A production-ready REST API for e-commerce platform with advanced features including authentication, product management, image uploads, caching, and comprehensive security.
- 🔐 JWT Authentication - Secure signup/login with role-based access control
- 📦 Product Management - Full CRUD operations with image upload support
- 🛒 Order Processing - Transaction-safe order placement with stock management
- 🔍 Advanced Search - Multi-field search, filtering, and sorting
- 📄 Pagination - Efficient data retrieval with customizable page sizes
- ✅ Unit Testing - 23 comprehensive tests with Jest & Supertest
- ✅ Caching - Redis-like caching with automatic invalidation (5-min TTL)
- ✅ API Documentation - Interactive Swagger/OpenAPI docs at
/api-docs - ✅ Image Upload - Cloudinary integration with automatic optimization
- ✅ Advanced Filtering - Category, price range, stock availability filters
- ✅ Rate Limiting - Protection against brute force and DDoS attacks
- Node.js 18+ | PostgreSQL 12+ | npm/yarn
# 1. Clone and install
git clone https://github.com/Nsarob/Fast-purchase.git
cd Fast-purchase
npm install
# 2. Configure environment
cp .env.example .env
# Edit .env with your database and JWT credentials
# 3. Setup database
psql -U postgres -c "CREATE DATABASE fast_purchase;"
# 4. Run the server
npm run dev
# Server runs at http://localhost:3000
# API docs at http://localhost:3000/api-docsPORT=3000
DB_HOST=localhost
DB_PORT=5432
DB_NAME=fast_purchase
DB_USER=postgres
DB_PASSWORD=your_password
JWT_SECRET=your_secret_key
JWT_EXPIRES_IN=24h
CLOUDINARY_URL=cloudinary://your_cloudinary_credentialsVisit http://localhost:3000/api-docs for full Swagger UI with:
- Live API testing
- Request/response schemas
- Authentication flows
- Example requests
POST /auth/register # Create new user account
POST /auth/login # Get JWT tokenGET /products # List products (supports filtering, sorting, search)
GET /products/:id # Get product details
POST /products # Create product (Admin only, supports image upload)
PUT /products/:id # Update product (Admin only)
DELETE /products/:id # Delete product (Admin only)POST /orders # Place order (Authenticated)
GET /orders # Get order history (Authenticated)📖 Detailed Examples: See API_DOCUMENTATION.md
npm test # Run all tests
npm run test:watch # Watch mode
npm run test:coverage # With coverage reportTest Coverage: 23 tests covering authentication, products, orders, and error handling
📖 Testing Guide: See TESTING_GUIDE.md
Fast-purchase/
├── src/
│ ├── config/ # Database, Cloudinary, Multer, Swagger configs
│ ├── controllers/ # Business logic (auth, products, orders)
│ ├── middleware/ # Auth, caching, rate limiting
│ ├── routes/ # API route definitions
│ ├── utils/ # Image upload, validation, response helpers
│ ├── migrations/ # Database migrations
│ ├── app.ts # Express app configuration
│ └── server.ts # Server entry point
├── tests/ # Unit and integration tests
├── docs/ # Additional documentation
│ ├── API_DOCUMENTATION.md
│ ├── ADVANCED_SEARCH_EXAMPLES.md
│ ├── CACHING_GUIDE.md
│ └── TESTING_GUIDE.md
└── README.md
| Category | Technologies |
|---|---|
| Runtime | Node.js, TypeScript |
| Framework | Express.js |
| Database | PostgreSQL |
| Authentication | JWT, Bcrypt |
| File Upload | Multer, Cloudinary |
| Caching | node-cache |
| Testing | Jest, Supertest |
| Documentation | Swagger/OpenAPI |
| Security | express-rate-limit, Helmet |
| Validation | Custom validators |
- Framework: Jest + Supertest
- Coverage: 23 comprehensive tests
- Features: Mocked database, isolated tests, CI/CD ready
- Details: TESTING_GUIDE.md
- Implementation: node-cache with 5-minute TTL
- Strategy: Automatic invalidation on mutations
- Endpoints: All GET requests cached
- Details: CACHING_GUIDE.md
- Tool: Swagger/OpenAPI 3.0
- Features: Interactive UI, request/response examples, authentication testing
- Access: http://localhost:3000/api-docs
- Details: API_DOCUMENTATION.md
- Service: Cloudinary integration
- Features: Multi-image upload (max 5), automatic optimization (800x800), format conversion
- Supported: JPEG, PNG, GIF, WebP (5MB max)
- Storage: Secure URLs in PostgreSQL array
- Search: Name + Description (case-insensitive)
- Filters: Category, price range (min/max), stock availability
- Sorting: By name, price, stock, date, category (asc/desc)
- Details: ADVANCED_SEARCH_EXAMPLES.md
- Protection: Brute force, DDoS, API abuse
- Limits:
- Auth: 5 req/15min
- Read: 200 req/15min
- Create: 10 req/15min
- Orders: 20 req/15min
- Headers: RateLimit-* headers included
- ✅ Password hashing (bcrypt)
- ✅ JWT-based authentication
- ✅ Role-based access control (Admin/User)
- ✅ Rate limiting per endpoint
- ✅ SQL injection prevention (parameterized queries)
- ✅ Input validation and sanitization
- ✅ Environment variable protection
| # | User Story | Status |
|---|---|---|
| 1 | User Signup | ✅ |
| 2 | User Login | ✅ |
| 3 | Create Product (Admin) | ✅ |
| 4 | Update Product (Admin) | ✅ |
| 5 | List Products with Pagination | ✅ |
| 6 | Search Products | ✅ |
| 7 | Get Product Details | ✅ |
| 8 | Delete Product (Admin) | ✅ |
| 9 | Place Order | ✅ |
| 10 | View Order History | ✅ |
All 10 core user stories + 6 bonus features = 100% complete
- API Documentation - Detailed endpoint descriptions
- Advanced Search Examples - Filtering and sorting usage
- Caching Guide - Cache strategy and implementation
- Testing Guide - How to run and write tests
Nsarob - GitHub
Built as part of A2SV Backend Engineering Track
This project is licensed under the MIT License.
- A2SV Backend Engineering Team
- Node.js & Express.js communities
- PostgreSQL & TypeScript ecosystems