Hilmifawwazsaad Nextjs Boilerplate Backend

Pre-Code Checklist

1. Resource + HTTP method + action
2. Request → response contract (input shape, output shape, errors)
3. Auth requirement (public / authenticated / role-gated)
4. Failure scenarios + validation rules

Response Envelope

{ "success": true,  "data": "<payload>", "message": "OK",        "error": null }
{ "success": false, "data": null,         "message": "<summary>", "error": { "code": "<CODE>", "details": [{ "field": "", "message": "" }] } }

HTTP Status Codes

Design Rules

• Versioning — prefix all routes /api/v1/.
• Endpoints — plural nouns, kebab-case: /api/v1/posts, /api/v1/post-categories.
• Query params — page, limit, sort, filter[key]=value.
• Auth — Authorization: Bearer <token> (JWT/opaque) or HTTP-only cookie (same parent domain).
• Pagination — all list endpoints: data: { items: T[], pagination: { page, limit, totalItems, totalPages } }.
• CORS — exact origin only (http://localhost:3000 dev, exact domain prod). Never * with credentials.
• Naming — pick camelCase or snake_case; consistent throughout the project.
• Docs — expose OpenAPI spec at /api/docs or /openapi.json when feasible.

Architecture

• Route handlers thin — business logic in service/use-case layer.
• Global error handler → catches all unhandled errors → safe 500.
• DB connection pooling. Async/non-blocking I/O.
• Cache read-heavy data (Redis or in-memory).

Security (non-negotiable)

• Secrets via env vars only — never hardcoded.
• Parameterized queries/ORM — no string-concatenated SQL.
• Hash passwords (bcrypt/argon2 or language equivalent).
• Rate-limit auth endpoints (login, register, password reset).
• Limit request body size (e.g., 1 MB).
• Security headers in production (X-Frame-Options, CSP, HSTS).
• Validate all input at boundary before processing.

Never Do

• Expose stack traces, DB errors, or internal details to client.
• Trust unvalidated client input or hardcode secrets.
• Skip pagination on list endpoints.
• Wildcard CORS * with credentials.
• Business logic directly in route handlers.

Source: hilmifawwazsaad/NextJS-Boilerplate — distributed by TomeVault.