Phase 5Days 52-63

Node + Express + REST APIs

Build production-shaped backends

Phase Goal

Build a production-shaped REST API with validation, file uploads, caching, rate limiting, structured logging, proper error handling — and both manual (Postman) and automated (Vitest + Supertest) tests.

Progress

Notes

Open the written lectures for this course before checking off the phase topics.

Projects

Museum Collection API (rehearsal)

Food-Safety Inspection API — DEPLOYED & TESTED

Day 52: Node, Modules, Package Managers

V8 + libuv + event loop (backend lens)Single-threaded JS, multi-threaded I/Oprocess, globals, the standard library

package.json "type": "module" for ESMimport / export, top-level awaitWhen you'll still see require

name, version (semver), type, exportsdependencies vs devDependencies vs peerDependenciesengines fieldscripts (npm run, predefined names)

npm ships with Node and is the course standardYarn is fine on other teams; use one manager and commit its lockfilenpm install / uninstalllockfiles never go in .gitignore

fs/promises (readFile, writeFile, readdir)path (join, resolve, basename, extname)url, os, crypto basics

Day 53: Env, CLI, Dev Loops

process.envdotenv for local .env files.env, .env.local, .env.exampleNever commit secrets — .gitignore .envValidate env at boot with Zod

Read process.argvcommander.js for ergonomic CLIsBuild a "wc-clone" that counts lines/words/chars

tsx for running TS directlytsx watch for restart-on-savenodemon (the older alternative)

src/, dist/, tsconfig for Node + ESMtsconfig: target ES2022, module NodeNext, moduleResolution NodeNextBuild script + start script

Day 54: Express Basics

node:http createServerSee req.method, req.url, req.headersres.writeHead, res.endJust enough to appreciate Express

npm install express @types/expressapp.get / post / put / patch / deleteRoute params: /users/:idQuery strings: req.queryapp.listen(port)

req.params, req.query, req.body, req.headersres.json, res.status, res.send, res.redirectChain status: res.status(201).json(data)

app.use(express.json()) for JSON bodiesexpress.static for serving filesA first /health endpoint

200 OK, 201 Created, 204 No Content400 Bad Request, 401/403, 404 Not Found409 Conflict, 422 Unprocessable, 429 Too Many500 Internal — memorize ~10, look up the rest

Day 55: Middleware & Error Handling

(req, res, next) signatureCall next() to continue, send response to short-circuitOrder of app.use matters

express.json, express.urlencodedcorsmorgan or pino-http for request logs

Express 5 catches async errors automaticallyIn Express 4 use express-async-errors or wrap handlersCentralized error middleware: (err, req, res, next)Consistent error JSON shape

requestId middleware (uuid)requireAuth stub middleware (real one Phase 7)logger middleware

Day 56: REST API Design

Nouns, plural: /users, /notesHierarchy: /users/:id/notesAvoid verbs in URLs (use HTTP methods)

POST → 201 + Location headerGET → 200 or 404PUT/PATCH → 200 or 204DELETE → 204Idempotency: which verbs are safe to retry

Page + limit OR cursor-basedFiltering: /notes?tag=urgentSorting: /notes?sort=-createdAtAlways return total count + next page hint

Cache-Control: max-age, no-store, private vs publicETag + If-None-Match → 304 Not Modified (save bandwidth)Last-Modified + If-Modified-SinceWhere a CDN/edge cache fits vs app cache (Redis later, Phase 13)

URL: /v1/notes (most common)Header: Accept-VersionPick one and document it

Day 57: Validation with Zod

TS only protects compile-timeNetwork input is always untrustedValidate body, params, query, headers

z.object, z.string, z.number, z.arrayRefinements: .min, .max, .email, .uuid.transform for parsing query strings.coerce for "string-to-number" body fields

Reusable middleware: validate({ body?, params?, query? })Returns 422 with field errorsStores parsed result on req.validated

z.infer<typeof schema>Single source of truth for shape + validationShare schemas with the frontend later

Day 58: File Uploads

Why JSON can't carry filesBoundary-encoded bodyBrowser sends via <form enctype> or FormData

npm install multerMemory storage vs disk storageupload.single / array / fieldsFile limits: size, count

cloudinary.v2.uploader.upload_streamPipe Multer buffer → CloudinaryStore the secure_url in DB onlyFolder + public_id naming convention

Whitelist MIME types (don't trust extension)Magic-byte sniff for real safety (file-type)Max size; reject early

Day 59: Security Baseline

helmet() sets sensible default headerscors({ origin: ["https://app.x.com"], credentials: true })Never origin: "*" with credentials

express-rate-limit middlewarePer IP for anonymous, per user for authedStrict limits on auth routes (brute force)Store in memory now, Redis in Phase 13

Never string-concat queriesNoSQL injection in Mongo (preview)SQL injection & why parameterized queries / ORMs prevent it (Phase 6 Postgres)Sanitize inputs that hit your DB

.env never in git.env.example committed (with placeholders)Rotate secrets if leaked

Broken access control (IDOR)Crypto failuresInjectionJust enough to know what to look up

Day 60: Structured Logging — Pino

console.log is for tutorialsJSON logs are searchable, aggregatableLevels: trace/debug/info/warn/error/fatal

npm install pino pino-http pino-prettySingle shared logger modulepino-pretty in dev only

pino-http middlewarerequestId via header X-Request-Id (or generate)Attach to req.log for child loggers

Hosting: Railway, Render, Fly stream stdoutLog shippers: Better Stack (Logtail), Datadog, AxiomWire these into your next production project

Day 61: API Testing — Manual + Automated

Postman: full-featured, share-friendlyThunder Client: lives in VS Codehttpie: terminal-native, scriptableOne collection per project, folder per resource, commit the JSON

pm.test("status is 200", ...)Chain requests via env vars (login → save token)Run the whole collection headless (Newman CLI)baseUrl/token variables per environment

Export the Express app (don't listen) so tests can import itsupertest: await request(app).post("/notes").send({...}).expect(201)Assert status, body shape, and headersTest the unhappy paths: 422 on bad input, 404 on missing, 401 unauthorizedGroup with describe/it; run with npm run test

In-memory / ephemeral store or a throwaway test DBbeforeEach reset so tests don't leak stateMock Cloudinary/email so tests are hermeticWhat belongs in CI vs local (Phase 15 wires the pipeline)

Day 62: Production API Design Review

POST /notes, GET /notes (paginated + search), GET /:id, PATCH /:id, DELETE /:idPOST /notes/:id/attachment (Cloudinary)Zod validation, helmet, CORS, rate limit on writesETag on GET /:id, Pino logs, request IDsIn-memory store for now (Mongo & Postgres land Phase 6)

Project structure: src/routes, src/middleware, src/serviceshelmet, cors, json, pino-http wiredError handler middleware ready

In-memory Map<string, Note>Each endpoint with Zod validationPagination + simple title search

Project

Museum Collection API (rehearsal)

Production-shaped Express rehearsal build. Zod-validated, rate-limited, cached, logged, and structured for attachment uploads. Day 63 transfers the architecture to the different users, resources, states, and disclosure rules of food-safety inspections.

Day 63: Project — Food-Safety Inspection API

Multer + CloudinarySize limit 5MB, image MIME whitelistUpdate incident record with attachment URL

AppError class with statusCode + codeError middleware emits { error: { code, message, details } }Map Zod errors → 422 with field list

Vitest + Supertest across every endpointHappy path + 422 + 404 + rate-limit (429)Green suite before you deploy — your regression net

README with cURL examples; Postman collection under /docsSet env vars in dashboardSmoke test from Postman against production

Capstone

Food-Safety Inspection API — DEPLOYED & TESTED

Build an API for registering establishments, recording checklist findings and evidence, and moving inspections through explicit review states. Use Node, Express, TypeScript, Zod, Pino, and Vitest/Supertest; expose separate public/internal views, structured audit events, rate limits, and OpenAPI-backed documentation.

Public incident feed with severity, affected service, timeline entries, and clear status transitions.
Internal authenticated update endpoint with Zod validation, request IDs, structured logs, and rate limits.
OpenAPI documentation, integration tests, and a deployed health endpoint.

Phase Complete!

After this phase, you'll be able to:

Express + TypeScript with proper middleware patterns
REST API design: status codes, pagination, caching (ETag/Cache-Control), versioning
Zod validation everywhere
File uploads via Multer + Cloudinary
Helmet, CORS, rate limiting, OWASP awareness
Pino structured logs with request IDs
Manual (Postman/Newman) AND automated (Vitest + Supertest) API tests

You can ship a real, tested API to production. Time to give it a database — two of them.

Back to all phases

Phase Goal

Day 52: Node, Modules, Package Managers

Node runtime

ESM vs CommonJS

package.json deep dive

npm vs yarn

Standard library tour

Day 53: Env, CLI, Dev Loops

Environment variables

A tiny CLI

Dev loops

Project scaffold

Day 54: Express Basics

HTTP without a framework (10 lines)

Express app

req & res essentials

JSON & static files

Pick the right status code

Day 55: Middleware & Error Handling

The middleware contract

Built-in / standard middleware

Async error handling

Writing your own middleware

Day 56: REST API Design

Resource modeling

Verbs to status code matrix

Pagination, filtering, sorting

HTTP caching & conditional requests

API versioning

Day 57: Validation with Zod

Why runtime validation

Zod schemas

validate(schema) middleware

Type-safe handlers

Day 58: File Uploads

multipart/form-data

Multer

Server-side Cloudinary upload

Validation & limits

Day 59: Security Baseline

helmet + CORS configured properly

Rate limiting

Injection prevention

.env discipline + secrets rotation

OWASP top 10 quick map

Day 60: Structured Logging — Pino

Why structured logs

Pino setup

Request logging + correlation IDs

Where logs go in production

Day 61: API Testing — Manual + Automated

Manual: Postman / Thunder / httpie

Test scripts + collection runs

Automated: Vitest + Supertest

Isolating tests from real services

Day 62: Production API Design Review

Spec

Scaffold + base middleware

CRUD endpoints

Museum Collection API (rehearsal)

Day 63: Project — Food-Safety Inspection API

Attachment endpoint

Centralized errors + consistent shape

Automated test suite

Docs + deploy to Render/Railway

Food-Safety Inspection API — DEPLOYED & TESTED

Phase Complete!