Build Scalable Express.js APIs

Express API Builder organizes Node.js HTTP APIs around separation of concerns. Controllers handle HTTP requests and responses, services contain business logic, and models define data structures. Routes connect operations to middleware and controllers, while configuration and utilities have their own modules. Cross-cutting concerns such as authentication, validation, and logging belong in the middleware pipeline.

The design favors async/await and a shared error path. An asyncHandler wrapper forwards rejected asynchronous work to error middleware. A custom AppError carries a message, status code, optional code, and operational-error marker. Error handling maps Mongoose cast, duplicate-key, and validation failures to HTTP responses and includes stack traces only in development.

Use the skill when creating or restructuring an Express REST API that needs clear layers, repeatable responses, request validation, and protected routes. Its implementation fragments require project-specific models, services, and imported helpers. They are architectural patterns rather than a complete deployable service.

Review configuration and authorization before deployment. The sample JWT configuration contains a fallback secret, and the route examples do not apply identical authentication to every operation. A default value or an isolated middleware function does not establish that the full API has an appropriate production access policy.

Inputs include route requirements, data models, business operations, allowed origins, authentication settings, and environment configuration. Outputs can include controllers, services, model definitions, validation rules, route modules, middleware, and application setup.

The middleware stack combines security headers, credentialed CORS, rate limiting, compression, request logging, and body parsing. Its JSON parser includes an explicit size limit:

app.use(express.json({ limit: '10mb' }));

Validation uses express-validator chains for email, password, names, and identifiers, followed by a shared validation-result check. Pagination returns page, limit, total, and page count alongside data. Creation returns a created response; a missing record follows the error path. Adapt these rules to the actual input and storage model rather than assuming the illustrated user fields fit every endpoint.

Authentication uses jsonwebtoken to verify a Bearer token, load its user through Mongoose, exclude the password field, and attach the user to the request. A separate role middleware checks allowed roles. Router chains then combine authentication, role checks, validation, and controllers per HTTP method.

Configuration through dotenv and environment variables includes runtime mode, port, database connection, JWT expiry, SMTP, and upload settings. Helmet, cors, compression, express-rate-limit, and Morgan supply the illustrated middleware capabilities.

The skill serves developers building Express APIs with explicit HTTP and business-logic boundaries. Its operational checklist covers an /api/v1/ prefix, consistent response fields and status codes, request correlation IDs, a /health endpoint, Swagger/OpenAPI documentation, service unit tests, endpoint integration tests, connection pooling, graceful database failures, and shutdown handling for SIGTERM and SIGINT. These are implementation responsibilities to complete in the actual service.