feat: Enhance user service with comprehensive error handling and Google OAuth profile validation

- Implemented findOrCreateGoogleUser function with improved validation and error handling.
- Added findUserById, updateUserProfile, and deactivateUser functions to manage user accounts.
- Introduced custom error classes for better error management.
- Updated user model to include lastLoginAt and profile image handling.
- Enhanced API tests for authentication requirements.
- Documented error handling and validation improvements in a new markdown file.
- Created configuration management for environment variables with validation.
- Added session cleanup middleware to prevent infinite redirect loops and validate user sessions.
- Developed validation middleware for MongoDB ObjectId and note data.
- Implemented health check routes for application status monitoring.
- Established custom error handling utilities for consistent error responses.
- Created Joi validation schemas for user and note data.
- Developed session utilities for managing expired sessions and user session statistics.

Author: soumya813

ERROR_HANDLING_IMPROVEMENTS.md

@@ -0,0 +1,222 @@
+# Error Handling and Validation Improvements
+
+This document outlines the comprehensive error handling and validation improvements made to the Notes App.
+
+## Overview of Improvements
+
+### 1. Custom Error Classes (`server/utils/errors.js`)
+- **AppError**: Base error class with status codes and operational flags
+- **ValidationError**: For input validation failures
+- **NotFoundError**: For resource not found scenarios
+- **AuthenticationError**: For authentication failures
+- **AuthorizationError**: For access denied scenarios
+- **DatabaseError**: For database operation failures
+- **ExternalAPIError**: For external service failures
+
+### 2. Validation Utilities (`server/utils/validation.js`)
+- String validation with length constraints
+- MongoDB ObjectId validation
+- Search term sanitization
+- Email format validation
+- Note data validation
+- Pagination parameter validation
+- Google profile validation
+
+### 3. Improved Middleware
+
+#### Error Handler (`server/middleware/errorHandler.js`)
+- Centralized error handling
+- Proper logging with Winston
+- Different responses for API vs web requests
+- Development vs production error details
+- Graceful error page rendering
+
+#### Authentication (`server/middleware/checkAuth.js`)
+- Enhanced authentication checks
+- Support for optional authentication
+- Better error messages
+- Proper redirects with return URLs
+
+#### Validation (`server/middleware/validation.js`)
+- ObjectId parameter validation
+- Note data validation
+- Search term validation and sanitization
+- Summarization request validation
+- Rate limiting for sensitive operations
+
+### 4. Enhanced Models
+
+#### User Model (`server/models/User.js`)
+- Comprehensive field validation
+- Email format validation
+- Profile image URL validation
+- Automatic timestamp updates
+- Virtual fields for computed properties
+- Index optimization
+
+#### Notes Model (`server/models/Notes.js`)
+- Field length validation
+- Required field validation
+- Automatic timestamp updates
+- Text search indexing
+- Virtual fields for excerpts and word counts
+- Archive functionality
+
+### 5. Improved Services
+
+#### User Service (`server/services/userService.js`)
+- Comprehensive error handling
+- Better Google OAuth profile processing
+- User profile update functionality
+- Account deactivation
+- Proper validation integration
+
+#### Note Service (`server/services/noteService.js`)
+- Full CRUD operations with validation
+- Advanced search functionality
+- Statistics generation
+- Pagination support
+- Archive support
+
+### 6. Enhanced Controllers
+
+#### Dashboard Controller (`server/controllers/dashboardController.js`)
+- AsyncHandler wrapper for automatic error catching
+- Comprehensive input validation
+- Better external API error handling
+- Session message management
+- Proper HTTP status codes
+
+#### Main Controller (`server/controllers/mainController.js`)
+- Error handling consistency
+- Message display system
+- Proper redirects
+
+### 7. Route Improvements
+
+All routes now include:
+- Input validation middleware
+- Proper error handling
+- Rate limiting where appropriate
+- Authentication checks
+
+### 8. Configuration Management (`server/config/config.js`)
+
+- Environment variable validation
+- Default value management
+- Security settings configuration
+- Application settings centralization
+
+### 9. Database Connection (`server/config/db.js`)
+
+- Connection retry logic
+- Graceful shutdown handling
+- Health check functionality
+- Better error reporting
+
+## Key Features
+
+### Error Handling Strategy
+
+1. **Input Validation**: All user inputs are validated at multiple levels
+2. **Database Errors**: Mongoose errors are properly caught and transformed
+3. **External API Errors**: Proper handling of third-party service failures
+4. **Authentication Errors**: Clear error messages for auth issues
+5. **Resource Not Found**: Proper 404 handling with user-friendly pages
+
+### Security Improvements
+
+1. **Rate Limiting**: Protection against abuse
+2. **Input Sanitization**: Prevention of injection attacks
+3. **Session Security**: Secure session configuration
+4. **Error Information**: Limited error details in production
+
+### User Experience
+
+1. **Friendly Error Messages**: Clear, actionable error messages
+2. **Form Persistence**: Form data is preserved on validation errors
+3. **Success Feedback**: Confirmation messages for successful operations
+4. **Loading States**: Better handling of async operations
+
+### Developer Experience
+
+1. **Consistent Error Handling**: Standardized error patterns
+2. **Comprehensive Logging**: Detailed error logs for debugging
+3. **Type Safety**: Better validation reduces runtime errors
+4. **Testing Support**: Error classes support unit testing
+
+## Usage Examples
+
+### Using Custom Errors
+
+```javascript
+const { ValidationError, NotFoundError } = require('../utils/errors');
+
+// Validation error with multiple messages
+throw new ValidationError('Validation failed', ['Title is required', 'Content too long']);
+
+// Simple not found error
+throw new NotFoundError('Note');
+```
+
+### Using AsyncHandler
+
+```javascript
+const { asyncHandler } = require('../utils/errors');
+
+exports.createNote = asyncHandler(async (req, res) => {
+  // Any errors thrown here will be automatically caught
+  const note = await noteService.createNote(req.body, req.user.id);
+  res.json(note);
+});
+```
+
+### Using Validation Middleware
+
+```javascript
+const { validateNote, validateObjectId } = require('../middleware/validation');
+
+router.post('/notes', validateNote, createNote);
+router.get('/notes/:id', validateObjectId(), getNote);
+```
+
+## Configuration
+
+### Required Environment Variables
+
+- `MONGODB_URI`: Database connection string
+- `GOOGLE_CLIENT_ID`: Google OAuth client ID
+- `GOOGLE_CLIENT_SECRET`: Google OAuth client secret
+- `GOOGLE_CALLBACK_URL`: Google OAuth callback URL
+
+### Optional Environment Variables
+
+- `SESSION_SECRET`: Session encryption key
+- `HUGGING_FACE_API`: API key for summarization
+- `REDIS_URL`: Redis connection for sessions
+
+## Testing
+
+The error handling system includes:
+- Unit tests for validation functions
+- Integration tests for error middleware
+- API endpoint error testing
+- Database error simulation
+
+## Monitoring
+
+- Winston logging with structured logs
+- Error categorization and severity levels
+- Performance metrics for error rates
+- External API failure tracking
+
+## Future Improvements
+
+1. **Metrics Dashboard**: Real-time error monitoring
+2. **Alert System**: Notification for critical errors
+3. **Error Recovery**: Automatic retry mechanisms
+4. **Performance Optimization**: Caching for frequently accessed data
+5. **Advanced Rate Limiting**: IP-based and user-based limits
+6. **Audit Logging**: User action tracking
+7. **Content Security Policy**: Enhanced security headers
+8. **API Versioning**: Better API evolution support