create-simo-api 0.0.0-stage → 1.1.0

package/template/middlewares/authMiddleware.js

@@ -0,0 +1,15 @@
+import env from '../config/env.js';
+import AppError from '../utils/AppError.js';
+import verifyToken from '../utils/verifyToken.js';
+
+const authenticate = (req, res, next) => {
+    const header = req.headers.authorization;
+    if (!header?.startsWith('Bearer ')) {
+        throw new AppError('No access token', 401);
+    }
+
+    req.user = verifyToken(header.split(' ')[1], env.ACCESS_TOKEN_SECRET, 'Invalid or expired access token');
+    next();
+};
+
+export default authenticate;

package/template/middlewares/errorMiddleware.js

@@ -0,0 +1,33 @@
+import AppError from '../utils/AppError.js';
+
+export const notFound = (req, res, next) => {
+    next(new AppError(`Route not found: ${req.method} ${req.originalUrl}`, 404));
+};
+
+export const errorHandler = (err, req, res, next) => {
+    let error = err;
+
+    if (err.type === 'entity.parse.failed') {
+        error = new AppError('Invalid JSON body', 400);
+    }
+
+    if (err.code === '23505') {
+        const field = err.detail?.match(/Key \((.+?)\)/)?.[1] ?? 'value';
+        error = new AppError(`${field} already exists`, 409);
+    }
+
+    if (err.code === '22P02') {
+        error = new AppError('Invalid input value', 400);
+    }
+
+    const statusCode = error instanceof AppError ? error.statusCode : 500;
+
+    if (statusCode === 500) {
+        console.error(err);
+    }
+
+    res.status(statusCode).json({
+        message: statusCode === 500 ? 'Internal server error' : error.message,
+        ...(error.details && { errors: error.details }),
+    });
+};

package/template/middlewares/rateLimitMiddleware.js

@@ -0,0 +1,14 @@
+import rateLimit from 'express-rate-limit';
+import env from '../config/env.js';
+import AppError from '../utils/AppError.js';
+
+export const apiLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    limit: 100,
+    standardHeaders: 'draft-8',
+    legacyHeaders: false,
+    skip: () => env.NODE_ENV === 'test',
+    handler: (req, res, next) => {
+        next(new AppError('Too many requests, please try again in 15 minutes', 429));
+    },
+});

package/template/middlewares/roleMiddleware.js

@@ -0,0 +1,22 @@
+import { PERMISSIONS } from '../config/permissions.js';
+import AppError from '../utils/AppError.js';
+
+export const authorize = (permission) => {
+    return (req, res, next) => {
+        if (!req.user?.role) {
+            return next(new AppError('Not authenticated', 401));
+        }
+
+        const allowedRoles = PERMISSIONS[permission];
+
+        if (!allowedRoles) {
+            return next(new AppError('Permission not defined', 403));
+        }
+
+        if (!allowedRoles.includes(req.user.role)) {
+            return next(new AppError('Access denied', 403));
+        }
+
+        next();
+    };
+};

package/template/middlewares/validateMiddleware.js

@@ -0,0 +1,18 @@
+import AppError from '../utils/AppError.js';
+
+export const validate = (schema, source = 'body') => {
+    return (req, res, next) => {
+        const result = schema.safeParse(req[source] ?? {});
+
+        if (!result.success) {
+            const errors = result.error.issues.map((issue) => ({
+                field: issue.path.join('.'),
+                message: issue.message,
+            }));
+            return next(new AppError('Validation failed', 400, errors));
+        }
+
+        req[source] = result.data;
+        next();
+    };
+};

package/template/migrations/1792673478177_create-users-table.sql

@@ -0,0 +1,16 @@
+-- Up Migration
+CREATE TYPE user_role AS ENUM ('user', 'admin');
+
+CREATE TABLE users (
+  id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  name VARCHAR(255) NOT NULL,
+  email VARCHAR(255) NOT NULL UNIQUE,
+  password VARCHAR(255) NOT NULL,
+  refresh_token CHAR(64),
+  role user_role NOT NULL DEFAULT 'user',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Down Migration
+DROP TABLE users;
+DROP TYPE user_role;

package/template/migrations/1792842956065_create-refresh-tokens-table.sql

@@ -0,0 +1,17 @@
+-- Up Migration
+CREATE TABLE refresh_tokens (
+  id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  user_id INT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  token_hash CHAR(64) NOT NULL UNIQUE,
+  expires_at TIMESTAMPTZ NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX refresh_tokens_user_id_idx ON refresh_tokens (user_id);
+
+ALTER TABLE users DROP COLUMN refresh_token;
+
+-- Down Migration
+ALTER TABLE users ADD COLUMN refresh_token CHAR(64);
+
+DROP TABLE refresh_tokens;

package/template/migrations/1792842957555_create-products-table.sql

@@ -0,0 +1,14 @@
+-- Up Migration
+CREATE TABLE products (
+  id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  name VARCHAR(255) NOT NULL,
+  description TEXT,
+  price NUMERIC(10, 2) NOT NULL CHECK (price >= 0),
+  stock INT NOT NULL DEFAULT 0 CHECK (stock >= 0),
+  image_url TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Down Migration
+DROP TABLE products;

package/template/models/productModel.js

@@ -0,0 +1,42 @@
+import db from '../config/db.js';
+
+const getAll = async () => {
+    const { rows } = await db.query('SELECT * FROM products ORDER BY id');
+    return rows;
+};
+
+const findById = async (id) => {
+    const { rows } = await db.query('SELECT * FROM products WHERE id = $1', [id]);
+    return rows[0];
+};
+
+const create = async ({ name, description = null, price, stock = 0, image_url = null }) => {
+    const { rows } = await db.query(
+        'INSERT INTO products (name, description, price, stock, image_url) VALUES ($1, $2, $3, $4, $5) RETURNING *',
+        [name, description, price, stock, image_url]
+    );
+    return rows[0];
+};
+
+const update = async (id, fields) => {
+    const columns = Object.keys(fields);
+    const setClause = columns.map((column, index) => `${column} = $${index + 1}`).join(', ');
+    const { rows } = await db.query(
+        `UPDATE products SET ${setClause}, updated_at = now() WHERE id = $${columns.length + 1} RETURNING *`,
+        [...Object.values(fields), id]
+    );
+    return rows[0];
+};
+
+const remove = async (id) => {
+    const { rowCount } = await db.query('DELETE FROM products WHERE id = $1', [id]);
+    return rowCount > 0;
+};
+
+export default {
+    getAll,
+    findById,
+    create,
+    update,
+    remove
+};

package/template/models/refreshTokenModel.js

@@ -0,0 +1,25 @@
+import db from '../config/db.js';
+
+const create = async (userId, tokenHash, expiresAt) => {
+    await db.query('INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES ($1, $2, $3)', [userId, tokenHash, expiresAt]);
+};
+
+const findByHash = async (tokenHash) => {
+    const { rows } = await db.query('SELECT * FROM refresh_tokens WHERE token_hash = $1 AND expires_at > now()', [tokenHash]);
+    return rows[0];
+};
+
+const deleteByHash = async (tokenHash) => {
+    await db.query('DELETE FROM refresh_tokens WHERE token_hash = $1', [tokenHash]);
+};
+
+const deleteAllForUser = async (userId) => {
+    await db.query('DELETE FROM refresh_tokens WHERE user_id = $1', [userId]);
+};
+
+export default {
+    create,
+    findByHash,
+    deleteByHash,
+    deleteAllForUser
+};

package/template/models/userModel.js

@@ -0,0 +1,39 @@
+import db from '../config/db.js';
+import bcrypt from 'bcrypt';
+
+const PUBLIC_COLUMNS = 'id, name, email, role, created_at';
+
+const getAllUsers = async () => {
+    const { rows } = await db.query(`SELECT ${PUBLIC_COLUMNS} FROM users`);
+    return rows;
+};
+
+const findOne = async (email) => {
+    const { rows } = await db.query('SELECT * FROM users WHERE email = $1', [email]);
+    return rows[0];
+}
+
+const findById = async (id) => {
+    const { rows } = await db.query('SELECT * FROM users WHERE id = $1', [id]);
+    return rows[0];
+};
+
+const findPublicById = async (id) => {
+    const { rows } = await db.query(`SELECT ${PUBLIC_COLUMNS} FROM users WHERE id = $1`, [id]);
+    return rows[0];
+};
+
+const createUser = async (userData) => {
+    const { name, email, password, role = 'user' } = userData;
+    const hashedPassword = await bcrypt.hash(password, 10);
+    const { rows } = await db.query('INSERT INTO users (name, email, password, role) VALUES ($1, $2, $3, $4) RETURNING id', [name, email, hashedPassword, role]);
+    return rows[0].id;
+};
+
+export default {
+    getAllUsers,
+    createUser,
+    findOne,
+    findById,
+    findPublicById
+};

package/template/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "simo-api",
+  "version": "1.0.0",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "migrate": "node-pg-migrate -j sql",
+    "migrate:up": "node-pg-migrate up -j sql",
+    "migrate:down": "node-pg-migrate down -j sql",
+    "start": "node index.js",
+    "dev": "nodemon index.js",
+    "test": "NODE_ENV=test node --test 'tests/**/*.test.js'",
+    "seed": "node seeds/seed.js"
+  },
+  "dependencies": {
+    "bcrypt": "^6.0.0",
+    "cookie-parser": "^1.4.7",
+    "cors": "^2.8.6",
+    "dotenv": "^18.0.8",
+    "express": "^5.3.0",
+    "express-rate-limit": "^8.7.1",
+    "jsonwebtoken": "^9.0.3",
+    "morgan": "^1.12.1",
+    "pg": "^8.23.1",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "node-pg-migrate": "^9.0.0",
+    "nodemon": "^3.1.14",
+    "supertest": "^7.3.1"
+  },
+  "private": true
+}

package/template/routes/authRoutes.js

@@ -0,0 +1,13 @@
+import express from 'express';
+const router = express.Router();
+
+import authController from '../controllers/authController.js';
+import { validate } from '../middlewares/validateMiddleware.js';
+import { loginSchema, registerSchema } from '../validations/authValidation.js';
+
+router.post('/login', validate(loginSchema), authController.login);
+router.post('/register', validate(registerSchema), authController.register);
+router.post('/refresh', authController.refresh, authController.clearRefreshCookieOnError);
+router.post('/logout', authController.logout);
+
+export default router;

package/template/routes/index.js

@@ -0,0 +1,15 @@
+import express from 'express';
+const router = express.Router();
+
+import authRoutes from './authRoutes.js';
+import userRoutes from './userRoutes.js';
+import productRoutes from './productRoutes.js';
+
+
+
+router.use('/auth', authRoutes);
+router.use('/user', userRoutes);
+router.use('/product', productRoutes);
+
+
+export default router;

package/template/routes/productRoutes.js

@@ -0,0 +1,17 @@
+import express from 'express';
+const router = express.Router();
+
+import productController from '../controllers/productController.js';
+import authenticate from '../middlewares/authMiddleware.js';
+import { authorize } from '../middlewares/roleMiddleware.js';
+import { validate } from '../middlewares/validateMiddleware.js';
+import { createProductSchema, updateProductSchema, productIdSchema } from '../validations/productValidation.js';
+
+
+router.get('/getAll', productController.getAllProducts);
+router.get('/:id', validate(productIdSchema, 'params'), productController.getProductById);
+router.post('/create', authenticate, authorize('PRODUCT_CREATE'), validate(createProductSchema), productController.createProduct);
+router.patch('/update/:id', authenticate, authorize('PRODUCT_UPDATE'), validate(productIdSchema, 'params'), validate(updateProductSchema), productController.updateProduct);
+router.delete('/delete/:id', authenticate, authorize('PRODUCT_DELETE'), validate(productIdSchema, 'params'), productController.deleteProduct);
+
+export default router;

package/template/routes/userRoutes.js

@@ -0,0 +1,15 @@
+import express from 'express';
+const router = express.Router();
+
+import userController from '../controllers/userController.js';
+import authenticate from '../middlewares/authMiddleware.js';
+import { authorize } from '../middlewares/roleMiddleware.js';
+import { validate } from '../middlewares/validateMiddleware.js';
+import { createUserSchema } from '../validations/userValidation.js';
+
+
+router.get('/me', authenticate, userController.getMe);
+router.get('/getAll', authenticate, authorize('USER_GETALL'), userController.getAllUsers);
+router.post('/create', authenticate, authorize('USER_CREATE'), validate(createUserSchema), userController.createUser);
+
+export default router;

package/template/seeds/seed.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import db from '../config/db.js';
+import userModel from '../models/userModel.js';
+import { ROLES } from '../config/permissions.js';
+import { name, email, password } from '../validations/authValidation.js';
+
+const adminSchema = z.object({
+    ADMIN_NAME: name,
+    ADMIN_EMAIL: email,
+    ADMIN_PASSWORD: password,
+});
+
+const seedAdmin = async () => {
+    const result = adminSchema.safeParse(process.env);
+
+    if (!result.success) {
+        console.error('Invalid admin variables in .env:');
+        for (const issue of result.error.issues) {
+            console.error(`  - ${issue.path.join('.')}: ${issue.message}`);
+        }
+        process.exitCode = 1;
+        return;
+    }
+
+    const { ADMIN_NAME, ADMIN_EMAIL, ADMIN_PASSWORD } = result.data;
+
+    const existing = await userModel.findOne(ADMIN_EMAIL);
+    if (existing) {
+        console.log(`Admin already exists: ${ADMIN_EMAIL}`);
+        return;
+    }
+
+    const id = await userModel.createUser({
+        name: ADMIN_NAME,
+        email: ADMIN_EMAIL,
+        password: ADMIN_PASSWORD,
+        role: ROLES.ADMIN,
+    });
+
+    console.log(`Admin created: ${ADMIN_EMAIL} (id ${id})`);
+};
+
+try {
+    await seedAdmin();
+} catch (error) {
+    console.error('Seed failed:', error);
+    process.exitCode = 1;
+} finally {
+    await db.end();
+}

package/template/services/authService.js

@@ -0,0 +1,94 @@
+import bcrypt from 'bcrypt';
+import jwt from 'jsonwebtoken';
+import crypto from 'crypto';
+import env from '../config/env.js';
+import { ROLES } from '../config/permissions.js';
+import userModel from '../models/userModel.js';
+import refreshTokenModel from '../models/refreshTokenModel.js';
+import AppError from '../utils/AppError.js';
+import verifyToken from '../utils/verifyToken.js';
+
+export const REFRESH_TOKEN_MAX_AGE = env.REFRESH_TOKEN_EXPIRES_DAYS * 24 * 60 * 60 * 1000;
+
+const hashToken = (token) => crypto.createHash('sha256').update(token).digest('hex');
+
+const generateAccessToken = (user) => {
+    const payload = { id: user.id, email: user.email, role: user.role };
+    return jwt.sign(payload, env.ACCESS_TOKEN_SECRET, { expiresIn: env.ACCESS_TOKEN_EXPIRES_IN });
+};
+
+const generateRefreshToken = (user) => {
+    const payload = { id: user.id, jti: crypto.randomUUID() };
+    return jwt.sign(payload, env.REFRESH_TOKEN_SECRET, { expiresIn: REFRESH_TOKEN_MAX_AGE / 1000 });
+};
+
+const createSession = async (user) => {
+    const accessToken = generateAccessToken(user);
+    const refreshToken = generateRefreshToken(user);
+    const expiresAt = new Date(Date.now() + REFRESH_TOKEN_MAX_AGE);
+
+    await refreshTokenModel.create(user.id, hashToken(refreshToken), expiresAt);
+
+    return { accessToken, refreshToken };
+};
+
+const login = async (email, password) => {
+    const user = await userModel.findOne(email);
+
+    if (!user || !(await bcrypt.compare(password, user.password))) {
+        throw new AppError('Invalid email or password', 401);
+    }
+
+    const tokens = await createSession(user);
+
+    return {
+        ...tokens,
+        user: { id: user.id, name: user.name, email: user.email, role: user.role },
+    };
+};
+
+const register = async ({ name, email, password }) => {
+    const existingUser = await userModel.findOne(email);
+
+    if (existingUser) {
+        throw new AppError('Email already exists', 409);
+    }
+
+    return userModel.createUser({ name, email, password, role: ROLES.USER });
+};
+
+const refresh = async (token) => {
+    if (!token) {
+        throw new AppError('No refresh token', 401);
+    }
+
+    const payload = verifyToken(token, env.REFRESH_TOKEN_SECRET, 'Invalid or expired refresh token');
+
+    const storedToken = await refreshTokenModel.findByHash(hashToken(token));
+    if (!storedToken || storedToken.user_id !== payload.id) {
+        await refreshTokenModel.deleteAllForUser(payload.id);
+        throw new AppError('Refresh token revoked', 401);
+    }
+
+    const user = await userModel.findById(payload.id);
+    if (!user) {
+        throw new AppError('User no longer exists', 401);
+    }
+
+    await refreshTokenModel.deleteByHash(hashToken(token));
+
+    return createSession(user);
+};
+
+const logout = async (token) => {
+    if (token) {
+        await refreshTokenModel.deleteByHash(hashToken(token));
+    }
+};
+
+export default {
+    login,
+    register,
+    refresh,
+    logout
+};

package/template/services/productService.js

@@ -0,0 +1,37 @@
+import productModel from '../models/productModel.js';
+import AppError from '../utils/AppError.js';
+
+const getAll = () => productModel.getAll();
+
+const getById = async (id) => {
+    const product = await productModel.findById(id);
+    if (!product) {
+        throw new AppError('Product not found', 404);
+    }
+    return product;
+};
+
+const create = (data) => productModel.create(data);
+
+const update = async (id, data) => {
+    const product = await productModel.update(id, data);
+    if (!product) {
+        throw new AppError('Product not found', 404);
+    }
+    return product;
+};
+
+const remove = async (id) => {
+    const deleted = await productModel.remove(id);
+    if (!deleted) {
+        throw new AppError('Product not found', 404);
+    }
+};
+
+export default {
+    getAll,
+    getById,
+    create,
+    update,
+    remove
+};

package/template/services/userService.js

@@ -0,0 +1,24 @@
+import { ROLES } from '../config/permissions.js';
+import userModel from '../models/userModel.js';
+import AppError from '../utils/AppError.js';
+
+const getAll = () => userModel.getAllUsers();
+
+const getById = async (id) => {
+    const user = await userModel.findPublicById(id);
+    if (!user) {
+        throw new AppError('User not found', 404);
+    }
+    return user;
+};
+
+const create = ({ name, email, password, role }, currentUser) => {
+    const finalRole = currentUser.role === ROLES.ADMIN ? role : ROLES.USER;
+    return userModel.createUser({ name, email, password, role: finalRole });
+};
+
+export default {
+    getAll,
+    getById,
+    create
+};