Project 3: Auto Booking API — Cab/Auto System

Now let's build the ride controller that uses our state machine to update ride statuses safely.

// controllers/ride.controller.js — Ride Management
import Ride from '../models/Ride.js';
import User from '../models/User.js';
import AppError from '../utils/AppError.js';
import asyncHandler from '../utils/asyncHandler.js';

// POST /api/rides — Request a new ride
export const requestRide = asyncHandler(async (req, res) => {
  const { pickup, dropoff } = req.body;

  const ride = await Ride.create({
    rider: req.user.id,
    pickup,
    dropoff,
    fare: {
      estimated: calculateFare(pickup, dropoff) // Simple distance-based
    },
    status: 'requested'
  });

  res.status(201).json({
    success: true,
    message: 'Ride requested! Auto aa raha hai bhai! 🛺',
    data: ride
  });
});

// PATCH /api/rides/:id/accept — Driver accepts ride
export const acceptRide = asyncHandler(async (req, res, next) => {
  const ride = await Ride.findById(req.params.id);
  if (!ride) throw new AppError('Ride not found!', 404);

  // Check state machine
  ride.changeStatus('accepted');  // Throws if invalid
  ride.driver = req.user.id;       // Assign driver

  await ride.save();

  res.json({
    success: true,
    message: 'Ride accepted! Driver aa raha hai! 🚗',
    data: ride
  });
});

// PATCH /api/rides/:id/start — Driver starts the ride
export const startRide = asyncHandler(async (req, res, next) => {
  const ride = await Ride.findById(req.params.id);
  if (!ride) throw new AppError('Ride not found!', 404);

  // Only the assigned driver can start
  if (ride.driver.toString() !== req.user.id) {
    throw new AppError('Yeh ride aapki nahi hai bhai! Sirf driver start kar sakta hai!', 403);
  }

  ride.changeStatus('ongoing');
  await ride.save();

  res.json({ success: true, message: 'Ride started! 🚗💨', data: ride });
});

// PATCH /api/rides/:id/complete — Complete the ride
export const completeRide = asyncHandler(async (req, res, next) => {
  const ride = await Ride.findById(req.params.id);
  if (!ride) throw new AppError('Ride not found!', 404);

  ride.changeStatus('completed');
  ride.fare.actual = ride.fare.estimated; // In real app, calculate from actual distance

  await ride.save();

  res.json({
    success: true,
    message: 'Ride completed! Thank you! Hyderabad khatam! 🏁',
    data: ride
  });
});

// PATCH /api/rides/:id/cancel — Cancel ride (rider or driver)
export const cancelRide = asyncHandler(async (req, res, next) => {
  const ride = await Ride.findById(req.params.id);
  if (!ride) throw new AppError('Ride not found!', 404);

  ride.changeStatus('cancelled');
  ride.cancelledBy = req.user.id;
  await ride.save();

  res.json({ success: true, message: 'Ride cancelled! 🛑', data: ride });
});

// Simple fare calculator
function calculateFare(pickup, dropoff) {
  if (!pickup || !dropoff) return 50; // Minimum fare
  // In real app: use Google Maps Distance Matrix API or geolocation math
  return Math.floor(50 + Math.random() * 150); // Rs. 50-200
}

Route wiring:

// routes/ride.routes.js
router.post('/', protect, requestRide);              // Rider requests
router.patch('/:id/accept', protect, authorize('driver'), acceptRide);
router.patch('/:id/start', protect, authorize('driver'), startRide);
router.patch('/:id/complete', protect, authorize('driver'), completeRide);
router.patch('/:id/cancel', protect, cancelRide);    // Anyone can cancel

Key security consideration: The state machine prevents invalid transitions at the MODEL level — not just the route level. Even if a hacker sends a direct request to MongoDB (bypassing your API), the model's changeStatus method enforces valid transitions.