Routes

All Express Router modules live in backend/routes/. Each file defines the HTTP method, URL path, middleware chain, and controller handler for its domain.

Route Base Path

All routes are mounted under /api/v1/ in server.js:

app.use('/api/v1/auth',          authRoutes);
app.use('/api/v1/users',         userRoutes);
app.use('/api/v1/books',         bookRoutes);
app.use('/api/v1/circulation',   circulationRoutes);
app.use('/api/v1/fines',         fineRoutes);
app.use('/api/v1/dashboard',     dashboardRoutes);
app.use('/api/v1/notifications', notificationRoutes);

Additionally, src/app.js mounts supplementary routes:

app.use('/api/reservations',  reservationRoutes);
app.use('/api/dashboard',     dashboardRoutes);
app.use('/api/notifications', notificationRoutes);
app.use('/api/config',        systemConfigRoutes);
app.use('/api/audit',         auditRoutes);
app.use('/api/reports',       reportRoutes);

1. Auth Routes

File: routes/auth.js

Includes rate limiting: 5 requests per minute per IP on setup, login, and refresh.

Note: setup, login, and refresh are public endpoints (no auth required). Rate-limited to 5 requests per minute per IP.

2. User Routes

File: routes/users.js

All user routes require authentication (router.use(authenticate)). Includes rate limiting on user creation.

3. Book Routes

File: routes/books.js

4. Circulation Routes

File: routes/circulation.js

All circulation routes require authentication (router.use(authenticate)).

Note: history is available to all authenticated users but the controller filters results by role — students see only their own history.

5. Fine Routes

File: routes/fines.js

All fine routes require authentication (router.use(authenticate)).

6. Dashboard Routes

File: routes/dashboard.js

7. Notification Routes

File: routes/notifications.js

All notification routes require authentication (router.use(authenticate)).

8. Reservation Routes

File: routes/reservations.js

All reservation routes require authentication (router.use(authenticate)).

9. Report Routes

File: routes/reports.js

All report routes require authentication and ROLE_ADMIN or ROLE_LIBRARIAN authorization.

10. Audit Routes

File: routes/audit.js

All audit routes require authentication and ROLE_ADMIN authorization.

11. System Config Routes

File: routes/systemConfig.js

All config routes require authentication and ROLE_ADMIN authorization.

Access Control Summary