$ show SphericalKat/katbin
Katbin is a pastebin service (pastebin/paste.rs-style) built on Cloudflare Workers with Hono, D1 (SQLite) via Drizzle ORM, and a Vite + React frontend styled with Tailwind CSS. It supports paste creation with syntax highlighting (highlight.js), markdown rendering, raw paste access, and configurable expiration. The service includes usage analytics with documented visitor limits, differentiated rate limiting (missing raw pastes are limited separately from existing ones), and admin routes that enforce authentication before executing any queries. Deployment is fully automated via GitHub Actions with separate production and staging environments, including D1 migration management through wrangler. The codebase demonstrates strong engineering practices: type-safe database access, careful analytics implementation with explicit visitor limit documentation, and security-conscious route design. The test suite covers API error handling, analytics edge cases, and rate limiting behavior.
The LLM identified 4 files worth highlighting for reuse:
Usage metrics tracking module that filters non-content paths (/static, /admin, /health, /assets), documents visitor limits explicitly, and handles stale/unavailable metric states without fabricating zeros. Tests verify that daily visitor rows are never summed across days to estimate weekly/monthly uniques, and that bot traffic is counted as request activity (not human estimates). This is a genuinely reusable analytics pattern for any web service needing honest traffic measurement.
Differentiated rate limiting that treats missing raw pastes separately from existing resources, preventing attackers from probing for non-existent pastes while not penalizing legitimate users. The test 'rate limits missing raw pastes separately' verifies this behavior. This is a smart, non-obvious abuse-prevention pattern applicable to any content-addressed storage service.
Input validation utilities including IPv4 address validation (parts.length !== 4 || parts.some(part => !/^\d+$/.test(part))) and length constraints (max 160 chars for titles, max 80 for language/author fields). The validation is defensive and rejects malformed input with safe client errors rather than server errors, as verified by the test 'rejects non-JSON and invalid API requests with safe client errors'.
Type-safe database access patterns using Drizzle ORM's sql template literal for complex aggregations. Includes queue draining logic (if (once || (drain && summary.processed === 0)) return summary) for batch processing and replication error handling. Demonstrates clean patterns for serverless database access with proper error propagation.