Node.js Backend and API Engineering
Layered APIs, identity, tenant authorization, jobs, webhooks, retries, and idempotency
Controllers, Services, and Repositories
Controllers handle HTTP; services implement use cases; repositories encapsulate persistence; adapters integrate external providers.
How to apply it
Use a request flow of middleware, authentication, authorization, validation, controller, service, repository/transaction, and response. Inject dependencies explicitly and normalize errors centrally.
Worked example
A project controller validates request shape and calls a project service; the service enforces domain invariants before persistence.
Common mistakes to avoid
Database calls scattered across controllers or hidden business rules in middleware.
Practice task
Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.
- Controllers handle HTTP; services implement use cases; repositories encapsulate persistence; adapters integrate external providers.
- Use a request flow of middleware, authentication, authorization, validation, controller, service, repository/transaction, and response.
What is the strongest production practice for Controllers, Services, and Repositories?
Background Jobs and Webhooks
Slow work such as email, exports, and provider events should be durable asynchronous work when it need not block a request.
How to apply it
Use stable job/event IDs, tenant context, bounded retries with exponential backoff and jitter, and a failed-job workflow. Verify webhook signatures against the raw body, persist unique event IDs, acknowledge after durable acceptance, and process idempotently.
Worked example
A unique provider event ID prevents a retried payment webhook from applying the same transition twice; reconciliation repairs missed events.
Common mistakes to avoid
Assuming webhook delivery is ordered or that a timeout proves an operation did not happen.
Practice task
Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.
- Slow work such as email, exports, and provider events should be durable asynchronous work when it need not block a request.
- Use stable job/event IDs, tenant context, bounded retries with exponential backoff and jitter, and a failed-job workflow.
What is the strongest production practice for Background Jobs and Webhooks?