Infiwall

The backend is organized under server/src with distinct layers: controllers contain business logic for users, canvases, and elements; routes expose RESTful endpoints guarded by the protect middleware that validates JWT tokens; models define MongoDB schemas for User, Canvas, and Element, each embedding references to enable relational‑like queries. Data flow starts at an HTTP request, passes through validation middleware (e.g., validation.js), reaches the controller, which interacts with Mongoose to persist or retrieve data, and finally returns a standardized JSON response.

Security is enforced at multiple levels. The auth.js middleware verifies the Authorization: Bearer <token> header, while Helmet, CORS, and bcryptjs protect against common web vulnerabilities and ensure password hashing. Input validation using express‑validator prevents malformed payloads, and a global error‑handling middleware normalizes error responses.

The frontend leverages a modular component library (src/components/ui) and a typed API layer (src/lib/api). The apiClient provides get, post, put, patch, and delete methods that automatically serialize request bodies and parse responses into a unified ApiResponse<T> shape. Services such as canvasService consume these methods, translating raw API data into domain models used by React components.

Build and deployment are streamlined with Vite for fast development bundling and ESLint for code quality. The project is configured as an ES module ("type": "module") and uses npm scripts for dev (vite), production builds, and linting. The repository is ready for containerization or serverless deployment, given its clear separation of concerns and stateless API design.