My Chat Buddy Server

My Chat Buddy Server lets a business upload its own content and expose a controlled AI assistant through APIs or a hosted website widget. The assistant is designed to answer from business-provided documents, track usage, and capture verified leads when the assistant flow is enabled.

• Customers create isolated projects with their own API keys and model settings.
• Visitors get fast answers from uploaded business knowledge.
• Developers integrate through REST endpoints or GET /widget.js.
• When useful context is missing, the assistant should return I don't know.

• Fastify TypeScript API server with PostgreSQL, Drizzle ORM, Chroma, and Docker support.
• Dashboard registration, login, email OTP verification, refresh token rotation, and roles.
• Project CRUD, API key rotation, widget snippets, integration helpers, and token limits.
• Document upload, chunking, embeddings, Chroma indexing, reindexing, and deletion.
• RAG chat with hybrid reranking, conversation history, token tracking, and sources.
• Assistant lead capture with name, email, OTP verification, and per-lead message limits.
• Usage and analytics endpoints for documents, conversations, messages, endpoints, and recent usage.

Website / frontend
  -> Fastify route
  -> auth or API key middleware
  -> controller validation
  -> service logic
  -> PostgreSQL / Chroma / AI provider
  -> response

Document upload
  -> store document in PostgreSQL
  -> chunk text
  -> create embeddings
  -> store vectors in Chroma
  -> store chunk metadata in PostgreSQL

User chat
  -> embed question
  -> retrieve matching chunks from Chroma
  -> hybrid rerank
  -> build prompt from retrieved context
  -> call selected AI provider
  -> save conversation and usage

The backend separates dashboard identity, project configuration, knowledge storage, chat history, usage, and assistant lead state.

Dashboard endpoints use bearer tokens.

Authorization: Bearer <accessToken>

Projects are tenant boundaries. The full API key is returned only when a project is created or rotated; the database stores the hashed key and a visible prefix.

POST /projects
Authorization: Bearer <accessToken>
Content-Type: application/json

{
  "name": "Acme Support Bot",
  "modelProvider": "groq",
  "tokenLimit": 100000,
  "modelConfig": {
    "model": "llama-3.1-8b-instant",
    "temperature": 0.2,
    "assistantMessageLimit": 5
  }
}

Runtime document APIs use the project API key.

x-api-key: <project-api-key>

POST /upload-doc
x-api-key: <project-api-key>
Content-Type: application/json

{
  "content": "Your product docs, FAQ, pricing, policy, or support content.",
  "metadata": {
    "source": "pricing-page",
    "category": "pricing"
  }
}

The chat endpoint validates the project key, enforces rate and token limits, retrieves relevant chunks, reranks them, calls the selected model provider, stores messages, and returns usage plus sources.

POST /chat
x-api-key: <project-api-key>
Content-Type: application/json

{
  "message": "What is your refund policy?",
  "conversationId": "optional-existing-conversation-id"
}

Older conversation messages can be summarized before model calls, while recent history is kept for follow-up questions.

The assistant flow is for business websites that want lead capture before normal chat. It asks for name, asks for email, validates the email, sends OTP, verifies the lead, then unlocks project chat with a message limit.

POST /assistant/chat
x-api-key: <project-api-key>
Content-Type: application/json

{}

POST /assistant/verify-otp
x-api-key: <project-api-key>
Content-Type: application/json

{
  "sessionId": "<sessionId>",
  "otp": "123456"
}

Usage is stored in usage_logs and total tokens used are updated on the project. Analytics can include document count, conversation count, message count, endpoint usage, and recent daily usage.

GET /usage
GET /analytics
GET /debug/provider-health  # non-production only

The backend serves a hosted widget script at GET /widget.js. A customer can paste the snippet into a website and configure title, color, position, welcome text, API URL, and project API key.

<script
  src="http://localhost:5000/widget.js"
  data-api-url="http://localhost:5000"
  data-api-key="YOUR_PROJECT_API_KEY"
  data-title="My Project Assistant"
  data-primary-color="#0f766e"
  data-position="right"
  data-welcome="Ask me anything about this project."
></script>

Create the environment file, start local dependencies, install packages, migrate, and run the server.

PORT=5000
APP_BASE_URL=http://localhost:5000
FRONTEND_ORIGIN=http://localhost:3000
AUTH_SECRET=change-me-in-production
ACCESS_SECRET=change-me-in-production
REFRESH_SECRET=change-me-in-production
DB_URL=postgres://postgres:postgres@localhost:5432/chat
CHROMA_URL=http://localhost:8000
CHROMA_TENANT=default_tenant
CHROMA_DATABASE=default_database
OLLAMA_BASE_URL=http://localhost:11434
GROQ_API_KEY=
OPENAI_API_KEY=
GEMINI_API_KEY=
RESEND_API_KEY=
RESEND_FROM_EMAIL=

docker compose up -d
npm install
npm run push
npm run dev

1. Register a dashboard user with POST /auth/register.
2. Verify the OTP with POST /auth/verify-otp.
3. Create a project and store the returned API key securely.
4. Upload training content with POST /upload-doc.
5. Test grounded answers with POST /chat.
6. Add the widget script to the customer website.

Customers should understand what to upload, how to create projects, how API keys work, and how to review conversations and analytics.

• Upload FAQs, pricing, policies, product docs, support docs, and website content.
• Rotate an API key immediately if it is exposed.
• Expect the assistant to say I don't know when uploaded context is not enough.
• Use analytics and conversations to improve training content.

Website visitors should know the assistant answers using business-provided content, may ask for name and email, may require OTP in lead-capture mode, has message limits, and should not be used for sensitive account-specific requests.

• Dashboard pages for leads, CSV export, CRM sync, source citations, and train-bot flows.
• Better parsers for PDF, DOCX, HTML, CSV, sitemap crawling, and URL crawling.
• Custom system prompts, branding, team roles, billing, and multi-language support.
• Retrieval evaluation tests, confidence scores, reranking providers, and document enable or disable status.
• Password reset, audit logs, API key scopes, domain allowlists, and encrypted provider keys.
• OpenAPI schema, Postman or Bruno collection, seed script, structured logs, and error catalog.

• No automated test suite is currently implemented.
• Rate limiting is in-memory and is not ideal for multi-instance production deployments.
• Local fallback embeddings are low quality and should be replaced with setup warnings or errors in production.
• Widget UI is basic and can be improved.
• Provider API key storage should be hardened before production.
• Assistant OTP resend, lead list/export APIs, billing, and subscriptions are not yet present.
• Production deployment requires careful PostgreSQL, Chroma, email, and AI provider configuration.

Short pitch: My Chat Buddy turns business documents into a controlled website assistant with APIs, widget delivery, verified leads, usage tracking, and isolated project knowledge bases.