Core Backend Services

Relevant source files

The following files were used as context for generating this wiki page:

• server/_core/index.ts
• server/_core/oauth.ts
• server/_core/sdk.ts
• server/_core/llm.ts
• server/storage.ts
• drizzle/schema.ts
• package.json

The core backend services for the aidoit4u-mobile-app are built using Node.js with an Express server. This backend is responsible for handling user authentication via Manus OAuth, managing user data in a MySQL database using Drizzle ORM, and proxying requests to external services, including a Large Language Model (LLM) and a file storage system.

The server exposes a set of RESTful API endpoints for authentication and session management, which are consumed by both the web and native mobile clients. It is designed to be run in both development and production environments, with configuration managed through environment variables.

System Architecture

The backend is a monolithic service that orchestrates several key functions. It initializes an Express application, configures middleware, and registers routes for authentication and other potential tRPC procedures (though no tRPC routers are defined in the provided context).

Server Initialization

The server entry point is server/_core/index.ts. It sets up an Express server, applies necessary middleware like cors and express.json, and registers the OAuth routes. The server listens on a port defined by the PORT environment variable, defaulting to 3000.

The following diagram illustrates the server startup process.

Authentication and Session Management

Authentication is handled via Manus OAuth 2.0. The backend provides callback endpoints to handle the authorization code grant flow for both web and mobile clients. It uses the jose library for creating and verifying JWT-based session tokens.

Sources: server/_core/oauth.ts, server/_core/sdk.ts

User Data Model

User information is persisted in a MySQL database. The schema is defined using Drizzle ORM and includes a single users table.

The table below details the columns in the users table.

Column	Type	Constraints	Description
id	int	PRIMARY KEY, AUTO_INCREMENT	Surrogate primary key.
openId	varchar(64)	NOT NULL, UNIQUE	Manus OAuth identifier.
name	text	NULL	User's name.
email	varchar(320)	NULL	User's email address.
loginMethod	varchar(64)	NULL	The method used for login (e.g., google, email).
role	enum('user', 'admin')	NOT NULL, DEFAULT 'user'	User role.
createdAt	timestamp	NOT NULL, DEFAULT NOW()	Timestamp of record creation.
updatedAt	timestamp	NOT NULL, DEFAULT NOW(), ON UPDATE NOW()	Timestamp of the last update.
lastSignedIn	timestamp	NOT NULL, DEFAULT NOW()	Timestamp of the last sign-in.
Sources: drizzle/schema.ts:6-25

Authentication Flows

The system supports two distinct OAuth callback flows: one for web clients and one for native mobile clients.

Web OAuth Flow (/api/oauth/callback)

This flow is designed for web applications. After the user authenticates with Manus, the browser is redirected to this endpoint. The server exchanges the authorization code for an access token, retrieves user info, syncs the user to the local database, creates a session token (JWT), and sets it as an HTTP-only cookie. Finally, it redirects the user back to the frontend application.

Mobile OAuth Flow (/api/oauth/mobile)

This flow is for native mobile apps. The mobile app opens a web browser for authentication and receives the authorization code. It then sends this code to the /api/oauth/mobile endpoint. The server performs the same token exchange and user sync process as the web flow but responds with a JSON payload containing the session token (app_session_id) and user details, instead of setting a cookie and redirecting.

API Endpoints

The backend exposes several REST endpoints for authentication and session management.

Method	Endpoint	Description
GET	/api/oauth/callback	Handles the OAuth callback for web clients.
GET	/api/oauth/mobile	Handles the OAuth code exchange for mobile clients.
POST	/api/auth/logout	Clears the session cookie to log the user out.
GET	/api/auth/me	Retrieves the current authenticated user's information. Authenticates via cookie or Bearer token.
POST	/api/auth/session	Establishes a session cookie from a provided Bearer token. Used for iframe previews.
Sources: server/_core/oauth.ts:65-163

External Service Integrations

The backend acts as a secure proxy for interacting with external services, such as an LLM and a file storage provider.

LLM Service

The invokeLLM function provides a standardized interface to communicate with a Large Language Model via the Forge API (https://forge.manus.im/v1/chat/completions). It handles message normalization, tool choice processing, and response format configuration.

The function constructs a payload for the gemini-2.5-flash model, including messages, tools, and other parameters. It requires the FORGE_API_KEY (or OPENAI_API_KEY) environment variable for authorization.

Storage Service

The storage.ts module provides helpers (storagePut, storageGet) to interact with a Biz-provided storage proxy. This service is used for uploading and retrieving files. Configuration requires BUILT_IN_FORGE_API_URL and BUILT_IN_FORGE_API_KEY environment variables.

File Upload (storagePut)

The storagePut function uploads data (Buffer, string, etc.) to the storage service. It constructs a FormData object and sends a POST request to the /v1/storage/upload endpoint of the proxy.

File Download URL (storageGet)

The storageGet function retrieves a publicly accessible download URL for a given file key. It makes a GET request to the /v1/storage/downloadUrl endpoint, which returns a signed URL for the client to use.

Sources: server/storage.ts:74-81, server/storage.ts:22-30

Summary

The Core Backend Services provide the essential server-side logic for the aidoit4u-mobile-app. It acts as a secure and centralized hub for managing user identity through Manus OAuth, persisting user data, and interfacing with critical external AI and storage services. Its architecture clearly separates concerns, with dedicated modules for authentication, database interaction, and external API proxying, making it a foundational component of the application.