How santoshkumar555/20-nodejs-virtual-library-api works
1. Overall shape
This is a Node.js + Express REST API backed by MongoDB/Mongoose, with a small static frontend demo and Postman docs. The main runtime is the API server in server.js, which wires routes, middleware, database connectivity, and error handling.
2. Primary domain boundaries
The code is split into three main feature areas:
- controllers/authors for author CRUD
- controllers/books for book CRUD
- controllers/userAccess for authentication, profile, and admin user management
This separation is mirrored in routes/authorRoutes.js, routes/bookRoutes.js, and routes/userAccessRoutes.js.
3. Request lifecycle
A typical request flows from:
- route definition
- optional middleware checks
- controller logic
- Mongoose model operations
- response/error handling
The shared error boundary is middleware/handleErrors.js, which centralizes API error responses.
4. Authentication and session model
User access is JWT-based, but login is OTP-driven rather than password-only. The user-access controllers cover:
- registration
- sending login OTP
- verifying login OTP
- logout
- “get me” profile lookup
- email checks
- profile updates
- forgot/reset password
- self-deletion
- admin create/delete user
controllers/userAccess/generateToken.js indicates token generation is factored out, and middleware/isUserLoggedIn.js likely protects authenticated endpoints.
5. Authorization and role control
Access control is separated from authentication. middleware/checkUserPermissions.js suggests role- or permission-based enforcement for sensitive endpoints such as admin user actions and protected CRUD operations. This is an important architectural boundary: identity is verified first, then privileges are checked.
6. Data model layer
The persistent domain is represented by three Mongoose models:
- models/User.js
- models/Author.js
- models/Book.js
The README highlights author-book relationships via MongoDB ObjectIds, so books likely reference authors through IDs rather than embedded documents. This means the API has a relational-like dependency structure on top of MongoDB.
7. Content management: authors and books
Authors and books are managed as independent CRUD resources, each with five standard endpoints:
- list all
- get by id
- create
- update
- delete
The split into separate controllers per operation indicates a thin route layer and action-specific controller files rather than large monolithic controllers.
8. File upload subsystem
middleware/handleFileUpload.js and utils/deleteUploadedFiles.js show that book or user-related image/file uploads are supported via Multer. The architecture includes cleanup on delete/update, so uploaded files are treated as external side effects that must stay consistent with database state.
9. Email/OTP delivery
config/emailService.js and OTP login/forgot-password flows imply an outbound email subsystem. This service is part of the auth flow, not a standalone feature: it supports verification and recovery rather than general messaging.
10. Configuration and environment
config/database.js centralizes database connection setup, while .env.example shows the app depends on environment variables for secrets and service settings. That makes the deployment boundary explicit: the API behavior changes based on runtime configuration rather than hardcoded values.
11. Validation and defensive middleware
utils/validateInput.js suggests request payload validation is handled separately from business logic. Combined with upload handling, login checks, and permission checks, the API uses middleware to reject bad or unauthorized requests before controller logic runs.
12. Frontend and documentation
The frontend/ folder is a static client/demo served separately from the API logic, with index.html, script.js, style.css, and _redirects. The canonical developer-facing contract is documented through docs/postman/virtual-library-api.postman.json, and the README also points to Swagger UI in the live deployment.
13. What to draw in an architecture diagram
A good diagram would show:
- clients hitting the Express API
- route modules dispatching to feature controllers
- middleware gates for auth, permissions, uploads, and error handling
- controllers reading/writing MongoDB via Mongoose models
- auxiliary email service for OTP/password flows
- filesystem/object storage side effect for uploads, with cleanup on deletion
- a separate static frontend consuming the same API
The main trust boundaries are authentication/authorization, database persistence, and file/email side effects.
14. Notable product intent
This is not just a CRUD library API: it is a secure library management backend with account recovery, OTP login, admin user management, and media upload lifecycle management. Those concerns are first-class in the architecture, not add-ons.
Main entry points: userAccess User access · server.js Server · bookRoutes.js Book routes · authorRoutes.js Author routes
Components 21
API runtime
Express server, routes, controllers, and middleware
- Server · Bootstraps the API, middleware, routes, and shutdown/error wiring
server.js - Author routes · Endpoints for author CRUD
routes/authorRoutes.js - Book routes · Endpoints for book CRUD
routes/bookRoutes.js - User routes · Endpoints for registration, login, profile, and admin actions
routes/userAccessRoutes.js - Access guard · Checks login state and permissions
middleware/isUserLoggedIn.js - Perms check · Role or permission enforcement for protected actions
middleware/checkUserPermissions.js - Upload handler · Handles multipart uploads and file intake
middleware/handleFileUpload.js - Error handler · Central API error responses
middleware/handleErrors.js
Domain
Author, book, and user access features
- Authors · Author CRUD actions
controllers/authors - Books · Book CRUD actions
controllers/books - User access · Auth, profile, password, and admin user flows
controllers/userAccess - Token util · Generates JWTs for authenticated sessions
controllers/userAccess/generateToken.js
Persistence
MongoDB models and file side effects
- User model · User persistence and identity data
models/User.js - Author model · Author persistence
models/Author.js - Book model · Book persistence and author references
models/Book.js - File cleanup · Deletes uploaded files during update/delete flows
utils/deleteUploadedFiles.js
Support
Config, email, validation, and shared utilities
- DB config · MongoDB connection setup
config/database.js - Email service · Sends OTP and password recovery email flows
config/emailService.js - Validate input · Request payload validation helpers
utils/validateInput.js
Client & docs
Static frontend and API documentation
- Frontend · Small static demo client consuming the API
frontend/index.html - Postman docs · Canonical request collection for the API
docs/postman/virtual-library-api.postman.json
Connections 26
- Server → DB config: connects · Initializes the database connection
- Server → Author routes: mounts · Registers author endpoints
- Server → Book routes: mounts · Registers book endpoints
- Server → User routes: mounts · Registers user-access endpoints
- Server → Error handler: uses · Centralizes API error handling
- Author routes → Access guard: protects · Applies login checks where needed
- Author routes → Perms check: guards · Applies privilege checks for sensitive operations
- Author routes → Authors: dispatches · Routes CRUD requests to author controllers
- Book routes → Access guard: protects · Applies login checks where needed
- Book routes → Perms check: guards · Applies privilege checks for sensitive operations
- Book routes → Upload handler: accepts · Handles file uploads on book workflows
- Book routes → Books: dispatches · Routes CRUD requests to book controllers
- User routes → User access: dispatches · Routes auth and profile requests
- User access → Token util: generates · Creates JWTs after successful auth
- User access → Email service: sends · Delivers login OTP and recovery email flows
- User access → Validate input: validates · Checks input before state changes
- User access → Access guard: requires · Uses login state for protected user actions
- User access → Perms check: requires · Uses permissions for admin actions
- Authors → Author model: reads/writes · Persists author records
- Books → Book model: reads/writes · Persists book records
- Books → Author model: references · Books are linked to authors by id
- User access → User model: reads/writes · Persists user records
- Books → File cleanup: cleans up · Removes uploaded files when records change
- Upload handler → File cleanup: pairs with · Supports upload lifecycle cleanup
- Frontend → Server: consumes · Static client talks to the API
- Postman docs → Server: describes · Collection documents API behavior