Bob Mine Clearance Timeline:
Day 1  📧 Invalid email address → Database Error → 500 Error
Day 2  🖼️ 500MB Upload → Disk Full → Service Outage
Day 3  🤖 1000 req/s → CPU 100% → 502 Bad Gateway
Day 4  🔒 Add middleware → Take Them One by One → Stable service

const express = require('express');
const app = express();

app.get('/boom', (req, res, next) => {
  try {
    throw new Error('Blown up on purpose');
  } catch (err) {
    next(err);
  }
});

app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(err.status || 500).json({
    code: err.status || 500,
    data: null,
    message: err.message
  });
});

app.listen(3000);

class AppError extends Error {
  constructor(message, status) {
    super(message);
    this.status = status;
    this.isOperational = true;
    Error.captureStackTrace(this, this.constructor);
  }
}

class NotFoundError extends AppError {
  constructor(resource) {
    super(`${resource} Not found`, 404);
  }
}

class ValidationError extends AppError {
  constructor(message) {
    super(message, 400);
  }
}

app.get('/users/:id', (req, res, next) => {
  const user = findUser(req.params.id);
  if (!user) return next(new NotFoundError('User'));
  res.json({ code: 0, data: user, message: 'ok' });
});

const { body, validationResult } = require('express-validator');

app.post('/register',
  body('username')
    .isLength({ min: 3, max: 20 }).withMessage('The username must3-20Character')
    .isAlphanumeric().withMessage('Usernames must consist of alphanumeric characters only.'),
  body('email')
    .isEmail().withMessage('Invalid email address')
    .normalizeEmail(),
  body('password')
    .isLength({ min: 8 }).withMessage('Password must be at least 8 characters')
    .matches(/\d/).withMessage('Passwords must contain numbers')
    .matches(/[A-Z]/).withMessage('The password must contain uppercase letters.'),
  body('age')
    .optional()
    .isInt({ min: 1, max: 150 }).withMessage('Age requirement1-150'),
  (req, res, next) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({
        code: 400,
        data: errors.array(),
        message: 'Request verification failed'
      });
    }
    next();
  },
  (req, res) => {
    res.json({ code: 0, data: req.body, message: 'ok' });
  }
);

const multer = require('multer');
const path = require('path');

const storage = multer.diskStorage({
  destination: (req, file, cb) => {
    cb(null, 'uploads/');
  },
  filename: (req, file, cb) => {
    const ext = path.extname(file.originalname);
    const uniqueName = `${Date.now()}-${Math.round(Math.random() * 1e9)}${ext}`;
    cb(null, uniqueName);
  }
});

const fileFilter = (req, file, cb) => {
  const allowed = /\.(jpg|jpeg|png|gif|webp)$/i;
  if (allowed.test(path.extname(file.originalname))) {
    cb(null, true);
  } else {
    cb(new Error('Supports only jpg/png/gif/webp Format'), false);
  }
};

const upload = multer({
  storage,
  fileFilter,
  limits: { fileSize: 5 * 1024 * 1024 }
});

app.post('/avatar', upload.single('avatar'), (req, res) => {
  if (!req.file) return res.status(400).json({ code: 400, data: null, message: 'Please upload the file' });
  res.json({
    code: 0,
    data: { url: `/uploads/${req.file.filename}`, size: req.file.size },
    message: 'ok'
  });
});

app.post('/photos', upload.array('photos', 9), (req, res) => {
  const urls = req.files.map(f => `/uploads/${f.filename}`);
  res.json({ code: 0, data: urls, message: 'ok' });
});

const express = require('express');
const app = express();

app.use('/static', express.static('public', {
  maxAge: '7d',
  etag: true,
  lastModified: true,
  immutable: true,
  setHeaders: (res, filePath) => {
    if (filePath.endsWith('.html')) {
      res.setHeader('Cache-Control', 'no-cache');
    }
    if (filePath.match(/\.(jpg|png|gif|webp|svg)$/)) {
      res.setHeader('Cache-Control', 'public, max-age=2592000, immutable');
    }
  }
}));

app.use('/uploads', express.static('uploads', {
  maxAge: '30d',
  dotfiles: 'deny'
}));

const responseHandler = (req, res, next) => {
  res.success = (data = null, message = 'ok') => {
    res.json({ code: 0, data, message });
  };
  res.fail = (message = 'Operation Failed', code = -1, data = null) => {
    res.json({ code, data, message });
  };
  res.paginate = (list, total, page, pageSize) => {
    res.json({
      code: 0,
      data: { list, total, page, pageSize, totalPages: Math.ceil(total / pageSize) },
      message: 'ok'
    });
  };
  next();
};

app.use(responseHandler);

app.get('/users', (req, res) => {
  const users = getUserList();
  res.success(users);
});

app.get('/users/:id', (req, res, next) => {
  const user = findUser(req.params.id);
  if (!user) return res.fail('User does not exist', 404);
  res.success(user);
});

const rateLimit = require('express-rate-limit');

const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  message: { code: 429, data: null, message: 'Too many requests，Please try again later.' }
});

const apiLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 30,
  message: { code: 429, data: null, message: 'API Exceeded the call limit' }
});

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  skipSuccessfulRequests: true,
  message: { code: 429, data: null, message: 'Too many failed login attempts, please try again in 15 minutes' }
});

app.use(globalLimiter);
app.use('/api/', apiLimiter);
app.use('/auth/login', loginLimiter);

const dotenv = require('dotenv');
const path = require('path');

dotenv.config({ path: path.resolve(process.env.NODE_ENV ? `.env.${process.env.NODE_ENV}` : '.env') });

const config = {
  port: parseInt(process.env.PORT, 10) || 3000,
  env: process.env.NODE_ENV || 'development',
  db: {
    host: process.env.DB_HOST || 'localhost',
    port: parseInt(process.env.DB_PORT, 10) || 27017,
    name: process.env.DB_NAME || 'myapp_dev'
  },
  jwt: {
    secret: process.env.JWT_SECRET,
    expiresIn: process.env.JWT_EXPIRES_IN || '7d'
  },
  upload: {
    maxFileSize: parseInt(process.env.MAX_FILE_SIZE, 10) || 5 * 1024 * 1024,
    allowedTypes: (process.env.ALLOWED_TYPES || 'jpg,jpeg,png,gif,webp').split(',')
  },
  rateLimit: {
    windowMs: parseInt(process.env.RATE_WINDOW_MS, 10) || 15 * 60 * 1000,
    max: parseInt(process.env.RATE_MAX, 10) || 100
  }
};

module.exports = config;

# .env              ← Default（Development），Do not submit to Git
# .env.production   ← Production Environment，Strictly Restrict Access
# .env.test         ← Test Environment

PORT=3000
NODE_ENV=development

DB_HOST=localhost
DB_PORT=27017
DB_NAME=myapp_dev

JWT_SECRET=your-super-secret-key-change-in-production
JWT_EXPIRES_IN=7d

MAX_FILE_SIZE=5242880
ALLOWED_TYPES=jpg,jpeg,png,gif,webp

RATE_WINDOW_MS=900000
RATE_MAX=100

# .gitignore Must include
.env
.env.*
!.env.example

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const multer = require('multer');
const { body, param, validationResult } = require('express-validator');
const compression = require('compression');
const path = require('path');

const config = require('./config');

const app = express();

app.use(helmet());
app.use(cors({ origin: config.corsOrigin, credentials: true }));
app.use(compression({ threshold: 1024 }));
app.use(express.json({ limit: '10kb' }));
app.use(express.urlencoded({ extended: true }));

const globalLimiter = rateLimit({
  windowMs: config.rateLimit.windowMs,
  max: config.rateLimit.max,
  standardHeaders: true,
  legacyHeaders: false,
  message: { code: 429, data: null, message: 'error.rate_limited' }
});
app.use(globalLimiter);

const upload = multer({
  storage: multer.diskStorage({
    destination: 'uploads/',
    filename: (req, file, cb) => {
      const ext = path.extname(file.originalname);
      cb(null, `${Date.now()}-${Math.random().toString(36).slice(2)}${ext}`);
    }
  }),
  fileFilter: (req, file, cb) => {
    const ext = path.extname(file.originalname).toLowerCase();
    if (config.upload.allowedTypes.some(t => `.${t}` === ext)) {
      cb(null, true);
    } else {
      cb(new Error('error.invalid_file_type'), false);
    }
  },
  limits: { fileSize: config.upload.maxFileSize, files: 5 }
});

const responseHandler = (req, res, next) => {
  res.success = (data = null, message = 'ok') => {
    res.json({ code: 0, data, message });
  };
  res.fail = (message = 'error.internal', code = -1, data = null) => {
    res.json({ code, data, message });
  };
  next();
};
app.use(responseHandler);

const validate = (rules) => [
  ...rules,
  (req, res, next) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({
        code: 400,
        data: errors.array().map(e => ({ field: e.path, message: e.msg })),
        message: 'error.validation_failed'
      });
    }
    next();
  }
];

app.post('/api/users',
  validate([
    body('username').isLength({ min: 3, max: 20 }).withMessage('error.username_length'),
    body('email').isEmail().withMessage('error.invalid_email').normalizeEmail(),
    body('password').isLength({ min: 8 }).withMessage('error.password_length')
  ]),
  (req, res) => {
    const user = createUser(req.body);
    res.success(user, 'ok');
  }
);

app.post('/api/upload',
  upload.array('files', 5),
  (req, res) => {
    if (!req.files || req.files.length === 0) {
      return res.fail('error.no_file_uploaded', 400);
    }
    const urls = req.files.map(f => `/uploads/${f.filename}`);
    res.success(urls, 'ok');
  }
);

app.get('/api/users/:id',
  validate([param('id').isMongoId().withMessage('error.invalid_id')]),
  (req, res) => {
    const user = findUser(req.params.id);
    if (!user) return res.fail('error.user_not_found', 404);
    res.success(user);
  }
);

app.use('/uploads', express.static('uploads', { maxAge: '30d', dotfiles: 'deny' }));

app.use((req, res) => {
  res.status(404).json({ code: 404, data: null, message: 'error.not_found' });
});

class AppError extends Error {
  constructor(message, status) {
    super(message);
    this.status = status;
    this.isOperational = true;
  }
}

app.use((err, req, res, next) => {
  if (err instanceof multer.MulterError) {
    if (err.code === 'LIMIT_FILE_SIZE') {
      return res.status(413).json({ code: 413, data: null, message: 'error.file_too_large' });
    }
    return res.status(400).json({ code: 400, data: null, message: 'error.upload_failed' });
  }
  const status = err.status || 500;
  const message = err.isOperational ? err.message : 'error.internal';
  if (config.env === 'development') console.error(err.stack);
  res.status(status).json({ code: status, data: null, message });
});

app.listen(config.port, () => {
  console.log(`Server running on port ${config.port} [${config.env}]`);
});