A robust, enterprise-ready backend solution for managing a hair salon's operations. This API handles everything from real-time customer-stylist consultations to administrative booking management and media-heavy style galleries.
🚀 Key Professional Highlights Dual-Role Architecture: Separate, secure logic flows for Admins (Salons) and Users (Customers).
Real-time Communication: Integrated Socket.io for instant messaging and live booking notifications.
Secure Auth Lifecycle: Implements JWT with Refresh Tokens and Device Fingerprinting (prevents account hijacking across different devices).
Atomic Transactions: Hand-coded rollback logic during registration ensures database integrity even if third-party services (Email/Cloudinary) fail.
Reference System: Custom algorithmic generation for unique, business-ready Booking Reference Numbers (e.g., BR123456AB...).
Runtime: Node.js (Express.js)
Database: MongoDB (Mongoose ODM)
Real-time: Socket.io
Media: Cloudinary (Categorized storage for Male/Female/Unisex styles)
Communication: Nodemailer (SMTP) & Twilio (SMS ready)
Security: Bcrypt.js, JWT, Crypto, & Device Fingerprinting
Hair-Style-App-Backend/ ├── controllers/ # Business Logic (Admin, User, Chat, Uploads) ├── middleware/ # RBAC, Auth, & Global Error Handling ├── models/ # MongoDB Schemas (Complex Nested Objects) ├── routers/ # Express Route Definitions ├── utils/ # Cron Jobs (Cleanup) & Helper Functions ├── views/ # Email Templates └── server.js # Entry Point & Socket.io Initialization
Clone and Install: git clone npm install
Environment Configuration: Create a .env file in the root directory:
MONGODB_URL=your_mongodb_connection_string PORT=8006 JSON_WEB_TOKEN_SECRET_KEY=your_secret CLOUDINARY_CLOUD_NAME=your_name CLOUDINARY_API_KEY=your_key CLOUDINARY_API_SECRET=your_secret EMAIL_USER=your_gmail EMAIL_PASS=your_app_password WEBSITE_URL=http://localhost:4123
Run the Server: # Development mode npm run dev
- Administrative Booking Control The Admin has full control over the salon's schedule.
Accept/Reject/Complete: Each action triggers an automated, professionally formatted email to the user via a specialized sendEmailMessage utility.
New Request Tracking: Admins can filter for "New" requests which auto-mark as "seen" once retrieved.
- Multi-Category Media Engine The app handles high-resolution hair style galleries:
Admin Uploads: Categorizes images into Male, Female, or Other folders on Cloudinary.
User Uploads: Customers can upload their desired styles or provide Web URLs, which the system validates before saving to the booking request.
- Messaging & Help Desk A dual-layer messaging system:
Consultation: Direct conversation threads between Users and Admin.
Notifications: Global notification system for salon-wide announcements (e.g., "Closed for Holiday").
📬 Postman Testing For easy testing, you can import the provided .json collection into Postman.
Download the Postman_Collection.json.
Import it into Postman.
Use the accessToken in the Bearer Token field for protected routes.
Solution: For production, it is recommended to use SendGrid (already integrated into package.json) or a dedicated mail relay. If using Gmail, ensure "App Passwords" are active and be aware that Render's shared IPs may occasionally be throttled.
OTP Verification: Both Admin and User accounts require 6-digit email verification before activation.
Device Guard: The RefreshToken logic checks the x-device-id header against the stored device UUID, ensuring sessions cannot be easily stolen.
Input Sanitization: Regex-based email and password validation on the controller level before database hitting.
To make it easy for recruiters and collaborators to verify the API logic, a complete Postman Collection is included in the root directory: HairStyle_Booking_Collection.json.
-
How to Test: Import the Collection: * Open Postman -> Click Import -> Select the HairStyle_Booking_Collection.json file.
-
Set the Base URL: The collection uses a variable {{BASE_URL}}. By default, it is set to http://localhost:8006/Api_Url.
If testing on a deployed server, update the Collection Variables to your live URL.
- Authentication Flow:
Step 1: Register a user/admin or Login.
Step 2: Copy the accessToken from the JSON response.
Step 3: For protected routes (like Booking or Admin Actions), go to the Auth tab in Postman, select Bearer Token, and paste your token.
- Testing File Uploads:
For routes like /upload/male, go to the Body tab -> select form-data.
Change the key type to File and upload a .jpg or .png to test the Cloudinary integration.