# Build Production-Ready Node.js Backends

Backend projects often lack consistent architecture, security, and operational patterns. This skill provides TypeScript examples for APIs, data access, authentication, caching, and error handling.

## Install

```bash
npx skillstore add sickn33/nodejs-backend-patterns
```

## Metadata

- Status: approved
- Slug: sickn33-nodejs-backend-patterns
- Skillstore revision: r2
- Version status: missing
- Tree hash: b7ad7d87906844ee6d358ed8101290cba6c58fef9d5ac07c0e8de5953d3268b5
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nodejs-backend-patterns
- Ref: 81e05e636292629114b76cbb3922fbe57672fc02
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, network, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-nodejs-backend-patterns
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-nodejs-backend-patterns/manifest

## Capabilities

- Structures Express and Fastify applications with TypeScript.
- Applies controller, service, repository, and dependency injection patterns.
- Designs middleware for authentication, validation, rate limiting, logging, and errors.
- Shows PostgreSQL, MongoDB, Redis, transaction, and connection pooling patterns.
- Implements JWT authentication, role checks, password hashing, and token refresh flows.
- Provides production checklists for security, monitoring, testing, and graceful shutdown.

## Use Cases

- Design a New API: Create a maintainable Express or Fastify service structure with clear HTTP, business, and data boundaries.
- Standardize a Growing Service: Refactor middleware, errors, dependencies, and repositories into consistent patterns that support team development.
- Review Production Readiness: Assess authentication, validation, rate limits, logging, database pooling, caching, and shutdown behavior before release.

## Prompt Templates

### Choose a Backend Framework

```
Compare Express and Fastify for my API. Consider team experience, performance, validation, plugins, deployment, and maintenance. Recommend one with clear reasons.
```

### Create a Layered API Design

```
Design a TypeScript Node.js API for [domain]. Define routes, controllers, services, repositories, validation, errors, dependencies, and a practical folder structure.
```

### Add Secure Authentication

```
Design authentication and authorization for [application]. Include password hashing, access tokens, refresh rotation, role checks, secret validation, rate limits, and failure responses.
```

### Audit Backend Production Readiness

```
Review this Node.js backend architecture for production. Identify security, reliability, scaling, data integrity, observability, caching, and shutdown risks. Prioritize concrete fixes.
```

## Limitations

- The examples are reference patterns, not a complete runnable application.
- Package versions and framework APIs require verification before implementation.
- Deployment, cloud infrastructure, and environment-specific controls are not fully covered.
- Testing guidance is brief and refers users to a separate testing skill.

## Best Practices

- Provide framework, database, deployment, and traffic constraints before requesting an architecture.
- Validate generated patterns against current package documentation and local security requirements.
- Request tests and operational verification for authentication, transactions, caching, and shutdown paths.

## Anti Patterns

- Do not apply every pattern when a simpler service structure meets the requirements.
- Do not copy examples without validating inputs, secrets, origins, SQL identifiers, and network exposure.
- Do not treat TypeScript types as runtime validation for untrusted requests.

## Security Audit

- Audited at: 2026-08-04T16:06:42.011\+00:00
- Summary: Most static alerts are false positives caused by Markdown, TypeScript imports, template literals, environment configuration, and database examples. The all-interface network bind is a contextual exposure, and the playbook also contains unsafe SQL identifier interpolation, permissive CORS, and blocking Redis invalidation guidance.

## Stats

- Views: 134
- Downloads: 11
- Favorites: 0
- Popularity score: 0