Express + MongoDB Blog API with Auth
Build a REST API for a blog with Express and MongoDB (through Mongoose): users register and log in to receive a JSON Web Token, then create, edit and delete their own posts, while anyone can read published posts, search them by title and page through them. Passwords are hashed with bcrypt, a middleware checks tokens on protected routes, only a post's author can change it, and input is validated with clear errors. The API is covered by integration tests against a test database. You'll learn Mongoose schemas, validation and indexes, password hashing, JWT authentication and authorization, pagination and text search in MongoDB, consistent error handling in Express, and testing with Supertest.
- Estimate
- ~10h
- Steps
- 6
- Completed by
- 0
- Proposed by
- codeseed.app
Express · MongoDB · Mongoose · JWT
Project roadmap
- 01
Design the schemas
~1.5hCreate an Express project and connect to MongoDB (run it with Docker, or use MongoDB Atlas's free tier). Define Mongoose models: User (email unique and lowercased, name and password hash, never returned in responses) and Post (title, slug unique, body, tags, published flag, author reference and timestamps), with validation rules (required fields and lengths) and indexes (a text index on the title and body). Done when: the models validate sample documents and reject invalid ones.
- 02
Register and log in
~1.5hAdd POST /auth/register (validating the email and a password of at least 10 characters, and hashing it with bcrypt) and POST /auth/login (checking the password with bcrypt.compare and giving the same error for an unknown email or wrong password). Return 409 when an email is already registered. Done when: users can register and log in.
- 03
Add JWT authentication
~1.5hOn login, issue a JWT (with jsonwebtoken) containing the user id, signed with a secret from an environment variable and expiring after an hour. Write a middleware that reads the Authorization: Bearer header, verifies the token and sets req.user, returning 401 when it's missing, invalid or expired. Rate limit the login route. Done when: protected routes reject requests without a valid token.
- 04
Build the post endpoints
~2hAdd GET /posts and GET /posts/:slug (public, published posts only), and POST, PATCH and DELETE for logged-in users, generating a unique slug from the title. Only the author can update or delete a post (403 otherwise), and drafts are visible only to their author. Handle invalid ids and Mongoose validation errors in one error middleware returning clear JSON errors. Done when: all post endpoints work, and authors' rules are enforced.
- 05
Add pagination and search
~1.5hSupport GET /posts?page=&limit=&q=&tag=, where q uses the text index (sorted by relevance) and tag filters by tag, with a maximum page size, returning the items with the total count and page information. Include each post's author name with populate, selecting only the fields needed. Done when: search, tag filters and paging return the right posts.
- 06
Write integration tests
~2hWrite tests with Vitest (or Jest) and Supertest against an in-memory MongoDB (mongodb-memory-server) or a test database: registration and login, token checks, creating and editing posts, author-only rules, drafts, search and pagination, and validation errors. Done when: all tests pass.
Resources
Ready to build this?
Get a GitHub repo and start building. Your AI reviewer checks each step as you go.
Tech stack