Bunastack API
A NestJS backend with authentication, content management, media, and notifications — 70+ documented endpoints, secured by default.
Built on a proven stack
Modern, battle-tested technologies — chosen for performance, type safety, and long-term maintainability.
Framework
Data
Security
Storage
Notifications
Tooling
Clean layers, one-way flow, easy to extend
The API follows clean architecture — controllers handle transport, services own business logic, and repositories talk to the database. Each layer depends on abstractions, not concrete implementations.
- Controller → Service → Repository
- Dependency injection throughout
- Stateless, horizontally scalable
- Feature-based module folders
Who can log in, what they can do — decided server-side
The API authenticates every identity and authorizes every action. Tokens are short-lived and rotated, permissions come from the database on each request, and access can be revoked via ban/version bump (Redis) from anywhere.
- Email & OAuth login
- Short-lived access + rotating refresh
- RBAC resolved from DB per request
- Revoke access from any device
Each access token is short-lived, so a leaked token expires on its own. When it does, the refresh cookie — stored HttpOnly — is exchanged server-side for a brand-new access + refresh pair. The old refresh token is invalidated instantly, so it can never be replayed.
Revoking bans the user / bumps token version (Redis) and invalidates refresh tokens — access tokens expire shortly, from anywhere.
Posts, categories & menus — one content API
Manage the building blocks of your site: posts, categories, products, and menus. All localized, validated, and versioned — ready to power any frontend.
- Full CRUD for posts, categories & menus
- Localized fields & real-time slug check
- Nested categories & drag-drop menus
- Publish workflow & version history
Role-based access control, enforced on every request
Define roles, map granular permissions, and gate every API route and admin screen by effective access — resolved from the database on each request, never trusted from the client.
- Create roles with custom permission sets
- 35+ permissions across every module
- Guards on routes and endpoints
- Effective permissions from DB per request
Every change becomes a version you can restore
Posts, categories, and products are automatically versioned on every update, delete, and bulk delete — review the full history and roll back any change in one click, without losing anything.
- Auto-revision on update & delete
- Full version history per record
- One-click restore any version
- Rollback keeps history — restore again
Hardened against the OWASP Top 10, by default
Every endpoint is validated, throttled, and guarded before it reaches your business logic. Passwords are hashed with Argon2, tokens stay short-lived, and files are checked by content — not just by extension.
- Validate every input at the boundary
- Rate limit auth & write endpoints
- Argon2 password hashing
- MIME-sniffed file uploads
Upload once, serve everywhere
Upload images, video, audio, and documents with MIME validation — stored in S3 or self-hosted MinIO with thumbnails generated for you.
- Single & bulk upload
- S3 or self-hosted MinIO
- Auto thumbnails for images (768px & 360px)
- File manager with bulk delete
Per-user themes, stored and synced
Save each user's theme and language in their preferences — light, dark, system, or a themed palette. The API stores it once, and every client applies the same choice.
- Light, dark & system themes
- Themed palettes (Medieval, Feudal, Wabi-sabi)
- Saved per user via preferences API
- One API call to read & update
One content model, every language
Store name, slug, description, and body for each language in a single entity — the API serves the right translation to the right audience, and clients pick what they need.
- Localized name, slug, description & body
- 11 language codes ready in shared definitions
- Pick translations per request
- Same structure, zero duplication
Tested at every layer, ready to ship
Unit tests cover business logic in isolation, while E2E suites run real HTTP flows against a dedicated test database — so you get an API that's verified, not just shipped.
- Unit tests for services & validators
- 22+ E2E suites with Supertest
- Dedicated test database
- Auth, roles & rate-limit covered
Let's build something great
Have a project in mind or want to learn more? Reach out — we usually reply within one business day.
Prefer a direct line?
Pick whichever channel suits you — we read everything and get back fast.
Average response time: under 24 hours
Get in touch
Please feel free to contact us if you have any questions.