nguyenvinhtieng/server_social_media_vt-

Purpose and Runtime

Node.js backend organized as an Express-style API for users, authentication, posts, comments, likes, and image uploads. The application starts from src/index.js, initializes database/cloud services, mounts routes, and integrates a socket layer.

Application Entry and Route Composition

src/route/index.js is the route aggregation boundary, delegating resource endpoints to:

• src/route/auth.js

• src/route/user.js

• src/route/post.js

• src/route/comment.js

Route modules should define HTTP-facing contracts and compose controllers with authorization, validation, and sanitization middleware.

Controllers: Request-to-Domain Orchestration

Controllers are the main application-service layer:

• src/app/controllers/AuthController.js

• src/app/controllers/UserController.js

• src/app/controllers/PostController.js

• src/app/controllers/CommentController.js

They translate authenticated HTTP requests into model operations, return API responses, and coordinate post/comment/user lifecycle behavior. Post and comment controllers are likely the main interaction path for social content and likes.

Persistence Model Boundary

Database entities are isolated in src/app/models/:

• src/app/models/User.js

• src/app/models/Account.js

• src/app/models/Post.js

• src/app/models/Comment.js

• src/app/models/Like.js

User and Account separate user/profile identity from account/authentication data. Post, Comment, and Like model the content graph. Database connection setup is centralized in src/config/db.js, keeping persistence infrastructure outside controllers and route declarations.

Security, Validation, and Authorization Pipeline

Middleware forms a request-policy boundary before controller execution:

• src/app/middlewares/checkLogin.js

• src/app/middlewares/checkXss.js

• src/app/middlewares/validUserData.js

• src/app/middlewares/permissionAccessPost.js

• src/app/middlewares/permissionEditComment.js

• src/app/middlewares/permissionDeleteComment.js

• src/app/middlewares/permissionEditUser.js

The expected flow is authentication first, input/XSS and user-data validation next, then ownership or access checks for protected mutations. src/app/middlewares/userWasCreate.js appears to protect account-creation state or prevent duplicate user setup.

External Services and Media Handling

Cloudinary configuration is isolated in src/config/cloudinary.js; image-transfer behavior is encapsulated in src/utils/uploadImages.js. Controllers should consume this utility rather than directly embedding Cloudinary calls, preserving a clear media-provider boundary. Sensitive values are expected through src/credentials.js.

Realtime Boundary

src/socket/index.js provides the socket integration point, likely attached during server bootstrap in src/index.js. It is the boundary for realtime notifications or content events and should remain separate from HTTP route handling while sharing domain/model operations where necessary.