Backend

A server is a program that waits for HTTP requests. Express, middleware, env vars, errors, CRUD from scratch.

• 14.0Orientation: what we are building this chapter
• 14.1A server is just a program that waits for HTTP requests
• 14.2Node.js: same JS, no browser
• 14.3npm vs pnpm vs yarn (pick one and move on)
• 14.4package.json and node_modules demystified
• 14.5Module systems: CommonJS vs ESM
• 14.6Your first server with the built-in http module
• 14.7Express: why it exists and what it adds
• 14.8Routes and route handlers
• 14.9Middleware as a pipeline
• 14.10Reading request bodies, query strings, URL params
• 14.11Sending responses: status, headers, JSON
• 14.12Error handling that doesn't crash your server
• 14.13Environment variables and dotenv
• 14.14Logging that helps future you
• 14.15Building a CRUD API end-to-end
• 14.16Calling your API from your Next.js frontend
• 14.assignAssignment: Express CRUD API exercised with curl and the browser

Modules, controllers, services, DI, DTOs, guards, interceptors, pipes. The structure that lets a backend grow past the toy.

• 15.0Orientation: from writing a backend to structuring one
• 15.1Why NestJS exists: the five opinions it bakes in
• 15.2Installing Nest, the CLI, and your first module
• 15.3The Nest project structure, file by file
• 15.4Modules: the box with four lids
• 15.5Controllers: routes as decorated methods
• 15.6Services and providers: where the logic lives
• 15.7Dependency injection from scratch (the explanation that finally lands)
• 15.8DTOs: one class per request body
• 15.9class-validator and class-transformer: rules on a class
• 15.10Pipes: validate, transform, or reject
• 15.11Guards: who is allowed to call this route
• 15.12Interceptors: wrap the handler, time it, transform it
• 15.13Exception filters: turn thrown errors into clean JSON
• 15.14Configuration management with @nestjs/config
• 15.15Logging in Nest: kill the console.log habit
• 15.16Background jobs: BullMQ in the shape Nest expects
• 15.17Testing in Nest: the test module, mocks, and e2e
• 15.assignAssignment: rewrite the Ch 14 CRUD in Nest with proper structure

Data outlives code. SQL, Postgres, schemas, relations, indexes, normalisation, Prisma, migrations, the N+1 problem.

• 16.0Orientation: the chapter that puts a real database behind your API
• 16.1Why data outlives code
• 16.2SQL vs NoSQL (and why we go SQL first)
• 16.3Installing Postgres locally (and the Docker alternative)
• 16.4psql and GUI tools (TablePlus, DBeaver, pgAdmin)
• 16.5Tables, rows, columns, types
• 16.6Primary keys, foreign keys, indexes
• 16.7SELECT, WHERE, ORDER BY, LIMIT
• 16.8INSERT, UPDATE, DELETE
• 16.9JOIN: inner, left, right, full
• 16.10Normalisation: 1NF, 2NF, 3NF, with worked examples
• 16.11When to denormalise (and the cost)
• 16.12Transactions and isolation levels
• 16.13Indexes, how they work
• 16.14The N+1 problem and how to spot it
• 16.15Prisma: schema-first, migrations, the client
• 16.16Connection pooling
• 16.17Seeding data for development
• 16.assignAssignment: Model and migrate, then wire into the Nest API

Sessions vs JWT, password hashing, OAuth, magic links, RBAC, CSRF and XSS in auth contexts. The chapter where security stops being someone else's job.

• 17.0Orientation: the chapter where your API learns who you are
• 17.1What authentication actually is (and what it isn't)
• 17.2Authentication vs authorisation: the words that get mixed up
• 17.3Passwords: the only acceptable storage (bcrypt and argon2)
• 17.4Why you never roll your own password hashing
• 17.5Sessions: how they work, where they live
• 17.6JWTs: how they work, what they're for, what they're not for
• 17.7Sessions vs JWTs: where each is correct
• 17.8OAuth 2.0 step by step: the dance, drawn out
• 17.9OpenID Connect on top of OAuth
• 17.10Magic links and passwordless flows
• 17.11Multi-factor authentication: TOTP and WebAuthn at a high level
• 17.12RBAC vs ABAC: roles vs attributes
• 17.13CSRF attacks in plain English
• 17.14XSS in auth contexts
• 17.15Choosing a library: NextAuth/Auth.js, Clerk, Supabase Auth
• 17.16Wiring email/password and Google OAuth into the Nest API
• 17.assignAssignment: Working auth with email/password and Google OAuth

REST in detail, GraphQL, tRPC, WebSockets, webhooks, idempotency, rate limiting. The protocols you'll see at real companies.

• 18.0Orientation: every API is a contract
• 18.1REST, in detail
• 18.2The Richardson maturity model
• 18.3Versioning APIs without ruining your life
• 18.4Pagination, filtering, sorting
• 18.5GraphQL: what it solves and what it doesn't
• 18.6tRPC: type-safe RPC inside the JS monorepo
• 18.7REST vs GraphQL vs tRPC — when to pick each
• 18.8WebSockets: the long-running connection
• 18.9WebSockets the protocol: handshake, frames, ping/pong
• 18.10Server-sent events (and when to prefer them)
• 18.11Webhooks: when they call you
• 18.12Idempotency keys and at-least-once delivery
• 18.13Rate limiting strategies
• 18.14Wiring it all together in Nest
• 18.assignAssignment: same domain over REST, tRPC, and WebSockets