Notes API

A RESTful API for managing personal notes with user authentication, built using Express.js, MongoDB, and Passport.js.

Features

• User Authentication: Register, login, and logout functionality with session management
• Note Management: Full CRUD operations for notes (Create, Read, Update, Delete)
• Search & Filtering: Search notes by title, filter by tags
• Pagination: Paginated results for better performance
• Security: Helmet for security headers, XSS protection, input sanitization
• Validation: Joi schema validation for input data
• Error Handling: Comprehensive error handling with custom error classes

Tech Stack

• Backend: Node.js, Express.js
• Database: MongoDB with Mongoose ODM
• Authentication: Passport.js with Local Strategy
• Validation: Joi
• Security: Helmet, XSS-clean, Express Mongo Sanitize
• Session Management: Express Session

Installation

1. Clone the repository:

git clone https://github.com/DevOlabode/notes_API

2. Install dependencies:

npm install

3. Set up environment variables: Create a .env file in the root directory with the following variables:

PORT=3000
SECRET=your-secret-key-here
DATABASE_URL=mongodb://127.0.0.1:27017/notes_API

4. Start MongoDB: Make sure MongoDB is running on your system (default: mongodb://127.0.0.1:27017)

5. Run the application:

node index.js

The API will be available at http://localhost:3000

Usage

Authentication Endpoints

Register a new user

POST /register
Content-Type: application/json

{
  "username": "johndoe",
  "email": "john@example.com",
  "password": "password123"
}

Login

POST /login
Content-Type: application/json

{
  "username": "johndoe",
  "password": "password123"
}

Logout

POST /logout

Get user profile

GET /profile

Notes Endpoints

All notes endpoints require authentication.

Create a note

POST /notes
Content-Type: application/json

{
  "title": "My First Note",
  "content": "This is the content of my note",
  "tags": ["work", "important"],
  "isArchived": false,
  "isPinned": false
}

Get all notes

GET /notes?page=1&limit=10&q=searchTerm&tag=work

Query parameters:

• page: Page number (default: 1)
• limit: Number of notes per page (default: 10)
• q: Search term for title
• tag: Filter by tag

Get a specific note

GET /notes/:id

Update a note

PUT /notes/:id
Content-Type: application/json

{
  "title": "Updated Note Title",
  "content": "Updated content",
  "tags": ["personal", "updated"],
  "isArchived": true,
  "isPinned": true
}

Delete a note

DELETE /notes/:id

API Response Format

Success Response

{
  "success": true,
  "count": 5,
  "page": 1,
  "totalPages": 2,
  "toatlNotes": 15,
  "data": [...]
}

Error Response

{
  "error": "Error message"
}

Data Models

User

{
  email: String (required, unique),
  username: String (auto-generated by passport-local-mongoose),
  hash: String (password hash),
  salt: String (password salt)
}

Note

{
  title: String (required, max 50 chars),
  content: String (required, min 3 chars),
  tags: [String] (required),
  user: ObjectId (reference to User),
  isArchived: Boolean (default: false),
  isPinned: Boolean (default: false),
  createdAt: Date,
  updatedAt: Date
}

Validation Rules

Notes are validated using Joi schema:

• title: 1-50 characters, required
• content: Minimum 1 character, required
• tags: Array of strings (max 30 chars each), required
• isArchived: Boolean, optional
• isPinned: Boolean, optional

Project Structure

notes-api/
├── index.js              # Main application file
├── middleware.js         # Custom middleware functions
├── schema.js             # Joi validation schemas
├── package.json          # Dependencies and scripts
├── models/
│   ├── user.js           # User model
│   └── notes.js          # Note model
├── routes/
│   ├── auth.js           # Authentication routes
│   └── notes.js          # Notes CRUD routes
└── utils/
    ├── catchAsync.js     # Async error handler
    └── expressError.js   # Custom error class

Security Features

• Helmet: Sets various HTTP headers for security
• XSS Protection: Prevents cross-site scripting attacks
• MongoDB Sanitization: Prevents NoSQL injection
• Session Management: Secure session handling with Passport.js
• Input Validation: Joi schemas validate all incoming data

Error Handling

The API uses custom error handling:

• ExpressError class for custom errors
• catchAsync utility for async error handling
• Global error handler middleware
• Proper HTTP status codes and error messages

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

License

This project is licensed under the ISC License.