# Node.js Express Rules

Full coding rules for this stack. Read this in full before writing or modifying any Express code in this project — not just once, keep applying it to every edit in the session, not only the first.

---

## Project Structure

Follow the **Controller-Service-Repository** pattern:

```
src/
├── controllers/    # Route handlers — parse input, call service, return response
├── services/       # Business logic — core logic, database transactions
├── repositories/   # Data access — database queries, ORM interactions
├── models/         # Database models (Sequelize/Prisma/Mongoose)
├── middleware/     # Custom Express middleware (auth, logging)
├── routes/         # Route definitions
├── dtos/           # Input/Output Data Transfer Objects (if using TS)
├── utils/          # Stateless helper functions
└── config/         # App configuration
```

---

## Express Rules

- Use **Async/Await** for all asynchronous operations — avoid callbacks or manual promise chains.
- Always use a global error handler middleware. Never use `try/catch` in controllers if you use an async-wrapper middleware.
- Validate all incoming data using `Joi`, `Zod`, or `express-validator`.
- Keep controllers thin; they should only handle request parsing and response formatting.

---

## Security Rules

- Never expose stack traces in production.
- Use `helmet` to set secure HTTP headers.
- Sanitize input to prevent NoSQL/SQL injection.
- Use `argon2` or `bcrypt` for password hashing.
- Standardize on JWT for authentication.

---

## Testing Rules

- Use **Jest** and **Supertest** for testing.
- Test every API endpoint with integration tests.
- Mock external services (Email, Payment Gateways).