Ventara

Ventara is a full-stack Node/Express web application built with EJS templates, MongoDB (Mongoose), Passport authentication, Cloudinary image uploads and Mapbox maps. It provides CRUD operations for listings and nested reviews, user signup/login, and image hosting via Cloudinary.

This README explains how to run the project locally, required environment variables, common troubleshooting steps (including MongoDB Atlas connection issues), and the basic project layout.

Tech stack

• Node.js (Express)
• EJS + ejs-mate
• MongoDB (Mongoose)
• Passport (passport-local + passport-local-mongoose)
• Cloudinary (multer-storage-cloudinary)
• Mapbox (map rendering on listing show page)

Features

• Create, read, update, delete (CRUD) listings
• Add, list and delete reviews for listings
• User authentication (signup/login) with sessions and flash messages
• Image upload to Cloudinary
• Maps (Mapbox) on listing show page

Prerequisites

• Node.js (recommended v18+)
• npm
• MongoDB Atlas account (or local MongoDB)
• Cloudinary account (for image uploads)
• Mapbox access token (for map display)

Environment variables

Create a .env file in the project root (and add it to .gitignore) with the following variables:

• CLOUDE_NAME - your Cloudinary cloud name
• CLOUD_API_KEY - Cloudinary API key
• CLOUD_API_SECRET - Cloudinary API secret
• MAP_TOKEN - Mapbox public token
• ATLASDB_URL - MongoDB Atlas connection string (mongodb+srv://...)
• SECRET - session secret for express-session

Example .env (do NOT commit):

CLOUDE_NAME=your_cloud_name
CLOUD_API_KEY=your_cloud_api_key
CLOUD_API_SECRET=your_cloud_api_secret
MAP_TOKEN=pk.your_mapbox_token
ATLASDB_URL=mongodb+srv://<user>:<password>@cluster0.example.mongodb.net/yourDB?retryWrites=true&w=majority
SECRET=some-session-secret

Important: your repository currently contains a .env file with credentials. If these values were ever committed to a public repository, rotate them (passwords, Cloudinary keys, Mapbox token) immediately.

Installation

1. Clone the repo and cd into the project folder
2. Install dependencies

npm install

3. Create a .env (see above)

4. Start the app

node "c:\\Users\\Saifullah Siddiqui\\OneDrive\\Desktop\\WebClass\\MAJORPROJECT\\app.js"

Or simply:

node app.js

The app listens on port 8080 by default, so open http://localhost:8080.

Note about DB connection: app.js currently uses a hard-coded local URL (mongodb://127.0.0.1:27017/ventara). To use Atlas, either edit app.js to use process.env.ATLASDB_URL or set an environment variable MONGO_URL and update the connection code accordingly. See troubleshooting below for details.

Folder structure (high level)

MAJORPROJECT/
├─ app.js                # main Express app
├─ cloudConfig.js        # Cloudinary config + storage
├─ schema.js             # Joi validation schemas
├─ models/               # Mongoose models (listing, review, user)
├─ routes/               # Express routes (listings, reviews, users)
├─ controller/           # Route handler logic
├─ views/                # EJS templates
├─ public/               # Frontend assets (css, js, images)
└─ init/                 # seed / init data

Common issues & troubleshooting

1. MongoDB Atlas connection failure

   Symptoms: MongooseServerSelectionError, Could not connect to any servers, or OpenSSL TLS errors like ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR.

   Fixes:

   • Whitelist your current IP in MongoDB Atlas: Atlas > Network Access > Add IP Address (or use 0.0.0.0/0 for dev only).
   • Ensure the Atlas DB user and password match what's in ATLASDB_URL.
   • Try connecting from a different network (home/mobile) if you are behind a corporate proxy/firewall.
   • If TLS errors persist, check local OpenSSL/Node compatibility or try upgrading Node.

2. Secrets accidentally committed

   If .env was committed, rotate credentials now (Atlas user password, Cloudinary keys) and remove .env from git:

   git rm --cached .env
   git commit -m "Remove .env from repo"

3. XSS risk when embedding JSON into pages

   The project embeds listing objects into client-side JS in views/listings/show.ejs using <%- JSON.stringify(listing) %>. That writes raw JSON into a script tag and can be vulnerable if a field contains </script> or crafted content. Safer approaches:

   • Use serialize-javascript to safely serialize server objects into inline JS.
   • Put JSON in a <script type="application/json"> element and read textContent on the client.
   • Or fetch the listing via a JSON API from client-side code.

Development notes

• Authentication is implemented with passport-local and passport-local-mongoose.
• Image uploads are handled by multer + Cloudinary via multer-storage-cloudinary (configured in cloudConfig.js).
• Validation uses Joi (schema.js).

Next recommended improvements

• Make the DB connection string configurable via an environment variable used directly by the code (so you don't have to edit app.js).
• Replace inline JSON embedding with serialize-javascript or application/json script tags to avoid XSS risk.
• Add a .gitignore (if missing) and ensure .env is ignored.
• Add npm scripts for start/dev (e.g., start and dev using nodemon).

Contact / Contributing

If you want, I can:

• Update app.js to use process.env.ATLASDB_URL by default and fall back to local MongoDB.
• Add .gitignore and remove .env from git history.
• Replace the inline JSON embedding with a safe serialization approach.

Tell me which of the above you want me to implement and I'll make the change(s) and test them.

---

Generated on: November 4, 2025