Skip to content
L-04Journal / Field NotesEL +0.00 m

Blog

Backend engineering notes by Mohammed Mostafa on Node.js, TypeScript, Express.js, API architecture, message queues (BullMQ / Redis), authentication and payment-token security, and real-time systems (WebSockets, SSE, CRDTs) on AWS. Practical write-ups with code and diagrams from real projects like Lesoll, EgyStay, and SRVJ.

Distributed Systems

13 min read

CRDTs & Yjs in Production: The Day I Stopped Writing Conflict-Resolution Code

Why I stopped writing conflict-resolution code for SRVJ's collaborative diagrams — CRDTs from first principles (G-Counter, LWW-Register, OR-Set, sequence types), then Yjs and the authenticated WebSocket relay that keeps every editor converged.

CRDTYjsCollaborative EditingReal-TimeDistributed SystemsWebSocketTypeScriptNode.js

Backend Architecture

9 min read

Scaling Server-Sent Events with Redis Pub/Sub: SRVJ's Notifications

How SRVJ delivers real-time notifications with Server-Sent Events, BullMQ, Redis Pub/Sub, and PostgreSQL — a persist-then-fan-out pipeline that scales horizontally without sticky sessions.

SSEServer-Sent EventsReal-TimeBullMQRedisPostgreSQLNode.jsSystem Design

Payment Integration

12 min read

PayMob Webhooks in Node.js: HMAC, Idempotency & What the Docs Don't Cover

Months of integrating PayMob and Amazon Payment Services (PayFort) into a production marketplace, distilled — the provider adapter, the payment state machine, the verify-then-enqueue webhook pipeline, and the reconciliation job that catches everything else.

PaymentsPaymobAmazon Payment ServicesPayFortWebhooksBullMQNode.jsTypeScript

Backend Security

14 min read

PASETO vs JWT in Node.js: Choosing the Right Token for the Job

I shipped JWT in production, got burned, and switched to PASETO for auth and payments — but the real lesson is token taxonomy: signed vs encrypted vs opaque, and which job each one actually belongs to.

SecurityJWTPASETOAuthTokensNode.jsTypeScript