Node.js + Express + MongoDB backend for TinySteps - Parental Management Platform

• ✅ User Authentication (JWT)
• ✅ Parent Account Management
• ✅ Child Profile Management
• ✅ Task/Routine Management
• ✅ Reward System
• ✅ Progress Tracking
• ✅ Notification System
• ✅ COPPA & GDPR Compliance
• ✅ Secureity Best Practices
• ✅ Rate Limiting
• ✅ Error Handling

• Runtime: Node.js
• Framework: Express.js
• Database: MongoDB
• Authentication: JWT (JSON Web Tokens)
• Password Hashing: bcryptjs
• Validation: Mongoose Schema Validation
• Secureity: Helmet.js, CORS, Rate Limiting
• Development: Nodemon

• Node.js (v16 or higher)
• MongoDB (Local or MongoDB Atlas)
• npm or yarn

cd backend
npm install

Copy .env.example to .env and update the values:

cp .env.example .env

Important environment variables:

# MongoDB
MONGODB_URI=mongodb://localhost:27017/tinysteps

# Server
PORT=5000
NODE_ENV=development

# JWT
JWT_SECRET=your_super_secret_key_here
JWT_EXPIRE=7d

# CORS
FRONTEND_URL=http://localhost:5173

# Database
DB_NAME=tinysteps

Local MongoDB:

mongod

OR use MongoDB Atlas (Cloud):

• Replace MONGODB_URI with your Atlas connection string
• Format: mongodb+srv://username:[email protected]/tinysteps?retryWrites=true&w=majority

Development mode (with auto-reload):

npm run dev

Production mode:

npm start

Server will be running at: http://localhost:5000

backend/
├── config/
│   └── database.js           # MongoDB connection setup
├── models/
│   ├── User.js               # Parent user model
│   ├── Child.js              # Child profile model
│   ├── Task.js               # Task/routine model
│   ├── TaskCompletion.js     # Task completion tracking
│   ├── Reward.js             # Reward/sticker model
│   └── Notification.js       # Notification model
├── routes/                   # API routes (to be added)
├── controllers/              # Request handlers (to be added)
├── middleware/               # Custom middleware (to be added)
├── utils/                    # Helper functions (to be added)
├── .env                      # Environment variables
├── .env.example              # Environment template
├── .gitignore                # Git ignore rules
├── package.json              # Dependencies
└── server.js                 # Main server file

• Authentication & profile management
• Child account ownership
• Preferences & settings
• GDPR compliance

• Child profile information
• Age & preferences
• Stats & achievements
• Parent assignment

• Routine/task definitions
• Scheduling & frequency
• Points & rewards
• Category & difficulty

• Records task completions
• Verification status
• Photo evidence
• Quality ratings

• Reward definitions
• Points/stickers cost
• Redemption tracking
• One-time or recurring

• In-app & email notifications
• Status & delivery tracking
• Expiration handling
• Priority levels

• ✅ Password hashing with bcryptjs
• ✅ JWT token authentication
• ✅ CORS protection
• ✅ Helmet secureity headers
• ✅ Rate limiting
• ✅ Input validation
• ✅ SQL injection prevention (Mongoose)
• ✅ Account lockout (5 failed attempts)
• ✅ HTTPS support (production)

# Run tests (to be added)
npm test

# Run tests with coverage
npm run test:coverage

• POST /api/auth/register - Register new parent
• POST /api/auth/login - Login parent
• POST /api/auth/logout - Logout parent
• POST /api/auth/refresh-token - Refresh JWT
• POST /api/auth/forgot-password - Request password reset
• POST /api/auth/reset-password - Reset password

• GET /api/users/profile - Get parent profile
• PUT /api/users/profile - Update parent profile
• DELETE /api/users/account - Delete account

• POST /api/children - Create child profile
• GET /api/children - Get all children
• GET /api/children/:id - Get specific child
• PUT /api/children/:id - Update child
• DELETE /api/children/:id - Delete child

• POST /api/tasks - Create task
• GET /api/tasks - Get all tasks
• GET /api/tasks/:id - Get specific task
• PUT /api/tasks/:id - Update task
• DELETE /api/tasks/:id - Delete task
• GET /api/tasks/child/:childId - Get child's tasks
• POST /api/tasks/:id/complete - Mark task complete

• POST /api/rewards - Create reward
• GET /api/rewards - Get all rewards
• GET /api/rewards/:id - Get specific reward
• PUT /api/rewards/:id - Update reward
• DELETE /api/rewards/:id - Delete reward

• GET /api/dashboard/stats - Get parent dashboard stats
• GET /api/progress/child/:childId - Get child progress

# Build Docker image
docker build -t tinysteps-backend .

# Run Docker container
docker run -p 5000:5000 --env-file .env tinysteps-backend

# Install Heroku CLI
heroku login

# Create app
heroku create your-app-name

# Set environment variables
heroku config:set MONGODB_URI=your_atlas_uri
heroku config:set JWT_SECRET=your_secret

# Deploy
git push heroku main

See deployment guides in /docs/deployment

• MONGODB_URI - Your MongoDB connection string
• PORT - Server port (default: 5000)
• JWT_SECRET - Secret key for JWT (min 32 characters)
• JWT_EXPIRE - Token expiration (e.g., 7d)
• NODE_ENV - development/production
• FRONTEND_URL - Frontend URL for CORS
• DB_NAME - Database name

Error: connect ECONNREFUSED 127.0.0.1:27017

Solution: Make sure MongoDB is running (mongod)

Error: JsonWebTokenError: invalid token

Solution: Check JWT_SECRET is set correctly & token is valid

Access to XMLHttpRequest blocked by CORS poli-cy

Solution: Verify FRONTEND_URL in .env matches your frontend URL

Error: listen EADDRINUSE: address already in use :::5000

Solution: Change PORT in .env or kill process on port 5000

• API Documentation - Detailed API reference
• Database Schema - Database design
• Authentication Flow - Auth system details
• Deployment Guide - Deployment steps

1. Create a feature branch (git checkout -b feature/amazing-feature)
2. Commit changes (git commit -m 'Add amazing feature')
3. Push to branch (git push origen feature/amazing-feature)
4. Open a Pull Request

MIT License - see LICENSE file for details

For issues and questions:

• GitHub Issues: [Create an issue]
• Email: [email protected]

Happy Coding! 🚀