$ show sahat/hackathon-starter
This is a production-ready Node.js/Express web application boilerplate designed to jumpstart hackathon projects. The codebase implements a complete user authentication system supporting local email/password, OAuth 2.0/OAuth 1.0a (10+ providers including Google, Facebook, GitHub, Discord, Microsoft), WebAuthn passkeys, and two-factor authentication (TOTP + email). It includes session management with MongoDB, CSRF protection, rate limiting, and custom security measures like timing-safe token comparisons and IP-bound token consumption. Beyond auth, it ships working demos for ~20 third-party API integrations (Stripe, Twilio, GitHub, NYT, Wikipedia, etc.) and AI features powered by LangChain and Groq, including a ReAct agent with SSE streaming, a RAG pipeline with vector search, and LLM-based classification/vision. The repository also provides a sophisticated Playwright-based e2e testing framework using nock-recorded HTTP fixtures, enabling deterministic offline tests without live API keys. All features are organized as deletable modules with a removal checklist to facilitate trimming for production use.
The LLM identified 6 files worth highlighting for reuse:
A drop-in replacement for the unmaintained express-flash package. Normalizes session flash messages into a consistent array of { msg } objects, supports multiple message levels (info, warning, error, success), and is fully unit-tested. Can be extracted and used in any Express application needing flash message support without external dependencies.
Custom Express request logging middleware built on top of morgan. It adds colored HTTP status codes, user-agent parsing with Bowser, IP redaction in production, and byte counting. The logs are formatted consistently and exportable for integration testing. The pattern of extending basic logging with contextual information is reusable in any Express project.
An in-memory cache that computes SHA-256 content hashes of static files (JS, CSS) and appends them as query parameters for cache busting. It generates the hashes on first load and serves them via a helper function used in view templates. The module is self-contained, requires no external dependencies, and can be reused in any Express application with custom static file management.
A configurable module for revoking OAuth 2.0 and OAuth 1.0a tokens from multiple providers (Google, Microsoft, GitHub, Facebook, etc.). It supports six authentication strategies (basic auth, client credentials, GitHub-style, Facebook-style, token-only, OAuth1 body) and includes timeout/abort control and graceful failure fallback. The interface is pluggable via passport strategy configuration. Can be adapted to any application needing centralized token revocation across providers.
A sophisticated test fixture recorder/replay system using nock and Playwright. It records HTTP responses from external APIs, hashes URLs for unique filenames, scrubs sensitive data (tokens, secrets) using @zapier/secret-scrubber, and replays them for deterministic e2e tests. Supports persistent interceptors and Playwright project configurations for live, record, and replay modes. This infrastructure is reusable for any e2e suite that depends on external HTTP services and wants offline, reproducible tests.
A dependency-free utility that validates all <a> and <img> tags in HTML or Markdown content by extracting URLs, testing them with retry and timeout logic, and intelligently handling anti-bot 403 responses. It is used to verify that no links are broken in the rendered templates. The pattern of extracting and validating embedded links is reusable in any project that needs to check URL integrity in generated content.