JK
>ΦΟΡΤΩΣΗ // ΦΟΡΤΩΣΗ
ΑΡΧΙΚΟΠΟΙΗΣΗ ΠΡΟΒΟΛΗΣ
Ολοκληρώθηκεtypescriptnodejsexpressmongodbcloudinaryjwtdotenveslint
Express.js RESTful API Backend
Έτοιμο για παραγωγή REST API με αρθρωτή αρχιτεκτονική MVC και ασφαλή πιστοποίηση.
Πρόβλημα & Λύση
Δημιουργία αξιόπιστης δομής με κεντρική διαχείριση σφαλμάτων και αυτοματοποιημένους ελέγχους.
Χαρακτηριστικά
- Πιστοποίηση JWT με εναλλαγή refresh tokens
- Middleware εξουσιοδότησης βάσει ρόλων
- Βελτιστοποίηση αγωγών συγκέντρωσης στη MongoDB
- Επικύρωση εισόδου και ασφάλεια δεδομένων
- Σουίτα δοκιμών ολοκλήρωσης με Jest
Τεχνολογικό stack
| Τεχνολογία | Έκδοση | Σκοπός | Γιατί επιλέχθηκε |
|---|---|---|---|
| Node.js | — | JavaScript runtime | Non-blocking I/O, large ecosystem |
| Express.js | 4.19.2 | HTTP framework | Minimal, flexible, well-documented |
| TypeScript | 5.5.4 | Type safety | Compile-time error catching, IDE support |
| MongoDB | — | Document database | Flexible schema, JSON-native, horizontal scaling |
| Mongoose | 8.5.3 | MongoDB ODM | Schema validation, middleware, query building |
| JWT (jsonwebtoken) | 9.0.2 | Authentication tokens | Stateless auth, industry standard |
| bcrypt | 5.1.1 | Password hashing | Adaptive hashing, salt rounds |
| Cloudinary | 2.4.0 | Image hosting/CDN | Managed service, CDN, image transformations |
| Multer | 1.4.5-lts.1 | File upload handling | Express-integrated, simple API |
Αρχιτεκτονική
Application Layers
- Express.js middleware pipeline (CORS, JSON parsing, JWT auth)
- Domain-based modular structure (users, adminUser, restaurant, orders)
- Controllers with direct Mongoose access (no service layer abstraction)
- Global error handler middleware with status code mapping
Infrastructure
- MongoDB via Mongoose 8.5.3 for document storage
- Cloudinary v2 for menu item image hosting and CDN
- Multer for multipart file upload handling
- JWT (jsonwebtoken) for stateless authentication
Δομή έργου
src
adminUser
config
middlewares
orders
restaurant
users
app.ts
server.ts
API endpoints
RMS API (θύρα 3000)
| Μέθοδος | Διαδρομή | Σκοπός |
|---|---|---|
| GET | / | Health check / welcome |
| POST | /api/users/register | Register new user |
| POST | /api/users/login | Login user |
| POST | /api/admin/createAdmin | Create admin user |
| POST | /api/admin/adminlogin | Login admin |
| POST | /api/restaurant/createRestaurant | Register restaurant owner |
| POST | /api/restaurant/ownerLogin | Login restaurant owner |
| POST | /api/Menuitems/addItems | Create menu item with image |
| PUT | /api/Menuitems/:itemId | Update menu item |
| GET | /api/Menuitems/getAllItems | List all menu items |
| GET | /api/Menuitems/:itemId | Get single menu item |
| DELETE | /api/Menuitems/:itemId | Delete menu item |
| POST | /api/orders/createorder | Create order |
| POST | /api/orders/cancelorder/:orderId | Cancel order |
| GET | /api/orders/orderdetails/:orderId | Get order details |
Σχεδιασμός βάσης δεδομένων
users
| Στήλη | Τύπος | Σημειώσεις |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| name | String | Required |
| String | Required, unique | |
| password | String | bcrypt hashed |
| createdAt | Date | Auto (timestamps: true) |
| updatedAt | Date | Auto (timestamps: true) |
User accounts. Email is unique.
admins
| Στήλη | Τύπος | Σημειώσεις |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| name | String | Required |
| String | Required, unique | |
| password | String | bcrypt hashed |
| userType | String | enum: ['admin', 'user', 'restOwner'] |
Admin accounts. Separate collection from users.
restaurants
| Στήλη | Τύπος | Σημειώσεις |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| restaurantEmail | String | Required |
| restaurantPwd | String | bcrypt hashed |
| restaurantName | String | Required |
| restaurantAddress | String | Required |
| restaurantPhoneNo | Number | Required, unique |
Restaurant owner accounts.
menuitems
| Στήλη | Τύπος | Σημειώσεις |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| restaurantId | ObjectId | No ref defined — .populate() won't work |
| itemName | String | Has typo: require instead of required |
| itemDescription | String | Has typo: require instead of required |
| itemPrice | Number | Has typo: require instead of required |
| itemImage | String | Cloudinary URL |
Menu items per restaurant. restaurantId lacks ref property — schema bug.
orders
| Στήλη | Τύπος | Σημειώσεις |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| customerId | ObjectId | ref: User |
| restaurantId | ObjectId | ref: restaurant |
| menuId | ObjectId | ref: MenuItems |
| orderQuantity | Number | No validation for positive values |
| orderDate | Date | Default: Date.now |
| orderStatus | String | enum: ['in process', 'transit', 'cancelled', 'delivered'] |
| orderBill | Number | Client-supplied — security concern |
Orders are client-supplied bill amounts — no server-side price calculation.
One-to-Many: Users→Orders, Restaurants→MenuItems, Restaurants→Orders, MenuItems→Orders. All via ObjectId references. No many-to-many relationships. menuitems.restaurantId lacks ref property.
Βασικές σχεδιαστικές αποφάσεις
Modular Monolith Architecture
Απόφαση: Single Express.js application with domain-based folder structure
Λόγος: Appropriate for project scale (~15 endpoints, single deployment)
Οφέλη: Simple deployment, easy debugging, low operational overhead, clear domain ownership
Ανταλλάγματα: Cannot scale domains independently, all modules share process, no service layer for reuse
JWT for Authentication
Απόφαση: Stateless JWT tokens with Authorization: Bearer header
Λόγος: Standard for REST APIs, no session storage needed
Οφέλη: Stateless, no server-side session store, scales horizontally
Ανταλλάγματα: No server-side revocation, tokens valid until expiry even if user is deleted
No Service Layer
Απόφαση: Business logic resides directly in controllers
Λόγος: Simplicity for small project, fewer files to navigate
Οφέλη: Fast development, fewer abstractions
Ανταλλάγματα: Untestable business logic, code duplication across auth controllers, hard to reuse logic
Cloudinary for Image Storage
Απόφαση: Menu item images uploaded to Cloudinary CDN
Λόγος: Managed service avoids S3/MinIO setup, provides CDN and image transformations
Οφέλη: No infrastructure to manage, built-in CDN, free tier available
Ανταλλάγματα: Vendor lock-in, external dependency, cost at scale, latency for non-CDN regions
Client-Supplied Order Bill
Απόφαση: orderBill is sent by the client, not calculated server-side
Λόγος: Likely intentional simplification for MVP
Οφέλη: Simpler server logic
Ανταλλάγματα: Critical security vulnerability — clients can manipulate order amounts
No Request Validation Library
Απόφαση: Manual if (!field) validation instead of Zod/Joi
Λόγος: Simplicity, fewer dependencies
Οφέλη: No additional dependency, explicit control
Ανταλλάγματα: Inconsistent validation, no type inference from schemas, generic error messages
Δοκιμές
None installed•0 μονάδες δοκιμών
Τι δοκιμάζεται
Κενά κάλυψης
- No test framework installed (no jest, mocha, vitest)
- No test files or test directories
- No unit tests for controllers or middleware
- No integration tests for API endpoints
- No authentication flow tests
- No database operation tests
Βασικές προκλήσεις
- Σχεδιασμός αποδοτικού middleware για ασφάλεια και rate limiting
- Ενιαία δομή απαντήσεων σφαλμάτων σε όλα τα endpoints
Βασικά διδάγματα
- Καθαρή αρχιτεκτονική MVC σε περιβάλλον Node.js
- Προηγμένες τεχνικές ευρετηρίασης στη MongoDB