"A resilient, layered architecture for secure personal and administrative notes management."
| Attribute | Details |
|---|---|
| Project Name | Notes Management API |
| Version | 1.0.0 |
| Status | Production-Ready (GDG Submission) |
| Type | Backend RESTful API |
| Primary Stack | Node.js, Express, PostgreSQL |
| License | ISC |
| Author | Prithish Misra |
Welcome to the Notes Management API headquarters. This system was designed to provide a secure, scalable backend for notes management, featuring comprehensive Role-Based Access Control (RBAC).
| User Type | Use Case / Permissions |
|---|---|
| Regular User | Can securely create, read, update, and delete their own notes. |
| Administrator | Can view all system notes and delete any note for moderation purposes. |
| Developers/Evaluators | Can interact with a documented (Swagger), cleanly structured API that handles edge cases effectively. |
❌ Before
- Notes are stored insecurely without user isolation.
- No role differentiation; anyone can modify or view any data.
- API endpoints lack proper pagination, rate-limiting, and validation.
✅ After
+ JWT-based authentication ensures strict user isolation.
+ Multi-tier RBAC system distinguishes Users from Admins.
+ Built-in rate limiting, PostgreSQL data integrity, and pagination.The core philosophy driving this architecture is Security by Default, Scalability by Design.
| Principle | Application |
|---|---|
| Separation of Concerns | Distinct Routing, Controller, Service, and Data access layers. |
| Data Integrity | Relying on PostgreSQL schemas with strict validation. |
| Zero Trust | All protected routes mandate active JWT verification and role validation. |
| Feature | Description | Status |
|---|---|---|
| JWT Auth | Secure Registration and Login with bcryptjs. |
🟢 Active |
| RBAC | Strict Admin and User differentiation protocols. | 🟢 Active |
| Search & Pagination | Advanced queries via ?search=X&page=Y&limit=Z. |
🟢 Active |
| Rate Limiting | DDOS and brute-force protection logic. | 🟢 Active |
| Swagger UI | Comprehensive interactive API documentation. | 🟢 Active |
flowchart TD
A([User/Client]) --> B{Has Valid Token?}
B -- No --> C[Auth Middleware]
C --> D(401 Unauthorized)
B -- Yes --> E[Role Validator]
E -->|Valid Role| F[Controller Layer]
E -->|Invalid Role| G(403 Forbidden)
F --> H[Service / DB Layer]
H --> I([JSON Response])
graph TB
Client((API Client))
subgraph Express.js Backend
Router[Routes]
Mid[Middleware \nAuth & Rate Limiting]
Ctrl[Controllers]
Svc[Services \nBusiness Logic]
end
DB[(PostgreSQL)]
Client -->|HTTP Request| Router
Router --> Mid
Mid --> Ctrl
Ctrl --> Svc
Svc --> DB
src/
├── config/ # Environment, DB, and Swagger configurations
├── controllers/ # Request/Response handling and orchestration
├── middleware/ # Auth verification, role checks, and rate limiters
├── routes/ # Express route definitions with Swagger annotations
├── services/ # Abstraction for PostgreSQL database queries
├── utils/ # Helper functions (e.g., JWT token generation)
└── app.js # Express application entry point
| Layer | Technology | Purpose |
|---|---|---|
| Runtime | Node.js | Fast, scalable asynchronous execution environment. |
| Framework | Express.js | Robust routing and middleware ecosystem. |
| Database | PostgreSQL (pg) |
ACID-compliant relational data persistence. |
| Security | JWT, bcryptjs | Stateless authentication and password hashing. |
| Documentation | Swagger UI | Auto-generated interactive endpoint testing. |
-
Clone & Install
git clone https://github.com/prithishmisra23/Notes-Management-API.git cd Notes-Management-API npm install -
Environment Variables (
.env)Variable Description PORTAPI Port (e.g., 5000) DATABASE_URLPostgreSQL connection string JWT_SECRETSecret key for signing tokens JWT_EXPIRES_INToken lifespan (e.g., 1d) -
Run the API
npm run dev
The database schema will automatically initialize on startup if it doesn't exist.
| Security Control | Implementation Status | Notes |
|---|---|---|
| Password Hashing | ✅ Implemented | bcryptjs with auto-salting |
| Token Validation | ✅ Implemented | JWT required for all /api/notes routes |
| Rate Limiting | ✅ Implemented | 100 requests per 15 min per IP |
| CORS | ✅ Implemented | Cross-Origin enabled |
| Role Guarding | ✅ Implemented | Admins can view/delete all, Users isolated to self |
gitGraph
commit id: "Initial Project Setup"
branch feature/auth
commit id: "Add JWT and Bcrypt"
checkout main
merge feature/auth
branch feature/crud
commit id: "Implement Notes Service"
commit id: "Add Pagination & Search"
checkout main
merge feature/crud
branch feature/docs
commit id: "Integrate Swagger UI"
checkout main
merge feature/docs
commit id: "Release v1.0.0" tag: "v1.0.0"
| Milestone | Status | Details |
|---|---|---|
| Authentication System | ✅ Complete | JWT based registration and login. |
| Notes CRUD Operations | ✅ Complete | With proper ownership validation. |
| RBAC Implementation | ✅ Complete | Admin vs User boundaries enforced. |
| Advanced Querying | ✅ Complete | Search and pagination implemented. |
| API Documentation | ✅ Complete | Swagger UI integrated at /api-docs. |
- API Documentation:
/api-docs(Requires running server) - Database: PostgreSQL (Ensure service is running locally or remotely)
- Postman Tests: Check the
assets/folder for screenshots of successful API requests.
"Building resilient APIs for seamless data management."
