Server API - Improved Architecture

This is a Node.js/Express server with improved architecture, better error handling, security features, and organized code structure.

🚀 Features

✅ Architecture Improvements

• Modular Structure: Better separation of concerns with organized folders
• Configuration Management: Centralized configuration with environment validation
• Error Handling: Custom error classes and comprehensive error middleware
• Logging: Winston-based logging with file rotation and request tracking
• Security: Helmet, rate limiting, CORS, and security headers
• Database: Improved MongoDB connection management with retry logic
• Authentication: Enhanced JWT-based auth with account locking and login attempts
• Validation: Comprehensive input validation with Joi
• API Versioning: Proper API versioning structure

🔒 Security Features

• Helmet for security headers
• Rate limiting to prevent abuse
• Account locking after failed login attempts
• Password hashing with bcrypt
• JWT token management with proper expiration
• Input validation and sanitization
• CORS configuration

📁 Project Structure

server/
├── config/                 # Configuration files
│   ├── index.js           # Main configuration
│   └── database.js        # Database connection manager
├── controllers/           # Request handlers
│   └── authController.js  # Authentication controller
├── middleware/            # Custom middleware
│   ├── index.js          # Middleware setup
│   ├── auth.js           # Authentication middleware
│   └── errorHandler.js   # Error handling middleware
├── models/               # Database models
│   └── User.js          # User model with enhanced features
├── routes/              # Route definitions
│   ├── index.js        # Main router
│   ├── auth.js         # Authentication routes
│   ├── users.js        # User routes
│   ├── tasks.js        # Task routes
│   └── companies.js    # Company routes
├── utils/              # Utility functions
│   ├── errors.js       # Custom error classes
│   ├── logger.js       # Logging configuration
│   └── jwt.js          # JWT service
├── validators/         # Input validation
│   └── authValidator.js # Authentication validation
├── logs/              # Log files (auto-created)
├── index.js           # Main server file
└── package.json       # Dependencies and scripts

🛠️ Installation & Setup

1. Install Dependencies

   npm install

2. Environment Configuration Create a .env file in the root directory:

   # Server Configuration
   NODE_ENV=development
   PORT=6000
   
   # Database Configuration
   MONGO_URI=mongodb://localhost:27017/your-database-name
   DB_NAME=your-database-name
   
   # JWT Configuration
   ACCESS_TOKEN_SECRET=your-super-secret-access-token-key-here
   REFRESH_TOKEN_SECRET=your-super-secret-refresh-token-key-here
   ACCESS_TOKEN_EXPIRY=15m
   REFRESH_TOKEN_EXPIRY=7d
   
   # Security Configuration
   BCRYPT_ROUNDS=12
   
   # Rate Limiting
   RATE_LIMIT_WINDOW_MS=900000
   RATE_LIMIT_MAX=100
   
   # CORS Configuration
   CORS_ORIGIN=https://www.danhsachcongviec.site
   
   # Logging Configuration
   LOG_LEVEL=info
   LOG_FILE=logs/app.log

3. Start the Server

   # Development mode
   npm run dev
   
   # Production mode
   npm start

📚 API Documentation

Base URL

• Development: http://localhost:6000
• API Version: /api/v1

Health Check

• GET /health - Server health status

Authentication Endpoints

• POST /api/v1/auth/register - Register new user
• POST /api/v1/auth/login - User login
• POST /api/v1/auth/refresh-token - Refresh access token
• POST /api/v1/auth/logout - User logout (requires auth)
• GET /api/v1/auth/me - Get current user profile (requires auth)
• PATCH /api/v1/auth/update-password - Update password (requires auth)
• POST /api/v1/auth/verify-token - Verify token validity (requires auth)

Example Requests

Register User

curl -X POST http://localhost:6000/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "johndoe",
    "email": "john@example.com",
    "password": "SecurePass123!",
    "confirmPassword": "SecurePass123!"
  }'

Login User

curl -X POST http://localhost:6000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john@example.com",
    "password": "SecurePass123!"
  }'

🔧 Key Improvements Made

1. Configuration Management

• Centralized configuration in config/index.js
• Environment variable validation
• Database connection management with retry logic

2. Error Handling

• Custom error classes for different error types
• Comprehensive error middleware with proper logging
• Development vs production error responses

3. Security Enhancements

• Account locking after failed login attempts
• Rate limiting to prevent abuse
• Security headers with Helmet
• Enhanced password validation
• JWT token management improvements

4. Logging System

• Winston-based logging with file rotation
• Request tracking with unique request IDs
• Different log levels for different environments
• Structured logging with metadata

5. Database Improvements

• Connection pooling and retry logic
• Graceful shutdown handling
• Enhanced User model with validation
• Proper indexing for performance

6. Code Organization

• Better separation of concerns
• Modular middleware setup
• Clean controller architecture
• Proper route organization with versioning

7. Validation System

• Comprehensive input validation with Joi
• Custom validation messages
• Middleware-based validation

🚀 Development Scripts

npm run dev      # Start development server with nodemon
npm start        # Start production server
npm test         # Run tests (to be implemented)
npm run lint     # Run linting (to be implemented)
npm run build    # Build process (to be implemented)

📝 Logging

Logs are automatically created in the logs/ directory:

• app.log - All application logs
• error.log - Error logs only

In development mode, logs are also displayed in the console with colors.

🔒 Security Features

1. Rate Limiting: 100 requests per 15 minutes per IP
2. Account Locking: Account locked for 2 hours after 5 failed login attempts
3. Password Security: Strong password requirements with bcrypt hashing
4. JWT Security: Proper token expiration and validation
5. Headers Security: Helmet middleware for security headers
6. Input Validation: Comprehensive validation for all inputs

🤝 Contributing

1. Follow the existing code structure
2. Add proper error handling
3. Include logging for important operations
4. Write validation for new endpoints
5. Update documentation

📄 License

This project is licensed under the ISC License.