Backend Development: Node.js & Express APIs

// Importing native Node.js core module (ESM format)
import http from 'node:http';

// Create bare-bones HTTP server instance
const server = http.createServer((req, res) => {
  // Incoming request metadata
  const { method, url } = req;
  console.log(`[${new Date().toISOString()}] ${method} ${url}`);

  // Manual routing and header dispatch
  if (url === '/api/health' && method === 'GET') {
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ status: 'healthy', uptime: process.uptime() }));
  } else {
    res.writeHead(404, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ error: 'Endpoint Not Found' }));
  }
});

const PORT = 3000;
server.listen(PORT, () => {
  console.log(`🚀 Native Node HTTP Server listening on http://localhost:${PORT}`);
});

import express from 'express';

const app = express();
const PORT = process.env.PORT || 5000;

// Core Built-in Middleware
app.use(express.json({ limit: '10kb' })); // Parse application/json bodies (guard against payload bombs)
app.use(express.urlencoded({ extended: true }));

// Diagnostic Health Check (Used by Kubernetes / AWS Load Balancers)
app.get('/healthz', (req, res) => {
  res.status(200).json({
    status: 'OK',
    timestamp: new Date().toISOString(),
    memoryUsageMB: Math.round(process.memoryUsage().heapUsed / 1024 / 1024)
  });
});

// Start Listening
const server = app.listen(PORT, () => {
  console.log(`✅ Enterprise Express Server running in ${process.env.NODE_ENV || 'development'} on port ${PORT}`);
});

// Graceful Shutdown Orchestrator
function shutdownGracefully(signal) {
  console.log(`\n🛑 Received ${signal}. Closing HTTP server...`);
  server.close(() => {
    console.log('🔒 Closed out remaining connections. Exiting process safely.');
    process.exit(0);
  });
}

process.on('SIGTERM', () => shutdownGracefully('SIGTERM'));
process.on('SIGINT', () => shutdownGracefully('SIGINT'));

// Route: GET /api/v1/clusters/:clusterId/nodes?status=active&limit=10
app.get('/api/v1/clusters/:clusterId/nodes', (req, res) => {
  // 1. Extract Route Parameters
  const { clusterId } = req.params;

  // 2. Extract Query String Parameters with sensible fallbacks
  const statusFilter = req.query.status || 'all';
  const limit = parseInt(req.query.limit, 10) || 20;

  // 3. Inspect Headers
  const clientVersion = req.get('X-Client-Version') || 'legacy';

  // 4. Dispatch Structured RESTful JSON Response
  return res.status(200).json({
    success: true,
    meta: {
      clusterId,
      statusFilter,
      limit,
      clientVersion,
      count: 2
    },
    data: [
      { id: 'node-1', name: 'edge-east', status: 'active' },
      { id: 'node-2', name: 'edge-west', status: 'active' }
    ]
  });
});

import { Router } from 'express';

const router = Router();

// Route Chaining: Group HTTP verbs targeting the same URI path
router.route('/')
  .get((req, res) => {
    res.status(200).json({ nodes: [] });
  })
  .post((req, res) => {
    res.status(201).json({ message: 'Node provisioned successfully' });
  });

router.route('/:id')
  .get((req, res) => {
    res.status(200).json({ id: req.params.id, status: 'online' });
  })
  .delete((req, res) => {
    res.status(204).send(); // 204 No Content for successful deletion
  });

export default router;

// In main app.js:
// app.use('/api/v1/nodes', nodesRouter);

// 1. Latency Profiler Middleware: calculates total execution duration
export const requestTimer = (req, res, next) => {
  const startHighResTime = process.hrtime();

  // Listen to response 'finish' event emitted when headers/body are flushed
  res.on('finish', () => {
    const diff = process.hrtime(startHighResTime);
    const durationMs = (diff[0] * 1e3 + diff[1] * 1e-6).toFixed(2);
    console.log(`⚡ [HTTP] ${req.method} ${req.originalUrl} - Status: ${res.statusCode} (${durationMs}ms)`);
  });

  next(); // Pass execution to next middleware in stack
};

// 2. API Key Guard Middleware: validates custom client header
export const requireApiKey = (req, res, next) => {
  const clientKey = req.headers['x-api-key'];
  
  if (!clientKey || clientKey !== process.env.INTERNAL_API_KEY) {
    // Terminate cycle early with 403 Forbidden
    return res.status(403).json({
      error: 'Forbidden',
      message: 'Invalid or missing X-API-Key header.'
    });
  }

  next(); // Key is valid; proceed!
};

import dotenv from 'dotenv';

// Load .env file into process.env
dotenv.config();

// Array of mandatory configuration keys
const REQUIRED_ENV_VARS = [
  'PORT',
  'NODE_ENV',
  'JWT_SECRET',
  'DATABASE_URL'
];

// Validate presence
const missingVars = REQUIRED_ENV_VARS.filter(key => !process.env[key]);

if (missingVars.length > 0) {
  console.error(`❌ FATAL: Missing mandatory environment variables: ${missingVars.join(', ')}`);
  console.error('Check your .env file against .env.example.');
  process.exit(1); // Exit immediately with error code
}

export const config = {
  port: parseInt(process.env.PORT, 10) || 5000,
  env: process.env.NODE_ENV,
  jwtSecret: process.env.JWT_SECRET,
  databaseUrl: process.env.DATABASE_URL
};

// 1. Custom Operational Error Class
export class AppError extends Error {
  constructor(message, statusCode) {
    super(message);
    this.statusCode = statusCode;
    this.status = `${statusCode}`.startsWith('4') ? 'fail' : 'error';
    this.isOperational = true; // Distinguishes predictable business errors from server bugs
    Error.captureStackTrace(this, this.constructor);
  }
}

// 2. Async Controller Wrapper (Eliminates repetitive try/catch blocks)
export const asyncHandler = (fn) => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next);
};

// 3. Centralized 4-Argument Error Middleware
export const globalErrorHandler = (err, req, res, next) => {
  err.statusCode = err.statusCode || 500;
  err.status = err.status || 'error';

  if (process.env.NODE_ENV === 'development') {
    // Developer Mode: Full debug stack trace
    return res.status(err.statusCode).json({
      status: err.status,
      message: err.message,
      stack: err.stack,
      error: err
    });
  }

  // Production Mode: Sanitize and protect internal server architecture
  if (err.isOperational) {
    return res.status(err.statusCode).json({
      status: err.status,
      message: err.message
    });
  }

  // Unknown programmer bug: Don't leak details
  console.error('💥 UNHANDLED SYSTEM ERROR:', err);
  return res.status(500).json({
    status: 'error',
    message: 'Something went wrong on the server.'
  });
};

import bcrypt from 'bcrypt';

const SALT_ROUNDS = 12;

// 1. Registration: Hash plain-text password before saving to database
export async function hashPassword(plainTextPassword) {
  // Automatically generates random salt and calculates hash
  const hashedPassword = await bcrypt.hash(plainTextPassword, SALT_ROUNDS);
  return hashedPassword;
}

// 2. Login: Compare incoming password attempt against stored database hash
export async function verifyPassword(incomingPassword, storedHash) {
  // Uses constant-time comparison to prevent timing attacks
  const isMatch = await bcrypt.compare(incomingPassword, storedHash);
  return isMatch;
}

import jwt from 'jsonwebtoken';

const JWT_SECRET = process.env.JWT_SECRET || 'super-secret-key-change-in-prod';

// 1. Generate Signed JWT Token
export function generateAuthToken(user) {
  return jwt.sign(
    { 
      userId: user.id, 
      email: user.email, 
      role: user.role 
    },
    JWT_SECRET,
    { expiresIn: '2h' } // Token automatically expires in 2 hours
  );
}

// 2. Route Protection Middleware
export function authenticateToken(req, res, next) {
  // Extract from 'Authorization: Bearer <token>' header
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.startsWith('Bearer ') 
    ? authHeader.split(' ')[1] 
    : null;

  if (!token) {
    return res.status(401).json({
      error: 'Unauthorized',
      message: 'Access token is missing or malformed.'
    });
  }

  // Verify signature and expiration
  jwt.verify(token, JWT_SECRET, (err, decodedPayload) => {
    if (err) {
      return res.status(403).json({
        error: 'Forbidden',
        message: err.name === 'TokenExpiredError' 
          ? 'Token expired. Re-authenticate.' 
          : 'Invalid token signature.'
      });
    }

    // Attach decoded user identity to request object
    req.user = decodedPayload;
    next(); // Proceed to protected route controller
  });
}

import express from 'express';
import jwt from 'jsonwebtoken';
import bcrypt from 'bcrypt';

const app = express();
app.use(express.json());

const JWT_SECRET = 'devascent-telemetry-secret-key-2026';

// In-Memory Mock Databases
const usersDb = [];
const telemetryNodes = [
  { id: 'node-1', name: 'us-east-core', throughput: 14200 },
  { id: 'node-2', name: 'eu-west-edge', throughput: 8900 }
];

// --- Authentication Routes ---

// 1. User Registration
app.post('/api/v1/auth/register', async (req, res, next) => {
  try {
    const { email, password } = req.body;
    if (!email || !password || password.length < 6) {
      return res.status(400).json({ error: 'Email and 6+ character password required.' });
    }

    const existingUser = usersDb.find(u => u.email === email);
    if (existingUser) {
      return res.status(409).json({ error: 'User already registered.' });
    }

    const hashedPassword = await bcrypt.hash(password, 10);
    const newUser = { id: `usr_${Date.now()}`, email, password: hashedPassword, role: 'engineer' };
    usersDb.push(newUser);

    return res.status(201).json({ message: 'Account created successfully.', userId: newUser.id });
  } catch (err) {
    next(err);
  }
});

// 2. User Login
app.post('/api/v1/auth/login', async (req, res, next) => {
  try {
    const { email, password } = req.body;
    const user = usersDb.find(u => u.email === email);
    
    if (!user || !(await bcrypt.compare(password, user.password))) {
      return res.status(401).json({ error: 'Invalid email or password credentials.' });
    }

    const token = jwt.sign({ userId: user.id, role: user.role }, JWT_SECRET, { expiresIn: '1h' });
    return res.status(200).json({ token, expiresInSeconds: 3600 });
  } catch (err) {
    next(err);
  }
});

// --- Protected Telemetry CRUD Resource ---

// Auth Guard Middleware
const authGuard = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Missing or malformed Authorization Bearer token.' });
  }
  try {
    req.user = jwt.verify(authHeader.split(' ')[1], JWT_SECRET);
    next();
  } catch (err) {
    return res.status(403).json({ error: 'Invalid or expired token.' });
  }
};

// GET All Nodes (Protected)
app.get('/api/v1/telemetry/nodes', authGuard, (req, res) => {
  res.status(200).json({ totalNodes: telemetryNodes.length, nodes: telemetryNodes });
});

// POST Create Node (Protected)
app.post('/api/v1/telemetry/nodes', authGuard, (req, res) => {
  const { name, throughput } = req.body;
  if (!name) return res.status(400).json({ error: 'Node name is required.' });

  const newNode = { id: `node-${telemetryNodes.length + 1}`, name, throughput: throughput || 0 };
  telemetryNodes.push(newNode);
  res.status(201).json({ message: 'Node created', node: newNode });
});

// Centralized Error Handler Middleware
app.use((err, req, res, next) => {
  console.error('Server Error:', err);
  res.status(500).json({ error: 'Internal Server Error' });
});

const PORT = 5000;
app.listen(PORT, () => console.log(`🚀 Telemetry API Engine listening on port ${PORT}`));