Exchange Accounts & Q&A Architecture
Exchange Accounts & Q&A Architecture
Section titled “Exchange Accounts & Q&A Architecture”DigiEmu Exchange adds a small dynamic application layer to the otherwise static developer portal.
Architecture
Section titled “Architecture”Static portal
Astro and Starlight continue to build the documentation pages.
Dynamic API
Cloudflare Pages Functions handle authentication, sessions, profiles, questions, and answers under /api/.
Database
Cloudflare D1 stores Exchange users, hashed session identifiers, questions, answers, and tags.
Authentication
GitHub OAuth is used for sign-in. The first successful sign-in creates the local Exchange account.
The implementation stores the GitHub user identifier, login, display name, avatar URL, and an optional DigiEmu profile biography. It does not need to persist the GitHub OAuth access token after the identity lookup.
Session model
Section titled “Session model”The browser receives a random opaque session token in an HttpOnly cookie.
Only a SHA-256 hash of that token is stored in D1. Sessions expire after 30 days.
Publishing model
Section titled “Publishing model”Questions and answers are plain text in v1. The browser renders community content through DOM text nodes rather than interpreting user input as HTML.
Authenticated write requests require a same-origin request and are subject to simple per-user posting limits.
Controlled-beta gate
Section titled “Controlled-beta gate”Question and answer creation can be disabled globally with the EXCHANGE_WRITES_ENABLED environment variable.
This allows authentication and read paths to be tested before public posting is enabled.
Deliberate v1 limits
Section titled “Deliberate v1 limits”Accounts & Q&A v1 does not yet provide:
- email/password authentication;
- private messaging;
- reputation or voting;
- rich-text or Markdown rendering of user content;
- edit/delete UI for community posts;
- production claims about availability or scale.
Those capabilities should be added only with corresponding operational and moderation controls.
Moderation extension
Section titled “Moderation extension”Exchange Moderation & Admin v1 adds authenticated reports, a server-enforced admin role, hide/restore controls for questions and answers, report resolution, and append-only moderation-event records through the application API.
The admin dashboard is not the authorization boundary. Every moderation action is checked again by the server-side API.