# zihaddi/note-taking-application architecture

> Architecture diagram of the GitHub repository zihaddi/note-taking-application, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zihaddi/note-taking-application
- Repository: https://github.com/zihaddi/note-taking-application

## Overview

1. **Repository shape**
   - This repo contains two independently run applications: `task_backend` and `task_client`.
   - The backend is a Node.js/Express API; the client is a Nuxt 4/Vue 3 frontend that consumes that API.
   - MongoDB is the persistent store, accessed through Mongoose.

2. **Backend is organized as layered modules**
   - Each domain area lives under `src/modules/*` with the same split: model, repository, service, controller, and routes.
   - The main domains are `auth`, `user`, `note`, `post`, `role`, `permission`, and `menu`.
   - This creates a clear flow: HTTP route → controller → service → repository → Mongoose model → MongoDB.

3. **Core backend entry points**
   - `src/server.js` starts the process and connects to the database.
   - `src/app.js` builds the Express app, mounts middleware/routes, and handles errors.
   - Shared infrastructure is extracted into `src/config`, `src/middleware`, `src/repositories`, `src/services`, and `src/traits`.

4. **Backend cross-cutting concerns**
   - `authenticate.js` verifies JWTs and attaches the current user to the request.
   - `authorize.js` enforces role access, mainly distinguishing `user` vs `admin`.
   - `validate.js` centralizes request validation failures from `express-validator`.
   - `ApiResponse` provides a consistent response envelope across modules.

5. **Backend data access pattern**
   - `BaseRepository` provides generic CRUD and pagination primitives for concrete repositories.
   - `BaseService` wraps those repository operations with business rules.
   - This keeps controllers thin and makes ownership checks, pagination, and aggregation logic live above raw database access.

6. **Backend security and access model**
   - Authentication is JWT-based.
   - The API distinguishes public routes, authenticated user routes, and admin-only routes.
   - Admins inherit user capabilities on `/api/user/*` style endpoints, while additional `/api/admin/*` routes expose full management powers.

7. **Backend database modeling and query intent**
   - Mongoose schemas define the collections and explicit indexes.
   - Important indexes are on fields used for lookups and ownership checks, such as `email`, `role`, and `userId`.
   - The note and post domains are optimized around “own records” access patterns and admin listing/reporting views.

8. **Backend aggregation boundaries**
   - Two notable read models are implemented with aggregation pipelines:
     - user interests grouping for admin reporting
     - fetching a user with their posts via `$lookup`
   - These are not separate services; they are repository-level MongoDB aggregation queries, which keeps the joins/reporting close to the data layer.

9. **Client is a Nuxt app with file-based routing**
   - The frontend uses Nuxt layouts and pages to separate auth, admin, user, and public experiences.
   - Routes are organized into `admin-panel/*`, `user-panel/*`, and public auth pages like login/register.
   - Layouts define the shell around those sections, especially the admin sidebar and user sidebar patterns.

10. **Client state and API access**
   - Auth state is stored with Nuxt `useState` rather than a dedicated store library.
   - The token is persisted in a cookie and restored by a plugin on page load.
   - All API calls go through a shared fetch wrapper that injects the Bearer token and redirects on 401 responses.

11. **Client-side route protection**
   - Nuxt middleware enforces access rules before page navigation.
   - There are separate guards for guest users, authenticated users, and admins.
   - This mirrors the backend authorization model, so both navigation and API access are role-aware.

12. **Client feature composition**
   - Feature-specific composables encapsulate API calls for auth, users, notes, posts, menus, roles, and permissions.
   - Pages use these composables to keep UI components focused on presentation and interaction.
   - Shared UI primitives like confirmation and response modals support CRUD workflows across the admin and user panels.

13. **Primary end-to-end data flow**
   - A typical request starts in a Nuxt page, passes through a composable and fetch wrapper, reaches an Express route, then flows through auth/authorization/validation middleware into a controller-service-repository chain, and finally hits MongoDB.
   - The response returns in a consistent JSON shape and is then reflected in the UI state or modal feedback.

14. **Operational boundaries**
   - The backend is the only system component talking directly to MongoDB.
   - The client never accesses the database; it only talks to the API at the configured base URL.
   - The seed script in the backend suggests a local bootstrap path for demo accounts and initial data, but it is not part of the runtime request path.

Main entry points: [`task_backend/src/app.js`](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/app.js) (Express App), [`task_backend/src/traits/ApiResponse.js`](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/traits/ApiResponse.js) (ApiResponse), [`task_backend/src/repositories/BaseRepository.js`](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/repositories/BaseRepository.js) (Base Repo), [`task_backend/src/services/BaseService.js`](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/services/BaseService.js) (Base Service)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_backend["task_backend"]
  node_backend_server["Server<br/>entrypoint<br/>[server.js]"]
  node_backend_app["Express App<br/>http app<br/>[app.js]"]
  node_backend_auth_mw["Auth Guard<br/>middleware<br/>[authenticate.js]"]
  node_backend_authorize_mw["Role Guard<br/>middleware<br/>[authorize.js]"]
  node_backend_validate_mw["Validate<br/>middleware<br/>[validate.js]"]
  node_backend_api_response["ApiResponse<br/>response trait<br/>[ApiResponse.js]"]
  node_backend_base_repo["Base Repo<br/>data layer<br/>[BaseRepository.js]"]
  node_backend_base_service["Base Service<br/>service base<br/>[BaseService.js]"]
  node_backend_auth["Auth"]
  node_backend_user["User"]
  node_backend_note["Note"]
  node_backend_post["Post"]
  node_backend_role["Role"]
  node_backend_permission["Permission"]
  node_backend_menu["Menu"]
  node_backend_mongo[("MongoDB<br/>database")]
end

subgraph group_client["task_client"]
  node_client_shell["Nuxt App<br/>entrypoint<br/>[app.vue]"]
  node_client_auth_plugin["Auth Plugin<br/>state bootstrap<br/>[auth.ts]"]
  node_client_fetch["Fetch Wrapper<br/>api client<br/>[$fetch.ts]"]
  node_client_middleware["Route Guards<br/>navigation guard"]
  node_client_composables["Feature APIs<br/>feature layer"]
  node_client_pages["Pages<br/>routes"]
  node_client_layouts["Layouts<br/>shells"]
end

node_backend_server -->|"boots"| node_backend_app
node_backend_app -->|"uses"| node_backend_auth_mw
node_backend_app -->|"uses"| node_backend_authorize_mw
node_backend_app -->|"uses"| node_backend_validate_mw
node_backend_app -->|"mounts"| node_backend_auth
node_backend_app -->|"mounts"| node_backend_user
node_backend_app -->|"mounts"| node_backend_note
node_backend_app -->|"mounts"| node_backend_post
node_backend_app -->|"mounts"| node_backend_role
node_backend_app -->|"mounts"| node_backend_permission
node_backend_app -->|"mounts"| node_backend_menu
node_backend_auth -->|"returns"| node_backend_api_response
node_backend_user -->|"returns"| node_backend_api_response
node_backend_note -->|"returns"| node_backend_api_response
node_backend_post -->|"returns"| node_backend_api_response
node_backend_role -->|"returns"| node_backend_api_response
node_backend_permission -->|"returns"| node_backend_api_response
node_backend_menu -->|"returns"| node_backend_api_response
node_backend_auth -->|"uses"| node_backend_base_service
node_backend_user -->|"uses"| node_backend_base_service
node_backend_note -->|"uses"| node_backend_base_service
node_backend_post -->|"uses"| node_backend_base_service
node_backend_role -->|"uses"| node_backend_base_service
node_backend_permission -->|"uses"| node_backend_base_service
node_backend_menu -->|"uses"| node_backend_base_repo
node_backend_user -->|"uses"| node_backend_base_repo
node_backend_note -->|"uses"| node_backend_base_repo
node_backend_post -->|"uses"| node_backend_base_repo
node_backend_role -->|"uses"| node_backend_base_repo
node_backend_permission -->|"uses"| node_backend_base_repo
node_backend_auth -->|"persists"| node_backend_mongo
node_backend_user -->|"persists"| node_backend_mongo
node_backend_note -->|"persists"| node_backend_mongo
node_backend_post -->|"persists"| node_backend_mongo
node_backend_role -->|"persists"| node_backend_mongo
node_backend_permission -->|"persists"| node_backend_mongo
node_backend_menu -->|"persists"| node_backend_mongo
node_client_shell -->|"wraps"| node_client_layouts
node_client_shell -->|"hosts"| node_client_pages
node_client_pages -->|"guards"| node_client_middleware
node_client_pages -->|"uses"| node_client_composables
node_client_composables -->|"calls"| node_client_fetch
node_client_auth_plugin -->|"configures"| node_client_fetch
node_client_middleware -->|"reads"| node_client_auth_plugin
node_client_fetch -->|"requests"| node_backend_app
node_client_pages -->|"consumes"| node_backend_app

click node_backend_server "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/server.js"
click node_backend_app "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/app.js"
click node_backend_auth_mw "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/middleware/authenticate.js"
click node_backend_authorize_mw "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/middleware/authorize.js"
click node_backend_validate_mw "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/middleware/validate.js"
click node_backend_api_response "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/traits/ApiResponse.js"
click node_backend_base_repo "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/repositories/BaseRepository.js"
click node_backend_base_service "https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/services/BaseService.js"
click node_backend_auth "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/auth"
click node_backend_user "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/user"
click node_backend_note "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/note"
click node_backend_post "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/post"
click node_backend_role "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/role"
click node_backend_permission "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/permission"
click node_backend_menu "https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/menu"
click node_client_shell "https://github.com/zihaddi/note-taking-application/blob/main/task_client/app/app.vue"
click node_client_auth_plugin "https://github.com/zihaddi/note-taking-application/blob/main/task_client/app/plugins/auth.ts"
click node_client_fetch "https://github.com/zihaddi/note-taking-application/blob/main/task_client/app/utils/$fetch.ts"
click node_client_middleware "https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/middleware"
click node_client_composables "https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/composables"
click node_client_pages "https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/pages"
click node_client_layouts "https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/layouts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_backend_server,node_backend_app,node_backend_auth_mw,node_backend_authorize_mw,node_backend_validate_mw,node_backend_api_response,node_backend_base_repo,node_backend_base_service,node_backend_auth,node_backend_user,node_backend_note,node_backend_post,node_backend_role,node_backend_permission,node_backend_menu,node_backend_mongo toneBlue
class node_client_shell,node_client_auth_plugin,node_client_fetch,node_client_middleware,node_client_composables,node_client_pages,node_client_layouts toneAmber
```

## Components

### task_backend

Node.js/Express API with MongoDB persistence.

- [Server](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/server.js): entrypoint · Starts the backend process and connects to MongoDB. · `task_backend/src/server.js`
- [Express App](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/app.js): http app · Builds middleware, mounts routes, and handles errors. · `task_backend/src/app.js`
- [Auth Guard](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/middleware/authenticate.js): middleware · Verifies JWTs and attaches the current user. · `task_backend/src/middleware/authenticate.js`
- [Role Guard](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/middleware/authorize.js): middleware · Enforces user and admin access rules. · `task_backend/src/middleware/authorize.js`
- [Validate](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/middleware/validate.js): middleware · Collects and formats request validation failures. · `task_backend/src/middleware/validate.js`
- [ApiResponse](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/traits/ApiResponse.js): response trait · Standard JSON envelope for API responses. · `task_backend/src/traits/ApiResponse.js`
- [Base Repo](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/repositories/BaseRepository.js): data layer · Shared CRUD and pagination primitives. · `task_backend/src/repositories/BaseRepository.js`
- [Base Service](https://github.com/zihaddi/note-taking-application/blob/main/task_backend/src/services/BaseService.js): service base · Shared business-rule wrapper around repositories. · `task_backend/src/services/BaseService.js`
- [Auth](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/auth): module · Login and token issuing workflow. · `task_backend/src/modules/auth`
- [User](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/user): module · User management and profile access. · `task_backend/src/modules/user`
- [Note](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/note): module · Own-record note CRUD and access checks. · `task_backend/src/modules/note`
- [Post](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/post): module · Post CRUD and reporting views. · `task_backend/src/modules/post`
- [Role](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/role): module · Role management for access control. · `task_backend/src/modules/role`
- [Permission](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/permission): module · Permission management for access control. · `task_backend/src/modules/permission`
- [Menu](https://github.com/zihaddi/note-taking-application/tree/main/task_backend/src/modules/menu): module · Menu data exposed to the client. · `task_backend/src/modules/menu`
- **MongoDB**: database · Persistent store accessed through Mongoose models and aggregations.

### task_client

Nuxt 4/Vue 3 frontend that consumes the API.

- [Nuxt App](https://github.com/zihaddi/note-taking-application/blob/main/task_client/app/app.vue): entrypoint · Nuxt frontend application shell. · `task_client/app/app.vue`
- [Auth Plugin](https://github.com/zihaddi/note-taking-application/blob/main/task_client/app/plugins/auth.ts): state bootstrap · Restores auth state and token from cookie on load. · `task_client/app/plugins/auth.ts`
- [Fetch Wrapper](https://github.com/zihaddi/note-taking-application/blob/main/task_client/app/utils/$fetch.ts): api client · Injects bearer token and handles 401 redirects. · `task_client/app/utils/$fetch.ts`
- [Route Guards](https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/middleware): navigation guard · Enforces guest, user, and admin navigation rules. · `task_client/app/middleware`
- [Feature APIs](https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/composables): feature layer · Composable API modules for auth, users, notes, posts, menus, roles, and permissions. · `task_client/app/composables`
- [Pages](https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/pages): routes · Public, admin-panel, and user-panel views. · `task_client/app/pages`
- [Layouts](https://github.com/zihaddi/note-taking-application/tree/main/task_client/app/layouts): shells · Shared auth, admin, user, and default page shells. · `task_client/app/layouts`

## Connections

- Server → Express App: boots · Server initializes the Express application.
- Express App → Auth Guard: uses · Routes pass through JWT authentication.
- Express App → Role Guard: uses · Protected routes enforce role checks.
- Express App → Validate: uses · Requests are validated before controllers run.
- Express App → Auth: mounts · Auth routes are mounted on the app.
- Express App → User: mounts · User routes are mounted on the app.
- Express App → Note: mounts · Note routes are mounted on the app.
- Express App → Post: mounts · Post routes are mounted on the app.
- Express App → Role: mounts · Role routes are mounted on the app.
- Express App → Permission: mounts · Permission routes are mounted on the app.
- Express App → Menu: mounts · Menu routes are mounted on the app.
- Auth → ApiResponse: returns · Auth responses use the shared envelope.
- User → ApiResponse: returns · User responses use the shared envelope.
- Note → ApiResponse: returns · Note responses use the shared envelope.
- Post → ApiResponse: returns · Post responses use the shared envelope.
- Role → ApiResponse: returns · Role responses use the shared envelope.
- Permission → ApiResponse: returns · Permission responses use the shared envelope.
- Menu → ApiResponse: returns · Menu responses use the shared envelope.
- Auth → Base Service: uses · Business logic builds on the shared service base.
- User → Base Service: uses · Business logic builds on the shared service base.
- Note → Base Service: uses · Business logic builds on the shared service base.
- Post → Base Service: uses · Business logic builds on the shared service base.
- Role → Base Service: uses · Business logic builds on the shared service base.
- Permission → Base Service: uses · Business logic builds on the shared service base.
- Menu → Base Repo: uses · Repository operations reuse generic CRUD primitives.
- User → Base Repo: uses · Repository operations reuse generic CRUD primitives.
- Note → Base Repo: uses · Repository operations reuse generic CRUD primitives.
- Post → Base Repo: uses · Repository operations reuse generic CRUD primitives.
- Role → Base Repo: uses · Repository operations reuse generic CRUD primitives.
- Permission → Base Repo: uses · Repository operations reuse generic CRUD primitives.
- Auth → MongoDB: persists · Auth and user data ultimately resolve through MongoDB.
- User → MongoDB: persists · User records are stored in MongoDB.
- Note → MongoDB: persists · Notes are stored in MongoDB.
- Post → MongoDB: persists · Posts are stored in MongoDB.
- Role → MongoDB: persists · Roles are stored in MongoDB.
- Permission → MongoDB: persists · Permissions are stored in MongoDB.
- Menu → MongoDB: persists · Menus are stored in MongoDB.
- Nuxt App → Layouts: wraps · Pages are rendered inside shared layouts.
- Nuxt App → Pages: hosts · Nuxt file-based routes are served from pages.
- Pages → Route Guards: guards · Navigation rules run before page entry.
- Pages → Feature APIs: uses · Pages use composables for feature actions.
- Feature APIs → Fetch Wrapper: calls · Composable API modules use the shared fetch wrapper.
- Auth Plugin → Fetch Wrapper: configures · Auth plugin restores token used by fetch.
- Route Guards → Auth Plugin: reads · Guards depend on auth state from the client plugin.
- Fetch Wrapper → Express App: requests · Frontend API calls target the Express backend.
- Pages → Express App: consumes · Nuxt pages consume the backend API indirectly through composables.