Under the Hood: Deep-Dive API, Infrastructure, and Security Updates

While our recent platform updates focused on front-end features and staff tools, we’ve also been quietly rebuilding, hardening, and expanding the core engines powering Omniplex and Popplio.

From major version releases (v1.0.0 through v1.3.1) to behind-the-scenes database migrations, here is a complete breakdown of every API extension, infrastructure refactor, and security fix deployed across the platform.

---

Core API Extensions & Entity System

• Multi-Type Entity Packs (pack_type): Packs are no longer restricted to bots. We added support for server and emoji packs backed by a new pack_emojis asset table, giving users durably hosted emoji collections.
• Server Certification & Premium Perks: Server listings now feature parity with bots. Servers can apply for certification (request_server_certification), purchase Premium perks, utilize vote blitz cooldowns, and display custom emojis/stickers directly on listing pages (show_emojis).
• Standalone Support Ticket API: Built a native, web-first ticket system running on pure HTTP endpoints (GET /tickets/topics, POST/GET /users/{id}/tickets, PATCH /tickets/{id}), replacing legacy Discord channel dependencies while generating snowflake-compatible timestamps.
• Unified Report System (popplio/reports): Launched a generic moderation submission endpoint (PUT /users/{uid}/{target_type}/{target_id}/reports) with daily per-user rate limits, anonymous reporting pipelines, and internal RPC management tools.
• Trending & Discovery Endpoints: Added ?sort=trending support to /bots/@all and /servers/@all (ranked by 7-day net votes), alongside GET /servers/@emojis for bulk emoji browsing.
• Expanded Stats & Transparency: Added GET /list/stats parameters (total_banned_users, total_vote_banned_bots, total_pending_bots, total_denied_bots) and public report statistics (GET /reports/stats).

---

Infrastructure, Bot Architecture & Performance

• Infernoplex Ported to Go: Merged the standalone Rust server-tracking bot into Popplio’s primary Go codebase (infernoplex/). It now manages server setup wizards, invite tracking, vote leaderboards, and background synchronization natively.
• In-House Proof-of-Work Vote Captcha: Replaced external third-party captcha dependencies with a custom, stateless, HMAC-signed hashcash challenge system (popplio/captcha) backed by Redis single-use verification.
• Concurrent Entity Resolution: Rewrote ResolveIndexBot and ResolveIndexServer to resolve page results concurrently using Go errgroup, removing sequential database latency across search and index feeds.
• Shared Gateway Proxy Routing: Migrated REST traffic across Popplio and Arcadia to route through the parent company proxy (https://gateway.nodebyte.host/proxy/discord) using distinct X-Upstream-Authorization headers.
• Atomic Redis Operations: Replaced non-atomic checks with SetNX for OAuth2 code redemption and fixed JSON serialization bugs on status caching layers.

---

Security Patches & Hierarchy Protections

• Bot Account Staff Hard-Gating (perms.ErrBotAccount): Bot accounts are explicitly blocked from holding staff permissions, rank lookups, or executing staff RPC actions across both database reads and live session checks.
• Staff Command Hierarchy Enforcement: Staff bot commands (/kick, /ban, /timeout, /warn) perform strict rank evaluation via perms.LoadStaff(...).Rank(), rejecting any attempt to act against equal or higher-ranking staff members.
• HMAC Webhook Signatures: Introduced standard hmac_auth payload signing (X-Webhook-Signature: sha256=<hex>), providing a cleaner verification alternative to double-HMAC Splashtail body encryption.
• Sanitized API Errors: Stripped raw internal Go error strings (error.Error()) from API responses, logging detailed stack traces server-side while presenting clean, sanitized messages to clients.

---

Database Migrations & Critical Bug Fixes

• Team Removal Safety Check: Corrected an inverted owner check in DELETE /teams/{tid}/members/{mid} that previously blocked standard member removals while allowing solitary team owners to accidentally abandon teams.
• Foreign Key Resync Order: Resolved crash loops in StaffResync by enforcing user record existence checks prior to attempting staff_members table inserts.
• Notification Persistence Inversion: Fixed PushNotification logic where NoSave inverted storage behavior, restoring persistent in-app notifications for perk redemptions and purchases.
• OpenAPI Security Definitions: Registered missing server and team auth schemes in OpenAPI specifications to fix schema generator crashes on developer documentation builds.
• Database Schema Alignments: Migrated servers.extra_links from text[] to jsonb, added foreign key constraints to support data export/deletion tasks, and normalized legacy ticket JSON arrays.