Node.js — JavaScript as Backend

0 Week at a glance

• Server-side programming — code that runs on the server, hidden from visitors.
• Node.js — Chrome's V8 engine, unplugged from the browser and given server superpowers.
• Event loop, level 2 — Week 9's loop returns, now with the microtask queue.
• npm — the world's biggest code registry, and package.json, your project's manifest.
• Core modules — http, url, fs, path: everything you need for a real server.
• MVC — the architecture that keeps server code from becoming spaghetti.

1 Why backends?

• Server-side pages are programs — PHP, Java/JSP, Ruby on Rails, ASP.NET, Python, and now JavaScript.
• They make pages dynamic: different content per user, per time, per context.
• They talk to other services: databases, e-mail, payment systems.
• They authenticate users and process form data safely.
• They give security: server code can never be viewed from a browser.

Prove it — what can the visitor actually see?

// Secrets can live here — the browser NEVER receives this file
const API_KEY = "sk-live-9f2…TOP-SECRET";
const db = connect("mongodb://anime-db:27017");

server.get("/anime", (req, res) => {
  const anime = db.query("SELECT * FROM anime");
  res.send(renderPage(anime));   // only the RESULT is sent
});

<h1>My Anime Collection</h1>
<ul>
  <li>Death Note — Madhouse</li>
  <li>Fullmetal Alchemist: Brotherhood — Bones</li>
</ul>
<!-- no API key, no database, no server code 🎉 -->

Performance & compatibility wins

• Compute once, cache — don't repeat heavy work for every visitor.
• Stronger machines — heavy computation runs on server hardware, not a student laptop.
• Near the data — data-intensive work runs next to the database.
• Compatibility — dynamic behaviour even for clients with little or no JS support.

Web hosting — where servers live

Hosting = storing files on a server and making them accessible over the internet, securely and stably.

2 What is Node.js

The three key features

Traditional server vs. Node

Why developers love it

• Lightweight and fast — V8 compiles JS to machine code.
• One language everywhere — JS is the only language that runs both frontend and backend: shared code, shared types, shared libraries.
• Easy learning curve — you already know the language!
• Ecosystem — npm hosts over two million packages.
• Community-powered — cross-platform and multi-purpose.

3 One engine, two worlds

• Ask Chrome's V8 to run console.log('V8') — works. Ask it for document.querySelector('div') — the DOM API answers.
• Ask Node's V8 to run http.createServer() — the Node API answers.
• Ask Node for document.querySelector('div') — ???????? There is no DOM on a server!

// This runs in the NODE EMULATOR — there is no web page here.
console.log("Node says hi — no browser needed!");

const os = require('os');
console.log("Platform:", os.platform(), "· CPU cores:", os.cpus().length);

// Now try the impossible:
document.querySelector("div");   // 💥 servers have no document!

The sorting game: will it run?

4 The event loop, level 2

• Call stack — runs your functions, one at a time (Week 9 recap).
• Internal implementation — the C++ code (browser or Node) behind setTimeout & friends. The host itself is multi-threaded — your JS is not.
• Task queue — callbacks from setTimeout, addEventListener… wait here.
• Micro-task queue — Promise callbacks are special: they get their own, higher-priority queue.
• Event loop — when the stack empties, it drains all micro-tasks first, then takes one task.

Watch the VIP lane in action

console.log("Start");setTimeout(() => console.log("Timeout!"), 0);Promise.resolve().then(() => console.log("Promise!"));console.log("End");

Don't believe the simulation? Run the real thing

console.log("Start");

setTimeout(() => console.log("Timeout!"), 0);           // task queue

Promise.resolve().then(() => console.log("Promise!"));  // MICRO-task queue

console.log("End");

5 Getting Node on your machine

node -v     // v22.x  → the runtime
npm -v      // 10.x   → the package manager (ships WITH Node)

6 Modules & require()

The core modules toolbox

const os = require('os');
const path = require('path');

console.log("You are on:", os.platform());
console.log("CPU cores:", os.cpus().length);
console.log("joined path:", path.join("students", "week10", "app.js"));

// The emulator ships core modules only. Try uncommenting:
// require('express');   // → Error: Cannot find module 'express'

User-defined modules — your own files

function greet(name) {
  return "Hello, " + name + "!";
}

module.exports = greet;   // make it borrowable

const greet = require("./greet");

console.log(greet("Prof. Abul Qasim"));
// → Hello, Prof. Abul Qasim!

7 npm & package.json

• npm (Node Package Manager) comes with the Node.js installation.
• npm install <package> downloads a package into node_modules/ and records it in package.json.
• Installed packages are used via require() — same as core modules.
• npm install -g nodemon installs globally — a command available everywhere (nodemon auto-restarts your server on every save).

The practice terminal — set up a real project

What is package.json?

• Running npm install with no arguments installs everything listed in package.json.
• That's why node_modules/ is never committed to git — anyone can rebuild it from package.json.

dependencies vs. devDependencies

8 Semantic versioning & the lockfile

The ^ and ~ playground

package.json says "express": "^4.21.2". Which versions is npm allowed to install? Pick a prefix:

package-lock.json — the exact receipt

• Generated on npm install — catalogs exactly what landed in node_modules/.
• On the next install, package-lock.json trumps package.json: the locked versions win.
• Result: your teammate installs the identical versions you have. No "works on my machine".

9 Your first server

Hello, World — a real server, right here

const http = require('http');

const server = http.createServer(function (req, res) {
  res.writeHead(200, { "Content-Type": "text/plain" });
  res.write("Hello World from my first server!");
  res.end();
});

server.listen(3000, () => {
  console.log("Server running at http://localhost:3000");
});

Spot the bug — the original slide version

var http = require('http');

var server = http.createServer(function (req, res) {
  res.writeHead(200);
  resp.write('Hello World');   // 🐛 hmm…
  res.end();
});

server.listen(3000);

What's inside req?

const http = require('http');

const server = http.createServer((req, res) => {
  console.log("method:", req.method);        // 'GET', 'POST', …
  console.log("url:", req.url);              // '/users', '/about?x=1', …
  console.log("host header:", req.headers.host);
  console.log("http version:", req.httpVersion);
  res.end("Request received — now check the console output!");
});

server.listen(3000);

Building the response

Status codes & MIME types

10 The URL module

Anatomy of a URL — click each piece

Properties & searchParams — live

const { URL } = require('url');

const myUrl = new URL("https://www.example.com:8080/products/shoes?color=red&size=10#reviews");

console.log("protocol:", myUrl.protocol);
console.log("hostname:", myUrl.hostname);
console.log("port:", myUrl.port);
console.log("pathname:", myUrl.pathname);
console.log("search:", myUrl.search);
console.log("hash:", myUrl.hash);

// searchParams: get / set / append / delete
const p = myUrl.searchParams;
console.log("color =", p.get("color"));
p.set("size", "11");
p.append("coupon", "WEEK10");
console.log("updated URL:", myUrl.href);

A server that reads the query string

const http = require('http');
const { URL } = require('url');

const server = http.createServer(function (req, res) {
  res.writeHead(200, { "Content-Type": "text/html" });

  const q = new URL(req.url, "http://" + req.headers.host);

  res.write("host = " + req.headers.host);
  res.write("<br>pathname = " + q.pathname);
  res.write("<br>search = " + q.search);

  const qdata = q.searchParams;
  res.write("<br><b>Month = " + qdata.get("month") + "</b>");
  res.write("<br><b>Year = " + qdata.get("year") + "</b>");
  res.end();
});

server.listen(8080, () => console.log("Server running at http://localhost:8080"));

11 The fs & path modules

• Node supports reading, writing, creating and deleting files.
• require('fs').promises imports the modern, non-blocking, Promise-based API — made for await.

const fs = require('fs').promises;   // the Promise-based API

// Week 9 skills, server edition:
const data = await fs.readFile('example.txt', 'utf8');
console.log("example.txt says:", data);

await fs.writeFile('notes.txt', 'Node.js writes files!');
await fs.appendFile('notes.txt', ' And appends too.');
console.log("notes.txt says:", await fs.readFile('notes.txt', 'utf8'));

console.log("the disk now holds:", await fs.readdir('.'));

path — never glue paths by hand

• Windows uses \, Mac/Linux use / — path handles both, cross-platform.

const path = require('path');

const p = "/students/week10/report.pdf";
console.log("basename:", path.basename(p));   // file name
console.log("dirname :", path.dirname(p));    // its directory
console.log("extname :", path.extname(p));    // file extension

// join: cleans up slashes AND resolves '..' automatically
console.log("join    :", path.join("students", "week10", "..", "week11", "lab.js"));

// resolve: always returns an ABSOLUTE path
console.log("resolve :", path.resolve("images", "logo.png"));

12 Model – View – Controller

Follow one request through MVC

Why bother?

• Separation of concerns — data, logic and looks live apart.
• Data can change independently of its presentation.
• The same data, different views — one model can feed a web page, an app and an API.
• Easier maintenance and testing — each part tests in isolation.
• Team-friendly — coding tasks split cleanly between people.
• Reusability — one model, many views.

13 Key takeaways

1. Server-side code is invisible to visitors — that's where secrets, databases and authentication live.
2. Node.js = V8 + Node APIs — Chrome's engine, with http/fs/path instead of the DOM. No document on a server!
3. Node is event-driven, non-blocking, single-threaded — one thread serves thousands of connections.
4. The micro-task queue (Promises) beats the task queue (setTimeout) — every time the stack empties.
5. require() loads core modules ("fs"), your files ("./greet"), or npm packages ("express").
6. npm init -y creates package.json · npm install reads it · package-lock.json pins exact versions and wins.
7. Semver: ^ allows minor + patch, ~ allows patch only, no prefix = exactly that version.
8. http.createServer((req, res)) + server.listen(port) — and always res.end(), or the browser waits forever.
9. new URL() + searchParams dissect URLs and query strings safely.
10. MVC: Model = data + logic · View = presentation · Controller = the brains between them.

14 Self-check quiz

No grades, instant feedback. Can you get all eight?

15 Reading & practice

• Official Node.js guides
• Full Node.js API reference — every core module documented.
• The Node.js event loop, timers and nextTick
• Don't block the event loop
• jsv9000.app — step-by-step event loop visualizer.