Robust Node.js REST API built with TypeScript, Express.js, and MongoDB.
It powers the Shoishob platform, handling authentication, payments, and data access with production-grade security and code quality tooling.

Shoihob-backend follows a modular architecture with distinct components that handle specific business domains. The system is built using Node.js with Express framework and TypeScript, connecting to a MongoDB database for data persistence and integrating with SSLCommerz for payment processing.

The system follows a layered architecture pattern that promotes separation of concerns and maintainability.

This layer is responsible for handling HTTP requests and routing them to appropriate business logic.

• Routes: Define API endpoints and connect them to corresponding controllers.
• Controllers: Manage the request/response lifecycle and delegate core operations to services.
• Middleware: Intercepts and processes requests before they reach the controller (e.g., authentication, input validation, error handling).

The API is organized as a RESTful service with versioned endpoints. All routes are prefixed with /api/v1 and are organized by functionality. The Express router maps incoming requests to the appropriate controller functions.

This layer contains Service Classes that encapsulate the core logic of the application. It:

• Implements domain-specific rules and use cases.
• Coordinates actions involving multiple models or external services.
• Keeps controllers lean and focused on the request flow.

Responsible for communicating with the database using Mongoose. It includes:

• Schemas & Models: Define data structures and constraints for MongoDB collections.
• CRUD Operations: Abstracts direct database operations and enforces a consistent access pattern.

The Shoihob-backend is structured into several key modules, each responsible for a distinct business function. This modular approach ensures better scalability, maintainability, and separation of concerns.

📁 Source Root: src/app/routes/index.ts

Each module adheres to a standardized internal structure, which improves code readability, collaboration, and scalability:

src/
 └── app/
      └── [module-name]/
           ├── controllers/     # Handles HTTP request/response logic
           ├── services/        # Contains core business logic
           ├── models/          # Mongoose schemas and data access definitions
           ├── routes/          # Defines REST API endpoints
           └── validators/      # Joi or Zod schemas for request validation (if any)

The following diagram illustrates how a typical request flows through the system:

The system implements JWT (JSON Web Token) based authentication and role-based authorization.

The system uses MongoDB as its database and Mongoose for object data modeling. The following diagram illustrates the key data models and their relationships:

The system implements a global error handling mechanism to ensure consistent error responses across all API endpoints.

The system integrates with external services, particularly for payment processing:

src/
├── app/
│   ├── module/
│   │   ├── User/
│   │   │   ├── User.controller.ts
│   │   │   ├── User.service.ts
│   │   │   ├── User.model.ts
│   │   │   ├── User.interface.ts
│   │   │   ├── User.constant.ts
│   │   │   └── User.validation.ts
│   │   └── Payment/  (etc.)
│   └── common/         # shared middlewares & utils
├── config/             # mongo, sslcommerz, etc.
├── constance/          # enumerations & magic numbers
├── errors/             # ApiError, global handler
├── shared/             # helpers (catchAsync, sendResponse, pick)
├── app.ts              # Express app
└── server.ts           # entry point (env, DB connect, graceful shutdown)

• Node.js 20.4+ (LTS recommended)
• Yarn 4.9+ or npm 10+
• MongoDB (Atlas or local)
• SSL Commerz merchant account

# 1. Clone
git clone https://github.com/tareksabbir/shoishob-backend.git
cd shoishob-backend

# 2. Install
yarn install        # or: npm ci

# 3. Configure
cp .env.example .env   # fill real secrets

# 4. Run dev server (auto-restart, TS support)
yarn start

Visit [http://localhost:5000 /health](http://localhost:5000 /health) → should return {status:"OK"}.

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN yarn install --prod
COPY . .
RUN yarn build
CMD ["node", "dist/server.js"]

docker build -t shoishob-api .
docker run -p 5000:5000 --env-file .env shoishob-api

# .github/workflows/deploy.yml
name: Deploy
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: yarn install --immutable
      - run: yarn test # add tests!
      - run: yarn build
      # TODO: docker push / ssh deploy / render.com deploy…

• Unit tests: pure functions, services (jest, ts-jest)
• Integration tests: Express routes with in-memory Mongo (supertest, mongodb-memory-server)
• E2E: Postman/Newman or Playwright against staging

Add a __tests__/ folder mirroring src/. Aim for 80%+ coverage on business logic.

1. Install: yarn add swagger-ui-express swagger-jsdoc
2. Define specs in docs/openapi.yaml (see sample below).
3. Mount swagger UI in app.ts:

import swaggerUi from 'swagger-ui-express'
import specs from './docs'

app.use('/docs', swaggerUi.serve, swaggerUi.setup(specs))

Now GET /docs shows live API reference.

• helmet() HTTP headers
• express-rate-limit 100 req/15 min per IP
• .env never committed (git ignored)
• Mongo connection retries, graceful shutdown
• Mongoose ObjectId sanitization (mongoose-unique-validator)
• Unit tests for auth & permissions
• TODO: Enable CSRF protection for cookie-based auth
• TODO: Turn on log redaction for sensitive fields

import { ApiError } from './errors'
import httpStatus from 'http-status'

throw new ApiError(httpStatus.BAD_REQUEST, 'Email already exists')

All thrown ApiErrors propagate to the global handler → client gets a consistent JSON error envelope:

{
  "success": false,
  "message": "Email already exists",
  "statusCode": 400,
  "stack": "..." // only in dev
}

1. Client hits POST /api/v1/payments/init with cart & customer info.
2. Server creates transaction, gets GatewayPageURL, returns to client.
3. Client redirects user → SSL Commerz hosted checkout.
4. After payment, SSL Commerz calls IPN → POST /api/v1/payments/ipn.
5. We verify signature, update order status, trigger webhooks or emails.
6. User redirected back to our success or cancel page.

• main – always deployable
• dev – integration branch
• feature/xyz, bugfix/123 – short-lived topic branches

Commit messages follow Conventional Commits:

feat(user): add password reset
fix(payment): correct amount rounding

1. Fork & create a topic branch: git checkout -b feat/cool-stuff
2. Run yarn lint-prettier and add tests.
3. Commit & push, then open a Pull Request.

All PRs trigger CI: lint, tests, type-check.

• ☐ Refresh-token rotation & logout-all
• ☐ 2-FA (TOTP)
• ☐ Soft-delete + audit logs
• ☐ GraphQL gateway (stretch goal)

MIT

Md. Tarek Rahman Sabbir – https://github.com/tareksabbir