backend-implementation-patterns

Use resource-based routing where HTTP verbs map to operations: GET for list and detail, POST for create, PUT for update, DELETE for removal. Nest related resources under their parent path, such as /api/users/:id/posts for a user's posts.

Extract the Bearer token from the Authorization header, verify it with jwt.verify against your secret, and attach the decoded payload to the request object. Return 401 responses with structured error codes for missing, expired, or invalid tokens.

Define a Zod schema for the expected body shape, then call safeParse inside a validation middleware. On failure, return a 400 response with field-level error details; on success, pass the parsed data to the route handler.

Apply security headers first, then CORS, body parsing, request logging, rate limiting, and authentication, followed by routes. The error handling middleware must be registered last so it catches errors from all upstream handlers.

Catch database-specific error codes in the centralized error handler, such as Postgres code 23505 for unique violations, and map them to appropriate HTTP statuses like 409 Conflict. Unknown errors should return a generic 500 response without leaking internals in production.