Backend / API

Jobnest API — job board backend

REST API for job postings and applications built with Express and TypeScript. Mongoose models link users to jobs they create and jobs they apply to, with JWT-based sessions and role checks for admin-only user deletion. Request bodies for registration and login are validated with Joi; passwords are hashed with bcrypt. Routes are grouped under /api and /api/auth. No OpenAPI spec or health-check route is present in the repository.

Source code

API surface

Jobnest API — job board backend

  • GET/

    Returns a short welcome JSON message.

  • POST/api/auth/register

    Create a user account with validated registration fields.

  • POST/api/auth/login

    Authenticate and issue a JWT (cookie and JSON body).

  • POST/api/auth/logout

    Clear the auth cookie for the signed-in user.

  • GET/api/auth/users

    List users (authenticated).

  • GET/api/auth/users/:id

    Fetch one user by id (authenticated).

  • DELETE/api/auth/users/:id

    Delete a user by id (authenticated admin only).

  • GET/api/jobs

    List all jobs with sorting and populated relations.

  • GET/api/jobs/:id

    Fetch a single job by id.

  • POST/api/jobs

    Create a job for the authenticated user.

  • PUT/api/jobs/:id

    Update a job if the caller is the creator.

  • DELETE/api/jobs/:id

    Delete a job if the caller is the creator.

  • GET/api/jobs/user/created

    List jobs created by the authenticated user.

  • GET/api/jobs/user/applied

    List jobs the authenticated user has applied to.

  • POST/api/jobs/apply/:id

    Record an application to a job for the authenticated user.

Architecture

  1. 1

    Express app in src/index.ts mounts auth and job routers and connects Mongoose when MONGODB_URI is set.

  2. 2

    HTTP routes live under src/routers/authRouter.ts and src/routers/jobRouter.ts (prefixes /api/auth and /api).

  3. 3

    Controllers in src/controllers/* implement handlers and call Mongoose models User and Job.

  4. 4

    Joi schemas in src/utils/validator.ts validate auth payloads; bcrypt hashing in src/utils/hashing.ts.

  5. 5

    isAuthenticated verifies JWT from cookie or Bearer header and attaches req.user; isAdmin gates admin-only deletes.

  6. 6

    No dedicated API versioning segment (e.g. /v1); public surface uses /api and /api/auth.