// the take
A TypeScript REST API boilerplate for Express + MongoDB with hand-rolled JWT authentication: sign up/in, password reset, email verification, avatar upload, and token blacklisting via Redis. It's aimed at developers who want a starting point for auth-heavy Node APIs without pulling in a full framework like NestJS or an auth-as-a-service provider.
The layered structure (controllers/services/models/validations/guards) is a clean, conventional separation that's easy to extend. Token blacklisting on sign-out via Redis is a detail a lot of boilerplates skip, and it's a real gap in plain JWT setups. i18next is wired in end-to-end (middleware + translation files), not just bolted on. The feature list for auth is genuinely complete — reset, verify, update email/password/avatar, delete — covering flows people usually have to build piecemeal.
No test suite anywhere in the tree (no __tests__, no jest/mocha config) despite Codacy badge implying some code quality tooling — there's nothing verifying the auth logic actually works. Dead since July 2023 with no CI config, so TypeScript/Express/Mongoose version drift is a given; anyone adopting this inherits upgrade work on day one. Docker/docker-compose are listed as topics but don't appear in the file tree, so that part of the pitch doesn't match what's actually shipped. Image upload writes to local public storage with no cloud storage option, which won't survive a real deployment on anything other than a single persistent box.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →