budget-app-backend

name	Budget App Backend
description	Express + MongoDB + TypeScript backend for the Expense Tracker application. Contains codebase analysis, architecture, conventions, and known issues.

Budget App Backend — Codebase Skill File

Overview

This is a REST API backend built with Express.js, TypeScript, MongoDB (Mongoose), and JWT authentication. It powers an expense tracking application with support for transactions, bank accounts/cards, categories, and Google OAuth login.

Entry Point: server.ts
API Router: API.ts
Port: Configured via .env → APP_PORT (default: 4000)
Database: MongoDB Atlas (connection string in .env)

---

Architecture & File Structure

budget_app-backend/
├── server.ts              # Express app setup, CORS, middleware, /ping endpoint
├── API.ts                 # Central API router — mounts all sub-routers
├── dotenv.ts              # Environment variable loader
├── utils.ts               # Utility helpers (month generation, random colors)
├── Controller/            # Business logic (one file per domain)
│   ├── Auth.ts            # Login + ping
│   ├── UserController.ts  # User registration (signup)
│   ├── GoogleLoginController.ts  # Google OAuth login flow
│   ├── TransactionsController.ts # CRUD + analytics (bar/line/pie charts)
│   ├── AccountController.ts      # Bank account & card CRUD
│   └── CategoryController.ts     # Income/expense category CRUD
├── Routers/               # Express routers (thin, just map routes to controllers)
│   ├── AuthRout.ts
│   ├── UserRouter.ts
│   ├── GoogleLoginRout.ts
│   ├── TransactionsRout.ts
│   ├── AccountRout.ts
│   └── CategoryRout.ts
├── Models/                # Mongoose schemas/models
│   ├── index.ts           # Barrel export — creates all models
│   ├── UserModel/UserModel.ts
│   ├── TransactionsModel/TransactionsModel.ts
│   ├── AccountModel/AccountModel.ts
│   └── CategoryModel/CategoryModel.ts
├── DB/
│   ├── DBconnection.ts    # MongoDB connection logic
│   └── hooks.ts           # Mongoose post-save/update hooks for account balance sync
├── JWT/
│   └── index.ts           # JWT generation, token verification middleware
├── ServerResponse/
│   └── ServerRisponse.ts  # Standardized HTTP response helper class
├── .env                   # Environment variables (⚠️ contains secrets — see issues)
├── package.json
└── tsconfig.json

---

API Endpoints

Public (No Auth Required)

Method	Path	Description
POST	/api/auth/login	Email/password login
GET	/api/auth/ping	Check if email exists
POST	/api/user/addUser	User registration
POST	/api/google/google_login	Google OAuth login
GET	/ping	Health check (DB connection status)

Protected (JWT Required via token header)

Method	Path	Description
POST	/api/transaction/addTransaction	Create transaction (auto-creates category if newCategory provided)
GET	/api/transaction/getTransaction	List with regex search & filter
GET	/api/transaction/getTransactionsForDashboard	All non-deleted user transactions
GET	/api/transaction/getTransactionsForEdit	Single transaction by ID
PUT	/api/transaction/editTransactions	Update transaction
DELETE	/api/transaction/deleteTransaction	Soft-delete transactions (sets deleted: true)
GET	/api/transaction/getBarGraphData	Monthly income/expense bar chart data
GET	/api/transaction/getLineGraphData	Monthly balance line chart data
GET	/api/transaction/getExpenseData	Expenses grouped by category
GET	/api/transaction/getIncomeData	Income grouped by category
GET	/api/transaction/getBalanceByPaymentMethod	Balance grouped by payment method
POST	/api/account/createAccount	Create bank/card account
GET	/api/account/gateAccountCard	All active accounts/cards
GET	/api/account/gatOneAccountCard	Single account/card by ID
PUT	/api/account/editAccountCard	Update account/card
DELETE	/api/account/deleteAccountCard	Hard delete account/card
GET	/api/account/gatAccount	Active bank accounts only
GET	/api/account/gatCard	Active cards only
POST	/api/category/createCategory	Create category
GET	/api/category/getIncomeCategory	All income categories
GET	/api/category/getExpenceCategory	All expense categories

---

Authentication Flow

1. Registration: POST /api/user/addUser → password hashed with bcrypt (10 rounds) → stored in MongoDB
2. Login: POST /api/auth/login → bcrypt compare → JWT generated → returned with user details
3. Google Login: POST /api/google/google_login → Google ID token verified → user created if new → JWT generated
4. Token Verification: Middleware in JWT/index.ts → reads token header (NOT Authorization: Bearer) → jwt.verify() → attaches req.user

---

Data Models

User

• name (String, required)
• email (String, required, unique)
• password (String, required)
• googleId (String, optional, unique)
• img_url (String, default: "")

Transaction

• _id (String, crypto.randomUUID — custom UUID, not MongoDB ObjectId)
• amount (Number, required)
• action (String: "income" | "expence") ← note: "expence" spelling used throughout
• category (String, required)
• description (String, required)
• paymentMethod (String)
• from (String — account/card reference)
• synced (Boolean, default: false)
• edited (Boolean, default: false)
• deleted (Boolean, default: false — soft delete flag)
• date (Date)
• created_at (Date, default: now)
• created_by (ObjectId ref User)

Account

• balance (Number, default: 0)
• name (String, required)
• type (String, enum: 'bank' | 'card')
• accountCardNumber (Number, required — last 4 digits)
• bankCardName (String, required)
• bankLocation (String, optional)
• ifcCode (String, optional — IFSC for banks)
• expairyDate (Date, optional — for cards)
• serviceProvider (String, optional — for cards)
• isActive (Boolean, default: true)
• created_by (ObjectId ref User)

Category

• category (String, required)
• action (String, required — "income" | "expence")
• Note: Categories are global (not user-specific)

---

Controller Details

TransactionsController

• createTransactions: Creates transaction; if newCategory field is provided in body, also creates a new Category document automatically
• getTransactions: Regex search across category, description, paymentMethod fields
• getTransactionsForDashboard: Returns all non-deleted transactions for authenticated user
• getTransactionsForEdit: Single transaction fetch by _id
• editTransactions: Update via _id; sets edited: true
• deleteTransactions: for...of loop with findOneAndUpdate to set deleted: true; also updates account balance via hook
• getBarGraphData: MongoDB aggregation — groups by month, sums income vs expence
• getLineGraphData: Monthly cumulative balance trend
• getExpenseData: Aggregates expense transactions by category for pie chart
• getIncomeData: Aggregates income transactions by category for doughnut chart
• getBalanceByPaymentMethod: Groups by paymentMethod and action for breakdown

AccountController

• createAccount: Checks for duplicate accountCardNumber before creating
• gatAccount / gatCard: Fetch active records filtered by type
• editAccountCard: Update any field via _id
• deleteAccountCard: Hard delete (not soft delete) from MongoDB
• gatOneAccountCard: Single account fetch by _id

CategoryController

• createCategory: ⚠️ Has a bug — see known issues #6
• getIncomeCategory: Returns all categories where action === "income"
• getExpenceCategory: Returns all categories where action === "expence"

---

Database Hooks (DB/hooks.ts)

Mongoose post-save/post-update hooks automatically update account balances:

• transactionAdded (post-save): When a non-cash transaction is saved, finds the account by from field and adjusts its balance (+income / -expence)
• transactionUpdated (post-findOneAndUpdate): Re-adjusts balance when a transaction is edited — ⚠️ logic appears inverted (see issue #14)

---

Conventions & Patterns

• Response format: All responses use ServerResponseHandler class → standardized JSON: { code, success, data, message }
• Error handling: try/catch in every controller, console.error() + 500 response
• Soft delete: Transactions use deleted: true flag — never physically removed
• Hard delete: Accounts/cards are physically deleted from MongoDB
• Token placement: JWT sent via custom token header (not Authorization: Bearer)
• Spelling: "expence" is the canonical spelling used across ALL models, controllers, hooks, and frontend — do NOT change to "expense"

---

🚨 KNOWN ISSUES & BUGS

Critical

1. 🔴 JWT tokens never expire (JWT/index.ts line 24) — expiresIn is commented out. Tokens are valid forever. Major security risk.

2. 🔴 .env file contains hardcoded secrets committed to repo — MongoDB Atlas credentials, JWT secret, and Google Client ID are all in .env. Must never be committed.

3. 🔴 CORS is wide open (server.ts line 8) — cors({ origin: "*" }) allows any domain. Should be restricted to known frontend origins.

4. 🔴 createCategory has a logic bug (CategoryController.ts lines 9-13) — After finding an existing category, it still creates a new one because there's no return or else. Also uses .find() (always-truthy array) instead of .findOne().

High Priority

5. 🟡 No input validation/sanitization — req.body / req.query passed directly to MongoDB queries. Vulnerable to NoSQL injection.

6. 🟡 useNewUrlParser and useUnifiedTopology deprecated (DBconnection.ts lines 8-9) — Ignored by Mongoose 7+. Should be removed.

7. 🟡 Date.now() called at schema definition time (AccountModel.ts line 45) — default: Date.now() evaluates once at startup. Should be default: Date.now (function reference).

8. 🟡 require: true used instead of required: true — Typo silently ignored by Mongoose in TransactionsModel (lines 28, 32, 53, 59, 63), AccountModel (lines 44, 49, 55), UserModel (line 22).

9. 🟡 Google login stores sub as password (GoogleLoginController.ts line 33) — password: sub stores Google sub ID as plaintext password. Security concern.

10. 🟡 transactionUpdated hook calls next() multiple times (DB/hooks.ts) — Can be called twice if action is income or expence. Causes duplicate balance adjustments.

11. 🟡 transactionUpdated balance logic appears inverted (DB/hooks.ts) — For income updates it subtracts; for expense updates it adds. Likely backwards.

12. 🟡 Bar/Line graphs aggregate by month number only — No year included in grouping. Data from different years in the same month is merged together.

Medium Priority

13. 🟠 @types/* packages in dependencies — @types/cors, @types/express, @types/node should be in devDependencies.

14. 🟠 nodemon in dependencies — Dev tool should not be a production dependency.

15. 🟠 No rate limiting on login endpoints — Vulnerable to brute-force attacks.

16. 🟠 No pagination — getTransactions and getTransactionsForDashboard return ALL documents. Will degrade with scale.

17. 🟠 Debug console messages in production — e.g., 'Access denied. Invalid tokennnnnn' in JWT/index.ts line 44.

18. 🟠 Typos in naming: ServerRisponse (→ "Response"), gatAccountCard (→ "get"), expairyDate (→ "expiry"), ifcCode (→ "ifsc"), Featch (→ "Fetch").

19. 🟠 gatOneAccountCard uses serviveProvider — Controller projection uses wrong field name (serviveProvider vs serviceProvider in schema).

20. 🟠 No logout endpoint — No server-side token invalidation.

21. 🟠 Categories are global, not user-scoped — All users share the same category pool. A user creating a category exposes it to all other users.

---

Fixed Issues (History)

• deleteTransactions used forEach with async/await — Fixed: switched to for...of
• deleteTransactions used { id: req } instead of { _id: req } — Fixed
• Inconsistent "expence" vs "expense" spelling in line graph — Fixed: standardized on "expence"
• getRandomColor() reassigned per iteration in bar chart loop — Fixed: called once per dataset

---

How to Run

# Install dependencies
npm install

# Start development server (uses nodemon + ts-node)
npm start

# Environment variables required in .env:
# APP_PORT=4000
# DB_HOST=<mongodb_connection_string>
# DB_NAME=<database_name>
# JWT_SECRET=<secret_key>
# GOOGLE_CLIENT_ID=<google_oauth_client_id>

---

Dependencies

Package	Purpose
express	Web framework
mongoose	MongoDB ODM
jsonwebtoken	JWT auth
bcrypt	Password hashing
cors	Cross-origin requests
dotenv	Environment variables
google-auth-library	Google OAuth token verification
moment	Date manipulation
nodemon	Dev auto-restart (⚠️ should be devDependency)
ts-node	TypeScript execution
typescript	TypeScript compiler