Tip

• I am using node version 14. Though the project can be implemented using any node version but it is recommended to use node version 14+.
• Visual Studio Code has an integrated terminal. To open it use ctrl + `.
• Trouble setting up Node.js? - Video showing how to install node
• I am assuming you have gone through basic-npm-commands. Use the following commands to reach the stage (refer expected outcome section) I am currently in -

npm init --yes
npm install --save express jsonwebtoken dotenv

Tip

• How to access the request method using the HTTP module? - HTTP request method
• How to use query parameters using HTTP module? - You can access the entire uri path using request.url. And after that try to think of some way to access query parameters by splitting the string after "?".

Tip

• To retain the information of the user you can maintain a global array.
• How to retain the information? Or how to implement the register API?

  const usersData = [];
 
  app.post("/register", (req, res) => {
    // Do the necessary stuffs to check whether we have everything required or not in the request
    ....
 
    // Do the necessary checks (like whether username already taken by anyone else)
    ....
 
    const currentUserData = {
      "username": ...,  // fill this value by taking from the request
      "password": ...,
      "name": ...,
      "college": ....,
      "year-of-graduation": ...
    };
 
    // push the data to the global array, so that it is visible (and can be used) by other APIs as well
    usersData.push(currentUserData);
 
    res.send({message: "Successfully registered!"});
  })

• Trouble building the user Lists API?

  const usersData = [];
 
  app.post("/register", (req, res) => {.........});
 
  app.get("/profiles", (req, res) => {
    // clone the 'usersData' so that we don't change the global data
    const usersDataCopy = JSON.parse(JSON.stringify(usersData));
    
    /*
    * Write the code to remove the 'password' field from each of the user.
    * As this API is for public use and we don't want to expose 'password' publicly
    */ 
    ....
 
 
    res.json(usersDataCopy);
  })

• How to create API which will update info for a legitimate user?

  const usersData = [];
 
  app.put("/profile", (req, res) => {
    // Check whether all the information required is present in the request or not
    ....
 
    // Check whether the mentioned username and password exists in our list of registered users
    let isValid = false;
    let requestedUserIndexInGlobalArray = -1;
 
    for (let i = 0; i < usersData.lenth; i ++) {
      const currentUser = usersData[i];
 
      // If the currentUser's username and password matches with the provided username and password 
      // then set the 'isValid' flag and 'requestedUserIndexInGlobalArray' and break from the loop
      ...
    }
 
    if (!isValid) {
      res.status(401).json({message: "Invalid username or password!"});
    }
    else {
      // update the user's details corresponding to the found user
      usersData[requestedUserIndexInGlobalArray].name = .....
      ....
    }
  });

Tip

• Need help to create /login API?

const secretKeyForJWT = "FDaFdsFDafsFdasfFDSAsd";
 
app.post("/login", (req, res) => {
  // Sanity check - does the request contains the required parameters or not
  ...
 
  // Check whether the given username and password exists in our collection
  ...
 
  // returns 400 status in case the username or password is incorrect
  ....
 
  // build the JWT which is valid for 1 hr
 
  // Remember to include enough information to uniquely identify the user with token only
  // In our case 'username' is unique across all user, so 
  const dataToSign = {
    "username": ...,
  };
  const token = jwt.sign(dataToSign, secretKeyForJWT);
 
  // send the JWT in the header
  ...
});

• Need help to implement Updated PUT /profile API?

app.put("/profile", (req, res) => {
  // Sanity check - does the request contains the required parameters or not
  ...
 
  // Extract JWT from the header and check whether it is valid or not
  ...
 
  // returns 401 status in case JWT is invalid or expired
  ....
 
  // decrypt the JWT data to get 'username'
  ....
 
  // update the user information corresponding to 'username' fetched in the previous step
  ...
});

Tip

• Make sure to add .env file to the .gitignore file, so that we don't push it to our publicly available git repo by mistake.
• Trouble refactoring authentication to middleware?

const authenticationLogin = (req, res, next) => {
  // Extract JWT from the header and check whether it is valid or not
  ...
 
  // returns 401 status in case JWT is invalid or expired
  ....
 
  // token is valid and verified. 
  // We will then decrypt the token and put the value into some field in 'req'
  // so that it is accessed afterwards by any other middleware/the request handler
  req.userInfo = decodedInfo;
};
 
app.put("/profile", authenticationLogic, (req, res) => {
  // Sanity check - does the request contains the required parameters or not
  ...
 
  // extract the 'username' from decrypted json token information from the 'userInfo' field of the 'req'
  const username = req.userInfo.username;
 
  // update the user information corresponding to 'username' fetched in the previous step
  ...
})

Tip

• Make sure to add .env file to the .gitignore file, so that we don't push it to our publicly available git repo by mistake.
• Need help to set up /send-mail API?

const sharedSecretKeyForPrivateAPIs = process.env.SHARED_SECRET_KEY_FOR_PRIVATE_API;
 
app.post("/send-mail", (req, res) => {
  const authenticationToken = <FETCH_THE_'x-private-api-key'_FROM_THE_REQUEST_HEADERS>;
  
  // check whether the authenticationToken is present in the header or not
  if (authenticationToken === undefined || authenticationToken === null) {
    // send 400 response to the client
    ....
  }
  
  // check whether the authenticationToken received from the request is valid or not
   if (authenticationToken !== sharedSecretKeyForPrivateAPIs) {
    // send 401 response to the client
    ....
  }
  
  // send the email (simply logging in this case)
  const { emailBody, emailSubject } = req.body;
  console.log(emailBody, emailSubject);
});

• Need help in creating refactored /login API?

const sharedSecretKeyForPrivateAPIs = process.env.SHARED_SECRET_KEY_FOR_PRIVATE_API;
 
const secretKeyForJWT = "FDaFdsFDafsFdasfFDSAsd";
 
app.post("/login", (req, res) => {
  // Sanity check - does the request contains the required parameters or not
  ...
 
  // Check whether the given username and password exists in our collection
  ...
 
  // returns 400 status in case the username or password is incorrect
  ....
 
  // build the JWT which is valid for 1 hr
 
  // Remember to include enough information to uniquely identify the user with token only
  // In our case 'username' is unique across all user, so 
  const dataToSign = {
    "username": ...,
  };
  const token = jwt.sign(dataToSign, secretKeyForJWT);
 
  // attach the JWT in the header
  ...
  
  // call the email sending API (we can either wait for it's completion or send the response to the user and it will complete in background
  // i.e. asynchronous / synchronous
  axios.post("/send-mail", {emailSubject: "Someone just logged in!", "emailBody": `Here are the details - ${JSON.stringify(req.body)}`});
  
  res.json({ message: "Successfully logged in!" });
});