Implementing Full CRUD Endpoints with Express and Mongoose

With the endpoint map designed and the project structure in place, it is time to implement the full CRUD API for the blog posts resource. This lesson brings together Express routing, Mongoose models, controller functions, pagination, filtering, and consistent response shapes into a working API you can test immediately with Postman. By the end you will have a complete posts API — the backbone of the MERN Blog — ready to be connected to React in Part 5 of the series.

The Post Mongoose Model

// server/src/models/Post.js
const mongoose = require('mongoose');

const postSchema = new mongoose.Schema(
  {
    title: {
      type:      String,
      required:  [true, 'Post title is required'],
      trim:      true,
      minlength: [3,   'Title must be at least 3 characters'],
      maxlength: [200, 'Title cannot exceed 200 characters'],
    },
    slug: {
      type:   String,
      unique: true,
      lowercase: true,
    },
    body: {
      type:      String,
      required:  [true, 'Post body is required'],
      minlength: [10,  'Body must be at least 10 characters'],
    },
    excerpt: {
      type:      String,
      maxlength: [500, 'Excerpt cannot exceed 500 characters'],
    },
    coverImage: { type: String },
    author: {
      type:     mongoose.Schema.Types.ObjectId,
      ref:      'User',
      required: true,
    },
    tags:      { type: [String], default: [] },
    published: { type: Boolean, default: false },
    featured:  { type: Boolean, default: false },
    viewCount: { type: Number,  default: 0 },
  },
  { timestamps: true } // adds createdAt and updatedAt automatically
);

// Auto-generate slug from title before saving
postSchema.pre('save', function (next) {
  if (this.isModified('title') || this.isNew) {
    this.slug = this.title
      .toLowerCase()
      .replace(/[^a-z0-9\s-]/g, '')
      .replace(/\s+/g, '-')
      .replace(/-+/g, '-')
      .trim();
  }
  next();
});

// Index for common query patterns
postSchema.index({ author: 1, createdAt: -1 });
postSchema.index({ tags: 1 });
postSchema.index({ slug: 1 }, { unique: true });
postSchema.index({ published: 1, createdAt: -1 });

module.exports = mongoose.model('Post', postSchema);

Note: The { timestamps: true } option in the schema definition automatically adds createdAt and updatedAt fields to every document and updates updatedAt every time you call save(), findByIdAndUpdate(), or any other update method. You never need to manage these fields manually — Mongoose handles them for you.

Tip: Add database indexes for every field you query or sort by frequently. Without an index, MongoDB scans every document in the collection for each query — this is fast for small datasets but catastrophically slow at scale. The most important indexes for a blog API are on author, tags, slug (unique), and published + createdAt for the main feed query.

Warning: findByIdAndUpdate() with { new: true } returns the updated document, but it bypasses Mongoose middleware (pre/post hooks) and validators defined in the schema by default. To run validators on update, pass { runValidators: true } as well. Always include both options for update operations: { new: true, runValidators: true }.

Full CRUD Controller

// server/src/controllers/postController.js
const Post         = require('../models/Post');
const AppError     = require('../utils/AppError');
const asyncHandler = require('../utils/asyncHandler');

// ── GET /api/posts ─────────────────────────────────────────────────────────
const getAllPosts = asyncHandler(async (req, res) => {
  const {
    page = 1, limit = 10, sort = 'createdAt', order = 'desc',
    tag, author, search, published = 'true',
  } = req.query;

  const pageNum  = Math.max(1, parseInt(page,  10) || 1);
  const limitNum = Math.min(100, parseInt(limit, 10) || 10);
  const skip     = (pageNum - 1) * limitNum;
  const sortDir  = order === 'asc' ? 1 : -1;

  const filter = {};
  // Only admins can see unpublished posts in the list
  if (!req.user || req.user.role !== 'admin') filter.published = true;
  else if (published !== undefined) filter.published = published === 'true';
  if (tag)    filter.tags   = tag;
  if (author) filter.author = author;
  if (search) filter.$text  = { $search: search };

  const [posts, total] = await Promise.all([
    Post.find(filter)
      .sort({ [sort]: sortDir })
      .skip(skip)
      .limit(limitNum)
      .populate('author', 'name avatar'),
    Post.countDocuments(filter),
  ]);

  res.json({
    success: true,
    count:   posts.length,
    total,
    page:    pageNum,
    pages:   Math.ceil(total / limitNum),
    data:    posts,
  });
});

// ── GET /api/posts/:id ────────────────────────────────────────────────────
const getPostById = asyncHandler(async (req, res) => {
  const post = await Post.findById(req.params.id)
    .populate('author', 'name avatar bio');

  if (!post) throw new AppError('Post not found', 404);
  if (!post.published && (!req.user || req.user.id !== post.author.id)) {
    throw new AppError('Post not found', 404); // hide unpublished from non-owners
  }

  // Increment view count (fire-and-forget — do not await)
  Post.findByIdAndUpdate(req.params.id, { $inc: { viewCount: 1 } }).exec();

  res.json({ success: true, data: post });
});

// ── POST /api/posts ───────────────────────────────────────────────────────
const createPost = asyncHandler(async (req, res) => {
  const { title, body, excerpt, tags, published, featured, coverImage } = req.body;

  const post = await Post.create({
    title, body, excerpt, tags, published, featured, coverImage,
    author: req.user.id, // set from JWT middleware — never from req.body
  });

  res.status(201).json({ success: true, data: post });
});

// ── PATCH /api/posts/:id ──────────────────────────────────────────────────
const updatePost = asyncHandler(async (req, res) => {
  let post = await Post.findById(req.params.id);
  if (!post) throw new AppError('Post not found', 404);

  // Ownership check — only the author or an admin can update
  if (post.author.toString() !== req.user.id && req.user.role !== 'admin') {
    throw new AppError('Not authorised to update this post', 403);
  }

  // Only update the fields that were sent — never allow author to be changed
  const { title, body, excerpt, tags, published, featured, coverImage } = req.body;
  const updates = { title, body, excerpt, tags, published, featured, coverImage };
  // Remove undefined fields so unset fields are not overwritten with undefined
  Object.keys(updates).forEach(key => updates[key] === undefined && delete updates[key]);

  post = await Post.findByIdAndUpdate(
    req.params.id,
    updates,
    { new: true, runValidators: true }
  ).populate('author', 'name avatar');

  res.json({ success: true, data: post });
});

// ── DELETE /api/posts/:id ─────────────────────────────────────────────────
const deletePost = asyncHandler(async (req, res) => {
  const post = await Post.findById(req.params.id);
  if (!post) throw new AppError('Post not found', 404);

  if (post.author.toString() !== req.user.id && req.user.role !== 'admin') {
    throw new AppError('Not authorised to delete this post', 403);
  }

  await post.deleteOne();

  res.json({ success: true, message: 'Post deleted successfully' });
});

module.exports = { getAllPosts, getPostById, createPost, updatePost, deletePost };

Posts Router

// server/src/routes/posts.js
const express = require('express');
const router  = express.Router();
const {
  getAllPosts, getPostById, createPost, updatePost, deletePost,
} = require('../controllers/postController');
const protect          = require('../middleware/auth');
const validateObjectId = require('../middleware/validateObjectId');

// Public routes
router.get('/featured', asyncHandler(async (req, res) => {
  const posts = await Post.find({ published: true, featured: true })
    .sort({ createdAt: -1 }).limit(6).populate('author','name avatar');
  res.json({ success: true, count: posts.length, data: posts });
}));

router.route('/')
  .get(getAllPosts)
  .post(protect, createPost);

router.route('/:id')
  .get(validateObjectId('id'), getPostById)
  .patch(protect, validateObjectId('id'), updatePost)
  .delete(protect, validateObjectId('id'), deletePost);

module.exports = router;

Pagination Response Pattern

GET /api/posts?page=2&limit=5

Response:
{
  "success": true,
  "count":   5,          ← items in this page
  "total":   47,         ← total matching documents in MongoDB
  "page":    2,          ← current page
  "pages":   10,         ← total pages (ceil(47/5))
  "data": [
    { "_id": "...", "title": "...", "author": { "name": "Jane" }, ... },
    ...
  ]
}

React usage:
  Fetch page 1 on mount
  Show "Load more" button if page < pages
  On click: fetch page + 1 and append to existing posts array

Common Mistakes

Mistake 1 — Setting author from req.body instead of req.user

❌ Wrong — any user can claim to be any author:

const post = await Post.create({ ...req.body }); // req.body.author could be anyone's ID

✅ Correct — always set author from the verified JWT, not from the client:

const { title, body, tags } = req.body; // destructure only safe fields
const post = await Post.create({ title, body, tags, author: req.user.id }); // ✓

Mistake 2 — Not running validators on update operations

❌ Wrong — bypassing schema validation on updates:

await Post.findByIdAndUpdate(id, req.body); // validators do NOT run by default

✅ Correct — always include runValidators:

await Post.findByIdAndUpdate(id, updates, { new: true, runValidators: true }); // ✓

Mistake 3 — Skipping the ownership check on update and delete

❌ Wrong — any authenticated user can update or delete any post:

const updatePost = asyncHandler(async (req, res) => {
  const post = await Post.findByIdAndUpdate(req.params.id, req.body, { new: true });
  res.json({ data: post }); // no ownership check!
});

✅ Correct — always verify the requesting user owns the resource:

if (post.author.toString() !== req.user.id && req.user.role !== 'admin') {
  throw new AppError('Not authorised', 403);
}

Quick Reference

Operation	Mongoose Method	Options
Get all (filter)	`Post.find(filter).sort().skip().limit()`	populate, lean
Get one	`Post.findById(id)`	populate, select
Count	`Post.countDocuments(filter)`	—
Create	`Post.create({ fields })`	—
Update (patch)	`Post.findByIdAndUpdate(id, updates, opts)`	new: true, runValidators: true
Delete	`await post.deleteOne()`	—
Parallel queries	`Promise.all([Post.find(), Post.countDocuments()])`	—

The Post Mongoose Model #

Full CRUD Controller #

Posts Router #

Pagination Response Pattern #

Common Mistakes #

Mistake 1 — Setting author from req.body instead of req.user #

Mistake 2 — Not running validators on update operations #

Mistake 3 — Skipping the ownership check on update and delete #

Quick Reference #

🧠 Test Yourself #

📚 More in this Tutorial Series

The Post Mongoose Model

Full CRUD Controller

Posts Router

Pagination Response Pattern

Common Mistakes

Mistake 1 — Setting author from req.body instead of req.user

Mistake 2 — Not running validators on update operations

Mistake 3 — Skipping the ownership check on update and delete

Quick Reference

🧠 Test Yourself