Node.js & NestJS Interview — The Complete Guide

console.log("1 — sync");

setTimeout(() => console.log("2 — timer phase"), 0);
setImmediate(() => console.log("3 — check phase"));

process.nextTick(() => console.log("4 — nextTick (microtask)"));
Promise.resolve().then(() => console.log("5 — Promise (microtask)"));

console.log("6 — sync");

// Output: 1, 6, 4, 5, 2, 3
// Sync first → nextTick → Promise → timer → immediate
// Note: timer vs immediate order can vary inside I/O callbacks

// Check memory usage
const used = process.memoryUsage();
console.log({
  rss: `${Math.round(used.rss / 1024 / 1024)} MB`,        // total allocated
  heapUsed: `${Math.round(used.heapUsed / 1024 / 1024)} MB`, // actual usage
  heapTotal: `${Math.round(used.heapTotal / 1024 / 1024)} MB`, // V8 heap size
});

// Common memory leak: event listeners not cleaned up
const emitter = new EventEmitter();
function handler() { /* ... */ }
emitter.on("data", handler);
// Later: emitter.removeListener("data", handler); // MUST clean up

// V8 heap limit (default ~1.5GB)
// Increase with: node --max-old-space-size=4096 app.js

import { createReadStream, createWriteStream } from "fs";
import { pipeline } from "stream/promises";
import { createGzip } from "zlib";
import { Transform } from "stream";

// Basic: stream a file through gzip to output
await pipeline(
  createReadStream("input.log"),       // Readable
  createGzip(),                         // Transform
  createWriteStream("output.log.gz")   // Writable
);
// Memory stays constant regardless of file size

// Custom transform stream
const upperCase = new Transform({
  transform(chunk, encoding, callback) {
    this.push(chunk.toString().toUpperCase());
    callback();
  },
});

await pipeline(
  createReadStream("input.txt"),
  upperCase,
  createWriteStream("output.txt")
);

// ❌ Bad — .pipe() doesn't handle errors or backpressure properly
readStream.pipe(transformStream).pipe(writeStream);

// ✅ Good — pipeline handles backpressure + errors + cleanup
import { pipeline } from "stream/promises";
try {
  await pipeline(readStream, transformStream, writeStream);
  console.log("Pipeline complete");
} catch (err) {
  console.error("Pipeline failed:", err);
}

// Manual backpressure handling (for understanding)
readStream.on("data", (chunk) => {
  const canContinue = writeStream.write(chunk);
  if (!canContinue) {
    readStream.pause();                    // stop reading
    writeStream.once("drain", () => {
      readStream.resume();                 // resume when buffer drains
    });
  }
});

// Creating buffers
const buf1 = Buffer.from("Hello, World!");          // from string
const buf2 = Buffer.alloc(1024);                     // zero-filled, 1KB
const buf3 = Buffer.allocUnsafe(1024);               // uninitialized (faster, may contain old data)

// Buffer operations
buf1.toString("utf-8");                              // "Hello, World!"
buf1.toString("base64");                             // "SGVsbG8sIFdvcmxkIQ=="
Buffer.concat([buf1, buf2]);                         // combine buffers
buf1.length;                                         // 13 bytes (not characters!)

// ⚠️ Buffer.allocUnsafe is faster but may contain old memory data
// Only use when you'll immediately overwrite the entire buffer

import { readFile, writeFile, stat, mkdir } from "fs/promises";
import { existsSync } from "fs";

// ✅ Always use fs/promises (async) — never fs sync methods in production
const content = await readFile("config.json", "utf-8");
const config = JSON.parse(content);

await writeFile("output.json", JSON.stringify(data, null, 2));

// Check if file exists (sync is OK for startup checks)
if (existsSync("./uploads")) {
  const stats = await stat("./uploads");
  console.log("Is directory:", stats.isDirectory());
}

// ❌ Never in production — blocks the event loop
// const data = readFileSync("large-file.csv", "utf-8");

// CommonJS
const express = require("express");
module.exports = { handler };
module.exports.helper = helper;

// ES Modules
import express from "express";
export { handler };
export default handler;

// Dynamic import (works in both)
const module = await import("./heavy-module.js");

// CommonJS in ESM: use createRequire
import { createRequire } from "module";
const require = createRequire(import.meta.url);
const pkg = require("./package.json");

// 1. Async/await — always wrap in try/catch
async function fetchUser(id: string) {
  try {
    const user = await db.findById(id);
    if (!user) throw new NotFoundError("User not found");
    return user;
  } catch (err) {
    if (err instanceof NotFoundError) throw err; // re-throw known errors
    logger.error("Unexpected error fetching user", { id, err });
    throw new InternalError("Failed to fetch user");
  }
}

// 2. Promise chains — always have a .catch()
fetchData()
  .then(process)
  .catch((err) => logger.error("Pipeline failed", err));

// 3. Event emitters — listen for 'error' event
const stream = fs.createReadStream("file.txt");
stream.on("error", (err) => {
  logger.error("Stream error", err);
});

// 4. Global safety nets (last resort — log and restart)
process.on("uncaughtException", (err) => {
  logger.fatal("Uncaught exception", err);
  process.exit(1); // exit — state may be corrupted
});

process.on("unhandledRejection", (reason) => {
  logger.fatal("Unhandled rejection", reason);
  process.exit(1);
});

// Base application error
class AppError extends Error {
  constructor(
    public statusCode: number,
    public code: string,
    message: string,
    public isOperational = true // operational vs programmer error
  ) {
    super(message);
    this.name = this.constructor.name;
    Error.captureStackTrace(this, this.constructor);
  }
}

class NotFoundError extends AppError {
  constructor(message = "Resource not found") {
    super(404, "NOT_FOUND", message);
  }
}

class ValidationError extends AppError {
  constructor(message: string, public details?: Record<string, string>[]) {
    super(400, "VALIDATION_ERROR", message);
  }
}

class UnauthorizedError extends AppError {
  constructor(message = "Unauthorized") {
    super(401, "UNAUTHORIZED", message);
  }
}

// Operational errors: expected failures (bad input, not found, auth)
// Programmer errors: bugs (TypeError, null reference) — crash and restart

import express from "express";
const app = express();

// 1. Built-in middleware
app.use(express.json());                    // parse JSON bodies
app.use(express.urlencoded({ extended: true })); // parse form data

// 2. Custom middleware — runs for every request
app.use((req, res, next) => {
  req.requestId = crypto.randomUUID();
  console.log(`[${req.method}] ${req.path} — ${req.requestId}`);
  next(); // MUST call next() or the request hangs
});

// 3. Route-specific middleware
const authenticate = (req, res, next) => {
  const token = req.headers.authorization?.split(" ")[1];
  if (!token) return res.status(401).json({ error: "No token" });
  try {
    req.user = jwt.verify(token, SECRET);
    next();
  } catch {
    res.status(401).json({ error: "Invalid token" });
  }
};

app.get("/api/profile", authenticate, (req, res) => {
  res.json(req.user); // only runs if authenticate calls next()
});

// 4. Error-handling middleware (4 params — Express recognizes the signature)
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(err.statusCode || 500).json({
    error: { code: err.code || "INTERNAL_ERROR", message: err.message },
  });
});

// user.module.ts
@Module({
  imports: [TypeOrmModule.forFeature([User])],  // register entities
  controllers: [UserController],                 // HTTP handlers
  providers: [UserService],                      // business logic
  exports: [UserService],                        // make available to other modules
})
export class UserModule {}

// app.module.ts — root module
@Module({
  imports: [
    ConfigModule.forRoot({ isGlobal: true }),    // global config
    TypeOrmModule.forRoot({ /* DB config */ }),   // database
    UserModule,                                   // feature module
    OrderModule,
    AuthModule,
  ],
})
export class AppModule {}

@Controller("users")
export class UserController {
  constructor(private readonly userService: UserService) {}

  @Get()
  findAll(@Query("page") page = 1, @Query("limit") limit = 20) {
    return this.userService.findAll(page, limit);
  }

  @Get(":id")
  findOne(@Param("id", ParseIntPipe) id: number) {
    return this.userService.findOne(id);
  }

  @Post()
  @HttpCode(HttpStatus.CREATED)
  @UsePipes(new ValidationPipe({ whitelist: true }))
  create(@Body() createUserDto: CreateUserDto) {
    return this.userService.create(createUserDto);
  }

  @Put(":id")
  update(@Param("id", ParseIntPipe) id: number,
         @Body() updateUserDto: UpdateUserDto) {
    return this.userService.update(id, updateUserDto);
  }

  @Delete(":id")
  @HttpCode(HttpStatus.NO_CONTENT)
  remove(@Param("id", ParseIntPipe) id: number) {
    return this.userService.remove(id);
  }
}

// Service — @Injectable makes it available for DI
@Injectable()
export class UserService {
  constructor(
    @InjectRepository(User) private userRepo: Repository<User>,
    private readonly emailService: EmailService, // auto-injected
  ) {}

  async findOne(id: number): Promise<User> {
    const user = await this.userRepo.findOneBy({ id });
    if (!user) throw new NotFoundException(`User ${id} not found`);
    return user;
  }
}

// Custom provider — useful for third-party libraries
@Module({
  providers: [
    {
      provide: "REDIS_CLIENT",
      useFactory: async (config: ConfigService) => {
        return new Redis(config.get("REDIS_URL"));
      },
      inject: [ConfigService],
    },
  ],
})
export class CacheModule {}

// Inject custom provider
@Injectable()
export class CacheService {
  constructor(@Inject("REDIS_CLIENT") private redis: Redis) {}
}

// DTO with class-validator decorators
import { IsEmail, IsNotEmpty, MinLength, IsOptional, Min } from "class-validator";

export class CreateUserDto {
  @IsNotEmpty({ message: "Name is required" })
  name: string;

  @IsEmail({}, { message: "Must be a valid email" })
  email: string;

  @MinLength(8, { message: "Password must be at least 8 characters" })
  password: string;

  @IsOptional()
  @Min(18, { message: "Must be at least 18" })
  age?: number;
}

// Global validation pipe — validates all incoming DTOs
// main.ts
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,        // strip unknown properties
  forbidNonWhitelisted: true, // throw if unknown properties sent
  transform: true,        // auto-transform payloads to DTO instances
}));

// Controller — @Body() is automatically validated
@Post()
create(@Body() dto: CreateUserDto) {
  return this.userService.create(dto);
}
// If validation fails → 400 { statusCode: 400, message: [...errors] }

// Custom pipe — parse and validate ObjectId
@Injectable()
export class ParseObjectIdPipe implements PipeTransform<string> {
  transform(value: string): string {
    if (!Types.ObjectId.isValid(value)) {
      throw new BadRequestException(`"${value}" is not a valid ObjectId`);
    }
    return value;
  }
}

// Usage
@Get(":id")
findOne(@Param("id", ParseObjectIdPipe) id: string) {
  return this.service.findOne(id);
}

// JWT Auth Guard
@Injectable()
export class JwtAuthGuard implements CanActivate {
  constructor(private jwtService: JwtService) {}

  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const token = request.headers.authorization?.split(" ")[1];

    if (!token) throw new UnauthorizedException("No token provided");

    try {
      const payload = this.jwtService.verify(token);
      request.user = payload;
      return true;
    } catch {
      throw new UnauthorizedException("Invalid token");
    }
  }
}

// Roles Guard — checks user role
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.get<string[]>("roles", context.getHandler());
    if (!requiredRoles) return true; // no roles required

    const { user } = context.switchToHttp().getRequest();
    return requiredRoles.includes(user.role);
  }
}

// Custom decorator for roles
const Roles = (...roles: string[]) => SetMetadata("roles", roles);

// Usage
@Get("admin/dashboard")
@UseGuards(JwtAuthGuard, RolesGuard)
@Roles("admin")
getAdminDashboard() {
  return this.adminService.getDashboard();
}

// Logging interceptor — measures request duration
@Injectable()
export class LoggingInterceptor implements NestInterceptor {
  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
    const request = context.switchToHttp().getRequest();
    const start = Date.now();

    return next.handle().pipe(
      tap(() => {
        const duration = Date.now() - start;
        console.log(`[${request.method}] ${request.url} — ${duration}ms`);
      }),
    );
  }
}

// Transform interceptor — wrap all responses in { data: ... }
@Injectable()
export class TransformInterceptor<T> implements NestInterceptor<T, { data: T }> {
  intercept(context: ExecutionContext, next: CallHandler<T>) {
    return next.handle().pipe(
      map((data) => ({ data, timestamp: new Date().toISOString() })),
    );
  }
}

// Apply globally
app.useGlobalInterceptors(new LoggingInterceptor());

@Catch() // catches all exceptions
export class AllExceptionsFilter implements ExceptionFilter {
  catch(exception: unknown, host: ArgumentsHost) {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse();
    const request = ctx.getRequest();

    const status = exception instanceof HttpException
      ? exception.getStatus()
      : HttpStatus.INTERNAL_SERVER_ERROR;

    const message = exception instanceof HttpException
      ? exception.getResponse()
      : "Internal server error";

    response.status(status).json({
      statusCode: status,
      message,
      timestamp: new Date().toISOString(),
      path: request.url,
    });
  }
}

// Apply globally
app.useGlobalFilters(new AllExceptionsFilter());

// Entity definition
@Entity("users")
export class User {
  @PrimaryGeneratedColumn()
  id: number;

  @Column({ unique: true })
  email: string;

  @Column()
  name: string;

  @Column({ select: false }) // excluded from default queries
  password: string;

  @CreateDateColumn()
  createdAt: Date;

  @UpdateDateColumn()
  updatedAt: Date;

  @OneToMany(() => Order, (order) => order.user)
  orders: Order[];
}

@Entity("orders")
export class Order {
  @PrimaryGeneratedColumn()
  id: number;

  @Column("decimal", { precision: 10, scale: 2 })
  total: number;

  @ManyToOne(() => User, (user) => user.orders)
  @JoinColumn({ name: "user_id" })
  user: User;

  @Column()
  userId: number;
}

@Injectable()
export class UserService {
  constructor(
    @InjectRepository(User) private userRepo: Repository<User>,
  ) {}

  findAll(page: number, limit: number) {
    return this.userRepo.find({
      skip: (page - 1) * limit,
      take: limit,
      order: { createdAt: "DESC" },
    });
  }

  findOne(id: number) {
    return this.userRepo.findOne({
      where: { id },
      relations: ["orders"], // eager load orders
    });
  }

  // QueryBuilder for complex queries
  async findActiveWithOrders() {
    return this.userRepo
      .createQueryBuilder("user")
      .leftJoinAndSelect("user.orders", "order")
      .where("user.active = :active", { active: true })
      .andWhere("order.createdAt > :date", { date: thirtyDaysAgo })
      .orderBy("user.createdAt", "DESC")
      .getMany();
  }
}

// prisma/schema.prisma
model User {
  id        Int      @id @default(autoincrement())
  email     String   @unique
  name      String
  password  String
  orders    Order[]
  createdAt DateTime @default(now()) @map("created_at")
  updatedAt DateTime @updatedAt @map("updated_at")

  @@map("users")
}

model Order {
  id        Int      @id @default(autoincrement())
  total     Decimal  @db.Decimal(10, 2)
  user      User     @relation(fields: [userId], references: [id])
  userId    Int      @map("user_id")
  createdAt DateTime @default(now()) @map("created_at")

  @@map("orders")
}

@Injectable()
export class UserService {
  constructor(private prisma: PrismaService) {}

  findAll(page: number, limit: number) {
    return this.prisma.user.findMany({
      skip: (page - 1) * limit,
      take: limit,
      orderBy: { createdAt: "desc" },
    });
  }

  findOne(id: number) {
    return this.prisma.user.findUnique({
      where: { id },
      include: { orders: true }, // eager load orders
    });
  }

  // Prisma transactions
  async createUserWithOrder(userData: CreateUserDto, orderData: CreateOrderDto) {
    return this.prisma.$transaction(async (tx) => {
      const user = await tx.user.create({ data: userData });
      const order = await tx.order.create({
        data: { ...orderData, userId: user.id },
      });
      return { user, order };
    });
  }
}

// jwt.strategy.ts — validates JWT tokens
@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(private config: ConfigService) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: config.get("JWT_SECRET"),
    });
  }

  // Called after token is verified — return value is set as req.user
  async validate(payload: { sub: number; email: string; role: string }) {
    return { id: payload.sub, email: payload.email, role: payload.role };
  }
}

// auth.module.ts
@Module({
  imports: [
    PassportModule,
    JwtModule.registerAsync({
      inject: [ConfigService],
      useFactory: (config: ConfigService) => ({
        secret: config.get("JWT_SECRET"),
        signOptions: { expiresIn: "15m" },
      }),
    }),
  ],
  providers: [AuthService, JwtStrategy],
  exports: [AuthService],
})
export class AuthModule {}

@Injectable()
export class AuthService {
  constructor(
    private userService: UserService,
    private jwtService: JwtService,
  ) {}

  async login(email: string, password: string) {
    const user = await this.userService.findByEmail(email);
    if (!user) throw new UnauthorizedException("Invalid credentials");

    const isValid = await bcrypt.compare(password, user.password);
    if (!isValid) throw new UnauthorizedException("Invalid credentials");

    const payload = { sub: user.id, email: user.email, role: user.role };
    return {
      accessToken: this.jwtService.sign(payload),
      refreshToken: this.jwtService.sign(payload, { expiresIn: "7d" }),
    };
  }

  async refreshToken(token: string) {
    try {
      const payload = this.jwtService.verify(token);
      const newPayload = { sub: payload.sub, email: payload.email, role: payload.role };
      return { accessToken: this.jwtService.sign(newPayload) };
    } catch {
      throw new UnauthorizedException("Invalid refresh token");
    }
  }
}

// Custom decorator
export const Roles = (...roles: string[]) => SetMetadata("roles", roles);

// Current user decorator
export const CurrentUser = createParamDecorator(
  (data: unknown, ctx: ExecutionContext) => {
    const request = ctx.switchToHttp().getRequest();
    return request.user;
  },
);

// Usage in controller
@Controller("admin")
@UseGuards(JwtAuthGuard, RolesGuard)
export class AdminController {

  @Get("users")
  @Roles("admin")
  getAllUsers(@CurrentUser() user: JwtPayload) {
    console.log("Requested by:", user.email);
    return this.adminService.getAllUsers();
  }

  @Delete("users/:id")
  @Roles("admin", "superadmin")
  deleteUser(@Param("id", ParseIntPipe) id: number) {
    return this.adminService.deleteUser(id);
  }
}

describe("UserService", () => {
  let service: UserService;
  let repo: Repository<User>;

  beforeEach(async () => {
    const module = await Test.createTestingModule({
      providers: [
        UserService,
        {
          provide: getRepositoryToken(User),
          useValue: {
            findOneBy: jest.fn(),
            save: jest.fn(),
            find: jest.fn(),
          },
        },
      ],
    }).compile();

    service = module.get(UserService);
    repo = module.get(getRepositoryToken(User));
  });

  it("should return a user by id", async () => {
    const mockUser = { id: 1, name: "Alice", email: "alice@test.com" };
    jest.spyOn(repo, "findOneBy").mockResolvedValue(mockUser as User);

    const result = await service.findOne(1);
    expect(result).toEqual(mockUser);
    expect(repo.findOneBy).toHaveBeenCalledWith({ id: 1 });
  });

  it("should throw NotFoundException for missing user", async () => {
    jest.spyOn(repo, "findOneBy").mockResolvedValue(null);
    await expect(service.findOne(999)).rejects.toThrow(NotFoundException);
  });
});

describe("UserController (e2e)", () => {
  let app: INestApplication;

  beforeAll(async () => {
    const module = await Test.createTestingModule({
      imports: [AppModule],
    }).compile();

    app = module.createNestApplication();
    app.useGlobalPipes(new ValidationPipe({ whitelist: true }));
    await app.init();
  });

  afterAll(() => app.close());

  it("POST /users — should create a user", () => {
    return request(app.getHttpServer())
      .post("/users")
      .send({ name: "Alice", email: "alice@test.com", password: "password123" })
      .expect(201)
      .expect((res) => {
        expect(res.body).toHaveProperty("id");
        expect(res.body.email).toBe("alice@test.com");
      });
  });

  it("POST /users — should return 400 for invalid email", () => {
    return request(app.getHttpServer())
      .post("/users")
      .send({ name: "Alice", email: "not-an-email", password: "password123" })
      .expect(400);
  });

  it("GET /users/:id — should return 404 for missing user", () => {
    return request(app.getHttpServer())
      .get("/users/99999")
      .expect(404);
  });
});

// Request/Response — client sends, waits for reply
// Client side
@Injectable()
export class OrderService {
  constructor(@Inject("USER_SERVICE") private client: ClientProxy) {}

  async getUserForOrder(userId: number) {
    // send() returns Observable — use lastValueFrom to await
    return lastValueFrom(
      this.client.send({ cmd: "get_user" }, { userId })
    );
  }
}

// Server side (User microservice)
@Controller()
export class UserController {
  @MessagePattern({ cmd: "get_user" })
  getUser(@Payload() data: { userId: number }) {
    return this.userService.findOne(data.userId);
  }
}

// Event-based — fire and forget (no response)
// Client side
this.client.emit("order_placed", { orderId: 123, userId: 456 });

// Server side (Notification microservice)
@EventPattern("order_placed")
async handleOrderPlaced(@Payload() data: { orderId: number; userId: number }) {
  await this.notificationService.sendOrderConfirmation(data);
  // no return value — fire and forget
}

// Register queue in module
@Module({
  imports: [
    BullModule.registerQueue({ name: "email" }),
  ],
  providers: [EmailProcessor],
})
export class EmailModule {}

// Producer — add jobs to queue
@Injectable()
export class OrderService {
  constructor(@InjectQueue("email") private emailQueue: Queue) {}

  async placeOrder(dto: CreateOrderDto) {
    const order = await this.orderRepo.save(dto);

    // Add job to queue — processed asynchronously
    await this.emailQueue.add("order-confirmation", {
      orderId: order.id,
      email: dto.email,
    }, {
      attempts: 3,                    // retry 3 times on failure
      backoff: { type: "exponential", delay: 2000 },
      removeOnComplete: true,
    });

    return order;
  }
}

// Consumer — processes jobs from queue
@Processor("email")
export class EmailProcessor {
  @Process("order-confirmation")
  async handleOrderConfirmation(job: Job<{ orderId: number; email: string }>) {
    const { orderId, email } = job.data;
    await this.emailService.sendOrderConfirmation(email, orderId);
  }

  @OnQueueFailed()
  handleFailure(job: Job, error: Error) {
    logger.error(`Job ${job.id} failed: ${error.message}`);
  }
}

import cluster from "cluster";
import os from "os";

if (cluster.isPrimary) {
  const numCPUs = os.cpus().length;
  console.log(`Primary ${process.pid} forking ${numCPUs} workers`);

  for (let i = 0; i < numCPUs; i++) {
    cluster.fork();
  }

  cluster.on("exit", (worker) => {
    console.log(`Worker ${worker.process.pid} died. Restarting...`);
    cluster.fork(); // auto-restart crashed workers
  });
} else {
  // Each worker runs the full app
  const app = await NestFactory.create(AppModule);
  await app.listen(3000);
  console.log(`Worker ${process.pid} started`);
}

// In production, use PM2 instead:
// pm2 start dist/main.js -i max  (auto-detect CPU count)