mern-template-tool 1.0.0

package/templates/server/controllers/resourceController.js

@@ -0,0 +1,254 @@
+const path = require('path');
+const fs = require('fs');
+const Resource = require('../models/Resource');
+
+// @desc    Get all resources (with search, category filter, and sort)
+// @route   GET /api/resources
+// @access  Public
+const getResources = async (req, res, next) => {
+  try {
+    const { search, category, sort } = req.query;
+
+    // Build filter query
+    const queryObj = {};
+
+    // Search by title or description
+    if (search) {
+      queryObj.$or = [
+        { title: { $regex: search, $options: 'i' } },
+        { description: { $regex: search, $options: 'i' } },
+      ];
+    }
+
+    // Filter by category
+    if (category && category !== 'All') {
+      queryObj.category = { $regex: `^${category}$`, $options: 'i' };
+    }
+
+    let query = Resource.find(queryObj).populate('createdBy', 'name email role');
+
+    // Sorting
+    if (sort === 'newest') {
+      query = query.sort({ createdAt: -1 });
+    } else if (sort === 'oldest') {
+      query = query.sort({ createdAt: 1 });
+    } else if (sort === 'title_asc') {
+      query = query.sort({ title: 1 });
+    } else if (sort === 'title_desc') {
+      query = query.sort({ title: -1 });
+    } else {
+      query = query.sort({ createdAt: -1 }); // Default to newest
+    }
+
+    const resources = await query;
+
+    return res.status(200).json({
+      success: true,
+      count: resources.length,
+      data: resources,
+    });
+  } catch (error) {
+    next(error);
+  }
+};
+
+// @desc    Get single resource by ID
+// @route   GET /api/resources/:id
+// @access  Public
+const getResourceById = async (req, res, next) => {
+  try {
+    const resource = await Resource.findById(req.params.id).populate(
+      'createdBy',
+      'name email role'
+    );
+
+    if (!resource) {
+      return res.status(404).json({
+        success: false,
+        message: 'Resource not found',
+      });
+    }
+
+    return res.status(200).json({
+      success: true,
+      data: resource,
+    });
+  } catch (error) {
+    next(error);
+  }
+};
+
+// @desc    Create a new resource
+// @route   POST /api/resources
+// @access  Private (JWT)
+const createResource = async (req, res, next) => {
+  try {
+    const { title, description, category } = req.body;
+
+    const resourceData = {
+      title,
+      description: description || '',
+      category: category || 'General',
+      createdBy: req.user._id,
+    };
+
+    // If file was uploaded via Multer
+    if (req.file) {
+      resourceData.fileName = req.file.originalname;
+      resourceData.fileUrl = `/uploads/${req.file.filename}`;
+      resourceData.fileSize = req.file.size;
+    }
+
+    const resource = await Resource.create(resourceData);
+    await resource.populate('createdBy', 'name email role');
+
+    return res.status(201).json({
+      success: true,
+      message: 'Resource created successfully',
+      data: resource,
+    });
+  } catch (error) {
+    next(error);
+  }
+};
+
+// @desc    Update a resource
+// @route   PUT /api/resources/:id
+// @access  Private (Owner or Admin)
+const updateResource = async (req, res, next) => {
+  try {
+    let resource = await Resource.findById(req.params.id);
+
+    if (!resource) {
+      return res.status(404).json({
+        success: false,
+        message: 'Resource not found',
+      });
+    }
+
+    // Ownership check: creator or admin
+    const isOwner = resource.createdBy.toString() === req.user._id.toString();
+    const isAdmin = req.user.role === 'admin';
+
+    if (!isOwner && !isAdmin) {
+      return res.status(403).json({
+        success: false,
+        message: 'Access denied: You can only modify resources that you created.',
+      });
+    }
+
+    const { title, description, category } = req.body;
+
+    if (title !== undefined) resource.title = title;
+    if (description !== undefined) resource.description = description;
+    if (category !== undefined) resource.category = category;
+
+    // Handle new file upload if present
+    if (req.file) {
+      // Delete old file if exists
+      if (resource.fileUrl) {
+        const oldFilePath = path.join(__dirname, '..', resource.fileUrl);
+        if (fs.existsSync(oldFilePath)) {
+          fs.unlinkSync(oldFilePath);
+        }
+      }
+      resource.fileName = req.file.originalname;
+      resource.fileUrl = `/uploads/${req.file.filename}`;
+      resource.fileSize = req.file.size;
+    }
+
+    await resource.save();
+    await resource.populate('createdBy', 'name email role');
+
+    return res.status(200).json({
+      success: true,
+      message: 'Resource updated successfully',
+      data: resource,
+    });
+  } catch (error) {
+    next(error);
+  }
+};
+
+// @desc    Delete a resource
+// @route   DELETE /api/resources/:id
+// @access  Private (Owner or Admin)
+const deleteResource = async (req, res, next) => {
+  try {
+    const resource = await Resource.findById(req.params.id);
+
+    if (!resource) {
+      return res.status(404).json({
+        success: false,
+        message: 'Resource not found',
+      });
+    }
+
+    // Ownership check: creator or admin
+    const isOwner = resource.createdBy.toString() === req.user._id.toString();
+    const isAdmin = req.user.role === 'admin';
+
+    if (!isOwner && !isAdmin) {
+      return res.status(403).json({
+        success: false,
+        message: 'Access denied: You can only delete resources that you created.',
+      });
+    }
+
+    // Remove associated file from disk if present
+    if (resource.fileUrl) {
+      const filePath = path.join(__dirname, '..', resource.fileUrl);
+      if (fs.existsSync(filePath)) {
+        fs.unlinkSync(filePath);
+      }
+    }
+
+    await Resource.findByIdAndDelete(req.params.id);
+
+    return res.status(200).json({
+      success: true,
+      message: 'Resource deleted successfully',
+      data: { id: req.params.id },
+    });
+  } catch (error) {
+    next(error);
+  }
+};
+
+// @desc    Download resource file
+// @route   GET /api/resources/:id/download
+// @access  Public
+const downloadResourceFile = async (req, res, next) => {
+  try {
+    const resource = await Resource.findById(req.params.id);
+
+    if (!resource || !resource.fileUrl) {
+      return res.status(404).json({
+        success: false,
+        message: 'No file associated with this resource',
+      });
+    }
+
+    const filePath = path.join(__dirname, '..', resource.fileUrl);
+
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({
+        success: false,
+        message: 'File not found on server',
+      });
+    }
+
+    return res.download(filePath, resource.fileName || 'download');
+  } catch (error) {
+    next(error);
+  }
+};
+
+module.exports = {
+  getResources,
+  getResourceById,
+  createResource,
+  updateResource,
+  deleteResource,
+  downloadResourceFile,
+};

package/templates/server/middleware/adminMiddleware.js

@@ -0,0 +1,14 @@
+const adminOnly = (req, res, next) => {
+  if (req.user && req.user.role === 'admin') {
+    next();
+  } else {
+    return res.status(403).json({
+      success: false,
+      message: 'Access denied: Admin role required for this action.',
+    });
+  }
+};
+
+module.exports = {
+  adminOnly,
+};

package/templates/server/middleware/authMiddleware.js

@@ -0,0 +1,53 @@
+const jwt = require('jsonwebtoken');
+const User = require('../models/User');
+
+const protect = async (req, res, next) => {
+  let token;
+
+  if (
+    req.headers.authorization &&
+    req.headers.authorization.startsWith('Bearer')
+  ) {
+    try {
+      token = req.headers.authorization.split(' ')[1];
+
+      const decoded = jwt.verify(
+        token,
+        process.env.JWT_SECRET || 'fallback_jwt_secret_for_exam'
+      );
+
+      const user = await User.findById(decoded.id).select('-password');
+
+      if (!user) {
+        return res.status(401).json({
+          success: false,
+          message: 'User belonging to this token no longer exists.',
+        });
+      }
+
+      if (!user.isActive) {
+        return res.status(403).json({
+          success: false,
+          message: 'User account is deactivated.',
+        });
+      }
+
+      req.user = user;
+      next();
+    } catch (error) {
+      return res.status(401).json({
+        success: false,
+        message: 'Not authorized, token verification failed.',
+      });
+    }
+  } else {
+    return res.status(401).json({
+      success: false,
+      message: 'Not authorized, no Bearer token provided in Authorization header.',
+    });
+  }
+};
+
+module.exports = {
+  protect,
+};

package/templates/server/middleware/errorMiddleware.js

@@ -0,0 +1,55 @@
+// 404 Handler
+const notFound = (req, res, next) => {
+  const error = new Error(`Not Found - ${req.originalUrl}`);
+  res.status(404);
+  next(error);
+};
+
+// Centralized Error Handler
+const errorHandler = (err, req, res, next) => {
+  let statusCode = res.statusCode === 200 ? 500 : res.statusCode;
+
+  // Handle Mongoose Bad ObjectId (CastError)
+  if (err.name === 'CastError' && err.kind === 'ObjectId') {
+    statusCode = 404;
+    err.message = 'Resource not found (invalid ID format)';
+  }
+
+  // Handle Mongoose Duplicate Key Error
+  if (err.code === 11000) {
+    statusCode = 400;
+    const field = Object.keys(err.keyValue)[0];
+    err.message = `Duplicate value entered for ${field} field.`;
+  }
+
+  // Handle Multer errors
+  if (err.name === 'MulterError') {
+    statusCode = 400;
+    if (err.code === 'LIMIT_FILE_SIZE') {
+      err.message = 'File size limit exceeded (Max 10MB).';
+    }
+  }
+
+  // API Requests get JSON response
+  if (req.originalUrl.startsWith('/api')) {
+    return res.status(statusCode).json({
+      success: false,
+      message: err.message || 'Internal Server Error',
+      ...(process.env.NODE_ENV === 'development' && { stack: err.stack }),
+    });
+  }
+
+  // Render error for browser/EJS admin routes
+  res.status(statusCode).send(`
+    <div style="font-family: sans-serif; padding: 2rem; text-align: center;">
+      <h2>Error ${statusCode}</h2>
+      <p>${err.message || 'Something went wrong.'}</p>
+      <a href="/admin/login">Return to Admin Login</a>
+    </div>
+  `);
+};
+
+module.exports = {
+  notFound,
+  errorHandler,
+};

package/templates/server/middleware/sessionAuthMiddleware.js

@@ -0,0 +1,12 @@
+const sessionAuth = (req, res, next) => {
+  if (req.session && req.session.user && req.session.user.role === 'admin') {
+    res.locals.adminUser = req.session.user;
+    next();
+  } else {
+    return res.redirect('/admin/login?error=Please%20login%20as%20an%20admin%20to%20access%20dashboard');
+  }
+};
+
+module.exports = {
+  sessionAuth,
+};

package/templates/server/middleware/uploadMiddleware.js

@@ -0,0 +1,61 @@
+const multer = require('multer');
+const path = require('path');
+const fs = require('fs');
+
+// Ensure uploads folder exists
+const uploadDir = path.join(__dirname, '..', 'uploads');
+if (!fs.existsSync(uploadDir)) {
+  fs.mkdirSync(uploadDir, { recursive: true });
+}
+
+// Storage Configuration
+const storage = multer.diskStorage({
+  destination: function (req, file, cb) {
+    cb(null, uploadDir);
+  },
+  filename: function (req, file, cb) {
+    // Generate safe, unique filename: timestamp-random-originalname
+    const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1e9);
+    const sanitizedExt = path.extname(file.originalname).toLowerCase();
+    const sanitizedBase = path
+      .basename(file.originalname, sanitizedExt)
+      .replace(/[^a-zA-Z0-9_-]/g, '_');
+    cb(null, `${sanitizedBase}-${uniqueSuffix}${sanitizedExt}`);
+  },
+});
+
+// File filter for supported file types: pdf, png, jpg, jpeg, doc, docx
+const fileFilter = (req, file, cb) => {
+  const allowedExtensions = /pdf|png|jpg|jpeg|doc|docx/;
+  const extname = allowedExtensions.test(
+    path.extname(file.originalname).toLowerCase()
+  );
+  const mimetype =
+    allowedExtensions.test(file.mimetype) ||
+    file.mimetype === 'application/pdf' ||
+    file.mimetype === 'image/png' ||
+    file.mimetype === 'image/jpeg' ||
+    file.mimetype === 'application/msword' ||
+    file.mimetype ===
+      'application/vnd.openxmlformats-officedocument.wordprocessingml.document';
+
+  if (extname || mimetype) {
+    return cb(null, true);
+  } else {
+    return cb(
+      new Error(
+        'Invalid file type. Only PDF, PNG, JPG, JPEG, DOC, and DOCX files are allowed.'
+      ),
+      false
+    );
+  }
+};
+
+// 10MB limit
+const upload = multer({
+  storage: storage,
+  limits: { fileSize: 10 * 1024 * 1024 },
+  fileFilter: fileFilter,
+});
+
+module.exports = upload;

package/templates/server/middleware/validateMiddleware.js

@@ -0,0 +1,61 @@
+const { body, validationResult } = require('express-validator');
+
+// Reusable middleware to handle validation results
+const validate = (req, res, next) => {
+  const errors = validationResult(req);
+  if (!errors.isEmpty()) {
+    return res.status(400).json({
+      success: false,
+      message: 'Validation failed',
+      errors: errors.array().map((err) => ({
+        field: err.path || err.param,
+        message: err.msg,
+      })),
+    });
+  }
+  next();
+};
+
+// User Registration Validation Rules
+const registerValidationRules = [
+  body('name').trim().notEmpty().withMessage('Name is required'),
+  body('email')
+    .trim()
+    .isEmail()
+    .withMessage('Please provide a valid email address')
+    .normalizeEmail(),
+  body('password')
+    .isLength({ min: 6 })
+    .withMessage('Password must be at least 6 characters long'),
+  body('role')
+    .optional()
+    .isIn(['student', 'admin'])
+    .withMessage('Role must be either student or admin'),
+  validate,
+];
+
+// User Login Validation Rules
+const loginValidationRules = [
+  body('email')
+    .trim()
+    .isEmail()
+    .withMessage('Please provide a valid email address')
+    .normalizeEmail(),
+  body('password').notEmpty().withMessage('Password is required'),
+  validate,
+];
+
+// Generic Resource Validation Rules
+const resourceValidationRules = [
+  body('title').trim().notEmpty().withMessage('Title is required'),
+  body('description').optional().trim(),
+  body('category').optional().trim(),
+  validate,
+];
+
+module.exports = {
+  validate,
+  registerValidationRules,
+  loginValidationRules,
+  resourceValidationRules,
+};

package/templates/server/models/Resource.js

@@ -0,0 +1,43 @@
+const mongoose = require('mongoose');
+
+const resourceSchema = new mongoose.Schema(
+  {
+    title: {
+      type: String,
+      required: [true, 'Please provide a title'],
+      trim: true,
+    },
+    description: {
+      type: String,
+      trim: true,
+      default: '',
+    },
+    category: {
+      type: String,
+      trim: true,
+      default: 'General',
+    },
+    fileUrl: {
+      type: String,
+      default: null,
+    },
+    fileName: {
+      type: String,
+      default: null,
+    },
+    fileSize: {
+      type: Number,
+      default: null,
+    },
+    createdBy: {
+      type: mongoose.Schema.Types.ObjectId,
+      ref: 'User',
+      required: true,
+    },
+  },
+  {
+    timestamps: true,
+  }
+);
+
+module.exports = mongoose.model('Resource', resourceSchema);

package/templates/server/models/User.js

@@ -0,0 +1,48 @@
+const mongoose = require('mongoose');
+
+const userSchema = new mongoose.Schema(
+  {
+    name: {
+      type: String,
+      required: [true, 'Please provide a name'],
+      trim: true,
+    },
+    email: {
+      type: String,
+      required: [true, 'Please provide an email'],
+      unique: true,
+      lowercase: true,
+      trim: true,
+      match: [
+        /^\w+([.-]?\w+)*@\w+([.-]?\w+)*(\.\w{2,3})+$/,
+        'Please provide a valid email address',
+      ],
+    },
+    password: {
+      type: String,
+      required: [true, 'Please provide a password'],
+      minlength: 6,
+    },
+    role: {
+      type: String,
+      enum: ['student', 'admin'],
+      default: 'student',
+    },
+    isActive: {
+      type: Boolean,
+      default: true,
+    },
+  },
+  {
+    timestamps: true,
+  }
+);
+
+// Method to remove password from user object when returning JSON
+userSchema.methods.toJSON = function () {
+  const userObj = this.toObject();
+  delete userObj.password;
+  return userObj;
+};
+
+module.exports = mongoose.model('User', userSchema);

package/templates/server/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "server",
+  "version": "1.0.0",
+  "description": "Exam-ready MERN backend with Express, MongoDB, JWT, Sessions, EJS, and Multer",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js",
+    "dev": "nodemon server.js"
+  },
+  "dependencies": {
+    "bcryptjs": "^2.4.3",
+    "cors": "^2.8.5",
+    "dotenv": "^16.4.5",
+    "ejs": "^3.1.10",
+    "express": "^4.19.2",
+    "express-session": "^1.18.0",
+    "express-validator": "^7.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "mongoose": "^8.4.1",
+    "multer": "^1.4.5-lts.1"
+  },
+  "devDependencies": {
+    "nodemon": "^3.1.2"
+  }
+}