When you start your Node.js server and see this error, another process is already using that port.

**Error Message:**
```
Error: listen EADDRINUSE: address already in use :::3000
```

## Quick Solution

### Mac/Linux

Find the process:
```bash
lsof -i :3000
```

Output shows:
```
node    12345 user   23u  IPv6 ... TCP *:3000 (LISTEN)
```

Kill it:
```bash
kill -9 12345
```

One-liner:
```bash
kill -9 $(lsof -t -i:3000)
```

### Windows

Find the process:
```bash
netstat -ano | findstr :3000
```

Kill it:
```bash
taskkill /PID 12345 /F
```

## Better Solution: Auto Port Selection

Instead of hardcoding port 3000, try the next available port:

```javascript
const http = require('http');

function startServer(port) {
  const server = http.createServer(app);
  
  server.listen(port)
    .on('listening', () => {
      console.log(`Server on port ${port}`);
    })
    .on('error', (err) => {
      if (err.code === 'EADDRINUSE') {
        console.log(`Port ${port} busy, trying ${port + 1}`);
        startServer(port + 1);
      }
    });
}

startServer(3000);
```

## Environment Variables

Use flexible port configuration:

```javascript
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});
```

Run with custom port:
```bash
PORT=3001 node server.js
```

## Common Causes

| Cause | Solution |
|-------|----------|
| Previous server still running | Kill the process |
| Multiple server instances | Check running processes |
| Docker container active | Stop container |
| nodemon didn't clean up | Restart nodemon |

## Proper Server Cleanup

Add signal handlers to close server properly:

```javascript
const server = app.listen(3000);

process.on('SIGINT', () => {
  server.close(() => {
    console.log('Server closed');
    process.exit(0);
  });
});

process.on('SIGTERM', () => {
  server.close(() => {
    process.exit(0);
  });
});
```

Now Ctrl+C properly shuts down the server.

## NPM Script Helper

Add to package.json:

```json
{
  "scripts": {
    "kill-port": "kill -9 $(lsof -t -i:3000) 2>/dev/null || true",
    "start": "npm run kill-port && node server.js"
  }
}
```

## Docker Issues

If using Docker and port is still busy:

```bash
docker ps                    # List containers
docker stop <container-id>   # Stop specific container
docker rm <container-id>     # Remove container
```

## Prevention Tips

1. Always handle SIGINT and SIGTERM signals
2. Use environment variables for ports
3. Implement auto port selection for development
4. Clean up Docker containers regularly
5. Use process managers like PM2 in production

This error usually means a previous instance didn't shut down cleanly. The solutions above handle both the immediate fix and prevention.

Getting EADDRINUSE error? Your port is taken. Here's how to find what's using it and fix it properly.

Error: listen EADDRINUSE - Port Already in Use in Node.js

# Understanding Node.js Event Loop

## The Problem: JavaScript is Single-Threaded

JavaScript runs on a **single thread**. This means:
- Only one operation at a time
- If one operation blocks, everything stops
- Can't handle multiple requests simultaneously

**Traditional Multi-Threaded Server:**
```
Request 1 → Thread 1 → Process → Response
Request 2 → Thread 2 → Process → Response
Request 3 → Thread 3 → Process → Response

Each request gets its own thread
```

**Node.js (Single Thread):**
```
Request 1 → Event Loop → Process → Response
Request 2 → Event Loop → Process → Response
Request 3 → Event Loop → Process → Response

All requests share ONE thread!
```

**Question:** How can Node.js handle thousands of requests with just one thread?

**Answer:** The Event Loop!

## What is the Event Loop?

The Event Loop is Node.js's secret weapon. It's a mechanism that allows Node.js to perform **non-blocking I/O operations** despite being single-threaded.

### How It Works Conceptually

```
┌─────────────────────────────────────┐
│      JavaScript Code (Single Thread) │
└──────────────┬───────────────────────┘
               │
               │ Async operation?
               │
┌──────────────▼───────────────────────┐
│         Event Loop                  │
│  ┌──────────────────────────────┐  │
│  │  1. Check: Any callbacks?    │  │
│  │  2. Execute callbacks         │  │
│  │  3. Check: Any async done?   │  │
│  │  4. Add callbacks to queue    │  │
│  │  5. Repeat                    │  │
│  └──────────────────────────────┘  │
└──────────────┬───────────────────────┘
               │
               │ Offload to OS/Thread Pool
               │
┌──────────────▼───────────────────────┐
│   Operating System / Thread Pool    │
│   (Multi-threaded, handles I/O)      │
└─────────────────────────────────────┘
```

## Event Loop Phases (Detailed)

The event loop has **6 phases** that run in order:

```
┌─────────────────────────────────────┐
│      Event Loop (One Cycle)         │
│                                     │
│  ┌──────────────────────────────┐  │
│  │ 1. Timers Phase               │  │
│  │    - setTimeout()             │  │
│  │    - setInterval()           │  │
│  └──────────────────────────────┘  │
│           ↓                         │
│  ┌──────────────────────────────┐  │
│  │ 2. Pending Callbacks           │  │
│  │    - Deferred I/O callbacks   │  │
│  └──────────────────────────────┘  │
│           ↓                         │
│  ┌──────────────────────────────┐  │
│  │ 3. Idle, Prepare               │  │
│  │    - Internal use             │  │
│  └──────────────────────────────┘  │
│           ↓                         │
│  ┌──────────────────────────────┐  │
│  │ 4. Poll Phase                 │  │
│  │    - Fetch new I/O events     │  │
│  │    - Execute I/O callbacks    │  │
│  └──────────────────────────────┘  │
│           ↓                         │
│  ┌──────────────────────────────┐  │
│  │ 5. Check Phase                │  │
│  │    - setImmediate() callbacks │  │
│  └──────────────────────────────┘  │
│           ↓                         │
│  ┌──────────────────────────────┐  │
│  │ 6. Close Callbacks            │  │
│  │    - socket.on('close')       │  │
│  └──────────────────────────────┘  │
│           ↓                         │
│      Repeat from Phase 1            │
└─────────────────────────────────────┘
```

## Visual Example: How Requests Are Handled

### Step-by-Step Flow

```
Time →

Request 1 arrives:
┌─────────────────────────────────┐
│ Event Loop                      │
│ 1. Receive request              │
│ 2. Start DB query (async)       │
│ 3. Don't wait! Continue...      │
└─────────────────────────────────┘
         │
         │ (DB query running in background)
         │
Request 2 arrives:
┌─────────────────────────────────┐
│ Event Loop                      │
│ 1. Receive request 2             │
│ 2. Start DB query (async)       │
│ 3. Don't wait! Continue...      │
└─────────────────────────────────┘
         │
         │ (Both DB queries running)
         │
DB Query 1 completes:
┌─────────────────────────────────┐
│ Event Loop                      │
│ 1. Callback added to queue       │
│ 2. Process callback              │
│ 3. Send response to Request 1    │
└─────────────────────────────────┘
         │
DB Query 2 completes:
┌─────────────────────────────────┐
│ Event Loop                      │
│ 1. Callback added to queue       │
│ 2. Process callback              │
│ 3. Send response to Request 2    │
└─────────────────────────────────┘

Result: Both requests handled without blocking!
```

## Phase 1: Timers

```javascript
setTimeout(() => {
  console.log('Timer executed');
}, 1000);
```

**How it works:**
```
1. setTimeout() called
2. Timer registered (wait 1000ms)
3. Code continues (doesn't wait)
4. After 1000ms, callback added to Timers queue
5. Event Loop reaches Timers phase
6. Callback executed
```

## Phase 4: Poll Phase (Most Important!)

The Poll phase:
1. Calculates how long to block and wait for I/O
2. Processes events in the poll queue
3. Executes I/O callbacks

```
┌─────────────────────────────────┐
│      Poll Phase                 │
│                                 │
│  If callbacks in queue:         │
│    → Execute all callbacks      │
│                                 │
│  If queue empty:                │
│    → Wait for new I/O events    │
│    → Block until timers ready  │
└─────────────────────────────────┘
```

## Phase 5: Check Phase

```javascript
setImmediate(() => {
  console.log('setImmediate executed');
});
```

**setImmediate vs setTimeout:**
```
setTimeout(fn, 0):
  → Added to Timers phase
  → Executes in NEXT iteration

setImmediate(fn):
  → Added to Check phase
  → Executes in CURRENT iteration (after Poll)
```

## Microtasks: process.nextTick() and Promises

**Important:** Microtasks execute **BEFORE** moving to next phase!

```
┌─────────────────────────────────┐
│   Current Phase                 │
│   (e.g., Poll Phase)            │
└──────────────┬──────────────────┘
               │
               │ Phase completes
               │
┌──────────────▼──────────────────┐
│   Microtasks Queue               │
│   - process.nextTick()          │
│   - Promise.then()              │
│                                 │
│   Execute ALL microtasks        │
└──────────────┬──────────────────┘
               │
               │ All microtasks done
               │
┌──────────────▼──────────────────┐
│   Next Phase                     │
│   (e.g., Check Phase)           │
└─────────────────────────────────┘
```

## Execution Order Example

```javascript
console.log('Start');

setTimeout(() => console.log('Timeout'), 0);

Promise.resolve().then(() => console.log('Promise'));

process.nextTick(() => console.log('NextTick'));

console.log('End');
```

**Execution Flow:**
```
1. "Start" printed (synchronous)
2. setTimeout() registered (async, goes to Timers queue)
3. Promise.then() registered (microtask)
4. process.nextTick() registered (microtask)
5. "End" printed (synchronous)

Event Loop:
6. Execute microtasks:
   - process.nextTick() → "NextTick" printed
   - Promise.then() → "Promise" printed
7. Move to Timers phase:
   - setTimeout() → "Timeout" printed

Output:
Start
End
NextTick
Promise
Timeout
```

## Why Event Loop Makes Node.js Fast

**Traditional Blocking Server:**
```
Request 1: Read file (2 seconds) → Blocked
Request 2: Wait... → Blocked
Request 3: Wait... → Blocked

Total time: 6 seconds for 3 requests
```

**Node.js with Event Loop:**
```
Request 1: Start file read → Continue
Request 2: Start file read → Continue
Request 3: Start file read → Continue

All files read in parallel (background)
All complete in ~2 seconds

Total time: 2 seconds for 3 requests!
```

**Performance:**
```
Blocking: 1 request at a time
Event Loop: Thousands of requests simultaneously

3x faster for 3 requests
100x faster for 100 requests!
```

## Key Takeaway

The Event Loop is Node.js's core mechanism. It allows single-threaded JavaScript to handle thousands of concurrent operations. It works by offloading blocking operations to the OS/thread pool and processing callbacks when operations complete. Understanding the event loop phases and microtasks is crucial for writing efficient Node.js code.

Master the Node.js Event Loop. Understand how it works, phases, callbacks, microtasks, and why it makes Node.js fast.

Understanding Node.js Event Loop: A Complete Guide

Building RESTful APIs is one of the most common use cases for Node.js. Express.js provides a robust set of features for web and mobile applications, making API development straightforward and efficient.

## Setting Up Express

First, let's set up a basic Express server with proper middleware configuration.

## REST API Best Practices

When building RESTful APIs, following best practices ensures your API is maintainable, scalable, and easy to use:

- Use proper HTTP methods (GET, POST, PUT, DELETE, PATCH)
- Implement proper status codes
- Version your API
- Use proper error handling
- Implement request validation
- Add rate limiting and security measures

## Middleware in Express

Middleware functions are functions that have access to the request object, response object, and the next middleware function in the application's request-response cycle.

Learn how to build production-ready RESTful APIs using Node.js and Express framework.

Building RESTful APIs with Node.js and Express

Asynchronous programming is at the heart of Node.js. Understanding the difference between Promises and async/await is crucial for writing clean, maintainable code.

## Understanding Promises

Promises represent the eventual completion or failure of an asynchronous operation. They provide a cleaner alternative to callbacks and help avoid callback hell.

## Async/Await Syntax

Async/await is syntactic sugar built on top of Promises. It makes asynchronous code look and behave more like synchronous code, making it easier to read and maintain.

## Error Handling

Both approaches have different error handling mechanisms. Promises use .catch(), while async/await uses try/catch blocks.

Compare async/await and Promises in Node.js and learn when to use each approach.

Async/Await vs Promises in Node.js

This comprehensive guide covers 50 essential Node.js interview questions that every backend developer should know. These questions cover fundamental concepts, event loop, async programming, modules, streams, and production-ready patterns commonly asked in technical interviews.

## Core Concepts

Understanding Node.js core concepts is essential for any backend developer. These questions test your knowledge of the event loop, non-blocking I/O, and how Node.js handles concurrency.

## Event Loop & Async Programming

The event loop is the heart of Node.js. Master these questions to demonstrate your understanding of asynchronous programming, promises, async/await, and callback patterns.

## Modules & Package Management

Node.js uses CommonJS and ES modules for code organization. Understanding module systems, npm, and package management is crucial for building scalable applications.

## Streams & File System

Streams are powerful for handling large data efficiently. These questions cover readable, writable, and transform streams, along with file system operations.

## Production & Best Practices

Production-ready Node.js applications require proper error handling, security practices, performance optimization, and deployment strategies.

Comprehensive collection of 50 essential Node.js interview questions covering event loop, async programming, modules, streams, and backend concepts. Free Node.js, NodeJS, Node JS interview questions with answers. Node.js interview prep guide.

my-app

Node.js Interview Questions: 50 Essential Questions for Developers

TypeScript with Node.js is becoming the standard for professional backend development. It catches bugs before they reach production and makes your code way easier to maintain.

## Why TypeScript?

TypeScript finds errors while you're coding, not when users complain. Your IDE becomes smarter, autocomplete works better, and refactoring becomes safe. For backend code, this is a game changer.

## Setting It Up

Don't worry, it's not complicated. Install TypeScript, create a config file, and you're good to go. I'll show you exactly what to do, step by step.

## Typing Express Routes

Once TypeScript is set up, you can type everything - your routes, request bodies, query parameters. Your IDE will tell you if you make a mistake, and you'll catch bugs before they happen.

## Real Examples

I'll show you how to type database models, middleware, and complex Express routes. These are patterns you'll use in real projects.

Build type-safe Node.js apps with TypeScript. Learn how to set it up, type your Express routes, and catch errors before they reach production. This is how professionals build backends in 2025.

Node.js with TypeScript: Type-Safe Backends

CORS errors are one of the most common issues when building web applications. If you're getting "Access-Control-Allow-Origin" errors, this tutorial will help you fix them.

## What is CORS?

CORS (Cross-Origin Resource Sharing) is a security feature that browsers use to control which websites can make requests to your API. When your frontend (React app) tries to call your backend (Node.js API) from a different origin, the browser blocks it unless you configure CORS properly.

## Why CORS Errors Happen

CORS errors occur when:
- Your frontend runs on http://localhost:3000
- Your backend runs on http://localhost:5000
- Browser blocks the request because origins don't match

## Fixing CORS in Express

The easiest way to fix CORS is using the cors middleware. Install it and configure it properly.

## Basic CORS Setup

For development, you can allow all origins. For production, specify exact origins for security.

## Advanced CORS Configuration

Learn how to configure specific headers, methods, and credentials. This is important for production applications.

## Common CORS Issues

I'll show you how to handle preflight requests, credentials, and custom headers. These are the most common CORS problems developers face.

Learn how to fix CORS errors in Node.js and Express. Understand CORS, configure it properly, and handle cross-origin requests. Essential for building APIs that work with frontend applications.

Fixing CORS Errors in Node.js and Express

# What is Node.js?

## Introduction: The JavaScript Revolution

Node.js is a **JavaScript runtime** built on Chrome's V8 engine. It lets you run JavaScript on your computer/server, not just in browsers.

**Created:** 2009 by Ryan Dahl  
**Purpose:** Run JavaScript everywhere  
**Impact:** Revolutionized backend development

## Why Node.js Matters

```
Before Node.js:
- Frontend: JavaScript
- Backend: PHP, Python, Java, Ruby
- Result: Learn 2+ languages

After Node.js:
- Frontend: JavaScript
- Backend: JavaScript (Node.js)
- Result: One language for everything!
```

**Benefits:**
- **One Language** - JavaScript for frontend and backend
- **Fast** - V8 engine compiles to machine code
- **Non-Blocking** - Handles thousands of requests
- **Huge Ecosystem** - npm has millions of packages
- **Easy to Learn** - If you know JavaScript, you're ready!

## Complete Node.js Overview

```
                    ┌─────────────────────┐
                    │   JavaScript Code    │
                    │   (Your Application) │
                    └──────────┬───────────┘
                               │
                    ┌──────────▼───────────┐
                    │    Node.js Runtime   │
                    │  ┌────────────────┐ │
                    │  │  V8 Engine     │ │ ← Executes JavaScript
                    │  │  (Chrome's)    │ │
                    │  └────────────────┘ │
                    │  ┌────────────────┐ │
                    │  │  libuv         │ │ ← Handles async I/O
                    │  │  (Event Loop)  │ │
                    │  └────────────────┘ │
                    │  ┌────────────────┐ │
                    │  │  Node.js APIs  │ │ ← fs, http, crypto
                    │  └────────────────┘ │
                    └──────────┬───────────┘
                               │
                    ┌──────────▼───────────┐
                    │  Operating System   │
                    │  (File System,       │
                    │   Network, etc.)      │
                    └──────────────────────┘

What Node.js Does:
├── Runs JavaScript outside browser
├── Accesses file system
├── Creates web servers
├── Connects to databases
├── Handles network requests
└── Much more!
```

## The Problem: JavaScript Was Limited

Before Node.js (2009), JavaScript could only run in browsers:

```
┌─────────────────────────────────┐
│         Browser                 │
│  ┌──────────────────────────┐  │
│  │   JavaScript Engine       │  │
│  │   (V8, SpiderMonkey)      │  │
│  └──────────────────────────┘  │
│                                 │
│  ✅ Can manipulate DOM          │
│  ✅ Can handle events           │
│  ❌ Can't access files          │
│  ❌ Can't create servers        │
│  ❌ Can't connect to databases  │
└─────────────────────────────────┘

Backend Development:
├── PHP
├── Python
├── Java
├── Ruby
└── C# / .NET

Result: Different languages for frontend and backend!
```

## The Solution: Node.js

Node.js lets you run JavaScript **outside the browser** on your computer/server.

```
┌─────────────────────────────────┐
│         Node.js Runtime          │
│  ┌──────────────────────────┐   │
│  │   V8 JavaScript Engine    │   │
│  │   (Same as Chrome!)       │   │
│  └──────────────────────────┘   │
│  ┌──────────────────────────┐   │
│  │   System APIs             │   │
│  │   - File System (fs)      │   │
│  │   - Network (http)        │   │
│  │   - OS (os)               │   │
│  │   - Crypto                │   │
│  └──────────────────────────┘   │
│  ┌──────────────────────────┐   │
│  │   Event Loop              │   │
│  │   (Non-blocking I/O)      │   │
│  └──────────────────────────┘   │
└─────────────────────────────────┘

✅ Can access files
✅ Can create servers
✅ Can connect to databases
✅ Can do everything backend languages do!
```

## How Node.js Works

### Architecture Diagram

```
┌─────────────────────────────────────────┐
│         Your JavaScript Code             │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│         Node.js Runtime                 │
│  ┌──────────────────────────────────┐  │
│  │   V8 Engine (JavaScript Parser)  │  │
│  │   - Compiles JS to machine code   │  │
│  │   - Executes code                 │  │
│  └──────────────────────────────────┘  │
│  ┌──────────────────────────────────┐  │
│  │   libuv (C++ Library)           │  │
│  │   - Handles async operations    │  │
│  │   - Thread pool for heavy tasks │  │
│  │   - Event loop                  │  │
│  └──────────────────────────────────┘  │
│  ┌──────────────────────────────────┐  │
│  │   Node.js APIs                   │  │
│  │   - fs, http, crypto, etc.       │  │
│  └──────────────────────────────────┘  │
└─────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│         Operating System                │
│   (File System, Network, etc.)          │
└─────────────────────────────────────────┘
```

**Key Components:**
1. **V8 Engine** - Executes JavaScript (same engine Chrome uses)
2. **libuv** - Handles asynchronous operations
3. **Node.js APIs** - Provides system access (fs, http, etc.)

## Before vs After Node.js

### Before Node.js (2009)

```
Frontend Development:
┌─────────────┐
│ JavaScript  │ → Browser only
└─────────────┘

Backend Development:
┌──────┐  ┌────────┐  ┌──────┐  ┌──────┐
│ PHP  │  │ Python │  │ Java │  │ Ruby │
└──────┘  └────────┘  └──────┘  └──────┘

Problem: Learn 2+ languages!
```

### After Node.js

```
Full-Stack Development:
┌─────────────────────────────────┐
│         JavaScript               │
│  ┌─────────────┐  ┌──────────┐ │
│  │  Frontend   │  │ Backend   │ │
│  │  (Browser)  │  │ (Node.js) │ │
│  └─────────────┘  └──────────┘ │
└─────────────────────────────────┘

Solution: One language for everything!
```

## The Event Loop: How Node.js Handles Multiple Requests

### Traditional Server (Blocking)

```
Request 1 → Process → Wait for DB → Response (2 seconds)
Request 2 → Wait... → Wait... → Process → Response (4 seconds)
Request 3 → Wait... → Wait... → Wait... → Response (6 seconds)

Problem: Each request blocks others!
```

### Node.js Server (Non-Blocking)

```
Request 1 → Start DB query → Don't wait → Continue
Request 2 → Start DB query → Don't wait → Continue
Request 3 → Start DB query → Don't wait → Continue

DB responds → Handle Request 1 → Send Response
DB responds → Handle Request 2 → Send Response
DB responds → Handle Request 3 → Send Response

All requests handled in ~2 seconds!
```

### Event Loop Flow

```
┌─────────────────────────────────────┐
│         Event Loop                  │
│                                     │
│  1. Execute JavaScript code         │
│  2. If async operation (DB, file): │
│     → Send to thread pool          │
│     → Continue to next line        │
│  3. When async completes:          │
│     → Callback added to queue      │
│  4. Process callbacks              │
│  5. Repeat                          │
└─────────────────────────────────────┘

Result: Single thread handles thousands of requests!
```

## What Node.js is Good For

### ✅ Great For:

**1. APIs and Web Servers**
```
┌──────────┐      ┌──────────┐
│  Client  │─────▶│ Node.js  │
│          │◀────│  Server  │
└──────────┘      └──────────┘
                  Fast response!
```

**2. Real-Time Applications**
- Chat apps (WhatsApp, Slack)
- Gaming servers
- Live notifications
- Collaborative editing

**3. Microservices**
- Small, independent services
- Easy to scale
- Fast deployment

**4. CLI Tools**
- npm, yarn
- Build tools
- Automation scripts

**5. Streaming Applications**
- Video processing
- File uploads
- Data pipelines

### ❌ Not Ideal For:

**1. CPU-Intensive Tasks**
```
❌ Video encoding
❌ Image processing
❌ Machine learning
❌ Heavy calculations

Why? Node.js is single-threaded.
Use: Worker Threads or other languages
```

**2. Heavy Computation**
- Mathematical calculations
- Data analysis
- Scientific computing

## Your First Node.js Code

```javascript
// hello.js
console.log('Hello from Node.js!');

// Run it
// $ node hello.js
// Output: Hello from Node.js!
```

## Simple HTTP Server

```javascript
const http = require('http');

const server = http.createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' });
  res.end('Hello World!');
});

server.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});
```

**What happens:**
1. Import `http` module
2. Create server
3. Handle requests
4. Listen on port 3000

## Node.js vs Other Technologies

| Feature | Node.js | PHP | Python | Java |
|---------|---------|-----|--------|------|
| Language | JavaScript | PHP | Python | Java |
| Speed | Fast (V8) | Medium | Medium | Fast |
| Async | Native | Limited | Limited | Limited |
| Learning | Easy (if you know JS) | Easy | Easy | Hard |
| Ecosystem | Huge (npm) | Large | Large | Large |
| Use Case | APIs, Real-time | Web pages | Data science | Enterprise |

## Key Takeaway

Node.js = JavaScript + V8 Engine + System APIs + Event Loop. It enables full-stack JavaScript development with a non-blocking architecture perfect for I/O operations. Single-threaded but handles thousands of concurrent connections through event loop. Start with Node.js if you know JavaScript and want to build backends.

Complete introduction to Node.js. Understand what it is, how it works, architecture, and why it revolutionized backend development.

What is Node.js? A Beginner Introduction

# Installing Node.js and npm

npm comes bundled with Node.js. Install Node.js, get npm free.

## Method 1: Direct Download (Easiest)

1. Go to [nodejs.org](https://nodejs.org)
2. Download LTS version (recommended)
3. Run installer
4. Done!

Verify installation:
```bash
node --version
# v20.10.0

npm --version
# 10.2.3
```

## Method 2: Using nvm (Recommended)

nvm (Node Version Manager) lets you install multiple Node.js versions.

**Install nvm (Mac/Linux):**
```bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
```

**Install nvm (Windows):**
Download nvm-windows from GitHub releases.

**Using nvm:**
```bash
# Install latest LTS
nvm install --lts

# Install specific version
nvm install 18.17.0

# List installed versions
nvm ls

# Switch version
nvm use 18.17.0

# Set default
nvm alias default 18.17.0
```

## LTS vs Current

| Version | Use Case |
|---------|----------|
| LTS (Long Term Support) | Production, stability |
| Current | Latest features, testing |

**Recommendation:** Use LTS for real projects.

## Verify Everything Works

```bash
# Check Node.js
node --version

# Check npm
npm --version

# Run a quick test
node -e "console.log('Node.js is working!')"
```

## Common Issues

**Permission errors on npm (Mac/Linux):**
```bash
# Fix: Use nvm or change npm default directory
mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
# Add to .bashrc: export PATH=~/.npm-global/bin:$PATH
```

**Multiple versions conflict:**
```bash
# Use nvm to manage versions
nvm use 18
# Now using Node.js v18
```

## Key Takeaway

Use nvm to install Node.js - it makes version management painless. Download LTS for stability, Current for experimenting. Once installed, you're ready to build!

Learn how to install Node.js and npm on Windows, Mac, and Linux. Understand version management with nvm.

Installing Node.js and npm

# Understanding npm and package.json

npm = Node Package Manager. It's how you install and manage libraries.

## Initialize a Project

```bash
mkdir my-project
cd my-project
npm init -y
```

This creates package.json:
```json
{
  "name": "my-project",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  }
}
```

## Installing Packages

```bash
# Install a package
npm install express

# Install as dev dependency
npm install jest --save-dev
# or
npm install jest -D

# Install globally
npm install -g nodemon

# Install specific version
npm install lodash@4.17.21
```

## package.json Dependencies

```json
{
  "dependencies": {
    "express": "^4.18.2"    // Production
  },
  "devDependencies": {
    "jest": "^29.7.0"       // Development only
  }
}
```

## Version Numbers Explained

```
^4.18.2 = Compatible with 4.x.x (minor updates OK)
~4.18.2 = Patch updates only (4.18.x)
4.18.2  = Exact version
*       = Any version (dangerous!)
```

## Common npm Commands

```bash
# Install all dependencies from package.json
npm install

# Update packages
npm update

# Remove package
npm uninstall lodash

# List installed packages
npm list

# Check outdated packages
npm outdated

# Run scripts
npm run test
npm start        # shortcut for npm run start
```

## npm Scripts

```json
{
  "scripts": {
    "start": "node server.js",
    "dev": "nodemon server.js",
    "test": "jest",
    "build": "webpack --mode production"
  }
}
```

Run with: `npm run dev`

## package-lock.json

This file locks exact versions of all dependencies. **Always commit it!**

```bash
# Ensures everyone gets same versions
npm ci  # Clean install using lock file
```

## .npmrc Configuration

```bash
# Create .npmrc in project root
registry=https://registry.npmjs.org/
save-exact=true
```

## Key Takeaway

npm manages your project dependencies through package.json. Use `npm install` to add packages, commit package-lock.json for reproducible builds, and define scripts for common tasks. It's the backbone of Node.js development.

Master npm package manager and package.json configuration. Learn to install, update, and manage dependencies.

Understanding npm and package.json

# Your First Node.js Program

Let's write real Node.js code. No theory, just practice.

## Hello World

Create `hello.js`:
```javascript
console.log('Hello, Node.js!');
```

Run it:
```bash
node hello.js
# Output: Hello, Node.js!
```

That's it. You've written Node.js!

## Working with Variables

```javascript
// app.js
const name = 'Alice';
const age = 25;

console.log(`Name: ${name}, Age: ${age}`);

// Arrays and objects work the same
const skills = ['JavaScript', 'Node.js', 'Express'];
const user = { name: 'Bob', role: 'developer' };

console.log(skills);
console.log(user);
```

## Getting User Input

```javascript
// input.js
const readline = require('readline');

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout
});

rl.question('What is your name? ', (answer) => {
  console.log(`Hello, ${answer}!`);
  rl.close();
});
```

## Command Line Arguments

```javascript
// args.js
const args = process.argv.slice(2);

console.log('Arguments:', args);
console.log('First arg:', args[0]);
```

Run: `node args.js hello world`

Output:
```
Arguments: [ 'hello', 'world' ]
First arg: hello
```

## Simple Calculator

```javascript
// calc.js
const args = process.argv.slice(2);
const num1 = parseFloat(args[0]);
const operator = args[1];
const num2 = parseFloat(args[2]);

let result;
switch (operator) {
  case '+': result = num1 + num2; break;
  case '-': result = num1 - num2; break;
  case '*': result = num1 * num2; break;
  case '/': result = num1 / num2; break;
  default: console.log('Unknown operator'); process.exit(1);
}

console.log(`${num1} ${operator} ${num2} = ${result}`);
```

Run: `node calc.js 10 + 5`

## Reading a File

```javascript
// readfile.js
const fs = require('fs');

const content = fs.readFileSync('hello.js', 'utf8');
console.log('File contents:');
console.log(content);
```

## Key Takeaway

Node.js runs JavaScript files with `node filename.js`. You have access to `process.argv` for arguments, built-in modules like `fs` and `readline`, and all JavaScript features. Start simple, then build up!

Write and run your first Node.js program. Learn the basics of creating and executing JavaScript files.

Your First Node.js Program

# Node.js Modules: require and module.exports

## What are Modules?

Modules let you split code into separate files. Each file is a **module** that can be imported and used in other files.

## The Problem: Without Modules

```
app.js (1000+ lines)
├── Database functions
├── Authentication logic
├── User management
├── Email sending
├── File processing
└── API routes

Problems:
❌ Hard to find code
❌ Hard to maintain
❌ Can't reuse code
❌ Variable name conflicts
❌ Everything in global scope
```

## The Solution: Modules

```
project/
├── app.js (main file)
├── db.js (database module)
├── auth.js (authentication module)
├── users.js (user module)
├── email.js (email module)
└── routes.js (routes module)

Benefits:
✅ Organized code
✅ Easy to find
✅ Reusable
✅ No name conflicts
✅ Each module has its own scope
```

## How Modules Work

```
┌─────────────────────────────────┐
│      Module A (math.js)          │
│  ┌──────────────────────────┐   │
│  │ function add()           │   │
│  │ function subtract()      │   │
│  │                          │   │
│  │ module.exports = {       │   │
│  │   add, subtract          │   │
│  │ }                        │   │
│  └──────────────────────────┘   │
└─────────────────────────────────┘
               │
               │ require('./math')
               │
┌──────────────▼────────────────────┐
│      Module B (app.js)            │
│  ┌──────────────────────────┐   │
│  │ const math = require(     │   │
│  │   './math'               │   │
│  │ )                        │   │
│  │                          │   │
│  │ math.add(5, 3)           │   │
│  └──────────────────────────┘   │
└─────────────────────────────────┘
```

## Benefits of Modules

**1. Code Organization**
```
Without Modules: 1 file, 1000 lines
With Modules: 10 files, 100 lines each

Much easier to navigate!
```

**2. Reusability**
```
utils.js (shared utilities)
├── Used by app.js
├── Used by routes.js
└── Used by auth.js

Write once, use everywhere!
```

**3. Scope Isolation**
```
math.js:
  const PI = 3.14  // Only in math.js

app.js:
  const PI = 3.14159  // Different variable!

No conflicts!
```

**4. Easier Testing**
```
Test each module independently
math.js → test math.js
auth.js → test auth.js
```

## Why Modules?

## Exporting from a Module

**Single export:**
```javascript
// greet.js
function greet(name) {
  return `Hello, ${name}!`;
}

module.exports = greet;
```

**Multiple exports:**
```javascript
// math.js
function add(a, b) {
  return a + b;
}

function subtract(a, b) {
  return a - b;
}

module.exports = { add, subtract };
// or
module.exports.add = add;
module.exports.subtract = subtract;
```

## Importing with require

```javascript
// app.js
const greet = require('./greet');
const { add, subtract } = require('./math');

console.log(greet('Alice'));      // Hello, Alice!
console.log(add(5, 3));           // 8
console.log(subtract(10, 4));     // 6
```

## The ./ Matters!

```javascript
// Your files - need ./
const myModule = require('./myModule');

// npm packages - no ./
const express = require('express');

// Built-in modules - no ./
const fs = require('fs');
```

## exports vs module.exports

```javascript
// These are equivalent
exports.add = add;
module.exports.add = add;

// BUT this breaks exports
exports = { add };         // ❌ Won't work
module.exports = { add };  // ✅ Works
```

**Rule:** When exporting a single thing or replacing the whole export, use `module.exports`.

## Exporting a Class

```javascript
// User.js
class User {
  constructor(name) {
    this.name = name;
  }
  
  sayHi() {
    return `Hi, I'm ${this.name}`;
  }
}

module.exports = User;
```

```javascript
// app.js
const User = require('./User');
const alice = new User('Alice');
console.log(alice.sayHi());
```

## Module Caching

Modules are cached after first require:
```javascript
const config1 = require('./config');
const config2 = require('./config');

// config1 === config2 (same object)
```

## Organizing Modules

```
project/
├── index.js
├── utils/
│   ├── index.js
│   ├── format.js
│   └── validate.js
└── models/
    ├── index.js
    └── User.js
```

```javascript
// utils/index.js - re-export everything
module.exports = {
  ...require('./format'),
  ...require('./validate')
};

// app.js
const utils = require('./utils');
```

## Key Takeaway

CommonJS modules use `require` to import and `module.exports` to export. Use `./` for local files, no prefix for packages. This system keeps your code organized and reusable.

Master Node.js modules. Understand CommonJS, why modules exist, how require works, and code organization.

Node.js Modules: require and module.exports

# ES Modules in Node.js

ES Modules (ESM) is the modern JavaScript module system. Node.js supports it fully.

## Enabling ES Modules

**Option 1:** Use .mjs extension
```javascript
// math.mjs
export function add(a, b) {
  return a + b;
}
```

**Option 2:** Add "type": "module" to package.json
```json
{
  "name": "my-app",
  "type": "module"
}
```

Now .js files use ESM:
```javascript
// math.js (with "type": "module")
export function add(a, b) {
  return a + b;
}
```

## Named Exports

```javascript
// utils.js
export function formatDate(date) {
  return date.toISOString();
}

export function capitalize(str) {
  return str.charAt(0).toUpperCase() + str.slice(1);
}

export const VERSION = '1.0.0';
```

```javascript
// app.js
import { formatDate, capitalize, VERSION } from './utils.js';

console.log(capitalize('hello'));    // Hello
console.log(VERSION);                // 1.0.0
```

## Default Export

```javascript
// User.js
export default class User {
  constructor(name) {
    this.name = name;
  }
}
```

```javascript
// app.js
import User from './User.js';  // No curly braces

const user = new User('Alice');
```

## Mixed Exports

```javascript
// api.js
export default function fetchData() { /* ... */ }
export const BASE_URL = 'https://api.example.com';
export function formatResponse(data) { /* ... */ }
```

```javascript
// app.js
import fetchData, { BASE_URL, formatResponse } from './api.js';
```

## Import Everything

```javascript
import * as utils from './utils.js';

utils.formatDate(new Date());
utils.capitalize('hello');
console.log(utils.VERSION);
```

## CommonJS vs ES Modules

| Feature | CommonJS | ES Modules |
|---------|----------|------------|
| Syntax | require/module.exports | import/export |
| Loading | Synchronous | Asynchronous |
| File extension | .js | .mjs or "type": "module" |
| Top-level await | ❌ | ✅ |

## Importing CommonJS in ESM

```javascript
// ESM file importing CommonJS
import express from 'express';  // Works!

// Named imports might not work
import { Router } from 'express';  // May fail
const { Router } = express;        // Use this instead
```

## File Extensions Required

ESM requires full file paths:
```javascript
// ❌ Won't work in ESM
import { add } from './math';

// ✅ Works
import { add } from './math.js';
```

## Key Takeaway

ES Modules is the modern standard. Use `export` to share code, `import` to use it. Enable with `"type": "module"` in package.json or .mjs files. Remember to include .js extensions in imports!

Learn modern ES modules syntax with import and export in Node.js. Understand the difference from CommonJS.

ES Modules in Node.js (import/export)

# File System (fs) Module

## What is the fs Module?

The `fs` (file system) module lets Node.js interact with files and directories on your computer.

## Why Do We Need It?

**Browser JavaScript can't:**
```
Browser JavaScript:
❌ Read files from disk
❌ Write files to disk
❌ Access file system
❌ Create directories

Why? Security reasons - browsers can't access your computer's files
```

**Node.js can:**
```
Node.js (Server-side):
✅ Read files from disk
✅ Write files to disk
✅ Access file system
✅ Create directories

Why? Runs on your server, not in browser
```

## File Operations Flow

```
┌─────────────────────────────────┐
│      Your Node.js App            │
└──────────────┬────────────────────┘
               │
               │ fs.readFile()
               │ fs.writeFile()
               │ fs.mkdir()
               │
┌──────────────▼────────────────────┐
│         fs Module                  │
└──────────────┬────────────────────┘
               │
┌──────────────▼────────────────────┐
│      Operating System              │
│      (File System)                  │
└─────────────────────────────────────┘
```

## Sync vs Async: The Critical Difference

### Synchronous (Blocking)

```javascript
const fs = require('fs');

const data = fs.readFileSync('file.txt', 'utf8');
console.log(data);
console.log('This runs AFTER file is read');
```

**How it works:**
```
Time →
1. Start reading file
2. WAIT (blocked)...
3. WAIT (blocked)...
4. File read complete
5. Continue to next line

Problem: App is frozen while reading!
```

### Asynchronous (Non-Blocking)

```javascript
const fs = require('fs');

fs.readFile('file.txt', 'utf8', (err, data) => {
  console.log(data);
});
console.log('This runs IMMEDIATELY');
```

**How it works:**
```
Time →
1. Start reading file (don't wait)
2. Continue to next line immediately
3. "This runs IMMEDIATELY" prints
4. File read completes in background
5. Callback executes with data

Benefit: App continues working!
```

## When to Use Sync vs Async

**Use Sync When:**
- Startup scripts (read config once)
- CLI tools
- Simple scripts
- When you MUST wait for file operation

**Use Async When:**
- Web servers (handle multiple requests)
- Production applications
- Any time you need non-blocking behavior

## Import the Module

```javascript
const fs = require('fs');
// or for promises
const fs = require('fs').promises;
```

## Reading Files

**Synchronous (blocks execution):**
```javascript
const content = fs.readFileSync('file.txt', 'utf8');
console.log(content);
```

**Asynchronous with callback:**
```javascript
fs.readFile('file.txt', 'utf8', (err, data) => {
  if (err) throw err;
  console.log(data);
});
```

**Async/await (recommended):**
```javascript
const fs = require('fs').promises;

async function readFile() {
  const content = await fs.readFile('file.txt', 'utf8');
  console.log(content);
}
```

## Writing Files

```javascript
const fs = require('fs').promises;

// Write (overwrites existing)
await fs.writeFile('output.txt', 'Hello World!');

// Append to file
await fs.appendFile('log.txt', 'New log entry\n');
```

## Check if File Exists

```javascript
const fs = require('fs');

if (fs.existsSync('file.txt')) {
  console.log('File exists!');
}

// Or with promises
try {
  await fs.access('file.txt');
  console.log('File exists!');
} catch {
  console.log('File does not exist');
}
```

## Delete Files

```javascript
// Delete file
await fs.unlink('file.txt');

// Delete directory (must be empty)
await fs.rmdir('folder');

// Delete directory with contents
await fs.rm('folder', { recursive: true });
```

## Create Directories

```javascript
// Create single directory
await fs.mkdir('new-folder');

// Create nested directories
await fs.mkdir('path/to/nested', { recursive: true });
```

## List Directory Contents

```javascript
const files = await fs.readdir('.');
console.log(files);  // ['file1.txt', 'file2.txt', 'folder']

// With file types
const entries = await fs.readdir('.', { withFileTypes: true });
entries.forEach(entry => {
  console.log(`${entry.name} - ${entry.isDirectory() ? 'Dir' : 'File'}`);
});
```

## Get File Info

```javascript
const stats = await fs.stat('file.txt');
console.log({
  size: stats.size,           // bytes
  isFile: stats.isFile(),
  isDirectory: stats.isDirectory(),
  created: stats.birthtime,
  modified: stats.mtime
});
```

## Copy and Rename

```javascript
// Copy file
await fs.copyFile('source.txt', 'dest.txt');

// Rename/move file
await fs.rename('old.txt', 'new.txt');
```

## Practical Example: Log Manager

```javascript
const fs = require('fs').promises;
const path = require('path');

async function log(message) {
  const timestamp = new Date().toISOString();
  const line = `[${timestamp}] ${message}\n`;
  await fs.appendFile('app.log', line);
}

async function readLogs() {
  try {
    return await fs.readFile('app.log', 'utf8');
  } catch {
    return 'No logs yet';
  }
}

// Usage
await log('App started');
await log('User logged in');
console.log(await readLogs());
```

## Key Takeaway

Use `fs.promises` with async/await for clean file operations. Remember: `readFile` for reading, `writeFile` for writing, `unlink` for deleting, `mkdir` for directories. Always handle errors!

Master file operations in Node.js. Understand sync vs async, file operations, and when to use each method.

File System (fs) Module Basics

# Path Module Essentials

The path module handles file paths. Essential for cross-platform code.

## Why Use path?

```javascript
// ❌ Hardcoded - breaks on Windows
const file = '/users/data/' + 'file.txt';

// ✅ Cross-platform
const file = path.join('/users/data', 'file.txt');
```

## Import

```javascript
const path = require('path');
```

## path.join() - Combine Paths

```javascript
path.join('folder', 'subfolder', 'file.txt');
// → 'folder/subfolder/file.txt' (Unix)
// → 'folder\\subfolder\\file.txt' (Windows)

path.join(__dirname, 'data', 'config.json');
// → '/app/project/data/config.json'
```

## path.resolve() - Absolute Path

```javascript
path.resolve('file.txt');
// → '/current/working/directory/file.txt'

path.resolve('/foo', 'bar', 'baz');
// → '/foo/bar/baz'

path.resolve('foo', '/bar', 'baz');
// → '/bar/baz' (starts fresh from /bar)
```

## path.basename() - File Name

```javascript
path.basename('/path/to/file.txt');
// → 'file.txt'

path.basename('/path/to/file.txt', '.txt');
// → 'file' (without extension)
```

## path.dirname() - Directory

```javascript
path.dirname('/path/to/file.txt');
// → '/path/to'
```

## path.extname() - Extension

```javascript
path.extname('file.txt');      // → '.txt'
path.extname('file.tar.gz');   // → '.gz'
path.extname('file');          // → ''
```

## path.parse() - Break Down Path

```javascript
path.parse('/home/user/file.txt');
// {
//   root: '/',
//   dir: '/home/user',
//   base: 'file.txt',
//   ext: '.txt',
//   name: 'file'
// }
```

## path.format() - Build Path

```javascript
path.format({
  dir: '/home/user',
  name: 'file',
  ext: '.txt'
});
// → '/home/user/file.txt'
```

## __dirname and __filename

```javascript
// Current file's directory
console.log(__dirname);   // '/app/project/src'

// Current file's full path
console.log(__filename);  // '/app/project/src/app.js'

// Common pattern
const dataPath = path.join(__dirname, '..', 'data', 'config.json');
```

## Practical Example

```javascript
const path = require('path');
const fs = require('fs').promises;

async function processFiles(directory) {
  const files = await fs.readdir(directory);
  
  for (const file of files) {
    const fullPath = path.join(directory, file);
    const ext = path.extname(file);
    
    if (ext === '.txt') {
      console.log(`Processing: ${path.basename(file)}`);
      // Process file...
    }
  }
}

processFiles(path.join(__dirname, 'data'));
```

## Key Takeaway

Always use `path.join()` to combine paths - never concatenate strings. Use `__dirname` for paths relative to your file. The path module ensures your code works on any operating system.

Learn to work with file paths correctly in Node.js using the path module. Cross-platform path handling.

Path Module Essentials

# Working with JSON in Node.js

JSON is the standard data format. Node.js makes it easy.

## Parse JSON String

```javascript
const jsonString = '{"name": "Alice", "age": 25}';
const obj = JSON.parse(jsonString);

console.log(obj.name);  // Alice
console.log(obj.age);   // 25
```

## Convert to JSON String

```javascript
const obj = { name: 'Alice', age: 25 };
const jsonString = JSON.stringify(obj);

console.log(jsonString);  // {"name":"Alice","age":25}

// Pretty print
const pretty = JSON.stringify(obj, null, 2);
console.log(pretty);
// {
//   "name": "Alice",
//   "age": 25
// }
```

## Read JSON File

```javascript
const fs = require('fs').promises;

async function readJSON(filepath) {
  const data = await fs.readFile(filepath, 'utf8');
  return JSON.parse(data);
}

const config = await readJSON('config.json');
console.log(config);
```

**Simpler with require (for static files):**
```javascript
const config = require('./config.json');
// Works but caches the file
```

## Write JSON File

```javascript
const fs = require('fs').promises;

async function writeJSON(filepath, data) {
  const json = JSON.stringify(data, null, 2);
  await fs.writeFile(filepath, json);
}

const users = [
  { id: 1, name: 'Alice' },
  { id: 2, name: 'Bob' }
];

await writeJSON('users.json', users);
```

## Update JSON File

```javascript
async function updateJSON(filepath, updateFn) {
  const data = await readJSON(filepath);
  const updated = updateFn(data);
  await writeJSON(filepath, updated);
}

// Add a user
await updateJSON('users.json', users => {
  users.push({ id: 3, name: 'Charlie' });
  return users;
});
```

## Handle Errors

```javascript
function safeJsonParse(str) {
  try {
    return JSON.parse(str);
  } catch (err) {
    console.error('Invalid JSON:', err.message);
    return null;
  }
}

const data = safeJsonParse('invalid json');  // null
const valid = safeJsonParse('{"ok": true}'); // {ok: true}
```

## Working with API Responses

```javascript
const https = require('https');

function fetchJSON(url) {
  return new Promise((resolve, reject) => {
    https.get(url, (res) => {
      let data = '';
      res.on('data', chunk => data += chunk);
      res.on('end', () => resolve(JSON.parse(data)));
    }).on('error', reject);
  });
}

const user = await fetchJSON('https://api.github.com/users/octocat');
console.log(user.name);
```

## JSON with Dates

```javascript
const obj = {
  name: 'Event',
  date: new Date()
};

const json = JSON.stringify(obj);
// {"name":"Event","date":"2024-01-15T10:30:00.000Z"}

// Parse with date conversion
const parsed = JSON.parse(json, (key, value) => {
  if (key === 'date') return new Date(value);
  return value;
});
```

## Practical: Simple JSON Database

```javascript
class JsonDB {
  constructor(filepath) {
    this.filepath = filepath;
  }
  
  async read() {
    try {
      const data = await fs.readFile(this.filepath, 'utf8');
      return JSON.parse(data);
    } catch {
      return [];
    }
  }
  
  async write(data) {
    await fs.writeFile(this.filepath, JSON.stringify(data, null, 2));
  }
  
  async add(item) {
    const data = await this.read();
    data.push(item);
    await this.write(data);
  }
}

const db = new JsonDB('data.json');
await db.add({ id: 1, name: 'Item 1' });
```

## Key Takeaway

Use `JSON.parse()` to read JSON strings, `JSON.stringify()` to create them. For files, combine with `fs` module. Always handle parse errors and use pretty printing for readable files.

Learn to read, write, and manipulate JSON data in Node.js. Parse JSON files and handle API responses.

Working with JSON in Node.js

# Environment Variables in Node.js

Environment variables store configuration outside your code. Essential for secrets.

## Why Environment Variables?

```javascript
// ❌ Never do this
const apiKey = 'sk-secret-key-12345';

// ✅ Use environment variables
const apiKey = process.env.API_KEY;
```

## Accessing Environment Variables

```javascript
// Access any env variable
console.log(process.env.PATH);
console.log(process.env.HOME);
console.log(process.env.NODE_ENV);  // 'development' or 'production'
```

## Setting Variables (Command Line)

```bash
# Single command
PORT=3000 node app.js

# Multiple variables
PORT=3000 NODE_ENV=production node app.js

# Windows (PowerShell)
$env:PORT=3000; node app.js
```

## Using dotenv Package

Install:
```bash
npm install dotenv
```

Create `.env` file:
```
# .env
PORT=3000
DATABASE_URL=mongodb://localhost/mydb
API_KEY=your-secret-key
DEBUG=true
```

Load in your app:
```javascript
// app.js - Load at the very top!
require('dotenv').config();

console.log(process.env.PORT);        // 3000
console.log(process.env.API_KEY);     // your-secret-key
```

## .env File Best Practices

```
# Use comments for documentation
# Database Configuration
DATABASE_URL=mongodb://localhost/mydb
DATABASE_NAME=myapp

# API Keys
STRIPE_KEY=sk_test_...
SENDGRID_KEY=SG....

# Feature Flags
ENABLE_CACHE=true
DEBUG_MODE=false
```

## Don't Commit .env!

Add to .gitignore:
```
# .gitignore
.env
.env.local
.env.*.local
```

Create .env.example for documentation:
```
# .env.example (commit this)
PORT=3000
DATABASE_URL=your_database_url_here
API_KEY=your_api_key_here
```

## Different Environments

```javascript
// Load different files based on environment
const envFile = process.env.NODE_ENV === 'production' 
  ? '.env.production' 
  : '.env';

require('dotenv').config({ path: envFile });
```

## Type Conversion

Environment variables are always strings:
```javascript
// .env: PORT=3000

const port = process.env.PORT;       // "3000" (string!)
const port = parseInt(process.env.PORT, 10);  // 3000 (number)

// Booleans
const debug = process.env.DEBUG === 'true';  // boolean
```

## Required Variables Check

```javascript
const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];

for (const key of required) {
  if (!process.env[key]) {
    console.error(`Missing required env variable: ${key}`);
    process.exit(1);
  }
}
```

## Config Module Pattern

```javascript
// config.js
require('dotenv').config();

module.exports = {
  port: parseInt(process.env.PORT, 10) || 3000,
  db: {
    url: process.env.DATABASE_URL,
    name: process.env.DATABASE_NAME || 'myapp'
  },
  jwt: {
    secret: process.env.JWT_SECRET,
    expiresIn: '7d'
  },
  isDev: process.env.NODE_ENV !== 'production'
};
```

```javascript
// app.js
const config = require('./config');

app.listen(config.port);
```

## Key Takeaway

Use environment variables for all secrets and configuration. Install `dotenv`, create `.env` file, add it to `.gitignore`, and load with `require('dotenv').config()` at the top of your entry file. Create a config module for clean access.

Learn to manage configuration with environment variables. Use dotenv for secure secrets management.

Environment Variables in Node.js (dotenv)

# HTTP Module: Creating a Basic Server

Before Express, there's the http module. Understanding it helps you grasp how servers work.

## Basic Server

```javascript
const http = require('http');

const server = http.createServer((req, res) => {
  res.statusCode = 200;
  res.setHeader('Content-Type', 'text/plain');
  res.end('Hello World!');
});

server.listen(3000, () => {
  console.log('Server running at http://localhost:3000');
});
```

## Request Object (req)

```javascript
const server = http.createServer((req, res) => {
  console.log(req.method);      // GET, POST, etc.
  console.log(req.url);         // /path?query=value
  console.log(req.headers);     // { host: 'localhost', ... }
  
  res.end('Request received');
});
```

## Response Object (res)

```javascript
const server = http.createServer((req, res) => {
  // Set status code
  res.statusCode = 200;
  
  // Set headers
  res.setHeader('Content-Type', 'application/json');
  res.setHeader('X-Custom-Header', 'MyValue');
  
  // Or all at once
  res.writeHead(200, {
    'Content-Type': 'application/json',
    'X-Custom-Header': 'MyValue'
  });
  
  // Send response
  res.end(JSON.stringify({ message: 'Hello' }));
});
```

## Simple Router

```javascript
const http = require('http');

const server = http.createServer((req, res) => {
  const { method, url } = req;
  
  if (method === 'GET' && url === '/') {
    res.writeHead(200, { 'Content-Type': 'text/html' });
    res.end('<h1>Home Page</h1>');
  } 
  else if (method === 'GET' && url === '/api/users') {
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify([{ id: 1, name: 'Alice' }]));
  }
  else if (method === 'GET' && url === '/about') {
    res.writeHead(200, { 'Content-Type': 'text/html' });
    res.end('<h1>About Page</h1>');
  }
  else {
    res.writeHead(404, { 'Content-Type': 'text/plain' });
    res.end('Not Found');
  }
});

server.listen(3000);
```

## Handling POST Data

```javascript
const server = http.createServer((req, res) => {
  if (req.method === 'POST' && req.url === '/api/users') {
    let body = '';
    
    req.on('data', chunk => {
      body += chunk.toString();
    });
    
    req.on('end', () => {
      const user = JSON.parse(body);
      console.log('Received:', user);
      
      res.writeHead(201, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ success: true, user }));
    });
  }
});
```

## Serving Static Files

```javascript
const http = require('http');
const fs = require('fs');
const path = require('path');

const server = http.createServer((req, res) => {
  let filePath = path.join(__dirname, 'public', req.url === '/' ? 'index.html' : req.url);
  const ext = path.extname(filePath);
  
  const contentTypes = {
    '.html': 'text/html',
    '.css': 'text/css',
    '.js': 'text/javascript',
    '.json': 'application/json'
  };
  
  fs.readFile(filePath, (err, content) => {
    if (err) {
      res.writeHead(404);
      res.end('File not found');
    } else {
      res.writeHead(200, { 'Content-Type': contentTypes[ext] || 'text/plain' });
      res.end(content);
    }
  });
});
```

## Key Takeaway

The http module is Node.js's built-in way to create servers. It's low-level but teaches you the fundamentals. Express and other frameworks build on top of this. Know http basics, then use frameworks for real projects.

Learn to create HTTP servers in Node.js without frameworks. Understand the foundation of web servers.

HTTP Module: Creating a Basic Server

# Understanding Callbacks in Node.js

Callbacks are functions passed as arguments. Node.js uses them everywhere.

## What's a Callback?

```javascript
function greet(name, callback) {
  const message = `Hello, ${name}!`;
  callback(message);
}

greet('Alice', (msg) => {
  console.log(msg);  // Hello, Alice!
});
```

## Why Callbacks?

Node.js is non-blocking. Instead of waiting:
```javascript
// Blocking (bad in Node.js)
const data = readFileSync('file.txt');  // Waits here
console.log(data);

// Non-blocking (good)
readFile('file.txt', (err, data) => {
  console.log(data);  // Runs when file is read
});
console.log('This runs immediately!');
```

## Error-First Callbacks

Node.js convention: first argument is always error.

```javascript
const fs = require('fs');

fs.readFile('file.txt', 'utf8', (err, data) => {
  if (err) {
    console.error('Error:', err.message);
    return;
  }
  console.log('Data:', data);
});
```

## Creating Error-First Callbacks

```javascript
function divide(a, b, callback) {
  if (b === 0) {
    callback(new Error('Cannot divide by zero'));
    return;
  }
  callback(null, a / b);
}

divide(10, 2, (err, result) => {
  if (err) {
    console.error(err.message);
    return;
  }
  console.log('Result:', result);  // 5
});
```

## Callback Hell (The Problem)

```javascript
// Nested callbacks = hard to read
fs.readFile('file1.txt', (err, data1) => {
  if (err) return handleError(err);
  
  fs.readFile('file2.txt', (err, data2) => {
    if (err) return handleError(err);
    
    fs.readFile('file3.txt', (err, data3) => {
      if (err) return handleError(err);
      
      // Finally do something with data1, data2, data3
      console.log(data1, data2, data3);
    });
  });
});
```

## Avoiding Callback Hell

**1. Named functions:**
```javascript
function handleFile1(err, data1) {
  if (err) return handleError(err);
  fs.readFile('file2.txt', handleFile2);
}

function handleFile2(err, data2) {
  if (err) return handleError(err);
  console.log('Done!');
}

fs.readFile('file1.txt', handleFile1);
```

**2. Use Promises (better):**
```javascript
const fs = require('fs').promises;

async function readFiles() {
  const data1 = await fs.readFile('file1.txt');
  const data2 = await fs.readFile('file2.txt');
  const data3 = await fs.readFile('file3.txt');
  return [data1, data2, data3];
}
```

## Convert Callback to Promise

```javascript
const { promisify } = require('util');

// Old callback style
const readFile = promisify(fs.readFile);

// Now use with async/await
const data = await readFile('file.txt', 'utf8');
```

## Key Takeaway

Callbacks are foundational in Node.js. Always handle errors first. Avoid deep nesting with named functions or better yet, use Promises and async/await for cleaner code.

Master callback patterns in Node.js. Understand error-first callbacks and avoid callback hell.

Understanding Callbacks in Node.js

# Promises in Node.js

Promises are a cleaner way to handle async operations than callbacks.

## Promise States

```
Pending → Fulfilled (resolved)
       → Rejected (error)
```

## Creating a Promise

```javascript
const myPromise = new Promise((resolve, reject) => {
  const success = true;
  
  if (success) {
    resolve('It worked!');
  } else {
    reject(new Error('It failed!'));
  }
});
```

## Using Promises

```javascript
myPromise
  .then(result => {
    console.log(result);  // 'It worked!'
  })
  .catch(error => {
    console.error(error.message);
  });
```

## Chaining Promises

```javascript
function step1() {
  return new Promise(resolve => {
    setTimeout(() => resolve('Step 1 done'), 100);
  });
}

function step2(prev) {
  return new Promise(resolve => {
    setTimeout(() => resolve(prev + ' → Step 2 done'), 100);
  });
}

function step3(prev) {
  return new Promise(resolve => {
    setTimeout(() => resolve(prev + ' → Step 3 done'), 100);
  });
}

step1()
  .then(step2)
  .then(step3)
  .then(result => console.log(result));
// Step 1 done → Step 2 done → Step 3 done
```

## Promise.all - Run in Parallel

```javascript
const promise1 = fetch('/api/users');
const promise2 = fetch('/api/posts');
const promise3 = fetch('/api/comments');

Promise.all([promise1, promise2, promise3])
  .then(([users, posts, comments]) => {
    console.log('All done!', users, posts, comments);
  })
  .catch(error => {
    // If ANY promise fails, catch runs
    console.error('One failed:', error);
  });
```

## Promise.allSettled - Get All Results

```javascript
Promise.allSettled([promise1, promise2, promise3])
  .then(results => {
    results.forEach(result => {
      if (result.status === 'fulfilled') {
        console.log('Success:', result.value);
      } else {
        console.log('Failed:', result.reason);
      }
    });
  });
```

## Promise.race - First One Wins

```javascript
Promise.race([promise1, promise2, promise3])
  .then(winner => {
    console.log('First to finish:', winner);
  });
```

## Converting Callbacks to Promises

```javascript
const fs = require('fs');

function readFilePromise(path) {
  return new Promise((resolve, reject) => {
    fs.readFile(path, 'utf8', (err, data) => {
      if (err) reject(err);
      else resolve(data);
    });
  });
}

// Or use util.promisify
const { promisify } = require('util');
const readFile = promisify(fs.readFile);
```

## fs.promises (Built-in)

```javascript
const fs = require('fs').promises;

fs.readFile('file.txt', 'utf8')
  .then(data => console.log(data))
  .catch(err => console.error(err));
```

## Error Handling

```javascript
// Always add .catch() at the end
fetchData()
  .then(process)
  .then(save)
  .catch(error => {
    // Catches errors from any step
    console.error('Error:', error.message);
  })
  .finally(() => {
    // Always runs
    console.log('Cleanup done');
  });
```

## Key Takeaway

Promises make async code readable. Chain with `.then()`, catch errors with `.catch()`, run parallel with `Promise.all()`. Most Node.js APIs now have promise versions. Use them!

Learn Promises for cleaner async code. Chain operations and handle errors elegantly.

Promises in Node.js

# Async/Await: Clean Async Code

Async/await makes Promises look like synchronous code. It's the modern standard.

## Basic Syntax

```javascript
// Regular Promise
fetchUser()
  .then(user => console.log(user));

// Async/await
async function getUser() {
  const user = await fetchUser();
  console.log(user);
}
```

## async Function

```javascript
// Always returns a Promise
async function greet() {
  return 'Hello';
}

greet().then(msg => console.log(msg));  // Hello
```

## await Keyword

```javascript
async function loadData() {
  // Pauses here until Promise resolves
  const data = await fetchData();
  
  // Then continues
  console.log(data);
  return data;
}
```

## Error Handling with try/catch

```javascript
async function fetchUser(id) {
  try {
    const response = await fetch(`/api/users/${id}`);
    
    if (!response.ok) {
      throw new Error('User not found');
    }
    
    const user = await response.json();
    return user;
  } catch (error) {
    console.error('Error:', error.message);
    throw error;  // Re-throw if needed
  }
}
```

## Sequential vs Parallel

```javascript
// Sequential - slower
async function sequential() {
  const user = await fetchUser();    // Wait 1s
  const posts = await fetchPosts();  // Wait 1s
  // Total: 2s
}

// Parallel - faster
async function parallel() {
  const [user, posts] = await Promise.all([
    fetchUser(),    // Start immediately
    fetchPosts()    // Start immediately
  ]);
  // Total: 1s (max of both)
}
```

## Async in Loops

```javascript
// Sequential (one at a time)
async function processSequential(ids) {
  for (const id of ids) {
    const data = await fetchData(id);
    console.log(data);
  }
}

// Parallel (all at once)
async function processParallel(ids) {
  const promises = ids.map(id => fetchData(id));
  const results = await Promise.all(promises);
  return results;
}
```

## Real-World Example

```javascript
const fs = require('fs').promises;

async function processFile(inputPath, outputPath) {
  try {
    // Read file
    const content = await fs.readFile(inputPath, 'utf8');
    
    // Process
    const processed = content.toUpperCase();
    
    // Write result
    await fs.writeFile(outputPath, processed);
    
    console.log('Done!');
  } catch (error) {
    console.error('Failed:', error.message);
  }
}
```

## Top-Level Await (ES Modules)

```javascript
// In .mjs files or "type": "module"
const config = await fs.readFile('config.json', 'utf8');
console.log(config);
```

## Arrow Functions with Async

```javascript
const fetchData = async () => {
  const response = await fetch('/api/data');
  return response.json();
};

// In array methods
const results = await Promise.all(
  items.map(async (item) => {
    return await processItem(item);
  })
);
```

## Common Patterns

```javascript
// Retry logic
async function fetchWithRetry(url, retries = 3) {
  for (let i = 0; i < retries; i++) {
    try {
      return await fetch(url);
    } catch (error) {
      if (i === retries - 1) throw error;
      await delay(1000);  // Wait before retry
    }
  }
}

// Timeout
async function fetchWithTimeout(url, timeout = 5000) {
  const controller = new AbortController();
  const id = setTimeout(() => controller.abort(), timeout);
  
  try {
    const response = await fetch(url, { signal: controller.signal });
    clearTimeout(id);
    return response;
  } catch (error) {
    clearTimeout(id);
    throw error;
  }
}
```

## Key Takeaway

Async/await is syntactic sugar over Promises. Use `async` to mark functions, `await` to pause for Promises, try/catch for errors. For parallel operations, use `Promise.all()`. It's the cleanest way to write async Node.js code.

Master async/await for writing synchronous-looking asynchronous code. The modern way to handle async operations.

Async/Await: Clean Async Code

# Express.js Getting Started

## What is Express?

Express is a **minimal and flexible** web framework for Node.js. It makes building web servers much easier.

## The Problem: Building Servers with Node.js

Without Express, you need to handle everything manually:

```javascript
const http = require('http');

const server = http.createServer((req, res) => {
  if (req.url === '/users' && req.method === 'GET') {
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify([{ id: 1, name: 'John' }]));
  } else if (req.url === '/users' && req.method === 'POST') {
    let body = '';
    req.on('data', chunk => body += chunk);
    req.on('end', () => {
      const user = JSON.parse(body);
      res.writeHead(201);
      res.end(JSON.stringify(user));
    });
  } else {
    res.writeHead(404);
    res.end('Not Found');
  }
});

server.listen(3000);
```

**Problems:**
- Manual URL parsing
- Manual method checking
- Manual body parsing
- Manual headers
- Lots of boilerplate code

## The Solution: Express

Express simplifies everything:

```javascript
const express = require('express');
const app = express();

app.get('/users', (req, res) => {
  res.json([{ id: 1, name: 'John' }]);
});

app.post('/users', (req, res) => {
  res.status(201).json(req.body);
});

app.listen(3000);
```

**Benefits:**
- Automatic routing
- Automatic body parsing
- Clean syntax
- Middleware support
- Less code, more features

## Express Architecture

```
┌─────────────────────────────────┐
│         HTTP Request             │
└──────────────┬────────────────────┘
               │
┌──────────────▼────────────────────┐
│         Express App               │
│  ┌────────────────────────────┐  │
│  │   Middleware Stack         │  │
│  │   - Body parser            │  │
│  │   - CORS                   │  │
│  │   - Authentication         │  │
│  │   - Logging                │  │
│  └────────────────────────────┘  │
│  ┌────────────────────────────┐  │
│  │   Router                    │  │
│  │   - GET /users              │  │
│  │   - POST /users             │  │
│  │   - PUT /users/:id          │  │
│  └────────────────────────────┘  │
└──────────────┬────────────────────┘
               │
┌──────────────▼────────────────────┐
│         HTTP Response              │
└─────────────────────────────────────┘
```

## Why Use Express?

**1. Simplifies Routing**
```
Without Express: Manual URL parsing, if/else chains
With Express: Clean route definitions
```

**2. Middleware Support**
```
Request → Middleware 1 → Middleware 2 → Route Handler → Response
```

**3. Large Ecosystem**
- Thousands of middleware packages
- Well-documented
- Community support

**4. Industry Standard**
- Used by Netflix, Uber, PayPal
- Most Node.js jobs require Express
- Best practices established

## Installation

```bash
npm init -y
npm install express
```

## Hello World

```javascript
const express = require('express');
const app = express();

app.get('/', (req, res) => {
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});
```

## Basic Routing

```javascript
// GET request
app.get('/users', (req, res) => {
  res.json([{ id: 1, name: 'Alice' }]);
});

// POST request
app.post('/users', (req, res) => {
  res.status(201).json({ message: 'User created' });
});

// PUT request
app.put('/users/:id', (req, res) => {
  res.json({ message: `Updated user ${req.params.id}` });
});

// DELETE request
app.delete('/users/:id', (req, res) => {
  res.json({ message: `Deleted user ${req.params.id}` });
});
```

## Route Parameters

```javascript
// /users/123
app.get('/users/:id', (req, res) => {
  const userId = req.params.id;  // '123'
  res.json({ id: userId });
});

// /posts/2024/01
app.get('/posts/:year/:month', (req, res) => {
  const { year, month } = req.params;
  res.json({ year, month });
});
```

## Query Parameters

```javascript
// /search?q=nodejs&limit=10
app.get('/search', (req, res) => {
  const query = req.query.q;      // 'nodejs'
  const limit = req.query.limit;  // '10'
  res.json({ query, limit });
});
```

## Request Body (JSON)

```javascript
// Enable JSON parsing
app.use(express.json());

app.post('/users', (req, res) => {
  const { name, email } = req.body;
  console.log('Received:', name, email);
  res.status(201).json({ name, email });
});
```

## Response Methods

```javascript
app.get('/demo', (req, res) => {
  // Send text
  res.send('Hello');
  
  // Send JSON
  res.json({ message: 'Hello' });
  
  // Set status + send
  res.status(404).json({ error: 'Not found' });
  
  // Send file
  res.sendFile('/path/to/file.pdf');
  
  // Redirect
  res.redirect('/new-url');
});
```

## Basic Error Handling

```javascript
app.get('/users/:id', (req, res) => {
  const user = findUser(req.params.id);
  
  if (!user) {
    return res.status(404).json({ error: 'User not found' });
  }
  
  res.json(user);
});
```

## Complete Example

```javascript
const express = require('express');
const app = express();

// Middleware
app.use(express.json());

// In-memory "database"
let users = [
  { id: 1, name: 'Alice' },
  { id: 2, name: 'Bob' }
];

// Get all users
app.get('/api/users', (req, res) => {
  res.json(users);
});

// Get one user
app.get('/api/users/:id', (req, res) => {
  const user = users.find(u => u.id === parseInt(req.params.id));
  if (!user) return res.status(404).json({ error: 'Not found' });
  res.json(user);
});

// Create user
app.post('/api/users', (req, res) => {
  const user = {
    id: users.length + 1,
    name: req.body.name
  };
  users.push(user);
  res.status(201).json(user);
});

// Update user
app.put('/api/users/:id', (req, res) => {
  const user = users.find(u => u.id === parseInt(req.params.id));
  if (!user) return res.status(404).json({ error: 'Not found' });
  user.name = req.body.name;
  res.json(user);
});

// Delete user
app.delete('/api/users/:id', (req, res) => {
  users = users.filter(u => u.id !== parseInt(req.params.id));
  res.status(204).send();
});

app.listen(3000, () => console.log('Server running on port 3000'));
```

## Key Takeaway

Express simplifies Node.js web development. Define routes with `app.get()`, `app.post()`, etc. Access params with `req.params`, query with `req.query`, body with `req.body`. Respond with `res.json()` or `res.send()`. That's the foundation!

Master Express.js web framework. Understand what Express is, why use it, architecture, routing, and middleware concepts.

Express.js Getting Started

# Express Middleware Explained

Middleware = functions that run between request and response. They're Express's superpower.

## What is Middleware?

```javascript
function middleware(req, res, next) {
  // Do something with request
  console.log('Request received');
  
  // Pass to next middleware
  next();
}
```

## The Request Flow

```
Request → Middleware 1 → Middleware 2 → Route Handler → Response
```

## Using Middleware

```javascript
const express = require('express');
const app = express();

// Apply to ALL routes
app.use((req, res, next) => {
  console.log(`${req.method} ${req.url}`);
  next();
});

// Apply to specific path
app.use('/api', (req, res, next) => {
  console.log('API request');
  next();
});

// Routes
app.get('/', (req, res) => res.send('Home'));
```

## Built-in Middleware

```javascript
// Parse JSON bodies
app.use(express.json());

// Parse URL-encoded bodies (form data)
app.use(express.urlencoded({ extended: true }));

// Serve static files
app.use(express.static('public'));
```

## Creating Custom Middleware

**Logger:**
```javascript
function logger(req, res, next) {
  const timestamp = new Date().toISOString();
  console.log(`[${timestamp}] ${req.method} ${req.url}`);
  next();
}

app.use(logger);
```

**Request Timer:**
```javascript
function timer(req, res, next) {
  req.startTime = Date.now();
  
  res.on('finish', () => {
    const duration = Date.now() - req.startTime;
    console.log(`Request took ${duration}ms`);
  });
  
  next();
}

app.use(timer);
```

**Auth Check:**
```javascript
function requireAuth(req, res, next) {
  const token = req.headers.authorization;
  
  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }
  
  // Verify token...
  req.user = { id: 1, name: 'Alice' };
  next();
}

// Use on specific routes
app.get('/api/profile', requireAuth, (req, res) => {
  res.json(req.user);
});
```

## Order Matters!

```javascript
// ✅ Correct - body parser before routes
app.use(express.json());
app.post('/data', (req, res) => {
  console.log(req.body);  // Works!
});

// ❌ Wrong - body parser after route
app.post('/data', (req, res) => {
  console.log(req.body);  // undefined!
});
app.use(express.json());
```

## Error Handling Middleware

```javascript
// Regular middleware has 3 params
// Error middleware has 4 (err first)
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: 'Something broke!' });
});

// Trigger error
app.get('/error', (req, res, next) => {
  next(new Error('Oops!'));
});
```

## Third-Party Middleware

```javascript
const cors = require('cors');
const helmet = require('helmet');
const morgan = require('morgan');

app.use(cors());           // Enable CORS
app.use(helmet());         // Security headers
app.use(morgan('dev'));    // Request logging
```

## Middleware Factory

```javascript
function rateLimit(maxRequests, windowMs) {
  const requests = new Map();
  
  return (req, res, next) => {
    const ip = req.ip;
    const now = Date.now();
    
    if (!requests.has(ip)) {
      requests.set(ip, []);
    }
    
    const userRequests = requests.get(ip)
      .filter(time => now - time < windowMs);
    
    if (userRequests.length >= maxRequests) {
      return res.status(429).json({ error: 'Too many requests' });
    }
    
    userRequests.push(now);
    requests.set(ip, userRequests);
    next();
  };
}

// 100 requests per minute
app.use(rateLimit(100, 60000));
```

## Key Takeaway

Middleware processes requests in order. Always call `next()` to continue the chain. Use built-in middleware for JSON/forms, third-party for logging/security, and custom for app-specific logic. Put them before your routes!

Understand Express middleware - functions that process requests. Learn to create and use middleware effectively.

Express Middleware Explained

# Express Router for Modular Routes

As your app grows, routes become messy. Router helps organize them.

## The Problem

```javascript
// All in one file - gets messy fast
app.get('/users', ...);
app.post('/users', ...);
app.get('/users/:id', ...);
app.get('/posts', ...);
app.post('/posts', ...);
app.get('/products', ...);
// 100 more routes...
```

## The Solution: Router

```javascript
// routes/users.js
const express = require('express');
const router = express.Router();

router.get('/', (req, res) => {
  res.json([{ id: 1, name: 'Alice' }]);
});

router.get('/:id', (req, res) => {
  res.json({ id: req.params.id });
});

router.post('/', (req, res) => {
  res.status(201).json(req.body);
});

module.exports = router;
```

```javascript
// app.js
const express = require('express');
const userRoutes = require('./routes/users');

const app = express();
app.use(express.json());

app.use('/api/users', userRoutes);

app.listen(3000);
```

## Project Structure

```
project/
├── app.js
├── routes/
│   ├── index.js
│   ├── users.js
│   ├── posts.js
│   └── products.js
└── package.json
```

## Multiple Route Files

```javascript
// routes/posts.js
const router = require('express').Router();

router.get('/', (req, res) => res.json([]));
router.post('/', (req, res) => res.status(201).json(req.body));

module.exports = router;
```

```javascript
// routes/products.js
const router = require('express').Router();

router.get('/', (req, res) => res.json([]));

module.exports = router;
```

```javascript
// app.js
const userRoutes = require('./routes/users');
const postRoutes = require('./routes/posts');
const productRoutes = require('./routes/products');

app.use('/api/users', userRoutes);
app.use('/api/posts', postRoutes);
app.use('/api/products', productRoutes);
```

## Router Index File

```javascript
// routes/index.js
const express = require('express');
const router = express.Router();

router.use('/users', require('./users'));
router.use('/posts', require('./posts'));
router.use('/products', require('./products'));

module.exports = router;
```

```javascript
// app.js
const routes = require('./routes');
app.use('/api', routes);
```

## Router-Level Middleware

```javascript
// routes/admin.js
const router = require('express').Router();

// Middleware for all admin routes
router.use((req, res, next) => {
  if (!req.user?.isAdmin) {
    return res.status(403).json({ error: 'Admin only' });
  }
  next();
});

router.get('/stats', (req, res) => res.json({ users: 100 }));
router.delete('/users/:id', (req, res) => res.json({ deleted: true }));

module.exports = router;
```

## Nested Routes

```javascript
// routes/users.js
const router = require('express').Router();

router.get('/', (req, res) => res.json([]));

// Nested: /api/users/:userId/posts
router.get('/:userId/posts', (req, res) => {
  const { userId } = req.params;
  res.json({ userId, posts: [] });
});

module.exports = router;
```

## Complete Example

```javascript
// routes/users.js
const express = require('express');
const router = express.Router();

let users = [{ id: 1, name: 'Alice' }];

router.get('/', (req, res) => {
  res.json(users);
});

router.get('/:id', (req, res) => {
  const user = users.find(u => u.id === +req.params.id);
  if (!user) return res.status(404).json({ error: 'Not found' });
  res.json(user);
});

router.post('/', (req, res) => {
  const user = { id: users.length + 1, ...req.body };
  users.push(user);
  res.status(201).json(user);
});

router.delete('/:id', (req, res) => {
  users = users.filter(u => u.id !== +req.params.id);
  res.status(204).send();
});

module.exports = router;
```

## Key Takeaway

Use `express.Router()` to split routes into separate files. Mount them with `app.use('/path', router)`. Keeps your code organized as your app grows. Each router is a mini Express app for its routes.

Organize Express routes with Router. Split your application into manageable, modular pieces.

Express Router for Modular Routes

# Authentication with JWT in Node.js

JWT (JSON Web Token) is the standard for API authentication. No sessions, stateless, scalable.

## How JWT Works

```
1. User logs in with email/password
2. Server verifies, generates JWT
3. Server sends JWT to client
4. Client stores JWT (localStorage/cookie)
5. Client sends JWT with every request
6. Server verifies JWT, allows access
```

## JWT Structure

```
header.payload.signature

eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOjF9.abc123signature
```

## Setup

```bash
npm install express jsonwebtoken bcryptjs
```

## Generate Token

```javascript
const jwt = require('jsonwebtoken');

const SECRET = process.env.JWT_SECRET || 'your-secret-key';

function generateToken(user) {
  return jwt.sign(
    { userId: user.id, email: user.email },
    SECRET,
    { expiresIn: '7d' }
  );
}
```

## Verify Token

```javascript
function verifyToken(token) {
  try {
    return jwt.verify(token, SECRET);
  } catch (error) {
    return null;
  }
}
```

## Auth Middleware

```javascript
function authMiddleware(req, res, next) {
  const authHeader = req.headers.authorization;
  
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }
  
  const token = authHeader.split(' ')[1];
  const decoded = verifyToken(token);
  
  if (!decoded) {
    return res.status(401).json({ error: 'Invalid token' });
  }
  
  req.user = decoded;
  next();
}
```

## Password Hashing

```javascript
const bcrypt = require('bcryptjs');

// Hash password (registration)
async function hashPassword(password) {
  return bcrypt.hash(password, 10);
}

// Compare password (login)
async function comparePassword(password, hash) {
  return bcrypt.compare(password, hash);
}
```

## Complete Auth Routes

```javascript
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');

const app = express();
app.use(express.json());

const SECRET = 'your-secret-key';
const users = [];  // In-memory (use database in production)

// Register
app.post('/api/register', async (req, res) => {
  const { email, password } = req.body;
  
  // Check if user exists
  if (users.find(u => u.email === email)) {
    return res.status(400).json({ error: 'Email already registered' });
  }
  
  // Hash password
  const hashedPassword = await bcrypt.hash(password, 10);
  
  // Create user
  const user = {
    id: users.length + 1,
    email,
    password: hashedPassword
  };
  users.push(user);
  
  // Generate token
  const token = jwt.sign({ userId: user.id }, SECRET, { expiresIn: '7d' });
  
  res.status(201).json({ token, user: { id: user.id, email } });
});

// Login
app.post('/api/login', async (req, res) => {
  const { email, password } = req.body;
  
  // Find user
  const user = users.find(u => u.email === email);
  if (!user) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  // Check password
  const valid = await bcrypt.compare(password, user.password);
  if (!valid) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  // Generate token
  const token = jwt.sign({ userId: user.id }, SECRET, { expiresIn: '7d' });
  
  res.json({ token, user: { id: user.id, email: user.email } });
});

// Auth middleware
function auth(req, res, next) {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  try {
    const token = authHeader.split(' ')[1];
    req.user = jwt.verify(token, SECRET);
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
}

// Protected route
app.get('/api/profile', auth, (req, res) => {
  const user = users.find(u => u.id === req.user.userId);
  res.json({ id: user.id, email: user.email });
});

app.listen(3000);
```

## Frontend Usage

```javascript
// Login
const response = await fetch('/api/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email, password })
});
const { token } = await response.json();
localStorage.setItem('token', token);

// Authenticated request
const profile = await fetch('/api/profile', {
  headers: {
    'Authorization': `Bearer ${localStorage.getItem('token')}`
  }
});
```

## Key Takeaway

JWT enables stateless authentication. Hash passwords with bcrypt, generate tokens on login, verify tokens in middleware. Store tokens client-side, send in Authorization header. Simple and scalable!

Implement JWT authentication in Node.js. Learn token generation, verification, and protected routes.

Authentication with JWT in Node.js

# MongoDB with Mongoose in Node.js

Mongoose is the most popular MongoDB library for Node.js. It adds schemas, validation, and more.

## Setup

```bash
npm install mongoose
```

## Connect to MongoDB

```javascript
const mongoose = require('mongoose');

mongoose.connect('mongodb://localhost:27017/myapp')
  .then(() => console.log('Connected to MongoDB'))
  .catch(err => console.error('Connection error:', err));
```

## Define a Schema

```javascript
const userSchema = new mongoose.Schema({
  name: {
    type: String,
    required: true,
    trim: true
  },
  email: {
    type: String,
    required: true,
    unique: true,
    lowercase: true
  },
  age: {
    type: Number,
    min: 0,
    max: 120
  },
  role: {
    type: String,
    enum: ['user', 'admin'],
    default: 'user'
  },
  createdAt: {
    type: Date,
    default: Date.now
  }
});

const User = mongoose.model('User', userSchema);
```

## Create Documents

```javascript
// Method 1: new + save
const user = new User({
  name: 'Alice',
  email: 'alice@example.com',
  age: 25
});
await user.save();

// Method 2: create
const user2 = await User.create({
  name: 'Bob',
  email: 'bob@example.com'
});
```

## Read Documents

```javascript
// Find all
const users = await User.find();

// Find with conditions
const admins = await User.find({ role: 'admin' });

// Find one
const user = await User.findOne({ email: 'alice@example.com' });

// Find by ID
const user = await User.findById('507f1f77bcf86cd799439011');

// Select specific fields
const users = await User.find().select('name email');

// Sort
const users = await User.find().sort({ createdAt: -1 });

// Limit
const users = await User.find().limit(10);

// Pagination
const page = 2;
const limit = 10;
const users = await User.find()
  .skip((page - 1) * limit)
  .limit(limit);
```

## Update Documents

```javascript
// Find and update
const user = await User.findByIdAndUpdate(
  '507f1f77bcf86cd799439011',
  { name: 'Alice Smith' },
  { new: true }  // Return updated document
);

// Update many
await User.updateMany(
  { role: 'user' },
  { $set: { verified: true } }
);
```

## Delete Documents

```javascript
// Delete one
await User.findByIdAndDelete('507f1f77bcf86cd799439011');

// Delete many
await User.deleteMany({ role: 'guest' });
```

## Schema Options

```javascript
const postSchema = new mongoose.Schema({
  title: String,
  content: String,
  author: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'User'  // Reference to User model
  },
  tags: [String],  // Array of strings
  metadata: {
    views: { type: Number, default: 0 },
    likes: { type: Number, default: 0 }
  }
}, {
  timestamps: true  // Adds createdAt, updatedAt
});
```

## Populate (Join)

```javascript
// Get posts with author details
const posts = await Post.find()
  .populate('author', 'name email');

// Result includes full author object
// { title: '...', author: { name: 'Alice', email: '...' } }
```

## Instance Methods

```javascript
userSchema.methods.getPublicProfile = function() {
  return {
    id: this._id,
    name: this.name,
    email: this.email
  };
};

const user = await User.findById(id);
const profile = user.getPublicProfile();
```

## Static Methods

```javascript
userSchema.statics.findByEmail = function(email) {
  return this.findOne({ email });
};

const user = await User.findByEmail('alice@example.com');
```

## Middleware (Hooks)

```javascript
// Before saving
userSchema.pre('save', async function(next) {
  if (this.isModified('password')) {
    this.password = await bcrypt.hash(this.password, 10);
  }
  next();
});

// After saving
userSchema.post('save', function(doc) {
  console.log('User saved:', doc.email);
});
```

## Express Integration

```javascript
// models/User.js
const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: { type: String, required: true },
  email: { type: String, required: true, unique: true }
});

module.exports = mongoose.model('User', userSchema);

// routes/users.js
const User = require('../models/User');

router.get('/', async (req, res) => {
  const users = await User.find();
  res.json(users);
});

router.post('/', async (req, res) => {
  const user = await User.create(req.body);
  res.status(201).json(user);
});
```

## Key Takeaway

Mongoose provides schemas for MongoDB. Define schemas with types and validation, create models, then use find/create/update/delete. Use populate for joins, middleware for hooks. It's the standard way to work with MongoDB in Node.js.

Connect Node.js to MongoDB using Mongoose. Learn schemas, models, and CRUD operations.

MongoDB with Mongoose in Node.js

# Error Handling Best Practices in Node.js

Errors happen. How you handle them defines your app's reliability.

## Sync vs Async Errors

```javascript
// Synchronous - use try/catch
try {
  JSON.parse('invalid json');
} catch (error) {
  console.error('Parse error:', error.message);
}

// Asynchronous - different approaches
// Callbacks: error-first pattern
// Promises: .catch()
// Async/await: try/catch
```

## Async/Await Error Handling

```javascript
async function fetchUser(id) {
  try {
    const user = await User.findById(id);
    if (!user) throw new Error('User not found');
    return user;
  } catch (error) {
    console.error('fetchUser error:', error.message);
    throw error;  // Re-throw if caller should handle
  }
}
```

## Custom Error Classes

```javascript
class AppError extends Error {
  constructor(message, statusCode) {
    super(message);
    this.statusCode = statusCode;
    this.isOperational = true;
    Error.captureStackTrace(this, this.constructor);
  }
}

class NotFoundError extends AppError {
  constructor(message = 'Resource not found') {
    super(message, 404);
  }
}

class ValidationError extends AppError {
  constructor(message = 'Validation failed') {
    super(message, 400);
  }
}

// Usage
throw new NotFoundError('User not found');
```

## Express Error Handler

```javascript
// Error handling middleware (must have 4 params)
app.use((err, req, res, next) => {
  console.error(err.stack);
  
  const statusCode = err.statusCode || 500;
  const message = err.isOperational ? err.message : 'Internal server error';
  
  res.status(statusCode).json({
    status: 'error',
    message,
    ...(process.env.NODE_ENV === 'development' && { stack: err.stack })
  });
});
```

## Async Route Wrapper

```javascript
// Catches async errors automatically
const asyncHandler = (fn) => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next);
};

// Usage
app.get('/users/:id', asyncHandler(async (req, res) => {
  const user = await User.findById(req.params.id);
  if (!user) throw new NotFoundError();
  res.json(user);
}));
```

## Unhandled Rejections

```javascript
process.on('unhandledRejection', (reason, promise) => {
  console.error('Unhandled Rejection:', reason);
  // Log to monitoring service
  // Don't exit in development, exit in production
});

process.on('uncaughtException', (error) => {
  console.error('Uncaught Exception:', error);
  // Must exit after uncaught exception
  process.exit(1);
});
```

## Validation Errors

```javascript
// With express-validator
const { validationResult } = require('express-validator');

app.post('/users', [
  body('email').isEmail(),
  body('password').isLength({ min: 6 })
], (req, res, next) => {
  const errors = validationResult(req);
  
  if (!errors.isEmpty()) {
    return res.status(400).json({
      status: 'error',
      errors: errors.array()
    });
  }
  
  // Continue...
});
```

## Database Errors

```javascript
async function createUser(data) {
  try {
    return await User.create(data);
  } catch (error) {
    if (error.code === 11000) {  // MongoDB duplicate key
      throw new ValidationError('Email already exists');
    }
    if (error.name === 'ValidationError') {
      throw new ValidationError(error.message);
    }
    throw error;  // Unknown error, let it bubble
  }
}
```

## Complete Error Setup

```javascript
// errors/AppError.js
class AppError extends Error {
  constructor(message, statusCode) {
    super(message);
    this.statusCode = statusCode;
    this.isOperational = true;
  }
}

// middleware/errorHandler.js
const errorHandler = (err, req, res, next) => {
  err.statusCode = err.statusCode || 500;
  
  if (process.env.NODE_ENV === 'development') {
    res.status(err.statusCode).json({
      status: 'error',
      message: err.message,
      stack: err.stack
    });
  } else {
    // Production: don't leak error details
    res.status(err.statusCode).json({
      status: 'error',
      message: err.isOperational ? err.message : 'Something went wrong'
    });
  }
};

// middleware/asyncHandler.js
const asyncHandler = fn => (req, res, next) =>
  Promise.resolve(fn(req, res, next)).catch(next);

// app.js
app.use('/api/users', userRoutes);
app.use(errorHandler);  // Must be last
```

## Key Takeaway

Use custom error classes for different error types. Wrap async routes with asyncHandler. Have a central error middleware. Handle unhandled rejections. Never expose stack traces in production. Good error handling makes debugging easier and apps more reliable.

Learn proper error handling in Node.js. Handle sync/async errors, create custom errors, and build robust applications.

Error Handling Best Practices in Node.js

# File Uploads with Multer in Express

Multer handles multipart/form-data - the format for file uploads.

## Setup

```bash
npm install multer
```

## Basic Configuration

```javascript
const multer = require('multer');

// Simple memory storage
const upload = multer({ dest: 'uploads/' });

// Or disk storage with custom naming
const storage = multer.diskStorage({
  destination: (req, file, cb) => {
    cb(null, 'uploads/');
  },
  filename: (req, file, cb) => {
    const uniqueName = Date.now() + '-' + file.originalname;
    cb(null, uniqueName);
  }
});

const upload = multer({ storage });
```

## Single File Upload

```javascript
app.post('/upload', upload.single('avatar'), (req, res) => {
  console.log(req.file);
  // {
  //   fieldname: 'avatar',
  //   originalname: 'photo.jpg',
  //   filename: '1234567890-photo.jpg',
  //   path: 'uploads/1234567890-photo.jpg',
  //   size: 12345
  // }
  res.json({ file: req.file });
});
```

## Multiple Files

```javascript
// Multiple files, same field
app.post('/photos', upload.array('photos', 5), (req, res) => {
  console.log(req.files);  // Array of files
  res.json({ files: req.files });
});

// Multiple fields
const cpUpload = upload.fields([
  { name: 'avatar', maxCount: 1 },
  { name: 'gallery', maxCount: 8 }
]);

app.post('/profile', cpUpload, (req, res) => {
  console.log(req.files.avatar);   // Single file
  console.log(req.files.gallery);  // Array of files
});
```

## File Filtering

```javascript
const imageFilter = (req, file, cb) => {
  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
  
  if (allowedTypes.includes(file.mimetype)) {
    cb(null, true);
  } else {
    cb(new Error('Only images allowed'), false);
  }
};

const upload = multer({
  storage,
  fileFilter: imageFilter,
  limits: {
    fileSize: 5 * 1024 * 1024  // 5MB
  }
});
```

## Error Handling

```javascript
app.post('/upload', (req, res) => {
  upload.single('file')(req, res, (err) => {
    if (err instanceof multer.MulterError) {
      if (err.code === 'LIMIT_FILE_SIZE') {
        return res.status(400).json({ error: 'File too large' });
      }
      return res.status(400).json({ error: err.message });
    }
    if (err) {
      return res.status(400).json({ error: err.message });
    }
    res.json({ file: req.file });
  });
});
```

## Memory Storage (for cloud upload)

```javascript
const upload = multer({ storage: multer.memoryStorage() });

app.post('/upload', upload.single('file'), async (req, res) => {
  // req.file.buffer contains file data
  // Upload to S3, Cloudinary, etc.
  
  const buffer = req.file.buffer;
  // await uploadToCloud(buffer);
  
  res.json({ message: 'Uploaded' });
});
```

## Complete Example

```javascript
const express = require('express');
const multer = require('multer');
const path = require('path');

const app = express();

const storage = multer.diskStorage({
  destination: 'uploads/',
  filename: (req, file, cb) => {
    const ext = path.extname(file.originalname);
    cb(null, `${Date.now()}${ext}`);
  }
});

const upload = multer({
  storage,
  limits: { fileSize: 5 * 1024 * 1024 },
  fileFilter: (req, file, cb) => {
    const allowed = /jpeg|jpg|png|gif/;
    const ext = allowed.test(path.extname(file.originalname).toLowerCase());
    const mime = allowed.test(file.mimetype);
    
    if (ext && mime) cb(null, true);
    else cb(new Error('Images only!'));
  }
});

// Serve uploaded files
app.use('/uploads', express.static('uploads'));

app.post('/api/upload', upload.single('image'), (req, res) => {
  if (!req.file) {
    return res.status(400).json({ error: 'No file uploaded' });
  }
  
  res.json({
    url: `/uploads/${req.file.filename}`,
    size: req.file.size
  });
});

app.listen(3000);
```

## Key Takeaway

Multer handles file uploads in Express. Use `single()` for one file, `array()` for multiple. Filter by type/size for security. Use memory storage for cloud uploads, disk storage for local files.

Handle file uploads in Node.js with Multer. Upload images, documents, and manage file storage.

File Uploads with Multer in Express

# Sending Emails with Nodemailer

Nodemailer is the standard for sending emails from Node.js.

## Setup

```bash
npm install nodemailer
```

## Basic Configuration

```javascript
const nodemailer = require('nodemailer');

const transporter = nodemailer.createTransport({
  host: 'smtp.gmail.com',
  port: 587,
  secure: false,  // true for 465, false for other ports
  auth: {
    user: process.env.EMAIL_USER,
    pass: process.env.EMAIL_PASS  // App password, not regular password
  }
});
```

## Send Basic Email

```javascript
async function sendEmail() {
  const info = await transporter.sendMail({
    from: '"My App" <noreply@myapp.com>',
    to: 'user@example.com',
    subject: 'Hello!',
    text: 'Plain text version',
    html: '<h1>Hello!</h1><p>This is HTML content.</p>'
  });
  
  console.log('Message sent:', info.messageId);
}
```

## Multiple Recipients

```javascript
await transporter.sendMail({
  from: '"My App" <noreply@myapp.com>',
  to: 'user1@example.com, user2@example.com',
  cc: 'cc@example.com',
  bcc: 'bcc@example.com',
  subject: 'Team Update',
  html: '<p>Hello team!</p>'
});
```

## Attachments

```javascript
await transporter.sendMail({
  from: '"My App" <noreply@myapp.com>',
  to: 'user@example.com',
  subject: 'Report',
  text: 'Please find the report attached.',
  attachments: [
    {
      filename: 'report.pdf',
      path: './reports/monthly.pdf'
    },
    {
      filename: 'image.png',
      content: Buffer.from('...'),  // Or file buffer
    },
    {
      filename: 'data.json',
      content: JSON.stringify({ data: 'value' })
    }
  ]
});
```

## HTML Templates

```javascript
function welcomeEmail(name) {
  return `
    <!DOCTYPE html>
    <html>
    <head>
      <style>
        .container { font-family: Arial, sans-serif; padding: 20px; }
        .header { color: #333; }
        .button { 
          background: #007bff; 
          color: white; 
          padding: 10px 20px; 
          text-decoration: none;
          border-radius: 5px;
        }
      </style>
    </head>
    <body>
      <div class="container">
        <h1 class="header">Welcome, ${name}!</h1>
        <p>Thanks for signing up.</p>
        <a href="https://myapp.com/verify" class="button">Verify Email</a>
      </div>
    </body>
    </html>
  `;
}

await transporter.sendMail({
  to: 'user@example.com',
  subject: 'Welcome!',
  html: welcomeEmail('Alice')
});
```

## Email Service Class

```javascript
class EmailService {
  constructor() {
    this.transporter = nodemailer.createTransport({
      host: process.env.SMTP_HOST,
      port: process.env.SMTP_PORT,
      auth: {
        user: process.env.SMTP_USER,
        pass: process.env.SMTP_PASS
      }
    });
  }
  
  async send(to, subject, html) {
    return this.transporter.sendMail({
      from: process.env.FROM_EMAIL,
      to,
      subject,
      html
    });
  }
  
  async sendWelcome(user) {
    return this.send(
      user.email,
      'Welcome!',
      welcomeEmail(user.name)
    );
  }
  
  async sendPasswordReset(email, resetUrl) {
    return this.send(
      email,
      'Password Reset',
      `<p>Click <a href="${resetUrl}">here</a> to reset your password.</p>`
    );
  }
}

module.exports = new EmailService();
```

## Testing with Ethereal

```javascript
// For development - catches emails without sending
async function createTestAccount() {
  const testAccount = await nodemailer.createTestAccount();
  
  return nodemailer.createTransport({
    host: 'smtp.ethereal.email',
    port: 587,
    auth: {
      user: testAccount.user,
      pass: testAccount.pass
    }
  });
}

const info = await transporter.sendMail({...});
console.log('Preview URL:', nodemailer.getTestMessageUrl(info));
```

## Key Takeaway

Nodemailer sends emails via SMTP. Configure with your email provider's settings, use app passwords for Gmail. Create reusable templates and a service class for clean code. Use Ethereal for testing.

Send emails from Node.js using Nodemailer. Learn SMTP configuration, templates, and attachments.

Sending Emails with Nodemailer

# WebSockets with Socket.io

HTTP is request-response. WebSockets enable real-time, bidirectional communication.

## Setup

```bash
npm install socket.io
```

## Basic Server

```javascript
const express = require('express');
const http = require('http');
const { Server } = require('socket.io');

const app = express();
const server = http.createServer(app);
const io = new Server(server);

io.on('connection', (socket) => {
  console.log('User connected:', socket.id);
  
  socket.on('disconnect', () => {
    console.log('User disconnected:', socket.id);
  });
});

server.listen(3000, () => {
  console.log('Server running on port 3000');
});
```

## Client Connection

```html
<script src="/socket.io/socket.io.js"></script>
<script>
  const socket = io();
  
  socket.on('connect', () => {
    console.log('Connected!');
  });
</script>
```

## Sending & Receiving Events

```javascript
// Server
io.on('connection', (socket) => {
  // Receive from client
  socket.on('chat message', (msg) => {
    console.log('Message:', msg);
    
    // Send to all clients
    io.emit('chat message', msg);
  });
});

// Client
socket.emit('chat message', 'Hello!');

socket.on('chat message', (msg) => {
  console.log('Received:', msg);
});
```

## Emit Patterns

```javascript
// To sender only
socket.emit('private', data);

// To all except sender
socket.broadcast.emit('news', data);

// To all connected clients
io.emit('announcement', data);

// To specific socket
io.to(socketId).emit('private', data);

// To room
io.to('room1').emit('room message', data);
```

## Rooms

```javascript
io.on('connection', (socket) => {
  // Join room
  socket.on('join room', (room) => {
    socket.join(room);
    socket.to(room).emit('user joined', socket.id);
  });
  
  // Leave room
  socket.on('leave room', (room) => {
    socket.leave(room);
    socket.to(room).emit('user left', socket.id);
  });
  
  // Message to room
  socket.on('room message', ({ room, message }) => {
    io.to(room).emit('message', message);
  });
});
```

## Complete Chat Example

```javascript
// Server
const express = require('express');
const http = require('http');
const { Server } = require('socket.io');

const app = express();
const server = http.createServer(app);
const io = new Server(server);

app.use(express.static('public'));

const users = new Map();

io.on('connection', (socket) => {
  socket.on('set username', (username) => {
    users.set(socket.id, username);
    io.emit('user list', Array.from(users.values()));
    io.emit('system', `${username} joined`);
  });
  
  socket.on('chat message', (msg) => {
    const username = users.get(socket.id);
    io.emit('chat message', {
      user: username,
      text: msg,
      time: new Date().toLocaleTimeString()
    });
  });
  
  socket.on('typing', () => {
    const username = users.get(socket.id);
    socket.broadcast.emit('typing', username);
  });
  
  socket.on('disconnect', () => {
    const username = users.get(socket.id);
    users.delete(socket.id);
    io.emit('user list', Array.from(users.values()));
    io.emit('system', `${username} left`);
  });
});

server.listen(3000);
```

```html

<!DOCTYPE html>
<html>
<body>
  <div id="messages"></div>
  <input id="input" /><button onclick="send()">Send</button>
  
  <script src="/socket.io/socket.io.js"></script>
  <script>
    const socket = io();
    const input = document.getElementById('input');
    const messages = document.getElementById('messages');
    
    socket.emit('set username', prompt('Username?'));
    
    function send() {
      socket.emit('chat message', input.value);
      input.value = '';
    }
    
    socket.on('chat message', (msg) => {
      messages.innerHTML += `<p><b>${msg.user}:</b> ${msg.text}</p>`;
    });
  </script>
</body>
</html>
```

## With CORS

```javascript
const io = new Server(server, {
  cors: {
    origin: 'http://localhost:3000',
    methods: ['GET', 'POST']
  }
});
```

## Key Takeaway

Socket.io enables real-time communication. `emit()` sends events, `on()` receives them. Use rooms for group messaging. It handles reconnection, fallbacks, and cross-browser issues automatically.

Build real-time applications with Socket.io. Learn bidirectional communication for chat, notifications, and live updates.

WebSockets with Socket.io

# Caching with Redis in Node.js

Redis is an in-memory data store. Perfect for caching, sessions, and real-time data.

## Setup

```bash
npm install redis
# Make sure Redis server is running
```

## Connect to Redis

```javascript
const redis = require('redis');

const client = redis.createClient({
  url: 'redis://localhost:6379'
});

client.on('error', err => console.log('Redis Error:', err));

await client.connect();
console.log('Connected to Redis');
```

## Basic Operations

```javascript
// Set and get
await client.set('name', 'Alice');
const name = await client.get('name');  // 'Alice'

// Set with expiration (seconds)
await client.setEx('session', 3600, 'data');  // Expires in 1 hour

// Delete
await client.del('name');

// Check if exists
const exists = await client.exists('name');  // 0 or 1
```

## Working with JSON

```javascript
// Store object as JSON
const user = { id: 1, name: 'Alice' };
await client.set('user:1', JSON.stringify(user));

// Retrieve and parse
const data = await client.get('user:1');
const parsed = JSON.parse(data);
```

## Hash (Objects)

```javascript
// Set hash fields
await client.hSet('user:1', {
  name: 'Alice',
  email: 'alice@example.com',
  age: '25'
});

// Get all fields
const user = await client.hGetAll('user:1');
// { name: 'Alice', email: 'alice@example.com', age: '25' }

// Get single field
const name = await client.hGet('user:1', 'name');
```

## Caching Database Queries

```javascript
async function getUser(id) {
  const cacheKey = `user:${id}`;
  
  // Check cache first
  const cached = await client.get(cacheKey);
  if (cached) {
    console.log('Cache hit');
    return JSON.parse(cached);
  }
  
  // Cache miss - fetch from database
  console.log('Cache miss');
  const user = await User.findById(id);
  
  if (user) {
    // Cache for 1 hour
    await client.setEx(cacheKey, 3600, JSON.stringify(user));
  }
  
  return user;
}
```

## Cache Middleware

```javascript
function cache(duration) {
  return async (req, res, next) => {
    const key = `cache:${req.originalUrl}`;
    
    const cached = await client.get(key);
    if (cached) {
      return res.json(JSON.parse(cached));
    }
    
    // Store original res.json
    const originalJson = res.json.bind(res);
    
    res.json = async (data) => {
      await client.setEx(key, duration, JSON.stringify(data));
      return originalJson(data);
    };
    
    next();
  };
}

// Usage
app.get('/api/posts', cache(300), async (req, res) => {
  const posts = await Post.find();
  res.json(posts);
});
```

## Cache Invalidation

```javascript
async function updateUser(id, data) {
  // Update database
  const user = await User.findByIdAndUpdate(id, data, { new: true });
  
  // Invalidate cache
  await client.del(`user:${id}`);
  
  return user;
}

// Clear all user caches
async function clearUserCache() {
  const keys = await client.keys('user:*');
  if (keys.length) {
    await client.del(keys);
  }
}
```

## Lists & Sets

```javascript
// List - ordered
await client.lPush('queue', 'task1');
await client.lPush('queue', 'task2');
const task = await client.rPop('queue');  // 'task1'

// Set - unique values
await client.sAdd('tags', 'nodejs');
await client.sAdd('tags', 'redis');
const tags = await client.sMembers('tags');  // ['nodejs', 'redis']
```

## Session Storage

```javascript
const session = require('express-session');
const RedisStore = require('connect-redis').default;

app.use(session({
  store: new RedisStore({ client }),
  secret: 'your-secret',
  resave: false,
  saveUninitialized: false,
  cookie: { maxAge: 86400000 }  // 1 day
}));
```

## Key Takeaway

Redis dramatically speeds up reads by caching data in memory. Cache database queries, API responses, and sessions. Always set expiration times and invalidate cache when data changes. It's essential for high-performance Node.js apps.

Speed up your Node.js app with Redis caching. Learn key-value storage, expiration, and caching strategies.

Caching with Redis in Node.js

# Testing Node.js with Jest

Jest is the most popular testing framework. Simple, fast, feature-rich.

## Setup

```bash
npm install --save-dev jest
```

```json
// package.json
{
  "scripts": {
    "test": "jest",
    "test:watch": "jest --watch"
  }
}
```

## First Test

```javascript
// math.js
function add(a, b) {
  return a + b;
}
module.exports = { add };

// math.test.js
const { add } = require('./math');

test('adds 1 + 2 to equal 3', () => {
  expect(add(1, 2)).toBe(3);
});
```

Run: `npm test`

## Common Matchers

```javascript
// Equality
expect(2 + 2).toBe(4);
expect({ name: 'Alice' }).toEqual({ name: 'Alice' });

// Truthiness
expect(null).toBeNull();
expect(undefined).toBeUndefined();
expect(true).toBeTruthy();
expect(false).toBeFalsy();

// Numbers
expect(4).toBeGreaterThan(3);
expect(4).toBeLessThan(5);
expect(0.1 + 0.2).toBeCloseTo(0.3);

// Strings
expect('team').toMatch(/tea/);

// Arrays
expect(['Alice', 'Bob']).toContain('Alice');

// Exceptions
expect(() => throwError()).toThrow();
expect(() => throwError()).toThrow('error message');
```

## Grouping Tests

```javascript
describe('Math functions', () => {
  describe('add', () => {
    test('adds positive numbers', () => {
      expect(add(1, 2)).toBe(3);
    });
    
    test('adds negative numbers', () => {
      expect(add(-1, -2)).toBe(-3);
    });
  });
  
  describe('multiply', () => {
    test('multiplies numbers', () => {
      expect(multiply(2, 3)).toBe(6);
    });
  });
});
```

## Testing Async Code

```javascript
// With async/await
test('fetches user', async () => {
  const user = await fetchUser(1);
  expect(user.name).toBe('Alice');
});

// With promises
test('fetches user', () => {
  return fetchUser(1).then(user => {
    expect(user.name).toBe('Alice');
  });
});

// With done callback
test('fetches user', (done) => {
  fetchUser(1, (user) => {
    expect(user.name).toBe('Alice');
    done();
  });
});
```

## Mocking

```javascript
// Mock function
const mockFn = jest.fn();
mockFn('hello');

expect(mockFn).toHaveBeenCalled();
expect(mockFn).toHaveBeenCalledWith('hello');
expect(mockFn).toHaveBeenCalledTimes(1);

// Mock return value
const mockFn = jest.fn().mockReturnValue(42);
expect(mockFn()).toBe(42);

// Mock async
const mockAsync = jest.fn().mockResolvedValue({ id: 1 });
await mockAsync();
```

## Mocking Modules

```javascript
// Mock entire module
jest.mock('./database');
const db = require('./database');

db.query.mockResolvedValue([{ id: 1, name: 'Alice' }]);

test('gets users from database', async () => {
  const users = await getUsers();
  expect(users).toHaveLength(1);
});
```

## Testing Express Routes

```javascript
const request = require('supertest');
const app = require('./app');

describe('GET /api/users', () => {
  test('returns users', async () => {
    const response = await request(app)
      .get('/api/users')
      .expect('Content-Type', /json/)
      .expect(200);
    
    expect(response.body).toBeInstanceOf(Array);
  });
});

describe('POST /api/users', () => {
  test('creates user', async () => {
    const response = await request(app)
      .post('/api/users')
      .send({ name: 'Alice', email: 'alice@example.com' })
      .expect(201);
    
    expect(response.body.name).toBe('Alice');
  });
  
  test('returns 400 for invalid data', async () => {
    await request(app)
      .post('/api/users')
      .send({ name: '' })
      .expect(400);
  });
});
```

## Setup and Teardown

```javascript
describe('User tests', () => {
  beforeAll(async () => {
    // Run once before all tests
    await connectDB();
  });
  
  afterAll(async () => {
    // Run once after all tests
    await disconnectDB();
  });
  
  beforeEach(async () => {
    // Run before each test
    await clearDatabase();
  });
  
  afterEach(() => {
    // Run after each test
    jest.clearAllMocks();
  });
  
  test('test 1', () => { ... });
  test('test 2', () => { ... });
});
```

## Coverage

```bash
npm test -- --coverage
```

```json
// package.json
{
  "jest": {
    "collectCoverageFrom": ["src/**/*.js"],
    "coverageThreshold": {
      "global": {
        "branches": 80,
        "functions": 80,
        "lines": 80
      }
    }
  }
}
```

## Key Takeaway

Jest makes testing easy. Use `describe` to group tests, `test` for individual cases. Mock external dependencies. Test Express routes with supertest. Aim for high coverage but focus on meaningful tests.

Write tests for Node.js applications using Jest. Learn unit tests, mocking, and testing async code.

Testing Node.js with Jest

# Input Validation with express-validator

Never trust user input. Validate everything.

## Setup

```bash
npm install express-validator
```

## Basic Validation

```javascript
const { body, validationResult } = require('express-validator');

app.post('/api/users',
  body('email').isEmail(),
  body('password').isLength({ min: 6 }),
  (req, res) => {
    const errors = validationResult(req);
    
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    
    // Validation passed
    res.json({ message: 'User created' });
  }
);
```

## Common Validators

```javascript
body('email').isEmail(),
body('password').isLength({ min: 6, max: 100 }),
body('age').isInt({ min: 0, max: 120 }),
body('price').isFloat({ min: 0 }),
body('website').isURL(),
body('phone').isMobilePhone(),
body('date').isISO8601(),
body('uuid').isUUID(),
body('role').isIn(['user', 'admin']),
body('tags').isArray(),
body('name').notEmpty(),
body('bio').optional().isLength({ max: 500 }),
```

## Custom Error Messages

```javascript
body('email')
  .isEmail()
  .withMessage('Please enter a valid email'),
  
body('password')
  .isLength({ min: 6 })
  .withMessage('Password must be at least 6 characters'),
```

## Sanitization

```javascript
body('email').normalizeEmail(),
body('name').trim().escape(),
body('age').toInt(),
body('price').toFloat(),
body('tags').toArray(),
```

## Chaining Validators

```javascript
body('password')
  .trim()
  .isLength({ min: 8 })
  .withMessage('Password must be at least 8 characters')
  .matches(/[A-Z]/)
  .withMessage('Must contain uppercase letter')
  .matches(/[0-9]/)
  .withMessage('Must contain number'),
```

## Custom Validators

```javascript
body('confirmPassword').custom((value, { req }) => {
  if (value !== req.body.password) {
    throw new Error('Passwords do not match');
  }
  return true;
}),

body('email').custom(async (email) => {
  const user = await User.findOne({ email });
  if (user) {
    throw new Error('Email already in use');
  }
}),
```

## Validating Params & Query

```javascript
const { param, query } = require('express-validator');

// Route params
app.get('/api/users/:id',
  param('id').isMongoId(),
  (req, res) => { ... }
);

// Query strings
app.get('/api/search',
  query('q').notEmpty().trim(),
  query('page').optional().isInt({ min: 1 }),
  query('limit').optional().isInt({ min: 1, max: 100 }),
  (req, res) => { ... }
);
```

## Reusable Validation Middleware

```javascript
// validations/user.js
const { body } = require('express-validator');

const createUserValidation = [
  body('name')
    .trim()
    .notEmpty()
    .withMessage('Name is required')
    .isLength({ max: 100 }),
  body('email')
    .isEmail()
    .normalizeEmail()
    .withMessage('Valid email required'),
  body('password')
    .isLength({ min: 8 })
    .withMessage('Password must be 8+ characters')
];

const updateUserValidation = [
  body('name').optional().trim().isLength({ max: 100 }),
  body('email').optional().isEmail().normalizeEmail()
];

module.exports = { createUserValidation, updateUserValidation };
```

## Validation Middleware

```javascript
// middleware/validate.js
const { validationResult } = require('express-validator');

const validate = (req, res, next) => {
  const errors = validationResult(req);
  
  if (!errors.isEmpty()) {
    return res.status(400).json({
      status: 'error',
      errors: errors.array().map(err => ({
        field: err.path,
        message: err.msg
      }))
    });
  }
  
  next();
};

module.exports = validate;
```

## Complete Example

```javascript
const { createUserValidation } = require('./validations/user');
const validate = require('./middleware/validate');

app.post('/api/users',
  createUserValidation,
  validate,
  async (req, res) => {
    // All validation passed
    const user = await User.create(req.body);
    res.status(201).json(user);
  }
);
```

## Key Takeaway

Always validate user input. Use express-validator for declarative validation. Sanitize data to prevent XSS. Create reusable validation arrays. Return clear error messages. It's your first line of defense against bad data.

Validate and sanitize user input in Express. Prevent security issues and ensure data integrity.

Input Validation with express-validator

# Rate Limiting in Node.js APIs

Rate limiting prevents abuse by limiting how many requests a client can make.

## Setup

```bash
npm install express-rate-limit
```

## Basic Rate Limiter

```javascript
const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                   // 100 requests per window
  message: { error: 'Too many requests, please try again later' }
});

// Apply to all requests
app.use(limiter);
```

## API-Specific Limits

```javascript
// Strict limit for auth routes
const authLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,  // 1 hour
  max: 5,                     // 5 attempts
  message: { error: 'Too many login attempts' }
});

app.use('/api/auth', authLimiter);

// Relaxed limit for general API
const apiLimiter = rateLimit({
  windowMs: 60 * 1000,  // 1 minute
  max: 60               // 60 requests per minute
});

app.use('/api', apiLimiter);
```

## Custom Key Generator

```javascript
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  keyGenerator: (req) => {
    // Rate limit by user ID if authenticated, IP otherwise
    return req.user?.id || req.ip;
  }
});
```

## Skip Certain Requests

```javascript
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  skip: (req) => {
    // Don't rate limit admins
    return req.user?.role === 'admin';
  }
});
```

## Custom Response Headers

```javascript
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,  // Return rate limit info in headers
  legacyHeaders: false    // Disable X-RateLimit headers
});

// Response headers:
// RateLimit-Limit: 100
// RateLimit-Remaining: 99
// RateLimit-Reset: 1234567890
```

## Redis Store (for distributed apps)

```bash
npm install rate-limit-redis
```

```javascript
const RedisStore = require('rate-limit-redis');
const redis = require('redis');

const client = redis.createClient();

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  store: new RedisStore({
    sendCommand: (...args) => client.sendCommand(args)
  })
});
```

## Different Limits by Plan

```javascript
const createLimiter = (max) => rateLimit({
  windowMs: 60 * 1000,
  max,
  keyGenerator: (req) => req.user?.id || req.ip
});

const limiters = {
  free: createLimiter(10),
  pro: createLimiter(100),
  enterprise: createLimiter(1000)
};

function dynamicRateLimit(req, res, next) {
  const plan = req.user?.plan || 'free';
  return limiters[plan](req, res, next);
}

app.use('/api', dynamicRateLimit);
```

## Slow Down Instead of Block

```bash
npm install express-slow-down
```

```javascript
const slowDown = require('express-slow-down');

const speedLimiter = slowDown({
  windowMs: 15 * 60 * 1000,
  delayAfter: 50,       // Allow 50 requests without delay
  delayMs: (hits) => hits * 100  // Add 100ms per request after 50
});

app.use(speedLimiter);
```

## Complete Setup

```javascript
const rateLimit = require('express-rate-limit');

// General API limit
app.use('/api', rateLimit({
  windowMs: 60 * 1000,
  max: 60,
  standardHeaders: true
}));

// Strict auth limit
app.use('/api/auth/login', rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: { error: 'Too many login attempts. Try again in 15 minutes.' }
}));

// Very strict for password reset
app.use('/api/auth/forgot-password', rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 3
}));
```

## Key Takeaway

Rate limiting is essential API security. Use express-rate-limit for quick setup. Apply stricter limits to sensitive endpoints (auth, payments). Use Redis store for distributed systems. Always return informative error messages.

Protect your API from abuse with rate limiting. Implement request throttling and prevent DDoS attacks.

Rate Limiting in Node.js APIs

# Logging with Winston and Morgan

Good logging is essential for debugging and monitoring. Console.log won't cut it in production.

## Setup

```bash
npm install winston morgan
```

## Winston - Application Logs

```javascript
const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' })
  ]
});

// Add console in development
if (process.env.NODE_ENV !== 'production') {
  logger.add(new winston.transports.Console({
    format: winston.format.simple()
  }));
}

module.exports = logger;
```

## Log Levels

```javascript
logger.error('Database connection failed');
logger.warn('Deprecated API called');
logger.info('User logged in');
logger.http('GET /api/users');
logger.debug('Processing data...');
```

## Custom Format

```javascript
const logger = winston.createLogger({
  format: winston.format.combine(
    winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
    winston.format.printf(({ timestamp, level, message, ...meta }) => {
      return `${timestamp} [${level.toUpperCase()}]: ${message} ${Object.keys(meta).length ? JSON.stringify(meta) : ''}`;
    })
  ),
  transports: [
    new winston.transports.Console()
  ]
});

logger.info('User created', { userId: 1, email: 'alice@example.com' });
// 2024-01-15 10:30:00 [INFO]: User created {"userId":1,"email":"alice@example.com"}
```

## Morgan - HTTP Request Logs

```javascript
const morgan = require('morgan');

// Predefined formats
app.use(morgan('dev'));       // :method :url :status :response-time ms
app.use(morgan('combined'));  // Apache combined format
app.use(morgan('tiny'));      // Minimal output

// Custom format
app.use(morgan(':method :url :status :response-time ms - :res[content-length]'));
```

## Morgan + Winston Integration

```javascript
const morgan = require('morgan');
const logger = require('./logger');

// Create stream for winston
const stream = {
  write: (message) => logger.http(message.trim())
};

app.use(morgan('combined', { stream }));
```

## Skip Logging for Health Checks

```javascript
app.use(morgan('combined', {
  skip: (req, res) => req.url === '/health'
}));
```

## Daily Rotate File

```bash
npm install winston-daily-rotate-file
```

```javascript
require('winston-daily-rotate-file');

const logger = winston.createLogger({
  transports: [
    new winston.transports.DailyRotateFile({
      filename: 'logs/app-%DATE%.log',
      datePattern: 'YYYY-MM-DD',
      maxSize: '20m',
      maxFiles: '14d'  // Keep 14 days of logs
    })
  ]
});
```

## Complete Logger Setup

```javascript
// logger.js
const winston = require('winston');
require('winston-daily-rotate-file');

const levels = {
  error: 0,
  warn: 1,
  info: 2,
  http: 3,
  debug: 4
};

const logger = winston.createLogger({
  level: process.env.LOG_LEVEL || 'info',
  levels,
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.errors({ stack: true }),
    winston.format.json()
  ),
  defaultMeta: { service: 'my-app' },
  transports: [
    new winston.transports.DailyRotateFile({
      filename: 'logs/error-%DATE%.log',
      datePattern: 'YYYY-MM-DD',
      level: 'error',
      maxFiles: '30d'
    }),
    new winston.transports.DailyRotateFile({
      filename: 'logs/combined-%DATE%.log',
      datePattern: 'YYYY-MM-DD',
      maxFiles: '14d'
    })
  ]
});

if (process.env.NODE_ENV !== 'production') {
  logger.add(new winston.transports.Console({
    format: winston.format.combine(
      winston.format.colorize(),
      winston.format.simple()
    )
  }));
}

module.exports = logger;
```

## Usage in Application

```javascript
const logger = require('./logger');

// In route handlers
app.post('/api/users', async (req, res) => {
  try {
    const user = await User.create(req.body);
    logger.info('User created', { userId: user.id });
    res.status(201).json(user);
  } catch (error) {
    logger.error('Failed to create user', { error: error.message, stack: error.stack });
    res.status(500).json({ error: 'Internal error' });
  }
});
```

## Key Takeaway

Use Winston for application logs and Morgan for HTTP requests. Set up daily rotation to manage log files. Include timestamps and structured metadata. Different log levels help filter what's important. Good logging saves hours of debugging.

Implement professional logging in Node.js. Use Winston for application logs and Morgan for HTTP requests.

Logging with Winston and Morgan

# Security Best Practices in Node.js

Security isn't optional. Here are the essentials every Node.js developer must know.

## 1. Use Helmet

```bash
npm install helmet
```

```javascript
const helmet = require('helmet');
app.use(helmet());
```

Helmet sets security headers:
- X-Content-Type-Options
- X-Frame-Options
- Content-Security-Policy
- And more...

## 2. Prevent SQL/NoSQL Injection

```javascript
// ❌ Vulnerable
const user = await User.findOne({ email: req.body.email });

// ✅ Safe - validate input type
const email = typeof req.body.email === 'string' ? req.body.email : '';
const user = await User.findOne({ email });

// ❌ Raw SQL - vulnerable
db.query(`SELECT * FROM users WHERE id = ${userId}`);

// ✅ Parameterized query
db.query('SELECT * FROM users WHERE id = ?', [userId]);
```

## 3. XSS Prevention

```javascript
// Escape user input in HTML
const escape = require('escape-html');
const safeContent = escape(userInput);

// Use Content-Security-Policy
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],
    styleSrc: ["'self'", "'unsafe-inline'"]
  }
}));
```

## 4. HTTPS Only

```javascript
// Redirect HTTP to HTTPS
app.use((req, res, next) => {
  if (req.headers['x-forwarded-proto'] !== 'https' && process.env.NODE_ENV === 'production') {
    return res.redirect(`https://${req.headers.host}${req.url}`);
  }
  next();
});

// Secure cookies
app.use(session({
  cookie: {
    secure: true,      // HTTPS only
    httpOnly: true,    // No JavaScript access
    sameSite: 'strict' // CSRF protection
  }
}));
```

## 5. Password Security

```javascript
const bcrypt = require('bcryptjs');

// Hash password
const hash = await bcrypt.hash(password, 12);

// Verify password
const isValid = await bcrypt.compare(password, hash);

// Password requirements
const isStrongPassword = (password) => {
  return password.length >= 8 &&
         /[A-Z]/.test(password) &&
         /[a-z]/.test(password) &&
         /[0-9]/.test(password);
};
```

## 6. Rate Limiting

```javascript
const rateLimit = require('express-rate-limit');

// Prevent brute force
app.use('/api/auth', rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5
}));
```

## 7. Input Validation

```javascript
const { body, validationResult } = require('express-validator');

app.post('/api/users', [
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }),
  body('name').trim().escape()
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  // Safe to proceed
});
```

## 8. Environment Variables

```javascript
// ❌ Never commit secrets
const apiKey = 'sk-1234567890';

// ✅ Use environment variables
const apiKey = process.env.API_KEY;

// Check required vars at startup
const required = ['DATABASE_URL', 'JWT_SECRET', 'API_KEY'];
required.forEach(key => {
  if (!process.env[key]) {
    console.error(`Missing: ${key}`);
    process.exit(1);
  }
});
```

## 9. Dependency Security

```bash
# Check for vulnerabilities
npm audit

# Fix automatically
npm audit fix

# Update dependencies
npm update
```

## 10. Error Handling

```javascript
// ❌ Leaks info
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack });
});

// ✅ Safe
app.use((err, req, res, next) => {
  console.error(err.stack);  // Log for debugging
  res.status(500).json({ error: 'Internal server error' });
});
```

## Security Checklist

```
□ Helmet middleware enabled
□ HTTPS enforced
□ Secure cookie settings
□ Input validation on all routes
□ SQL/NoSQL injection prevention
□ XSS prevention
□ CSRF tokens for forms
□ Rate limiting on sensitive endpoints
□ Strong password hashing (bcrypt)
□ Secrets in environment variables
□ Dependencies regularly updated
□ Error messages don't leak info
```

## Complete Secure Setup

```javascript
const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');

const app = express();

// Security middleware
app.use(helmet());
app.use(cors({ origin: process.env.FRONTEND_URL }));
app.use(express.json({ limit: '10kb' }));  // Limit body size
app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));

// Trust proxy if behind nginx/load balancer
app.set('trust proxy', 1);
```

## Key Takeaway

Security is layers. Use Helmet, validate all input, hash passwords, rate limit, use HTTPS, keep dependencies updated. Never expose sensitive info in errors. Think like an attacker to defend like a pro.

Secure your Node.js application. Learn about common vulnerabilities and how to prevent them.

Security Best Practices in Node.js

# Docker for Node.js Applications

Docker packages your app with its dependencies. Works on my machine = works everywhere.

## Basic Dockerfile

```dockerfile
# Dockerfile
FROM node:20-alpine

WORKDIR /app

COPY package*.json ./

RUN npm ci --only=production

COPY . .

EXPOSE 3000

CMD ["node", "server.js"]
```

## Build and Run

```bash
# Build image
docker build -t my-app .

# Run container
docker run -p 3000:3000 my-app

# Run with environment variables
docker run -p 3000:3000 -e NODE_ENV=production my-app

# Run in background
docker run -d -p 3000:3000 my-app
```

## Optimized Dockerfile

```dockerfile
# Use specific version
FROM node:20-alpine AS builder

WORKDIR /app

# Copy package files first (better caching)
COPY package*.json ./

# Install all dependencies for build
RUN npm ci

# Copy source
COPY . .

# Build if needed (TypeScript, etc.)
RUN npm run build

# Production stage
FROM node:20-alpine

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install production dependencies only
RUN npm ci --only=production && npm cache clean --force

# Copy built files from builder
COPY --from=builder /app/dist ./dist

# Security: run as non-root user
USER node

EXPOSE 3000

CMD ["node", "dist/server.js"]
```

## .dockerignore

```
node_modules
npm-debug.log
.git
.gitignore
.env
.env.*
Dockerfile
docker-compose.yml
.dockerignore
README.md
.nyc_output
coverage
```

## Docker Compose

```yaml
# docker-compose.yml
version: '3.8'

services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=mongodb://mongo:27017/myapp
      - REDIS_URL=redis://redis:6379
    depends_on:
      - mongo
      - redis
    restart: unless-stopped

  mongo:
    image: mongo:6
    volumes:
      - mongo-data:/data/db
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    restart: unless-stopped

volumes:
  mongo-data:
```

## Run with Compose

```bash
# Start all services
docker-compose up

# Start in background
docker-compose up -d

# View logs
docker-compose logs -f app

# Stop all
docker-compose down

# Stop and remove volumes
docker-compose down -v
```

## Development with Docker

```yaml
# docker-compose.dev.yml
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile.dev
    ports:
      - "3000:3000"
    volumes:
      - .:/app
      - /app/node_modules  # Don't override node_modules
    environment:
      - NODE_ENV=development
    command: npm run dev
```

```dockerfile
# Dockerfile.dev
FROM node:20-alpine

WORKDIR /app

COPY package*.json ./
RUN npm install

COPY . .

CMD ["npm", "run", "dev"]
```

## Health Checks

```dockerfile
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --quiet --tries=1 --spider http://localhost:3000/health || exit 1
```

```javascript
// Express health endpoint
app.get('/health', (req, res) => {
  res.json({ status: 'ok', timestamp: new Date().toISOString() });
});
```

## Multi-Stage for TypeScript

```dockerfile
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY --from=builder /app/dist ./dist
USER node
EXPOSE 3000
CMD ["node", "dist/index.js"]
```

## Common Commands

```bash
# List containers
docker ps

# Stop container
docker stop <container_id>

# Remove container
docker rm <container_id>

# List images
docker images

# Remove image
docker rmi <image_id>

# Shell into container
docker exec -it <container_id> sh

# View logs
docker logs <container_id>
```

## Key Takeaway

Docker ensures consistent environments. Use multi-stage builds for smaller images. Use docker-compose for multi-service apps. Include health checks. Use non-root user for security. Keep images small with Alpine.

Containerize Node.js apps with Docker. Learn Dockerfile, docker-compose, and deployment best practices.

Docker for Node.js Applications

# Node.js Clustering

## The Problem: Single-Threaded Limitation

Node.js runs on a single thread. This means:
- Your app uses only 1 CPU core
- On a 4-core CPU, you're using 25% of available power
- Other 3 cores sit idle doing nothing
- One heavy request blocks others

```
4-Core CPU:
Core 1: ████████ (Node.js running here)
Core 2: -------- (idle)
Core 3: -------- (idle)
Core 4: -------- (idle)

Result: 75% of CPU wasted!
```

## What is Clustering?

Clustering creates multiple Node.js processes (workers) that:
- Share the same server port
- Each runs on a different CPU core
- Work independently
- Handle requests in parallel

```
Master Process (manages workers)
  ├── Worker 1 (Core 1) → Handles Request A
  ├── Worker 2 (Core 2) → Handles Request B
  ├── Worker 3 (Core 3) → Handles Request C
  └── Worker 4 (Core 4) → Handles Request D

All 4 requests processed simultaneously!
```

## How Clustering Works

```javascript
const cluster = require('cluster');
const os = require('os');
const express = require('express');

if (cluster.isMaster) {
  const numCPUs = os.cpus().length;
  console.log(`Master process running. CPU cores: ${numCPUs}`);
  
  for (let i = 0; i < numCPUs; i++) {
    cluster.fork();
  }
  
  cluster.on('exit', (worker) => {
    console.log(`Worker ${worker.process.pid} died`);
    cluster.fork();
  });
  
} else {
  const app = express();
  
  app.get('/', (req, res) => {
    res.send(`Handled by worker ${process.pid}`);
  });
  
  app.listen(3000);
  console.log(`Worker ${process.pid} started`);
}
```

**Explanation:**
1. **Master process** checks `cluster.isMaster`
2. Master creates workers with `cluster.fork()`
3. **Worker processes** run your Express app
4. OS automatically distributes requests
5. If worker crashes, master restarts it

## Benefits of Clustering

**1. Better Performance**
```
Without Clustering: 100 req/sec
With Clustering (4 cores): 380 req/sec
```

**2. Fault Tolerance**
If one worker crashes, others keep running.

**3. Zero Downtime Restarts**
Restart workers one by one.

**4. Full CPU Utilization**
Use all cores instead of just one.

## Using PM2 (Production Ready)

PM2 is a process manager that handles clustering automatically.

```bash
npm install -g pm2

pm2 start app.js -i max

pm2 list
pm2 logs
pm2 monit
```

**`-i max`** = Use all CPU cores

No code changes needed! PM2 handles everything.

## Critical Issue: Shared State

```javascript
let counter = 0;

app.get('/', (req, res) => {
  counter++;
  res.send(`Count: ${counter}`);
});
```

**Problem:** Each worker has its own `counter` variable!

```
Worker 1: counter = 5
Worker 2: counter = 3
Worker 3: counter = 7
Worker 4: counter = 2

Total should be 17, but each worker shows different count!
```

**Solution: Use Redis for shared state**

```javascript
const redis = require('redis');
const client = redis.createClient();

app.get('/', async (req, res) => {
  const count = await client.incr('counter');
  res.send(`Count: ${count}`);
});
```

Now all workers share the same counter in Redis.

## When to Use Clustering

**✅ Use When:**
- CPU-intensive operations
- High traffic applications
- Need fault tolerance
- Multiple CPU cores available

**❌ Don't Use When:**
- I/O-bound operations (database queries)
- Single-core server
- Shared memory needed (use Worker Threads instead)

## Key Takeaway

Clustering multiplies your app's capacity by using all CPU cores. Use PM2 in production for automatic management. Workers don't share memory - use Redis for shared state. Each worker is independent, so if one crashes, others keep serving requests.

Understand Node.js clustering. Use all CPU cores to handle more traffic.

Node.js Clustering for Multi-Core CPUs

# Child Processes

Need to run shell commands from Node.js? Use child processes.

## exec() - Simple Commands

```javascript
const { exec } = require('child_process');

exec('ls -la', (error, stdout, stderr) => {
  if (error) {
    console.error('Error:', error.message);
    return;
  }
  console.log(stdout);
});
```

**Use case:** Running simple commands like `git status`, `ls`, `pwd`

## spawn() - For Large Output

```javascript
const { spawn } = require('child_process');

const ls = spawn('ls', ['-la', '/usr']);

ls.stdout.on('data', (data) => {
  console.log(`${data}`);
});

ls.on('close', (code) => {
  console.log(`Exited with code ${code}`);
});
```

**Difference:** 
- `exec()` buffers entire output in memory
- `spawn()` streams output in chunks

## fork() - Run Node.js Files

```javascript
const { fork } = require('child_process');

const worker = fork('./worker.js');

worker.send({ task: 'calculate', numbers: [1,2,3,4,5] });

worker.on('message', (result) => {
  console.log('Result:', result);
});
```

```javascript
// worker.js
process.on('message', (msg) => {
  const sum = msg.numbers.reduce((a, b) => a + b, 0);
  process.send({ sum });
});
```

**Use case:** Heavy computations that would block main thread

## Real Example: Image Processing

```javascript
const { spawn } = require('child_process');

function compressImage(input, output) {
  return new Promise((resolve, reject) => {
    const convert = spawn('convert', [
      input,
      '-quality', '80',
      output
    ]);
    
    convert.on('close', (code) => {
      if (code === 0) resolve();
      else reject(new Error('Failed'));
    });
  });
}

await compressImage('photo.jpg', 'photo-small.jpg');
```

## Real Example: Git Operations

```javascript
const { exec } = require('child_process');
const { promisify } = require('util');
const execPromise = promisify(exec);

async function getGitStatus() {
  const { stdout } = await execPromise('git status');
  return stdout;
}

async function commitChanges(message) {
  await execPromise('git add .');
  await execPromise(`git commit -m "${message}"`);
}

const status = await getGitStatus();
console.log(status);
```

## Security Warning

```javascript
const userInput = req.query.filename;
exec(`cat ${userInput}`);
```

**Never do this!** User can inject: `file.txt; rm -rf /`

Safe version:

```javascript
const { spawn } = require('child_process');
const cat = spawn('cat', [userInput]);
```

## When to Use What

```
exec()   → Simple commands, small output
spawn()  → Large output, streaming data
fork()   → Heavy Node.js computations
```

## Key Takeaway

Child processes let you run external commands from Node.js. Use `spawn` for large outputs, `fork` for Node.js scripts, `exec` for simple commands. Always validate user input to prevent command injection.

Run shell commands and external programs from Node.js.

Child Processes in Node.js

# Streams in Node.js

Streams process data in chunks. Essential for handling large files without crashing your app.

## The Problem

```javascript
const fs = require('fs');

const data = fs.readFileSync('large-file.txt');
console.log(data);
```

If file is 1GB, this loads 1GB into memory. Your app crashes.

## The Solution: Streams

```javascript
const fs = require('fs');

const readStream = fs.createReadStream('large-file.txt');

readStream.on('data', (chunk) => {
  console.log(`Received ${chunk.length} bytes`);
});

readStream.on('end', () => {
  console.log('Finished reading');
});
```

Now it reads in small chunks (64KB by default). Memory usage stays low.

## Real Example: Copy File

```javascript
const fs = require('fs');

const readStream = fs.createReadStream('input.txt');
const writeStream = fs.createWriteStream('output.txt');

readStream.pipe(writeStream);

writeStream.on('finish', () => {
  console.log('File copied!');
});
```

## Real Example: Compress File

```javascript
const fs = require('fs');
const zlib = require('zlib');

fs.createReadStream('input.txt')
  .pipe(zlib.createGzip())
  .pipe(fs.createWriteStream('input.txt.gz'));
```

This compresses a file without loading it all into memory!

## Real Example: HTTP Response

```javascript
const express = require('express');
const fs = require('fs');
const app = express();

app.get('/download', (req, res) => {
  const fileStream = fs.createReadStream('large-video.mp4');
  
  res.setHeader('Content-Type', 'video/mp4');
  fileStream.pipe(res);
});

app.listen(3000);
```

Video starts playing immediately. No need to wait for full download.

## Transform Streams

```javascript
const { Transform } = require('stream');
const fs = require('fs');

const uppercase = new Transform({
  transform(chunk, encoding, callback) {
    this.push(chunk.toString().toUpperCase());
    callback();
  }
});

fs.createReadStream('input.txt')
  .pipe(uppercase)
  .pipe(fs.createWriteStream('output.txt'));
```

Converts text to uppercase while streaming.

## Error Handling

```javascript
const { pipeline } = require('stream');
const fs = require('fs');
const zlib = require('zlib');

pipeline(
  fs.createReadStream('input.txt'),
  zlib.createGzip(),
  fs.createWriteStream('input.txt.gz'),
  (err) => {
    if (err) {
      console.error('Pipeline failed:', err);
    } else {
      console.log('Pipeline succeeded');
    }
  }
);
```

`pipeline` handles errors automatically and cleans up streams.

## Types of Streams

```
Readable  → Read data (fs.createReadStream)
Writable  → Write data (fs.createWriteStream)
Duplex    → Both read and write (TCP socket)
Transform → Modify data while streaming (zlib.createGzip)
```

## Performance Comparison

```
Without Streams (1GB file):
- Memory: 1GB
- Time: 5 seconds
- Risk: Out of memory crash

With Streams (1GB file):
- Memory: 64KB
- Time: 5 seconds
- Risk: None
```

## Key Takeaway

Streams handle large data efficiently by processing in chunks. Use `createReadStream` for reading, `pipe` to connect streams, `pipeline` for error handling. Perfect for large files, videos, and real-time data.

Process large files efficiently with streams. Handle data in chunks instead of loading everything into memory.

Streams in Node.js

# EventEmitter Pattern

EventEmitter is the backbone of Node.js. Almost everything uses events internally.

## Basic Usage

```javascript
const EventEmitter = require('events');
const emitter = new EventEmitter();

emitter.on('userLoggedIn', (username) => {
  console.log(`${username} logged in`);
});

emitter.emit('userLoggedIn', 'john_doe');
```

**Output:** `john_doe logged in`

## Real Example: Order System

```javascript
const EventEmitter = require('events');

class OrderSystem extends EventEmitter {
  placeOrder(orderId, items) {
    console.log(`Processing order ${orderId}`);
    
    this.emit('orderPlaced', { orderId, items });
    
    setTimeout(() => {
      this.emit('orderShipped', { orderId });
    }, 2000);
  }
}

const orders = new OrderSystem();

orders.on('orderPlaced', (data) => {
  console.log('Order placed:', data);
});

orders.on('orderShipped', (data) => {
  console.log('Order shipped:', data);
});

orders.placeOrder('ORD-123', ['item1', 'item2']);
```

**Output:**
```
Processing order ORD-123
Order placed: { orderId: 'ORD-123', items: ['item1', 'item2'] }
Order shipped: { orderId: 'ORD-123' }
```

## Real Example: File Upload Progress

```javascript
const EventEmitter = require('events');
const fs = require('fs');

class FileUploader extends EventEmitter {
  upload(filePath) {
    const stats = fs.statSync(filePath);
    const totalSize = stats.size;
    let uploaded = 0;
    
    const stream = fs.createReadStream(filePath);
    
    stream.on('data', (chunk) => {
      uploaded += chunk.length;
      const progress = (uploaded / totalSize) * 100;
      this.emit('progress', progress.toFixed(2));
    });
    
    stream.on('end', () => {
      this.emit('complete');
    });
  }
}

const uploader = new FileUploader();

uploader.on('progress', (percent) => {
  console.log(`Uploaded: ${percent}%`);
});

uploader.on('complete', () => {
  console.log('Upload complete!');
});

uploader.upload('large-file.zip');
```

## One-Time Listeners

```javascript
emitter.once('startup', () => {
  console.log('App started');
});

emitter.emit('startup');
emitter.emit('startup');
```

**Output:** `App started` (only once)

## Error Handling

```javascript
emitter.on('error', (err) => {
  console.error('Error occurred:', err);
});

emitter.emit('error', new Error('Something went wrong'));
```

**Important:** If you don't handle `error` events, Node.js will crash!

## Remove Listeners

```javascript
function onData(data) {
  console.log(data);
}

emitter.on('data', onData);

emitter.off('data', onData);
```

## Multiple Listeners

```javascript
emitter.on('userLoggedIn', () => {
  console.log('Send welcome email');
});

emitter.on('userLoggedIn', () => {
  console.log('Update last login time');
});

emitter.on('userLoggedIn', () => {
  console.log('Log analytics event');
});

emitter.emit('userLoggedIn');
```

All three listeners execute when event fires.

## Key Takeaway

EventEmitter enables loose coupling between components. Extend EventEmitter for custom classes. Always handle `error` events. Remove listeners when done to prevent memory leaks.

Build event-driven applications with EventEmitter. Learn the observer pattern in Node.js.

EventEmitter Pattern

# Buffers in Node.js

Buffers handle raw binary data. Think of them as arrays of bytes.

## Creating Buffers

```javascript
const buf1 = Buffer.from('Hello World');
console.log(buf1);

const buf2 = Buffer.alloc(10);

const buf3 = Buffer.from([72, 101, 108, 108, 111]);
console.log(buf3.toString());
```

**Output:**
```
<Buffer 48 65 6c 6c 6f 20 57 6f 72 6c 64>
Hello
```

## Encoding Conversions

```javascript
const text = 'Hello World';
const buf = Buffer.from(text, 'utf8');

const base64 = buf.toString('base64');
console.log(base64);

const decoded = Buffer.from(base64, 'base64').toString('utf8');
console.log(decoded);
```

**Output:**
```
SGVsbG8gV29ybGQ=
Hello World
```

## Real Example: Image to Base64

```javascript
const fs = require('fs');

const imageBuffer = fs.readFileSync('photo.jpg');

const base64Image = imageBuffer.toString('base64');

const dataURI = `data:image/jpeg;base64,${base64Image}`;

console.log(dataURI);
```

Use this to embed images in HTML or send via API.

## Real Example: Check File Type

```javascript
const fs = require('fs');

const buffer = fs.readFileSync('unknown-file');

if (buffer[0] === 0xFF && buffer[1] === 0xD8) {
  console.log('This is a JPEG file');
} else if (buffer[0] === 0x89 && buffer[1] === 0x50) {
  console.log('This is a PNG file');
} else if (buffer[0] === 0x47 && buffer[1] === 0x49) {
  console.log('This is a GIF file');
}
```

Every file type has a unique signature (magic bytes).

## Buffer Operations

```javascript
const buf = Buffer.from('Hello');

console.log(buf.length);

console.log(buf[0]);

buf[0] = 74;
console.log(buf.toString());

const slice = buf.slice(0, 2);
console.log(slice.toString());
```

**Output:**
```
5
72
Jello
Je
```

## Concatenate Buffers

```javascript
const buf1 = Buffer.from('Hello ');
const buf2 = Buffer.from('World');

const combined = Buffer.concat([buf1, buf2]);
console.log(combined.toString());
```

**Output:** `Hello World`

## Real Example: File Upload

```javascript
const express = require('express');
const multer = require('multer');
const app = express();

const upload = multer({ storage: multer.memoryStorage() });

app.post('/upload', upload.single('file'), (req, res) => {
  const buffer = req.file.buffer;
  
  const base64 = buffer.toString('base64');
  
  res.json({
    filename: req.file.originalname,
    size: buffer.length,
    base64: base64.substring(0, 100) + '...'
  });
});

app.listen(3000);
```

## Key Takeaway

Buffers handle binary data like images, files, and network packets. Use `Buffer.from()` to create, `toString()` to convert. Essential for file operations and working with binary protocols.

Handle binary data with Buffers. Essential for files, images, and network protocols.

Working with Buffers

# URL Parsing

Parse and manipulate URLs with the URL class.

## Parsing URLs

```javascript
const myURL = new URL('https://example.com:8080/path?name=john&age=30#section');

console.log(myURL.protocol);
console.log(myURL.hostname);
console.log(myURL.port);
console.log(myURL.pathname);
console.log(myURL.search);
console.log(myURL.hash);
```

**Output:**
```
https:
example.com
8080
/path
?name=john&age=30
#section
```

## Query Parameters

```javascript
const url = new URL('https://api.example.com/users?role=admin&status=active');

console.log(url.searchParams.get('role'));
console.log(url.searchParams.get('status'));

url.searchParams.append('limit', '10');

url.searchParams.set('role', 'user');

url.searchParams.delete('status');

console.log(url.toString());
```

**Output:**
```
admin
active
https://api.example.com/users?role=user&limit=10
```

## Building URLs

```javascript
const apiURL = new URL('/api/users', 'https://example.com');
apiURL.searchParams.set('page', '1');
apiURL.searchParams.set('limit', '20');

console.log(apiURL.toString());
```

**Output:** `https://example.com/api/users?page=1&limit=20`

## Real Example: API Client

```javascript
function fetchUsers(filters) {
  const url = new URL('https://api.example.com/users');
  
  if (filters.role) {
    url.searchParams.set('role', filters.role);
  }
  
  if (filters.page) {
    url.searchParams.set('page', filters.page);
  }
  
  if (filters.limit) {
    url.searchParams.set('limit', filters.limit);
  }
  
  return fetch(url.toString());
}

fetchUsers({ role: 'admin', page: 2, limit: 50 });
```

## Real Example: Express Routes

```javascript
const express = require('express');
const app = express();

app.get('/search', (req, res) => {
  const query = req.query.q;
  const page = parseInt(req.query.page) || 1;
  const limit = parseInt(req.query.limit) || 10;
  
  const nextURL = new URL(req.originalUrl, `http://${req.headers.host}`);
  nextURL.searchParams.set('page', page + 1);
  
  res.json({
    results: [],
    nextPage: nextURL.toString()
  });
});

app.listen(3000);
```

## URLSearchParams Standalone

```javascript
const params = new URLSearchParams();
params.append('name', 'John Doe');
params.append('email', 'john@example.com');

console.log(params.toString());

for (const [key, value] of params) {
  console.log(`${key}: ${value}`);
}
```

**Output:**
```
name=John+Doe&email=john%40example.com
name: John Doe
email: john@example.com
```

## Key Takeaway

URL class makes parsing easy. Use `searchParams` for query strings. Build URLs programmatically. Automatically handles encoding.

Parse and build URLs in Node.js. Handle query parameters easily.

URL Parsing and Manipulation

# Process and Environment Variables

The `process` object provides runtime information about your Node.js app.

## Environment Variables

```javascript
const dbHost = process.env.DB_HOST || 'localhost';
const port = process.env.PORT || 3000;
const nodeEnv = process.env.NODE_ENV || 'development';

console.log(`Running in ${nodeEnv} mode`);
console.log(`Database: ${dbHost}`);
console.log(`Port: ${port}`);
```

## Using .env Files

```bash
npm install dotenv
```

```
# .env
DB_HOST=localhost
DB_USER=admin
DB_PASS=secret123
PORT=3000
```

```javascript
require('dotenv').config();

const dbConfig = {
  host: process.env.DB_HOST,
  user: process.env.DB_USER,
  password: process.env.DB_PASS
};
```

## Process Information

```javascript
console.log(process.version);
console.log(process.platform);
console.log(process.arch);
console.log(process.cwd());
console.log(process.pid);
console.log(process.uptime());
```

**Output:**
```
v18.17.0
linux
x64
/home/user/project
12345
45.234
```

## Memory Usage

```javascript
const used = process.memoryUsage();

console.log({
  rss: `${Math.round(used.rss / 1024 / 1024)} MB`,
  heapUsed: `${Math.round(used.heapUsed / 1024 / 1024)} MB`,
  heapTotal: `${Math.round(used.heapTotal / 1024 / 1024)} MB`
});
```

## Real Example: Health Check

```javascript
const express = require('express');
const app = express();

app.get('/health', (req, res) => {
  const health = {
    uptime: process.uptime(),
    timestamp: Date.now(),
    memory: process.memoryUsage(),
    version: process.version,
    status: 'ok'
  };
  
  res.json(health);
});

app.listen(3000);
```

## Graceful Shutdown

```javascript
const express = require('express');
const mongoose = require('mongoose');
const app = express();

const server = app.listen(3000);

process.on('SIGTERM', () => {
  console.log('SIGTERM received, closing server...');
  
  server.close(() => {
    console.log('Server closed');
    
    mongoose.connection.close(false, () => {
      console.log('MongoDB closed');
      process.exit(0);
    });
  });
});
```

## Command Line Arguments

```javascript
console.log(process.argv);
```

```bash
node app.js --port 3000 --env production
```

**Output:**
```
[
  '/usr/bin/node',
  '/path/to/app.js',
  '--port',
  '3000',
  '--env',
  'production'
]
```

## Exit Process

```javascript
if (!process.env.API_KEY) {
  console.error('API_KEY is required');
  process.exit(1);
}
```

## Key Takeaway

Use `process.env` for configuration. Monitor memory with `memoryUsage()`. Handle `SIGTERM` for graceful shutdown. Use dotenv for environment variables.

Access system information and environment variables. Monitor your app health.

Process and Environment Variables

# Crypto and Security

Node.js has built-in crypto module for security operations.

## Hashing with SHA-256

```javascript
const crypto = require('crypto');

const hash = crypto.createHash('sha256');
hash.update('my secret data');
const digest = hash.digest('hex');

console.log(digest);
```

**Output:** `a1b2c3d4e5f6...` (64 character hex string)

## Password Hashing with bcrypt

```bash
npm install bcrypt
```

```javascript
const bcrypt = require('bcrypt');

async function hashPassword(password) {
  const saltRounds = 10;
  const hash = await bcrypt.hash(password, saltRounds);
  return hash;
}

async function verifyPassword(password, hash) {
  const match = await bcrypt.compare(password, hash);
  return match;
}

const hashed = await hashPassword('myPassword123');
console.log(hashed);

const isValid = await verifyPassword('myPassword123', hashed);
console.log(isValid);
```

**Output:**
```
$2b$10$N9qo8uLOickgx2ZMRZoMye...
true
```

## Generate Random Tokens

```javascript
const crypto = require('crypto');

const token = crypto.randomBytes(32).toString('hex');
console.log(token);

const { randomUUID } = require('crypto');
const id = randomUUID();
console.log(id);
```

**Output:**
```
a1b2c3d4e5f6...
a1b2c3d4-e5f6-7890-abcd-ef1234567890
```

## Real Example: Password Reset Token

```javascript
const crypto = require('crypto');

function generateResetToken() {
  const token = crypto.randomBytes(32).toString('hex');
  
  const hash = crypto
    .createHash('sha256')
    .update(token)
    .digest('hex');
  
  return {
    token,
    hash
  };
}

const { token, hash } = generateResetToken();

console.log('Send to user:', token);
console.log('Store in DB:', hash);
```

## HMAC for Message Authentication

```javascript
const crypto = require('crypto');

const secret = 'my-secret-key';
const message = 'important data';

const hmac = crypto.createHmac('sha256', secret);
hmac.update(message);
const signature = hmac.digest('hex');

console.log(signature);
```

Use HMAC to verify data hasn't been tampered with.

## Encryption and Decryption

```javascript
const crypto = require('crypto');

const algorithm = 'aes-256-cbc';
const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(16);

function encrypt(text) {
  const cipher = crypto.createCipheriv(algorithm, key, iv);
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return encrypted;
}

function decrypt(encrypted) {
  const decipher = crypto.createDecipheriv(algorithm, key, iv);
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

const encrypted = encrypt('secret message');
console.log('Encrypted:', encrypted);

const decrypted = decrypt(encrypted);
console.log('Decrypted:', decrypted);
```

## Real Example: User Registration

```javascript
const express = require('express');
const bcrypt = require('bcrypt');
const app = express();

app.use(express.json());

app.post('/register', async (req, res) => {
  const { email, password } = req.body;
  
  const hashedPassword = await bcrypt.hash(password, 10);
  
  await User.create({
    email,
    password: hashedPassword
  });
  
  res.json({ message: 'User created' });
});

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  
  const user = await User.findOne({ email });
  
  if (!user) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  const isValid = await bcrypt.compare(password, user.password);
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  res.json({ message: 'Logged in' });
});

app.listen(3000);
```

## Key Takeaway

Use bcrypt for passwords, never plain hashing. Generate secure tokens with `randomBytes`. HMAC for message authentication. Store encryption keys securely, never in code.

Hash passwords, encrypt data, and generate secure tokens.

Crypto and Hashing

# Building CLI Tools

Node.js is perfect for creating command-line tools.

## Basic CLI Script

```javascript
#!/usr/bin/env node

console.log('Hello from CLI!');
```

```bash
chmod +x cli.js
./cli.js
```

## Parsing Arguments with Commander

```bash
npm install commander
```

```javascript
#!/usr/bin/env node
const { program } = require('commander');

program
  .name('my-tool')
  .description('A useful CLI tool')
  .version('1.0.0');

program
  .command('create <name>')
  .description('Create a new project')
  .option('-t, --template <type>', 'Template type', 'basic')
  .action((name, options) => {
    console.log(`Creating project: ${name}`);
    console.log(`Template: ${options.template}`);
  });

program
  .command('list')
  .description('List all projects')
  .action(() => {
    console.log('Listing projects...');
  });

program.parse();
```

**Usage:**
```bash
my-tool create my-app --template react
my-tool list
```

## Adding Colors

```bash
npm install chalk
```

```javascript
const chalk = require('chalk');

console.log(chalk.green('✓ Success!'));
console.log(chalk.red('✗ Error occurred'));
console.log(chalk.yellow('⚠ Warning'));
console.log(chalk.blue('ℹ Info'));
```

## Interactive Prompts

```bash
npm install inquirer
```

```javascript
const inquirer = require('inquirer');

async function getUserInput() {
  const answers = await inquirer.prompt([
    {
      type: 'input',
      name: 'projectName',
      message: 'Project name:',
      default: 'my-app'
    },
    {
      type: 'list',
      name: 'template',
      message: 'Choose template:',
      choices: ['React', 'Vue', 'Express']
    },
    {
      type: 'confirm',
      name: 'installDeps',
      message: 'Install dependencies?',
      default: true
    }
  ]);
  
  return answers;
}

const config = await getUserInput();
console.log(config);
```

## Progress Indicators

```bash
npm install ora
```

```javascript
const ora = require('ora');

const spinner = ora('Installing packages...').start();

setTimeout(() => {
  spinner.succeed('Packages installed!');
}, 3000);
```

## Real Example: Project Generator

```javascript
#!/usr/bin/env node
const { program } = require('commander');
const inquirer = require('inquirer');
const chalk = require('chalk');
const ora = require('ora');
const fs = require('fs');

program
  .command('create <name>')
  .action(async (name) => {
    const answers = await inquirer.prompt([
      {
        type: 'list',
        name: 'template',
        message: 'Choose template:',
        choices: ['React', 'Vue', 'Express']
      }
    ]);
    
    const spinner = ora('Creating project...').start();
    
    fs.mkdirSync(name);
    fs.writeFileSync(`${name}/package.json`, JSON.stringify({
      name,
      version: '1.0.0',
      template: answers.template
    }, null, 2));
    
    spinner.succeed(chalk.green(`Project ${name} created!`));
  });

program.parse();
```

## Publishing to npm

```json
{
  "name": "my-cli-tool",
  "version": "1.0.0",
  "bin": {
    "my-tool": "./cli.js"
  },
  "dependencies": {
    "commander": "^11.0.0",
    "chalk": "^5.3.0"
  }
}
```

```bash
npm publish

npm install -g my-cli-tool

my-tool create my-app
```

## Key Takeaway

Use commander for arguments, chalk for colors, inquirer for prompts, ora for spinners. Add shebang and bin field in package.json. Publish to npm for global installation.

Create command-line tools with Node.js. Learn argument parsing and colors.

Building CLI Tools

# GraphQL with Apollo Server

GraphQL lets clients request exactly what they need. No over-fetching or under-fetching.

## Setup

```bash
npm install apollo-server graphql
```

## Basic Server

```javascript
const { ApolloServer, gql } = require('apollo-server');

const typeDefs = gql`
  type User {
    id: ID!
    name: String!
    email: String!
  }
  
  type Query {
    users: [User!]!
    user(id: ID!): User
  }
`;

const users = [
  { id: '1', name: 'John', email: 'john@example.com' },
  { id: '2', name: 'Jane', email: 'jane@example.com' }
];

const resolvers = {
  Query: {
    users: () => users,
    user: (parent, { id }) => users.find(u => u.id === id)
  }
};

const server = new ApolloServer({ typeDefs, resolvers });

server.listen().then(({ url }) => {
  console.log(`Server ready at ${url}`);
});
```

## Example Queries

```graphql
query {
  users {
    id
    name
  }
}

query {
  user(id: "1") {
    name
    email
  }
}
```

## Mutations

```javascript
const typeDefs = gql`
  type User {
    id: ID!
    name: String!
    email: String!
  }
  
  type Query {
    users: [User!]!
  }
  
  type Mutation {
    createUser(name: String!, email: String!): User!
    deleteUser(id: ID!): Boolean!
  }
`;

const resolvers = {
  Query: {
    users: () => users
  },
  
  Mutation: {
    createUser: (parent, { name, email }) => {
      const user = {
        id: String(users.length + 1),
        name,
        email
      };
      users.push(user);
      return user;
    },
    
    deleteUser: (parent, { id }) => {
      const index = users.findIndex(u => u.id === id);
      if (index === -1) return false;
      users.splice(index, 1);
      return true;
    }
  }
};
```

**Usage:**
```graphql
mutation {
  createUser(name: "Bob", email: "bob@example.com") {
    id
    name
  }
}
```

## Real Example: Blog API

```javascript
const { ApolloServer, gql } = require('apollo-server');

const typeDefs = gql`
  type Post {
    id: ID!
    title: String!
    content: String!
    author: User!
  }
  
  type User {
    id: ID!
    name: String!
    posts: [Post!]!
  }
  
  type Query {
    posts: [Post!]!
    post(id: ID!): Post
    users: [User!]!
  }
  
  type Mutation {
    createPost(title: String!, content: String!, authorId: ID!): Post!
  }
`;

const posts = [];
const users = [
  { id: '1', name: 'John' },
  { id: '2', name: 'Jane' }
];

const resolvers = {
  Query: {
    posts: () => posts,
    post: (parent, { id }) => posts.find(p => p.id === id),
    users: () => users
  },
  
  Mutation: {
    createPost: (parent, { title, content, authorId }) => {
      const post = {
        id: String(posts.length + 1),
        title,
        content,
        authorId
      };
      posts.push(post);
      return post;
    }
  },
  
  Post: {
    author: (post) => users.find(u => u.id === post.authorId)
  },
  
  User: {
    posts: (user) => posts.filter(p => p.authorId === user.id)
  }
};

const server = new ApolloServer({ typeDefs, resolvers });
server.listen();
```

## With Express

```javascript
const express = require('express');
const { ApolloServer } = require('apollo-server-express');

const app = express();

const server = new ApolloServer({ typeDefs, resolvers });

await server.start();
server.applyMiddleware({ app });

app.listen(4000, () => {
  console.log(`Server ready at http://localhost:4000${server.graphqlPath}`);
});
```

## Key Takeaway

GraphQL gives clients control over data shape. Define schema with types, implement resolvers for data fetching. Mutations for modifications. Apollo Server handles the complexity.

Build GraphQL APIs with Apollo Server. Learn schema and resolvers.

GraphQL with Apollo Server

# Message Queues with Bull

Background jobs are essential for time-consuming tasks. Bull makes it easy with Redis.

## Setup

```bash
npm install bull
```

Make sure Redis is running:
```bash
redis-server
```

## Basic Queue

```javascript
const Queue = require('bull');

const emailQueue = new Queue('email', {
  redis: {
    host: '127.0.0.1',
    port: 6379
  }
});

async function sendWelcomeEmail(userId, email) {
  await emailQueue.add({
    userId,
    email,
    type: 'welcome'
  });
}

emailQueue.process(async (job) => {
  const { userId, email, type } = job.data;
  
  console.log(`Sending ${type} email to ${email}`);
  
  await sendEmail(email);
  
  return { sent: true };
});

await sendWelcomeEmail(123, 'user@example.com');
```

**What happens:**
1. Job added to queue
2. Worker picks up job
3. Processes asynchronously
4. Main app continues without waiting

## Real Example: Image Processing

```javascript
const Queue = require('bull');
const sharp = require('sharp');

const imageQueue = new Queue('image-processing');

app.post('/upload', upload.single('image'), async (req, res) => {
  await imageQueue.add({
    filename: req.file.filename,
    path: req.file.path
  });
  
  res.json({ message: 'Processing started' });
});

imageQueue.process(async (job) => {
  const { path, filename } = job.data;
  
  await sharp(path)
    .resize(800, 600)
    .toFile(`uploads/resized-${filename}`);
  
  await sharp(path)
    .resize(200, 200)
    .toFile(`uploads/thumb-${filename}`);
  
  return { processed: true };
});
```

## Job Events

```javascript
emailQueue.on('completed', (job, result) => {
  console.log(`Job ${job.id} completed`, result);
});

emailQueue.on('failed', (job, err) => {
  console.error(`Job ${job.id} failed`, err);
});

emailQueue.on('progress', (job, progress) => {
  console.log(`Job ${job.id} is ${progress}% done`);
});
```

## Job Options

```javascript
await emailQueue.add(data, {
  attempts: 3,
  backoff: {
    type: 'exponential',
    delay: 2000
  }
});

await emailQueue.add(data, {
  delay: 5000
});

await emailQueue.add(data, {
  priority: 1
});

await emailQueue.add(data, {
  removeOnComplete: true,
  removeOnFail: false
});
```

## Scheduled Jobs

```javascript
await emailQueue.add(data, {
  repeat: {
    cron: '0 9 * * *'
  }
});

await emailQueue.add(data, {
  repeat: {
    every: 5 * 60 * 1000
  }
});
```

## Multiple Workers

```javascript
imageQueue.process(5, async (job) => {
  await processImage(job.data);
});
```

Processes 5 jobs concurrently.

## Key Takeaway

Bull handles background jobs with Redis. Add jobs to queue, process asynchronously. Automatic retries and scheduling. Perfect for emails, image processing, reports.

Handle background jobs with Bull and Redis. Process tasks asynchronously.

Message Queues with Bull

# WebSockets with Socket.io

## The Problem: HTTP is One-Way

Traditional HTTP works like this:

```
Client → Request → Server
Server → Response → Client
Connection CLOSED

Need new data? Make NEW request again!
```

**Problems with HTTP for real-time:**
- Server can't push data to client
- Client must keep asking (polling)
- Wastes bandwidth
- High latency
- Not efficient for real-time updates

**Example:** Chat app with HTTP polling
```
User A sends message → Server stores it
User B keeps asking: "Any new messages?" (every 1 second)
User B keeps asking: "Any new messages?" (every 1 second)
User B keeps asking: "Any new messages?" (every 1 second)
...wastes bandwidth, high latency
```

## What are WebSockets?

WebSocket is a communication protocol that creates a **persistent, bidirectional connection** between client and server.

```
Client ←→ WebSocket Connection ←→ Server
         (Stays Open!)

Both can send data anytime, without request!
```

**Key Features:**
- **Persistent connection** - Stays open until closed
- **Bidirectional** - Both client and server can send data
- **Low latency** - No HTTP overhead
- **Real-time** - Instant data transfer
- **Efficient** - No repeated connection setup

## How WebSockets Work

### Step 1: Handshake (Initial Connection)

```
Client → HTTP Request (Upgrade to WebSocket)
Server → HTTP Response (101 Switching Protocols)
Connection UPGRADED to WebSocket!
```

### Step 2: Persistent Connection

```
Client ←→ WebSocket ←→ Server
         (Connection stays open)

Client can send: "Hello Server!"
Server can send: "Hello Client!" (without request!)
Both can send anytime!
```

### Step 3: Data Transfer

```
Client sends: "User A: Hello"
Server receives: "User A: Hello"
Server broadcasts: "User A: Hello" to all clients
All clients receive instantly!
```

## Visual Comparison

### HTTP Polling (Old Way)
```
Time →
Client: Request? → Server: No data
Client: Request? → Server: No data  
Client: Request? → Server: Here's data!
Client: Request? → Server: No data
Client: Request? → Server: No data

Result: Wastes bandwidth, high latency
```

### WebSocket (New Way)
```
Time →
Client ←→ Server (Connection open)
Client: "Hello" → Server
Server: "Hi!" → Client (instant!)
Server: "New message!" → Client (instant!)
Client: "Thanks!" → Server

Result: Instant, efficient, real-time
```

## Benefits of WebSockets

### 1. Real-Time Communication
```
HTTP: Client asks → Server responds (1-2 seconds delay)
WebSocket: Server pushes → Client receives (instant!)
```

### 2. Lower Latency
```
HTTP: 
  - Connection setup: 100ms
  - Request: 50ms
  - Response: 50ms
  Total: 200ms per request

WebSocket:
  - Connection setup: 100ms (once)
  - Data transfer: 5ms
  Total: 105ms (first time), 5ms (after)
```

### 3. Reduced Bandwidth
```
HTTP Polling (1 request/second):
  - 1000 requests/hour
  - Each request: 500 bytes
  - Total: 500KB/hour

WebSocket:
  - 1 connection
  - Only send when needed
  - Total: 50KB/hour

90% bandwidth saved!
```

### 4. Server Can Push Data
```
HTTP: Server waits for client request
WebSocket: Server can send data anytime!

Example: Live notifications
Server: "You have a new message!" → Client
(No need for client to ask!)
```

### 5. Better for Real-Time Apps
- Chat applications
- Live notifications
- Collaborative editing
- Gaming
- Stock prices
- Live sports scores

## When to Use WebSockets

**✅ Use WebSockets When:**
- Real-time chat
- Live notifications
- Collaborative editing (Google Docs style)
- Live dashboards
- Gaming
- Stock trading apps
- Live sports scores
- Any app needing instant updates

**❌ Don't Use WebSockets When:**
- Simple CRUD operations
- One-time data fetching
- Static content
- Traditional web pages
- REST APIs work fine

## Socket.io: Making WebSockets Easy

Socket.io is a library that makes WebSockets easier to use:
- Automatic reconnection
- Fallback to HTTP polling if WebSocket fails
- Room management
- Broadcasting
- Event-based API

## Setup

```bash
npm install socket.io
```

## Basic Server

```javascript
const express = require('express');
const http = require('http');
const { Server } = require('socket.io');

const app = express();
const server = http.createServer(app);
const io = new Server(server);

io.on('connection', (socket) => {
  console.log(`User connected: ${socket.id}`);
  
  socket.on('chat message', (msg) => {
    console.log('Message:', msg);
    io.emit('chat message', msg);
  });
  
  socket.on('disconnect', () => {
    console.log(`User disconnected: ${socket.id}`);
  });
});

server.listen(3000);
```

**What happens:**
1. Client connects → `connection` event fires
2. Client sends message → `chat message` event received
3. Server broadcasts to all clients → `io.emit()`
4. Client disconnects → `disconnect` event fires

## Client Side

```html
<script src="/socket.io/socket.io.js"></script>
<script>
  const socket = io();
  
  socket.emit('chat message', 'Hello World!');
  
  socket.on('chat message', (msg) => {
    console.log('Received:', msg);
  });
</script>
```

## Real Example: Chat App

```javascript
const users = new Map();

io.on('connection', (socket) => {
  socket.on('join', (username) => {
    users.set(socket.id, username);
    socket.broadcast.emit('user joined', username);
    
    socket.emit('online users', Array.from(users.values()));
  });
  
  socket.on('chat message', (msg) => {
    const username = users.get(socket.id);
    io.emit('chat message', {
      username,
      message: msg,
      timestamp: new Date()
    });
  });
  
  socket.on('disconnect', () => {
    const username = users.get(socket.id);
    users.delete(socket.id);
    io.emit('user left', username);
  });
});
```

## Rooms (Group Communication)

```javascript
socket.on('join room', (roomName) => {
  socket.join(roomName);
  console.log(`${socket.id} joined ${roomName}`);
  
  io.to(roomName).emit('message', `Welcome to ${roomName}`);
});

socket.on('leave room', (roomName) => {
  socket.leave(roomName);
});

io.to('room1').emit('message', 'Room 1 only');

socket.broadcast.emit('message', 'Everyone except sender');
```

**Room Concept:**
```
All Users
├── Room 1 (Chat)
│   ├── User A
│   ├── User B
│   └── User C
├── Room 2 (Support)
│   ├── User D
│   └── User E
└── Room 3 (Gaming)
    ├── User F
    └── User G

Message to Room 1 → Only A, B, C receive
Message to Room 2 → Only D, E receive
```

## Authentication

```javascript
const io = new Server(server, {
  cors: {
    origin: 'http://localhost:3000',
    credentials: true
  }
});

io.use((socket, next) => {
  const token = socket.handshake.auth.token;
  
  if (isValidToken(token)) {
    socket.userId = getUserIdFromToken(token);
    next();
  } else {
    next(new Error('Authentication error'));
  }
});

const socket = io({
  auth: {
    token: 'user-token-here'
  }
});
```

## Real Example: Live Notifications

```javascript
app.post('/api/orders', async (req, res) => {
  const order = await Order.create(req.body);
  
  io.to(`user-${order.userId}`).emit('new-order', {
    orderId: order.id,
    message: 'Your order has been placed!'
  });
  
  res.json(order);
});

socket.on('connection', (socket) => {
  const userId = socket.userId;
  socket.join(`user-${userId}`);
});
```

**Flow:**
```
User places order → API creates order
Server sends notification via WebSocket
User receives notification instantly!
(No need to refresh page or poll)
```

## WebSocket vs HTTP Comparison

| Feature | HTTP | WebSocket |
|---------|------|-----------|
| Connection | New each time | Persistent |
| Direction | Client → Server | Bidirectional |
| Latency | High (200ms+) | Low (5ms) |
| Server Push | No | Yes |
| Overhead | High | Low |
| Real-time | No | Yes |
| Use Case | CRUD, APIs | Chat, Live updates |

## Performance Benefits

**HTTP Polling (1 request/second):**
```
Requests: 3600/hour
Bandwidth: 500KB/hour
CPU: High (handling requests)
Latency: 1-2 seconds
```

**WebSocket:**
```
Connections: 1 persistent
Bandwidth: 50KB/hour
CPU: Low (just data transfer)
Latency: < 50ms
```

**Result:** 90% less bandwidth, 95% less latency!

## Common Use Cases

**1. Chat Applications**
- WhatsApp, Telegram, Slack
- Instant message delivery
- Typing indicators
- Online status

**2. Live Notifications**
- Facebook notifications
- Email alerts
- Order updates
- System alerts

**3. Collaborative Editing**
- Google Docs
- Multiple users editing
- Real-time cursor positions
- Live changes

**4. Gaming**
- Multiplayer games
- Real-time player positions
- Instant actions
- Live scores

**5. Live Dashboards**
- Stock prices
- Analytics
- Monitoring
- Real-time metrics

## Key Takeaway

WebSockets enable real-time bidirectional communication. Server can push data without client request. Much faster and efficient than HTTP polling. Perfect for chat, notifications, collaborative editing, gaming. Socket.io makes WebSockets easy with automatic reconnection and room management. Use WebSockets when you need real-time updates, use HTTP for traditional CRUD operations.

Master WebSockets for real-time applications. Understand bidirectional communication, benefits over HTTP, and build chat apps, live notifications, and collaborative features.

# Template Engines

Generate dynamic HTML on the server. Good for SEO and initial page load.

## EJS (Embedded JavaScript)

```bash
npm install ejs
```

```javascript
const express = require('express');
const app = express();

app.set('view engine', 'ejs');
app.set('views', './views');

app.get('/user/:name', (req, res) => {
  res.render('profile', {
    username: req.params.name,
    age: 25,
    hobbies: ['coding', 'reading', 'gaming']
  });
});

app.listen(3000);
```

```html

<!DOCTYPE html>
<html>
<head>
  <title><%= username %>'s Profile</title>
</head>
<body>
  <h1>Welcome, <%= username %>!</h1>
  <p>Age: <%= age %></p>
  
  <h2>Hobbies:</h2>
  <ul>
    <% hobbies.forEach(hobby => { %>
      <li><%= hobby %></li>
    <% }); %>
  </ul>
  
  <% if (age >= 18) { %>
    <p>You are an adult</p>
  <% } %>
</body>
</html>
```

## Pug (formerly Jade)

```bash
npm install pug
```

```javascript
app.set('view engine', 'pug');

app.get('/products', (req, res) => {
  res.render('products', {
    title: 'Our Products',
    products: [
      { name: 'Laptop', price: 999 },
      { name: 'Phone', price: 699 }
    ]
  });
});
```

```pug
//- views/products.pug
doctype html
html
  head
    title= title
  body
    h1= title
    
    each product in products
      .product
        h2= product.name
        p Price: $#{product.price}
    
    if products.length === 0
      p No products available
```

## Partials (EJS)

```html

<header>
  <nav>
    <a href="/">Home</a>
    <a href="/about">About</a>
  </nav>
</header>


<!DOCTYPE html>
<html>
<body>
  <%- include('partials/header') %>
  
  <main>
    <h1>Welcome Home</h1>
  </main>
  
  <%- include('partials/footer') %>
</body>
</html>
```

## Real Example: Blog

```javascript
app.get('/blog', async (req, res) => {
  const posts = await Post.find().sort({ date: -1 });
  
  res.render('blog', {
    title: 'My Blog',
    posts
  });
});
```

```html

<!DOCTYPE html>
<html>
<head>
  <title><%= title %></title>
</head>
<body>
  <h1><%= title %></h1>
  
  <% posts.forEach(post => { %>
    <article>
      <h2><%= post.title %></h2>
      <p><%= post.excerpt %></p>
      <a href="/blog/<%= post.slug %>">Read more</a>
    </article>
  <% }); %>
</body>
</html>
```

## Key Takeaway

EJS uses JavaScript syntax, Pug uses indentation. Use partials for reusable components. Good for blogs, dashboards, landing pages. For complex UIs, consider React/Vue.

Render dynamic HTML with template engines. Learn EJS and Pug.

Template Engines: EJS and Pug

# Sessions and Cookies

## The Problem: HTTP is Stateless

HTTP doesn't remember who you are. Every request is independent.

```
Request 1: Login as John
Request 2: View profile → Server doesn't know you're John!
Request 3: Add to cart → Server doesn't know you're John!
```

We need a way to track users across requests. Two solutions: **Cookies** and **Sessions**.

## What are Cookies?

Cookies are small pieces of data stored in the browser. Server sends cookies, browser sends them back with every request.

```
Browser → Request → Server
Server → Response + Set-Cookie: username=john
Browser stores: username=john

Next request:
Browser → Request + Cookie: username=john → Server
Server knows: This is John!
```

**Cookies live in the browser.** Anyone can see and modify them.

## What are Sessions?

Sessions store data on the server. Only a session ID is stored in a cookie.

```
Browser → Login → Server
Server creates session:
  sessionId: abc123
  userId: 42
  email: john@example.com

Server → Response + Set-Cookie: sessionId=abc123
Browser stores: sessionId=abc123

Next request:
Browser → Request + Cookie: sessionId=abc123 → Server
Server looks up session abc123 → Finds userId: 42
Server knows: This is user 42 (John)!
```

**Session data lives on server.** More secure than cookies.

## Cookies vs Sessions

```
Cookies:
✅ Simple to implement
✅ No server storage needed
❌ Limited size (4KB)
❌ Visible to user
❌ Can be modified by user
❌ Sent with every request (bandwidth)

Sessions:
✅ Unlimited data size
✅ Data hidden from user
✅ More secure
✅ Only session ID sent
❌ Requires server storage
❌ More complex setup
```

## Basic Cookies

```bash
npm install cookie-parser
```

```javascript
const express = require('express');
const cookieParser = require('cookie-parser');

const app = express();
app.use(cookieParser());

app.get('/set-cookie', (req, res) => {
  res.cookie('username', 'john', {
    maxAge: 900000,
    httpOnly: true,
    secure: true,
    sameSite: 'strict'
  });
  res.send('Cookie set');
});

app.get('/get-cookie', (req, res) => {
  const username = req.cookies.username;
  res.send(`Username: ${username}`);
});

app.listen(3000);
```

**Cookie Options Explained:**
- `maxAge`: How long cookie lives (milliseconds)
- `httpOnly`: JavaScript can't access it (prevents XSS attacks)
- `secure`: Only sent over HTTPS
- `sameSite`: Prevents CSRF attacks

## Sessions with express-session

```bash
npm install express-session connect-redis redis
```

```javascript
const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient();
redisClient.connect();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: 'your-secret-key',
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,
    httpOnly: true,
    maxAge: 1000 * 60 * 60 * 24
  }
}));
```

**Why Redis?** In-memory storage is fast. Sessions need quick access.

**Session Options:**
- `secret`: Signs session ID (prevents tampering)
- `resave`: Don't save if nothing changed
- `saveUninitialized`: Don't save empty sessions

## Complete Login System

```javascript
const bcrypt = require('bcrypt');

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  
  const user = await User.findOne({ email });
  
  if (!user) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  const isValid = await bcrypt.compare(password, user.password);
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  req.session.regenerate((err) => {
    if (err) return res.status(500).json({ error: 'Session error' });
    
    req.session.userId = user._id;
    req.session.email = user.email;
    req.session.role = user.role;
    
    res.json({ 
      message: 'Logged in successfully',
      user: {
        id: user._id,
        email: user.email,
        name: user.name
      }
    });
  });
});

app.get('/dashboard', (req, res) => {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  
  res.json({
    message: 'Welcome to dashboard',
    userId: req.session.userId,
    email: req.session.email
  });
});

app.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    if (err) return res.status(500).json({ error: 'Logout failed' });
    
    res.clearCookie('connect.sid');
    res.json({ message: 'Logged out successfully' });
  });
});
```

**Why `regenerate()`?** Creates new session ID after login. Prevents session fixation attacks.

## Auth Middleware

```javascript
function requireAuth(req, res, next) {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Authentication required' });
  }
  next();
}

function requireAdmin(req, res, next) {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Authentication required' });
  }
  
  if (req.session.role !== 'admin') {
    return res.status(403).json({ error: 'Admin access required' });
  }
  
  next();
}

app.get('/profile', requireAuth, async (req, res) => {
  const user = await User.findById(req.session.userId);
  res.json(user);
});

app.get('/admin/users', requireAdmin, async (req, res) => {
  const users = await User.find();
  res.json(users);
});
```

## Remember Me Feature

```javascript
app.post('/login', async (req, res) => {
  const { email, password, rememberMe } = req.body;
  
  if (rememberMe) {
    req.session.cookie.maxAge = 1000 * 60 * 60 * 24 * 30;
  } else {
    req.session.cookie.maxAge = 1000 * 60 * 60 * 24;
  }
  
  res.json({ message: 'Logged in' });
});
```

**Without Remember Me:** Session expires in 24 hours
**With Remember Me:** Session expires in 30 days

## Best Practices

**1. Always use HTTPS in production**
```javascript
cookie: {
  secure: process.env.NODE_ENV === 'production'
}
```

**2. Store sessions in Redis, not memory**
```javascript
store: new RedisStore({ client: redisClient })
```

**3. Regenerate session ID after login**
```javascript
req.session.regenerate((err) => {
  req.session.userId = user._id;
});
```

**4. Set httpOnly flag**
```javascript
cookie: {
  httpOnly: true
}
```

**5. Never store passwords in sessions**
```javascript
req.session.userId = user._id;
```

## Common Mistakes

❌ **Storing sensitive data in cookies**
```javascript
res.cookie('password', user.password);
```

✅ **Store only session ID**
```javascript
req.session.userId = user._id;
```

❌ **Not using HTTPS**
```javascript
cookie: { secure: false }
```

✅ **Always use HTTPS in production**
```javascript
cookie: { secure: true }
```

## Key Takeaway

Sessions store data on server (secure). Cookies store data in browser (less secure). Use express-session with Redis for production. Always regenerate session ID after login. Set httpOnly and secure flags. Sessions are perfect for authentication because data stays on server where users can't tamper with it.

Understand how sessions and cookies work. Build secure authentication systems.

Sessions and Cookies

# Stripe Payment Integration

Accept payments securely with Stripe.

## Setup

```bash
npm install stripe
```

```javascript
const stripe = require('stripe')('sk_test_your_secret_key');
```

## Create Payment Intent

```javascript
const express = require('express');
const app = express();

app.use(express.json());

app.post('/create-payment-intent', async (req, res) => {
  const { amount } = req.body;
  
  try {
    const paymentIntent = await stripe.paymentIntents.create({
      amount: amount,
      currency: 'usd',
      payment_method_types: ['card'],
      metadata: {
        orderId: 'order_123'
      }
    });
    
    res.json({
      clientSecret: paymentIntent.client_secret
    });
  } catch (error) {
    res.status(500).json({ error: error.message });
  }
});

app.listen(3000);
```

## Client Side (React)

```javascript
import { loadStripe } from '@stripe/stripe-js';
import { CardElement, useStripe, useElements } from '@stripe/react-stripe-js';

const stripePromise = loadStripe('pk_test_your_publishable_key');

function CheckoutForm() {
  const stripe = useStripe();
  const elements = useElements();
  
  const handleSubmit = async (e) => {
    e.preventDefault();
    
    const { clientSecret } = await fetch('/create-payment-intent', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ amount: 5000 })
    }).then(r => r.json());
    
    const { error, paymentIntent } = await stripe.confirmCardPayment(
      clientSecret,
      {
        payment_method: {
          card: elements.getElement(CardElement)
        }
      }
    );
    
    if (error) {
      console.error(error.message);
    } else if (paymentIntent.status === 'succeeded') {
      console.log('Payment successful!');
    }
  };
  
  return (
    <form onSubmit={handleSubmit}>
      <CardElement />
      <button type="submit" disabled={!stripe}>Pay</button>
    </form>
  );
}
```

## Webhooks

```javascript
app.post('/webhook', 
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const sig = req.headers['stripe-signature'];
    const webhookSecret = 'whsec_your_webhook_secret';
    
    let event;
    
    try {
      event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
    } catch (err) {
      return res.status(400).send(\`Webhook Error: \${err.message}\`);
    }
    
    switch (event.type) {
      case 'payment_intent.succeeded':
        const paymentIntent = event.data.object;
        console.log('Payment succeeded:', paymentIntent.id);
        await updateOrderStatus(paymentIntent.metadata.orderId, 'paid');
        break;
        
      case 'payment_intent.payment_failed':
        console.log('Payment failed');
        break;
    }
    
    res.json({ received: true });
  }
);
```

## Subscriptions

```javascript
app.post('/create-subscription', async (req, res) => {
  const { customerId, priceId } = req.body;
  
  try {
    const subscription = await stripe.subscriptions.create({
      customer: customerId,
      items: [{ price: priceId }],
      payment_behavior: 'default_incomplete',
      expand: ['latest_invoice.payment_intent']
    });
    
    res.json({
      subscriptionId: subscription.id,
      clientSecret: subscription.latest_invoice.payment_intent.client_secret
    });
  } catch (error) {
    res.status(500).json({ error: error.message });
  }
});
```

## Key Takeaway

Never expose secret keys. Verify amounts server-side. Use webhooks for payment confirmations. Test with Stripe test cards. Handle errors gracefully. Always use HTTPS in production.

Accept payments with Stripe. Handle webhooks and subscriptions.

Payment Integration with Stripe

# Sending Emails with Nodemailer

## Why Send Emails from Node.js?

Common use cases:
- Welcome emails after signup
- Password reset links
- Order confirmations
- Notifications
- Reports

## Setup

```bash
npm install nodemailer
```

```javascript
const nodemailer = require('nodemailer');

const transporter = nodemailer.createTransporter({
  host: 'smtp.gmail.com',
  port: 587,
  secure: false,
  auth: {
    user: 'your-email@gmail.com',
    pass: 'your-app-password'
  }
});
```

**Note:** Use App Password, not regular Gmail password.

## Send Basic Email

```javascript
async function sendEmail() {
  await transporter.sendMail({
    from: '"Your Name" <your-email@gmail.com>',
    to: 'recipient@example.com',
    subject: 'Hello from Node.js',
    text: 'Plain text content',
    html: '<b>HTML content</b>'
  });
}
```

## Real Example: Welcome Email

```javascript
async function sendWelcomeEmail(user) {
  const html = `
    <h1>Welcome, ${user.name}!</h1>
    <p>Thank you for signing up.</p>
    <a href="https://example.com/verify?token=${user.verifyToken}">
      Verify Email
    </a>
  `;
  
  await transporter.sendMail({
    from: '"MyApp" <noreply@example.com>',
    to: user.email,
    subject: 'Welcome to MyApp',
    html
  });
}
```

## Real Example: Password Reset

```javascript
async function sendPasswordReset(user, resetToken) {
  const resetURL = `https://example.com/reset-password?token=${resetToken}`;
  
  const html = `
    <h2>Password Reset Request</h2>
    <p>Click the link below to reset your password:</p>
    <a href="${resetURL}">Reset Password</a>
    <p>This link expires in 1 hour.</p>
  `;
  
  await transporter.sendMail({
    to: user.email,
    subject: 'Password Reset',
    html
  });
}
```

## Queue Emails (Production)

```javascript
const Queue = require('bull');
const emailQueue = new Queue('email');

async function queueEmail(to, subject, html) {
  await emailQueue.add({ to, subject, html });
}

emailQueue.process(async (job) => {
  const { to, subject, html } = job.data;
  
  await transporter.sendMail({
    from: 'noreply@example.com',
    to,
    subject,
    html
  });
});

await queueEmail('user@example.com', 'Welcome', '<h1>Welcome!</h1>');
```

**Why queue?** Don't block HTTP response waiting for email to send.

## Key Takeaway

Use Nodemailer for sending emails. Queue emails in production for reliability. Use HTML templates for better design. Always handle errors. Consider services like SendGrid for high volume.

Send emails from Node.js with Nodemailer. Learn SMTP and email templates.

# Scheduled Jobs with node-cron

## What are Cron Jobs?

Cron jobs run code at specific times automatically:
- Every day at midnight
- Every Monday at 9 AM
- Every 5 minutes
- First day of each month

## Setup

```bash
npm install node-cron
```

## Basic Usage

```javascript
const cron = require('node-cron');

cron.schedule('* * * * *', () => {
  console.log('Running every minute');
});

cron.schedule('0 0 * * *', () => {
  console.log('Running daily at midnight');
  performDailyCleanup();
});

cron.schedule('0 9 * * 1', () => {
  console.log('Running every Monday at 9 AM');
  sendWeeklyReport();
});
```

## Cron Syntax

```
* * * * *
│ │ │ │ │
│ │ │ │ └─ Day of week (0-7, 0 and 7 = Sunday)
│ │ │ └─── Month (1-12)
│ │ └───── Day of month (1-31)
│ └─────── Hour (0-23)
└───────── Minute (0-59)

Examples:
'0 0 * * *'      → Every day at midnight
'*/5 * * * *'    → Every 5 minutes
'0 9 * * 1-5'    → Weekdays at 9 AM
'0 0 1 * *'      → First day of month
'0 */6 * * *'    → Every 6 hours
```

## Real Example: Delete Old Logs

```javascript
cron.schedule('0 2 * * *', async () => {
  console.log('Cleaning old logs...');
  
  const thirtyDaysAgo = new Date();
  thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
  
  await Log.deleteMany({
    createdAt: { $lt: thirtyDaysAgo }
  });
  
  console.log('Cleanup complete');
});
```

## Real Example: Daily Report

```javascript
cron.schedule('0 8 * * *', async () => {
  const yesterday = new Date();
  yesterday.setDate(yesterday.getDate() - 1);
  
  const stats = {
    newUsers: await User.countDocuments({
      createdAt: { $gte: yesterday }
    }),
    orders: await Order.countDocuments({
      createdAt: { $gte: yesterday }
    })
  };
  
  await sendEmailReport(stats);
});
```

## Start/Stop Jobs

```javascript
const task = cron.schedule('* * * * *', () => {
  console.log('Running task');
}, {
  scheduled: false
});

task.start();

task.stop();

task.destroy();
```

## Key Takeaway

Use cron for recurring tasks. Understand cron syntax. Handle errors in jobs. Consider timezone for global apps. Use Bull queue for complex job management.

Schedule recurring tasks with cron jobs. Automate cleanups and reports.

Scheduled Jobs with node-cron

# Testing with Jest and Supertest

## Why Test?

- Catch bugs before production
- Refactor with confidence
- Document how code works
- Prevent regressions

## Setup

```bash
npm install --save-dev jest supertest
```

```json
{
  "scripts": {
    "test": "jest"
  },
  "jest": {
    "testEnvironment": "node"
  }
}
```

## Unit Tests

```javascript
// utils.js
function add(a, b) {
  return a + b;
}

function isValidEmail(email) {
  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
}

module.exports = { add, isValidEmail };
```

```javascript
// utils.test.js
const { add, isValidEmail } = require('./utils');

describe('Math utilities', () => {
  test('adds two numbers', () => {
    expect(add(2, 3)).toBe(5);
    expect(add(-1, 1)).toBe(0);
  });
});

describe('Email validation', () => {
  test('validates correct email', () => {
    expect(isValidEmail('test@example.com')).toBe(true);
  });
  
  test('rejects invalid email', () => {
    expect(isValidEmail('invalid')).toBe(false);
  });
});
```

## API Testing

```javascript
// app.js
const express = require('express');
const app = express();

app.use(express.json());

app.get('/api/users', (req, res) => {
  res.json([{ id: 1, name: 'John' }]);
});

app.post('/api/users', (req, res) => {
  res.status(201).json({ id: 2, ...req.body });
});

module.exports = app;
```

```javascript
// app.test.js
const request = require('supertest');
const app = require('./app');

describe('GET /api/users', () => {
  test('returns list of users', async () => {
    const response = await request(app)
      .get('/api/users')
      .expect(200)
      .expect('Content-Type', /json/);
    
    expect(response.body).toHaveLength(1);
    expect(response.body[0]).toHaveProperty('name', 'John');
  });
});

describe('POST /api/users', () => {
  test('creates new user', async () => {
    const newUser = { name: 'Jane', email: 'jane@example.com' };
    
    const response = await request(app)
      .post('/api/users')
      .send(newUser)
      .expect(201);
    
    expect(response.body).toMatchObject(newUser);
    expect(response.body).toHaveProperty('id');
  });
});
```

## Mocking

```javascript
const User = require('./models/User');

jest.mock('./models/User');

describe('getUser', () => {
  test('returns user by id', async () => {
    const mockUser = { id: 1, name: 'John' };
    User.findById.mockResolvedValue(mockUser);
    
    const user = await getUser(1);
    
    expect(User.findById).toHaveBeenCalledWith(1);
    expect(user).toEqual(mockUser);
  });
});
```

## Key Takeaway

Write unit tests for functions, API tests for endpoints. Mock external dependencies. Use beforeEach for test isolation. Aim for 80% code coverage. Run tests in CI/CD.

Test Node.js apps with Jest. Write unit tests and API tests.

Testing with Jest and Supertest

# Deployment to Production

## PM2 Process Manager

```bash
npm install -g pm2

pm2 start app.js

pm2 start app.js -i max

pm2 list
pm2 logs
pm2 monit
pm2 restart app
pm2 stop app

pm2 startup
pm2 save
```

## Nginx Reverse Proxy

```nginx
server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}
```

```bash
sudo ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx
```

## SSL with Let's Encrypt

```bash
sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d example.com

sudo certbot renew --dry-run
```

## Graceful Shutdown

```javascript
const server = app.listen(3000);

process.on('SIGTERM', () => {
  console.log('SIGTERM received, closing server...');
  
  server.close(() => {
    mongoose.connection.close(false, () => {
      process.exit(0);
    });
  });
});
```

## Key Takeaway

Use PM2 for process management. Nginx as reverse proxy. Enable SSL with Let's Encrypt. Implement graceful shutdown. Monitor logs and errors.

Deploy Node.js apps to production. Learn PM2, Nginx, and SSL.

Deployment with PM2 and Nginx

# Performance Optimization

## Caching with Redis

```javascript
const redis = require('redis');
const client = redis.createClient();

await client.connect();

async function getUser(id) {
  const cacheKey = `user:${id}`;
  
  const cached = await client.get(cacheKey);
  if (cached) {
    return JSON.parse(cached);
  }
  
  const user = await User.findById(id);
  
  await client.setEx(cacheKey, 3600, JSON.stringify(user));
  
  return user;
}
```

## Database Optimization

```javascript
productSchema.index({ category: 1, price: -1 });

const products = await Product.find().lean();

const users = await User.find().select('name email');

const [user, posts] = await Promise.all([
  User.findById(id),
  Post.find({ userId: id })
]);
```

## Compression

```javascript
const compression = require('compression');

app.use(compression());
```

## Clustering

```bash
pm2 start app.js -i max
```

## Key Takeaway

Cache with Redis. Add database indexes. Use lean() for reads. Enable compression. Run parallel operations with Promise.all(). Use clustering.

Optimize Node.js performance. Learn caching and database optimization.

Performance Optimization

# Security Best Practices

## Use Helmet for Security Headers

```bash
npm install helmet
```

```javascript
const helmet = require('helmet');

app.use(helmet());
```

Helmet sets HTTP headers to protect against:
- XSS attacks
- Clickjacking
- MIME sniffing
- And more

## Input Validation

```bash
npm install joi
```

```javascript
const Joi = require('joi');

const userSchema = Joi.object({
  email: Joi.string().email().required(),
  password: Joi.string().min(8).required(),
  age: Joi.number().integer().min(18)
});

app.post('/register', async (req, res) => {
  try {
    const validated = await userSchema.validateAsync(req.body);
  } catch (error) {
    return res.status(400).json({ error: error.details[0].message });
  }
});
```

## Prevent SQL Injection

```javascript
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [req.params.id]);

const user = await User.findById(req.params.id);
```

## Secure Password Storage

```javascript
const bcrypt = require('bcrypt');

const hash = await bcrypt.hash(password, 10);
```

## Environment Variables

```javascript
require('dotenv').config();

const secret = process.env.JWT_SECRET;
```

## Rate Limiting

```javascript
const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
});

app.use('/api/', limiter);
```

## HTTPS Only

```javascript
app.use((req, res, next) => {
  if (req.header('x-forwarded-proto') !== 'https') {
    return res.redirect(`https://${req.header('host')}${req.url}`);
  }
  next();
});
```

## Key Takeaway

Use Helmet for security headers. Validate all input. Use parameterized queries. Hash passwords with bcrypt. Never commit secrets. Enable rate limiting. Use HTTPS in production.

Secure your Node.js app. Learn Helmet, input validation, and common vulnerabilities.

Security Best Practices

# Rate Limiting

## Why Rate Limiting?

Without rate limiting:
- Users can spam your API
- DDoS attacks can crash your server
- Costs increase from excessive requests
- Database gets overloaded

## Setup

```bash
npm install express-rate-limit
```

## Basic Rate Limiting

```javascript
const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: 'Too many requests, please try again later',
  standardHeaders: true,
  legacyHeaders: false
});

app.use(limiter);
```

**Explanation:**
- `windowMs`: Time window (15 minutes)
- `max`: Max requests per window (100)
- User can make 100 requests in 15 minutes

## Different Limits for Different Routes

```javascript
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many login attempts'
});

app.post('/login', authLimiter, async (req, res) => {
});

const readLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100
});

app.get('/api/products', readLimiter, async (req, res) => {
});
```

## Redis Store for Multiple Servers

```javascript
const RedisStore = require('rate-limit-redis');
const { createClient } = require('redis');

const redisClient = createClient();
redisClient.connect();

const limiter = rateLimit({
  store: new RedisStore({
    client: redisClient,
    prefix: 'rl:'
  }),
  windowMs: 15 * 60 * 1000,
  max: 100
});

app.use(limiter);
```

## Key Takeaway

Always use rate limiting in production. Different limits for different routes. Use Redis store for multiple servers. Stricter limits for auth endpoints.

Protect your API with rate limiting. Prevent abuse and DDoS attacks.

Rate Limiting

# Logging with Winston

## Why Logging?

- Debug production issues
- Track errors
- Monitor performance
- Audit user actions

## Setup

```bash
npm install winston
```

## Basic Logger

```javascript
const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' })
  ]
});

if (process.env.NODE_ENV !== 'production') {
  logger.add(new winston.transports.Console({
    format: winston.format.simple()
  }));
}

logger.info('User logged in', { userId: 123 });
logger.error('Payment failed', { error: err.message });
```

## Log Levels

```javascript
logger.error('Critical error');
logger.warn('Warning message');
logger.info('Info message');
logger.http('HTTP request');
logger.debug('Debug info');
```

## Request Logging

```javascript
const morgan = require('morgan');

app.use(morgan('combined', {
  stream: {
    write: (message) => logger.http(message.trim())
  }
}));
```

## Error Logging

```javascript
process.on('uncaughtException', (error) => {
  logger.error('Uncaught Exception', { error: error.stack });
  process.exit(1);
});

app.use((err, req, res, next) => {
  logger.error('Express error', {
    error: err.message,
    stack: err.stack,
    url: req.url
  });
  
  res.status(500).json({ error: 'Internal server error' });
});
```

## Key Takeaway

Use Winston for structured logging. Log to files in production. Include context in logs. Monitor error logs. Never log sensitive data.

Implement proper logging with Winston. Learn log levels and rotation.

Logging with Winston

# Pagination Strategies

## Why Pagination?

Loading 10,000 records at once:
- Slow response time
- High memory usage
- Poor user experience
- Database overload

Solution: Load data in pages (10-50 items at a time).

## Offset-Based Pagination

```javascript
app.get('/products', async (req, res) => {
  const page = parseInt(req.query.page) || 1;
  const limit = parseInt(req.query.limit) || 10;
  const skip = (page - 1) * limit;
  
  const [products, total] = await Promise.all([
    Product.find().skip(skip).limit(limit),
    Product.countDocuments()
  ]);
  
  res.json({
    products,
    pagination: {
      currentPage: page,
      totalPages: Math.ceil(total / limit),
      totalItems: total,
      hasNextPage: page < Math.ceil(total / limit),
      hasPrevPage: page > 1
    }
  });
});
```

## Cursor-Based Pagination

```javascript
app.get('/posts', async (req, res) => {
  const limit = 10;
  const cursor = req.query.cursor;
  
  let query = {};
  if (cursor) {
    query._id = { $lt: cursor };
  }
  
  const posts = await Post.find(query)
    .sort({ _id: -1 })
    .limit(limit + 1);
  
  const hasMore = posts.length > limit;
  const items = hasMore ? posts.slice(0, -1) : posts;
  
  res.json({
    posts: items,
    nextCursor: hasMore ? items[items.length - 1]._id : null,
    hasMore
  });
});
```

**Better for real-time data** (like social media feeds).

## With Filtering

```javascript
app.get('/products', async (req, res) => {
  const page = parseInt(req.query.page) || 1;
  const limit = 10;
  const skip = (page - 1) * limit;
  
  const query = {};
  if (req.query.category) {
    query.category = req.query.category;
  }
  if (req.query.minPrice) {
    query.price = { $gte: parseInt(req.query.minPrice) };
  }
  
  const [products, total] = await Promise.all([
    Product.find(query).skip(skip).limit(limit),
    Product.countDocuments(query)
  ]);
  
  res.json({
    products,
    pagination: {
      page,
      limit,
      total,
      pages: Math.ceil(total / limit)
    }
  });
});
```

## Key Takeaway

Use offset pagination for simple cases. Cursor pagination for real-time feeds. Always include total count. Support filtering with pagination.

Implement efficient pagination. Learn offset and cursor-based pagination.

Pagination Strategies

# Search Implementation

## MongoDB Text Search

```javascript
const productSchema = new mongoose.Schema({
  name: String,
  description: String
});

productSchema.index({ name: 'text', description: 'text' });

const Product = mongoose.model('Product', productSchema);

app.get('/search', async (req, res) => {
  const query = req.query.q;
  
  const products = await Product.find(
    { $text: { $search: query } },
    { score: { $meta: 'textScore' } }
  ).sort({ score: { $meta: 'textScore' } });
  
  res.json(products);
});
```

## Regex Search

```javascript
app.get('/search', async (req, res) => {
  const query = req.query.q;
  
  const products = await Product.find({
    $or: [
      { name: { $regex: query, $options: 'i' } },
      { description: { $regex: query, $options: 'i' } }
    ]
  });
  
  res.json(products);
});
```

## With Filters

```javascript
app.get('/search', async (req, res) => {
  const { q, category, minPrice, maxPrice } = req.query;
  
  const query = {};
  
  if (q) {
    query.$text = { $search: q };
  }
  
  if (category) {
    query.category = category;
  }
  
  if (minPrice || maxPrice) {
    query.price = {};
    if (minPrice) query.price.$gte = parseInt(minPrice);
    if (maxPrice) query.price.$lte = parseInt(maxPrice);
  }
  
  const products = await Product.find(query);
  
  res.json(products);
});
```

## Autocomplete

```javascript
app.get('/autocomplete', async (req, res) => {
  const query = req.query.q;
  
  const suggestions = await Product.find({
    name: { $regex: `^${query}`, $options: 'i' }
  })
  .limit(10)
  .select('name');
  
  res.json(suggestions.map(p => p.name));
});
```

## Key Takeaway

Use MongoDB text index for full-text search. Regex for simple searches. Combine search with filters. Add autocomplete for better UX.

Implement search functionality. Learn full-text search and fuzzy matching.

Search Implementation

# Working with Redis

## What is Redis?

Redis is an in-memory data store. Super fast because data lives in RAM.

**Use cases:**
- Caching
- Sessions
- Real-time analytics
- Pub/Sub messaging
- Rate limiting

## Setup

```bash
npm install redis
```

```javascript
const redis = require('redis');

const client = redis.createClient({
  host: 'localhost',
  port: 6379
});

await client.connect();
```

## Basic Operations

```javascript
await client.set('key', 'value');

const value = await client.get('key');

await client.setEx('key', 3600, 'value');

await client.del('key');

const exists = await client.exists('key');

await client.incr('counter');
```

## Caching Pattern

```javascript
async function getUser(id) {
  const cacheKey = `user:${id}`;
  
  const cached = await client.get(cacheKey);
  if (cached) {
    return JSON.parse(cached);
  }
  
  const user = await User.findById(id);
  
  await client.setEx(cacheKey, 3600, JSON.stringify(user));
  
  return user;
}
```

## Lists

```javascript
await client.rPush('queue', 'task1');
await client.rPush('queue', 'task2');

const task = await client.lPop('queue');

const length = await client.lLen('queue');
```

## Sets

```javascript
await client.sAdd('tags', 'nodejs');
await client.sAdd('tags', 'redis');

const isMember = await client.sIsMember('tags', 'nodejs');

const members = await client.sMembers('tags');
```

## Hashes

```javascript
await client.hSet('user:123', 'name', 'John');
await client.hSet('user:123', 'email', 'john@example.com');

const name = await client.hGet('user:123', 'name');

const user = await client.hGetAll('user:123');
```

## Key Takeaway

Redis is fast in-memory storage. Use for caching, sessions, queues. Data structures: strings, lists, sets, hashes. Set expiration to save memory.

Use Redis for caching and sessions. Learn Redis data structures.

Working with Redis

# Microservices Architecture

## Monolith vs Microservices

**Monolith:**
```
One big application
├── User management
├── Orders
├── Payments
└── Notifications

All in one codebase, one database, one deployment
```

**Microservices:**
```
Multiple small services
├── User Service (port 3001)
├── Order Service (port 3002)
├── Payment Service (port 3003)
└── Notification Service (port 3004)

Each has own codebase, database, deployment
```

## Benefits

- **Independent deployment** - Update one service without affecting others
- **Technology flexibility** - Use different tech for different services
- **Better scalability** - Scale only services that need it
- **Fault isolation** - One service crash doesn't kill everything

## Basic Service Structure

```javascript
// user-service/index.js
const express = require('express');
const app = express();

app.get('/users/:id', async (req, res) => {
  const user = await User.findById(req.params.id);
  res.json(user);
});

app.listen(3001);
```

```javascript
// order-service/index.js
const express = require('express');
const app = express();

app.get('/orders/:id', async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order);
});

app.listen(3002);
```

## Service Communication

```javascript
const axios = require('axios');

app.get('/orders/:id', async (req, res) => {
  const order = await Order.findById(req.params.id);
  
  const userResponse = await axios.get(
    `http://user-service:3001/users/${order.userId}`
  );
  
  res.json({
    ...order.toObject(),
    user: userResponse.data
  });
});
```

## API Gateway

```javascript
const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');

const app = express();

app.use('/api/users', createProxyMiddleware({
  target: 'http://user-service:3001',
  changeOrigin: true
}));

app.use('/api/orders', createProxyMiddleware({
  target: 'http://order-service:3002',
  changeOrigin: true
}));

app.listen(3000);
```

## Key Takeaway

Microservices enable independent scaling and deployment. Use API gateway as entry point. Each service has own database. Start simple, split when needed.

Build microservices with Node.js. Learn service communication.

Microservices Architecture

# REST API Best Practices

## HTTP Methods

```javascript
app.get('/api/products', async (req, res) => {
  const products = await Product.find();
  res.json(products);
});

app.get('/api/products/:id', async (req, res) => {
  const product = await Product.findById(req.params.id);
  if (!product) return res.status(404).json({ error: 'Not found' });
  res.json(product);
});

app.post('/api/products', async (req, res) => {
  const product = await Product.create(req.body);
  res.status(201).json(product);
});

app.put('/api/products/:id', async (req, res) => {
  const product = await Product.findByIdAndUpdate(
    req.params.id,
    req.body,
    { new: true }
  );
  res.json(product);
});

app.delete('/api/products/:id', async (req, res) => {
  await Product.findByIdAndDelete(req.params.id);
  res.status(204).send();
});
```

## Status Codes

```
200 OK              → Successful GET, PUT, PATCH
201 Created         → Successful POST
204 No Content      → Successful DELETE
400 Bad Request     → Invalid input
401 Unauthorized    → Not authenticated
403 Forbidden       → Not authorized
404 Not Found       → Resource doesn't exist
500 Internal Error  → Server error
```

## Consistent Response Format

```javascript
res.json({
  success: true,
  data: products
});

res.status(400).json({
  success: false,
  error: {
    message: 'Invalid input',
    code: 'INVALID_INPUT'
  }
});
```

## Filtering and Sorting

```javascript
app.get('/api/products', async (req, res) => {
  const { category, minPrice, sortBy, order } = req.query;
  
  const query = {};
  if (category) query.category = category;
  if (minPrice) query.price = { $gte: parseInt(minPrice) };
  
  const sort = {};
  if (sortBy) sort[sortBy] = order === 'desc' ? -1 : 1;
  
  const products = await Product.find(query).sort(sort);
  res.json({ success: true, data: products });
});
```

## Key Takeaway

Use proper HTTP methods and status codes. Consistent response format. Support filtering, sorting, pagination. Include helpful error messages.

Build better REST APIs. Learn HTTP methods and status codes.

REST API Best Practices

# API Documentation with Swagger

## Setup

```bash
npm install swagger-jsdoc swagger-ui-express
```

```javascript
const swaggerJsdoc = require('swagger-jsdoc');
const swaggerUi = require('swagger-ui-express');

const options = {
  definition: {
    openapi: '3.0.0',
    info: {
      title: 'My API',
      version: '1.0.0'
    },
    servers: [
      {
        url: 'http://localhost:3000'
      }
    ]
  },
  apis: ['./routes/*.js']
};

const specs = swaggerJsdoc(options);

app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(specs));
```

## Document Routes

```javascript
/**
 * @swagger
 * /api/users:
 *   get:
 *     summary: Get all users
 *     responses:
 *       200:
 *         description: List of users
 */
app.get('/api/users', async (req, res) => {
  const users = await User.find();
  res.json(users);
});
```

## Key Takeaway

Swagger generates interactive docs. Document as you code. Keep docs updated with code.

Document APIs with Swagger. Generate interactive documentation.

API Documentation with Swagger

# Internationalization (i18n)

## Setup

```bash
npm install i18n
```

```javascript
const i18n = require('i18n');

i18n.configure({
  locales: ['en', 'es', 'fr'],
  defaultLocale: 'en',
  directory: __dirname + '/locales'
});

app.use(i18n.init);
```

## Translation Files

```json
// locales/en.json
{
  "welcome": "Welcome",
  "greeting": "Hello, %s!"
}

// locales/es.json
{
  "welcome": "Bienvenido",
  "greeting": "¡Hola, %s!"
}
```

## Using Translations

```javascript
app.get('/', (req, res) => {
  res.json({
    welcome: req.__('welcome'),
    greeting: req.__('greeting', 'John')
  });
});

app.get('/lang/:locale', (req, res) => {
  res.cookie('language', req.params.locale);
  req.setLocale(req.params.locale);
  res.redirect('/');
});
```

## Key Takeaway

Store translations in JSON files. Detect language from headers or cookies. Format dates and numbers by locale.

Add multi-language support. Learn i18n library.

Internationalization (i18n)

# Memory Leaks and Debugging

## Monitor Memory

```javascript
setInterval(() => {
  const used = process.memoryUsage();
  console.log({
    rss: `${Math.round(used.rss / 1024 / 1024)} MB`,
    heapUsed: `${Math.round(used.heapUsed / 1024 / 1024)} MB`
  });
}, 60000);
```

## Common Causes

```javascript
let cache = {};

emitter.on('data', handler);

function createHandler() {
  const largeData = new Array(1000000);
  return () => {
    console.log(largeData.length);
  };
}
```

**Fixes:**
- Use LRU cache with limits
- Remove event listeners
- Don't reference large data in closures

## Key Takeaway

Monitor memory in production. Remove event listeners. Use LRU cache with limits. Take heap snapshots to find leaks.

Find and fix memory leaks. Learn heap snapshots.

Node.js Resources - NodeJS Node JS Programming

Browse Node.js Content

Tutorials

Interview Questions

Practice Problems

Articles & Blog