project_04_capstone

Authentication, Authorization & Secure API Design with Node.Stack Requirements

API Documentation

Use the following technologies:

• Node.js
• Express.js
• MongoDB + Mongoose
• dotenv
• Morgan

Scenario

You were hired to build the backend for a startup called VaultPass — a platform where users can create private notes and manage team access securely.

The company recently suffered a security breach because:

users could access other users’ data,
admins had too much unrestricted power,
tokens never expired,
and sensitive routes were exposed publicly.
Your task is to redesign the backend properly.

Requirements

Project Setup

Initialize a professional backend structure.

Your project must include:

Environment variable management with dotenv
Request logging with Morgan
Proper folder structure
Error handling middleware
MongoDB connection setup

Authentication System

Implement:

User Registration

A user should register with:
fullName
email
password
role

Rules
email must be unique
password must be hashed

role can only be:
user
moderator
admin

User Login
Users should log in using:
email
password

Return:
JWT token
user information (excluding password)

Authorization Twist

Implement role-based access control.

Routes

Public Route
GET /api/public/message
Response:
{ "message": "This route is public" }

Protected Route
GET /api/user/profile Only logged-in users can access it.

Moderator Route
GET /api/moderator/reports

Accessible only by:
moderator
admin

Admin Route

DELETE /api/admin/user/:id

Only admins can:
delete users
BUT admins cannot delete themselves (Yes, this is intentional.)

The Twist

Implement account locking.

If a user enters the wrong password:

5 consecutive times,

within 10 minutes,

their account should be locked for:

15 minutes.

During lock:

login must fail even if password becomes correct.

Store this properly in MongoDB.

Token Security

JWT tokens must:

expire in 1 hour

fail properly when expired

return meaningful error responses

Suspicious Activity Logger

Create middleware that logs:

failed logins

forbidden route access attempts

deleted accounts

Store logs in MongoDB.

Suggested fields:

action

user

ipAddress

timestamp

Bonus Twist (Important)

Create a route:

POST /api/admin/promote/:id

Rules:

only admins can promote users

admins CANNOT promote another admin

moderators cannot promote anyone

users cannot access the route

Deliverables

Students must submit:

GitHub Repository

With:

clean commits

meaningful README

Postman Collection

Include:
all endpoints
example requests
example responses

Database Design

Explain:
collections used
why each field exists

Extra Challenge Questions

Students must answer these theoretically:

1. Question 1

   Why is storing plain passwords dangerous even in small applications?

2. Question 2

   What is the difference between:

   authentication

   authorization

   Give real-world examples.

3. Question 3

   Why is JWT expiration important?

   What could happen if tokens never expire?

4. Question 4

   A hacker gets access to a valid JWT token.

   What are 3 things you can implement to reduce damage?

5. Question 5 Why should logging systems be treated as sensitive infrastructure?

API Documentation