NodeJS is a JavaScript runtime built on Google's V8 Engine that allows JavaScript to run outside the browser.

Key Characteristics

• Single-threaded
• Event-driven
• Non-blocking I/O
• Asynchronous programming model

Common Use Cases

• REST APIs
• Real-time applications
• Microservices
• Streaming services
• Chat applications

The Event Loop allows NodeJS to perform non-blocking operations even though JavaScript runs on a single thread.

Execution Flow

1. Call Stack
2. Node APIs / Libuv
3. Callback Queue
4. Event Loop

Example

console.log('Start');

setTimeout(() => {
  console.log('Timer');
}, 0);

console.log('End');

Output

Start
End
Timer

console.log('A');

setTimeout(() => console.log('B'));

Promise.resolve()
  .then(() => console.log('C'));

console.log('D');

Correct Output

A
D
C
B

Explanation

• Promise callbacks enter Microtask Queue
• Microtasks execute before Callback Queue
• setTimeout callback executes last

Both are used for handling data, but work differently.

fs.createReadStream('large-file.txt');

fs.readFile('large-file.txt');

Worker Threads allow CPU-intensive tasks to run on separate threads, preventing the Event Loop from being blocked.

const { Worker } = require('worker_threads');

const worker = new Worker('./worker.js');

Common Use Cases

• Image processing
• PDF generation
• Data analysis
• Encryption

Restrict a user to a fixed number of requests.

const requests = {};

function allowRequest(ip) {

  requests[ip] ??= 0;

  if (requests[ip] >= 5) {
    return false;
  }

  requests[ip]++;

  return true;
}

Interview Discussion Points

• Memory usage
• Distributed systems
• Redis implementation
• Sliding window algorithm

Expected Topics

• Load Balancer
• Horizontal Scaling
• Microservices
• Redis Cache
• Database Sharding
• CDN
• Message Queues
• Monitoring

The package.json file is the manifest of a Node.js project. It holds metadata (name, version, main file) and manages project dependencies.

• dependencies: Essential packages required to run the application in production (e.g., Express, Lodash).
• devDependencies: Packages only needed during local development, testing, or building (e.g., Jest, ESLint, TypeScript compiler).

{
  "name": "my-app",
  "dependencies": {
    "express": "^4.18.2"
  },
  "devDependencies": {
    "jest": "^29.5.0"
  }
}

In CommonJS, module.exports is the actual object returned when requiring a module. exports is merely a shorthand variable pointing to the same memory reference as module.exports.

If you assign a new object or function to exports directly (e.g., exports = MyClass), you break the reference, and Node.js will still return the original module.exports (which remains empty).

// Correct exports shorthand
exports.add = (a, b) => a + b;

// Correct default override
module.exports = (a, b) => a + b;

The package-lock.json file locks down the exact version of all dependencies (and their nested dependencies) installed in the project. It records the precise dependency tree with hash checksums to ensure reproducible builds across machines.

It must be committed to git to prevent drift between local development, staging, and production environments.

Environment variables are passed from the command line prefixing the execution script and are accessed inside the runtime via the global object process.env.

// Command line execution:
// PORT=4000 node index.js

const port = process.env.PORT || 3000;
console.log(`Server listening on port ${port}`);

Although they sound opposite:

• process.nextTick() executes callbacks immediately after the current phase of the event loop completes, before the loop enters the next phase. It runs microtasks.
• setImmediate() schedules execution on the next turn (tick) of the event loop during the check phase.

process.nextTick(() => console.log('Tick'));
setImmediate(() => console.log('Immediate'));
// Output: 
// Tick
// Immediate

Instead of manual string concats using slashes, use the built-in path module methods like path.join() and path.resolve(). They automatically format paths with delimiters matching the runtime OS (Windows \ vs Unix /).

const path = require('path');

// Safe cross-platform absolute path
const uploadDir = path.join(__dirname, 'uploads', 'images');
console.log(uploadDir);

The EventEmitter is a core class of the events module. It implements the Observer pattern, allowing one part of the code to emit named event markers that trigger registered listener callback functions.

const EventEmitter = require('events');
const myEmitter = new EventEmitter();

myEmitter.on('login', (user) => {
  console.log(`User logged in: ${user}`);
});

myEmitter.emit('login', 'Vijay');

fs.readFile is asynchronous and non-blocking, delegating the reading task to the Libuv thread pool. fs.readFileSync is synchronous and blocking, stalling the main event loop thread until the entire file is fetched.

Use the built-in http module and call the createServer() factory method.

const http = require('http');

const server = http.createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' });
  res.end('Hello NodeJS World');
});

server.listen(3000);

Middleware functions are functions that have access to the request object (req), response object (res), and the next middleware function in the application’s request-response cycle.

They can execute code, modify request/response objects, end request cycles, or call next() to pass control to subsequent handlers.

const logger = (req, res, next) => {
  console.log(`${req.method} request received`);
  next(); // Mandatory to pass control
};

In browsers, the top-level global scope is window. In Node.js, the global scope is global. Also, variables declared with var at the top level of a Node.js file are local to that module wrapper, not added to the global scope like browsers.

npm is the package manager used to install, update, and manage dependencies in a project. npx is a package runner tool shipped with npm. It allows executing CLI packages (e.g. create-react-app, prisma) directly from the registry without installing them globally.

A Buffer represents a fixed-size chunk of memory allocated outside the V8 heap. It is designed to handle raw binary data streams (such as files, TCP packets, images) which JavaScript originally had no native type for.

const buf = Buffer.from('Hello');
console.log(buf); // Output raw bytes: 
console.log(buf.toString()); // Output: Hello

Type coercion is the automatic conversion of values from one data type to another (e.g., 5 + '5' = '55'). Node.js developers avoid coercion by using strict equality comparisons (=== and !==) instead of loose ones (== and !=).

Routing determines how an application responds to a client request to a particular endpoint (URI/path) and HTTP request method (GET, POST, etc.). Express supports route parameters and router groups.

const express = require('express');
const app = express();

app.get('/users/:id', (req, res) => {
  res.send(`User ID: ${req.params.id}`);
});

Use built-in body parsing middlewares. Since Express 4.16+, body-parser is bundled within Express directly, enabling express.json() for JSON payloads and express.urlencoded() for form-submitted key-values.

const express = require('express');
const app = express();

app.use(express.json()); // Parses JSON bodies
app.post('/data', (req, res) => {
  console.log(req.body); // holds JSON parsed content
  res.sendStatus(200);
});

npm shrinkwrap creates a locked manifest file (npm-shrinkwrap.json) that behaves exactly like package-lock.json, but is publishable to the public npm registry to enforce lock versions on consumer installs.

Core modules are modules pre-compiled into the Node.js binary. They don't require npm installs and are imported directly via require/import statements.

Examples: fs, path, http, os, crypto, events, util.

REPL stands for **Read-Eval-Print-Loop**. It is the interactive shell interface launched when running the node command alone, allowing immediate execution of JS commands for testing.

Query parameters following the ? symbol in an API url are parsed by Express automatically and populated inside the req.query object.

// GET /search?q=nodejs&limit=10
app.get('/search', (req, res) => {
  const query = req.query.q;
  const limit = req.query.limit;
  res.send(`Search for ${query}, limit ${limit}`);
});

Backpressure occurs when the data writing buffer speed is slower than the data reading buffer speed in streams (e.g. fast disk read piped to a slow HTTP client). This leads to memory accumulation and eventually OOM crashes.

To handle it, stream consumers notify publishers to pause reading by returning false on write(). The stream then fires the drain event once the buffer clears, indicating it is safe to resume reading.

const fs = require('fs');
const readStream = fs.createReadStream('large.txt');
const writeStream = fs.createWriteStream('copy.txt');

readStream.on('data', (chunk) => {
  const canContinue = writeStream.write(chunk);
  if (!canContinue) {
    readStream.pause(); // Pause reading to handle backpressure
  }
});

writeStream.on('drain', () => {
  readStream.resume(); // Resume reading once buffer is flushed
});

child_process.fork() is a special helper of spawn to create a new Node.js child process executing a specified JS module. Unlike standard processes, fork creates an IPC channel allowing bidirectional message passage between the parent and child via send() and on('message').

// parent.js
const { fork } = require('child_process');
const child = fork('child.js');

child.send({ hello: 'child' });
child.on('message', (msg) => console.log('Parent received:', msg));

// child.js
process.on('message', (msg) => {
  console.log('Child received:', msg);
  process.send({ hello: 'parent' });
});

These helpers spawn child processes with specific configurations:

• spawn(): Stream-based execution of CLI commands. Best for returning large amounts of data dynamically without blocking memory.
• exec(): Spawns a shell and buffers the output (default limit: 200KB). Best for running small scripts and receiving immediate output.
• execFile(): Runs a file binary directly without spawning a shell, saving memory and improving execution speed.
• fork(): Spawns a new Node.js process and creates an IPC communications channel.

libuv is the multi-platform C library supporting asynchronous I/O operations in Node.js. It manages the Event Loop and a Worker Thread Pool for task delegations that are not natively asynchronous at the OS level (like file system access, crypto hashing, DNS resolution).

The default size is 4 threads. It can be modified on startup by setting the environment variable UV_THREADPOOL_SIZE (up to a limit of 1024).

JWT is a stateless credential format consisting of three base64url strings: Header, Payload, and Signature. It is passed via authorization request headers to authenticate users without storing session states in database tables.

const jwt = require('jsonwebtoken');

// Generate Token
const token = jwt.sign({ userId: 123 }, 'secret_key', { expiresIn: '1h' });

// Verify Token Middleware
const authenticate = (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).send('Access Denied');
  
  try {
    const decoded = jwt.verify(token, 'secret_key');
    req.user = decoded;
    next();
  } catch (err) {
    res.status(403).send('Invalid Token');
  }
};

Differences are centered around state management:

• Session-based: Stateful. The server creates a session entry in a database/memory cache (Redis) and returns a unique session ID stored in client cookies. Subsequent queries validate the session ID against the server session repository.
• Token-based: Stateless. The server issues a signed JWT containing client data. The client stores it locally (LocalStorage or HttpOnly Cookies) and attaches it to request headers. The server verifies signature validity without querying cache databases.

Do not use simple hash algorithms like MD5 or SHA256 alone because they are vulnerable to dictionary and rainbow table lookups. Instead, use slow, adaptive hashing libraries like bcrypt or Node.js native crypto.scrypt(), applying unique salt strings.

const bcrypt = require('bcrypt');

// Hash password
const hashPassword = async (pwd) => {
  const salt = await bcrypt.genSalt(10);
  return await bcrypt.hash(pwd, salt);
};

// Compare password
const verifyPassword = async (pwd, hash) => {
  return await bcrypt.compare(pwd, hash);
};

Rate limiting restricts the number of requests a client can make in a specified window of time, preventing DDoS and brute-force scenarios. Locally, you can use packages like express-rate-limit, but distributed architectures require storing hits in a central Redis cache database.

const rateLimit = require('express-rate-limit');

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // max 100 requests per IP
  message: 'Too many requests, please try again later.'
});

app.use('/api/', apiLimiter);

helmet is an Express middleware collection that sets various secure HTTP response headers to defend against clickjacking, sniff attacks, XSS, and server details identification.

It hides headers like X-Powered-By: Express and enforces security constraints like Strict-Transport-Security, X-Content-Type-Options: nosniff, and Content-Security-Policy.

Node.js standard streams (e.g. Readable, Writable) are proprietary to the Node.js runtime and emit events like data, end, and error. WebStreams are standard web API stream specifications (e.g. ReadableStream, WritableStream) supported inside browsers, Cloudflare Workers, and modern Node.js versions, allowing isomorphic streams logic.

AbortController is a standard controller object that communicates termination requests to async tasks (like fetch requests, file reads, or timeouts) using an AbortSignal.

const controller = new AbortController();
const { signal } = controller;

// Cancel fetch query after 500ms
setTimeout(() => controller.abort(), 500);

try {
  const res = await fetch('https://api.example.com/data', { signal });
  const data = await res.json();
} catch (err) {
  if (err.name === 'AbortError') console.log('Request cancelled!');
}

Supertest allows testing HTTP server endpoints without binding the Express application to network ports. Jest manages the test framework assertions, setup/teardown processes, and execution hooks.

const request = require('supertest');
const app = require('./app'); // Express app object

describe('GET /api/users', () => {
  it('should return list of users', async () => {
    const res = await request(app)
      .get('/api/users')
      .expect('Content-Type', /json/)
      .expect(200);
    
    expect(res.body).toBeInstanceOf(Array);
  });
});

Node.js 20 introduces a stable built-in test runner via the node:test module, removing external test dependencies (like Jest or Mocha) for lightweight test scripts.

const test = require('node:test');
const assert = require('node:assert');

test('synchronous addition test', (t) => {
  assert.strictEqual(1 + 1, 2);
});

Both exit code numbers tell the parent OS process status when Node exits:

• 0: Success/Normal termination. The script executed completely with no runtime errors.
• 1: Failure/Abnormal exit. Tells orchestrators (like Kubernetes, PM2, or Docker) that an error occurred, prompting restart configurations.

Node.js starts resolving from the current file folder looking for a node_modules folder. If not found, it climbs up parent directory folders iteratively to the root directory. Inside the module folder, it reads the package.json exports, main entry, or defaults to index.js.

util.promisify transforms standard node callback-based functions (expecting error-first callback params) into clean Promise-returning utilities compatible with async/await patterns.

const { promisify } = require('util');
const fs = require('fs');

const readFileAsync = promisify(fs.readFile);

try {
  const content = await readFileAsync('file.txt', 'utf8');
  console.log(content);
} catch (err) {
  console.error(err);
}

It listens to unhandled synchronous errors that bubble up to the global execution scope. This prevents standard crashes from dropping active requests, although it is best practice to log the error and terminate the process gracefully to avoid memory corruption states.

process.on('uncaughtException', (err) => {
  console.error('Fatal Uncaught Exception:', err);
  // Gracefully terminate application after logging
  process.exit(1);
});

It captures promise rejections that lack corresponding catch() handlers. Starting in modern Node.js versions, unhandled rejections will exit the process with status code 1 if not handled.

WebSockets enable persistent, full-duplex TCP communication channels over port connections. In Node.js, the ws package sets up lightweight WebSocket servers.

const { WebSocketServer } = require('ws');
const wss = new WebSocketServer({ port: 8080 });

wss.on('connection', (ws) => {
  ws.on('message', (message) => {
    console.log(`Received: ${message}`);
    ws.send('Acknowledged');
  });
});

Validation libraries like Zod or Joi enforce strict type schemas on client input (req.body, req.query, req.params) before route controllers run, preventing SQL injection, schema corruption, or invalid arguments from crashing the app.

const { z } = require('zod');

const userSchema = z.object({
  email: z.string().email(),
  age: z.number().min(18)
});

app.post('/register', (req, res) => {
  const result = userSchema.safeParse(req.body);
  if (!result.success) return res.status(400).json(result.error);
  res.send('Valid payload');
});

Path processing differences:

• path.join(): Joins all path segments together using OS path delimiters, returning a normalized relative path string.
• path.resolve(): Resolves path segments into an absolute path. It processes inputs from right to left, prefixing the current working directory (cwd) if a absolute path is not resolved.

exec runs command line inputs inside a system shell and passes the buffered outputs to a callback function.

const { exec } = require('child_process');

exec('ls -lh', (error, stdout, stderr) => {
  if (error) return console.error(`Error: ${error.message}`);
  console.log(`Output: ${stdout}`);
});

Standard REST codes include:

• 200: OK (Success)
• 201: Created (Success write)
• 400: Bad Request (Validation failed)
• 401: Unauthorized (No auth credentials)
• 403: Forbidden (Insufficient permission credentials)
• 404: Not Found
• 500: Internal Server Error

V8 divides heap memory into spaces for optimized GC cycles:

• New Space (Nursery): Small space (1-8MB) where new allocations occur. It uses a fast **Scavenge (Copy)** collector. Surviving objects are promoted to Old Space.
• Old Space: Holds long-lived objects. Divided into Old Pointer Space and Old Data Space. It uses **Mark-Sweep-Compact** algorithms.
• Large Object Space: Holds objects exceeding size allocations of other spaces, avoiding copy overhead.

V8 GC runs incrementally and concurrently to minimize pause times on the main event loop thread.

Memory leak detection and debugging flow:

1. Detection: Monitor memory usage (RSS/heapUsed) growing consistently over time in APMs (Datadog, Grafana) or using process.memoryUsage().
2. Snapshot Generation: Run node with --inspect, connect Chrome DevTools, and take Heap Snapshots at different intervals (before and after load tests).
3. Comparison: Compare snapshots to find growing allocations (often unreleased event listeners, global arrays, or closures).

// Programmatic snapshot generation
const v8 = require('v8');
const fs = require('fs');

const snapshotStream = v8.getHeapSnapshot();
const fileName = `${Date.now()}.heapsnapshot`;
const fileStream = fs.createWriteStream(fileName);
snapshotStream.pipe(fileStream);

Use the built-in V8 profiler to diagnose event loop delays:

1. Run Node with the built-in tick profiler: node --prof app.js.
2. Run load tests to simulate CPU pressure.
3. Process the generated log file: node --prof-process isolate-0xXXXX-v8.log > processed.txt.
4. Analyze the output to locate hot paths (blocking regex, crypto, parsing).

Differences are centered around memory sharing models:

• Child Processes: Each process runs on its own OS process, possessing its own V8 instance and isolated memory. Communication occurs through serialized IPC messaging. Best for external shell executions or long running tasks.
• Worker Threads: Run inside the same OS process on separate threads. They share memory through SharedArrayBuffer and avoid expensive serialization overheads. Best for CPU-intensive JavaScript operations.

const { Worker, isMainThread, parentPort } = require('worker_threads');

if (isMainThread) {
  const worker = new Worker(__filename);
  worker.on('message', (msg) => console.log('Received:', msg));
} else {
  parentPort.postMessage('Done');
}

Implement a Cache-Aside pattern. Look up key data in Redis cache; on miss, query database, save results in Redis with a TTL (Time To Live), and return payload.

const redis = require('redis');
const client = redis.createClient({ url: 'redis://localhost:6379' });

const getUserCached = async (userId) => {
  const cached = await client.get(`user:${userId}`);
  if (cached) return JSON.parse(cached);
  
  const user = await db.queryUser(userId);
  await client.setEx(`user:${userId}`, 3600, JSON.stringify(user)); // 1h TTL
  return user;
};

A Circuit Breaker wraps third-party network calls. If failures exceed a threshold (e.g. 50% errors), the breaker trips (opens) and immediately returns error responses instead of routing queries that pile up sockets on hanging downstreams. It moves to a **Half-Open** probe state after a cooldown to test if services recovered.

const opossum = require('opossum');

const asyncFunction = async (id) => {
  const res = await fetch(`https://partner-api/users/${id}`);
  return res.json();
};

const options = {
  timeout: 3000, // 3s timeout
  errorThresholdPercentage: 50, // open if 50% fail
  resetTimeout: 30000 // try reset after 30s
};

const breaker = new opossum(asyncFunction, options);
breaker.fallback(() => ({ error: 'Service Unavailable' }));

const data = await breaker.fire(123);

Opening a TCP connection for every query introduces latency and CPU spikes. Connection pooling maintains a pre-allocated pool of active database connections. Node.js processes lease active connections from the pool, execute SQL queries, and immediately return them to the pool.

Instead of updating database entity row values in place, Event Sourcing records every state modification as an immutable, sequential event stream (e.g. OrderCreated, ItemAdded, OrderPaid). The current state of an entity is derived by replaying (reducing) the events chronologically.

Introduced as an experimental feature in Node.js 20, the Permission Model allows restricting runtime access to resources such as the file system, network, and child processes using security CLI flags.

• --allow-fs-read/--allow-fs-write: Limit folder/file access.
• --allow-child-process: Disable/restrict spawning child processes.

In production, console.log should be avoided because it blocks synchronously when outputting to standard out. Use structured loggers like pino or winston that output log events as JSON formats, enabling quick indexing in Logstash/Elasticsearch aggregators.

const pino = require('pino');
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  mixin() { return { correlationId: 'tx-123' }; }
});

logger.info({ userId: 456 }, 'User successfully authenticated');

SQLi occurs when untrusted user input is directly concatenated into SQL strings, allowing malicious payloads to alter the query command structure. Prevent it by using **Prepared Statements** (parameterized queries) or modern ORMs, separating query structure from variables.

// VULNERABLE
const query = `SELECT * FROM users WHERE email = '${email}'`;

// SECURE
const query = 'SELECT * FROM users WHERE email = ?';
const [rows] = await db.execute(query, [email]);

Prevention strategies:

• XSS (Cross-Site Scripting): Sanitize user HTML inputs using libraries like dompurify. Configure strict Content-Security-Policy (CSP) headers using Helmet.
• CSRF (Cross-Site Request Forgery): Store JWT/session tokens inside secure, HttpOnly cookies configured with SameSite=Strict attribute. Require CSRF tokens on state-changing requests (POST/PUT/DELETE).

Event loop block/starvation occurs when synchronous operations (long JSON.parse, loops, crypto) hog the main execution thread, preventing microtasks and callbacks from running. You can detect blocking behavior using tools like `blocked-at` or node diagnostics hooks.

// Split heavy work with setImmediate
function processChunks(data) {
  if (data.length === 0) return;
  doSmallSegment(data.shift());
  
  // Defer next segment to prevent loop blocking
  setImmediate(() => processChunks(data));
}

Node.js core methods like dns.lookup() call the system-level C API getaddrinfo(), which is a blocking operation. Node handles this by running the lookup inside the Libuv thread pool. If the thread pool is full, DNS lookups stall, adding latency to HTTP requests.

To avoid this dependency, use dns.resolve() instead, which runs asynchronously over network sockets, bypassing the libuv threads.

A Transform stream is a type of Duplex stream where the output is computed from the input. You write it by extending the Transform class from stream module and overriding the _transform() method.

const { Transform } = require('stream');

class UpperCaseTransform extends Transform {
  _transform(chunk, encoding, callback) {
    const upperCased = chunk.toString().toUpperCase();
    this.push(upperCased);
    callback(); // Indicate processing is complete
  }
}

process.stdin.pipe(new UpperCaseTransform()).pipe(process.stdout);

Monorepo best practices:

• Use package managers with built-in workspace support (npm workspaces, pnpm, yarn).
• Separate core shared business logic (e.g. database schemas, authentication middleware) into isolated local packages referenced by apps.
• Utilize monorepo orchestration tools (turborepo, nx) to cache builds, lint, and run tests globally.

PM2 cluster mode creates child instances to scale Node across multiple CPU cores. For zero-downtime reloads, configure PM2 with reload instead of restart, and configure `listen_timeout` to wait for app boot verification.

// ecosystem.config.js
module.exports = {
  apps: [{
    name: "app",
    script: "./app.js",
    instances: "max", // Scale across all available CPU cores
    exec_mode: "cluster",
    listen_timeout: 3000,
    wait_active: true
  }]
};

Multi-stage Docker builds separate build tool chains (webpack, ts-compilers) from the runtime runtime image to minimize target container footprint and security attack surface.

# Build Stage
FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production Stage
FROM node:20-alpine AS production
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY --from=build /app/dist ./dist
CMD ["node", "dist/main.js"]

Prototype pollution is a vulnerability where attackers inject properties into the JavaScript base object prototype (Object.prototype) using keys like __proto__ or constructor.prototype, altering behavior in all created objects.

Defense: Use Object.create(null) for dictionary objects, schema validate user payload properties, or use Object.freeze(Object.prototype) on startup.

PKCE (Proof Key for Code Exchange) secures client authentication. The client generates a high-entropy cryptographically secure string called code_verifier, hashes it to create `code_challenge`, and sends the challenge on initial authorization. On redirect token retrieval, the client sends the original verifier, which Node validates by re-hashing.

A local memory limiter fails in clusters because traffic is spread randomly. A distributed rate limiter leverages a central Redis cache using a **sliding window counter** pattern. To minimize network latency, we implement the rate checking logic inside a **Redis Lua Script**, ensuring atomic executions in a single network round-trip.

// Lua script for sliding window rate limiting
const rateLimitLua = `
  local key = KEYS[1]
  local now = tonumber(ARGV[1])
  local window = tonumber(ARGV[2])
  local limit = tonumber(ARGV[3])
  local clearBefore = now - window
  
  redis.call('zremrangebyscore', key, 0, clearBefore)
  local amount = redis.call('zcard', key)
  if amount < limit then
    redis.call('zadd', key, now, now)
    redis.call('expire', key, window)
    return 1
  else
    return 0
  end
`;

High-concurrency WebSocket systems require a horizontally scaled layer of Node.js instances backed by a Redis Pub/Sub backplane. Key components include:

1. Load Balancing: An Nginx or AWS ALB layer configured with IP Hash (sticky sessions) to upgrade TCP socket connections.
2. Horizontal Scale: Scaling Node instances across clusters, keeping connections alive by modifying OS limits (nofile setting to 200,000+ files).
3. Pub/Sub Sync: When a user on Server A messages a user on Server B, the message publishes to a Redis channel, prompting Server B to broadcast to the targeted client.

Authentication should be centralized at the API Gateway layer (e.g. Kong, Apigee, or a custom Express gateway). The gateway verifies incoming JWTs or OAuth tokens. Upon successful validation, it injects custom header attributes (such as x-user-id, x-user-roles) and routes the request to target downstream services. Downstream microservices remain stateless and trust requests that match internal network authorization signatures.

Background processors avoid blocking client-facing API responses. BullMQ implements a producer-consumer model using Redis streams and sorting sets to support job retries, delays, prioritization, concurrency parameters, and concurrency limits.

const { Queue, Worker } = require('bullmq');

// Producer side (in Express API controller)
const emailQueue = new Queue('emails', { connection: redisConfig });
await emailQueue.add('welcomeEmail', { email: 'vijay@example.com' });

// Consumer side (in Worker process node)
const worker = new Worker('emails', async (job) => {
  await sendEmail(job.data.email);
}, { connection: redisConfig, concurrency: 10 });

Database sharding partitions tables horizontally across separate database engines. Dynamic routing calculates shard destinations based on a partition key (e.g. userId % totalShards). Node handles routing dynamically by instantiating database pools for each shard and routing queries inside middleware/repositories using the computed shard key.

A robust observability stack relies on three pillars: Metrics, Traces, and Logs.

1. Metrics: Expose Prometheus metrics (/metrics endpoint) capturing Node process states (event loop delay, heap size, active handles) using prom-client.
2. Traces: Instrument applications with OpenTelemetry (OTel) SDK. Inject span contexts on external queries to enable distributed trace charts (Jaeger, Zipkin).
3. Logs: Stream JSON structured logs to Elasticsearch/Logstash aggregator layers.

Zero-downtime relies on Kubernetes **Rolling Updates** combined with proper Node.js shutdown hook listeners. Key configurations include:

• Readiness Probe: Monitors if Node is booted and databases are connected before directing traffic.
• Liveness Probe: Monitors if the process crashed or hung.
• SIGTERM Handler: Node catches SIGTERM, immediately closes HTTP servers (stopping new connections), waits for active requests to finish (graceful shutdown window), and exits.

const server = app.listen(3000);

process.on('SIGTERM', () => {
  console.log('SIGTERM received. Starting graceful shutdown...');
  server.close(() => {
    console.log('HTTP server closed. Exiting process.');
    db.closeConnection().then(() => process.exit(0));
  });
});

Clean Architecture enforces separation of concerns by placing business logic at the core, independent of external frameworks (Express, NestJS, databases, ORMs). The folder layers are:

1. Domain (Entities): Central business models and logic (pure JS/TS).
2. Use Cases (Application): Orchestrates domain models. Declares interface abstractions for external integrations.
3. Interface Adapters (Controllers, Repositories): Converts HTTP or database inputs into domain models.
4. Frameworks & Drivers: External frameworks (Express router files, Sequelize/Prisma config pools).

Two-Phase Commit (2PC) blocks databases and fails at scale. We solve this by implementing the **Saga Pattern** (orchestrated or choreographed) or **Outbox Pattern**.

• Saga: Each service executes a local transaction and publishes an event. If a downstream service fails, compensating transactions are triggered backwards to roll back previous steps.
• Outbox: Saves database records and outbox events in a single transaction, publishing events to Kafka via an independent publisher process to ensure delivery.

A scalable notification platform uses an event-driven architecture based on **Apache Kafka** or **RabbitMQ** combined with BullMQ processing layers. Key stages include:

1. Ingestion API: Express endpoint validates requests and immediately pushes a job event (e.g. SendNotification) into a message broker, returning status 202 accepted.
2. Broker (Kafka): Partitions notification events by user or category to scale consumers.
3. Consumers (BullMQ): Specialized worker groups subscribe to events, retrieve user profile settings, apply template designs, and call third-party services (Twilio, Sendgrid) with exponential retries.