nodejs-backend-patterns

Separate the codebase into controllers handling HTTP requests, services containing business logic, and repositories managing data access. Wire them together with a dependency injection container so each layer depends on abstractions and remains testable.

Extract the Bearer token from the Authorization header, verify it with jsonwebtoken against your JWT secret, and attach the decoded payload to the request object. Pair short-lived 15-minute access tokens with 7-day refresh tokens for session continuity.

Express offers a minimalist, widely adopted middleware ecosystem, while Fastify provides higher throughput with built-in schema validation and Pino logging. Both patterns in this skill use TypeScript with helmet, cors, and compression.

Define custom error classes extending a base AppError with status codes, then register a global error-handling middleware as the last middleware. It returns structured JSON for known errors and logs unexpected ones without leaking details in production.

Yes, it includes a PostgreSQL repository using the pg Pool with parameterized queries and transactions, plus a Mongoose setup with connection management and schema indexes. Both use connection pooling and graceful shutdown handling.

Use express-rate-limit with a Redis store via rate-limit-redis so limits persist across instances. Apply a general limiter for API routes and a stricter one for authentication endpoints, skipping successful requests on auth routes.