Skip to content
Data & AI

My Social Network API - Backend Architecture

Secure REST API (Node.js, Express, MongoDB) for a social network: groups, events, transactional ticketing, carpooling and polls.

Client
EFREI academic project
Year
2026
Expertise
Data & AI
Services
REST API, Backend Development, API Security, Data Modelling
Tools
  • Node.js
  • Express
  • MongoDB
  • JWT
  • Postman

Context

This project is part of a professional simulation in which Facebook commissioned a REST API for a brand-new social networking service. The goal was to design a robust backend architecture, with full freedom over the endpoint design, while meeting a precise functional specification.

Our approach

To meet these requirements, a complete and secure RESTful API was built with Node.js, Express and MongoDB.

  • Architecture & Modelling

    Advanced database schemas to manage users, groups (public, private, secret) and events.

  • Social Features

    Discussion threads attached to groups or events, commentable photo albums and interactive polls.

  • Ticketing & Transactions

    Ticketing with strict stock control (one ticket per outside attendee) handled through atomic MongoDB transactions (mongoose.startSession()).

  • Collaborative Modules (Bonus)

    An event Shopping List and an interactive Carpooling module.

  • Maximum Security

    JWT authentication, bcrypt password hashing, rate limiting against brute force, hardened headers (Helmet) and HTTPS-only encrypted traffic.

Deliverables

A fully working REST API documented in Postman, with source code validated by security tests and an architectural visualisation through an interactive Terminal component and a data flow diagram.

Discuss a similar projectExpertise Data & AI

API in action

One ticket purchase, one transaction

No user interface: the API reads through its requests. Here is the real ticket purchase call from the Postman collection, and the document returned by the server.

zsh — https://localhost:3000

Request

POST /events/68ff53f7feb4ed139d5dbb45/purchase HTTP/1.1
Host: localhost:3000
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…
Content-Type: application/json

{
  "ticketTypeId": "690650cac85bc6f4f34b2676",
  "buyerFirstName": "Peter",
  "buyerLastName": "Pan",
  "buyerAddress": "123 Neverland St, London",
  "buyerEmail": "peter.pan@test.com"
}

ResponseHTTP/1.1 201 Created

{
  "_id": "6906528fc85bc6f4f34b2690",
  "event": "68ff53f7feb4ed139d5dbb45",
  "ticketType": "690650cac85bc6f4f34b2676",
  "buyerFirstName": "Peter",
  "buyerLastName": "Pan",
  "buyerAddress": "123 Neverland St, London",
  "buyerEmail": "peter.pan@test.com",
  "purchaseDate": "2025-11-01T18:42:07.311Z",
  "createdAt": "2025-11-01T18:42:07.311Z",
  "updatedAt": "2025-11-01T18:42:07.311Z"
}
View the GitHub repository(new tab)

Inside a MongoDB session

  1. 1The event exists and is public, otherwise ticketing is refused.
  2. 2The ticket type actually belongs to this event.
  3. 3Stock check: soldCount < quantity.
  4. 4Ticket creation; the unique index (event + email) blocks a second purchase (409).
  5. 5Atomic soldCount increment ($inc), then full commit or rollback.

API surface

57 documented requests

Every resource of the Postman collection, with its HTTP verb breakdown.

Architecture

The data model

Thirteen Mongoose schemas linked by references. The event is the hub: ticketing, carpooling, shopping list, albums, polls and discussion thread all hang off it.

View the Mermaid code
erDiagram
  User {
    ObjectId _id PK
    string firstname
    string lastname
    string email UK
    string password "bcrypt"
    string avatar
  }
  Group {
    ObjectId _id PK
    string name
    string groupType "public | private | secret"
    ObjectId[] admins FK
    ObjectId[] members FK
    object settings
  }
  Event {
    ObjectId _id PK
    string name
    date startDate
    date endDate
    string location
    boolean isPrivate
    ObjectId group FK
    boolean shoppingListEnabled
    boolean carpoolingEnabled
  }
  TicketType {
    ObjectId _id PK
    ObjectId event FK
    string name
    number price
    number quantity
    number soldCount
  }
  PurchasedTicket {
    ObjectId _id PK
    ObjectId event FK
    ObjectId ticketType FK
    string buyerEmail "unique par event"
    date purchaseDate
  }
  CarpoolOffer {
    ObjectId _id PK
    ObjectId event FK
    ObjectId driver FK
    string departureLocation
    date departureTime
    number price
    number availableSeats
    number maxDetourMinutes
  }
  ShoppingListItem {
    ObjectId _id PK
    ObjectId event FK
    ObjectId user FK
    string itemName
    number quantity
    date arrivalTime
  }
  User }o--o{ Group : "admin / member"
  Group |o--o{ Event : "hosts"
  User }o--o{ Event : "organises / attends"
  Group ||--o| DiscussionThread : "thread"
  Event ||--o| DiscussionThread : "thread"
  DiscussionThread ||--o{ Message : "contains"
  User ||--o{ Message : "writes"
  Message |o--o{ Message : "replies to"
  Event ||--o{ PhotoAlbum : "albums"
  PhotoAlbum ||--o{ Photo : "contains"
  User ||--o{ Photo : "uploads"
  Event ||--o{ Poll : "polls"
  Poll ||--o{ PollResponse : "responses"
  User ||--o{ PollResponse : "votes"
  Event ||--o{ TicketType : "ticketing"
  TicketType ||--o{ PurchasedTicket : "sold as"
  Event ||--o{ PurchasedTicket : "1 per email"
  Event ||--o{ ShoppingListItem : "shopping list"
  User ||--o{ ShoppingListItem : "brings"
  Event ||--o{ CarpoolOffer : "carpooling"
  User ||--o{ CarpoolOffer : "drives"

Tech stack

Tooling

Runtime & API

  • Node.js (ESM)
  • Express
  • REST

Data

  • MongoDB
  • Mongoose
  • Transactions ACID

Security

  • JWT
  • bcrypt
  • Helmet
  • express-rate-limit
  • CORS
  • HTTPS / TLS

Tooling

  • Postman
  • ESLint
  • compression
  • dotenv
View the full source code (GitHub)(new tab)

Express controllers, Mongoose schemas, JWT middleware and the full Postman collection.

More projects Data & AI

Back to portfolio