Skip to content

chore: add LICENSE, badges, and architecture diagram #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
donny-devops merged 1 commit into from
Jul 7, 2026
Merged

chore: add LICENSE, badges, and architecture diagram #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
MIT License

Copyright (c) 2026 Adonis Jimenez

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
24 changes: 24 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
# Node TS API Gateway

[![CI](https://github.com/donny-devops/node-ts-api-gateway/actions/workflows/ci.yml/badge.svg)](https://github.com/donny-devops/node-ts-api-gateway/actions/workflows/ci.yml)
[![Security Hygiene](https://github.com/donny-devops/node-ts-api-gateway/actions/workflows/security-hygiene.yml/badge.svg)](https://github.com/donny-devops/node-ts-api-gateway/actions/workflows/security-hygiene.yml)
[![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the placeholder license section

This commit now publishes a concrete MIT license via the badge and LICENSE file, but the README's License section still says to choose a license (README lines 217-219). That leaves consumers with contradictory licensing instructions; please update the section to state that the project is MIT licensed or remove the placeholder text.

Useful? React with 👍 / 👎.



A TypeScript-based Node.js API gateway designed to centralize routing, middleware, authentication, and service-to-service communication for distributed applications.

## Overview
Expand Down Expand Up @@ -211,3 +217,21 @@ You can deploy this gateway to platforms such as:
## License

Choose the license that fits your project, such as MIT, Apache-2.0, or a private internal license.
Comment on lines 217 to 219

## Architecture

```mermaid
flowchart LR
Client -->|HTTPS| GW[API Gateway]
GW --> Auth[JWT Auth]
Auth --> RL[Rate Limiter]
RL --> Val[Zod Validation]

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Align the diagram with the implemented request flow

This diagram says every request reaches a Zod Validation step, but in this commit the only zod reference outside docs is the dependency entry, and src/server.ts goes from rate limiting/JWT/DDoS/sanitise/auth to registerProxyRoutes without registering validation middleware. In deployments that rely on the README to enumerate enforced security controls for proxied traffic, this overstates request validation; please either add the validation layer or mark it as planned.

Useful? React with 👍 / 👎.

Val --> Router[Router / Proxy]
Router --> SvcA[Service A]
Router --> SvcB[Service B]
Router --> SvcC[Service C]
RL -.-> Redis[(Redis)]
Comment on lines +225 to +233

@gemini-code-assist gemini-code-assist Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

In an API gateway, rate limiting and DDoS protection should be executed before authentication (JWT Auth). If authentication is performed first, unauthenticated clients can flood the gateway with requests, forcing it to perform expensive cryptographic JWT verification on every request, which can easily lead to CPU exhaustion and denial of service.

Please update the architecture diagram to place the Rate Limiter before JWT Auth. Additionally, remember to update the description below the diagram (lines 236-237) to reflect this flow.

Suggested change
Client -->|HTTPS| GW[API Gateway]
GW --> Auth[JWT Auth]
Auth --> RL[Rate Limiter]
RL --> Val[Zod Validation]
Val --> Router[Router / Proxy]
Router --> SvcA[Service A]
Router --> SvcB[Service B]
Router --> SvcC[Service C]
RL -.-> Redis[(Redis)]
Client -->|HTTPS| GW[API Gateway]
GW --> RL[Rate Limiter]
RL --> Auth[JWT Auth]
Auth --> Val[Zod Validation]
Val --> Router[Router / Proxy]
Router --> SvcA[Service A]
Router --> SvcB[Service B]
Router --> SvcC[Service C]
RL -.-> Redis[(Redis)]

@secure-code-warrior-for-github secure-code-warrior-for-github Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Micro-Learning Topic: Denial of service (Detected by phrase)

Matched on "denial of service"

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service

Try a challenge in Secure Code Warrior

Comment on lines +224 to +233
```

*Requests flow through authentication, Redis-backed rate limiting, schema
validation, and routing before reaching downstream services.*
Comment on lines +236 to +237
Loading