Completing CRUD

Look, if you've ever dealt with this in production, you know exactly what the problem is. We have successfully implemented the 'Create' and 'Read' operations. To complete our blog's backend functionality, we must implement 'Update' and 'Delete'. However, unlike reading a public blog post, updating or deleting data is a destructive action. We must strictly control who is allowed to perform these actions. If anyone can send a DELETE /api/posts/:id request and wipe out another user's content, our application is fundamentally insecure. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy a full-stack JavaScript app, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. To update a document, we use a PUT or PATCH HTTP request. In Mongoose, we use findByIdAndUpdate(). This method takes three arguments: the ID of the document to find, an object containing the new data to apply, and an options object. A critical option to include is { new: true }. By default, Mongoose returns the old, outdated document *before* the update was applied. Setting new: true forces Mongoose to return the freshly updated document back to the React client. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy a full-stack JavaScript app, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. Deleting a document is relatively straightforward using Mongoose's findByIdAndDelete(). When a DELETE request hits /api/posts/:id, Express extracts the id from the URL parameters and passes it to Mongoose. If the document is found and deleted, Mongoose returns the deleted document. If the document does not exist (perhaps it was already deleted), it returns null. We must check for this null state and return a 404 Not Found to the client if necessary. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy a full-stack JavaScript app, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. Currently, our endpoints are fully functional, but dangerously exposed. Anyone with Postman can send a DELETE request to /api/posts/123 and destroy the database. To fix this, we must enforce Authorization at the route level. Before we call findByIdAndUpdate, we must first check if post.author.toString() === req.user.id. We will build out this req.user functionality in the upcoming Authentication module using JSON Web Tokens (JWT). This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy a full-stack JavaScript app, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. We have now explored the theoretical architecture for secure CRUD operations. However, to actually implement these security guards, we need a robust identity system. How does the server know who req.user is? Since HTTP is completely stateless, the server forgets who you are the millisecond the request finishes. In the next module, we will solve this fundamental problem using JSON Web Tokens (JWT) and secure authentication. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy a full-stack JavaScript app, this is the mechanic that prevents catastrophic failure.

Completing CRUD. We have successfully implemented the 'Create' and 'Read' operations. To complete our blog's backend functionality, we must implement 'Update' and 'Delete'. However, unlike reading a public blog post, updating or deleting data is a destructive action. We must strictly control who is allowed to perform these actions. If anyone can send a DELETE /api/posts/:id request and wipe out another user's content, our application is fundamentally insecure.

The Update Endpoint. To update a document, we use a PUT or PATCH HTTP request. In Mongoose, we use findByIdAndUpdate(). This method takes three arguments: the ID of the document to find, an object containing the new data to apply, and an options object. A critical option to include is { new: true }. By default, Mongoose returns the old, outdated document *before* the update was applied. Setting new: true forces Mongoose to return the freshly updated document back to the React client.

When using the Mongoose findByIdAndUpdate method to process a PUT request, why is it highly recommended to pass { new: true } as the third options argument?

• →It returns the freshly updated document.
• →It creates a duplicate document.

The Delete Endpoint. Deleting a document is relatively straightforward using Mongoose's findByIdAndDelete(). When a DELETE request hits /api/posts/:id, Express extracts the id from the URL parameters and passes it to Mongoose. If the document is found and deleted, Mongoose returns the deleted document. If the document does not exist (perhaps it was already deleted), it returns null. We must check for this null state and return a 404 Not Found to the client if necessary.

Enforcing Authorization. Currently, our endpoints are fully functional, but dangerously exposed. Anyone with Postman can send a DELETE request to /api/posts/123 and destroy the database. To fix this, we must enforce Authorization at the route level. Before we call findByIdAndUpdate, we must first check if post.author.toString() === req.user.id. We will build out this req.user functionality in the upcoming Authentication module using JSON Web Tokens (JWT).

Before executing a destructive database operation like a delete, why is it necessary to fetch the document first, rather than immediately running findByIdAndDelete()?

• →To examine the author field and verify ownership before deletion.
• →Because Mongoose requires documents in RAM to delete them.

The Stage is Set. We have now explored the theoretical architecture for secure CRUD operations. However, to actually implement these security guards, we need a robust identity system. How does the server know who req.user is? Since HTTP is completely stateless, the server forgets who you are the millisecond the request finishes. In the next module, we will solve this fundamental problem using JSON Web Tokens (JWT) and secure authentication.