Backend / API

Core Post Backend — blog & engagement API

Versioned Express REST API (`/api/v1`) for posts, nested comments, likes, and bookmarks on MongoDB. Users register and verify email via OTP email (Nodemailer); JWT protects mutations, with an extra database-backed verified-email check for write operations. List endpoints support query pagination (`page`), and auth-sensitive routes use express-rate-limit. Vitest and Supertest cover HTTP behavior against MongoDB when available.

Source code

API surface

Core Post Backend — blog & engagement API

  • GET/

    JSON hello / basic liveness response.

  • POST/api/v1/auth/register

    Create account (rate-limited).

  • POST/api/v1/auth/login

    Authenticate and obtain JWT (rate-limited).

  • POST/api/v1/auth/logout

    Logout for authenticated user.

  • PATCH/api/v1/auth/verify-account

    Confirm email with verification code (rate-limited).

  • GET/api/v1/posts

    Paginated list of posts (`page` query).

  • GET/api/v1/posts/:_id

    Single post; optional JWT enriches liked/bookmarked-by-me flags.

  • POST/api/v1/posts/create

    Create post (authenticated + verified).

  • GET/api/v1/posts/:postId/comments

    Paginated comments for a post.

  • POST/api/v1/posts/:postId/like

    Like a post (authenticated + verified).

  • GET/api/v1/posts/:postId/likes/count

    Public like count for a post.

  • PATCH/api/v1/users/me

    Update current user profile (authenticated).

  • GET/api/v1/users/me/bookmarks

    Paginated saved posts for current user.

  • GET/api/v1/users/:id

    User profile with posts.

Architecture

  1. 1

    `createApp()` in src/app.ts mounts versioned routers under `/api/v1` and applies helmet, compression, CORS, cookie-parser, json/urlencoded parsers.

  2. 2

    Routers in src/routers/* delegate to controllers in src/controllers/*.

  3. 3

    Controllers call services in src/services/*; Joi validation is centralized in src/utils/validator.ts.

  4. 4

    Mongoose models in src/models/* persist to MongoDB; index.ts connects via MONGODB_URI then listens.

  5. 5

    Cross-cutting: asyncHandler, AppError + errorHandler, isAuthenticated / optionalAuthenticated / isVerified, and rate limiters on auth routes.

  6. 6

    No OpenAPI/Swagger spec or `.github/workflows` in repo; tests use Vitest + Supertest in src/app.test.ts.