Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

The Ecommerce API is a full-featured shirt-store backend built with Node.js, Express, and MongoDB (Mongoose). It handles everything from user registration and JWT authentication to multi-image product uploads via Google Cloud Storage, paginated product listings, cart management, and real-time events over Socket.io. Every endpoint under /api/user, /api/product, and /api/carts uses the POST HTTP method. A custom token-access header carries the JWT for protected routes.

​
Architecture Overview

The application follows a layered architecture that keeps concerns cleanly separated: 
HTTP Request
    │
    ▼
Routes  (/api/user · /api/product · /api/carts)
    │
    ▼
Middleware  (Token auth · Paginate · Multer upload)
    │
    ▼
Controllers  (authController · userController · ProductController · cartsController)
    │
    ▼
Models  (User · Product · Carts — Mongoose schemas)
    │
    ▼
MongoDB
Each route file maps URL paths to controller functions, optionally passing requests through middleware first. The Token middleware validates the token-access JWT header before any protected controller runs.

​
Key Capabilities

JWT Authentication

Register, verify, and log in users. All protected routes require a signed JWT passed in the token-access request header. Tokens are valid for 365 days.

Google OAuth 2.0

Sign in with Google via Passport.js. The OAuth flow starts at /auth/google and redirects back to /auth/google/callback on success.

Product Management

Create, edit, delete, search, and paginate shirt products. Each product supports up to four image angles, size variants (XS–XXL), pricing, and discount fields.

Cloud Image Uploads

Product images are processed with Sharp (resizing/optimisation) then stored in Google Cloud Storage. Multer handles multipart/form-data uploads.

Shopping Cart

Add products to a cart, adjust quantities with increase/decrease actions, and list purchases or sales — all tied to the authenticated user.

Email Notifications

Nodemailer sends a 5-digit verification code on registration and a recovery code for password resets, using a Gmail App Password for delivery.

Role-Based Access

Users carry a roles array (Usuario = "1", Admin = "2"). Admin-only endpoints verify role membership before executing privileged operations.

Swagger UI

Interactive API documentation is auto-generated from JSDoc annotations and served at /api-docs using swagger-ui-express and swagger-jsdoc.

​
Route Base Paths

Every API route is prefixed with /api. The three resource groups are:
PrefixDescription
/api/userRegistration, verification, login, password recovery, profile & role updates
/api/productCreate, edit, delete, search, and list shirt products
/api/cartsAdd to cart, update quantities, list purchases and sales
All /api/* routes use POST. Every endpoint under /api/user, /api/product, and /api/carts uses the POST method — including read and list operations. There are no GET, PUT, or DELETE routes under the /api prefix.

​
Authentication Header

Protected routes validate a JWT on every request. Pass the token returned by /api/user/login in the following custom header: 
token-access: <your-jwt-token>
Requests to protected endpoints without a valid token-access header receive a 403 Forbidden response. Tokens that are malformed or refer to a deleted user return 401 Unauthorized.

​
Interactive API Docs

The full OpenAPI 3.0 spec is browsable at http://localhost:3000/api-docs once the server is running. Every endpoint, request body schema, and response code is documented there via JSDoc annotations in the route files.

Build docs developers (and LLMs) love

Get started for freeTalk to us