IV Tutorials and Examples

Summary

This part contains tutorials which are step-by-step learning guides, and examples that are more complex but less meticulous. The former group includes the Instagram Gallery, Todo App and REST API. They’ll introduce readers to how Express.js interacts with other aspects of web services. We’ll learn how to make requests to a third-party site, connect to a database and perform CRUD (create, read, update and delete) operations on it, render Jade templates, compile LESS stylesheets, utilize CSRF and build Mocha tests. The HackHall example, on the other hand, can serve as a reference and give you hints on how to use Mongoose and OAuth sessions and prepare an app for deployment.

1 Instagram Gallery

Summary

This tutorial will demonstrate how to use Express.js external third-party services. In this tutorial, in addition to Express.js, we’ll use Instagram photos via Storify API, SuperAgent, Consolidate and Handlebars modules.

Example

The full source code of this example is available at https://github.com/azat-co/sfy-gallery.

Storify runs on Node.js and Express.js; therefore, why not use these technologies to write an application that demonstrates how to build apps that rely on third-party APIs and HTTP requests?

The Instagram Gallery app will fetch a story object and display its title, description, and a gallery of the elements/images like this:

Instagram Gallery: Storify API + Node.js = <3

1.1 A File Structure

- index.js
- package.json
- views/index.html
- css/bootstrap-responsive.min.css
- css/flatly-bootstrap.min.css

Where index.js is our main Node.js file and index.html is the Handlebars template.

1.2 Dependencies

Our dependencies include:

express: 3.2.5 for Express.js framework
superagent: 0.14.6 for making HTTP requests
consolidate: 0.9.1 for using Handlebars with Express.js
handlebars: 1.0.12 for using Handlebars template engine

The package.json file:

{
 "name": "sfy-demo",
 "version": "0.0.0",
 "description": "Simple Node.js demo app on top of Storify API",
 "main": "index.js",
 "scripts": {
   "test": "echo \"Error: no test specified\" && exit 1"
 },
 "dependencies": {
   "express": "3.2.5",
   "superagent": "0.14.6",
   "consolidate": "0.9.1",
   "handlebars": "1.0.12"
 },
 "repository": "",
 "author": "Azat Mardanov",
 "license": "BSD"
}

1.3 Node.js Server

At the beginning of the file, we require dependencies:

var express = require('express');
var superagent = require('superagent');
var consolidate = require('consolidate');

var app = express();

Then, configure template engine:

app.engine('html', consolidate.handlebars);
app.set('view engine', 'html');
app.set('views', __dirname + '/views');

Set up a static folder with middleware:

1 app.use(express.static(__dirname + '/public'));

If you want to serve any other story, feel free to do so. All you need is the username of the author and the story slug for my gallery of the capitol of Tatarstan, Kazan. Leave the following:

1 var user = 'azat_co';
2 var story_slug = 'kazan';

Paste your values, i.e., Storify API key, username and _token if you have one. As of this writing, Storify API is public, meaning there is no need for authentication. In case this changes in the future, please obtain your signup for an API key at http://dev.storify.com/request or follow the official documentation at dev.storify.com:

var api_key = "";
var username = "";
var _token = "";

Let’s define the home route:

1 app.get('/',function(req, res){

Now we’ll fetch elements from Storify API for the route’s callback:

 superagent.get("http://api.storify.com/v1/stories/"
   + user + "/" + story_slug)
   .query({api_key: api_key,
     username: username,
     _token: _token})
   .set({  Accept: 'application/json' })
   .end(function(e, storifyResponse){
     if (e) next(e);

To render the template with the story object which is in the HTTP response body’s content property:

     return res.render('index', storifyResponse.body.content);
   })

})

app.listen(3001);

1.4 Handlebars Template

The views/index.html file:

<!DOCTYPE html lang="en">
<html>
 <head>
   <link type="text/css"
     href="css/flatly-bootstrap.min.css"
     rel="stylesheet" />
   <link type="text/css"
     href="css/bootstrap-responsive.min.css"
     rel="stylesheet"/>
 </head>

 <body class="container">
   <div class="row">
     <h1>{{title}}<small> by {{author.name}}</small></h1>
     <p>{{description}}</p>
   </div>
   <div class="row">
     <ul class="thumbnails">
     {{#each elements}}
       <li class="span3">
         <a class="thumbnail" href="{{permalink}}"
         target="_blank">
           <img src="{{data.image.src}}"
             title="{{data.image.caption}}" />
         </a>
       </li>
     {{/each}}
     </ul>
   </div>
 </body>

</html>

1.5 Conclusion

Express.js and SuperAgent allow developers to retrieve and manipulate data provided by third-party services such as Storify, Twitter and Facebook in just a few lines of code.

Note

In most cases, service providers (such as Google, Facebook and Twitter) require authentication (which is not the case with Storify API as of this writing). To make OAuth 1.0, OAuth 2.0 and OAuth Echo requests, consider oauth (GitHub), everyauth (GitHub) and/or Passport(website and GitHub).

2 Todo App

Summary

Todo apps are considered quintessential in showcasing frameworks and are akin to the famous Todomvc.com for front-end JavaScript frameworks. In this example, we’ll use Jade, forms, LESS, AJAX/XHR and CSRF.

In our Todo app, we’ll intentionally not use Backbone.js or Angular to demonstrate how to build traditional websites with the use of forms and redirects. We’ll also explain how to plug in CSRF and LESS.

Example

All the source code is in github.com/azat-co/todo-express for your convenience.

Here are some screenshots of the Todo app in which we start from a home page:

The Todo app home page.

There’s an empty list (unless you played with this app before):

The empty Todo List page.

Now we can add four items to the Todo List:

The Todo List page with added items.

Mark one of the tasks as “done”, e.g.. “Buy milk”:

The Todo List page with one item marked done.

Going to the Complete page reveals this done item:

The Todo app Completed page.

Deletion of an item from the Todo list is the only action performed via AJAX/XHR request. The rest of the logic is done via GETs and POSTs (by forms).

The Todo List page with removed tasks.

2.1 Scaffolding

As usual, we start by running

$ express todo-express
$ cd todo-express
$ npm install

This will give us the basic Express.js application.

We’ll need to add two extra dependencies to package.json, the less-middleware and Mongoskin libraries:

1 $ npm install less-middleware --save
2 $ npm install mongoskin --save

Changing the name to todo-express is optional:

{
 "name": "todo-express",
 "version": "0.0.1",
 "private": true,
 "scripts": {
   "start": "node app.js"
 },
 "dependencies": {
   "express": "3.3.5",
   "jade": "*",
   "mongoskin": "~0.6.0",
   "less-middleware": "~0.1.12"
 }
}

2.2 MongoDB

Install MongoDB if you don’t have it already.

$ brew update
$ brew install mongodb
$ mongo --version

For more flavors of MongoDB installation, check out the official docs.

2.3 Structure

The final version of the app has the following folder/file structure (GitHub):

/todo-express
 /public
   /bootstrap
     *.less
   /images
   /javascripts
     main.js
     jquery.js
   /stylesheets
     style.css
     main.less
 /routes
   tasks.js
   index.js
 /views
   tasks_completed.jade
   layout.jade
   index.jade
   tasks.jade
 app.js
 readme.md
 package.json

The *.less in the bootstrap folder means there are a bunch of Twitter Bootstrap (the CSS framework) source files. They’re available at GitHub.

2.4 app.js

This is a breakdown of the Express.js-generated app.js file with the addition of routes, database, session, LESS and param middlewares.

Firstly, we import dependencies with the Node.js global require() function:

1 var express = require('express');

Similarly, we get access to our own modules, which are the app’s routes:

1 var routes = require('./routes');
2 var tasks = require('./routes/tasks');

The core http and path modules will be needed as well:

1 var http = require('http');
2 var path = require('path');

Mongoskin is a better alternative to the native MongoDB driver:

1 var mongoskin = require('mongoskin');

One line is all we need to get the database connection object. The first param follows the standard URI convention of protocol://username:password@host:port/database:

1 var db = mongoskin.db('mongodb://localhost:27017/todo?auto_reconnect', {safe:true\
2 });

The app itself:

1 var app = express();

In this middleware, we export the database object to all middlewares. By doing so, we’ll be able to perform database operations in the routes modules:

1 app.use(function(req, res, next) {
2   req.db = {};

We simply store the tasks collection in every request:

 req.db.tasks = db.collection('tasks');
 next();
})

This line allows us to access appname from within every Jade template:

1 app.locals.appname = 'Express.js Todo App'

We set the server port to either the environment variable, or if that’s undefined, to 3000:

1 app.set('port', process.env.PORT || 3000);

These statements tell Express.js where templates live and what file extension to prepend in case the extension is omitted during the render calls:

1 app.set('views', __dirname + '/views');
2 app.set('view engine', 'jade');

Display the Express.js favicon (the graphic in the URL address bar of browsers):

1 app.use(express.favicon());

The out-of-the-box logger will print requests in the terminal window:

1 app.use(express.logger('dev'));

The bodyParser() middleware is needed to painlessly access incoming data:

1 app.use(express.bodyParser());

The methodOverride() middleware is a workaround for HTTP methods that involve headers. It’s not essential for this example, but we’ll leave it here:

1 app.use(express.methodOverride());

To use CSRF, we need cookieParser() and session():

app.use(express.cookieParser());
app.use(express.session({
 secret: '59B93087-78BC-4EB9-993A-A61FC844F6C9'
}));

The csrf() middleware itself. The order is important; in other words, csrf() must be preceded by cookieParser() and session():

1 app.use(express.csrf());

To process LESS stylesheets into CSS ones, we utilize less-middleware in this manner:

app.use(require('less-middleware')({
 src: __dirname + '/public',
 compress: true
}));

The other static files are also in the public folder:

1 app.use(express.static(path.join(__dirname, 'public')));

Remember CSRF? This is how we expose it to templates:

app.use(function(req, res, next) {
 res.locals._csrf = req.session._csrf;
 return next();
})

The router plug-in is enabled by this statement. It’s important to have this line after the less-middleware and csrf() lines above:

1 app.use(app.router);

It’s possible to configure different behavior based on environments:

if ('development' == app.get('env')) {
 app.use(express.errorHandler());
}

When there’s a request that matches route/RegExp with :task_id in it, this block is executed:

1 app.param('task_id', function(req, res, next, taskId) {

The value of task ID is in taskId and we query the database to find that object:

1   req.db.tasks.findById(taskId, function(error, task){

It’s tremendously important to check for errors and empty results:

1     if (error) return next(error);
2     if (!task) return next(new Error('Task is not found.'));

If there’s data, store it in the request and proceed to the next middleware:

   req.task = task;
   return next();
 });
});

Now it’s time to define our routes. We start with the home page:

1 app.get('/', routes.index);

The Todo List page:

1 app.get('/tasks', tasks.list);

This route will mark all tasks in the Todo List as completed if the user presses the all done button. In a RESP API, the HTTP method would be PUT but because we’re building classical web apps with forms, we have to use POST:

1 app.post('/tasks', tasks.markAllCompleted)

The same URL for adding new tasks is used for marking all tasks completed, but in the previous methods itself (markAllCompleted) you’ll see how we handle flow control:

1 app.post('/tasks', tasks.add);

To mark a single task completed, we use the aforementioned :task_id string in our URL pattern. (In REST API, this should have been a PUT request):

1 app.post('/tasks/:task_id', tasks.markCompleted);

Unlike with the POST route above, we utilize Express.js param middleware with a :task_id token:

1 app.del('/tasks/:task_id', tasks.del);

For our Completed page, we define this route:

1 app.get('/tasks/completed', tasks.completed);

In case of malicious attacks or mistyped URLs, it’s a user-friendly thing to catch all requests with *. Keep in mind that if we had a match previously, the Node.js won’t come to execute this block:

app.all('*', function(req, res){
 res.send(404);
})

Finally, we spin up our application with the good ‘ol http method:

http.createServer(app).listen(app.get('port'),
 function(){
   console.log('Express server listening on port '
     + app.get('port'));
 }
);

The full content of the app.js file:

/**
* Module dependencies.
*/

var express = require('express');
var routes = require('./routes');
var tasks = require('./routes/tasks');
var http = require('http');
var path = require('path');
var mongoskin = require('mongoskin');
var db = mongoskin.db('mongodb://localhost:27017/todo?auto_reconnect', {safe:true\
});
var app = express();
app.use(function(req, res, next) {
 req.db = {};
 req.db.tasks = db.collection('tasks');
 next();
})
app.locals.appname = 'Express.js Todo App'
// all environments


app.set('port', process.env.PORT || 3000);
app.set('views', __dirname + '/views');
app.set('view engine', 'jade');
app.use(express.favicon());
app.use(express.logger('dev'));
app.use(express.bodyParser());
app.use(express.methodOverride());
app.use(express.cookieParser());
app.use(express.session({secret: '59B93087-78BC-4EB9-993A-A61FC844F6C9'}));
app.use(express.csrf());

app.use(require('less-middleware')({ src: __dirname + '/public', compress: true }\
));
app.use(express.static(path.join(__dirname, 'public')));
app.use(function(req, res, next) {
 res.locals._csrf = req.session._csrf;
 return next();
})
app.use(app.router);

// development only
if ('development' == app.get('env')) {
 app.use(express.errorHandler());
}
app.param('task_id', function(req, res, next, taskId) {
 req.db.tasks.findById(taskId, function(error, task){
   if (error) return next(error);
   if (!task) return next(new Error('Task is not found.'));
   req.task = task;
   return next();
 });
});

app.get('/', routes.index);
app.get('/tasks', tasks.list);
app.post('/tasks', tasks.markAllCompleted)
app.post('/tasks', tasks.add);
app.post('/tasks/:task_id', tasks.markCompleted);
app.del('/tasks/:task_id', tasks.del);
app.get('/tasks/completed', tasks.completed);

app.all('*', function(req, res){
 res.send(404);
})
http.createServer(app).listen(app.get('port'), function(){
 console.log('Express server listening on port ' + app.get('port'));
});

2.5 Routes

There are only two files in the routes folder. One of them serves the home page (e.g., http://localhost:3000/) and is straightforward:

/*
* GET home page.
*/

exports.index = function(req, res){
 res.render('index', { title: 'Express.js Todo App' });
};

The remaining logic that deals with tasks itself has been placed in todo-express/routes/tasks.js. Let’s break it down a bit.

We start by exporting a list() request handler that gives us a list of incomplete tasks:

1 exports.list = function(req, res, next){

To do so, we perform a database search with completed=false query:

 req.db.tasks.find({
   completed: false
 }).toArray(function(error, tasks){

In the callback, we need to check for any errors: javascript if (error) return next(error);

Since we use toArray(), we can send the date directly to the template:

   res.render('tasks', {
     title: 'Todo List',
     tasks: tasks || []
   });
 });
};

Adding a new task requires us to check for the name parameter:

exports.add = function(req, res, next){
 if (!req.body || !req.body.name)
   return next(new Error('No data provided.'));

Thanks to our middleware, we already have a database collection in the req object, and the default value for the task is incomplete (completed: false):

 req.db.tasks.save({
   name: req.body.name,
   completed: false
 }, function(error, task){

Again, it’s important to check for errors and propagate them with the Express.js next() function:

1     if (error) return next(error);
2     if (!task) return next(new Error('Failed to save.'));

Logging is optional; however, it’s useful for learning and debugging:

1     console.info('Added %s with id=%s', task.name, task._id);

Lastly, we redirect back to the Todo List page when the saving operation has finished successfully:

   res.redirect('/tasks');
 })
};

This method marks all incomplete tasks as complete:

1 exports.markAllCompleted = function(req, res, next) {

Because we had to reuse the POST route and since it’s a good illustration of flow control, we check for the all_done parameter to decide if this request comes from the all done button or the add button:

 if (!req.body.all_done
   || req.body.all_done !== 'true')
   return next();

If the execution has come this far, we perform a db query with multi: true: javascript req.db.tasks.update({ completed: false }, {$set: { completed: true }}, {multi: true}, function(error, count){

Significant error handling, logging and redirection back to Todo List page:

   if (error) return next(error);
   console.info('Marked %s task(s) completed.', count);
   res.redirect('/tasks');
 })
};

The Completed route is similar to the Todo List, except for the completed flag value (true in this case):

exports.completed = function(req, res, next) {
 req.db.tasks.find({
   completed: true
 }).toArray(function(error, tasks) {
   res.render('tasks_completed', {
     title: 'Completed',
     tasks: tasks || []
   });
 });
};

This is the route that takes care of marking a single task as done. We use updateById but the same thing can be accomplished with a plain update method from Mongoskin/MongoDB API. The trick with completed: req.body.completed === 'true is needed because the incoming value is a string and not a boolean.

exports.markCompleted = function(req, res, next) {
 if (!req.body.completed)
   return next(new Error('Param is missing'));
 req.db.tasks.updateById(req.task._id, {
   $set: {completed: req.body.completed === 'true'}},
   function(error, count) {

Once more, we perform error and results checks; (update() and updateById() don’t return object, but the count of the affected documents instead):

     if (error) return next(error);
     if (count !==1)
       return next(new Error('Something went wrong.'));
     console.info('Marked task %s with id=%s completed.',
       req.task.name,
       req.task._id);
     res.redirect('/tasks');
   }
 )
}

Delete is the single route called by an AJAX request. However, there’s nothing special about its implementation. The only difference is that we don’t redirect, but send status 200 back.

Just for your information, the remove() method can be used instead of removeById().

exports.del = function(req, res, next) {
 req.db.tasks.removeById(req.task._id, function(error, count) {
   if (error) return next(error);
   if (count !==1) return next(new Error('Something went wrong.'));
   console.info('Deleted task %s with id=%s completed.',
     req.task.name,
     req.task._id);
   res.send(200);
 });
}

For your convenience, here’s the full content of the todo-express/routes/tasks.js file:

/*
* GET users listing.
*/

exports.list = function(req, res, next){
 req.db.tasks.find({completed: false}).toArray(function(error, tasks){
   if (error) return next(error);
   res.render('tasks', {
     title: 'Todo List',
     tasks: tasks || []
   });
 });
};

exports.add = function(req, res, next){
 if (!req.body || !req.body.name) return next(new Error('No data provided.'));
 req.db.tasks.save({
   name: req.body.name,
   completed: false
 }, function(error, task){
   if (error) return next(error);
   if (!task) return next(new Error('Failed to save.'));
   console.info('Added %s with id=%s', task.name, task._id);
   res.redirect('/tasks');
 })
};

exports.markAllCompleted = function(req, res, next) {
 if (!req.body.all_done || req.body.all_done !== 'true') return next();
 req.db.tasks.update({
   completed: false
 }, {$set: {
   completed: true
 }}, {multi: true}, function(error, count){
   if (error) return next(error);
   console.info('Marked %s task(s) completed.', count);
   res.redirect('/tasks');
 })
};

exports.completed = function(req, res, next) {
 req.db.tasks.find({completed: true}).toArray(function(error, tasks) {
   res.render('tasks_completed', {
     title: 'Completed',
     tasks: tasks || []
   });
 });
};

exports.markCompleted = function(req, res, next) {
 if (!req.body.completed) return next(new Error('Param is missing'));
 req.db.tasks.updateById(req.task._id, {$set: {completed: req.body.completed ===\
'true'}}, function(error, count) {
   if (error) return next(error);
   if (count !==1) return next(new Error('Something went wrong.'));
   console.info('Marked task %s with id=%s completed.', req.task.name, req.task.\
_id);
   res.redirect('/tasks');
 })
};

exports.del = function(req, res, next) {
 req.db.tasks.removeById(req.task._id, function(error, count) {
   if (error) return next(error);
   if (count !==1) return next(new Error('Something went wrong.'));
   console.info('Deleted task %s with id=%s completed.', req.task.name, req.task\
._id);
   res.send(200);
 });
};

2.6 Jades

In the Todo app, we use four templates:

layout.jade: the skeleton of HTML pages that is used on all pages
index.jade: home page
tasks.jade: Todo List page
tasks_completed.jade: Completed page

Let’s go through each file starting with layout.jade. It starts with doctype, html and head types:

doctype 5
html
 head

We should have the appname variable set:

1     title= title + ' | ' + appname

Next, we include *.css files but underneath, and Express.js will serve its contents from LESS files:

   link(rel="stylesheet", href="/stylesheets/style.css")
   link(rel="stylesheet", href="/bootstrap/bootstrap.css")
   link(rel="stylesheet", href="/stylesheets/main.css")

The body with Twitter Bootstrap structure consist of .container and .navbar. To read more about those and other classes, go to getbootstrap.com/css/:

 body
   .container
     .navbar.navbar-default
       .container
         .navbar-header
           a.navbar-brand(href='/')= appname
     .alert.alert-dismissable
     h1= title
     p Welcome to Express.js Todo app by&nbsp;
       a(href='http://twitter.com/azat_co') @azat_co
       |. Please enjoy.

This is the place where other jades (like tasks.jade) will be imported:

1       block content

The last lines include front-end JavaScript files:

1   script(src='/javascripts/jquery.js', type="text/javascript")
2   script(src='/javascripts/main.js', type="text/javascript")

The full layout.jade file:

doctype html
html
 head
   title= title + ' | ' + appname
   link(rel="stylesheet", href="/stylesheets/style.css")
   link(rel="stylesheet", href="/bootstrap/bootstrap.css")
   link(rel="stylesheet", href="/stylesheets/main.css")

 body
   .container
     .navbar.navbar-default
       .container
         .navbar-header
           a.navbar-brand(href='/')= appname
     .alert.alert-dismissable
     h1= title
     p Welcome to Express.js Todo app by&nbsp;
       a(href='http://twitter.com/azat_co') @azat_co
       |. Please enjoy.
     block content
 script(src='/javascripts/jquery.js', type="text/javascript")
 script(src='/javascripts/main.js', type="text/javascript")

The index.jade file is our home page and it’s quite vanilla. The most interesting thing it has is the nav-pills menu:

extends layout

block content
 .menu
   h2 Menu
   ul.nav.nav-pills
     li.active
       a(href="/tasks") Home
     li
       a(href="/tasks") Todo List
     li
       a(href="/tasks") Completed
 .home
   p This is an example of classical (no front-end JavaScript frameworks) web ap\
plication built with Express.js 3.3.5 for 
     a(href="http://expressjsguide.com") Express.js Guide
     |.
   p The full source code is available at 
     a(href='http://github.com/azat-co/todo-express') github.com/azat-co/todo-ex\
press
     |.

The tasks.jade uses extends layout:

extends layout

block content

Then goes our main page of specific content:

 .menu
   h2 Menu
   ul.nav.nav-pills
     li
       a(href='/') Home
     li.active
       a(href='/tasks') Todo List
     li
       a(href="/tasks/completed") Completed
 h1= title

The div with list class will hold the Todo List:

1   .list
2     .item.add-task

The form to mark all items as done has a CSRF token in a hidden field and uses the POST method pointed to /tasks:

     div.action
       form(action='/tasks', method='post')
         input(type='hidden', value='true', name='all_done')
         input(type='hidden', value=locals._csrf, name='_csrf')
         input(type='submit', class='btn btn-success btn-xs', value='all done')

A similar CSRF-enabled form is used for new task creation:

     form(action="/tasks", method='post')
       input(type='hidden', value=locals._csrf, name='_csrf')
       div.name
         input(type="text", name="name", placeholder='Add a new task')
       div.delete
         input.btn.btn-primary.btn-sm(type="submit", value='add')

When we start the app for the first time (or clean the database), there are no tasks:

1     if (tasks.length === 0)
2       | No tasks.

Jade supports iterations with the each command:

   each task, index in tasks
     .item
       div.action

This form submits data to its individual task route:

         form(action='/tasks/#{task._id}', method='post')
           input(type='hidden', value=task._id.toString(), name='id')
           input(type='hidden', value='true', name='completed')
           input(type='hidden', value=locals._csrf, name='_csrf')
           input(type='submit', class='btn btn-success btn-xs task-done', value=\
'done')

The index variable is used to display order in the list of tasks:

       div.num
         span=index+1
           |.&nbsp;
       div.name
         span.name=task.name
         //- no support for DELETE method in forms
         //- http://amundsen.com/examples/put-delete-forms/
         //- so do XHR request instead from public/javascripts/main.js

The delete button doesn’t have anything fancy attached to it, because events are attached to these buttons from the main.js front-end JavaScript file:

       div.delete
         a(class='btn btn-danger btn-xs task-delete', data-task-id=task._id.toSt\
ring(), data-csrf=locals._csrf) delete

The full source code of tasks.jade:

extends layout

block content

 .menu
   h2 Menu
   ul.nav.nav-pills
     li
       a(href='/') Home
     li.active
       a(href='/tasks') Todo List
     li
       a(href="/tasks/completed") Completed
 h1= title

 .list
   .item.add-task
     div.action
       form(action='/tasks', method='post')
         input(type='hidden', value='true', name='all_done')
         input(type='hidden', value=locals._csrf, name='_csrf')
         input(type='submit', class='btn btn-success btn-xs', value='all done')
     form(action="/tasks", method='post')
       input(type='hidden', value=locals._csrf, name='_csrf')
       div.name
         input(type="text", name="name", placeholder='Add a new task')
       div.delete
         input.btn.btn-primary.btn-sm(type="submit", value='add')
   if (tasks.length === 0)
     | No tasks.
   each task, index in tasks
     .item
       div.action
         form(action='/tasks/#{task._id}', method='post')
           input(type='hidden', value=task._id.toString(), name='id')
           input(type='hidden', value='true', name='completed')
           input(type='hidden', value=locals._csrf, name='_csrf')
           input(type='submit', class='btn btn-success btn-xs task-done', value=\
'done')
       div.num
         span=index+1
           |.&nbsp;
       div.name
         span.name=task.name
         //- no support for DELETE method in forms
         //- http://amundsen.com/examples/put-delete-forms/
         //- so do XHR request instead from public/javascripts/main.js
       div.delete
         a(class='btn btn-danger btn-xs task-delete', data-task-id=task._id.toSt\
ring(), data-csrf=locals._csrf) delete

Last but not least comes tasks_completed.jade, which is just a stripped down version of the tasks.jade file:

extends layout

block content

 .menu
   h2 Menu
   ul.nav.nav-pills
     li
       a(href='/') Home
     li
       a(href='/tasks') Todo List
     li.active
       a(href="/tasks/completed") Completed

 h1= title

 .list
   if (tasks.length === 0)
     | No tasks.
   each task, index in tasks
     .item
       div.num
         span=index+1
           |.&nbsp;
       div.name.completed-task
         span.name=task.name

2.7 LESS

As we’ve mentioned before, after applying proper middleware in app.js files, we can put *.less files anywhere under the public folder. Express.js works by accepting a request for some .css file and tries to match the corresponding file by name. Therefore, we include *.css files in our jades.

Here is the content of the todo-express/public/stylesheets/main.less file:

* {
 font-size:20px;
}
.btn {
 // margin-left: 20px;
 // margin-right: 20px;
}
.num {
 // margin-right: 3px;
}
.item {
 height: 44px;
 width: 100%;
 clear: both;
 .name {
   width: 300px;
 }
 .action {
   width: 100px;
 }
 .delete {
   width: 100px
 }
 div {
   float:left;
 }
}
.home {
 margin-top: 40px;
}
.name.completed-task {
 text-decoration: line-through;
}

2.8 Conclusion

The Todo app is considered classic because it doesn’t rely on any front-end framework. This was done intentionally to show how easy it is to use Express.js for such tasks. In modern-day development, people often leverage some sort of REST API server architecture with a front-end client built with Backbone.js, Angular, Ember or something else. Our next examples dive into the details about how to write such servers.

3 REST API

Summary

In this tutorial, in addition to Express.js, we’ll use MongoDB via Mongoskin. We’ll also use Mocha and SuperAgent to write functional tests.

This tutorial will walk you through the writing test using the Mocha and Super Agent libraries, and then use them in a test-driven development manner to build a Node.js free JSON REST API server, utilizing the Express.js framework and Mongoskin library for MongoDB.

Example

All the source code is in github.com/azat-co/rest-api-express for your convenience.

In this REST API server, we’ll perform create, update, remove and delete (CRUD) operations and harness the Express.js middleware concept with app.param() and app.use() methods.

3.1 Test Coverage

Before anything else, let’s write functional tests that make HTTP requests to our soon-to-be-created REST API server. If you know how to use Mocha or just want to jump straight to the Express.js app implementation, feel free to do so. You can use CURL terminal commands for testing too.

Assuming we already have Node.js, NPM and MongoDB installed, let’s create a new folder (or if you wrote the tests, use that folder):

1 mkdir rest-api
2 cd rest-api

We’ll use the Mocha, Expect.js and Super Agent libraries. To install them, run these commands from the project folder:

$ npm install -g mocha
$ npm install expect.js
$ npm install superagent

Tip

Installing Mocha locally will give us the ability to use different versions at the same time. To run tests, simply point to ./node_modules/mocha/bin/mocha. A better alternative would be to use Makefile as outlined in the HackHall example.

Now let’s create an express.test.js file in the same folder, which will have six suites:

creating a new object
retrieving an object by its ID
retrieving the whole collection
updating an object by its ID
checking an updated object by its ID
removing an object by its ID

HTTP requests are a breeze with SuperAgent’s chained functions, which we’ll put inside of each test suite.

Here is the full source code for the rest-api-express/express.test.js file:

var superagent = require('superagent')
var expect = require('expect.js')

describe('express rest api server', function(){
 var id

 it('post object', function(done){
   superagent.post('http://localhost:3000/collections/test')
     .send({ name: 'John'
       , email: 'john@rpjs.co'
     })
     .end(function(e,res){
       // console.log(res.body)
       expect(e).to.eql(null)
       expect(res.body.length).to.eql(1)
       expect(res.body[0]._id.length).to.eql(24)
       id = res.body[0]._id
       done()
     })
 })

 it('retrieves an object', function(done){
   superagent.get('http://localhost:3000/collections/test/'+id)
     .end(function(e, res){
       // console.log(res.body)
       expect(e).to.eql(null)
       expect(typeof res.body).to.eql('object')
       expect(res.body._id.length).to.eql(24)
       expect(res.body._id).to.eql(id)
       done()
     })
 })

 it('retrieves a collection', function(done){
   superagent.get('http://localhost:3000/collections/test')
     .end(function(e, res){
       // console.log(res.body)
       expect(e).to.eql(null)
       expect(res.body.length).to.be.above(0)
       expect(res.body.map(function (item){return item._id})).to.contain(id)
       done()
     })
 })

 it('updates an object', function(done){
   superagent.put('http://localhost:3000/collections/test/'+id)
     .send({name: 'Peter'
       , email: 'peter@yahoo.com'})
     .end(function(e, res){
       // console.log(res.body)
       expect(e).to.eql(null)
       expect(typeof res.body).to.eql('object')
       expect(res.body.msg).to.eql('success')
       done()
     })
 })

 it('checks an updated object', function(done){
   superagent.get('http://localhost:3000/collections/test/'+id)
     .end(function(e, res){
       // console.log(res.body)
       expect(e).to.eql(null)
       expect(typeof res.body).to.eql('object')
       expect(res.body._id.length).to.eql(24)
       expect(res.body._id).to.eql(id)
       expect(res.body.name).to.eql('Peter')
       done()
     })
 })
 it('removes an object', function(done){
   superagent.del('http://localhost:3000/collections/test/'+id)
     .end(function(e, res){
       // console.log(res.body)
       expect(e).to.eql(null)
       expect(typeof res.body).to.eql('object')
       expect(res.body.msg).to.eql('success')
       done()
     })
 })
})

To run the tests, we can use the $ mocha express.test.js command.

3.2 Dependencies

In this tutorial, we’ll utilize Mongoskin, a MongoDB library, which is a better alternative to the plain good old native MongoDB driver for Node.js. In addition, Mongoskin is more lightweight than Mongoose and schema-less. For more insight, please check out this Mongoskin comparison blurb.

Express.js is a wrapper for core Node.js HTTP module objects. The Express.js framework is built on top of Connect middleware and provides tons of convenience. Some people compare the framework to Ruby’s Sinatra because it’s non-opinionated and configurable.

If you’ve created a rest-api folder in the previous section Test Coverage, simply run these commands to install modules for the application:

1 npm install express
2 npm install mongoskin

3.3 Implementation

First things first. Let’s define our dependencies:

1 var express = require('express')
2   , mongoskin = require('mongoskin')

After version 3.x, Express streamlines the instantiation of its app instance, so that this line will give us a server object:

1 var app = express()

To extract params from the body of the requests, we’ll use bodyParser() middleware which looks more like a configuration statement:

1 app.use(express.bodyParser())

Middleware (in this and other forms) is a powerful and convenient pattern in Express.js and Connect to organize and reuse code.

As with the bodyParser() method that saves us from the hurdles of parsing a body object of an HTTP request, Mongoskin makes it possible to connect to the MongoDB database in one effortless line of code:

1 var db = mongoskin.db('localhost:27017/test', {safe:true});

Note

If you wish to connect to a remote database, e.g., MongoHQ for instance, substitute the string with your username, password, host and port values. Here is the format of the URI string: mongodb://[username:password@] host1[:port1][,host2[:port2],... [,hostN[:portN]]] [/[database][?options]]

The app.param() method is another Express.js middleware. It basically says “do something every time there is this value in the URL pattern of the request handler.” In our case, we select a particular collection when a request pattern contains a string collectionName prefixed with a colon (you’ll see it later in the routes):

app.param('collectionName', function(req, res, next, collectionName){
 req.collection = db.collection(collectionName)
 return next()
})

Merely to be user-friendly, let’s put a root route with a message:

app.get('/', function(req, res, next) {
 res.send('please select a collection, e.g., /collections/messages')
})

Now the real work begins. Here is how we retrieve a list of items sorted by _id and that has a limit of 10:

app.get('/collections/:collectionName', function(req, res, next) {
 req.collection.find({},{
   limit:10, sort: [['_id',-1]]
 }).toArray(function(e, results){
   if (e) return next(e)
   res.send(results)
 })
})

Have you noticed a :collectionName string in the URL pattern parameter? This and the previous app.param() middleware is what gives us the req.collection object which points to a specified collection in our database.

The object-creating endpoint is slightly easier to grasp since we just pass the whole payload to the MongoDB (method a.k.a. free JSON REST API):

app.post('/collections/:collectionName', function(req, res, next) {
 req.collection.insert(req.body, {}, function(e, results){
   if (e) return next(e)
   res.send(results)
 })
})

Single-object-retrieval functions are faster than find(), but they use different interface (they return an object directly instead of a cursor — please be aware). We’re also extracting the ID from :id part of the path with req.params.id Express.js magic:

app.get('/collections/:collectionName/:id', function(req, res, next) {
 req.collection.findOne({
   _id: req.collection.id(req.params.id)
 }, function(e, result){
   if (e) return next(e)
   res.send(result)
 })
})

The PUT request handler gets more interesting because update() doesn’t return the augmented object; instead, it returns a count of affected objects.

Also {$set:req.body} is a special MongoDB operator (operators tend to start with a dollar sign) that sets values.

The second ` {safe:true, multi:false}` parameter is an object with options that tell MongoDB to wait for the execution before running the callback function and to process only one (the first) item.

app.put('/collections/:collectionName/:id', function(req, res, next) {
 req.collection.update({
     _id: req.collection.id(req.params.id)
   }, {$set:req.body}, {safe:true, multi:false},
   function(e, result){
     if (e) return next(e)
     res.send((result===1)?{msg:'success'}:{msg:'error'})
   }
 );
})

Finally, the DELETE method, which also outputs a custom JSON message:

app.del('/collections/:collectionName/:id', function(req, res, next) {
 req.collection.remove({
     _id: req.collection.id(req.params.id)
   },
   function(e, result){
     if (e) return next(e)
     res.send((result===1)?{msg:'success'}:{msg:'error'})
   }
 );
})

Note: The delete is an operator in JavaScript, so Express.js uses app.del instead.

The last line that actually starts the server on port 3000 in this case is:

1 app.listen(3000)

Just in case something is not working well, here is the full code of the rest-api-express/express.js file :

var express = require('express')
 , mongoskin = require('mongoskin')

var app = express()
app.use(express.bodyParser())

var db = mongoskin.db('localhost:27017/test', {safe:true});

app.param('collectionName', function(req, res, next, collectionName){
 req.collection = db.collection(collectionName)
 return next()
})

app.get('/', function(req, res, next) {
 res.send('please select a collection, e.g., /collections/messages')
})

app.get('/collections/:collectionName', function(req, res, next) {
 req.collection.find({},{limit:10, sort: [['_id',-1]]}).toArray(function(e, resu\
lts){
   if (e) return next(e)
   res.send(results)
 })
})

app.post('/collections/:collectionName', function(req, res, next) {
 req.collection.insert(req.body, {}, function(e, results){
   if (e) return next(e)
   res.send(results)
 })
})


app.get('/collections/:collectionName/:id', function(req, res, next) {
 req.collection.findOne({_id: req.collection.id(req.params.id)}, function(e, res\
ult){
   if (e) return next(e)
   res.send(result)
 })
})
app.put('/collections/:collectionName/:id', function(req, res, next) {
 req.collection.update({_id: req.collection.id(req.params.id)}, {$set:req.body},\
{safe:true, multi:false}, function(e, result){
   if (e) return next(e)
   res.send((result===1)?{msg:'success'}:{msg:'error'})
 })
})
app.del('/collections/:collectionName/:id', function(req, res, next) {
 req.collection.remove({_id: req.collection.id(req.params.id)}, function(e, resu\
lt){
   if (e) return next(e)
   res.send((result===1)?{msg:'success'}:{msg:'error'})
 })
})



app.listen(3000)

Exit your editor and run this command in your terminal:

1 $ node express.js

And in a different window (without closing the first one):

1 $ mocha express.test.js

If you really don’t like Mocha and/or BDD, CURL is always there for you. :-)

For example, CURL data to make a POST request:

1 $ curl -d "" http://localhost:3000

GET requests also work in the browser. For example http://localhost:3000/test.

In this tutorial, our tests are longer than the app code itself, so abandoning test-driven development might be tempting, but believe me, the good habits of TDD will save you hours and hours during any serious development when the complexity of the application you are working on is high.

3.4 Conclusion

The Express.js and Mongoskin libraries are great when you need to build a simple REST API server in a few lines of code. Later, if you need to expand the libraries, they also provide a way to configure and organize your code.

NoSQL databases like MongoDB are good at handling free-REST APIs. We don’t have to define schemas and can throw any data at it and it’ll be saved.

The full code for both test and app files: https://gist.github.com/azat-co/6075685.

If you would like to learn more about Express.js and other JavaScript libraries, take a look at the series Intro to Express.js tutorials.

Note

In this example, I’m using a semicolon-less style. Semicolons in JavaScript are absolutely optional except in two cases: in the for loop and before expressions/statements that start with parenthesis (e.g., Immediately-Invoked Function Expression).

4 HackHall

Summary

The HachHall app is a REST API server with a front-end client that is written in Backbone.js and Underscore. For the purpose of this book, we’ll illustrate how to use Express.js with MongoDB via Mongoose for the back-end REST API server. In addition, the project utilizes OAuth and sessions, and Mocha for TDD.

Example

The HackHall source code is in the public GitHub repository.

The live demo is accessible at hackhall.com, either with AngelList or pre-filled email (1@1.com) and password (1).

4.1 What is HackHall

HackHall (ex-Accelerator.IO) is an open-source invite-only social network and collaboration tool for hackers, hipsters, entrepreneurs and pirates (just kidding). HackHall is akin to Reddit, plus Hacker News, plus Facebook Groups with curation.

The HackHall project is in its early stage and roughly a beta. We plan to extend the code base in the future and bring in more people to share skills, wisdom and passion for programming.

In this chapter, we’ll cover the 1.0 release which has:

OAuth 1.0 with oauth modules and AngelList API
Email and password authentication
Mongoose models and schemas
Express.js structure with routes in modules
JSON REST API
Express.js error handling
Front-end client Backbone.js app (for more info on Backbone.js, download/read online our Rapid Prototyping with JS tutorials)
Environmental variables with Foreman’s .env
TDD with Mocha
Basic Makefile setup

4.2 Running HackHall

To get the source code, you can navigate to the hackhall folder or clone it from GitHub:

$ git clone git@github.com:azat-co/hackhall
$ git checkout 1.0
$ npm install

If you plan to test an AngelList (optional), HackHall is using a Heroku and Foreman setup for AngelList API keys, storing them in environmental variables, so we need to add an .evn file like this (below are fake values):

1 ANGELLIST_CLIENT_ID=254C0335-5F9A-4607-87C0
2 ANGELLIST_CLIENT_SECRET=99F5C1AC-C5F7-44E6-81A1-8DF4FC42B8D9

The keys can be found at angel.co/api after someone creates and registers his/her AngelList app.

Download and install MongoDB if you don’t have it already. The databases and third-party libraries are outside of the scope of this book. However, you can find enough materials online and in Rapid Prototyping with JS.

To start the MongoDB server, open a new terminal window and run:

1 $ mongod

Go back to the project folder and run:

1 $ foreman start

After MongoDB is running on localhost with default port 27017, it’s possible to seed the database hackhall with a default admin user by running seed.js MongoDB script:

1 $ mongo localhost:27017/hackhall seed.js

Feel free to modify seed.js to your liking (beware that it erases all previous data!):

db.dropDatabase();
var seedUser ={
 firstName:'Azat',
 lastName:"Mardanov", 
 displayName:"Azat Mardanov",
 password:'1',
 email:'1@1.com',
 role:'admin',
 approved: true, 
 admin: true
};
db.users.save(seedUser);

If you open your browser at http://localhost:5000, you should see the login screen.

The HackHall login page running locally.

Enter username and password to get in (the ones from the seed.js file).

The HackHall login page with seed data.

After successful authentication, users are redirected to the Posts page:

The HackHall Posts page.

where they can create a post (e.g., a question):

The HackHall Posts page.

Save the post:

The HackHall Posts page with a saved post.

Like posts:

The HackHall Posts page with a liked post.

Visit other users’ profiles:

The HackHall People page.

If they have admin rights, users can approve applicants:

The HackHall People page with admin rights.

and manage their account on the Profile page:

The HackHall Profile page.

4.3 Structure

Here are what each of the folders and files contain:

/api: app-shared routes
/models: Mongoose models
/public: Backbone app, static files like front-end JavaScript, CSS, HTML
/routes: REST API routes
/tests: Mocha tests
.gitignore: list of files that git should ignore
Makefile: make file to run tests
Procfile: Cedar stack file needed for Heroku deployment
package.json: NPM dependencies and HackHall metadata
readme.md: description
server.js: main HackHall server file

Content of the HackHall base folder.

4.4 Express.js App

Let’s jump straight to the server.js file and learn how it’s implemented. Firstly, we declare dependencies:

var express = require('express'),
 routes = require('./routes'),
 http = require('http'),
 util = require('util'),
 oauth = require('oauth'),
 querystring = require('querystring');

Then, we initialize the app and configure middlewares. The process.env.PORT is populated by Heroku, and in the case of a local setup, falls back on 3000.

var app = express();
app.configure(function(){
 app.set('port', process.env.PORT || 3000  );
 app.use(express.favicon());
 app.use(express.logger('dev'));
 app.use(express.bodyParser());
 app.use(express.methodOverride());

The values passed to cookieParser and session middlewares are needed for authentication. Obviously, session secrets are supposed to be private:

 app.use(express.cookieParser('asd;lfkajs;ldfkj'));
 app.use(express.session({
   secret: '<h1>WHEEYEEE</h1>',
   key: 'sid',
   cookie: {
     secret: true,
     expires: false
   }
 }));

This is how we serve our front-end client Backbone.js app and other static files like CSS:

 app.use(express.static(__dirname + '/public'));
 app.use(app.router);
});

Error handling is broken down into three functions with clientErrorHandler dedicated to AJAX/XHR requests from the Backbone.js app (responds with JSON):

app.configure(function() {
 app.use(logErrors);
 app.use(clientErrorHandler);
 app.use(errorHandler);
});

function logErrors(err, req, res, next) {
 console.error('logErrors', err.toString());
 next(err);
}

function clientErrorHandler(err, req, res, next) {
 console.error('clientErrors ', err.toString());
 res.send(500, { error: err.toString()});
 if (req.xhr) {
   console.error(err);
   res.send(500, { error: err.toString()});
 } else {
   next(err);
 }
}

function errorHandler(err, req, res, next) {
 console.error('lastErrors ', err.toString());
 res.send(500, {error: err.toString()});
}

In the same way that we determine process.env.PORT and fallback on local setup value 3000, we do a similar thing with a MongoDB connection string:

var dbUrl = process.env.MONGOHQ_URL
 || 'mongodb://@127.0.0.1:27017/hackhall';
var mongoose = require('mongoose');
var connection = mongoose.createConnection(dbUrl);
connection.on('error', console.error.bind(console,
 'connection error:'));

Sometimes it’s a good idea to log the connection open event:

connection.once('open', function () {
 console.info('connected to database')
});

The Mongoose models live in the models folder:

1 var models = require('./models');

This middleware will provide access to two collections within our routes methods:

function db (req, res, next) {
 req.db = {
   User: connection.model('User', models.User, 'users'),
   Post: connection.model('Post', models.Post, 'posts')
 };
 return next();
}

Just a new name for imported auth functions:

checkUser = routes.main.checkUser;
checkAdmin = routes.main.checkAdmin;
checkApplicant = routes.main.checkApplicant;

AngelList OAuth routes:

app.get('/auth/angellist', routes.auth.angelList);
app.get('/auth/angellist/callback',
 routes.auth.angelListCallback,
 routes.auth.angelListLogin,
 db,
 routes.users.findOrAddUser);

Main application routes including the api/profile return user session if user is logged in:

//MAIN
app.get('/api/profile', checkUser, db, routes.main.profile);
app.del('/api/profile', checkUser, db, routes.main.delProfile);
app.post('/api/login', db, routes.main.login);
app.post('/api/logout', routes.main.logout);

The POST requests for creating users and posts:

//POSTS
app.get('/api/posts', checkUser, db, routes.posts.getPosts);
app.post('/api/posts', checkUser, db, routes.posts.add);
app.get('/api/posts/:id', checkUser, db, routes.posts.getPost);
app.put('/api/posts/:id', checkUser, db, routes.posts.updatePost);
app.del('/api/posts/:id', checkUser, db, routes.posts.del);

//USERS
app.get('/api/users', checkUser, db, routes.users.getUsers);
app.get('/api/users/:id', checkUser, db,routes.users.getUser);
app.post('/api/users', checkAdmin, db, routes.users.add);
app.put('/api/users/:id', checkAdmin, db, routes.users.update);
app.del('/api/users/:id', checkAdmin, db, routes.users.del);

These routes are for new members that haven’t been approved yet:

//APPLICATION
app.post('/api/application',
 checkAdmin,
 db,
 routes.application.add);
app.put('/api/application',
 checkApplicant,
 db,
 routes.application.update);
app.get('/api/application',
 checkApplicant,
 db,
 routes.application.get);

The catch-all-else route:

app.get('*', function(req, res){
 res.send(404);
});

The require.main === module is a clever trick to determine if this file is being executed as a standalone or as an imported module:

http.createServer(app);
if (require.main === module) {
 app.listen(app.get('port'), function(){
   console.info('Express server listening on port '
     + app.get('port'));
 });
}
else {
 console.info('Running app as a module')
 exports.app = app;
}

The full source code for hackhall/server.js:

var express = require('express'),
 routes = require('./routes'),
 http = require('http'),
 util = require('util'),
 oauth = require('oauth'),
 querystring = require('querystring');

var app = express();
app.configure(function(){
 app.set('port', process.env.PORT || 3000  );
 app.use(express.favicon());
 app.use(express.logger('dev'));
 app.use(express.bodyParser());
 app.use(express.methodOverride());
 app.use(express.cookieParser('asd;lfkajs;ldfkj'));
 app.use(express.session({
   secret: '<h1>WHEEYEEE</h1>',
   key: 'sid',
   cookie: {
     secret: true,
     expires: false      
   }
 }));
 // app.use(express.csrf());
 // app.use(function(req, res, next) {
   // res.locals.csrf = req.session._cstf;
   // return next();
 // });
 app.use(express.static(__dirname + '/public'));
 app.use(app.router);
});

app.configure(function() {
 app.use(logErrors);
 app.use(clientErrorHandler);
 app.use(errorHandler);
});

function logErrors(err, req, res, next) {
 console.error('logErrors', err.toString());
 next(err);
}

function clientErrorHandler(err, req, res, next) {
 console.error('clientErrors ', err.toString());
 res.send(500, { error: err.toString()});
 if (req.xhr) {
   console.error(err);
   res.send(500, { error: err.toString()});
 } else {
   next(err);
 }
}

function errorHandler(err, req, res, next) {
 console.error('lastErrors ', err.toString());  
 res.send(500, {error: err.toString()});
}

var dbUrl = process.env.MONGOHQ_URL || 'mongodb://@127.0.0.1:27017/hackhall';
var mongoose = require('mongoose');
var connection = mongoose.createConnection(dbUrl);
connection.on('error', console.error.bind(console, 'connection error:'));
connection.once('open', function () {
 console.info('connected to database')
});

var models = require('./models');
function db (req, res, next) {
 req.db = {
   User: connection.model('User', models.User, 'users'),
   Post: connection.model('Post', models.Post, 'posts')
 };
 return next();
}
checkUser = routes.main.checkUser;
checkAdmin = routes.main.checkAdmin;
checkApplicant = routes.main.checkApplicant;

app.get('/auth/angellist', routes.auth.angelList);
app.get('/auth/angellist/callback',
 routes.auth.angelListCallback, 
 routes.auth.angelListLogin,
 db, 
 routes.users.findOrAddUser);

//MAIN
app.get('/api/profile', checkUser, db, routes.main.profile);
app.del('/api/profile', checkUser, db, routes.main.delProfile);
app.post('/api/login', db, routes.main.login);
app.post('/api/logout', routes.main.logout);

//POSTS
app.get('/api/posts', checkUser, db, routes.posts.getPosts);
app.post('/api/posts', checkUser, db, routes.posts.add);
app.get('/api/posts/:id', checkUser, db, routes.posts.getPost);
app.put('/api/posts/:id', checkUser, db, routes.posts.updatePost);
app.del('/api/posts/:id', checkUser, db, routes.posts.del);

//USERS
app.get('/api/users', checkUser, db, routes.users.getUsers);
app.get('/api/users/:id', checkUser, db,routes.users.getUser);
app.post('/api/users', checkAdmin, db, routes.users.add);
app.put('/api/users/:id', checkAdmin, db, routes.users.update);
app.del('/api/users/:id', checkAdmin, db, routes.users.del);

//APPLICATION 
app.post('/api/application', checkAdmin, db, routes.application.add); 
app.put('/api/application', checkApplicant, db, routes.application.update);
app.get('/api/application', checkApplicant, db, routes.application.get);

app.get('*', function(req, res){
 res.send(404);
});

http.createServer(app);
if (require.main === module) {
 app.listen(app.get('port'), function(){
   console.info('Express server listening on port ' + app.get('port'));
 });
}
else {
 console.info('Running app as a module')
 exports.app = app;
}

4.5 Routes

The HackHall routes reside in the hackhall/routes folder and are grouped into several modules:

hackhall/routes/index.js: bridge between server.js and other routes in the folder
hackhall/routes/auth.js: routes that handle OAuth dance with AngelList API
hackhall/routes/main.js: login, logout and other routes
hackhall/routes/users.js: routes related to users’ REST API
hackhall/routes/application.js: submission of application to become a user
hackhall/routes/posts.js: routes related to posts’ REST API

4.5.1 index.js

Let’s peek into hackhall/routes/index.js where we’ve included other modules:

exports.posts = require('./posts');
exports.main = require('./main');
exports.users = require('./users');
exports.application = require('./application');
exports.auth = require('./auth');

4.5.2 auth.js

In this module, we’ll handle OAuth dance with AngelList API. To do so, we’ll have to rely on the https library:

1 var https = require('https');

The AngelList API client ID and client secret are obtained at theangel.co/api website and stored in environment variables:

1 var angelListClientId = process.env.ANGELLIST_CLIENT_ID;
2 var angelListClientSecret = process.env.ANGELLIST_CLIENT_SECRET;

The method will redirect users to the angel.co website for authentication:

exports.angelList = function(req, res) {
 res.redirect('https://angel.co/api/oauth/authorize?client_id=' + angelListClien\
tId + '&scope=email&response_type=code');
}

After users allow our app to access their information, AngelList sends them back to this route to allow us to make a new (HTTPS) request to retrieve the token:

exports.angelListCallback = function(req, res, next) {
 var token;
 var buf = '';
 var data;
 // console.log('/api/oauth/token?client_id='
 //+ angelListClientId
 //+ '&client_secret='
 //+ angelListClientSecret
 //+ '&code='
 //+ req.query.code
 //+ '&grant_type=authorization_code');
 var angelReq = https.request({
     host: 'angel.co',
     path: '/api/oauth/token?client_id='
       + angelListClientId
       + '&client_secret='
       + angelListClientSecret
       + '&code='
       + req.query.code
       + '&grant_type=authorization_code',
     port: 443,
     method: 'POST',
     headers: {
       'content-length': 0
     }
   },
   function(angelRes) {
     angelRes.on('data', function(buffer) {
       buf += buffer;
     });
     angelRes.on('end', function() {
       try {
         data = JSON.parse(buf.toString('utf-8'));
       } catch (e) {
         if (e) return res.send(e);
       }
       if (!data || !data.access_token) return res.send(500);
       token = data.access_token;
       req.session.angelListAccessToken = token;
       if (token) next();
       else res.send(500);
     });
   });
 angelReq.end();
 angelReq.on('error', function(e) {
   console.error(e);
   next(e);
 });
}

Directly call AngleList API with the token from the previous middleware to get user information:

exports.angelListLogin = function(req, res, next) {
 token = req.session.angelListAccessToken;
 httpsRequest = https.request({
     host: 'api.angel.co',
     path: '/1/me?access_token=' + token,
     port: 443,
     method: 'GET'
   },
   function(httpsResponse) {
     httpsResponse.on('data', function(buffer) {
       data = JSON.parse(buffer.toString('utf-8'));
       if (data) {
         req.angelProfile = data;
         next();
       }
     });
   }
 );
 httpsRequest.end();
 httpsRequest.on('error', function(e) {
   console.error(e);
 });
};

The full source code for hackhall/routes/auth.js files:

var https = require('https');

var angelListClientId = process.env.ANGELLIST_CLIENT_ID;
var angelListClientSecret = process.env.ANGELLIST_CLIENT_SECRET;

exports.angelList = function(req, res) {
 res.redirect('https://angel.co/api/oauth/authorize?client_id=' + angelListClien\
tId + '&scope=email&response_type=code');
}
exports.angelListCallback = function(req, res, next) {
 var token;
 var buf = '';
 var data;
 // console.log('/api/oauth/token?client_id=' + angelListClientId + '&client_sec\
ret=' + angelListClientSecret + '&code=' + req.query.code + '&grant_type=authoriz\
ation_code');
 var angelReq = https.request({
     host: 'angel.co',
     path: '/api/oauth/token?client_id=' + angelListClientId + '&client_secret='\
+ angelListClientSecret + '&code=' + req.query.code + '&grant_type=authorization\
_code',
     port: 443,
     method: 'POST',
     headers: {
       'content-length': 0
     }
   },
   function(angelRes) {

     angelRes.on('data', function(buffer) {
       buf += buffer;
     });
     angelRes.on('end', function() {
       try {
         data = JSON.parse(buf.toString('utf-8'));
       } catch (e) {
         if (e) return res.send(e);
       }
       if (!data || !data.access_token) return res.send(500);
       token = data.access_token;
       req.session.angelListAccessToken = token;
       if (token) next();
       else res.send(500);
     });
   });
 angelReq.end();
 angelReq.on('error', function(e) {
   console.error(e);
   next(e);
 });
}
exports.angelListLogin = function(req, res, next) {
 token = req.session.angelListAccessToken;
 httpsRequest = https.request({
     host: 'api.angel.co',
     path: '/1/me?access_token=' + token,
     port: 443,
     method: 'GET'
   },
   function(httpsResponse) {
     httpsResponse.on('data', function(buffer) {
       data = JSON.parse(buffer.toString('utf-8'));
       if (data) {
         req.angelProfile = data;
         next();
       }
     });
   }
 );
 httpsRequest.end();
 httpsRequest.on('error', function(e) {
   console.error(e);
 });
};

4.5.3 main.js

The hackhall/routes/main.js file is also interesting.

The checkAdmin() function performs authentication for admin privileges. If the session object doesn’t carry the proper flag, we call Express.js next() function with an error object:

exports.checkAdmin = function(request, response, next) {
 if (request.session
   && request.session.auth
   && request.session.userId
   && request.session.admin) {
   console.info('Access ADMIN: ' + request.session.userId);
   return next();
 } else {
   next('User is not an administrator.');
 }
};

Similarly, we can check only for the user without checking for admin rights:

exports.checkUser = function(req, res, next) {
 if (req.session && req.session.auth && req.session.userId
   && (req.session.user.approved || req.session.admin)) {
   console.info('Access USER: ' + req.session.userId);
   return next();
 } else {
   next('User is not logged in.');
 }
};

If an application is just an unapproved user object, we can also check for that:

exports.checkApplicant = function(req, res, next) {
 if (req.session && req.session.auth && req.session.userId
   && (!req.session.user.approved || req.session.admin)) {
   console.info('Access USER: ' + req.session.userId);
   return next();
 } else {
   next('User is not logged in.');
 }
};

In the login function, we search for email and password matches in the database. Upon success, we store the user object in the session and proceed; otherwise the request fails:

exports.login = function(req, res, next) {
 req.db.User.findOne({
     email: req.body.email,
     password: req.body.password
   },
   null, {
     safe: true
   },
   function(err, user) {
     if (err) return next(err);
     if (user) {
       req.session.auth = true;
       req.session.userId = user._id.toHexString();
       req.session.user = user;
       if (user.admin) {
         req.session.admin = true;
       }
       console.info('Login USER: ' + req.session.userId);
       res.json(200, {
         msg: 'Authorized'
       });
     } else {
       next(new Error('User is not found.'));
     }
   });
};

The logging out process removes any session information:

exports.logout = function(req, res) {
 console.info('Logout USER: ' + req.session.userId);
 req.session.destroy(function(error) {
   if (!error) {
     res.send({
       msg: 'Logged out'
     });
   }
 });
};

This route is used for the Profile page as well as by Backbone.js for user authentication:

exports.profile = function(req, res, next) {
 req.db.User.findById(req.session.userId, 'firstName lastName'
     + 'displayName headline photoUrl admin'
     + 'approved banned role angelUrl twitterUrl'
     + 'facebookUrl linkedinUrl githubUrl', function(err, obj) {
   if (err) next(err);
   if (!obj) next(new Error('User is not found'));
   req.db.Post.find({
     author: {
       id: obj._id,
       name: obj.displayName
     }
   }, null, {
     sort: {
       'created': -1
     }
   }, function(err, list) {
     if (err) next(err);
     obj.posts.own = list || [];
     req.db.Post.find({
       likes: obj._id
     }, null, {
       sort: {
         'created': -1
       }

This logic finds posts and comments made by the user:

     }, function(err, list) {
       if (err) next(err);
       obj.posts.likes = list || [];
       req.db.Post.find({
         watches: obj._id
       }, null, {
         sort: {
           'created': -1
         }
       }, function(err, list) {
         if (err) next(err);
         obj.posts.watches = list || [];
         req.db.Post.find({
           'comments.author.id': obj._id
         }, null, {
           sort: {
             'created': -1
           }
         }, function(err, list) {
           if (err) next(err);
           obj.posts.comments = [];
           list.forEach(function(value, key, list) {
             obj.posts.comments.push(
               value.comments.filter(
                 function(el, i, arr) {
                   return (el.author.id.toString() == obj._id.toString());
                 }
               )
             );
           });
           res.json(200, obj);
         });
       });
     });
   });
 });
};

It’s important to allow users to delete their profiles:

exports.delProfile = function(req, res, next) {
 console.log('del profile');
 console.log(req.session.userId);
 req.db.User.findByIdAndRemove(req.session.user._id, {},
   function(err, obj) {
     if (err) next(err);
     req.session.destroy(function(error) {
       if (err) {
         next(err)
       }
     });
     res.json(200, obj);
   }
 );
};

The full source code of hackhall/routes/main.js files:

exports.checkAdmin = function(request, response, next) {
 if (request.session && request.session.auth && request.session.userId && reques\
t.session.admin) {
   console.info('Access ADMIN: ' + request.session.userId);
   return next();
 } else {
   next('User is not an administrator.');
 }
};

exports.checkUser = function(req, res, next) {
 if (req.session && req.session.auth && req.session.userId && (req.session.user.\
approved || req.session.admin)) {
   console.info('Access USER: ' + req.session.userId);
   return next();
 } else {
   next('User is not logged in.');
 }
};

exports.checkApplicant = function(req, res, next) {
 if (req.session && req.session.auth && req.session.userId && (!req.session.user\
.approved || req.session.admin)) {
   console.info('Access USER: ' + req.session.userId);
   return next();
 } else {
   next('User is not logged in.');
 }
};

exports.login = function(req, res, next) {
 req.db.User.findOne({
     email: req.body.email,
     password: req.body.password
   },
   null, {
     safe: true
   },
   function(err, user) {
     if (err) return next(err);
     if (user) {
       req.session.auth = true;
       req.session.userId = user._id.toHexString();
       req.session.user = user;
       if (user.admin) {
         req.session.admin = true;
       }
       console.info('Login USER: ' + req.session.userId);
       res.json(200, {
         msg: 'Authorized'
       });
     } else {
       next(new Error('User is not found.'));
     }
   });
};

exports.logout = function(req, res) {
 console.info('Logout USER: ' + req.session.userId);
 req.session.destroy(function(error) {
   if (!error) {
     res.send({
       msg: 'Logged out'
     });
   }
 });
};

exports.profile = function(req, res, next) {
 req.db.User.findById(req.session.userId, 'firstName lastName displayName headli\
ne photoUrl admin approved banned role angelUrl twitterUrl facebookUrl linkedinUr\
l githubUrl', function(err, obj) {
   if (err) next(err);
   if (!obj) next(new Error('User is not found'));
   req.db.Post.find({
     author: {
       id: obj._id,
       name: obj.displayName
     }
   }, null, {
     sort: {
       'created': -1
     }
   }, function(err, list) {
     if (err) next(err);
     obj.posts.own = list || [];
     req.db.Post.find({
       likes: obj._id
     }, null, {
       sort: {
         'created': -1
       }
     }, function(err, list) {
       if (err) next(err);
       obj.posts.likes = list || [];
       req.db.Post.find({
         watches: obj._id
       }, null, {
         sort: {
           'created': -1
         }
       }, function(err, list) {
         if (err) next(err);
         obj.posts.watches = list || [];
         req.db.Post.find({
           'comments.author.id': obj._id
         }, null, {
           sort: {
             'created': -1
           }
         }, function(err, list) {
           if (err) next(err);
           obj.posts.comments = [];
           list.forEach(function(value, key, list) {
             obj.posts.comments.push(value.comments.filter(function(el, i, arr) {
               return (el.author.id.toString() == obj._id.toString());
             }));
           });
           res.json(200, obj);
         });
       });
     });
   });
 });
};

exports.delProfile = function(req, res, next) {
 console.log('del profile');
 console.log(req.session.userId);
 req.db.User.findByIdAndRemove(req.session.user._id, {}, function(err, obj) {
   if (err) next(err);
   req.session.destroy(function(error) {
     if (err) {
       next(err)
     }
   });
   res.json(200, obj);
 });
};

4.5.4 users.js

The full source code for hackhall/routes/users.js files:

objectId = require('mongodb').ObjectID;

exports.getUsers = function(req, res, next) {
 if (req.session.auth && req.session.userId) {
   req.db.User.find({}, 'firstName lastName displayName headline photoUrl admin \
approved banned role angelUrl twitterUrl facebookUrl linkedinUrl githubUrl', func\
tion(err, list) {
     if (err) next(err);
     res.json(200, list);
   });
 } else {
   next('User is not recognized.')
 }
}

exports.getUser = function(req, res, next) {
 req.db.User.findById(req.params.id, 'firstName lastName displayName headline ph\
otoUrl admin approved banned role angelUrl twitterUrl facebookUrl linkedinUrl git\
hubUrl', function(err, obj) {
   if (err) next(err);
   if (!obj) next(new Error('User is not found'));
   req.db.Post.find({
     author: {
       id: obj._id,
       name: obj.displayName
     }
   }, null, {
     sort: {
       'created': -1
     }
   }, function(err, list) {
     if (err) next(err);
     obj.posts.own = list || [];
     req.db.Post.find({
       likes: obj._id
     }, null, {
       sort: {
         'created': -1
       }
     }, function(err, list) {
       if (err) next(err);
       obj.posts.likes = list || [];
       req.db.Post.find({
         watches: obj._id
       }, null, {
         sort: {
           'created': -1
         }
       }, function(err, list) {
         if (err) next(err);
         obj.posts.watches = list || [];
         req.db.Post.find({
           'comments.author.id': obj._id
         }, null, {
           sort: {
             'created': -1
           }
         }, function(err, list) {
           if (err) next(err);
           obj.posts.comments = [];
           list.forEach(function(value, key, list) {
             obj.posts.comments.push(value.comments.filter(function(el, i, arr) {
               return (el.author.id.toString() == obj._id.toString());
             }));
           });
           res.json(200, obj);
         });
       });
     });
   });
 });
};

exports.add = function(req, res, next) {
 var user = new req.db.User(req.body);
 user.save(function(err) {
   if (err) next(err);
   res.json(user);
 });
};

exports.update = function(req, res, next) {
 var obj = req.body;
 obj.updated = new Date();
 delete obj._id;
 req.db.User.findByIdAndUpdate(req.params.id, {
   $set: obj
 }, {
   new: true
 }, function(err, obj) {
   if (err) next(err);
   res.json(200, obj);
 });
};

exports.del = function(req, res, next) {
 req.db.User.findByIdAndRemove(req.params.id, function(err, obj) {
   if (err) next(err);
   res.json(200, obj);
 });
};

exports.findOrAddUser = function(req, res, next) {
 data = req.angelProfile;
 req.db.User.findOne({
   angelListId: data.id
 }, function(err, obj) {
   console.log('angelListLogin4');
   if (err) next(err);
   console.warn(obj);
   if (!obj) {
     req.db.User.create({
       angelListId: data.id,
       angelToken: token,
       angelListProfile: data,
       email: data.email,
       firstName: data.name.split(' ')[0],
       lastName: data.name.split(' ')[1],
       displayName: data.name,
       headline: data.bio,
       photoUrl: data.image,
       angelUrl: data.angellist_url,
       twitterUrl: data.twitter_url,
       facebookUrl: data.facebook_url,
       linkedinUrl: data.linkedin_url,
       githubUrl: data.github_url
     }, function(err, obj) { //remember the scope of variables!
       if (err) next(err);
       console.log(obj);
       req.session.auth = true;
       req.session.userId = obj._id;
       req.session.user = obj;
       req.session.admin = false; //assing regular user role by default         \
        
       res.redirect('/#application');
       // }
     });
   } else { //user is in the database
     req.session.auth = true;
     req.session.userId = obj._id;
     req.session.user = obj;
     req.session.admin = obj.admin; //false; //assing regular user role by defau\
lt
     if (obj.approved) {
       res.redirect('/#posts');
     } else {
       res.redirect('/#application');
     }
   }
 })
}

4.5.5 applications.js

In the current version, submitting and approving an application won’t trigger an email notification. Therefore, users have to come back to the website to check their status.

Merely add a user object (with approved=false by default) to the database:

exports.add = function(req, res, next) {
 req.db.User.create({
   firstName: req.body.firstName,
   lastName: req.body.lastName,
   displayName: req.body.displayName,
   headline: req.body.headline,
   photoUrl: req.body.photoUrl,
   password: req.body.password,
   email: req.body.email,
   angelList: {
     blah: 'blah'
   },
   angelUrl: req.body.angelUrl,
   twitterUrl: req.body.twitterUrl,
   facebookUrl: req.body.facebookUrl,
   linkedinUrl: req.body.linkedinUrl,
   githubUrl: req.body.githubUrl
 }, function(err, obj) {
   if (err) next(err);
   if (!obj) next('Cannot create.')
   res.json(200, obj);
 })
};

Let the users update information in their applications:

exports.update = function(req, res, next) {
 var data = {};
 Object.keys(req.body).forEach(function(k) {
   if (req.body[k]) {
     data[k] = req.body[k];
   }
 });
 delete data._id;
 req.db.User.findByIdAndUpdate(req.session.user._id, {
   $set: data
 }, function(err, obj) {
   if (err) next(err);
   if (!obj) next('Cannot save.')
   res.json(200, obj);
 });
};

Select a particular object with the get() function:

exports.get = function(req, res, next) {
 req.db.User.findById(req.session.user._id,
   'firstName lastName photoUrl headline displayName'
     + 'angelUrl facebookUrl twitterUrl linkedinUrl'
     + 'githubUrl', {}, function(err, obj) {
     if (err) next(err);
     if (!obj) next('cannot find');
     res.json(200, obj);
   })
};

The full source code of hackhall/routes/applications.js files:

<<(hackhall/routes/applications.js)

4.5.6 posts.js

The last routes module that we bisect is hackhall/routes/posts.js. It takes care of adding, editing and removing posts, as well as commenting, watching and liking.

We use object ID for conversion from HEX strings to proper objects:

1 objectId = require('mongodb').ObjectID;

The coloring is nice for logging, but it’s of course optional. We accomplish it with escape sequences:

var red, blue, reset;
red   = '\u001b[31m';
blue  = '\u001b[34m';
reset = '\u001b[0m';
console.log(red + 'This is red' + reset + ' while ' + blue + ' this is blue' + re\
set);

The default values for the pagination of posts:

1 var LIMIT = 10;
2 var SKIP = 0;

The add() function handles creation of new posts:

exports.add = function(req, res, next) {
 if (req.body) {
   req.db.Post.create({
     title: req.body.title,
     text: req.body.text || null,
     url: req.body.url || null,
     author: {
       id: req.session.user._id,
       name: req.session.user.displayName
     }
   }, function(err, docs) {
     if (err) {
       console.error(err);
       next(err);
     } else {
       res.json(200, docs);
     }

   });
 } else {
   next(new Error('No data'));
 }
};

To retrieve the list of posts:

exports.getPosts = function(req, res, next) {
 var limit = req.query.limit || LIMIT;
 var skip = req.query.skip || SKIP;
 req.db.Post.find({}, null, {
   limit: limit,
   skip: skip,
   sort: {
     '_id': -1
   }
 }, function(err, obj) {
   if (!obj) next('There are not posts.');
   obj.forEach(function(item, i, list) {
     if (req.session.user.admin) {
       item.admin = true;
     } else {
       item.admin = false;
     }
     if (item.author.id == req.session.userId) {
       item.own = true;
     } else {
       item.own = false;
     }
     if (item.likes
       && item.likes.indexOf(req.session.userId) > -1) {
       item.like = true;
     } else {
       item.like = false;
     }
     if (item.watches
       && item.watches.indexOf(req.session.userId) > -1) {
       item.watch = true;
     } else {
       item.watch = false;
     }
   });
   var body = {};
   body.limit = limit;
   body.skip = skip;
   body.posts = obj;
   req.db.Post.count({}, function(err, total) {
     if (err) next(err);
     body.total = total;
     res.json(200, body);
   });
 });
};

For the individual post page, we need the getPost() method:

exports.getPost = function(req, res, next) {
 if (req.params.id) {
   req.db.Post.findById(req.params.id, {
     title: true,
     text: true,
     url: true,
     author: true,
     comments: true,
     watches: true,
     likes: true
   }, function(err, obj) {
     if (err) next(err);
     if (!obj) {
       next('Nothing is found.');
     } else {
       res.json(200, obj);
     }
   });
 } else {
   next('No post id');
 }
};

The del() function removes specific posts from the database. The findById() and remove() methods from Mongoose are used in this snippet. However, the same thing can be accomplished with just remove().

exports.del = function(req, res, next) {
 req.db.Post.findById(req.params.id, function(err, obj) {
   if (err) next(err);
   if (req.session.admin || req.session.userId === obj.author.id) {
     obj.remove();
     res.json(200, obj);
   } else {
     next('User is not authorized to delete post.');
   }
 })
};

To like the post, we update the post item by prepending the post.likes array with the ID of the user:

function likePost(req, res, next) {
 req.db.Post.findByIdAndUpdate(req.body._id, {
   $push: {
     likes: req.session.userId
   }
 }, {}, function(err, obj) {
   if (err) {
     next(err);
   } else {
     res.json(200, obj);
   }
 });
};

Likewise, when a user performs the watch action, the system adds a new ID to the post.watches array:

function watchPost(req, res, next) {
 req.db.Post.findByIdAndUpdate(req.body._id, {
   $push: {
     watches: req.session.userId
   }
 }, {}, function(err, obj) {
   if (err) next(err);
   else {
     res.json(200, obj);
   }
 });
};

The updatePost() is what calls like or watch functions based on the action flag sent with the request. In addition, the updatePost() processes the changes to the post and comments:

exports.updatePost = function(req, res, next) {
 var anyAction = false;
 if (req.body._id && req.params.id) {
   if (req.body && req.body.action == 'like') {
     anyAction = true;
     likePost(req, res);
   }
   if (req.body && req.body.action == 'watch') {
     anyAction = true;
     watchPost(req, res);
   }
   if (req.body && req.body.action == 'comment'
     && req.body.comment && req.params.id) {
     anyAction = true;
     req.db.Post.findByIdAndUpdate(req.params.id, {
       $push: {
         comments: {
           author: {
             id: req.session.userId,
             name: req.session.user.displayName
           },
           text: req.body.comment
         }
       }
     }, {
       safe: true,
       new: true
     }, function(err, obj) {
       if (err) throw err;
       res.json(200, obj);
     });
   }
   if (req.session.auth && req.session.userId && req.body
     && req.body.action != 'comment' &&
     req.body.action != 'watch' && req.body != 'like' &&
     req.params.id && (req.body.author.id == req.session.user._id
     || req.session.user.admin)) {
     req.db.Post.findById(req.params.id, function(err, doc) {
       if (err) next(err);
       doc.title = req.body.title;
       doc.text = req.body.text || null;
       doc.url = req.body.url || null;
       doc.save(function(e, d) {
         if (e) next(e);
         res.json(200, d);
       });
     })
   } else {
     if (!anyAction) next('Something went wrong.');
   }

 } else {
   next('No post ID.');
 }
};

The full source code for the hackhall/routes/posts.js file:

objectId = require('mongodb').ObjectID;
var red, blue, reset;
red = '\u001b[31m';
blue = '\u001b[34m';
reset = '\u001b[0m';
console.log(red + 'This is red' + reset + ' while ' + blue + ' this is blue' + re\
set);

var LIMIT = 10;
var SKIP = 0;

exports.add = function(req, res, next) {
 if (req.body) {
   req.db.Post.create({
     title: req.body.title,
     text: req.body.text || null,
     url: req.body.url || null,
     author: {
       id: req.session.user._id,
       name: req.session.user.displayName
     }
   }, function(err, docs) {
     if (err) {
       console.error(err);
       next(err);
     } else {
       res.json(200, docs);
     }

   });
 } else {
   next(new Error('No data'));
 }
};

exports.getPosts = function(req, res, next) {
 var limit = req.query.limit || LIMIT;
 var skip = req.query.skip || SKIP;
 req.db.Post.find({}, null, {
   limit: limit,
   skip: skip,
   sort: {
     '_id': -1
   }
 }, function(err, obj) {
   if (!obj) next('There are not posts.');
   obj.forEach(function(item, i, list) {
     if (req.session.user.admin) {
       item.admin = true;
     } else {
       item.admin = false;
     }
     if (item.author.id == req.session.userId) {
       item.own = true;
     } else {
       item.own = false;
     }
     if (item.likes && item.likes.indexOf(req.session.userId) > -1) {
       item.like = true;
     } else {
       item.like = false;
     }
     if (item.watches && item.watches.indexOf(req.session.userId) > -1) {
       item.watch = true;
     } else {
       item.watch = false;
     }
   });
   var body = {};
   body.limit = limit;
   body.skip = skip;
   body.posts = obj;
   req.db.Post.count({}, function(err, total) {
     if (err) next(err);
     body.total = total;
     res.json(200, body);
   });
 });
};


exports.getPost = function(req, res, next) {
 if (req.params.id) {
   req.db.Post.findById(req.params.id, {
     title: true,
     text: true,
     url: true,
     author: true,
     comments: true,
     watches: true,
     likes: true
   }, function(err, obj) {
     if (err) next(err);
     if (!obj) {
       next('Nothing is found.');
     } else {
       res.json(200, obj);
     }
   });
 } else {
   next('No post id');
 }
};

exports.del = function(req, res, next) {
 req.db.Post.findById(req.params.id, function(err, obj) {
   if (err) next(err);
   if (req.session.admin || req.session.userId === obj.author.id) {
     obj.remove();
     res.json(200, obj);
   } else {
     next('User is not authorized to delete post.');
   }
 })
};

function likePost(req, res, next) {
 req.db.Post.findByIdAndUpdate(req.body._id, {
   $push: {
     likes: req.session.userId
   }
 }, {}, function(err, obj) {
   if (err) {
     next(err);
   } else {
     res.json(200, obj);
   }
 });
};

function watchPost(req, res, next) {
 req.db.Post.findByIdAndUpdate(req.body._id, {
   $push: {
     watches: req.session.userId
   }
 }, {}, function(err, obj) {
   if (err) next(err);
   else {
     res.json(200, obj);
   }
 });
};

exports.updatePost = function(req, res, next) {
 var anyAction = false;
 if (req.body._id && req.params.id) {
   if (req.body && req.body.action == 'like') {
     anyAction = true;
     likePost(req, res);
   }
   if (req.body && req.body.action == 'watch') {
     anyAction = true;
     watchPost(req, res);
   }
   if (req.body && req.body.action == 'comment' && req.body.comment && req.param\
s.id) {
     anyAction = true;
     req.db.Post.findByIdAndUpdate(req.params.id, {
       $push: {
         comments: {
           author: {
             id: req.session.userId,
             name: req.session.user.displayName
           },
           text: req.body.comment
         }
       }
     }, {
       safe: true,
       new: true
     }, function(err, obj) {
       if (err) throw err;
       res.json(200, obj);
     });
   }
   if (req.session.auth && req.session.userId && req.body && req.body.action != \
'comment' &&
     req.body.action != 'watch' && req.body != 'like' &&
     req.params.id && (req.body.author.id == req.session.user._id || req.session\
.user.admin)) {
     req.db.Post.findById(req.params.id, function(err, doc) {
       if (err) next(err);
       doc.title = req.body.title;
       doc.text = req.body.text || null;
       doc.url = req.body.url || null;
       doc.save(function(e, d) {
         if (e) next(e);
         res.json(200, d);
       });
     })
   } else {
     if (!anyAction) next('Something went wrong.');
   }

 } else {
   next('No post ID.');
 }
};

4.6 Mogoose Models

Ideally, in a big application, we would break down each model into a separate file. Right now in the HackHall app, we have them all in hackhall/models/index.js.

As always, our dependencies look better at the top:

var mongoose = require('mongoose');
var Schema = mongoose.Schema;
var roles = 'user staff mentor investor founder'.split(' ');

The Post model represents post with its likes, comments and watches.

exports.Post = new Schema ({
 title: {
   required: true,
   type: String,
   trim: true,
   // match: /^([[:alpha:][:space:][:punct:]]{1,100})$/
   match: /^([\w ,.!?]{1,100})$/
 },
 url: {
   type: String,
   trim: true,
   max: 1000
 },
 text: {
   type: String,
   trim: true,
   max: 2000
 },
 comments: [{
   text: {
     type: String,
     trim: true,
     max:2000
   },
   author: {
     id: {
       type: Schema.Types.ObjectId,
       ref: 'User'
     },
     name: String
   }
 }],
 watches: [{
   type: Schema.Types.ObjectId,
   ref: 'User'
 }],
 likes: [{
   type: Schema.Types.ObjectId,
   ref: 'User'
 }],
 author: {
   id: {
     type: Schema.Types.ObjectId,
     ref: 'User',
     required: true
   },
   name: {
     type: String,
     required: true
   }
 },
 created: {
   type: Date,
   default: Date.now,
   required: true
 },
 updated:  {
   type: Date,
   default: Date.now,
   required: true
 },
 own: Boolean,
 like: Boolean,
 watch: Boolean,
 admin: Boolean,
 action: String
});

The User model can also serve as an application object (when approved=false):

exports.User = new Schema({
 angelListId: String,
 angelListProfile: Schema.Types.Mixed,
 angelToken: String,
   firstName: {
   type: String,
   required: true,
   trim: true
 },
 lastName: {
   type: String,
   required: true,
   trim: true
 },
 displayName: {
   type: String,
   required: true,
   trim: true
 },
   password: String,
   email: {
   type: String,
   required: true,
   trim: true
 },
 role: {
   type:String,
   enum: roles,
   required: true,
   default: roles[0]
 },
 approved: {
   type: Boolean,
   default: false
 },
 banned: {
   type: Boolean,
   default: false
 },
 admin: {
   type: Boolean,
   default: false
 },
 headline: String,
 photoUrl: String,
 angelList: Schema.Types.Mixed,
 created: {
   type: Date,
   default: Date.now
 },
 updated:  {
   type: Date, default: Date.now
 },
 angelUrl: String,
 twitterUrl: String,
 facebookUrl: String,
 linkedinUrl: String,
 githubUrl: String,
 own: Boolean,
 posts: {
   own: [Schema.Types.Mixed],
   likes: [Schema.Types.Mixed],
   watches: [Schema.Types.Mixed],
   comments: [Schema.Types.Mixed]
 }
});

The full source code for hackhall/models/index.js:

var mongoose = require('mongoose');
var Schema = mongoose.Schema;
var roles = 'user staff mentor investor founder'.split(' ');

exports.Post = new Schema ({
 title: {
   required: true,
   type: String,
   trim: true,
   // match: /^([[:alpha:][:space:][:punct:]]{1,100})$/
   match: /^([\w ,.!?]{1,100})$/
 },
 url: {
   type: String,
   trim: true,
   max: 1000
 },
 text: {
   type: String,
   trim: true,
   max: 2000
 },
 comments: [{
   text: {
     type: String,
     trim: true,
     max:2000
   },
   author: {
     id: { 
       type: Schema.Types.ObjectId, 
       ref: 'User' 
     },
     name: String
   }
 }],
 watches: [{ 
   type: Schema.Types.ObjectId, 
   ref: 'User' 
 }],
 likes: [{
   type: Schema.Types.ObjectId, 
   ref: 'User'
 }],
 author: {
   id: { 
     type: Schema.Types.ObjectId, 
     ref: 'User',
     required: true
   },
   name: {
     type: String,
     required: true
   }
 },
 created: { 
   type: Date, 
   default: Date.now,
   required: true
 },
 updated:  { 
   type: Date, 
   default: Date.now, 
   required: true
 },  
 own: Boolean,
 like: Boolean,
 watch: Boolean,
 admin: Boolean,
 action: String  
});

exports.User = new Schema({
 angelListId: String,
 angelListProfile: Schema.Types.Mixed,
 angelToken: String, 
   firstName: {
   type: String,
   required: true,
   trim: true
 },
 lastName: {
   type: String,
   required: true,
   trim: true
 },
 displayName: {
   type: String,
   required: true,
   trim: true
 },
   password: String,
   email: {
   type: String,
   required: true,
   trim: true
 },
 role: {
   type:String,
   enum: roles,
   required: true,
   default: roles[0]
 },
 approved: {
   type: Boolean,
   default: false
 },
 banned: {
   type: Boolean,
   default: false
 },  
 admin: {
   type: Boolean,
   default: false
 },  
 headline: String,
 photoUrl: String,
 angelList: Schema.Types.Mixed,
 created: { 
   type: Date, 
   default: Date.now 
 },
 updated:  { 
   type: Date, default: Date.now 
 },
 angelUrl: String,
 twitterUrl: String,
 facebookUrl: String,
 linkedinUrl: String,
 githubUrl: String,
 own: Boolean,
 posts: {
   own: [Schema.Types.Mixed],
   likes: [Schema.Types.Mixed],
   watches: [Schema.Types.Mixed],
   comments: [Schema.Types.Mixed]
 }
});

4.7 Mocha Tests

One of the benefits of using REST API server architecture is that each route and the application as a whole become very testable. The assurance of the passed tests is a wonderful supplement during development — the so-called test-driven development approach.

To run tests, we utilize Makefile:

REPORTER = list
MOCHA_OPTS = --ui tdd --ignore-leaks

test: 
clear
echo Starting test *********************************************************
./node_modules/mocha/bin/mocha \
--reporter $(REPORTER) \
$(MOCHA_OPTS) \
tests/*.js
echo Ending test

test-w: 
./node_modules/mocha/bin/mocha \
--reporter $(REPORTER) \
--growl \
--watch \
$(MOCHA_OPTS) \
tests/*.js 

users: 
mocha tests/users.js --ui tdd --reporter list --ignore-leaks

posts: 
clear
echo Starting test *********************************************************
./node_modules/mocha/bin/mocha \
--reporter $(REPORTER) \
$(MOCHA_OPTS) \
tests/posts.js 
echo Ending test

application: 
mocha tests/application.js --ui tdd --reporter list --ignore-leaks

.PHONY: test test-w posts application

Therefore, we can start tests with the $ make command.

All 20 tests should pass:

The results of running Mocha tests.

The HackHall tests live in the tests folder and consist of:

hackhall/tests/application.js: functional tests for unapproved users’ information
hackhall/tests/posts.js: functional tests for posts
hackhall/tests/users.js: functional tests for users

Tests use a library called superagent(GitHub).

The full content for hackhall/tests/application.js:

var app = require ('../server').app,
 assert = require('assert'),
 request = require('superagent');

app.listen(app.get('port'), function(){
 console.log('Express server listening on port ' + app.get('port'));
});

var user1 = request.agent();
var port = 'http://localhost:'+app.get('port');
var userId;

suite('APPLICATION API', function (){
 suiteSetup(function(done){
   done();
 });
 test('log in as admin', function(done){
   user1.post(port+'/api/login').send({email:'1@1.com',password:'1'}).end(functi\
on(res){
       assert.equal(res.status,200);
     done();
   });       
 });
 test('get profile for admin',function(done){
   user1.get(port+'/api/profile').end(function(res){
       assert.equal(res.status,200);
     done();
   });
 }); 
 test('submit applicaton for user 3@3.com', function(done){
   user1.post(port+'/api/application').send({
       firstName: 'Dummy',
     lastName: 'Application',
     displayName: 'Dummy Application',
       password: '3',
       email: '3@3.com',
     headline: 'Dummy Appliation',
     photoUrl: '/img/user.png',
     angelList: {blah:'blah'},
     angelUrl: 'http://angel.co.com/someuser',
     twitterUrl: 'http://twitter.com/someuser',
     facebookUrl: 'http://facebook.com/someuser',
     linkedinUrl: 'http://linkedin.com/someuser',
     githubUrl: 'http://github.com/someuser'     
   }).end(function(res){
     assert.equal(res.status,200);
     userId = res.body._id;        
     done();
   });
   
 });
 test('logout admin',function(done){
   user1.post(port+'/api/logout').end(function(res){
       assert.equal(res.status,200);
     done();
   });
 });
 test('get profile again after logging out',function(done){
   user1.get(port+'/api/profile').end(function(res){
       assert.equal(res.status,500);
     done();
   });
 }); 
 test('log in as user3 - unapproved', function(done){
   user1.post(port+'/api/login').send({email:'3@3.com',password:'3'}).end(functi\
on(res){
       assert.equal(res.status,200);
     done();
   });       
 }); 
 test('get user application', function(done){
   user1.get(port+'/api/application/').end(function(res){
     // console.log(res.body)
     assert.equal(res.status, 200);  
     done();
   });
 }); 
 test('update user application', function(done){
   user1.put(port+'/api/application/').send({      
     firstName: 'boo'}).end(function(res){
     // console.log(res.body)
     assert.equal(res.status, 200);  
     done();
   });
 }); 
 test('get user application', function(done){
   user1.get(port+'/api/application/').end(function(res){
     // console.log(res.body)
     assert.equal(res.status, 200);  
     done();
   });
 }); 
 test('check for posts - fail (unapproved?)', function(done){
   user1.get(port+'/api/posts/').end(function(res){
     // console.log(res.body)
     assert.equal(res.status, 500);
 
     done();
   });
 });
 test('logout user',function(done){
   user1.post(port+'/api/logout').end(function(res){
       assert.equal(res.status,200);
     done();
   });
 }); 
 test('log in as admin', function(done){
   user1.post(port+'/api/login').send({email:'1@1.com',password:'1'}).end(functi\
on(res){
       assert.equal(res.status,200);
     done();
   });       
 }); 
 test('delete user3', function(done){
   user1.del(port+'/api/users/'+userId).end(function(res){
     assert.equal(res.status, 200);
     done();
   });   
 }); 
 test('logout admin',function(done){
   user1.post(port+'/api/logout').end(function(res){
       assert.equal(res.status,200);
     done();
   });
 }); 
 test('log in as user - should fail', function(done){
   user1.post(port+'/api/login').send({email:'3@3.com',password:'3'}).end(functi\
on(res){
     // console.log(res.body)
       assert.equal(res.status,500);
     
     done();
   });       
 }); 
 test('check for posts - must fail', function(done){
   user1.get(port+'/api/posts/').end(function(res){
     // console.log(res.body)
     assert.equal(res.status, 500);
 
     done();
   });
 }); 
 suiteTeardown(function(done){
   done();
 });

});

The full content for hackhall/tests/posts.js:

var app = require('../server').app,
 assert = require('assert'),
 request = require('superagent');

app.listen(app.get('port'), function() {
 console.log('Express server listening on port ' + app.get('port'));
});

var user1 = request.agent();
var port = 'http://localhost:' + app.get('port');
var postId;

suite('POSTS API', function() {
 suiteSetup(function(done) {
   done();
 });
 test('log in', function(done) {
   user1.post(port + '/api/login').send({
     email: '1@1.com',
     password: '1'
   }).end(function(res) {
     assert.equal(res.status, 200);
     done();
   });
 });
 test('add post', function(done) {
   user1.post(port + '/api/posts').send({
     title: 'Yo Test Title',
     text: 'Yo Test text',
     url: ''
   }).end(function(res) {
     assert.equal(res.status, 200);
     postId = res.body._id;
     done();
   });

 });
 test('get profile', function(done) {
   user1.get(port + '/api/profile').end(function(res) {
     assert.equal(res.status, 200);
     done();
   });
 });
 test('post get', function(done) {
   // console.log('000'+postId);
   user1.get(port + '/api/posts/' + postId).end(function(res) {
     assert.equal(res.status, 200);
     assert.equal(res.body._id, postId);
     done();
   });
 });
 test('delete post', function(done) {
   user1.del(port + '/api/posts/' + postId).end(function(res) {
     assert.equal(res.status, 200);
     done();
   });
 });
 test('check for deleted post', function(done) {
   user1.get(port + '/api/posts/' + postId).end(function(res) {
     // console.log(res.body)
     assert.equal(res.status, 500);

     done();
   });
 });
 suiteTeardown(function(done) {
   done();
 });

});

The full content for hackhall/tests/users.js:

var app = require('../server').app,
 assert = require('assert'),
 request = require('superagent');
// http = require('support/http');

var user1 = request.agent();
var port = 'http://localhost:' + app.get('port');


app.listen(app.get('port'), function() {
 console.log('Express server listening on port ' + app.get('port'));
});

suite('Test root', function() {
 setup(function(done) {
   console.log('setup');

   done();
 });

 test('check /', function(done) {
   request.get('http://localhost:3000').end(function(res) {
     assert.equal(res.status, 200);
     done();
   });
 });
 test('check /api/profile', function(done) {
   request.get('http://localhost:' + app.get('port') + '/api/profile').end(funct\
ion(res) {
     assert.equal(res.status, 500);
     done();
   });
 });
 test('check /api/users', function(done) {
   user1.get('http://localhost:' + app.get('port') + '/api/users').end(function(\
res) {
     assert.equal(res.status, 500);
     // console.log(res.text.length);
     done();
   });
   // done();
 });
 test('check /api/posts', function(done) {
   user1.get('http://localhost:' + app.get('port') + '/api/posts').end(function(\
res) {
     assert.equal(res.status, 500);
     // console.log(res.text.length);
     done();
   });
   // done();
 });
 teardown(function(done) {
   console.log('teardown');
   done();
 });

});

suite('Test log in', function() {
 setup(function(done) {
   console.log('setup');

   done();
 });
 test('login', function(done) {
   user1.post('http://localhost:3000/api/login').send({
     email: '1@1.com',
     password: '1'
   }).end(function(res) {
     assert.equal(res.status, 200);
     done();
   });

 });
 test('check /api/profile', function(done) {
   user1.get('http://localhost:' + app.get('port') + '/api/profile').end(functio\
n(res) {
     assert.equal(res.status, 200);
     // console.log(res.text.length);
     done();
   });
   // done();
 });
 test('check /api/users', function(done) {
   user1.get('http://localhost:' + app.get('port') + '/api/users').end(function(\
res) {
     assert.equal(res.status, 200);
     // console.log(res.text);
     done();
   });
   // done();
 });
 test('check /api/posts', function(done) {
   user1.get('http://localhost:' + app.get('port') + '/api/posts').end(function(\
res) {
     assert.equal(res.status, 200);
     // console.log(res.text.length);
     done();
   });
   // done();
 });

 teardown(function(done) {
   console.log('teardown');
   done();
 });

});
suite('User control', function() {
 var user2 = {
   firstName: 'Bob',
   lastName: 'Dilan',
   displayName: 'Bob Dilan',
   email: '2@2.com'
 };
 suiteSetup(function(done) {
   user1.post('http://localhost:3000/api/login').send({
     email: '1@1.com',
     password: '1'
   }).end(function(res) {
     assert.equal(res.status, 200);
     // done();
   });
   user1.get('http://localhost:' + app.get('port') + '/api/profile').end(functio\
n(res) {
     assert.equal(res.status, 200);
     // console.log(res.text.length);
     // done();
   });

   done();
 })

 test('new user POST /api/users', function(done) {
   user1.post(port + '/api/users')
     .send(user2)
     .end(function(res) {
       assert.equal(res.status, 200);
       // console.log(res.text.length);
       user2 = res.body;
       // console.log(user2)
       done();
     })
 });
 test('get user list and check for new user GET /api/users', function(done) {
   user1.get('http://localhost:' + app.get('port') + '/api/users').end(function(\
res) {
     assert.equal(res.status, 200);
     // console.log(res.body)
     var user3 = res.body.filter(function(el, i, list) {
       return (el._id == user2._id);
     });
     assert(user3.length === 1);
     // assert(res.body.indexOf(user2)>-1);
     // console.log(res.body.length)
     done();
   })
 });
 test('Approve User: PUT /api/users/' + user2._id, function(done) {
   assert(user2._id != '');
   user1.put(port + '/api/users/' + user2._id)
     .send({
       approved: true
     })
     .end(function(res) {
       assert.equal(res.status, 200);
       // console.log(res.text.length);
       assert(res.body.approved);
       user1.get(port + '/api/users/' + user2._id).end(function(res) {
         assert(res.status, 200);
         assert(res.body.approved);
         done();
       })

     })
 });
 test('Banned User: PUT /api/users/' + user2._id, function(done) {
   assert(user2._id != '');
   user1.put(port + '/api/users/' + user2._id)
     .send({
       banned: true
     })
     .end(function(res) {
       assert.equal(res.status, 200);
       // console.log(res.text.length);
       assert(res.body.banned);
       user1.get(port + '/api/users/' + user2._id).end(function(res) {
         assert(res.status, 200);
         assert(res.body.banned);
         done();
       })

     })
 });
 test('Promote User: PUT /api/users/' + user2._id, function(done) {
   assert(user2._id != '');
   user1.put(port + '/api/users/' + user2._id)
     .send({
       admin: true
     })
     .end(function(res) {
       assert.equal(res.status, 200);
       // console.log(res.text.length);
       assert(res.body.admin);
       user1.get(port + '/api/users/' + user2._id).end(function(res) {
         assert(res.status, 200);
         assert(res.body.admin);
         done();
       })

     })
 });
 test('Delete User: DELETE /api/users/:id', function(done) {
   assert(user2._id != '');
   user1.del(port + '/api/users/' + user2._id)
     .end(function(res) {
       assert.equal(res.status, 200);
       // console.log('id:' + user2._id)
       user1.get(port + '/api/users').end(function(res) {
         assert.equal(res.status, 200);
         var user3 = res.body.filter(function(el, i, list) {
           return (el._id === user2._id);
         });
         // console.log('***');
         // console.warn(user3);
         assert(user3.length === 0);
         done();
       });
     });


 });
});
// app.close();   
// console.log(app)

Warning

Please don’t store plain passwords/keys in the database. Any serious production app should at least salt the passwords before storing them.

4.8 Conclusion

HackHall is still in development, but there are important real production application components, such as REST API architecture, OAuth, Mongoose and its models, MVC structure of Express.js apps, access to environment variables, etc.

ExpressWorks

Summary

ExpressWorks is an automated workshop that will walk you through the building of Express.js servers, processing of GET, POST and PUT requests, and the extraction of query string, payload and URL parameters.

What is ExpressWorks Based On?

ExpressWorks is the Express.js workshop based on workshopper and inspired by stream-adventure by @substack and @maxogden.

Hello World Express.js app

Installation (recommended)

Recommended global installation:

1 $ npm install -g expressworks
2 $ expressworks

If you see errors, try:

1 $ sudo npm install -g expressworks

Local Installation (advanced)

Run and install locally:

$ npm install expressworks
$ cd expressworks
$ npm install
$ node expressworks

Usage

ExpressWorks understands these commands:

Usage

 expressworks
   Show a menu to interactively select a workshop.
 expressworks list
   Show a newline-separated list of all the workshops.
 expressworks select NAME
   Select a workshop.
 expressworks current
   Show the currently selected workshop.
 expressworks run program.js
   Run your program against the selected input.
 expressworks verify program.js
   Verify your program against the expected output.

Reset

If you want to reset the list of completed tasks, clean the ~/.config/expressworks/completed.json file.

Hello World Express.js app

Steps

Hello World

Create an Express.js app that runs on localhost:3000, and outputs “Hello World!” when somebody goes to root ‘/home’.

process.argv[2] will be provided by expressworks to you. This is the port number.

Jade

Create an Express.js app with a home page (/home) rendered by a Jade template engine that shows the current date (toDateString).

Good Old Form

Write a route (‘/form’) that processes an HTML form input (<form><input name="str"/></form>) and prints the str value backwards.

Static

Apply static middleware to the server index.html file without any routes. The index.html file is provided and usable via the process.argv[3] value of the path to it. However, you can use your own file with this content:

 <html>
   <head>
     <link rel="stylesheet" type="text/css" href="/main.css"/>
   </head>
   <body>
     <p>I am red!</p>
   </body>
 </html>

Stylish CSS

Style your HTML from the previous example with some Stylus middleware. The path to the main.styl file is provided in process.argv[3], or you can create your own file/folder from these:

1   p
2     color red

The index.html file:

 <html>
   <head>
     <title>expressworks</title>
     <link rel="stylesheet" type="text/css" href="/main.css"/>
   </head>
   <body>
     <p>I am red!</p>
   </body>
 </html>

Param Pam Pam

Create an Express.js server that processes PUT /message/:id requests, e.g., PUT /message/526aa677a8ceb64569c9d4fb.

The response of this request returns id SHA1 hashed with a date:

 require('crypto')
   .createHash('sha1')
   .update(new Date().toDateString().toString() + id)
   .digest('hex')

What’s in a Query

Write a route that extracts data from a query string in the GET /search URL route, e.g., ?results=recent&include_tabs=true, and then transforms and outputs it back to the user in JSON format.

JSON Me

Write a server that reads a file (file name is passed in process.argv[3]), then parses it to JSON, and outputs the content to the user with res.json(object).

Summary

In this short chapter, we’ll provide a list of the most useful Node.js resources for further learning.

Other Node.js Frameworks

The Express.js framework is no doubt the most mature, popular, robust, tested and used project for Node.js web services. As of this writing, Express.js is also the most starred NPM repository with 2x more stars that request and async libraries. There are plenty of real production apps that rely on Express 2.x and 3.x including Storify (acquired by LiveFyre), DocuSign, new MySpace, LearnBoost, Geekli.st, Klout, Prismatic, Segment.io and more.

Express.js is also the most starred NPM repository.

Nevertheless, there are plenty of alternatives for which we created our analog of todomvc.com collection: nodeframework.com. By the way, some of the more comprehensive frameworks depend on Express.js (i.e., SailsJS). So it’s great that our readers know Express.js by now!

Node.js Books

For more core Node.js overview and/or other components of the Node.js stack, such as databases and websockets, please consider these resources:

Rapid Prototyping with JS: Agile JavaScript Development (Azat Mardanov) — beginner-to-intermediate book on Node.js, MongoDB and Backbone.js
JavaScript and Node FUNdamentals: A Collection of Essential Basics (Azat Mardanov) — short read on simple but important concepts of browser JS and Node
Pro Node.js (Colin J. Ihrig) — ISBN: 978-1-4302-5860-5, comprehensive low-level book on Node.js sans any non-core modules
Node.js in Action (TJ Holowaychuk et al) — ISBN: 9781617290572 not yet published (est. end of 2013). Book about Express.js from the creators of the framework
Learning Node (Shelley Powers) — ISBN: 978-1-4493-2307-3 book covers Express, MongoDB, Mongoose and Socket.IO
Node Cookbook (David Mark Clements) — ISBN: 978-1-84951-718-8 book covers databases and websockets
Node: Up and Running (Tom Hughes-Croucher et al) brief overview of Node.js
Smashing Node.js (Guillermo Rauch) covers Express.js, Jade, and Stylus from the creator of Mongoose ORM for MongoDB

JavaScript Classics

For deeper understanding of the most misunderstood and most popular programming language, please make sure to read these proven classics:

Eloquent JavaScript: programming fundamentals in the JavaScript coating
JavaScript: The Good Parts: tricky part of the language

Contact Us

Let’s be friends on the Internet!

Tweet Node.js question on Twitter: @azat_co
Follow on Facebook: facebook.com/azat.mardanov
Website: expressjsguide.com
GitHub: github.com/azat-co/rpjs

Other Ways to Reach Us

Email Azat directly: hi@azat.co
Google Group: rpjs@googlegroups.com and https://groups.google.com/forum/#!forum/rpjs
Blog: webapplog.com
HackHall: community for hackers, hipsters and pirates

Share on Twitter with ClickToTweet link: http://ctt.ec/dd0Nc, or just click:

“I’ve finished reading Express.js Guide — The Comprehensive Book on Express.js by @azat_co #RPJS #Node.js”

Up next

1 Instagram Gallery

IV Tutorials and Examples

Summary

1 Instagram Gallery

Summary

Example

1.1 A File Structure

1.2 Dependencies

1.3 Node.js Server

1.4 Handlebars Template

1.5 Conclusion

Note

2 Todo App

Summary

Example

2.1 Scaffolding

2.2 MongoDB

2.3 Structure

2.4 app.js

2.5 Routes

2.6 Jades

2.7 LESS

2.8 Conclusion

3 REST API

Summary

Example

3.1 Test Coverage

Tip

3.2 Dependencies

3.3 Implementation

Note

3.4 Conclusion

Note

4 HackHall

Summary

Example

4.1 What is HackHall

4.2 Running HackHall

4.3 Structure

4.4 Express.js App

4.5 Routes

4.5.1 index.js

4.5.2 auth.js

4.5.3 main.js

4.5.4 users.js

4.5.5 applications.js

4.5.6 posts.js

4.6 Mogoose Models

4.7 Mocha Tests

Warning

4.8 Conclusion

ExpressWorks

Summary

What is ExpressWorks Based On?

Installation (recommended)

Local Installation (advanced)

Usage

Reset

Steps

Hello World

Jade

Good Old Form

Static

Stylish CSS

Param Pam Pam

What’s in a Query

JSON Me

Related Reading and Resources

Summary

Other Node.js Frameworks

Node.js Books

JavaScript Classics

Contact Us