SM-Post Social Media Scheduler
SM-Post is a multi-tenant social-media posting and scheduling platform — the self-hostable core of a Buffer/Hootsuite-style product, delivered as a pnpm + Turborepo monorepo. Four apps: a Next.js 15 (App Router) + React 19 web client, a Fastify 5 API, a BullMQ worker, and a Playwright E2E suite; seven packages including a Prisma 6 data layer (33 models, 14 hand-authored migrations), a provider SDK, and an AES-256-GCM token vault. It runs on Postgres 17, Redis 7 and S3/MinIO. Nine real providers ship in the box — Bluesky, Mastodon and Telegram work out of the box, while LinkedIn, Facebook, Instagram, X, Pinterest and TikTok activate as soon as you supply your own platform-app credentials — plus a MockProvider whose content markers drive every branch of the publish state machine in tests and demos. The publishing engine is the differentiator: Postgres is the source of truth and BullMQ jobs are disposable, deterministically-named triggers, so you can flush Redis entirely and rebuild all queue state with one command. BullMQ is pinned to a single attempt and the application owns retry policy in the database (attemptCount / maxAttempts / nextRetryAt), because letting the queue retry would double-post; a maybe-sent outcome is never auto-retried and instead lands in an operator needs-review inbox, and a recorded success is never re-posted. Multi-tenancy is workspaces and projects with OWNER/ADMIN/MEMBER roles, hash-only email invitations, and an append-only audit stream. Per-project approvals bind an approval to a sha256 snapshot of the post content, media, per-provider overrides and targets — and the worker recomputes that hash immediately before fan-out, so an edited post can never ride an old approval. Stripe Checkout, the Billing Portal and a signed raw-body webhook back FREE/PRO/TEAM tiers with channel, post, member and project limits; omit the Stripe key and it drops into self-host mode with everything unlimited. Media uploads are presigned straight to S3/MinIO so bytes never transit the API, then content-sniffed with sharp on completion. Auth is passwordless magic-link (better-auth) with optional Google OIDC. Provider tokens live in an append-only encrypted vault — rows are inserted on refresh, never updated, and never stored on the channel row. Operationally it ships liveness and readiness probes, pino structured logs with secret redaction and request IDs, opt-in Sentry, Redis-backed rate limiting, Zod env schemas that fail fast at boot, and a production guard that refuses to start with dev secrets. Tests: 65 unit files, 19 integration suites against real Postgres/Redis/MinIO/Mailpit, and 5 Playwright journeys covering auth + tenancy, connect + publish, approvals, failure review, and billing limits. Ideal for founders launching a niche or vertical scheduling tool, agencies running client social calendars under one roof, teams that want first-party control of their social tokens instead of renting a SaaS seat, and developers who want a genuinely production-shaped queue, tenancy and OAuth codebase to learn from.