Roommate App - Roadmap

Architecture

---

Component Overview

Component	Technology	Responsibility
Reverse Proxy	Nginx	SSL termination, load balancing
REST API	NestJS	HTTP endpoints, business logic
WebSocket Gateway	Socket.io	Real-time chat, presence
Message Queue	RabbitMQ	Async message delivery between clients
Cache	Redis	Cache layer, rate limiting, session
Database	PostgreSQL	Primary data store

---

Phase 1: Foundation

Core authentication system with stateless JWT access tokens and database-stored refresh tokens.

Completed

• Project scaffolding (NestJS, Drizzle, Docker)
• Email service (SMTP)
• OTP generation and verification
• JWT access tokens
• Refresh tokens (hashed, 90-day expiry)
• JWT Guard decorator
• Token rotation on refresh
• Seeder for locations
• Swagger setup
• API versioning
• Factory methods for integration tests
• POST /auth/refresh endpoint
• POST /auth/logout endpoint

Remaining

• Global Exception Filter
• Image upload service
• NSFW filtering

Notes

Access Token:  JWT, stateless
Refresh Token: Opaque string, hashed in DB, 90-day expiry

---

Phase 2: User Profile & Preferences

User identity and preferences system. Foundation for matching algorithm.

Tasks

• Profile schema
• Profile CRUD endpoints
• Preferences schema
• Preferences CRUD endpoints

Phase 3: Postings

Property posting system with geospatial search capability.

Tasks

• Posting schema based on location
• Posting create/updated CRUD endpoints
• Posting image update CRUD endpoints
• Posting delete/posting_status
• Pagination (posting lists)
• Location endpoint for getting neighborhoodsID
• Search and Filtering endpoints for lists
• Pagination GET bookmarks
• Preventing multiple postings in the same location
• Bookmark feature and count of it for posts
• Posting status (active/inactive/rented)
• Max postings constraint

Phase 4: Discovery & Matching

Swipe-based discovery system with mutual matching.

Tasks

Core

• swipes table
• matches table
• POST /swipes endpoint
• GET /matches endpoint (list matches)
• DELETE /matches/:id endpoint (unmatch)

Feed Generation

• GET /feed endpoint
• Location-based filtering
• Gender preference filtering
• Budget/lifestyle preference filtering
• Exclude swiped profiles
• Exclude blocked users (bidirectional)

Ranking Algorithm

• Basic scoring system:
  • Location match
  • Preference compatibility
  • Profile popularity
  • Recent activity
• ORDER BY score logic
• Shuffle algorithm

Optimizations

• Redis cache for feed sets
• Query indexes on swipes table
• Archive old swipes (>3 months)

Analytics

• Track swipe behavior (view duration, time to decision)
• Track match quality (unmatch rate, time to unmatch)

Edge Cases

• Self-swipe prevention
• Duplicate swipe prevention
• Race condition on match creation
• Deleted/blocked user handling
• Re-match after unmatch

Algorithm Phases

Phase 1: Location + basic filters
Phase 2: + Lifestyle preference scoring
Phase 3: + Collaborative filtering (Apache AGE extension?)
Phase 4: + ML recommendations (future)

---

Phase 5: Real-time Messaging

End-to-end encrypted peer-to-peer messaging via WebSocket.

Tasks

• WebSocket Gateway (Socket.io)
• JWT auth on connection
• Conversation per match or postings
• RabbitMQ integration
• E2EE implementation
• Offline message queue
• Temporary stored messages strategy

E2EE Design

Messages are encrypted on sender's device and decrypted on receiver's device. Server only stores encrypted data it cannot read.

Key Exchange: Diffie-Hellman

Flow:
  1. Users match → exchange encryption keys
  2. Sender encrypts message on their phone
  3. Server stores encrypted message (until it is delivered e.g. for offline users)
  4. Receiver decrypts on their phone

Phase 5.5: Notifications

Push notifications for matches and messages when users are offline.

Tasks

• user_devices table (device_token, platform, user_id)
• notifications table (user_id, type, title, body, read_at, created_at)
• POST /devices/register endpoint
• GET /notifications endpoint
• PUT /notifications/:id/read endpoint
• RabbitMQ notification consumer
• FCM integration (Android push)
• APNs integration (iOS push)
• Firebase project setup
• APNs certificate setup
• Rate limiting (max 5 push/day per user)
• Auto-delete notifications older than 30 days

Notification Types

- New match (when offline)
- New message (when offline)

Phase 6: Safety & Moderation

User safety features and abuse prevention.

Tasks

• Block/unblock user endpoint
• Rate limiting (Redis)
• Bot prevention

Rate Limiting Strategy

Layer 1 - Nginx:   IP-based throttling
Layer 2 - Redis:   User-based limits
Layer 3 - App:     Endpoint-specific limits

Limits:
├── Auth:     5 OTP requests/hour/email

---

Phase 7: Maps Integration

Location services for postings and discovery.

Tasks

• Geocoding service
• Reverse geocoding

Phase 8: Infrastructure

Production deployment and DevOps setup.

Tasks

• Docker Compose production config
• Nginx SSL configuration (Let's Encrypt)
• GitHub Actions CI
• GitHub Actions CD
• Health check endpoints
• Structured logging
• Backup strategy (cron)

Docker Services

services:
  api: NestJS application
  postgres: PostgreSQL
  redis: Cache + Rate limiting
  rabbitmq: Message queue
  nginx: Reverse proxy + SSL

CI/CD Pipeline

---

Phase 9: Performance

Optimization and caching strategies.

Tasks

• Move refresh tokens to Redis
• Connection pooling
• Response caching