Built with Node.js · Express · MongoDB · JWT

NexusCRM — Backend API Server

Production-ready RESTful CRM backend built with Node.js, Express & MongoDB

---

Overview

NexusCRM is a secure, scalable Customer Relationship Management backend that allows sales teams to manage contacts, track deals through a pipeline, and administer users — all through a clean JSON REST API with JWT-based authentication.

---

Tech Stack

Layer	Technology	Purpose
Runtime	Node.js 18+	JavaScript server environment
Framework	Express.js 4.x	HTTP routing & middleware pipeline
Database	MongoDB Atlas	Cloud-hosted document storage
ODM	Mongoose 7.x	Schema modeling & query builder
Auth	JSON Web Tokens	Stateless session management
Security	bcryptjs	Password hashing with salt rounds
Config	dotenv	Environment variable management
Dev Tool	nodemon	Hot-reload during development

---

🏗️ System Architecture

Request flow: Client → CORS/JWT Middleware → Route Controller → Service Logic → MongoDB → JSON Response

---

📁 Project Structure

nexuscrm-server/
├── Server.js                  ← Entry point (Express init + DB connect)
├── .env                       ← Secrets (never commit this)
├── package.json
│
├── config/
│   └── db.js                  ← Mongoose connection setup
│
├── middleware/
│   └── authMiddleware.js      ← JWT verification for protected routes
│
├── models/
│   ├── User.js                ← User schema (name, email, passwordHash, role)
│   ├── Contact.js             ← Contact schema (name, email, phone, company)
│   └── Deal.js                ← Deal schema (title, value, stage, contactRef)
│
├── routes/
│   ├── authRoutes.js          ← POST /register  POST /login
│   ├── userRoutes.js          ← GET PUT DELETE /users/:id
│   ├── contactRoutes.js       ← Full CRUD /contacts
│   └── dealRoutes.js          ← Full CRUD /deals
│
└── controllers/
    ├── authController.js
    ├── userController.js
    ├── contactController.js
    └── dealController.js

---

⚙️ Getting Started

Prerequisites

• Node.js v18+
• npm v9+
• MongoDB Atlas account (or local MongoDB)

Installation

# 1. Clone the repo
git clone https://github.com/your-username/nexuscrm-server.git
cd nexuscrm-server

# 2. Install dependencies
npm install

# 3. Setup environment
cp .env.example .env
# → Edit .env with your credentials

# 4. Run in development mode
npm run dev

Expected terminal output:

[nodemon] 3.0.0
[nodemon] starting `Server.js`
✔  MongoDB Atlas connected successfully
✔  Server is running on http://localhost:5000

---

🔐 Environment Variables

Create a .env file in the root:

PORT=5000
NODE_ENV=development
MONGO_URI=mongodb+srv://<username>:<password>@cluster.mongodb.net/nexuscrm
JWT_SECRET=your_super_secret_key_minimum_32_characters
JWT_EXPIRES_IN=7d

⚠️ Never commit .env to version control. It is listed in .gitignore.

---

📡 API Reference

All routes are prefixed with /api. Protected routes require:

Authorization: Bearer <your_jwt_token>

🔑 Auth Endpoints

Method	Endpoint	Access	Description
POST	/api/auth/register	🟢 Public	Register new user
POST	/api/auth/login	🟢 Public	Login & get JWT token

👤 User Endpoints

Method	Endpoint	Access	Description
GET	/api/users	🔒 Protected	Get all users
GET	/api/users/:id	🔒 Protected	Get user by ID
PUT	/api/users/:id	🔒 Protected	Update user profile
DELETE	/api/users/:id	🔒 Protected	Delete user

📋 Contact Endpoints

Method	Endpoint	Access	Description
GET	/api/contacts	🔒 Protected	List all contacts
POST	/api/contacts	🔒 Protected	Create a contact
GET	/api/contacts/:id	🔒 Protected	Get contact by ID
PUT	/api/contacts/:id	🔒 Protected	Update contact
DELETE	/api/contacts/:id	🔒 Protected	Delete contact

💼 Deal Endpoints

Method	Endpoint	Access	Description
GET	/api/deals	🔒 Protected	List all deals
POST	/api/deals	🔒 Protected	Create a deal
GET	/api/deals/:id	🔒 Protected	Get deal by ID
PUT	/api/deals/:id	🔒 Protected	Update / move stage
DELETE	/api/deals/:id	🔒 Protected	Delete a deal

Deal pipeline: lead → proposal → negotiation → closed-won / closed-lost

---

📊 Sample API Output

POST /api/auth/login — 200 OK

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY0ZjFjM2E3ZTJiO...",
  "user": {
    "_id": "64f1c3a7e2b8d90012af3e11",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "role": "admin",
    "createdAt": "2024-08-01T10:30:00.000Z"
  }
}

GET /api/contacts — 200 OK

[
  {
    "_id": "64f2a8b1c3e1f70034cd9e21",
    "name": "Acme Corporation",
    "email": "contact@acme.com",
    "phone": "+1-800-555-0100",
    "company": "Acme Corp",
    "deal": {
      "stage": "proposal",
      "value": 24000
    },
    "createdAt": "2024-08-05T08:20:00.000Z"
  }
]

POST /api/contacts — 401 Unauthorized (no token)

{
  "success": false,
  "message": "Not authorized, token missing or invalid"
}

POST /api/auth/register — 400 Bad Request (duplicate email)

{
  "success": false,
  "message": "User already exists with this email"
}

---

🔒 Security Implementation

Threat	Protection
Plain-text passwords	bcryptjs with 10 salt rounds — never stored raw
Unauthorized access	JWT middleware blocks all protected routes
Cross-origin attacks	CORS configured with allowed origins
Invalid data	Mongoose schema validation before any DB write
Secret exposure	All keys in .env, never hardcoded in source

---

🔄 Authentication Flow

1. REGISTER  →  Password hashed (bcrypt)  →  User saved in MongoDB
2. LOGIN     →  Hash compared (bcrypt)    →  JWT token signed & returned
3. REQUEST   →  Bearer token in header    →  JWT middleware verifies
4. EXPIRED   →  401 Unauthorized          →  Client re-authenticates

---

📦 Dependencies

{
  "dependencies": {
    "bcryptjs": "^2.4.3",
    "cors": "^2.8.5",
    "dotenv": "^16.0.3",
    "express": "^4.18.2",
    "jsonwebtoken": "^9.0.0",
    "mongoose": "^7.0.0"
  },
  "devDependencies": {
    "nodemon": "^3.0.0"
  }
}

---

📜 Scripts

npm start       # Production — node Server.js
npm run dev     # Development — nodemon Server.js (hot reload)

---

📄 License

MIT © 2024 NexusCRM

---

Built with Node.js · Express · MongoDB · JWT · bcrypt