youngjun827 / api-std-lib Goto Github PK

Evaluate the new slog package for logging as an alternative to the standard log package.

Credentials for the database are currently hardcoded in db.go. Replace these with environment variables or a secure method for storing them.

Consider implementing the repository pattern to separate SQL logic from the controllers.

Consider implementing Two-Factor Authentication (2FA) using TOTP for added security.

For example, you could use a machine learning model to detect harmful or offensive content.

Project is containerized thus, I need to update update makefile so others can run the project using docker containers

The current rate limiter blindly trusts r.RemoteAddr for the IP address. Implement a more robust method for correctly identifying IP addresses.

The r.Body is being closed manually in controllers, which is unnecessary as the server handles this.

Evaluate the need for logging the start of each handler in controllers.

Currently, channels and goroutines are being used unnecessarily for building a list of users. Simplify this by using a direct database query.

Implement better email validation using mail.ParseAddress and simplify password rules focusing on length.

Currently, a new cleanup goroutine is spawned with each request in the rate limiter. Consider optimizing this.

Errors are currently returned using http.Error() with basic text. Make all responses JSON-formatted for better API consistency.

Replace snake_case with camelCase and PascalCase as per Go conventions.

The utility package needs to be broken down into more appropriately-named packages. For example, rate limiting logic could go into a package named rate, and validation helpers could go into a package named validate.

Evaluate the necessity of user caching in the current system.

The current implementation always logs output to files. Change it to log to stdout and stderr, so the user can redirect it to files or any other destination as needed.

Replace the current usage of http.ListenAndServe with creating a custom http.Server instance for better control over timeouts and other settings.

Currently, the default serve mux from the http package is being used. Implement a custom serve mux for better control and security.

Reconsider the current validation logic shared across controllers. Potentially separate this into individual responsibilities for each controller.

Instead of manually typing out HTTP error messages, use http.StatusText() to get default status texts.

The rate limiter is currently using a global mutex, causing requests to be processed sequentially. Optimize this for parallel processing.