Overview
Barq Bank is a demo digital-banking platform covering the modules a real retail bank needs: accounts, transfers, cards, loans, deposits, bill payments, transaction history, and profile/security settings. The frontend is a Bootstrap-based SPA-style client with light/dark theming; the backend is a TypeScript/Express API backed by MongoDB Atlas, designed to run as Vercel serverless functions.
Tech Stack
Frontend
HTML5, vanilla JavaScript (ES6+)
Bootstrap 5.3 + Bootstrap Icons
Chart.js (dashboard spending chart)
Light/dark theme via CSS custom properties + data-bs-theme
Backend
Node.js + Express 4
TypeScript (ES modules)
MongoDB Atlas + Mongoose 8
JWT authentication (jsonwebtoken)
bcryptjs for password hashing
zod for request validation
helmet, cors, express-rate-limit for security
morgan for request logging
Infrastructure
Vercel (separate deployments for client/ and server/, serverless functions for the API)
MongoDB Atlas (managed cluster)
Features
Authentication & Security
Register / Login / Logout with JWT
Passwords hashed with bcrypt, never stored or returned in plain text
Route-level auth middleware (protect) + role-based authorization (authorize)
Change password, and toggle 2FA / biometric / login-alert preferences
Rate limiting on auth and money-movement endpoints
Helmet security headers, strict CORS tied to a single configured client origin
Centralized, consistent error responses ({ success, message, data })
Accounts
Auto-opens a savings account on registration
Open additional savings/current accounts
Real-time total balance across all accounts
Fund Transfer
Own-account transfers (atomic debit + credit via MongoDB sessions)
External transfers (IBFT / RTGS) to saved beneficiaries
Beneficiary management (save, list, delete)
Every transfer produces matching ledger entries in transaction history
Transactions
Full, filterable transaction history (by account, direction, date range)
Dashboard "recent transactions" widget
Running balance recorded per transaction
Cards
Debit & credit card management
Freeze / unfreeze
Per-card controls: online payments, international usage, ATM withdrawal, contactless
Daily spending limit updates
Report lost/stolen (auto-blocks the card)
Loans
Loan product catalog (personal, home, car, business) with rate/tenure/amount limits
EMI calculation on application
Apply for a loan (creates a pending-approval record)
Pay EMI, with automatic outstanding-balance reduction and status updates
Deposits & Savings
Fixed Deposits, Recurring Deposits, and Digital Savings Jars
Live maturity calculator
Jar goal contributions
Opening an FD/RD atomically debits the source account
Bill Payments
Pay bills across categories (electricity, gas/water, internet, mobile, TV, tuition)
Scheduled / recurring auto-payments (create, pause, resume)
Every paid bill produces a linked transaction record
Profile & Settings
View/update personal information
Security preference toggles
Change password
Architecture
The backend follows a strict layered structure so business logic never lives in route handlers:
routes → controllers → services → models → MongoDB
routes/ — HTTP endpoints, wiring middleware (auth, validation, rate limiting)
controllers/ — request/response handling only, delegates to services
services/ — business logic, including atomic multi-step operations
models/ — Mongoose schemas
middleware/ — auth guard, centralized error handler, rate limiters, Zod validator
validations/ — all Zod request schemas in one place
Money-movement integrity: transfers, deposit openings, and bill payments use MongoDB (Mongoose) sessions/transactions so a debit and its corresponding credit/ledger entry either both succeed or both roll back — balances can never end up inconsistent from a partial failure.
Serverless-ready: the Express app is built once via createApp() and reused by both the local dev entry point (server.ts, uses app.listen) and the Vercel serverless entry point (api/index.ts, no app.listen). The MongoDB connection is cached across warm invocations to avoid exhausting the connection pool.
Security
Passwords hashed with bcrypt (never returned in API responses)
JWT-based stateless auth with role support (user / admin)
Zod validation on every mutating request
Helmet HTTP security headers
CORS restricted to a single configured origin
Rate limiting: general API, stricter on auth and money-movement endpoints
Atomic MongoDB transactions on all balance-affecting operations
No secrets committed — .env is gitignored, .env.example ships instead
Future Features
Statement generation as downloadable PDF/CSV files (currently metadata-only)
Real-time notifications (bell icon feed is scaffolded but not yet populated by backend events)
Admin dashboard (user management, loan approvals, audit log) using the existing admin role
Email/SMS notifications for transfers, bill payments, and login alerts
Two-factor authentication enforcement (OTP) at login, not just a profile toggle
Live chat support backed by a real messaging service
Recurring deposit auto-debit scheduler (cron/queue-based)
Auto-payment execution scheduler for bills
Pagination and infinite scroll for transaction history
Unit/integration test suite (Jest + Supertest) and CI pipeline
React/Vite migration for the frontend (component-based UI, client-side routing)
Multi-currency account support.
Developed by Muhammad Hanif
