The Estructuras Backend API is a RESTful web service built with Express.js that powers a full-featured real estate property listings platform. It provides everything a property marketplace needs on the backend: secure user registration and authentication, protected property management operations, and public read access to listing data — all backed by a Turso (libSQL) cloud database and validated against strict Zod schemas.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/nelrondon/backend-proyecto-estructuras/llms.txt
Use this file to discover all available pages before exploring further.
Why Estructuras?
Managing real estate listings requires two distinct concerns: a reliable identity layer so only authorized agents can create or modify listings, and a performant, openly readable catalog so prospective buyers or renters can browse properties without an account. Estructuras handles both. Authentication is handled entirely through HTTP-only cookies carrying a signed JWT — there are no API keys to rotate or Authorization headers to thread through every frontend request. The property catalog is publicly accessible by default, while write operations (create, update, delete) require a valid session.Tech Stack
Estructuras is a modern ESM Node.js application. Every dependency is chosen for a specific role:| Package | Version | Role |
|---|---|---|
express | ^5.1.0 | HTTP server and routing framework |
@libsql/client | ^0.15.9 | Turso / libSQL database driver |
jsonwebtoken | ^9.0.2 | JWT creation and verification |
bcrypt | ^6.0.0 | Password hashing with configurable salt rounds |
zod | ^3.25.63 | Request body schema validation |
cookie-parser | ^1.4.7 | Parses the HTTP-only token cookie on every request |
cors | ^2.8.5 | Origin allowlist enforcement with credential support |
morgan | ^1.10.0 | HTTP request logging in dev format |
dotenv | ^16.5.0 | Environment variable loading from .env |
--watch mode for development — no separate build step or transpilation is required.
API Structure
The API is organized into two top-level route groups mounted under/api:
Users & Authentication — /api
All identity operations live under /api. These endpoints handle account creation, credential verification, session management, and profile retrieval. Most endpoints in this group require a valid session cookie; POST /api/login and POST /api/register are the public entry points that issue one.
| Method | Path | Auth Required | Description |
|---|---|---|---|
POST | /api/register | No | Create a new user account and receive a session cookie |
POST | /api/login | No | Authenticate with username + password and receive a session cookie |
POST | /api/logout | No | Clear the session cookie |
GET | /api/ | Yes | Retrieve the authenticated user’s profile |
GET | /api/verify-token | Yes | Validate the current session token |
Properties — /api/properties
Property endpoints provide full CRUD access to listings. Read operations are publicly accessible; write operations require an authenticated session.
| Method | Path | Auth Required | Description |
|---|---|---|---|
GET | /api/properties | No | List all property listings |
GET | /api/properties/:id | No | Retrieve a single property by ID |
GET | /api/properties/type/:type | No | Filter listings by type (Casa, Apartamento, Terreno, Comercial) |
GET | /api/properties/status/:status | No | Filter listings by status (Venta, Alquiler, Ambas) |
POST | /api/properties | Yes | Create a new property listing |
PUT | /api/properties | Yes | Update an existing property listing |
DELETE | /api/properties | Yes | Delete a property listing |
Authentication Approach
Estructuras uses HTTP-only cookie-based JWT authentication. On a successful login or registration, the server signs a JWT with a 7-day expiry usingSECRET_KEY and writes it into a token cookie flagged httpOnly, secure, and sameSite: none. The cookie is never accessible from JavaScript — it is automatically attached to every subsequent same-origin (or CORS-allowed cross-origin) request by the browser.
On the server side, the authRequired middleware reads the token cookie via cookie-parser, verifies it with jsonwebtoken, and attaches the decoded user payload to req.user before passing control to the route handler. Protected routes return 401 Unauthorized if the cookie is absent or the token is invalid.
Because cookies are set with
sameSite: none and secure: true, your frontend must be served over HTTPS in production and must send requests with credentials: 'include' (Fetch API) or withCredentials: true (Axios). See the Quickstart for working examples.Key Features
- Zod-validated requests — Every write endpoint parses the request body through a strict Zod schema before touching the database. Validation errors return a structured
422 Unprocessable Entityresponse with a human-readable message. - bcrypt password hashing — Passwords are never stored in plaintext. The number of salt rounds is configurable via
SALT_ROUNDSso you can tune the cost factor for your hardware. - Turso cloud database — The database is hosted on Turso’s global edge network at
libsql://estructuradb-nelrondon.aws-us-east-1.turso.io, giving you low-latency reads from any region. - CORS allowlist — Only
http://localhost:5173(local Vite dev server) andhttps://proyecto-estructuras-topaz.vercel.app(production frontend) are permitted by default. The list is easy to extend insrc/config.js. - Security hardening — The
X-Powered-By: Expressheader is disabled to avoid leaking runtime information. - Property filtering — Listings can be filtered server-side by property type or availability status without any query-string parsing on the client.
Explore the Documentation
Quickstart
Clone the repo, set your environment variables, and make your first authenticated API call in under 5 minutes.
Configuration
Full reference for environment variables, CORS settings, database connection, and security options.
Authentication Overview
Deep dive into the JWT cookie flow, token verification, and how to protect your own routes.
API Reference
Complete endpoint reference with request/response schemas for every Users and Properties route.