NewsHub - News Portal Web App

§ 01Challenge

Building NewsHub as a true microservices system introduced problems a monolithic app wouldn't face. With 7 independent services and no shared session store, every protected request needed a reliable way to verify identity without duplicating JWT secrets across services. Because each service owned its own isolated PostgreSQL database, relationships that would normally be simple foreign keys — a news article belonging to a category, a comment belonging to an article — couldn't be enforced at the database level, risking orphaned or invalid references. The admin dashboard added another layer of difficulty, since it needed live statistics (user count, news count, most-viewed article) pulled from three separate services without stacking up sequential request latency. On top of that, file uploads such as thumbnails and avatars had to be handled independently of the services that referenced them, and authorization had to be enforced consistently — both ownership rules (only the author can edit their own article) and role-based permissions (admin-only routes) — across both the frontend and backend.

§ 02Solution

To solve the authentication problem, a dedicated auth-service was built to issue JWTs, while every other service validated incoming requests through a custom middleware that introspected the token against auth-service's /me endpoint, centralizing trust without distributing secrets across the system. UUID primary keys were used instead of auto-increment IDs, generated independently within each service, which avoided ID collisions in a database-per-service architecture. To preserve data integrity without foreign keys, services performed synchronous cross-service validation — for example, news-service calling category-service to confirm a category exists before saving an article, or comment-service verifying the target article through news-service before accepting a comment. An API Gateway was implemented as the single client-facing entry point, routing around 40 endpoints to the correct downstream service, and for the admin dashboard specifically, a concurrent fan-out endpoint was built using Laravel's Http::pool to fetch news count, user count, and trending articles in parallel rather than sequentially. File handling was decoupled through a dedicated media pipeline, where uploads flow from the client through the gateway to media-service, which returns a public URL that other services simply reference. Finally, role-based access control was enforced in depth, combining route-level guards on the frontend with ownership and role checks on every mutating endpoint on the backend.