Rivvo
A full-stack messaging platform — direct and group chat, status posts, WebRTC voice and video, group key rotation, and a moderation console — over Express, MySQL and Socket.IO.
- 17
- Route groups
- 21
- Frontend pages
- 16
- Controllers
- P2P
- WebRTC calls
- Role
- Author
- Year
- 2026
- Type
- Messaging & calling platform
01Overview
Rivvo is a messaging platform built to see how much of a real chat product one person can carry end to end: registration and OTP verification, direct and group conversations, status posts, voice and video calls, contact graphs, reports and an admin moderation console.
The backend is Express over MySQL with Socket.IO for presence, typing and call signalling; the frontend is React 18 and Vite. In production the backend serves the built frontend, so the whole thing deploys as one process.
Seventeen route groups and sixteen controllers on the backend, twenty-one pages on the frontend. The interesting parts are not the message list — they are key distribution, moderation and the call layer.
02The problem
A chat app is the classic example of a project that looks small and is not. Sending a message is an afternoon. Everything around it — delivery state, read receipts, edits, view-once, blocking, group membership changes, key rotation when someone leaves, reporting, and an admin who can act on a report — is the actual system.
Group encryption metadata is where most hobby chat projects quietly give up. If a member leaves a group and the keys do not rotate, they can still read what follows. If keys rotate but are not redistributed, everyone else loses the conversation.
Moderation is the other half. A platform that accepts user-generated content without a report queue, a moderator role and an audit trail is not a product; it is a liability with a login page.
03Architecture
- 01
Transport split by shape
REST under /api for anything with a request and a response; Socket.IO for presence, typing indicators and WebRTC signalling. Calls themselves are peer-to-peer WebRTC — the server brokers the handshake and then gets out of the media path.
- 02
Group keys and rotation
Users carry public keys; groups distribute member keys and rotate them on membership change. The server stores key material and distribution state rather than plaintext, so leaving a group actually ends access rather than merely hiding the UI.
- 03
Message semantics beyond send
Edits, deletes, view-once, read receipts, pinning and muting, plus attachments validated by file signature rather than by extension — the same magic-bytes rule the rest of my work uses, because a renamed .exe is the oldest upload trick there is.
- 04
Moderation and admin
User and message reports, moderator assignment and resolution, verification badges and pricing, admin analytics, and audit logging that covers refresh-token events as well as admin actions.
- 05
Groups and communities
Public and private groups, invites and join requests, and three roles — owner, admin, member — with avatars and banners passing the same file checks as attachments.
04Key decisions
One deployable, two applications
The Express backend serves the Vite build in production. For a project at this stage a second static host and a CORS surface would be operational overhead bought with nothing.
WebRTC peer-to-peer, server only for signalling
Relaying media through the server would mean paying for bandwidth proportional to call minutes. Presence-based signalling over Socket.IO and then a direct peer connection keeps the server's cost proportional to users, not to how long they talk.
Audit refresh tokens, not just admin actions
Refresh-token events are the earliest visible signal of a stolen session. Logging them alongside admin actions means the audit trail can answer 'when did this account start behaving differently', not only 'who deleted what'.
Shipped honestly as unfinished
The repository description says it is still being built and learned from. Overselling an in-progress system is how a portfolio loses the benefit of the doubt on the projects that are finished.
05Stack
- React 18
- Vite
- TypeScript
- Node.js
- Express
- MySQL
- Socket.IO
- WebRTC
- JWT