# yahia101imad/express-backend-starter architecture

> Architecture diagram of the GitHub repository yahia101imad/express-backend-starter, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-22). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/yahia101imad/express-backend-starter
- Repository: https://github.com/yahia101imad/express-backend-starter

## Overview

1. **Overall shape**
   - This is a modular Node.js/Express API backend centered around two business modules: **auth** and **user**.
   - The code is organized by responsibility: application bootstrap, shared infrastructure, cross-cutting middleware, feature modules, and seed scripts.

2. **Bootstrap and runtime entrypoints**
   - `src/server.js` is the process entrypoint that likely starts the HTTP server.
   - `src/app.js` is the Express application composition layer, where middleware, routes, and docs are wired together before the server listens.

3. **Routing boundary**
   - `src/routes/index.js` appears to be the top-level route aggregator.
   - Feature routes are split by module, mainly `src/modules/auth/auth.routes.js` and `src/modules/user/user.routes.js`, which keeps endpoint ownership localized to each feature.

4. **Auth module as the main security subsystem**
   - `src/modules/auth/` contains the full authentication lifecycle:
     - login/register flows in `auth.controller.js` and `auth.service.js`
     - session persistence in `session.model.js`
     - password reset tokens in `password-reset-token.model.js`
     - email verification tokens in `email-verification-token.model.js`
   - This module is the primary source of identity-related state changes in the system.

5. **JWT and token flow**
   - `src/common/auth/` contains token utilities for generating and validating access/refresh tokens.
   - The readme indicates the system uses **short-lived access tokens** plus **refresh tokens**, so the auth flow likely issues tokens on login, verifies them in middleware, and uses stored sessions/tokens for logout and refresh behavior.

6. **Authorization and RBAC**
   - `src/common/constants/roles.js`, `permissions.js`, and `rolePermissions.js` define the authorization model.
   - `src/middlewares/permission.middleware.js` enforces role/permission checks after authentication, making authorization a separate layer from token verification.

7. **User module as the domain data subsystem**
   - `src/modules/user/` owns user CRUD and user-facing business logic through `user.controller.js`, `user.service.js`, and `user.model.js`.
   - This module likely consumes the auth context for protected endpoints and is the main persistent entity outside of sessions and token records.

8. **Persistence layer**
   - MongoDB + Mongoose is the persistence boundary, configured in `src/config/db.js`.
   - Each module owns its own models, which suggests a feature-aligned data model rather than a single centralized repository layer.

9. **Cross-cutting middleware pipeline**
   - `src/middlewares/` holds the request pipeline concerns:
     - authentication
     - permission checks
     - validation
     - rate limiting
     - centralized error handling
   - The request path is therefore: route → validation/authz middleware → controller/service → model/database → response or error handler.

10. **Validation and response shaping**
   - `src/modules/auth/validators/auth.schema.js` defines request schemas for auth endpoints.
   - `src/common/utils/sendResponse.js` standardizes successful API responses, while `src/common/errors/appError.js` provides a structured app-level error type for the error middleware to interpret.

11. **Configuration and infrastructure concerns**
   - `src/config/env.js`, `security.js`, `logger.js`, and Swagger config files centralize environment parsing, security settings, logging, and API documentation setup.
   - These files form the app’s infrastructure boundary and are consumed by bootstrap and middleware layers rather than business modules.

12. **API documentation**
   - `src/config/swagger.js` and `src/config/swagger.components.js` indicate Swagger/OpenAPI docs are generated from code configuration and exposed as part of the app.
   - This is a supporting subsystem, not part of request execution, but it mirrors the API surface for consumers.

13. **Background/admin setup**
   - `src/seed/admin.seed.js` is a bootstrap data script for creating an initial admin account.
   - This suggests the system expects at least one privileged seed identity for development or first-run setup.

14. **Shared utilities**
   - `src/utils/asyncHandler.js` likely wraps async controllers to forward errors cleanly to the error middleware.
   - `src/utils/pagination.js` supports list endpoints, aligning with the readme’s mention of pagination/filtering work.

15. **External dependencies that materially shape the architecture**
   - The core external boundary is **MongoDB/Mongoose** for persistence.
   - **JWT** is the primary security mechanism for stateless request authentication.
   - **Swagger/OpenAPI** is used for API contract documentation.
   - The architecture is otherwise a conventional Express service with explicit module boundaries and shared cross-cutting infrastructure.

Main entry points: [`src/modules/auth/auth.service.js`](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.service.js) (Auth svc), [`src/modules/auth/auth.routes.js`](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.routes.js) (Auth routes), [`src/app.js`](https://github.com/yahia101imad/express-backend-starter/blob/main/src/app.js) (App), [`src/modules/user/user.routes.js`](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.routes.js) (User routes)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Runtime"]
  node_server(("Server<br/>entrypoint<br/>[server.js]"))
  node_app["App<br/>[app.js]"]
  node_routes_index["Routes<br/>router aggregator<br/>[index.js]"]
end

subgraph group_infra["Infrastructure"]
  node_db[("Database<br/>mongoose config<br/>[db.js]")]
  node_env["Env<br/>config<br/>[env.js]"]
  node_security["Security<br/>config<br/>[security.js]"]
  node_logger["Logger<br/>config<br/>[logger.js]"]
  node_swagger["Swagger<br/>openapi config<br/>[swagger.js]"]
  node_swagger_components["Docs schema<br/>openapi components"]
end

subgraph group_crosscut["Cross-cutting"]
  node_auth_mw["Auth mw<br/>middleware<br/>[auth.middleware.js]"]
  node_perm_mw["Permission mw<br/>rbac middleware"]
  node_validate_mw["Validate mw<br/>validation middleware"]
  node_error_mw["Error mw<br/>error middleware"]
  node_rate_limit["Rate limit<br/>middleware"]
  node_auth_common["Token utils<br/>jwt helpers"]
  node_roles["Roles<br/>rbac constants"]
  node_app_error["App error<br/>error type<br/>[appError.js]"]
  node_send_response["Response<br/>[sendResponse.js]"]
  node_async_handler["Async handler<br/>[asyncHandler.js]"]
  node_pagination["Pagination<br/>[pagination.js]"]
end

subgraph group_features["Feature modules"]
  node_auth_module{{"Auth<br/>feature module"}}
  node_auth_controller["Auth ctl<br/>controller<br/>[auth.controller.js]"]
  node_auth_service["Auth svc<br/>[auth.service.js]"]
  node_auth_routes["Auth routes<br/>router<br/>[auth.routes.js]"]
  node_session_model[("Session<br/>model<br/>[session.model.js]")]
  node_reset_token_model[("Reset token<br/>model")]
  node_verify_token_model[("Verify token<br/>model")]
  node_auth_schema["Auth schema<br/>validation schema<br/>[auth.schema.js]"]
  node_user_module{{"User<br/>feature module"}}
  node_user_controller["User ctl<br/>controller<br/>[user.controller.js]"]
  node_user_service["User svc<br/>[user.service.js]"]
  node_user_routes["User routes<br/>router<br/>[user.routes.js]"]
  node_user_model[("User model<br/>[user.model.js]")]
end

subgraph group_support["Support"]
  node_admin_seed["Admin seed<br/>seed script<br/>[admin.seed.js]"]
end

node_server -->|"boots"| node_app
node_app -->|"mounts"| node_routes_index
node_app -->|"documents"| node_swagger
node_swagger -->|"uses"| node_swagger_components
node_app -->|"uses"| node_error_mw
node_app -->|"uses"| node_rate_limit
node_app -->|"uses"| node_security
node_app -->|"uses"| node_logger
node_routes_index -->|"mounts"| node_auth_routes
node_routes_index -->|"mounts"| node_user_routes
node_auth_routes -->|"validates"| node_validate_mw
node_auth_routes -->|"protects"| node_auth_mw
node_auth_routes -->|"authorizes"| node_perm_mw
node_user_routes -->|"protects"| node_auth_mw
node_user_routes -->|"authorizes"| node_perm_mw
node_user_routes -->|"lists"| node_pagination
node_auth_controller -->|"delegates"| node_auth_service
node_auth_service -->|"persists"| node_session_model
node_auth_service -->|"persists"| node_reset_token_model
node_auth_service -->|"persists"| node_verify_token_model
node_auth_service -->|"signs"| node_auth_common
node_auth_service -->|"formats"| node_send_response
node_auth_service -->|"raises"| node_app_error
node_auth_routes -->|"dispatches"| node_auth_controller
node_auth_routes -->|"validates"| node_auth_schema
node_auth_routes -->|"wraps"| node_async_handler
node_user_controller -->|"delegates"| node_user_service
node_user_service -->|"persists"| node_user_model
node_user_service -->|"formats"| node_send_response
node_user_service -->|"raises"| node_app_error
node_user_routes -->|"dispatches"| node_user_controller
node_user_routes -->|"wraps"| node_async_handler
node_auth_module -->|"contains"| node_auth_controller
node_auth_module -->|"contains"| node_auth_service
node_auth_module -->|"contains"| node_auth_routes
node_user_module -->|"contains"| node_user_controller
node_user_module -->|"contains"| node_user_service
node_user_module -->|"contains"| node_user_routes
node_db -->|"backs"| node_session_model
node_db -->|"backs"| node_reset_token_model
node_db -->|"backs"| node_verify_token_model
node_db -->|"backs"| node_user_model
node_env -->|"configures"| node_db
node_roles -->|"drives"| node_perm_mw
node_roles -->|"drives"| node_auth_service
node_admin_seed -->|"creates"| node_user_model
node_auth_mw -->|"verifies"| node_auth_common
node_auth_mw -->|"raises"| node_app_error

click node_server "https://github.com/yahia101imad/express-backend-starter/blob/main/src/server.js"
click node_app "https://github.com/yahia101imad/express-backend-starter/blob/main/src/app.js"
click node_routes_index "https://github.com/yahia101imad/express-backend-starter/blob/main/src/routes/index.js"
click node_db "https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/db.js"
click node_env "https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/env.js"
click node_security "https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/security.js"
click node_logger "https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/logger.js"
click node_swagger "https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/swagger.js"
click node_swagger_components "https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/swagger.components.js"
click node_auth_mw "https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/auth.middleware.js"
click node_perm_mw "https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/permission.middleware.js"
click node_validate_mw "https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/validate.middleware.js"
click node_error_mw "https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/error.middleware.js"
click node_rate_limit "https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/rateLimit.middleware.js"
click node_auth_common "https://github.com/yahia101imad/express-backend-starter/tree/main/src/common/auth"
click node_roles "https://github.com/yahia101imad/express-backend-starter/tree/main/src/common/constants"
click node_app_error "https://github.com/yahia101imad/express-backend-starter/blob/main/src/common/errors/appError.js"
click node_send_response "https://github.com/yahia101imad/express-backend-starter/blob/main/src/common/utils/sendResponse.js"
click node_async_handler "https://github.com/yahia101imad/express-backend-starter/blob/main/src/utils/asyncHandler.js"
click node_pagination "https://github.com/yahia101imad/express-backend-starter/blob/main/src/utils/pagination.js"
click node_auth_module "https://github.com/yahia101imad/express-backend-starter/tree/main/src/modules/auth"
click node_auth_controller "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.controller.js"
click node_auth_service "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.service.js"
click node_auth_routes "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.routes.js"
click node_session_model "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/session.model.js"
click node_reset_token_model "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/password-reset-token.model.js"
click node_verify_token_model "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/email-verification-token.model.js"
click node_auth_schema "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/validators/auth.schema.js"
click node_user_module "https://github.com/yahia101imad/express-backend-starter/tree/main/src/modules/user"
click node_user_controller "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.controller.js"
click node_user_service "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.service.js"
click node_user_routes "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.routes.js"
click node_user_model "https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.model.js"
click node_admin_seed "https://github.com/yahia101imad/express-backend-starter/blob/main/src/seed/admin.seed.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server,node_app,node_routes_index toneBlue
class node_db,node_env,node_security,node_logger,node_swagger,node_swagger_components toneAmber
class node_auth_mw,node_perm_mw,node_validate_mw,node_error_mw,node_rate_limit,node_auth_common,node_roles,node_app_error,node_send_response,node_async_handler,node_pagination toneMint
class node_auth_module,node_auth_controller,node_auth_service,node_auth_routes,node_session_model,node_reset_token_model,node_verify_token_model,node_auth_schema,node_user_module,node_user_controller,node_user_service,node_user_routes,node_user_model toneRose
class node_admin_seed toneIndigo
```

## Components

### Runtime

Process bootstrap and Express application wiring.

- [Server](https://github.com/yahia101imad/express-backend-starter/blob/main/src/server.js): entrypoint · Starts the Node.js process and listens for requests. · `src/server.js`
- [App](https://github.com/yahia101imad/express-backend-starter/blob/main/src/app.js): express app · Composes middleware, routes, and docs into the Express application. · `src/app.js`
- [Routes](https://github.com/yahia101imad/express-backend-starter/blob/main/src/routes/index.js): router aggregator · Top-level route mounting for feature routers. · `src/routes/index.js`

### Infrastructure

Configuration, logging, persistence, and API documentation.

- [Database](https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/db.js): mongoose config · MongoDB connection and persistence setup. · `src/config/db.js`
- [Env](https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/env.js): config · Parses runtime environment and application settings. · `src/config/env.js`
- [Security](https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/security.js): config · Central security-related configuration. · `src/config/security.js`
- [Logger](https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/logger.js): config · Application logging configuration. · `src/config/logger.js`
- [Swagger](https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/swagger.js): openapi config · Builds API documentation configuration. · `src/config/swagger.js`
- [Docs schema](https://github.com/yahia101imad/express-backend-starter/blob/main/src/config/swagger.components.js): openapi components · Shared OpenAPI component definitions. · `src/config/swagger.components.js`

### Cross-cutting

Shared middleware, auth helpers, errors, and utilities.

- [Auth mw](https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/auth.middleware.js): middleware · Verifies access tokens and attaches request identity. · `src/middlewares/auth.middleware.js`
- [Permission mw](https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/permission.middleware.js): rbac middleware · Enforces role and permission checks. · `src/middlewares/permission.middleware.js`
- [Validate mw](https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/validate.middleware.js): validation middleware · Runs request schema validation before handlers. · `src/middlewares/validate.middleware.js`
- [Error mw](https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/error.middleware.js): error middleware · Normalizes application errors into responses. · `src/middlewares/error.middleware.js`
- [Rate limit](https://github.com/yahia101imad/express-backend-starter/blob/main/src/middlewares/rateLimit.middleware.js): middleware · Limits request throughput to protect endpoints. · `src/middlewares/rateLimit.middleware.js`
- [Token utils](https://github.com/yahia101imad/express-backend-starter/tree/main/src/common/auth): jwt helpers · Generates and verifies access and refresh tokens. · `src/common/auth`
- [Roles](https://github.com/yahia101imad/express-backend-starter/tree/main/src/common/constants): rbac constants · Role, permission, and role-to-permission definitions. · `src/common/constants`
- [App error](https://github.com/yahia101imad/express-backend-starter/blob/main/src/common/errors/appError.js): error type · Structured error object consumed by error handling. · `src/common/errors/appError.js`
- [Response](https://github.com/yahia101imad/express-backend-starter/blob/main/src/common/utils/sendResponse.js): response helper · Standard response formatting helper. · `src/common/utils/sendResponse.js`
- [Async handler](https://github.com/yahia101imad/express-backend-starter/blob/main/src/utils/asyncHandler.js): utility · Wraps async route handlers for error forwarding. · `src/utils/asyncHandler.js`
- [Pagination](https://github.com/yahia101imad/express-backend-starter/blob/main/src/utils/pagination.js): utility · Shared list pagination helper. · `src/utils/pagination.js`

### Feature modules

Domain modules for auth and user management.

- [Auth](https://github.com/yahia101imad/express-backend-starter/tree/main/src/modules/auth): feature module · Authentication, tokens, sessions, and account recovery. · `src/modules/auth`
- [Auth ctl](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.controller.js): controller · Handles login, registration, verification, and reset flows. · `src/modules/auth/auth.controller.js`
- [Auth svc](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.service.js): service · Implements authentication business logic. · `src/modules/auth/auth.service.js`
- [Auth routes](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/auth.routes.js): router · Feature routes for authentication endpoints. · `src/modules/auth/auth.routes.js`
- [Session](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/session.model.js): model · Stores active session state and token lifecycle data. · `src/modules/auth/session.model.js`
- [Reset token](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/password-reset-token.model.js): model · Persists password reset tokens. · `src/modules/auth/password-reset-token.model.js`
- [Verify token](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/email-verification-token.model.js): model · Persists email verification tokens. · `src/modules/auth/email-verification-token.model.js`
- [Auth schema](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/auth/validators/auth.schema.js): validation schema · Request validation rules for auth endpoints. · `src/modules/auth/validators/auth.schema.js`
- [User](https://github.com/yahia101imad/express-backend-starter/tree/main/src/modules/user): feature module · User domain state and protected user operations. · `src/modules/user`
- [User ctl](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.controller.js): controller · Handles user-facing CRUD and profile actions. · `src/modules/user/user.controller.js`
- [User svc](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.service.js): service · Implements user business logic. · `src/modules/user/user.service.js`
- [User routes](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.routes.js): router · Feature routes for user endpoints. · `src/modules/user/user.routes.js`
- [User model](https://github.com/yahia101imad/express-backend-starter/blob/main/src/modules/user/user.model.js): model · Primary user persistence model. · `src/modules/user/user.model.js`

### Support

Seed and background setup scripts.

- [Admin seed](https://github.com/yahia101imad/express-backend-starter/blob/main/src/seed/admin.seed.js): seed script · Creates an initial privileged admin account. · `src/seed/admin.seed.js`

## Connections

- Server → App: boots · Process entrypoint starts the Express application.
- App → Routes: mounts · Application wiring delegates endpoint registration to the route aggregator.
- App → Swagger: documents · Exposes API documentation alongside the app.
- Swagger → Docs schema: uses · Swagger config references shared component definitions.
- App → Error mw: uses · Central error handling is installed at the application boundary.
- App → Rate limit: uses · Request throttling is applied as cross-cutting middleware.
- App → Security: uses · Security settings shape request handling and docs.
- App → Logger: uses · Application bootstrapping initializes logging.
- Routes → Auth routes: mounts · Top-level router mounts auth endpoints.
- Routes → User routes: mounts · Top-level router mounts user endpoints.
- Auth routes → Validate mw: validates · Auth routes run request schema validation.
- Auth routes → Auth mw: protects · Protected auth flows use authentication middleware where needed.
- Auth routes → Permission mw: authorizes · Role and permission checks gate privileged auth actions.
- User routes → Auth mw: protects · User endpoints are guarded by token authentication.
- User routes → Permission mw: authorizes · User endpoints can require permission checks.
- User routes → Pagination: lists · User listing endpoints can use shared pagination behavior.
- Auth ctl → Auth svc: delegates · Controller forwards business work to the auth service.
- Auth svc → Session: persists · Auth flow stores and updates session state.
- Auth svc → Reset token: persists · Password reset tokens are created and consumed here.
- Auth svc → Verify token: persists · Email verification tokens are managed here.
- Auth svc → Token utils: signs · Token utilities issue and validate JWTs.
- Auth svc → Response: formats · Successful responses use the shared response helper.
- Auth svc → App error: raises · Business failures are surfaced as structured app errors.
- Auth routes → Auth ctl: dispatches · Auth routes hand off to the controller layer.
- Auth routes → Auth schema: validates · Auth endpoint inputs are checked against schemas.
- Auth routes → Async handler: wraps · Async handler utility helps route execution propagate errors.
- User ctl → User svc: delegates · User controller forwards domain work to the service.
- User svc → User model: persists · User data is read from and written to the database.
- User svc → Response: formats · User APIs standardize success responses.
- User svc → App error: raises · User business errors use the shared error type.
- User routes → User ctl: dispatches · User routes route requests to the controller.
- User routes → Async handler: wraps · Async handler utility shields route handlers from unhandled rejections.
- Auth → Auth ctl: contains · Auth module is implemented through its controller.
- Auth → Auth svc: contains · Auth module is implemented through its service.
- Auth → Auth routes: contains · Auth module exposes its own router.
- User → User ctl: contains · User module is implemented through its controller.
- User → User svc: contains · User module is implemented through its service.
- User → User routes: contains · User module exposes its own router.
- Database → Session: backs · MongoDB/Mongoose supports session persistence.
- Database → Reset token: backs · MongoDB/Mongoose supports reset token storage.
- Database → Verify token: backs · MongoDB/Mongoose supports verification token storage.
- Database → User model: backs · MongoDB/Mongoose supports user persistence.
- Env → Database: configures · Environment settings drive database connection setup.
- Roles → Permission mw: drives · Authorization middleware consumes role and permission constants.
- Roles → Auth svc: drives · Auth logic uses the role model when creating accounts and sessions.
- Admin seed → User model: creates · Seed script creates an initial admin user.
- Auth mw → Token utils: verifies · Authentication middleware validates JWTs.
- Auth mw → App error: raises · Invalid or missing credentials become structured errors.