiting via express-rate-limit (adapted for Fastify), and JWT verification middleware applied to all non‑auth routes. Passwords are hashed with Argon2, and OTP email verification leverages a centralized EmailService.

The build topology uses a standard TypeScript compilation pipeline (npm run build) producing JavaScript output consumed by src/start.ts. Development mode (npm run dev) employs hot‑reload, while production runs the compiled bundle with environment‑driven configuration. Health checks (GET /health) and a root status endpoint provide operational visibility.