Project structure · Backend
Express with TypeScript project structure
Opens with creditsFor students who know a bit of JavaScript and want a backend that looks like the ones teams actually run. Express gives you almost no structure, so this layout supplies it: one folder per feature under src/modules, each split into routes, controller, service and repository, with Zod at the edge and Vitest plus Supertest for tests.
Curated by Tauseef FayyazIntermediate187 files and foldersExpress 5.2, TypeScript 7.0, Node.js 24 LTSChecked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you11 files and folders
- 2GrowingWhat a real app with features and tests adds+90 files and folders
- ProductionWhat running it for real users adds+31 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+55 files and foldersOpens with credits
How it is organised
- Group by feature, not by file type: everything about orders lives in src/modules/orders, so a change touches one folder instead of five. The trade-off is a little repetition between modules, which is cheaper than hunting across controllers/, services/ and models/ folders.
- Each layer has one job: routes map URLs, controllers speak HTTP, services hold business rules, repositories talk to the database. Services never see req or res, so you can test them without a server.
- Validate at the edge with Zod, then trust the types inside. Config is validated the same way at startup, so a missing variable crashes on boot, not at 2am.
- Build the app in app.ts and listen in server.ts, so tests import the app and hit it with Supertest without opening a port.
- Express 5 forwards rejected promises to your error handler, so async handlers need no try/catch wrapper: throw a typed AppError and let one error middleware shape every response.
- Slow work leaves the request: sending emails or calling third parties goes on a BullMQ queue and a separate worker process picks it up, so a slow mail server never slows checkout.
- Test in layers: unit tests next to the code at Growing, API tests through Supertest, then a real PostgreSQL in Testcontainers at Production, and contract, load and mutation tests only when a team and its clients are big enough to need them.
- Grow structure only when pain appears. A single package with modules is right for most teams; workspaces, enforced boundaries, Terraform and SLO files in the Expert stage pay off when several people or services share the code.
At the top of the project
Open one in the explorer for the full story
- orders-api/
- node_modules/Installed packages, written by npm install.
- dist/Compiled JavaScript from npm run build, what production runs.
- coverage/Coverage report written by vitest run --coverage.
- src/All application code. tsc compiles this folder into dist.13 inside
- tests/Tests that cross layers: API tests through Supertest, plus factories and helpers. Unit tests sit next to the code.4 inside
- drizzle/SQL migration files written by drizzle-kit generate. Committed and reviewed.2 inside
- scripts/One-off and CI helper scripts that are not part of the running app.1 inside
- openapi.jsonThe generated API contract, committed so changes show up in pull requests.
- .husky/Git hooks managed by husky, created by npx husky init.2 inside
- .vscode/Shared editor settings, recommended extensions and debug configurations.3 inside
- .devcontainer/Dev Container config: Node, Docker access and extensions in a container, for VS Code or Codespaces.1 inside
- .envYour local secrets and settings: database URL, JWT secret, port.
- .env.exampleEvery variable the app needs, with fake values. Committed.
- .gitignoreTells Git to skip node_modules, dist, .env and log files.
- .editorconfigIndentation, line endings and final newline rules every editor understands.
- .nvmrcThe Node major the project uses (24), read by nvm, fnm and setup-node.
- compose.yamlRuns local PostgreSQL and Redis with one command: docker compose up -d.
- drizzle.config.tsTells drizzle-kit where the schema is, where to write migrations and which database to use.
- vitest.config.tsVitest settings: Node environment, setup files, coverage thresholds.
- eslint.config.jsESLint flat config with typescript-eslint's type-aware rules.
- .prettierrc.jsonPrettier settings: quotes, line width, trailing commas.
- commitlint.config.jsExtends @commitlint/config-conventional for the commit-msg hook.
- package.jsonProject name, scripts and dependencies. npm init -y creates it.
- package-lock.jsonExact versions of every installed package, written by npm install. Commit it.
- tsconfig.jsonTypeScript compiler settings. tsc --init writes a strict, minimal starting point.
- AGENTS.mdInstructions for AI coding agents: commands, layout rules, conventions.
- CLAUDE.mdPoints Claude Code at AGENTS.md so both tools share one set of rules.
- README.mdWhat the API does, how to run it, how to test it, how to deploy it.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with Express with TypeScript.
- Roadmap· Node.jsBackend development roadmapAPIs, databases, auth, deploys
- Roadmap· MERNFull stack development roadmapBuild and ship whole web apps
- RoadmapSQL and databases roadmapQueries, design, indexes, transactions
- RoadmapDevOps and cloud roadmapLinux, Docker, Kubernetes, AWS
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetSQL and databases cheat sheetQueries, design, indexes, transactions.
- FYP idea· BeginnerForm Backend Service for Static Sites with Spam FilteringA developer-facing web service that gives static and no-code websites a form endpoint: submissions are stored, filtered for spam, emailed to the owner and sent to webhooks, with a dashboard and CSV export. A beginner-friendly final year project in backend development with a clear SaaS model.
- FYP idea· IntermediateApproval Workflow Engine with Escalations for Small OfficesAn approval workflow engine for small offices, schools and NGOs that turns purchase requests, leave, reimbursements and document sign-offs into tracked flows with deadlines, escalations and email or WhatsApp-style reminders. A no-code automation final year project with a durable workflow runtime and an audit trail.
- FYP idea· IntermediatePharmacy Stock Ledger with Batch Expiry and FEFO DispensingA web-based stock ledger and billing counter for independent pharmacies that tracks every medicine by batch and expiry, sells loose tablets from strips correctly, and dispenses first-expiry-first-out. A final year project in healthcare retail software with real inventory correctness problems to solve.
See 9 moreShow fewer
- QuestionShould I learn TypeScript or Python first in 2026?Learn Python first if you are new to programming or drawn to data and AI. Learn TypeScript first only if you already know some JavaScript or are certain about web development, and even then learn plain JavaScript for a few weeks before the types. The second language is much easier than the first.
- QuestionI understand tutorials but cannot build anything myself. Why does coding feel so different when I am alone?Tutorials train recognition, not production. When you follow along, someone else makes every decision. Building alone requires you to break a problem down and make choices, which is a separate skill. Build it with small projects, planning on paper first, and a rule to struggle before you look anything up.
- QuestionI am graduating soon and feel like I learned four years of theory but cannot actually build software. What now?The gap between theory and building is common and closable. Building is a separate skill: breaking a vague idea into small steps, using real tools and finishing. Close it with one guided build, then one project you design yourself, shipped in small working slices. Your theory will start to make sense along the way.
- QuestionHow do I build a developer portfolio as a beginner with nothing to show?Start with two or three small but complete projects that solve a real problem, each with a clear README, screenshots and a live link or easy run steps. Put them on a simple one-page site or a tidy GitHub profile. Depth and finish matter far more than the number of projects or a fancy design.
- Resource· GuideExpress DocumentationThe official documentation for Express, the minimal and most widely used Node.js web framework. It covers installation, routing, writing and using middleware, error handling, template engines, the full API reference for Express 5 and 4, and guides on security and performance in production. It suits Node.js developers building APIs or server-rendered apps, and anyone who wants to understand the middleware model that many other Node frameworks borrow.
- Resource· GuideThe TypeScript HandbookThe TypeScript Handbook is the official, free guide to TypeScript's type system from the TypeScript team, written for working programmers and kept current with each release. It covers everyday types, narrowing, functions, object types, generics, type manipulation, classes and modules, and it is designed to be read in a few hours. It suits JavaScript developers adopting TypeScript and anyone who writes types by copying patterns without understanding them.
- Resource· GuideVitest DocumentationThe official documentation for Vitest, the test runner built on Vite. Its getting started guide has you writing and running a real test in minutes, then covers matchers, async tests, setup and teardown, mocking (functions, modules, timers, dates, requests), snapshots, coverage, the UI dashboard and browser mode for component tests. It uses a Jest-compatible API, so it suits JavaScript and TypeScript developers starting to test, and teams moving from Jest.
- Resource· GuideNode.js LearnThe official Node.js Learn guides explain what Node itself is doing underneath your framework: the event loop, asynchronous work, files and streams, HTTP, environment variables, running TypeScript, diagnostics and the built-in test runner. The articles are short and free. They suit JavaScript developers who use Express, Next.js or another tool but want to understand the runtime, and anyone debugging a problem that a framework tutorial glosses over.
- Resource· GuideOWASP API Security Top 10The OWASP API Security Top 10 (2023 edition) lists the most critical security risks in APIs, led by broken object level authorisation, broken authentication and broken object property level authorisation. Each risk comes with attack scenarios and prevention advice. It suits anyone building or reviewing backends, because these flaws are common, easy to miss in code review and often invisible in normal testing.
Checked against 9 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com