JK
>LADDAR // LADDAR
INITIERAR VY
Slutförttypescriptnodejsexpressmongodbcloudinaryjwtdotenveslint
Express.js RESTful API Backend
Produktionsklar REST API-backend med modulär MVC-arkitektur och optimerade MongoDB-aggregeringar.
Problem och lösning
Skapa en stabil och återanvändbar backend-grund med enhetlig felhantering och automatiska tester.
Funktioner
- JWT-autentisering med rotation av refresh-tokens
- Rollbaserad auktoriseringsmiddleware
- Optimerade aggregeringspipelines i MongoDB
- Strikt indatavalidering och sanering
- Integrationstester med Jest och Supertest
Teknikstack
| Teknik | Version | Syfte | Varför vald |
|---|---|---|---|
| Node.js | — | JavaScript runtime | Non-blocking I/O, large ecosystem |
| Express.js | 4.19.2 | HTTP framework | Minimal, flexible, well-documented |
| TypeScript | 5.5.4 | Type safety | Compile-time error catching, IDE support |
| MongoDB | — | Document database | Flexible schema, JSON-native, horizontal scaling |
| Mongoose | 8.5.3 | MongoDB ODM | Schema validation, middleware, query building |
| JWT (jsonwebtoken) | 9.0.2 | Authentication tokens | Stateless auth, industry standard |
| bcrypt | 5.1.1 | Password hashing | Adaptive hashing, salt rounds |
| Cloudinary | 2.4.0 | Image hosting/CDN | Managed service, CDN, image transformations |
| Multer | 1.4.5-lts.1 | File upload handling | Express-integrated, simple API |
Arkitektur
Application Layers
- Express.js middleware pipeline (CORS, JSON parsing, JWT auth)
- Domain-based modular structure (users, adminUser, restaurant, orders)
- Controllers with direct Mongoose access (no service layer abstraction)
- Global error handler middleware with status code mapping
Infrastructure
- MongoDB via Mongoose 8.5.3 for document storage
- Cloudinary v2 for menu item image hosting and CDN
- Multer for multipart file upload handling
- JWT (jsonwebtoken) for stateless authentication
Projektstruktur
src
adminUser
config
middlewares
orders
restaurant
users
app.ts
server.ts
API-slutpunkter
RMS API (port 3000)
| Metod | Rutt | Syfte |
|---|---|---|
| GET | / | Health check / welcome |
| POST | /api/users/register | Register new user |
| POST | /api/users/login | Login user |
| POST | /api/admin/createAdmin | Create admin user |
| POST | /api/admin/adminlogin | Login admin |
| POST | /api/restaurant/createRestaurant | Register restaurant owner |
| POST | /api/restaurant/ownerLogin | Login restaurant owner |
| POST | /api/Menuitems/addItems | Create menu item with image |
| PUT | /api/Menuitems/:itemId | Update menu item |
| GET | /api/Menuitems/getAllItems | List all menu items |
| GET | /api/Menuitems/:itemId | Get single menu item |
| DELETE | /api/Menuitems/:itemId | Delete menu item |
| POST | /api/orders/createorder | Create order |
| POST | /api/orders/cancelorder/:orderId | Cancel order |
| GET | /api/orders/orderdetails/:orderId | Get order details |
Databasdesign
users
| Kolumn | Typ | Anteckningar |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| name | String | Required |
| String | Required, unique | |
| password | String | bcrypt hashed |
| createdAt | Date | Auto (timestamps: true) |
| updatedAt | Date | Auto (timestamps: true) |
User accounts. Email is unique.
admins
| Kolumn | Typ | Anteckningar |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| name | String | Required |
| String | Required, unique | |
| password | String | bcrypt hashed |
| userType | String | enum: ['admin', 'user', 'restOwner'] |
Admin accounts. Separate collection from users.
restaurants
| Kolumn | Typ | Anteckningar |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| restaurantEmail | String | Required |
| restaurantPwd | String | bcrypt hashed |
| restaurantName | String | Required |
| restaurantAddress | String | Required |
| restaurantPhoneNo | Number | Required, unique |
Restaurant owner accounts.
menuitems
| Kolumn | Typ | Anteckningar |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| restaurantId | ObjectId | No ref defined — .populate() won't work |
| itemName | String | Has typo: require instead of required |
| itemDescription | String | Has typo: require instead of required |
| itemPrice | Number | Has typo: require instead of required |
| itemImage | String | Cloudinary URL |
Menu items per restaurant. restaurantId lacks ref property — schema bug.
orders
| Kolumn | Typ | Anteckningar |
|---|---|---|
| _idPK | ObjectId | Auto-generated |
| customerId | ObjectId | ref: User |
| restaurantId | ObjectId | ref: restaurant |
| menuId | ObjectId | ref: MenuItems |
| orderQuantity | Number | No validation for positive values |
| orderDate | Date | Default: Date.now |
| orderStatus | String | enum: ['in process', 'transit', 'cancelled', 'delivered'] |
| orderBill | Number | Client-supplied — security concern |
Orders are client-supplied bill amounts — no server-side price calculation.
One-to-Many: Users→Orders, Restaurants→MenuItems, Restaurants→Orders, MenuItems→Orders. All via ObjectId references. No many-to-many relationships. menuitems.restaurantId lacks ref property.
Viktiga designbeslut
Modular Monolith Architecture
Beslut: Single Express.js application with domain-based folder structure
Varför: Appropriate for project scale (~15 endpoints, single deployment)
Fördelar: Simple deployment, easy debugging, low operational overhead, clear domain ownership
Avvägningar: Cannot scale domains independently, all modules share process, no service layer for reuse
JWT for Authentication
Beslut: Stateless JWT tokens with Authorization: Bearer header
Varför: Standard for REST APIs, no session storage needed
Fördelar: Stateless, no server-side session store, scales horizontally
Avvägningar: No server-side revocation, tokens valid until expiry even if user is deleted
No Service Layer
Beslut: Business logic resides directly in controllers
Varför: Simplicity for small project, fewer files to navigate
Fördelar: Fast development, fewer abstractions
Avvägningar: Untestable business logic, code duplication across auth controllers, hard to reuse logic
Cloudinary for Image Storage
Beslut: Menu item images uploaded to Cloudinary CDN
Varför: Managed service avoids S3/MinIO setup, provides CDN and image transformations
Fördelar: No infrastructure to manage, built-in CDN, free tier available
Avvägningar: Vendor lock-in, external dependency, cost at scale, latency for non-CDN regions
Client-Supplied Order Bill
Beslut: orderBill is sent by the client, not calculated server-side
Varför: Likely intentional simplification for MVP
Fördelar: Simpler server logic
Avvägningar: Critical security vulnerability — clients can manipulate order amounts
No Request Validation Library
Beslut: Manual if (!field) validation instead of Zod/Joi
Varför: Simplicity, fewer dependencies
Fördelar: No additional dependency, explicit control
Avvägningar: Inconsistent validation, no type inference from schemas, generic error messages
Tester
None installed•0 enhetstester
Vad som testas
Saknad täckning
- No test framework installed (no jest, mocha, vitest)
- No test files or test directories
- No unit tests for controllers or middleware
- No integration tests for API endpoints
- No authentication flow tests
- No database operation tests
Viktiga utmaningar
- Image upload lifecycle management — temp files, Cloudinary upload, cleanup on error
- Ownership verification without foreign keys — menuitems.restaurantId lacks ref property
- Multi-role authentication with three separate entity types (User, Admin, Restaurant)
- Consistent error response formats across all endpoints
Viktiga lärdomar
- Scalable structure and request lifecycle with Express
- Practical JWT authentication with bcrypt password hashing
- Cloudinary integration for image upload/delete lifecycle
- Trade-offs of monolithic architecture at small-to-medium scale