This website helps people quickly find, compare, and book rental cars online.
Customers can browse available cars, choose rental dates, complete checkout, and track booking status, while admins manage requests, inventory, and booking approvals.

A full-stack car rental platform built with Node.js, Express, MongoDB, and EJS. It includes customer flows (browse/search/book), admin workflows (requests/bookings management), authentication (email/password + Google OAuth), localization, and checkout status tracking.

• Features
• Tech Stack
• Project Structure
• Architecture Overview
• Getting Started
• Environment Variables
• Run the App
• Main Routes
• API Endpoints
• Data Models
• Authentication Flows
• Internationalization
• Static Assets & Views
• Security Notes
• Known Gaps / Next Improvements
• Contributing
• License

• User registration and login with session-based auth
• Google OAuth login via Passport
• Forgot password flow with email verification code
• Car catalog with category/search filters
• Date-based availability search
• Car details page with rental session context
• Booking checkout flow with status lifecycle (pending, confirmed, cancelled, completed)
• Admin panel for requests and bookings
• Booking status lookup endpoint
• Cookie consent endpoints
• English/French localization via i18n

• Backend: Node.js, Express 5
• Database: MongoDB + Mongoose
• Views: EJS templates
• Auth: express-session, Passport (Google OAuth 2.0), bcrypt
• Email: Nodemailer (Gmail)
• Uploads: Multer
• Localization: i18n
• Utilities/Middleware: body-parser, morgan, cookie-parser, cors

Car_Rental/
|- app.js
|- package.json
|- config/
|  \- passport.js
|- controllers/
|  |- User.js
|  |- Car.js
|  \- admin.js
|- models/
|  |- user.js
|  |- car.js
|  |- booking.js
|  |- bookings.js
|  |- rentRequest.js
|  \- notification.js
|- routers/
|  |- users.js
|  |- cars.js
|  |- bookingroute.js
|  \- admins.js
|- views/
|  |- Admin/
|  \- partials/
|- public/
|  |- css/
|  |- JavaScript/
|  \- images/
|- locales/
|  |- en.json
|  \- fr.json
\- Utils/
   \- sendEmail.js

flowchart TD
  A[Browser / Client] --> B[Express App app.js]
  B --> C[Routers]
  C --> D[Controllers]
  D --> E[Mongoose Models]
  E --> F[(MongoDB)]
  B --> G[EJS Views]
  B --> H[Public Assets]
  B --> I[Passport Google OAuth]
  B --> J[Nodemailer]

• Node.js 18+
• npm 9+
• MongoDB database (local or Atlas)
• Google OAuth credentials (for Google login)
• Gmail app password (for reset emails)

npm install

Create a .env file in project root. Use this template:

API_URL=/api/v1
CONNECTION_STRING=mongodb+srv://<username>:<password>@<cluster>/<db_name>

EMAIL_USER=[email protected]
EMAIL_PASS=your_gmail_app_password

GOOGLE_CLIENT_ID=your_google_client_id
GOOGLE_CLIENT_SECRET=your_google_client_secret
GOOGLE_CALLBACK_URL=http://localhost:3000/auth/google/callback

npm run dev

Or production:

npm start

Default server URL: http://localhost:3000

With API_URL=/api/v1:

• /api/v1/cars -> cars router
• /api/v1/users -> users router
• /api/v1/admin -> admin router
• /api/booking -> booking router

• POST /signup - Register user
• POST /login - Login user
• POST /forgot-password - Send reset code
• POST /verify-code - Verify code
• POST /reset-password - Set new password
• GET /logout - Destroy session
• GET / - List all users
• GET /:userId/notifications - User notifications

• GET / - List/search cars
• GET /inside/:id - Single car page
• GET /featured - Featured cars JSON
• GET /search - Alias search route
• GET /available - Date/city availability search
• GET /store-dates - Store dates in session
• GET /AddCars - Add car form page
• POST / - Add car
• PUT /inside/:id - Edit car

• GET /requests - All rent requests
• GET /requests/details/:id - Request details
• POST /requests/accept/:id - Approve request
• POST /requests/decline/:id - Decline request
• GET /bookings - All bookings
• GET /bookings/details/:id - Booking details

• GET /api/booking/status/:bookingRef - Booking status lookup
• POST /api/booking/upload - Upload identity image
• POST /process-payment - Update booking to processing state
• POST /admin/booking/:id/status - Update booking status

• Profile: first/last name, email, phone, birthdate
• Auth: hashed password, role (client/admin)
• Password reset: resetCode, resetCodeExpires

• Core details: name, brand, city, images, pricing, category
• Flags: available, featured
• Specs: seats, horsepower, cylinders, maxSpeed, model

• Customer contact and address data
• Payment method and summary fields
• Booking reference auto-generation (NW-YYYY-XXXXXX)
• Status lifecycle: pending, confirmed, cancelled, completed

• Links userId and carId
• Rental window (rentStart, rentEnd)
• Booking status (booked)

• Rental request from user to admin
• Request dates and entity references

• Notification content per user
• Timestamped entries

1. User signs up (bcrypt hash stored)
2. User logs in (express-session stores user)
3. Role-based redirect (admin -> /admin, client -> /)

1. POST /api/v1/users/forgot-password
2. Code emailed via Nodemailer (Gmail)
3. POST /api/v1/users/verify-code
4. POST /api/v1/users/reset-password

1. GET /auth/google
2. Google callback to /auth/google/callback
3. Passport profile saved to session

• Configured locales: en, fr
• Locale sources in locales/en.json and locales/fr.json
• Query parameter supported: ?lang=en or ?lang=fr
• Cookie-based language persistence via /lang/:locale

• Views under views/ (EJS)
• Reusable parts in views/partials/
• Admin templates in views/Admin/
• Frontend assets in public/css, public/JavaScript, public/images

• Do not commit real .env secrets to source control.
• Rotate any exposed credentials immediately.
• For production, secure sessions (cookie.secure: true behind HTTPS).
• Avoid storing full card/payment details server-side.
• Add request validation/sanitization for all write endpoints.

• Add automated tests (unit + integration)
• Add centralized input validation (e.g., Joi/Zod)
• Enforce auth/role middleware on admin routes
• Add CSRF protection and rate limiting
• Normalize model naming (booking.js vs bookings.js)
• Add .env.example and remove hardcoded/committed secrets
• Add CI workflow for lint + tests

1. Fork the repository
2. Create a feature branch
3. Commit your changes
4. Open a pull request with a clear description