public-endpoint-builder

To expose unauthenticated public API endpoints in Express.js, you can generate GET-only controllers wired under the /public prefix. This enforces read-only operations for list and detail views without requiring custom route creation from scratch.

Yes, you can use MongoDB aggregation pipelines for joined data in public API routes. The generated GET endpoints support optional aggregation pipelines, enabling related data to be queried and returned within the public list and detail responses.

The best way to create a read-only storefront catalog API is to generate public GET endpoints under a /public prefix for existing resources. This automatically wires list and detail controllers into the public router, ensuring discoverability without modifying original routes.

Yes, this approach enforces read-only operations by generating exclusively GET-only controllers for list and detail views. The endpoints are restricted to read operations under the /public prefix, preventing unauthenticated write access to existing resources.

You wire generated public controllers by placing them in the controllers/public directory and exporting them through a barrel file in controllers/public/index.js. The corresponding routes are then registered in routes/public.js to enable testing.

You should not use unauthenticated public endpoints for resources requiring access control or write operations. This approach is limited to GET-only list and detail views intended for publicly accessible data like storefronts, article listings, and public catalogs.