# pamith596/nodegoat-devsecops architecture

> Architecture diagram of the GitHub repository pamith596/nodegoat-devsecops, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/pamith596/nodegoat-devsecops
- Repository: https://github.com/pamith596/nodegoat-devsecops

## Overview

NodeGoat is a web application for learning OWASP Top 10 risks by using a deliberately vulnerable personal-finance app alongside tutorial material. The main flow is browser request → Express route/session handling → domain handler → MongoDB DAO → rendered page or response. Domain branches cover accounts, profiles, contributions, benefits, allocations, memos, and research; a separate tutorial route serves learning pages. The supplied source confirms several handler-to-DAO links and the research route's outbound HTTP request; other documented modules are included, but their internal calls are not asserted where excerpts do not show them.

Main entry points: [`app/routes/index.js`](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/index.js) (Route registry), [`app/routes/session.js`](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/session.js) (Accounts and sessions), [`server.js`](https://github.com/pamith596/nodegoat-devsecops/blob/master/server.js) (Express server), [`app/routes/profile.js`](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/profile.js) (Profile handler)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web and sessions"]
  node_express["Express server<br/>[server.js]"]
  node_route_registry["Route registry<br/>[index.js]"]
  node_session["Accounts and sessions<br/>[session.js]"]
  node_login_views["Login and signup views"]
end

subgraph group_finance["Finance features"]
  node_profile["Profile handler<br/>[profile.js]"]
  node_contributions["Contributions handler<br/>[contributions.js]"]
  node_benefits["Benefits handler<br/>[benefits.js]"]
  node_allocations["Allocations handler<br/>[allocations.js]"]
  node_memos["Memos handler<br/>[memos.js]"]
  node_finance_views["Finance views"]
end

subgraph group_storage["Data access"]
  node_user_dao["User data<br/>[user-dao.js]"]
  node_mongo[("MongoDB")]
  node_profile_dao["Profile data<br/>[profile-dao.js]"]
  node_contributions_dao["Contributions data"]
  node_benefits_dao["Benefits data<br/>[benefits-dao.js]"]
  node_allocations_dao["Allocations data<br/>[allocations-dao.js]"]
  node_memos_dao["Memos data<br/>[memos-dao.js]"]
  node_research_dao["Research data<br/>[research-dao.js]"]
end

subgraph group_learning["Learning and research"]
  node_research["Research handler<br/>[research.js]"]
  node_tutorial["OWASP tutorial<br/>[tutorial.js]"]
  node_tutorial_pages["Tutorial pages"]
end

node_browser(("Browser user"))
node_market_service["Market data service"]

node_browser -->|"sends requests"| node_express
node_express -->|"connects to"| node_mongo
node_express -->|"registers routes"| node_route_registry
node_route_registry -->|"dispatches auth"| node_session
node_route_registry -->|"dispatches profile"| node_profile
node_route_registry -->|"dispatches contributions"| node_contributions
node_route_registry -->|"dispatches benefits"| node_benefits
node_route_registry -->|"dispatches allocations"| node_allocations
node_route_registry -->|"dispatches memos"| node_memos
node_route_registry -->|"dispatches research"| node_research
node_route_registry -->|"mounts tutorial"| node_tutorial
node_session -->|"validates accounts"| node_user_dao
node_session -->|"prepares allocations"| node_allocations_dao
node_profile -->|"reads and updates"| node_profile_dao
node_contributions -->|"reads and updates"| node_contributions_dao
node_benefits --> node_benefits_dao
node_allocations --> node_allocations_dao
node_memos --> node_memos_dao
node_research -->|"constructs DAO"| node_research_dao
node_research -->|"requests market data"| node_market_service
node_user_dao -->|"reads and writes"| node_mongo
node_profile_dao -->|"reads and writes"| node_mongo
node_allocations_dao -->|"reads and writes"| node_mongo
node_tutorial -->|"serves pages"| node_tutorial_pages
node_profile -->|"renders profile"| node_finance_views
node_contributions -->|"renders contributions"| node_finance_views
node_session -->|"renders account pages"| node_login_views

click node_express "https://github.com/pamith596/nodegoat-devsecops/blob/master/server.js"
click node_route_registry "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/index.js"
click node_session "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/session.js"
click node_user_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/user-dao.js"
click node_profile "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/profile.js"
click node_profile_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/profile-dao.js"
click node_contributions "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/contributions.js"
click node_contributions_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/contributions-dao.js"
click node_benefits "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/benefits.js"
click node_benefits_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/benefits-dao.js"
click node_allocations "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/allocations.js"
click node_allocations_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/allocations-dao.js"
click node_memos "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/memos.js"
click node_memos_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/memos-dao.js"
click node_research "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/research.js"
click node_research_dao "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/research-dao.js"
click node_tutorial "https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/tutorial.js"
click node_tutorial_pages "https://github.com/pamith596/nodegoat-devsecops/tree/master/app/views/tutorial"
click node_finance_views "https://github.com/pamith596/nodegoat-devsecops/tree/master/app/views"
click node_login_views "https://github.com/pamith596/nodegoat-devsecops/tree/master/app/views"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_express,node_route_registry,node_session,node_login_views,node_browser toneBlue
class node_profile,node_contributions,node_benefits,node_allocations,node_memos,node_finance_views toneAmber
class node_user_dao,node_mongo,node_profile_dao,node_contributions_dao,node_benefits_dao,node_allocations_dao,node_memos_dao,node_research_dao toneMint
class node_research,node_tutorial,node_tutorial_pages toneRose
class node_market_service toneIndigo
```

## Components

### Web and sessions

- [Express server](https://github.com/pamith596/nodegoat-devsecops/blob/master/server.js): `server.js`
- [Route registry](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/index.js): `app/routes/index.js`
- [Accounts and sessions](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/session.js): `app/routes/session.js`
- [Login and signup views](https://github.com/pamith596/nodegoat-devsecops/tree/master/app/views): `app/views`

### Finance features

- [Profile handler](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/profile.js): `app/routes/profile.js`
- [Contributions handler](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/contributions.js): `app/routes/contributions.js`
- [Benefits handler](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/benefits.js): `app/routes/benefits.js`
- [Allocations handler](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/allocations.js): `app/routes/allocations.js`
- [Memos handler](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/memos.js): `app/routes/memos.js`
- [Finance views](https://github.com/pamith596/nodegoat-devsecops/tree/master/app/views): `app/views`

### Data access

- [User data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/user-dao.js): `app/data/user-dao.js`
- **MongoDB**
- [Profile data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/profile-dao.js): `app/data/profile-dao.js`
- [Contributions data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/contributions-dao.js): `app/data/contributions-dao.js`
- [Benefits data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/benefits-dao.js): `app/data/benefits-dao.js`
- [Allocations data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/allocations-dao.js): `app/data/allocations-dao.js`
- [Memos data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/memos-dao.js): `app/data/memos-dao.js`
- [Research data](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/data/research-dao.js): `app/data/research-dao.js`

### Learning and research

- [Research handler](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/research.js): `app/routes/research.js`
- [OWASP tutorial](https://github.com/pamith596/nodegoat-devsecops/blob/master/app/routes/tutorial.js): `app/routes/tutorial.js`
- [Tutorial pages](https://github.com/pamith596/nodegoat-devsecops/tree/master/app/views/tutorial): `app/views/tutorial`

### Other components

- **Browser user**
- **Market data service**

## Connections

- Browser user → Express server: sends requests (evidence: `README.md`)
- Express server → MongoDB: connects to (evidence: `server.js`)
- Express server → Route registry: registers routes (evidence: `server.js`)
- Route registry → Accounts and sessions: dispatches auth (evidence: `app/routes/index.js`)
- Route registry → Profile handler: dispatches profile (evidence: `app/routes/index.js`)
- Route registry → Contributions handler: dispatches contributions (evidence: `app/routes/index.js`)
- Route registry → Benefits handler: dispatches benefits (evidence: `app/routes/index.js`)
- Route registry → Allocations handler: dispatches allocations (evidence: `app/routes/index.js`)
- Route registry → Memos handler: dispatches memos (evidence: `app/routes/index.js`)
- Route registry → Research handler: dispatches research (evidence: `app/routes/index.js`)
- Route registry → OWASP tutorial: mounts tutorial (evidence: `app/routes/index.js`)
- Accounts and sessions → User data: validates accounts (evidence: `app/routes/session.js`)
- Accounts and sessions → Allocations data: prepares allocations (evidence: `app/routes/session.js`)
- Profile handler → Profile data: reads and updates (evidence: `app/routes/profile.js`)
- Contributions handler → Contributions data: reads and updates (evidence: `app/routes/contributions.js`)
- Benefits handler → Benefits data (evidence: `app/routes/benefits.js`)
- Allocations handler → Allocations data (evidence: `app/routes/allocations.js`)
- Memos handler → Memos data (evidence: `app/routes/memos.js`)
- Research handler → Research data: constructs DAO (evidence: `app/routes/research.js`)
- Research handler → Market data service: requests market data (evidence: `app/routes/research.js`)
- User data → MongoDB: reads and writes (evidence: `app/data/user-dao.js`)
- Profile data → MongoDB: reads and writes (evidence: `app/data/profile-dao.js`)
- Allocations data → MongoDB: reads and writes (evidence: `app/data/allocations-dao.js`)
- OWASP tutorial → Tutorial pages: serves pages (evidence: `README.md`)
- Profile handler → Finance views: renders profile (evidence: `app/routes/profile.js`)
- Contributions handler → Finance views: renders contributions (evidence: `app/routes/contributions.js`)
- Accounts and sessions → Login and signup views: renders account pages (evidence: `app/routes/session.js`)