nodejs-backend-patterns

Use a layered architecture with controllers handling HTTP requests, services containing business logic, and repositories managing data access. Wire them together with a dependency injection container that registers singletons for the database pool, repositories, and services.

Express offers a minimalist, middleware-centric ecosystem suited for general APIs, while Fastify provides higher performance with built-in schema validation and a plugin system. Both setups here include helmet, cors, and compression for security and response handling.

Create an AuthService that verifies passwords with bcrypt and signs short-lived access tokens (15 minutes) plus refresh tokens (7 days) using jsonwebtoken. Protect routes with an authenticate middleware that verifies the Bearer token and attaches the payload to the request.

Express does not catch rejected promises from async handlers automatically, so wrap them in an asyncHandler that forwards errors to next(). A global error-handling middleware then maps custom AppError subclasses to proper status codes and hides details in production.

Acquire a dedicated client from the pg Pool, run BEGIN, execute all related queries, then COMMIT on success or ROLLBACK on error, releasing the client in a finally block. This keeps multi-step writes like order creation and inventory updates atomic.

Use express-rate-limit with a rate-limit-redis store backed by an ioredis client so limits are shared across instances. Apply a general limiter such as 100 requests per 15 minutes and a stricter limiter for authentication endpoints.