Add user accounts to a message-based service
Give a Seneca system register, login and session-check messages with argon2id hashes, and keep the password out of every log line debug logging writes.
How-to › Section 14
The services behind an API: choosing an architecture, message-based services and pattern routing, entity persistence, providers for external APIs, and HTTP or edge exposure. Seneca is one option beside NestJS, Moleculer, tRPC, NATS, Temporal and Hono.
11 guides in 5 topics. Every guide compares its approaches and shows the output its commands printed.
Services where everything is a message: Seneca (actions by pattern, plugins and priors, transports and seneca-mesh, seneca-user, seneca-petition, structured message tracing, seneca-msg-test, seneca-doc, seneca-repl), @voxgig/system and create-system (services loaded by convention, model-driven CLI adding entity, srv, msg, field, env), and ordu for ordered task pipelines, against NestJS modules, Moleculer actions, tRPC routers, Fastify plus a message bus, NATS services and Temporal.
Give a Seneca system register, login and session-check messages with argon2id hashes, and keep the password out of every log line debug logging writes.
Stop a worker pulling more messages than it can process, so a burst waits at the broker where an operator can see it instead of inside your process.
Turn an improvised startup function into an ordered list of named steps that can stop the boot and say why, and pin readiness to the store actually being open.
Put each module of a Node monolith behind a Seneca message pattern, keep its exports as a facade so callers and tests stay put, and find shared tables first.
Dispatch by matching properties inside a service: patrun (most-specific match wins, trie keyed by sorted property names, gex globs, add, find, list, remove), bloomrun, router libraries, rules engines (json-rules-engine, Drools), decision tables (the decide utility) and plain switch or if chains, with benchmarks for your message mix.
Replace a switch on message.type with a Map of handlers, so that adding one is a registration call, unknown types reach a fallback, and prototype keys stay out.
Route messages in a Python worker with the match statement, using mapping and class patterns, guards, and a fallback, tested over a table of messages.
Entity data in services: seneca-entity and its store plugins (Postgres, Mongo, DynamoDB, seneca-d1-store on Cloudflare) against Prisma, Drizzle, TypeORM, Knex and raw drivers; the repository pattern, store-agnostic tests, migrations, multi-store setups.
Decide who mints an entity id, the service or the database, then choose a sequence, UUIDv4, UUIDv7, ULID, or nanoid by measuring index locality and order.
Bringing third-party APIs into a service system as providers: the seneca-provider pattern (seneca-dtone-provider, seneca-attachmentav-provider), generating a provider from a spec (the sdkgen seneca-provider target), credentials, retries and testing for providers against recorded fixtures, versus the adapter pattern, Nango and Merge unified APIs, and hand-written service clients.
Map every vendor status and error code onto five outcomes inside a Seneca provider, reply with a coded error, and log the vendor's own code beside it.
Replace each service's copy of a vendor client with one Seneca provider, moving callers through shadow reads until the legacy path's vendor calls reach zero.
HTTP and edge fronts for message services: seneca-gateway-* (including seneca-gateway-cloudflare) and seneca-web-adapter-express against Hono on Cloudflare Workers, Express and Fastify routers, API gateways (Kong, APISIX) and serverless adapters; auth at the gateway, running the same service locally and at the edge.
Verify tokens once at the gateway, strip the identity headers callers send, and sign what it forwards, so a hand-set x-user-id cannot promote anyone.
Write the HTTP front once in the fetch shape, give Node a twenty-line adapter, and run one request suite against both fronts and a stand-in that has no Node globals.
Retries, timeouts, pagination and auth are the same problems in every client. Voxgig generates them from your OpenAPI description, in 23 languages, from one model.
Since 2018, Richard Rodger has talked with developer advocates, event organizers, and the people who build developer-facing companies about the specifics of the work.