How sourav-roy/apinodejs works
Purpose and entry points
This is an Express/Node.js REST API for DevCamper: bootcamps, their courses, user reviews, and user administration. The server is initialized in index.js; database connection is centralized in db/db.js and re-exported via db/index.js. Deployment configuration is present in vercel.json.
HTTP composition and request pipeline
Routes are mounted through the route aggregation layer, then dispatched to resource controllers:
• routes/index.js
• routes/authRoute.js
• routes/bootcampsRoute.js
• controllers/index.js
• controllers/bootcampsController.js
Cross-cutting middleware enforces authentication, validation, error handling, logging, and paginated/filterable results before or around controller execution:
• middleware/auth.js
• middleware/advancedResults.js
• middleware/error.js
Domain and persistence model
MongoDB/Mongoose-backed models represent the core aggregate relationships: bootcamps own or associate with courses; reviews are authored by users and target bootcamps; users carry authentication and role state.
• models/BootcampModel.js
• models/CourseModel.js
• models/ReviewModel.js
• models/UserModel.js
Controllers implement CRUD, ownership/role authorization, nested-resource handling, profile/password changes, and authentication workflows:
• controllers/coursesController.js
• controllers/reviewsController.js
• controllers/usersController.js
• controllers/authController.js
Authentication and authorization boundary
Authentication uses JWT and cookies, with role-based access for User, Publisher, and Admin. The auth controller handles registration, login/logout, protected-user retrieval, password reset, and credential updates; authorization middleware resolves the requesting user and gates privileged actions.
• controllers/authController.js
• middleware/auth.js
• routes/authRoute.js
Bootcamp enrichment and media
Bootcamp writes incorporate geocoding to derive location/radius data, and bootcamp endpoints support photo upload. Geocoding is an external-service boundary; uploaded media is handled at the controller/API boundary rather than by the data model alone.
• controllers/bootcampsController.js
• utils/geocoder.js
• models/BootcampModel.js
Security, reliability, and external integration
The API applies rate limiting, NoSQL-injection protection, XSS/HPP protection, CORS, password encryption, centralized async error propagation, and request logging. Email is an external integration used by password-reset flows.
• middleware/async.js
• middleware/validate.js
• utils/ErrorResponse.js
• utils/sendMail.js
Data lifecycle and operations
Development/demo data is maintained as JSON fixtures and loaded through the seeding entry point. The repository also carries API and system-design documentation for consumers and maintainers.
• seeder.js
• _data/bootcamps.json
• _data/courses.json
• docs/API_REFERENCE.md
Main entry points: BootcampModel.js Mongoose aggregates · index.js Server bootstrap · routes/index.js Route aggregation · controllers/index.js Controller exports
Components 20
HTTP API
Express request composition and cross-cutting enforcement.
- Server bootstrap
index.js - Route aggregation
routes/index.js - Auth routes
routes/authRoute.js - Bootcamp routes
routes/bootcampsRoute.js - Controller exports
controllers/index.js - JWT & role guard · Resolves users and gates User, Publisher, and Admin actions.
middleware/auth.js - Query results middleware
middleware/advancedResults.js - Validation & error boundary · Validates requests and centralizes async error responses.
middleware/validate.js
Domain
Resource workflows and MongoDB persistence.
- Bootcamp controller · CRUD, ownership checks, nested resources, and photo upload.
controllers/bootcampsController.js - Course controller
controllers/coursesController.js - Review controller
controllers/reviewsController.js - User controller
controllers/usersController.js - Auth controller · Registration, sessions, password reset, and credential changes.
controllers/authController.js - Mongoose aggregates · Bootcamps, courses, reviews, and users encode core relationships.
models/BootcampModel.js - MongoDB connection
db/db.js
Integrations & operations
External services, deployment, and development data.
- Geocoding service · Derives bootcamp location and radius data.
utils/geocoder.js - Email delivery · Used by password-reset flows.
utils/sendMail.js - Data seeder · Loads demo fixtures into MongoDB.
seeder.js - Bootcamp fixtures
_data/bootcamps.json - Vercel deployment
vercel.json
Connections 25
- Vercel deployment → Server bootstrap: deploys
- Server bootstrap → Route aggregation: mounts
- Server bootstrap → JWT & role guard: applies
- Server bootstrap → Validation & error boundary: applies
- Route aggregation → Auth routes: includes
- Route aggregation → Bootcamp routes: includes
- Route aggregation → Controller exports: dispatches through
- Auth routes → Auth controller: dispatches
- Bootcamp routes → Bootcamp controller: dispatches
- JWT & role guard → Auth controller: protects
- JWT & role guard → User controller: authorizes
- Query results middleware → Bootcamp controller: enriches queries
- Controller exports → Course controller: exports
- Controller exports → Review controller: exports
- Controller exports → User controller: exports
- Bootcamp controller → Mongoose aggregates: persists
- Course controller → Mongoose aggregates: persists
- Review controller → Mongoose aggregates: persists
- User controller → Mongoose aggregates: persists
- Auth controller → Mongoose aggregates: manages users
- Mongoose aggregates → MongoDB connection: uses
- Bootcamp controller → Geocoding service: geocodes writes
- Auth controller → Email delivery: sends reset email
- Data seeder → Bootcamp fixtures: loads
- Data seeder → MongoDB connection: seeds