Controllers & Business Logic

Relevant source files

The following files were used as context for generating this wiki page:

• backend/src/controllers/authController.js
• backend/src/controllers/userController.js
• backend/src/server.js
• backend/src/routes/users.js
• README.md
• frontend/src/App.js
• backend/package.json

Introduction

The backend's business logic is managed by controllers within the Express.js framework. According to the project structure, the backend/src/controllers/ directory is designated to handle the business logic for API endpoints. These controllers are responsible for processing incoming requests, interacting with the database models, and sending back responses to the client. The main server file, backend/src/server.js, also contains some simple inline controller logic for basic operations, while more complex features are modularized into dedicated route and controller files.

This system uses a combination of inline functions for simple routes and modular controllers for more organized and scalable features like user management. Middleware for authentication, authorization, and validation is applied at the routing level to protect and sanitize the controller inputs.

Sources: README.md, backend/src/server.js, backend/src/routes/users.js

Architectural Overview

The request handling flow follows a standard Express.js pattern. An incoming HTTP request is first processed by the server, passed through relevant middleware, and then directed by the routing layer to the appropriate controller function. The controller then executes the business logic and returns a response.

The following diagram illustrates the general request flow to a controller.

Data Models

The application defines data structures using Mongoose schemas. A primary User model is defined directly within the main server file.

User Schema

The User model has a simple structure for storing user credentials and information.

Fields:

Field	Type	Description
name	String	The user's full name.
email	String	The user's unique email address.
password	String	The user's password.

Sources: backend/src/server.js:37-41

API Endpoints and Controllers

The application exposes several API endpoints, handled by both inline functions in server.js and dedicated controllers imported into route files.

Simple Inline Controllers

The main server.js file contains basic CRUD operations for the /users endpoint. These are implemented as inline async functions.

Method	Path	Description
GET	/users	Retrieves a list of all users from the database.
POST	/users	Creates a new user with name, email, and password.

The following sequence diagram shows the process of creating a new user via the POST /users endpoint.

Modular Controllers

For better organization, the application uses modular routers. The endpoints for user management under /api/users are defined in backend/src/routes/users.js and are handled by functions imported from userController.js.

User Management (/api/users)

These routes provide full CRUD functionality for user resources and are protected by authentication and authorization middleware.

Method	Path	Controller Function	Middleware	Description
GET	/	getUsers	protect, authorize('admin')	Get all users. (Admin only)
GET	/:id	getUser	protect	Get a single user by their ID.
PUT	/:id	updateUser	protect	Update a user's profile.
DELETE	/:id	deleteUser	protect, authorize('admin')	Delete a user. (Admin only)

Sources: backend/src/routes/users.js:47-65

Other Registered Routes

The server.js file registers several other modular routes, indicating a structured approach for different features.

• /api/auth: Handles authentication-related logic.
• /api/taikhoan: Manages account-related operations.
• /api/thietbi: Manages device-related operations.

The following diagram shows how these modular routes are mounted in the main application.

Middleware and Validation

The application heavily relies on middleware for security and data integrity.

Authentication and Authorization

The routes in users.js use two key middleware functions:

• protect: This middleware is applied to all routes in users.js, ensuring that only authenticated users can access them.
• authorize('admin'): This middleware restricts access to specific routes (e.g., GET / and DELETE /:id) to users with the 'admin' role.

Sources: backend/src/routes/users.js:44, 50, 65

Input Validation

The express-validator library is used to validate and sanitize incoming request data before it reaches the controller logic. This prevents invalid data from being processed.

Update User Validation (PUT /api/users/:id)

• name: Optional. Must be a string between 2 and 50 characters.
• email: Optional. Must be a valid email format.

User ID Validation (GET, PUT, DELETE on /:id)

• id: The route parameter must be a valid MongoDB Object ID.

Sources: backend/src/routes/users.js:23-41, backend/package.json:25

Conclusion

The controller and business logic layer of the CDIO4 backend is designed with a clear separation of concerns. It combines simple, inline handlers for basic endpoints with a scalable, modular structure for more complex features like user management. The extensive use of middleware for authentication, authorization, and validation at the routing level ensures that the controllers receive secure and well-formed data, making the business logic cleaner and more robust. This architecture provides a solid foundation for building and extending the application's features.