Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

This guide walks you through cloning the repository, wiring up all required environment variables, starting the development server, and completing a full authentication flow — from registering a new account to making authenticated requests with your JWT token. The whole process takes about five minutes.
1

Clone the repository

Pull the project from GitLab and move into the directory:
git clone https://gitlab.com/rizofredy5/Ecommerce.git && cd Ecommerce
The source code lives entirely inside the src/ subdirectory. Configuration is loaded from a .env file you will create in the project root (next step).
2

Install dependencies

Install all Node.js dependencies declared in package.json:
npm install
Key packages installed include express, mongoose, jsonwebtoken, bcrypt, multer, sharp, @google-cloud/storage, nodemailer, passport, passport-google-oauth20, socket.io, and swagger-ui-express.
3

Create the .env file

Create a .env file in the project root (the same level as package.json, not inside src/). Populate every variable — the server will start with empty strings for missing values, but features that depend on them will silently fail.
.env
# Server
PORT=3000

# JWT
SECRET=replace_with_a_long_random_string_at_least_32_chars

# MongoDB
MONGODB_URL=mongodb://localhost:27017/ecommerce

# Nodemailer / Gmail
USER_EMAIL=your-gmail-address@gmail.com
PASS_EMAIL=your-google-app-password

# Google Cloud Storage
NAMEGOOGLECLOUD=your-gcs-bucket-name

# Google OAuth 2.0
CLIENT_ID=your-google-oauth-client-id.apps.googleusercontent.com
CLIENT_SECRET=your-google-oauth-client-secret
CLIENT_URL=http://localhost:3000/auth/google/callback
Never commit .env to version control. Add it to .gitignore immediately. Exposing SECRET or CLIENT_SECRET compromises every user’s JWT and your OAuth application.
4

Start the development server

The dev script uses Nodemon to watch for file changes and Babel to transpile ES module syntax on the fly:
npm run dev
You should see output like:
Server on port 3000
The server listens on PORT from your .env (defaulting to 3000 if unset). Nodemon will automatically restart the server whenever you save a source file.
Visit http://localhost:3000/api-docs in your browser to explore the full OpenAPI spec with an interactive Swagger UI — no additional tooling required.
5

Register a new user

Send a POST request to /api/user/register with all required fields. On success the server emails a 5-digit verification code to the address provided.All nine fields are required — the server returns 203 if any are missing.
curl -X POST http://localhost:3000/api/user/register \
  -H "Content-Type: application/json" \
  -d '{
    "firstName": "Juan",
    "lastName": "Pérez",
    "email": "juan@example.com",
    "password": "MySecret123",
    "phone": "3001234567",
    "sex": "Masculino",
    "document": "12345678",
    "documentType": "CC",
    "birthdate": "1995-05-20"
  }'
FieldTypeAllowed Values
firstNamestringAny
lastNamestringAny
emailstringValid email address
passwordstringAny (hashed with bcrypt)
phonestringNumeric phone number
sexstringMasculino, Femenino, Otro
documentstringNumeric document number
documentTypestringCC, CE, Pasaporte
birthdatestringDate string e.g. 1995-05-20
6

Verify your account

Check your inbox for the 5-digit code. Submit it alongside your email to activate your account. Without this step, login will be rejected with 403.
curl -X POST http://localhost:3000/api/user/verify-account \
  -H "Content-Type: application/json" \
  -d '{
    "email": "juan@example.com",
    "code": "34251"
  }'
The code is a 5-character string of digits. It is stored in login_code on the User document and matched exactly — make sure to send it as a string, not a number.
7

Log in and retrieve your JWT token

With your account verified, log in to receive a signed JWT. The token is valid for 365 days and must be sent with every protected request.
curl -X POST http://localhost:3000/api/user/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "juan@example.com",
    "password": "MySecret123"
  }'
Copy the token value from the response — you will need it in the next step.
8

Make authenticated requests

Pass the JWT in the token-access custom header on every request to a protected endpoint. Below is an example that adds a product to the authenticated user’s cart:
curl -X POST http://localhost:3000/api/carts/agregate/64f1a2b3c4d5e6f7a8b9c0d2/cart \
  -H "Content-Type: application/json" \
  -H "token-access: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "cantBuy": 2,
    "sizes": { "talla": "M", "color": "Blanco" }
  }'
The header name is token-access — not Authorization or Bearer. Requests with a missing or invalid header receive 403 Forbidden.

​
Complete Auth Flow at a Glance

Here is the full registration-to-authenticated-request sequence in one place: 
# 1. Register
curl -X POST http://localhost:3000/api/user/register \
  -H "Content-Type: application/json" \
  -d '{"firstName":"Juan","lastName":"Pérez","email":"juan@example.com","password":"MySecret123","phone":"3001234567","sex":"Masculino","document":"12345678","documentType":"CC","birthdate":"1995-05-20"}'

# 2. Verify (replace 34251 with the code emailed to you)
curl -X POST http://localhost:3000/api/user/verify-account \
  -H "Content-Type: application/json" \
  -d '{"email":"juan@example.com","code":"34251"}'

# 3. Login — copy the "token" field from the response
curl -X POST http://localhost:3000/api/user/login \
  -H "Content-Type: application/json" \
  -d '{"email":"juan@example.com","password":"MySecret123"}'

# 4. Add a product to cart (replace <TOKEN> and <PRODUCT_ID> with real values)
curl -X POST http://localhost:3000/api/carts/agregate/<PRODUCT_ID>/cart \
  -H "Content-Type: application/json" \
  -H "token-access: <TOKEN>" \
  -d '{"cantBuy":1,"sizes":{"talla":"M","color":"Blanco"}}'
Prefer interactive exploration? Open http://localhost:3000/api-docs in your browser once the server is running. Swagger UI lets you try every endpoint directly from your browser — no cURL required.

Build docs developers (and LLMs) love

Get started for freeTalk to us