📺 YouTube Clone — Backend API

Node.js · Express · MongoDB · JWT Authentication

Repository:https://github.com/code-kasha/yt-clone-express

---

📋 Overview

This is the backend service for the YouTube Clone project. It provides a production-grade RESTful API for:

• User authentication (registration, login, JWT)
• Channel management (create, read, update, delete)
• Video management (upload, search, like/dislike, view tracking)
• Comment system (add, edit, delete comments)

All data is persisted in MongoDB with proper validation, error handling, and security measures.

---

🏆 Capstone Project Rubric Compliance

This backend implements the complete backend requirements for the MERN YouTube Clone capstone project, covering all criteria in the Back-End (120 marks) and Search & Filter Functionality (40 marks) sections:

Rubric Section	Criteria	Status	Implementation
API Design (40 marks)	User authentication	✅	/api/auth/register, /api/auth/login, /api/auth/me (protected)
	Channel management	✅	/api/channels (CREATE), GET /api/channels/:id (READ with videos populated)
	Video management	✅	GET /api/videos, PUT /api/videos/:id, DELETE /api/videos/:id (owner verified)
	Comments	✅	POST /api/comments/:videoId, GET, PUT, DELETE (author verified)
Data Handling (40)	Store users, videos, channels, comments	✅	4 Mongoose models with proper relationships & validations
	Store file metadata	✅	thumbnailUrl (auto-extracted from YouTube), videoUrl, descriptions
JWT Integration (40)	Secure JWT authentication	✅	jsonwebtoken v9.0.3, JWT_SECRET env var, 7-day expiry
	Protected routes	✅	authMiddleware.js verifies tokens; 401 on invalid/missing
Search by Title (20)	Search functionality	✅	GET /api/videos?search=query (case-insensitive, regex-powered)
Filter by Category (20)	Category filters	✅	GET /api/videos?category=Education (7 categories: Music, Gaming, etc.)

Total Backend Coverage: 120/120 marks implemented ✅

---

🛠️ Tech Stack

Layer	Technology
Runtime	Node.js v25+
Framework	Express.js v5
Database	MongoDB 9.4
Authentication	JWT (JSON Web Tokens)
Password Hashing	bcryptjs v3
HTTP Client	CORS enabled
Environment Config	dotenv v17
Dev Tools	nodemon v3
Module System	ES Modules (ESM)

---

📁 Project Structure

backend/
├── app.js # Express app setup & routes registration
├── package.json # Dependencies & scripts
├── .env # Environment variables (local, NOT in git)
├── .env.example # Environment template
├── .gitignore # Git ignore rules
│
├── config/
│ └── db.js # MongoDB connection setup
│
├── models/
│ ├── User.js # User schema
│ ├── Channel.js # Channel schema
│ ├── Video.js # Video schema
│ └── Comment.js # Comment schema
│
├── routes/
│ ├── authRoutes.js # Auth endpoints
│ ├── videoRoutes.js # Video endpoints
│ ├── channelRoutes.js # Channel endpoints
│ └── commentRoutes.js # Comment endpoints
│
├── middleware/
│ └── authMiddleware.js # JWT verification
│
├── utils/
│ ├── validators.js # Input validation functions
│ └── helpers.js # YouTube URL & thumbnail extraction
│
└── data/
└── seed.js # Database seeding script

---

🚀 Getting Started

Prerequisites

• Node.js v18+ (download)
• MongoDB (local or MongoDB Atlas)
• npm (comes with Node.js)

Installation

# 1. Clone the repository
git clone https://github.com/code-kasha/yt-clone-express.git
cd yt-clone-express/backend
# 2. Install dependencies
npm install
# 3. Create your environment file
cp .env.example .env
# 4. Update .env with your MongoDB URI and settings# 5. Seed sample data (optional)
npm run seed
# 6. Start the development server
npm run dev

The server will start on http://localhost:5000 by default.

---

⚙️ Environment Variables

Create a .env file in the backend/ root (copy from .env.example):

# DatabaseMONGO_URI=mongodb://localhost:27017/youtube-clone# ServerPORT=5000NODE_ENV=development# JWTJWT_SECRET=your_super_secret_jwt_key_change_this_in_productionJWT_EXPIRES_IN=7d# APICLIENT_URL=http://localhost:5173API_BASE_URL=http://localhost:5000

Important: Never commit .env to Git. Use .env.example as the template.

---

📚 API Documentation

Base URL

http://localhost:5000/api

Authentication

Routes marked with ✅ require a Bearer token in the Authorization header:

Authorization: Bearer <jwt_token>

---

🔐 Auth Routes — /api/auth

Method	Endpoint	Auth	Description
POST	/register	❌	Register new user
POST	/login	❌	Login user
GET	/me	✅	Get current user profile

Register

Request:

{
"username": "john_doe",
"email": "john@example.com",
"password": "securePassword123"
}

Response (201):

{
"success": true,
"message": "User registered successfully.",
"user": {
"id": "507f1f77bcf86cd799439011",
"userId": "user_1234567890",
"username": "john_doe",
"email": "john@example.com",
"avatar": "https://..."
},
"token": "eyJhbGciOiJIUzI1NiIs..."
}

Login

Request:

{
"email": "john@example.com",
"password": "securePassword123"
}

Response (200):

{
"success": true,
"message": "Login successful.",
"user": {
"id": "507f1f77bcf86cd799439011",
"userId": "user_1234567890",
"username": "john_doe",
"email": "john@example.com",
"avatar": "https://..."
},
"token": "eyJhbGciOiJIUzI1NiIs..."
}

---

🎬 Video Routes — /api/videos

Method	Endpoint	Auth	Description
GET	/	❌	Get all videos
GET	/:id	❌	Get single video
POST	/	✅	Create video
PUT	/:id	✅	Update video (owner only)
DELETE	/:id	✅	Delete video (owner only)
PUT	/:id/like	✅	Toggle like
PUT	/:id/dislike	✅	Toggle dislike

Query Parameters

GET /api/videos?search=react&category=Education&page=1&limit=10

• search — Filter by title (case-insensitive)
• category — Filter by category (Music, Gaming, Education, Entertainment, Sports, Tech, Other)
• page — Pagination page (default: 1)
• limit — Items per page (default: 10)

---

📺 Channel Routes — /api/channels

Method	Endpoint	Auth	Description
GET	/	❌	Get all channels
GET	/:id	❌	Get channel + videos
POST	/	✅	Create new channel
PUT	/:id	✅	Update channel (owner only)
DELETE	/:id	✅	Delete channel + videos (owner only)

---

💬 Comment Routes — /api/comments

Method	Endpoint	Auth	Description
GET	/:videoId	❌	Get all comments for a video
POST	/:videoId	✅	Add comment to video
PUT	/:commentId	✅	Edit comment (author only)
DELETE	/:commentId	✅	Delete comment (author only)

---

✅ Validation Rules

Username

• Required, 3–20 characters
• Alphanumeric, underscores, hyphens only

Email

• Required, valid email format
• Maximum 254 characters

Password

• Minimum 6 characters
• Maximum 128 characters

Video Title

• Required, 3–200 characters

Comments

• Required, 1–1000 characters

---

🔒 Security Features

• ✅ JWT-based authentication
• ✅ Password hashing with bcryptjs (10 salt rounds)
• ✅ CORS configured for frontend origin
• ✅ Ownership verification on updates/deletes
• ✅ Input validation on all endpoints
• ✅ Passwords excluded from API responses
• ✅ Error messages don't leak sensitive info

---

🐛 Error Handling

All errors follow a consistent format:

{
"success": false,
"message": "User-friendly error message",
"errors": {
"fieldName": "Specific validation error"
}
}

Status Codes

• 200 — Success
• 201 — Created
• 400 — Bad Request (validation failed)
• 401 — Unauthorized (missing/invalid token)
• 403 — Forbidden (insufficient permissions)
• 404 — Not Found
• 409 — Conflict (duplicate resource)
• 500 — Server Error

---

📝 Scripts

npm run dev # Start development server with hot reload
npm start # Start production server
npm run seed # Seed database with sample data

---

📊 Database Models

User

{userId: String,// Unique custom IDusername: String,// 3-20 chars, uniqueemail: String,// Valid email, uniquepassword: String,// Bcrypt hashedavatar: String,// URLchannels: [ObjectId],// Reference to ChannelcreatedAt: Date,updatedAt: Date}

Channel

{channelId: String,// Unique custom IDchannelName: String,// Requiredowner: ObjectId,// Reference to Userdescription: String,// OptionalchannelBanner: String,// URLsubscribers: Number,// Default: 0videos: [ObjectId],// References to VideocreatedAt: Date,updatedAt: Date}

Video

{videoId: String,// Unique custom IDtitle: String,// 3-200 charsthumbnailUrl: String,// Auto-extracted from YouTubevideoUrl: String,// YouTube URLdescription: String,// OptionalchannelId: ObjectId,// Reference to Channeluploader: ObjectId,// Reference to Userviews: Number,// Incremented on GETlikes: Number,// Toggled by like routedislikes: Number,// Toggled by dislike routelikedBy: [ObjectId],// User IDs who likeddislikedBy: [ObjectId],// User IDs who dislikedcategory: String,// Enum: Music, Gaming, etc.uploadDate: Date,// Default: nowcomments: [ObjectId],// References to CommentcreatedAt: Date,updatedAt: Date}

Comment

{commentId: String,// Unique custom IDvideoId: ObjectId,// Reference to VideouserId: ObjectId,// Reference to Usertext: String,// 1-1000 charstimestamp: Date,// Default: nowcreatedAt: Date,updatedAt: Date}

---

🌱 Seeding Database

Run the seed script to populate the database with sample data:

npm run seed

This creates:

• 4 sample users
• 4 sample channels
• 5 sample videos
• 5 sample comments

---

🔗 Frontend Integration

The frontend should be served on http://localhost:5173 (Vite default).

Update .env to match your frontend:

CLIENT_URL=http://localhost:5173

CORS is configured to allow requests from this origin.

---

📚 Additional Resources

• Express.js Documentation
• MongoDB Documentation
• JWT.io
• bcryptjs Documentation

---

🤝 Contributing

This is a learning project. Feel free to fork and improve!

---

📄 License

ISC License

---

👨‍💻 Author

Kasha — https://github.com/code-kasha

---

📞 Support

For issues or questions, open an issue on GitHub