🏦 Banking System Backend

A robust and highly secure RESTful API built with Node.js, Express, and MongoDB that simulates a core banking engine. This backend handles user authentication, account management, and peer-to-peer (P2P) financial transactions while ensuring strict data integrity and protection against race conditions.

✨ Key Features

• Secure Authentication & Session Management: JWT-based authentication with a highly secure logout mechanism using a database-backed Token Blacklist (optimized with MongoDB TTL indexes).
• ACID-Compliant Transactions: Utilizes MongoDB Sessions and Transactions to ensure all peer-to-peer transfers and ledger entries succeed or fail atomically.
• Idempotency Protection: Enforces idempotency keys on all transaction routes to prevent duplicate charges and protect against network retries or double-clicks.
• Race Condition Prevention: Bulletproof concurrency handling prevents users from double-spending or overdrawing accounts during simultaneous requests.
• Double-Entry Ledger: Maintains an immutable ledger tracking every credit and debit for accurate balance derivation and auditing.
• Automated Email Notifications: Integrates an email service to instantly notify users of successful deposits and withdrawals.
• System User Funding: Dedicated system-level endpoints to inject initial funds into the banking ecosystem.

🛠️ Tech Stack

• Runtime: Node.js
• Framework: Express.js
• Database: MongoDB & Mongoose
• Authentication: JSON Web Tokens (JWT) & bcrypt
• Notifications: Nodemailer (Email Service)

🚀 Getting Started

Prerequisites

• Node.js installed on your local machine
• A MongoDB database (Local or MongoDB Atlas)

Installation

1. Clone the repository:

   git clone https://github.com/RuDr8A/Banking-System-Backend.git cd Banking-System-Backend

2. Install the dependencies:

   npm install

3. Create a .env file in the root directory and configure your environment variables:

   PORT=3000 MONGODB_URI=your_mongodb_connection_string JWT_SECRET=your_super_secret_jwt_key EMAIL_USER=your_email_address EMAIL_PASS=your_email_app_password

4. Start the server:

   npm run dev

📡 API Endpoints Summary

Authentication (/api/auth)

• POST /register - Register a new user (triggers email verification).
• POST /login - Authenticate a user and return a JWT.
• POST /logout - Blacklist the current JWT to securely end the session.

Accounts (/api/account)

• POST /create - Create a new banking account (Checking/Savings) for the logged-in user.
• GET /get-accounts - Retrieve all accounts owned by the logged-in user.
• GET /balance/:accountId - Fetch the real-time calculated balance of a specific account.

Transactions (/api/transaction)

• POST /system/initial-fund - (Admin/System Only) Deposit initial funds into a user's account.
• POST /make-transaction - Execute a secure P2P transfer between two accounts. Requires an idempotencyKey.

🧠 Engineering Highlights

This project addresses several advanced backend engineering challenges:

1. The "Double-Spend" Problem: Solved by utilizing MongoDB's startTransaction() to lock account documents during balance verification and ledger insertion.
2. Network Retries: Implemented Idempotency Keys so that if a client drops connection and retries a transfer, the server safely returns the original receipt instead of deducting funds twice.
3. Stateless JWT Revocation: Standard JWTs cannot be destroyed before expiration. This API introduces a tokenBlacklist collection with a Time-To-Live (TTL) index that securely intercepts and rejects blacklisted tokens, dropping them from the database automatically once they naturally expire.

📄 License

This project is open-source and available under the MIT License.