⚙️ Backend Dev

Authentication versus authorization in Express

Authentication proves who you are, authorization decides what you may do, authentication happens first.

MongoDB aggregation pipeline for total sales

Explain the pipeline as ordered stages, use $group with $sum to total per productId, $match on the computed total, then $sort descending.

Atomic order creation with Sequelize transactions

Wrap dependent writes in sequelize.transaction, pass the transaction to each query, let managed transactions auto-commit or roll back.

Solving the N+1 query problem in Sequelize

Define N+1 as one parent query plus one per child, detect it via SQL logging, fix with eager loading using include.

Mongoose pre('save') hooks for password hashing

Pre('save') runs before persistence; use it to hash the password, guarding with isModified, calling next() or returning.

Database migrations with the Sequelize CLI

Migrations are version-controlled scripts with up/down so teams apply identical schema changes; use sequelize-cli to generate, edit with addColumn, then db:migrate.

Mongoose populate() for referenced documents

Populate() replaces stored ObjectIds with the referenced documents, needs a ref in the schema, called via .populate('author').

Define a Mongoose schema and model

New mongoose.Schema with field options (type, required, default), then mongoose.model('Product', schema) to get a model.

API versioning: URL vs header strategies

Version via URL path (/v1/), a custom or Accept header, or a query param; URL is visible and cache-friendly, headers keep URLs clean but are less discoverable.

Centralized error handling in an Express API

A final four-arg error middleware, an asyncHandler wrapper to funnel promise rejections via next, a custom error class with statusCode, returning uniform JSON.

404 vs 500: missing resource vs server failure

A missing resource returns 404 Not Found (client asked for something absent); a database failure returns 500 Internal Server Error (server-side fault).

Idempotency: PUT vs POST in REST

Idempotent means repeated identical requests leave the same server state; PUT is idempotent, POST is not. Use PUT to overwrite a resource at a known URL.

Modularize routes with express.Router

Create a Router per resource in its own file, define routes on it, export it, and mount with app.use('/products', router).

Status codes for successful POST and GET

201 Created for a successful POST (ideally with a Location header), 200 OK for a successful GET returning data.

req.params vs req.query vs req.body in Express

Req.params holds named route segments, req.query holds the URL query string, req.body holds the parsed payload.

Design an Express route to create a user

POST to a collection URL like /users, read the payload from req.body via express.json(), return 201 with the created resource.

Conditionally apply middleware by request property

Use express.text({ type: 'application/xml' }) or a guard wrapper that checks req.is() then calls the parser or next().

Write a JWT authentication middleware

Read the header, strip Bearer, jwt.verify with the secret, set req.user and next(), else send 401.

Middleware execution order and sharing data via req

Middleware runs top-down in registration order; each calls next(); attach data like req.user that later handlers read.