Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Danielsl4/TFG_DAM_2526/llms.txt

Use this file to discover all available pages before exploring further.

The FutsalLeague Manager backend is a Node.js/Express API that connects to PostgreSQL for persistent storage, Redis for caching and rate limiting, Cloudinary for image uploads, and Gmail for transactional email. This guide covers everything you need to get the API running in a production environment.

​
Prerequisites

Before deploying, make sure the following are available:
  • Node.js — No engine field is specified in package.json; use Node.js 18 LTS or newer for best compatibility.
  • PostgreSQL — A running PostgreSQL instance with the database initialized (see Database setup).
  • Redis — Required for both response caching and auth rate limiting. A Redis 6+ instance or a managed service (Redis Cloud, Upstash, etc.) is supported.
  • Cloudinary account — For team and player image uploads.
  • Gmail account — For sending verification and password-reset emails via Nodemailer.

​
Environment variables

Create a .env file in the backend/ directory (or set these as environment variables in your hosting platform). All variables are required unless a default is noted.
VariableDescriptionDefault
PORTPort the Express server listens on3000
DATABASE_URLFull PostgreSQL connection string (used by pg.Pool)—
JWT_SECRETSecret key used to sign and verify JWT tokens—
REDIS_URLRedis connection URL used by ioredis—
CLOUDINARY_CLOUD_NAMEYour Cloudinary cloud name—
CLOUDINARY_API_KEYCloudinary API key—
CLOUDINARY_API_SECRETCloudinary API secret—
EMAIL_USERGmail address used as the sender for all emails—
EMAIL_PASSGmail app password for the sender account—
FRONTEND_URLPublic URL of the frontend — embedded in verification and password-reset email linkshttp://localhost:4200
JWT_SECRET must be a long, random string generated with a tool like openssl rand -hex 64. Never commit it to version control or reuse a value across environments. A weak or leaked secret allows anyone to forge authentication tokens.
Redis is required for two separate concerns: response caching (match lists, standings) via ioredis, and distributed rate limiting on auth endpoints via rate-limit-redis. The API will not start correctly if Redis is unreachable at boot.

​
Sample .env file

PORT=3000

# PostgreSQL
DATABASE_URL=postgresql://user:password@localhost:5432/futsalleague

# Auth
JWT_SECRET=replace-with-a-long-random-string

# Redis
REDIS_URL=redis://localhost:6379

# Cloudinary
CLOUDINARY_CLOUD_NAME=your-cloud-name
CLOUDINARY_API_KEY=your-api-key
CLOUDINARY_API_SECRET=your-api-secret

# Email (Gmail)
EMAIL_USER=[email protected]
EMAIL_PASS=your-gmail-app-password

# Frontend URL (used in email links)
FRONTEND_URL=https://yourdomain.com

​
Installation and start

# Install dependencies
npm install

# Start the server
npm start
The server starts on http://localhost:3000 (or the port defined in PORT) and prints: 
Servidor modular iniciado en http://localhost:3000
Sistema de tareas programadas (Cron Jobs) iniciado.

​
CORS configuration

The API currently allows requests from all origins using a manual CORS middleware: 
res.header("Access-Control-Allow-Origin", "*");
All standard HTTP methods (GET, POST, PUT, PATCH, DELETE, OPTIONS) and the Authorization header are permitted. If you need to restrict origins to your frontend domain in production, update this header in index.js.

​
Rate limiting

Authentication endpoints (/login, /register, /forgot-password, /resend-verification) are protected by a shared rate limiter:
  • Limit: 10 requests per IP per 15-minute window
  • Storage: Redis (via rate-limit-redis), so limits are shared across multiple server instances
  • Response on breach: HTTP 429 with a JSON message asking the user to retry after 15 minutes
Standard RateLimit-* response headers are included; legacy X-RateLimit-* headers are disabled.

​
Cron jobs

The backend registers scheduled tasks at startup using node-cron. No external job runner is required — they run inside the Node.js process.
ScheduleTask
Daily at midnight (0 0 * * *)Deletes all user accounts that have been unverified for more than 24 hours, keeping the users table free of stale registrations.

​
API route structure

PrefixDescription
/login, /registerAuthentication and account management
/usersUser profile endpoints
/matchesMatch records and referee management
/teamsTeam detail and follow relationships
/playersPlayer detail
/standingsLeague standings
/statisticsGlobal statistics
/adminAdmin panel operations
/seasonsSeason management
/groupsGroup management
/fieldsPlaying field management

Build docs developers (and LLMs) love

Get started for freeTalk to us