Working with Databases (MongoDB)

// npm install mongoose

const mongoose = require('mongoose');

// Connect ONCE at startup — never inside a route handler
mongoose.connect(process.env.DATABASE_URL)   // never hard-code credentials
  .then(() => console.log('Connected to MongoDB'))
  .catch(err => {
    console.error('Connection failed:', err.message);
    process.exit(1);                         // do not serve traffic without a database
  });

// Define a Schema
const userSchema = new mongoose.Schema({
  name: { type: String, required: true, trim: true },
  email: {
    type: String,
    required: true,
    unique: true,
    lowercase: true
  },
  age: { type: Number, min: 0 },
  role: {
    type: String,
    enum: ['user', 'admin'],
    default: 'user'
  },
  createdAt: { type: Date, default: Date.now }
});

// Create a Model
const User = mongoose.model('User', userSchema);

module.exports = User;

const express = require('express');
const User = require('./models/User');
const router = express.Router();

// CREATE — Add a new user
router.post('/', async (req, res) => {
  try {
    const user = await User.create(req.body);
    res.status(201).json(user);
  } catch (err) {
    if (err.code === 11000) {
      return res.status(400).json({ error: 'Email already exists' });
    }
    res.status(400).json({ error: err.message });
  }
});

// READ — Get all users (with filtering)
router.get('/', async (req, res) => {
  try {
    const { role, sort = '-createdAt' } = req.query;
    const filter = role ? { role } : {};
    const users = await User.find(filter).sort(sort).limit(50);
    res.json(users);
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// READ — Get a single user
router.get('/:id', async (req, res) => {
  try {
    // An id like 'abc' throws a CastError BEFORE the query ever runs
    const user = await User.findById(req.params.id);
    if (!user) return res.status(404).json({ error: 'User not found' });
    res.json(user);
  } catch (err) {
    if (err.name === 'CastError') {
      return res.status(400).json({ error: 'Invalid id format' });
    }
    res.status(500).json({ error: 'Server error' });
  }
});

// UPDATE — Modify a user
router.put('/:id', async (req, res) => {
  try {
    const user = await User.findByIdAndUpdate(
      req.params.id,
      req.body,
      { new: true, runValidators: true }
    );
    if (!user) return res.status(404).json({ error: 'User not found' });
    res.json(user);
  } catch (err) {
    res.status(400).json({ error: err.message });
  }
});

// DELETE — Remove a user
router.delete('/:id', async (req, res) => {
  try {
    const user = await User.findByIdAndDelete(req.params.id);
    if (!user) return res.status(404).json({ error: 'User not found' });
    res.status(204).send();
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

module.exports = router;

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: {
    type: String,
    required: [true, 'Name is required'],
    trim: true,
    maxlength: 80
  },
  email: {
    type: String,
    required: true,
    unique: true,      // an INDEX, not a validator — failures arrive as code 11000
    lowercase: true,
    trim: true
  },
  password: {
    type: String,
    required: true,
    minlength: 8,
    select: false      // never returned unless a query asks for it explicitly
  },
  role: { type: String, enum: ['user', 'admin'], default: 'user' }
}, { timestamps: true });   // createdAt and updatedAt, maintained for you

// Referencing: a book has an identity of its own, so it points at its owner
const bookSchema = new mongoose.Schema({
  title: { type: String, required: true, trim: true },
  owner: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'User',
    required: true,
    index: true        // you will filter by this constantly
  }
}, { timestamps: true });

const User = mongoose.model('User', userSchema);
const Book = mongoose.model('Book', bookSchema);

// Pulling the reference in when you actually need it
const books = await Book.find({ owner: userId }).populate('owner', 'name email');

// Asking for the hidden field on purpose, in the one place that needs it
const account = await User.findOne({ email }).select('+password');

// VULNERABLE — a JSON body can send an object where you expected a string
const user = await User.findOne({
  email: req.body.email,
  password: req.body.password
});
// POST {"email":"admin@site.com","password":{"$ne":null}}
//   -> { email: 'admin@site.com', password: { $ne: null } }
//   -> matches, and the attacker is now the administrator

// SAFE — force the types, and never compare the password in the query
const email = String(req.body.email || '').toLowerCase().trim();
const password = String(req.body.password || '');

const account = await User.findOne({ email }).select('+password');
if (!account || !(await bcrypt.compare(password, account.password))) {
  return res.status(401).json({ error: 'Invalid email or password' });
}

// BROKEN ACCESS CONTROL — returns the task to whoever asks for it
const task = await Task.findById(req.params.id);

// CORRECT — ownership is part of the query, so someone else's task is "not found"
const mine = await Task.findOne({ _id: req.params.id, owner: req.user.id });
if (!mine) return res.status(404).json({ error: 'Task not found' });

// NEVER let the client shape the filter
// const tasks = await Task.find({ ...req.query });   // any field, any operator
const filter = { owner: req.user.id };                // build it yourself
if (req.query.status === 'done') filter.completed = true;

// Map database errors once, in the global error handler (lesson 17)
app.use((err, req, res, next) => {
  if (err.name === 'ValidationError') {
    return res.status(400).json({
      error: 'Validation failed',
      details: Object.values(err.errors).map(e => ({ field: e.path, message: e.message }))
    });
  }
  if (err.name === 'CastError') return res.status(400).json({ error: 'Invalid id format' });
  if (err.code === 11000)       return res.status(409).json({ error: 'That value already exists' });

  console.error(err.stack);
  res.status(500).json({ error: 'Internal Server Error' });
});

// A read you will not modify: fewer fields, paginated, plain objects
const books = await Book.find({ owner: req.user.id })
  .select('title author createdAt')
  .sort('-createdAt')
  .skip((page - 1) * limit)
  .limit(limit)
  .lean();

// N+1 — one request quietly becomes fifty-one
// for (const book of books) {
//   book.owner = await User.findById(book.owner);
// }

// One query instead
const owners = await User.find({ _id: { $in: books.map(b => b.owner) } })
  .select('name')
  .lean();