Express JS Use-cases

[vinniefalco]

Here are many practical Express.js route handler examples for real-world scenarios:

Authentication & Users

// User registration
app.post('/api/register', async (req, res) => {
  const { email, password, name } = req.body;
  const hashedPassword = await bcrypt.hash(password, 12);
  const user = await User.create({ email, password: hashedPassword, name });
  const token = jwt.sign({ id: user.id }, process.env.JWT_SECRET, { expiresIn: '7d' });
  res.status(201).json({ token, user: { id: user.id, email, name } });
});

// Login
app.post('/api/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await User.findOne({ email });
  if (!user || !await bcrypt.compare(password, user.password)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  const token = jwt.sign({ id: user.id }, process.env.JWT_SECRET, { expiresIn: '7d' });
  res.json({ token });
});

// Password reset request
app.post('/api/forgot-password', async (req, res) => {
  const user = await User.findOne({ email: req.body.email });
  if (!user) return res.json({ message: 'If email exists, reset link sent' });
  const resetToken = crypto.randomBytes(32).toString('hex');
  user.resetToken = resetToken;
  user.resetExpires = Date.now() + 3600000;
  await user.save();
  await sendEmail(user.email, `Reset: ${process.env.URL}/reset/${resetToken}`);
  res.json({ message: 'If email exists, reset link sent' });
});

// Get current user profile
app.get('/api/me', auth, async (req, res) => {
  const user = await User.findById(req.userId).select('-password');
  res.json(user);
});

// Update profile
app.patch('/api/me', auth, async (req, res) => {
  const updates = ['name', 'bio', 'avatar'].reduce((acc, field) => {
    if (req.body[field] !== undefined) acc[field] = req.body[field];
    return acc;
  }, {});
  const user = await User.findByIdAndUpdate(req.userId, updates, { new: true });
  res.json(user);
});

E-Commerce

// Get products with filtering, sorting, pagination
app.get('/api/products', async (req, res) => {
  const { category, minPrice, maxPrice, sort = 'createdAt', page = 1, limit = 20 } = req.query;
  const filter = {};
  if (category) filter.category = category;
  if (minPrice || maxPrice) filter.price = { $gte: minPrice || 0, $lte: maxPrice || Infinity };
  const products = await Product.find(filter)
    .sort(sort)
    .skip((page - 1) * limit)
    .limit(Number(limit));
  const total = await Product.countDocuments(filter);
  res.json({ products, total, pages: Math.ceil(total / limit) });
});

// Add to cart
app.post('/api/cart', auth, async (req, res) => {
  const { productId, quantity } = req.body;
  const product = await Product.findById(productId);
  if (!product || product.stock < quantity) {
    return res.status(400).json({ error: 'Insufficient stock' });
  }
  let cart = await Cart.findOne({ userId: req.userId });
  if (!cart) cart = new Cart({ userId: req.userId, items: [] });
  const existingItem = cart.items.find(i => i.productId.equals(productId));
  if (existingItem) existingItem.quantity += quantity;
  else cart.items.push({ productId, quantity, price: product.price });
  await cart.save();
  res.json(cart);
});

// Checkout / Create order
app.post('/api/orders', auth, async (req, res) => {
  const cart = await Cart.findOne({ userId: req.userId }).populate('items.productId');
  if (!cart || !cart.items.length) return res.status(400).json({ error: 'Empty cart' });
  
  const total = cart.items.reduce((sum, i) => sum + i.price * i.quantity, 0);
  const paymentIntent = await stripe.paymentIntents.create({
    amount: Math.round(total * 100),
    currency: 'usd',
    metadata: { userId: req.userId }
  });
  
  const order = await Order.create({
    userId: req.userId,
    items: cart.items,
    total,
    paymentIntentId: paymentIntent.id,
    shippingAddress: req.body.address
  });
  
  await Cart.deleteOne({ userId: req.userId });
  res.json({ order, clientSecret: paymentIntent.client_secret });
});

// Apply coupon
app.post('/api/cart/coupon', auth, async (req, res) => {
  const coupon = await Coupon.findOne({ code: req.body.code, expiresAt: { $gt: new Date() } });
  if (!coupon) return res.status(400).json({ error: 'Invalid or expired coupon' });
  const cart = await Cart.findOneAndUpdate(
    { userId: req.userId },
    { couponId: coupon._id, discount: coupon.percent },
    { new: true }
  );
  res.json(cart);
});

File Uploads

// Upload single image
app.post('/api/upload', auth, upload.single('image'), async (req, res) => {
  const result = await cloudinary.uploader.upload(req.file.path, {
    folder: 'uploads',
    transformation: [{ width: 800, height: 800, crop: 'limit' }]
  });
  fs.unlinkSync(req.file.path);
  res.json({ url: result.secure_url, publicId: result.public_id });
});

// Upload multiple files to S3
app.post('/api/documents', auth, upload.array('files', 10), async (req, res) => {
  const uploads = await Promise.all(req.files.map(async file => {
    const key = `docs/${req.userId}/${Date.now()}-${file.originalname}`;
    await s3.putObject({
      Bucket: process.env.S3_BUCKET,
      Key: key,
      Body: file.buffer,
      ContentType: file.mimetype
    }).promise();
    return { key, name: file.originalname, size: file.size };
  }));
  res.json(uploads);
});

// Generate signed download URL
app.get('/api/documents/:key/download', auth, async (req, res) => {
  const url = s3.getSignedUrl('getObject', {
    Bucket: process.env.S3_BUCKET,
    Key: req.params.key,
    Expires: 3600
  });
  res.json({ url });
});

Social Features

// Create a post
app.post('/api/posts', auth, async (req, res) => {
  const post = await Post.create({
    userId: req.userId,
    content: req.body.content,
    images: req.body.images || []
  });
  await post.populate('userId', 'name avatar');
  res.status(201).json(post);
});

// Like/unlike a post
app.post('/api/posts/:id/like', auth, async (req, res) => {
  const post = await Post.findById(req.params.id);
  const hasLiked = post.likes.includes(req.userId);
  await Post.findByIdAndUpdate(req.params.id, {
    [hasLiked ? '$pull' : '$addToSet']: { likes: req.userId }
  });
  res.json({ liked: !hasLiked });
});

// Add comment
app.post('/api/posts/:id/comments', auth, async (req, res) => {
  const comment = { userId: req.userId, text: req.body.text, createdAt: new Date() };
  const post = await Post.findByIdAndUpdate(
    req.params.id,
    { $push: { comments: comment } },
    { new: true }
  ).populate('comments.userId', 'name avatar');
  res.json(post.comments.at(-1));
});

// Follow user
app.post('/api/users/:id/follow', auth, async (req, res) => {
  if (req.params.id === req.userId) return res.status(400).json({ error: 'Cannot follow yourself' });
  await User.findByIdAndUpdate(req.userId, { $addToSet: { following: req.params.id } });
  await User.findByIdAndUpdate(req.params.id, { $addToSet: { followers: req.userId } });
  res.json({ following: true });
});

// Get feed (posts from followed users)
app.get('/api/feed', auth, async (req, res) => {
  const user = await User.findById(req.userId);
  const posts = await Post.find({ userId: { $in: [...user.following, req.userId] } })
    .sort('-createdAt')
    .limit(50)
    .populate('userId', 'name avatar');
  res.json(posts);
});

Search & Autocomplete

// Full-text search
app.get('/api/search', async (req, res) => {
  const { q, type } = req.query;
  const results = await Product.find(
    { $text: { $search: q } },
    { score: { $meta: 'textScore' } }
  ).sort({ score: { $meta: 'textScore' } }).limit(20);
  res.json(results);
});

// Autocomplete suggestions
app.get('/api/autocomplete', async (req, res) => {
  const suggestions = await Product.aggregate([
    { $match: { name: { $regex: `^${req.query.q}`, $options: 'i' } } },
    { $group: { _id: '$name' } },
    { $limit: 10 }
  ]);
  res.json(suggestions.map(s => s._id));
});

// Elasticsearch search
app.get('/api/search/advanced', async (req, res) => {
  const { body } = await elastic.search({
    index: 'products',
    body: {
      query: {
        bool: {
          must: [{ multi_match: { query: req.query.q, fields: ['name^3', 'description'] } }],
          filter: req.query.category ? [{ term: { category: req.query.category } }] : []
        }
      },
      highlight: { fields: { name: {}, description: {} } }
    }
  });
  res.json(body.hits.hits.map(h => ({ ...h._source, highlights: h.highlight })));
});

Notifications & Real-time

// Get notifications
app.get('/api/notifications', auth, async (req, res) => {
  const notifications = await Notification.find({ userId: req.userId })
    .sort('-createdAt')
    .limit(50);
  res.json(notifications);
});

// Mark notifications as read
app.patch('/api/notifications/read', auth, async (req, res) => {
  await Notification.updateMany(
    { userId: req.userId, read: false },
    { read: true }
  );
  res.json({ success: true });
});

// Send push notification (for admin)
app.post('/api/admin/push', adminAuth, async (req, res) => {
  const { title, body, userIds } = req.body;
  const tokens = await PushToken.find({ userId: { $in: userIds } });
  await firebase.messaging().sendMulticast({
    tokens: tokens.map(t => t.token),
    notification: { title, body }
  });
  res.json({ sent: tokens.length });
});

// SSE endpoint for live updates
app.get('/api/events', auth, (req, res) => {
  res.setHeader('Content-Type', 'text/event-stream');
  res.setHeader('Cache-Control', 'no-cache');
  res.setHeader('Connection', 'keep-alive');
  
  const clientId = req.userId;
  clients.set(clientId, res);
  
  req.on('close', () => clients.delete(clientId));
});

Webhooks & Integrations

// Stripe webhook
app.post('/api/webhooks/stripe', express.raw({ type: 'application/json' }), async (req, res) => {
  const sig = req.headers['stripe-signature'];
  const event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
  
  if (event.type === 'payment_intent.succeeded') {
    const order = await Order.findOneAndUpdate(
      { paymentIntentId: event.data.object.id },
      { status: 'paid', paidAt: new Date() }
    );
    await sendEmail(order.email, 'Order confirmed!', orderConfirmationTemplate(order));
  }
  res.json({ received: true });
});

// GitHub webhook
app.post('/api/webhooks/github', (req, res) => {
  const signature = req.headers['x-hub-signature-256'];
  const expected = 'sha256=' + crypto.createHmac('sha256', process.env.GITHUB_SECRET)
    .update(JSON.stringify(req.body)).digest('hex');
  if (signature !== expected) return res.status(401).send('Invalid signature');
  
  if (req.body.action === 'opened' && req.body.pull_request) {
    console.log(`New PR: ${req.body.pull_request.title}`);
  }
  res.sendStatus(200);
});

// Slack slash command
app.post('/api/slack/command', async (req, res) => {
  const { command, text, user_id, response_url } = req.body;
  if (command === '/ticket') {
    const ticket = await Ticket.create({ title: text, createdBy: user_id });
    res.json({ response_type: 'in_channel', text: `🎫 Ticket #${ticket.id} created: ${text}` });
  }
});

Analytics & Reporting

// Track event
app.post('/api/analytics/event', async (req, res) => {
  const { event, properties } = req.body;
  await AnalyticsEvent.create({
    event,
    properties,
    userId: req.userId,
    sessionId: req.cookies.sessionId,
    userAgent: req.headers['user-agent'],
    ip: req.ip,
    timestamp: new Date()
  });
  res.sendStatus(204);
});

// Dashboard stats
app.get('/api/admin/stats', adminAuth, async (req, res) => {
  const [users, orders, revenue] = await Promise.all([
    User.countDocuments(),
    Order.countDocuments({ status: 'paid' }),
    Order.aggregate([
      { $match: { status: 'paid' } },
      { $group: { _id: null, total: { $sum: '$total' } } }
    ])
  ]);
  res.json({ users, orders, revenue: revenue[0]?.total || 0 });
});

// Export data as CSV
app.get('/api/admin/export/orders', adminAuth, async (req, res) => {
  const orders = await Order.find().lean();
  const csv = orders.map(o => `${o._id},${o.total},${o.status},${o.createdAt}`).join('\n');
  res.setHeader('Content-Type', 'text/csv');
  res.setHeader('Content-Disposition', 'attachment; filename=orders.csv');
  res.send('id,total,status,date\n' + csv);
});

Background Jobs & Queues

// Queue email job
app.post('/api/newsletters/send', adminAuth, async (req, res) => {
  const subscribers = await Subscriber.find({ active: true });
  await emailQueue.addBulk(
    subscribers.map(s => ({
      name: 'send-newsletter',
      data: { email: s.email, subject: req.body.subject, html: req.body.html }
    }))
  );
  res.json({ queued: subscribers.length });
});

// Schedule task
app.post('/api/reminders', auth, async (req, res) => {
  const reminder = await Reminder.create({
    userId: req.userId,
    message: req.body.message,
    sendAt: new Date(req.body.sendAt)
  });
  await agenda.schedule(reminder.sendAt, 'send-reminder', { reminderId: reminder._id });
  res.json(reminder);
});

Rate Limiting & Security

// Login with rate limiting
const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5, message: 'Too many attempts' });

app.post('/api/login', loginLimiter, async (req, res) => {
  // ... login logic
});

// API key authentication
app.get('/api/v1/data', async (req, res) => {
  const apiKey = req.headers['x-api-key'];
  const client = await ApiClient.findOne({ key: apiKey, active: true });
  if (!client) return res.status(401).json({ error: 'Invalid API key' });
  
  await ApiClient.updateOne({ _id: client._id }, { $inc: { requestCount: 1 } });
  res.json({ data: await fetchData() });
});

// CSRF token endpoint
app.get('/api/csrf-token', (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

Misc Utilities

// Health check
app.get('/health', async (req, res) => {
  const dbOk = mongoose.connection.readyState === 1;
  const redisOk = await redis.ping() === 'PONG';
  res.status(dbOk && redisOk ? 200 : 503).json({ db: dbOk, redis: redisOk });
});

// Proxy external API
app.get('/api/weather/:city', cache('5 minutes'), async (req, res) => {
  const { data } = await axios.get(`https://api.weather.com/v1/${req.params.city}`, {
    params: { key: process.env.WEATHER_API_KEY }
  });
  res.json(data);
});

// Generate PDF invoice
app.get('/api/orders/:id/invoice', auth, async (req, res) => {
  const order = await Order.findById(req.params.id).populate('items.productId');
  const pdf = await generateInvoicePDF(order);
  res.setHeader('Content-Type', 'application/pdf');
  res.send(pdf);
});

// Short URL redirect
app.get('/s/:code', async (req, res) => {
  const link = await ShortLink.findOneAndUpdate(
    { code: req.params.code },
    { $inc: { clicks: 1 } }
  );
  if (!link) return res.status(404).send('Not found');
  res.redirect(301, link.url);
});

// Sitemap generation
app.get('/sitemap.xml', async (req, res) => {
  const products = await Product.find({}, 'slug updatedAt').lean();
  const urls = products.map(p => 
    `<url><loc>https://site.com/p/${p.slug}</loc><lastmod>${p.updatedAt.toISOString()}</lastmod></url>`
  ).join('');
  res.type('application/xml').send(`<?xml version="1.0"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${urls}</urlset>`);
});

These examples cover authentication, e-commerce, file handling, social features, search, real-time updates, webhooks, analytics, background jobs, security, and various utilities — all patterns you'd see in production Express applications!