Any tips on implenting the lemmy api?

UlrikHD

I’ve been wanting to write a library for the lemmy API so that I can port some of my scripts over to elixir. For those unfamiliar with lemmy, it’s a FOSS project trying to mimic reddit.

Since I’ve only used elixir for a single project/5 months, I’d like to know if my idea for the library structure is sound.

My current plan is to use req as a dependency to take care of the network of communication. I’m leaning towards using a GenServer process to store the JSON Web Token for an account login, and then have all API calls on the format api_call(GenServer_PID, api_params...). The api_call will then make a GenServer call to retrieve the JWT before sending the request.

The advantage of this format is that you can easily juggle multiple accounts/processes in the same VM process if you want to wrap up and supervise multiple scripts in one process. The disadvantage is that all calls have to go through the GenServer process to retrieve the JWT, though I don’t think this is a realistic bottleneck.

I suppose my questions are:

Does it make sense to use a GenServer to simply store and potentially update the session token of an account.
Is there a different approach/convention that is typically used when implementing REST APIs in Elixir?
Are there any pitfalls I should be aware while writing the library?

4 comments

#library #rest_api #library-rfc

0 700 4

2025-08-05 13:56:06 UTC

Showing Posts 1 to 4

Show Best Posts
Show All (oldest first)
Show All (newest first)

dimitarvp

Why not use ETS with read concurrency?

Post #1

UlrikHD

Truth be told, I didn’t have any use for ETS in my last project so it wasn’t even on my mind. I’m also not sure if it provides any serious benefits (though maybe also no disadvantage either?). If retrieving a value from a GenServer becomes a bottleneck rather than the network calls, you’re likely spamming the lemmy instance server in a way you shouldn’t do. Though I suppose it could be argued that it isn’t the responsibility of the library to police that sort of behaviour.

Would you make any effort to protect the JWT from the other processes, or would it be redundant?

Post #2

dimitarvp

The BEAM VM has zero sandboxing abilities. One process running malicious code can extract a lot of information. It’s best that you don’t concern yourself with this; assume the code in your application is safe and do worry only about interacting with the external world. Using a secrets manager to inject the values that your application needs is also pretty much the accepted approach for years now.

Post #3

dimitarvp

RE:GenServer or not, I don’t base my API usage decisions on anticipated usage patterns; despite the huge skepticism of many, these usage patterns do change even in mature production codebases and then you’re left holding the bag.

So I wouldn’t use GenServer. Don’t use OTP mechanics unless you really have to.

Post #4

— All posts loaded —