GameZone — Backend

Modern, secure backend for turn-based multiplayer games built with Node.js, Express, MongoDB and Socket.IO.

---

Table of contents

• About
• Features
• Tech stack
• Quick start
  • Prerequisites
  • Install
  • Environment
  • Run
• API reference
• Realtime (Socket.IO)
• Project structure
• Testing & troubleshooting
• Security notes
• Contributing
• License

---

About

GameZone backend provides authentication (JWT access + refresh), OTP-based password reset via email, persistent user profiles and leaderboards, plus a Socket.IO-based realtime layer to handle multiplayer game sessions and turn logic.

---

Features

• Email OTP for password reset
• JWT access + refresh tokens stored in cookies (rotated on refresh)
• Protected endpoints for profile and score updates
• Leaderboard (top 10) and user progress history
• Socket.IO matchmaking and game room management (join, move, draw, checkmate, timeouts)
• HTTPS-capable server with TLS certs

---

Tech stack

• Node.js, Express
• MongoDB (mongoose)
• Socket.IO for realtime comms
• JWT for authentication
• Mailtrap (MailtrapTransport) for dev email delivery

---

Quick start

Prerequisites

• Node.js 18+ and npm
• MongoDB (Atlas or local)
• (Optional) Mailtrap token for email testing
• TLS certificate files (optional for HTTPS)

Install

Clone and install dependencies:

git clone <repo-url>
cd Game-backend
npm install

Environment — .env example

Create a .env file in the project root. Use .env.example as a template.

# MongoDB
MONGODB_URL=mongodb+srv://<user>:<pass>@cluster.mongodb.net/gamezone

# Server
PORT=3001

# JWT secrets (use secure random values)
ACCESS_TOKEN_SECRETE=your_access_secret
REFRESH_TOKEN_SECRETE=your_refresh_secret

# Mailtrap (for dev emails)
MAILTRAP_TOKEN=your_mailtrap_token

Tip: keep secrets out of source control. Add .env to .gitignore.

Run

Development with nodemon:

npx nodemon server.js

Production (example with PM2):

npm run start
# or using pm2
pm install -g pm2
pm run start

---

API reference

Base URL: http://localhost:3001/api

Authentication

• POST /api/auth/register — register user

  • Body: { name, email, password }
  • Returns: 200 on success

• POST /api/auth/login — login user

  • Body: { email, password }
  • On success: sets cookies accessToken (httpOnly) and jwt (refresh token)

• POST /api/auth/refresh-token — rotates refresh tokens, issues a new access token

• POST /api/auth/send-otp — send OTP to email

  • Body: { email }

• POST /api/auth/verify-otp — verify OTP

  • Body: { email, otp }

• POST /api/auth/reset-password — reset password

  • Body: { newPassword, email, otp } (min 8 characters)

• GET /api/auth/logout — clear auth cookies

User

• POST /api/user/updateProfile — protected

  • Body: { _id, name, image } — updates profile

• GET /api/user/getLeaderboard — returns top 10 users by score

• POST /api/user/updateScore — protected

  • Body: { id, score } — increments user score and logs progress

• GET /api/user/profile — protected

  • Returns: logged-in user's profile (excludes password)

Authentication middleware expects accessToken cookie. Ensure client sends cookies using credentials: 'include' (fetch) or withCredentials: true (axios).

---

Realtime (Socket.IO)

The Socket server matches players by gameType from handshake query and manages game rooms and turn timers.

Key events:

• Client connect handshake query: { gameType: 'TIC', id: '<userId>' }
• join — payload { board, User } → server pairs players and emits startGame when ready
• move — payload { gameId, board, symbol } → broadcast to room, reset turn timer
• reset, checkMate, Draw — broadcast accordingly
• opponentDisconnected, turnTimeout — notifications fired by server

Example (client):

import { io } from 'socket.io-client';
const socket = io('https://localhost:3001', {
  query: { gameType: 'TIC', id: USER_ID }
});

socket.emit('join', { board: initialBoard, User });

Turn timeout is 60s by default; server deletes games after a timeout event.

---

Screenshots

Project structure

/ (root)
├─ server.js
├─ app.js
├─ routes/
├─ controllers/
├─ models/
├─ socket/socketManager.js
├─ config/
└─ utils/

---

Security notes

• Use strong, unique values for JWT secrets and keep them out of source control.
• Use HTTPS in production.
• Rotate refresh tokens and validate cookie scopes.

---

---

License

MIT. See LICENSE for details.

---