Jimmy

Academic

RailRoad — A REST API for Railway Management

A REST API for railway management built as a two-person project — users, trains, stations and tickets, JWT authentication, role-based access control and Swagger documentation.

Completed

My contribution

I handled most of the technical implementation of the API, its data model and its authentication and authorization mechanisms. It was a two-person project, with my teammate contributing mainly through reviews and the presentation material.

Highlights

  • Four resources — users, trains, stations, tickets — exposed as a REST API
  • JWT authentication and role-based access control (user, employee, administrator)
  • Swagger documentation generated from the routes and served by the API

Goal

Design the API of a fictional railway company: manage users, trains, stations and ticket bookings, with different rights depending on each user’s role. The result is a REST API, without a user interface.

Architecture

The API is written in Node.js with Express and relies on MongoDB through Mongoose. The code is split into layers: one router per resource, repositories holding the business logic and access checks, and Mongoose schemas defining the data model and its validation.

Features

  • Users: sign-up, login, viewing and updating one’s own account, soft deletion.
  • Trains: creation, update, deletion and cancellation; a list sortable by departure time, departure or arrival station, with a configurable number of results.
  • Stations: creation, update, deletion and a list sorted by name; deleting a station cancels the trains serving it.
  • Tickets: booking a journey and listing one’s own tickets.

Authentication and authorization

Passwords are hashed before being stored. On login, the API issues a time-limited JWT, checked by a middleware on protected routes. Each operation then applies the rights of the user’s role: managing trains and stations is reserved for administrators, cancelling a train is also open to employees, and users can only access their own account.

Documentation

The OpenAPI (Swagger) documentation is generated from the routes and their annotations, then served by the application itself: every endpoint can be browsed and tried out from the browser.

Limits

The project remained an academic exercise: some planned features, notably ticket validation and full handling of station images, were not completed.