Building Scalable REST APIs with Node.js

src/
├─ config/         # Environment, DB, Redis
├─ controllers/    # Request/response logic
├─ middleware/     # Auth, validation, errors
├─ models/         # Data schemas
├─ routes/         # Endpoint definitions
├─ services/       # Business logic
├─ utils/          # Helpers, constants
├─ app.js          # Express setup
└─ server.js       # Entry point

// middleware/asyncHandler.js
export const asyncHandler = (fn) => (req, res, next) =>
  Promise.resolve(fn(req, res, next)).catch(next);

// Usage
router.get('/users/:id', asyncHandler(async (req, res) => {
  const user = await UserService.getById(req.params.id);
  if (!user) throw new NotFoundError('User');
  res.json(user);
}));

// validators/userValidator.js
import { z } from 'zod';

export const createUserSchema = z.object({
  body: z.object({
    email: z.string().email(),
    password: z.string().min(12),
    role: z.enum(['user', 'admin']).default('user')
  })
});

// middleware/validate.js
export const validate = (schema) => (req, res, next) => {
  const result = schema.safeParse({ body: req.body, query: req.query, params: req.params });
  if (!result.success) throw new ValidationError(result.error.flatten());
  next();
};

// middleware/auth.js
export const authenticate = asyncHandler(async (req, res, next) => {
  const token = req.cookies?.accessToken || req.headers.authorization?.split(' ')[1];
  if (!token) throw new UnauthorizedError();
  const payload = verifyToken(token);
  req.user = await UserService.getById(payload.sub);
  if (!req.user) throw new UnauthorizedError();
  next();
});

// config/rateLimit.js
import rateLimit from 'express-rate-limit';
import RedisStore from 'rate-limit-redis';

export const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10,
  store: new RedisStore({ client: redisClient }),
  keyGenerator: (req) => req.ip,
  standardHeaders: true,
  legacyHeaders: false
});