Base.vn Prep

1 · Client-Server Architecture

HTTP lifecycle: DNS → TCP → TLS → HTTP → response → close/keep-alive

Stateless: session vào Redis hoặc JWT → scale ngang dễ.

Pitfall: WS cho mọi real-time → tốn socket. Polling 30s đủ cho notification. Quên CORS + idempotency POST.

2 · Database Design (PostgreSQL)

Pick: SQL khi schema ổn định + JOIN/transaction. NoSQL khi schema linh hoạt + scale write cao.

-- Hot query: WHERE user_id = ? ORDER BY created_at DESC
CREATE INDEX idx_tasks_user_created ON tasks(user_id, created_at DESC);

-- Composite index thứ tự: equality TRƯỚC, range SAU
-- Bad:  ON tasks(created_at, user_id) — dùng user_id miss index
-- Good: ON tasks(user_id, created_at)

Transaction: Multi-table write → BẮT BUỘC transaction. Prisma: prisma.$transaction([...])

Pitfall: Index quá nhiều → chậm write. Soft delete quên WHERE deleted_at IS NULL → leak. UUID v4 PK → fragment index → ULID/UUIDv7.

3 · Caching Strategies (Redis)

// Cache-aside — default
async function getUser(id: string) {
  const cached = await redis.get(`user:${id}`);
  if (cached) return JSON.parse(cached);
  const user = await db.user.findUnique({ where: { id } });
  await redis.set(`user:${id}`, JSON.stringify(user), 'EX', 300);
  return user;
}

// Invalidate khi update
async function updateUser(id: string, data) {
  const user = await db.user.update({ where: { id }, data });
  await redis.del(`user:${id}`); // KHÔNG set lại — race condition
  return user;
}

Strategy: TTL (simple, eventual) · Event-based (chính xác, phức tạp) · Write-through (consistent, slow write).

Pitfall: Cache stampede — 1000 req cùng miss → đánh DB. Fix: lock (single-flight) + stale-while-revalidate. Cache key thiếu tenant_id → leak cross-tenant.

4 · Load Balancing & Horizontal Scaling

   Internet
      │
      ▼
  [Load Balancer]   ── Round-robin / Least-conn / IP-hash
   │   │   │
   ▼   ▼   ▼
  app app app       ── Stateless instances (Docker/K8s)
   │   │   │
   └───┼───┘
       ▼
  [Redis]  [Postgres replica · read]  [Postgres primary · write]

Read replica: Tách read sang replica, write vào primary. Read throughput 3-5×. Trade: replication lag.

Pitfall: Sticky session → scale khó. Dùng Redis session. Quên health check → LB route vào instance chết.

5 · Async Processing (BullMQ)

Nguyên tắc: Đừng block HTTP. User click "Send 10k email" → trả 202 Accepted, push job.

const emailQueue = new Queue('email', { connection: redis });

@Post('campaigns/:id/send')
async sendCampaign(@Param('id') id: string) {
  await emailQueue.add('send-batch', { campaignId: id }, {
    attempts: 3,
    backoff: { type: 'exponential', delay: 5000 }, // 5s, 25s, 125s
  });
  return { status: 'queued' }; // 202
}

new Worker('email', async (job) => {
  await sendEmailBatch(job.data.campaignId);
}, { connection: redis, concurrency: 10 });

Pitfall: Job không idempotent → retry tạo duplicate. Dedup key. Worker crash giữa chừng → state machine cho long job.

6 · Multi-tenancy Patterns ★ critical Base.vn

Enforce: Middleware inject tenantId từ JWT. Postgres RLS làm safety net.

Pitfall: Admin query quên scope → leak. JOIN qua table khác tenant. Cache key thiếu tenant_id.

7 · REST API + JWT Auth

[Login]   POST /auth/login → access (15m, body) + refresh (7d, httpOnly cookie)
[Auth]    GET /tasks  Authorization: Bearer <access> → verify sig + exp
[Refresh] 401 → POST /auth/refresh (cookie auto-sent) → rotate

REST conventions: POST tạo · GET đọc · PUT replace · PATCH partial · DELETE. Status: 200/201/204 · 400 bad · 401 unauth · 403 forbidden · 404 not found · 409 conflict · 422 validation · 5xx.

Pitfall: JWT lưu localStorage → XSS đọc được. Không refresh rotation → hijack forever. Stack trace lộ secret trong error.

8 · Prisma ORM

// Transaction — atomic multi-table
await prisma.$transaction(async (tx) => {
  const order = await tx.order.create({ data: { userId, total } });
  await tx.stock.update({
    where: { productId },
    data: { quantity: { decrement: 1 } },
  });
  await tx.invoice.create({ data: { orderId: order.id } });
});

// Avoid N+1 — include / select
const tasks = await prisma.task.findMany({
  where: { tenantId },
  include: { assignee: true, comments: { take: 3 } },
}); // 1 query JOIN, không phải N

Pitfall: Quên include → N+1. Transaction dài → lock table. Migration conflict khi merge branch. Schema thay đổi nhưng quên regen client.