Blog API

Express-based blog backend API endpoints. Base URL: http://localhost:3000. Protected endpoints require the Authorization: Bearer <token> header. Returns 401 when the token is missing, 403 when the token is invalid/expired or the role is not permitted, and 404 when a record is not found; some errors may be returned as an Express HTML error page instead of JSON.

Backend repository

Authentication (Auth)

POST/api/auth/register

Creates a new user. Returns 409 Conflict if the email is already in use. The registration token carries a `role` claim while the role middleware expects `roleName`; use the token from the /login response for role-protected endpoints.

Example request body

{
  "email": "yazar@example.com",
  "password": "GüçlüBirŞifre123!",
  "name": "Yazar",
  "roleId": "<writer rolünün ID'si>"
}

POST/api/auth/login

Signs in the user and returns a JWT.

Example request body

{
  "email": "yazar@example.com",
  "password": "GüçlüBirŞifre123!"
}

User Management (Users)

GET/api/users/writers-all?page=1&limit=10Authentication required

Lists writers with pagination. `page` defaults to 1, `limit` defaults to 10, max 100.

GET/api/users/get/:idAuthentication required

Returns the specified user. Returns 404 Not Found if the user does not exist.

PATCH/api/users/change-passwordAuthentication required

Updates the password of the signed-in user.

Example request body

{
  "oldPassword": "EskiŞifre123!",
  "newPassword": "YeniŞifre456!"
}

DELETE/api/users/delete/:idAuthentication required

Deletes the token owner's account. Known issue: returned 500 in testing; the blog repository dependency required by UserService is not provided.

Blog Management (Blogs)

GET/api/blogs/all?page=1&limit=10

Lists blogs with pagination. `page` defaults to 1, `limit` defaults to 10, max 100.

GET/api/blogs/get/:id

Returns the specified blog. If the record is not found, the current code may return 200 OK with null.

GET/api/blogs/detail/:id

Returns the blog detail and its related blog object. Known issue: returned 500 in testing; the query uses an `isActive` field that does not exist on the BlogDetail model.

POST/api/blogs/createAuthentication required

Creates a new blog. Requires the `writer` or `admin` role. `summary` is optional; `authorId` is taken from the token. Because Blog.content has a unique index, each blog must use a different `content` value.

Example request body

{
  "title": "Örnek başlık",
  "content": "Benzersiz blog içeriği",
  "summary": "Kısa özet"
}

PUT/api/blogs/update/:idAuthentication required

Updates a blog. Requires the `writer` or `admin` role. Known issue: returned 500 in testing; the controller does not pass the update fields to the service method in the expected object shape.

Example request body

{
  "title": "Güncel başlık",
  "content": "Yeni ve benzersiz içerik",
  "summary": "Güncel özet"
}

DELETE/api/blogs/delete/:idAuthentication required

Deletes/deactivates a blog. Requires the `writer` or `admin` role. Returns the deleted/deactivated blog object.

Admin

GET/api/admin/all-users?page=1&limit=10Authentication required

Returns a paginated user list; user fields include `isActive` and role info. Requires the admin role.

DELETE/api/admin/delete-user/:idAuthentication required

Deletes the specified user. Requires the admin role. Known issue: when deleting related blog details, the code tries to update an `isActive` field that does not exist on BlogDetail and may return 500.

DELETE/api/admin/delete-blog/:idAuthentication required

Deletes the specified blog. Requires the admin role.