Backend API

Backend API nima?

Backend API - bu frontend (foydalanuvchi interfeysi) va database (ma'lumotlar bazasi) o'rtasidagi ko'prik. U serverda ishlaydi va quyidagi vazifalarni bajaradi:

• Ma'lumotlarni qayta ishlash - frontenddan kelgan so'rovlarni qabul qilish va javob qaytarish
• Biznes logika - ilovaning asosiy qoidalari va hisob-kitoblarni bajarish
• Autentifikatsiya - foydalanuvchilarni aniqlash va ruxsatlarni tekshirish
• Ma'lumotlar bazasi bilan ishlash - CRUD operatsiyalarni bajarish

API (Application Programming Interface) - bu dasturlar o'rtasida muloqot qilish uchun qoidalar to'plami. Web API'lar odatda HTTP protokoli orqali ishlaydi.

Nega kerak?

Frontend to'g'ridan-to'g'ri database bilan ishlasa bo'lmaydimi? Yo'q, va buning bir nechta muhim sababi bor:

Asosiy tushunchalar

REST API

REST (Representational State Transfer) - eng keng tarqalgan API arxitekturasi. Asosiy tamoyillari:

• Stateless - har bir so'rov mustaqil, server session saqlamaydi
• Resource-based - URL'lar resurslarni ifodalaydi (/users, /products)
• HTTP methods - CRUD uchun standart metodlar

HTTP Methods

GraphQL

Facebook tomonidan yaratilgan alternativ yondashuv:

• Bitta endpoint - /graphql
• Client tanlaydi - qaysi ma'lumotlar kerakligini client belgilaydi
• Over-fetching yo'q - faqat kerakli fieldlarni olasiz
• Type system - strong typing bilan xavfsizroq

Authentication vs Authorization

• Authentication (AuthN) - "Kim siz?" - foydalanuvchini aniqlash
• Authorization (AuthZ) - "Nima qila olasiz?" - ruxsatlarni tekshirish

Status Codes

HTTP response kodlari natijani bildiradi:

• 2xx - Muvaffaqiyat (200 OK, 201 Created, 204 No Content)
• 4xx - Client xatosi (400 Bad Request, 401 Unauthorized, 404 Not Found)
• 5xx - Server xatosi (500 Internal Error, 503 Service Unavailable)

Amaliy jarayon (step-by-step)

Eng ko'p uchraydigan xatolar

Best practices

• Versioning ishlating: /api/v1/users, /api/v2/users
• Barcha inputlarni validatsiya qiling (server-side, client emas)
• HTTPS faqat - HTTP qabul qilmang
• JWT tokenlarni qisqa muddatli qiling (15-60 daqiqa)
• Rate limiting va throttling o'rnating
• CORS ni to'g'ri sozlang - wildcard (*) ishlatmang production'da
• Pagination ishlating - 1000 ta recordni bir so'rovda qaytarmang
• Consistent error format: {error: {code, message, details}}
• Health check endpoint: GET /health yoki GET /api/status
• Request ID bilan logging - debug osonlashadi

Asboblar va texnologiyalar

Mini misol

Express.js bilan oddiy REST API:

const express = require('express');
const app = express();

// Middleware
app.use(express.json());

// In-memory database (misol uchun)
let users = [
  { id: 1, name: 'Ali', email: 'ali@example.com' },
  { id: 2, name: 'Vali', email: 'vali@example.com' }
];

// GET - Barcha userlarni olish
app.get('/api/users', (req, res) => {
  res.json({ success: true, data: users });
});

// GET - Bitta userni olish
app.get('/api/users/:id', (req, res) => {
  const user = users.find(u => u.id === parseInt(req.params.id));
  if (!user) {
    return res.status(404).json({ 
      success: false, 
      error: 'User not found' 
    });
  }
  res.json({ success: true, data: user });
});

// POST - Yangi user yaratish
app.post('/api/users', (req, res) => {
  const { name, email } = req.body;
  
  // Validatsiya
  if (!name || !email) {
    return res.status(400).json({
      success: false,
      error: 'Name and email are required'
    });
  }
  
  const newUser = {
    id: users.length + 1,
    name,
    email
  };
  
  users.push(newUser);
  res.status(201).json({ success: true, data: newUser });
});

// DELETE - Userni o'chirish
app.delete('/api/users/:id', (req, res) => {
  const index = users.findIndex(u => u.id === parseInt(req.params.id));
  if (index === -1) {
    return res.status(404).json({ 
      success: false, 
      error: 'User not found' 
    });
  }
  users.splice(index, 1);
  res.status(204).send();
});

// Error handling middleware
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ 
    success: false, 
    error: 'Internal server error' 
  });
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

JWT authentication middleware:

const jwt = require('jsonwebtoken');

const authMiddleware = (req, res, next) => {
  // Header'dan token olish
  const authHeader = req.headers.authorization;
  
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({
      success: false,
      error: 'No token provided'
    });
  }
  
  const token = authHeader.split(' ')[1];
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded;
    next();
  } catch (err) {
    return res.status(401).json({
      success: false,
      error: 'Invalid token'
    });
  }
};

module.exports = authMiddleware;

Ko'p so'raladigan savollar (FAQ)

Glossary (Atamalar lug'ati)