JK
プロジェクト
JK
>読み込み中 // 読み込み中
ビューを初期化中
制作・デザイン:JK
JK
>読み込み中 // PROJECT DETAILS
PARSING ARCHITECTURE, DIAGRAMS & API ENDPOINTS
プロジェクト一覧に戻る
GitHubで見る
Express.js RESTful API バックエンド
完了typescriptnodejsexpressmongodbcloudinaryjwtdotenveslint

Express.js RESTful API バックエンド

モジュール式MVC設計、MongoDB集計パイプライン、強固な認証機構を備えた堅牢なREST APIバックエンド。

課題と解決策

体系的なエラーハンドリング、セキュリティヘッダー、自動テストを備えた再利用性の高い実用バックエンド基盤を構築すること。

機能

  • リフレッシュトークンローテーション付きJWT認証
  • ロールベース認可ミドルウェア
  • MongoDB集計（Aggregation）パイプラインの高速化
  • スキーマ検証と入力サニタイズ
  • JestとSupertestによる統合テストスイート

技術スタック

技術バージョン目的採用理由
Node.js—JavaScript runtimeNon-blocking I/O, large ecosystem
Express.js4.19.2HTTP frameworkMinimal, flexible, well-documented
TypeScript5.5.4Type safetyCompile-time error catching, IDE support
MongoDB—Document databaseFlexible schema, JSON-native, horizontal scaling
Mongoose8.5.3MongoDB ODMSchema validation, middleware, query building
JWT (jsonwebtoken)9.0.2Authentication tokensStateless auth, industry standard
bcrypt5.1.1Password hashingAdaptive hashing, salt rounds
Cloudinary2.4.0Image hosting/CDNManaged service, CDN, image transformations
Multer1.4.5-lts.1File upload handlingExpress-integrated, simple API

アーキテクチャ

Frontend Client

React :3000

Express App

app.ts :3000

CORS

express.json

JWT Auth Middleware

Global Error Handler

API Routes

/users, /admin, /restaurant, /menuitems, /orders

Controllers

User, Admin, Restaurant, Menu, Order

Mongoose Models

User, Admin, Restaurant, MenuItems, Order

MongoDB

localhost:27017/RMS

Cloudinary CDN

Local Filesystem

uploads
Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

Application Layers

  • Express.js middleware pipeline (CORS, JSON parsing, JWT auth)
  • Domain-based modular structure (users, adminUser, restaurant, orders)
  • Controllers with direct Mongoose access (no service layer abstraction)
  • Global error handler middleware with status code mapping

Infrastructure

  • MongoDB via Mongoose 8.5.3 for document storage
  • Cloudinary v2 for menu item image hosting and CDN
  • Multer for multipart file upload handling
  • JWT (jsonwebtoken) for stateless authentication

プロジェクト構成

src
adminUser
config
middlewares
orders
restaurant
users
app.tsExpress app setup, middleware, route mounting
server.tsApplication entry point, starts DB then server

APIエンドポイント

RMS API （ポート 3000）

メソッドルート目的
GET/Health check / welcome
POST/api/users/registerRegister new user
POST/api/users/loginLogin user
POST/api/admin/createAdminCreate admin user
POST/api/admin/adminloginLogin admin
POST/api/restaurant/createRestaurantRegister restaurant owner
POST/api/restaurant/ownerLoginLogin restaurant owner
POST/api/Menuitems/addItemsCreate menu item with image
PUT/api/Menuitems/:itemIdUpdate menu item
GET/api/Menuitems/getAllItemsList all menu items
GET/api/Menuitems/:itemIdGet single menu item
DELETE/api/Menuitems/:itemIdDelete menu item
POST/api/orders/createorderCreate order
POST/api/orders/cancelorder/:orderIdCancel order
GET/api/orders/orderdetails/:orderIdGet order details

データベース設計

users

4 cols
_idPK
ObjectId
name
String
email
String
password
String

admins

4 cols
_idPK
ObjectId
name
String
email
String
userType
String

restaurants

4 cols
_idPK
ObjectId
restaurantName
String
restaurantEmail
String
restaurantPhoneNo
Number

menuitems

5 cols
_idPK
ObjectId
restaurantId
ObjectId
itemName
String
itemPrice
Number
itemImage
String

orders

7 cols
_idPK
ObjectId
customerId
ObjectId
restaurantId
ObjectId
menuId
ObjectId
orderQuantity
Number
orderStatus
String
orderBill
Number
Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

users

カラム型備考
_idPKObjectIdAuto-generated
nameStringRequired
emailStringRequired, unique
passwordStringbcrypt hashed
createdAtDateAuto (timestamps: true)
updatedAtDateAuto (timestamps: true)

User accounts. Email is unique.

admins

カラム型備考
_idPKObjectIdAuto-generated
nameStringRequired
emailStringRequired, unique
passwordStringbcrypt hashed
userTypeStringenum: ['admin', 'user', 'restOwner']

Admin accounts. Separate collection from users.

restaurants

カラム型備考
_idPKObjectIdAuto-generated
restaurantEmailStringRequired
restaurantPwdStringbcrypt hashed
restaurantNameStringRequired
restaurantAddressStringRequired
restaurantPhoneNoNumberRequired, unique

Restaurant owner accounts.

menuitems

カラム型備考
_idPKObjectIdAuto-generated
restaurantIdObjectIdNo ref defined — .populate() won't work
itemNameStringHas typo: require instead of required
itemDescriptionStringHas typo: require instead of required
itemPriceNumberHas typo: require instead of required
itemImageStringCloudinary URL

Menu items per restaurant. restaurantId lacks ref property — schema bug.

orders

カラム型備考
_idPKObjectIdAuto-generated
customerIdObjectIdref: User
restaurantIdObjectIdref: restaurant
menuIdObjectIdref: MenuItems
orderQuantityNumberNo validation for positive values
orderDateDateDefault: Date.now
orderStatusStringenum: ['in process', 'transit', 'cancelled', 'delivered']
orderBillNumberClient-supplied — security concern

Orders are client-supplied bill amounts — no server-side price calculation.

One-to-Many: Users→Orders, Restaurants→MenuItems, Restaurants→Orders, MenuItems→Orders. All via ObjectId references. No many-to-many relationships. menuitems.restaurantId lacks ref property.

主要な設計判断

Modular Monolith Architecture

判断: Single Express.js application with domain-based folder structure

理由: Appropriate for project scale (~15 endpoints, single deployment)

利点: Simple deployment, easy debugging, low operational overhead, clear domain ownership

トレードオフ: Cannot scale domains independently, all modules share process, no service layer for reuse

JWT for Authentication

判断: Stateless JWT tokens with Authorization: Bearer header

理由: Standard for REST APIs, no session storage needed

利点: Stateless, no server-side session store, scales horizontally

トレードオフ: No server-side revocation, tokens valid until expiry even if user is deleted

No Service Layer

判断: Business logic resides directly in controllers

理由: Simplicity for small project, fewer files to navigate

利点: Fast development, fewer abstractions

トレードオフ: Untestable business logic, code duplication across auth controllers, hard to reuse logic

Cloudinary for Image Storage

判断: Menu item images uploaded to Cloudinary CDN

理由: Managed service avoids S3/MinIO setup, provides CDN and image transformations

利点: No infrastructure to manage, built-in CDN, free tier available

トレードオフ: Vendor lock-in, external dependency, cost at scale, latency for non-CDN regions

Client-Supplied Order Bill

判断: orderBill is sent by the client, not calculated server-side

理由: Likely intentional simplification for MVP

利点: Simpler server logic

トレードオフ: Critical security vulnerability — clients can manipulate order amounts

No Request Validation Library

判断: Manual if (!field) validation instead of Zod/Joi

理由: Simplicity, fewer dependencies

利点: No additional dependency, explicit control

トレードオフ: Inconsistent validation, no type inference from schemas, generic error messages

テスト

None installed•ユニットテスト 0 件

テスト内容

    不足しているカバレッジ

    • No test framework installed (no jest, mocha, vitest)
    • No test files or test directories
    • No unit tests for controllers or middleware
    • No integration tests for API endpoints
    • No authentication flow tests
    • No database operation tests

    主な課題

    • 安全かつ高速な認証ミドルウェアとレート制限の実装
    • 全エンドポイントにおけるエラーレスポンス形式の統一

    学んだこと

    • Express環境でのクリーンなMVCアーキテクチャ設計
    • NoSQLデータベースにおけるインデックス最適化