nodejs-express-starter 1.7.0

package/docker-compose.prod.yml

@@ -0,0 +1,4 @@
+services:
+  node-app:
+    container_name: node-app-prod
+    command: npm start

package/docker-compose.test.yml

@@ -0,0 +1,4 @@
+services:
+  node-app:
+    container_name: node-app-test
+    command: npm test

package/docker-compose.yml

@@ -0,0 +1,30 @@
+services:
+  node-app:
+    build: .
+    image: node-app
+    environment:
+      - MONGODB_URL=mongodb://mongodb:27017/node-boilerplate
+    ports:
+      - '3000:3000'
+    depends_on:
+      - mongodb
+    volumes:
+      - .:/usr/src/node-app
+    networks:
+      - node-network
+
+  mongodb:
+    image: mongo:4.2.1-bionic
+    ports:
+      - '27017:27017'
+    volumes:
+      - dbdata:/data/db
+    networks:
+      - node-network
+
+volumes:
+  dbdata:
+
+networks:
+  node-network:
+    driver: bridge

package/jest.config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  testEnvironment: 'node',
+  testEnvironmentOptions: {
+    NODE_ENV: 'test',
+  },
+  restoreMocks: true,
+  coveragePathIgnorePatterns: ['node_modules', 'src/config', 'src/app.js', 'tests'],
+  coverageReporters: ['text', 'lcov', 'clover', 'html'],
+};

package/package.json

@@ -0,0 +1,117 @@
+{
+  "name": "nodejs-express-starter",
+  "version": "1.7.0",
+  "description": "Create a Node.js app for building production-ready RESTful APIs using Express, by running one command",
+  "bin": {
+    "nodejs-express-starter": "./bin/createNodejsApp.js"
+  },
+  "main": "src/index.js",
+  "repository": "https://github.com/Ahlyab/express-backend-starter-js.git",
+  "author": "Ahlyab <ahalyabasad@gmail.com>",
+  "license": "MIT",
+  "files": [
+    "bin",
+    "src",
+    "tests",
+    ".env.example",
+    ".gitignore",
+    ".eslintrc.json",
+    ".eslintignore",
+    ".prettierrc.json",
+    ".prettierignore",
+    ".editorconfig",
+    "docker-compose.yml",
+    "docker-compose.dev.yml",
+    "docker-compose.prod.yml",
+    "docker-compose.test.yml",
+    "Dockerfile",
+    ".dockerignore",
+    "jest.config.js",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "start": "node src/index.js",
+    "dev": "cross-env NODE_ENV=development nodemon src/index.js",
+    "test": "cross-env NODE_ENV=test jest -i --colors --verbose --detectOpenHandles",
+    "test:watch": "cross-env NODE_ENV=test jest -i --watchAll",
+    "coverage": "cross-env NODE_ENV=test jest -i --coverage",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "prettier": "npx prettier --check \"**/*.js\"",
+    "prettier:fix": "npx prettier --write \"**/*.js\"",
+    "docker:prod": "docker compose -f docker-compose.yml -f docker-compose.prod.yml up --build",
+    "docker:prod:down": "docker compose -f docker-compose.yml -f docker-compose.prod.yml down",
+    "docker:dev": "docker compose -f docker-compose.yml -f docker-compose.dev.yml up --build",
+    "docker:dev:down": "docker compose -f docker-compose.yml -f docker-compose.dev.yml down",
+    "docker:test": "docker compose -f docker-compose.yml -f docker-compose.test.yml up --build",
+    "docker:test:down": "docker compose -f docker-compose.yml -f docker-compose.test.yml down",
+    "prepare": "husky"
+  },
+  "keywords": [
+    "node",
+    "node.js",
+    "boilerplate",
+    "generator",
+    "express",
+    "rest",
+    "api",
+    "mongodb",
+    "mongoose",
+    "es6",
+    "es7",
+    "es8",
+    "es9",
+    "jest",
+    "travis",
+    "docker",
+    "passport",
+    "joi",
+    "eslint",
+    "prettier"
+  ],
+  "dependencies": {
+    "bcryptjs": "^2.4.3",
+    "compression": "^1.7.4",
+    "cors": "^2.8.5",
+    "cross-env": "^7.0.0",
+    "dotenv": "^16.4.5",
+    "express": "^4.21.0",
+    "express-mongo-sanitize": "^2.2.0",
+    "express-rate-limit": "^7.4.0",
+    "helmet": "^7.1.0",
+    "http-status": "^1.7.4",
+    "joi": "^17.13.3",
+    "jsonwebtoken": "^9.0.2",
+    "moment": "^2.30.1",
+    "mongoose": "^6.13.0",
+    "morgan": "^1.10.0",
+    "nodemailer": "^8.0.2",
+    "passport": "^0.7.0",
+    "passport-jwt": "^4.0.1",
+    "swagger-jsdoc": "^6.2.8",
+    "swagger-ui-express": "^5.0.0",
+    "validator": "^13.12.0",
+    "winston": "^3.14.2"
+  },
+  "devDependencies": {
+    "@faker-js/faker": "^9.2.0",
+    "eslint": "^8.57.0",
+    "eslint-config-airbnb-base": "^15.0.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-import": "^2.29.1",
+    "eslint-plugin-jest": "^27.9.0",
+    "eslint-plugin-prettier": "^5.2.0",
+    "eslint-plugin-security": "1.7.1",
+    "husky": "^9.0.11",
+    "jest": "^29.7.0",
+    "lint-staged": "^15.2.10",
+    "node-mocks-http": "^1.14.0",
+    "nodemon": "^3.1.4",
+    "prettier": "^3.3.3",
+    "supertest": "^7.0.0"
+  }
+}

package/src/app.js

@@ -0,0 +1,82 @@
+const express = require('express');
+const helmet = require('helmet');
+const mongoSanitize = require('express-mongo-sanitize');
+const compression = require('compression');
+const cors = require('cors');
+const passport = require('passport');
+const httpStatus = require('http-status');
+const config = require('./config/config');
+const morgan = require('./config/morgan');
+const { jwtStrategy } = require('./config/passport');
+const { authLimiter } = require('./middlewares/rateLimiter');
+const routes = require('./routes/v1');
+const healthRoute = require('./routes/v1/health.route');
+const { errorConverter, errorHandler } = require('./middlewares/error');
+const ApiError = require('./utils/ApiError');
+const requestId = require('./middlewares/requestId');
+
+const app = express();
+
+// request ID for tracing (must be early)
+app.use(requestId);
+
+// health check endpoints (before auth, for load balancers/orchestration)
+app.use('/health', healthRoute);
+
+if (config.env !== 'test') {
+  app.use(morgan.successHandler);
+  app.use(morgan.errorHandler);
+}
+
+// set security HTTP headers
+app.use(
+  helmet({
+    contentSecurityPolicy: config.env === 'production',
+    crossOriginEmbedderPolicy: false,
+  }),
+);
+
+// parse json request body
+app.use(express.json({ limit: '10kb' }));
+
+// parse urlencoded request body
+app.use(express.urlencoded({ extended: true }));
+
+// sanitize request data
+app.use(mongoSanitize());
+
+// gzip compression
+app.use(compression());
+
+// enable cors
+const corsOptions = {
+  origin: config.corsOrigin === '*' ? true : config.corsOrigin,
+  credentials: true,
+};
+app.use(cors(corsOptions));
+app.options('*', cors(corsOptions));
+
+// jwt authentication
+app.use(passport.initialize());
+passport.use('jwt', jwtStrategy);
+
+// limit repeated failed requests to auth endpoints
+if (config.env === 'production') {
+  app.use('/v1/auth', authLimiter);
+}
+
+// v1 api routes
+app.use('/v1', routes);
+
+// send back a 404 error for any unknown api request
+app.use((req, res, next) => {
+  next(new ApiError(httpStatus.NOT_FOUND, 'Not found'));
+});
+
+// convert error to ApiError, if needed
+app.use(errorConverter);
+
+// handle error
+app.use(errorHandler);
+
+module.exports = app;

package/src/config/config.js

@@ -0,0 +1,64 @@
+const dotenv = require('dotenv');
+const path = require('path');
+const Joi = require('joi');
+
+dotenv.config({ path: path.join(__dirname, '../../.env') });
+
+const envVarsSchema = Joi.object()
+  .keys({
+    NODE_ENV: Joi.string().valid('production', 'development', 'test').required(),
+    PORT: Joi.number().default(3000),
+    LOG_LEVEL: Joi.string().valid('error', 'warn', 'info', 'http', 'verbose', 'debug').default('info'),
+    CORS_ORIGIN: Joi.string().allow('').default('*').description('CORS allowed origins, comma-separated'),
+    MONGODB_URL: Joi.string().required().description('Mongo DB url'),
+    JWT_SECRET: Joi.string().required().description('JWT secret key'),
+    JWT_ACCESS_EXPIRATION_MINUTES: Joi.number().default(30).description('minutes after which access tokens expire'),
+    JWT_REFRESH_EXPIRATION_DAYS: Joi.number().default(30).description('days after which refresh tokens expire'),
+    JWT_RESET_PASSWORD_EXPIRATION_MINUTES: Joi.number()
+      .default(10)
+      .description('minutes after which reset password token expires'),
+    JWT_VERIFY_EMAIL_EXPIRATION_MINUTES: Joi.number()
+      .default(10)
+      .description('minutes after which verify email token expires'),
+    SMTP_HOST: Joi.string().description('server that will send the emails'),
+    SMTP_PORT: Joi.number().description('port to connect to the email server'),
+    SMTP_USERNAME: Joi.string().description('username for email server'),
+    SMTP_PASSWORD: Joi.string().description('password for email server'),
+    EMAIL_FROM: Joi.string().description('the from field in the emails sent by the app'),
+  })
+  .unknown();
+
+const { value: envVars, error } = envVarsSchema.prefs({ errors: { label: 'key' } }).validate(process.env);
+
+if (error) {
+  throw new Error(`Config validation error: ${error.message}`);
+}
+
+module.exports = {
+  env: envVars.NODE_ENV,
+  port: envVars.PORT,
+  logLevel: envVars.LOG_LEVEL,
+  corsOrigin: envVars.CORS_ORIGIN && envVars.CORS_ORIGIN !== '*' ? envVars.CORS_ORIGIN.split(',').map((o) => o.trim()) : '*',
+  mongoose: {
+    url: envVars.MONGODB_URL + (envVars.NODE_ENV === 'test' ? '-test' : ''),
+    options: {},
+  },
+  jwt: {
+    secret: envVars.JWT_SECRET,
+    accessExpirationMinutes: envVars.JWT_ACCESS_EXPIRATION_MINUTES,
+    refreshExpirationDays: envVars.JWT_REFRESH_EXPIRATION_DAYS,
+    resetPasswordExpirationMinutes: envVars.JWT_RESET_PASSWORD_EXPIRATION_MINUTES,
+    verifyEmailExpirationMinutes: envVars.JWT_VERIFY_EMAIL_EXPIRATION_MINUTES,
+  },
+  email: {
+    smtp: {
+      host: envVars.SMTP_HOST,
+      port: envVars.SMTP_PORT,
+      auth: {
+        user: envVars.SMTP_USERNAME,
+        pass: envVars.SMTP_PASSWORD,
+      },
+    },
+    from: envVars.EMAIL_FROM,
+  },
+};

package/src/config/logger.js

@@ -0,0 +1,26 @@
+const winston = require('winston');
+const config = require('./config');
+
+const enumerateErrorFormat = winston.format((info) => {
+  if (info instanceof Error) {
+    Object.assign(info, { message: info.stack });
+  }
+  return info;
+});
+
+const logger = winston.createLogger({
+  level: config.logLevel || (config.env === 'development' ? 'debug' : 'info'),
+  format: winston.format.combine(
+    enumerateErrorFormat(),
+    config.env === 'development' ? winston.format.colorize() : winston.format.uncolorize(),
+    winston.format.splat(),
+    winston.format.printf(({ level, message }) => `${level}: ${message}`),
+  ),
+  transports: [
+    new winston.transports.Console({
+      stderrLevels: ['error'],
+    }),
+  ],
+});
+
+module.exports = logger;

package/src/config/morgan.js

@@ -0,0 +1,25 @@
+const morgan = require('morgan');
+const config = require('./config');
+const logger = require('./logger');
+
+morgan.token('message', (req, res) => res.locals.errorMessage || '');
+morgan.token('request-id', (req) => req.id || '-');
+
+const getIpFormat = () => (config.env === 'production' ? ':remote-addr - ' : '');
+const successResponseFormat = `${getIpFormat()}[:request-id] :method :url :status - :response-time ms`;
+const errorResponseFormat = `${getIpFormat()}[:request-id] :method :url :status - :response-time ms - message: :message`;
+
+const successHandler = morgan(successResponseFormat, {
+  skip: (req, res) => res.statusCode >= 400,
+  stream: { write: (message) => logger.info(message.trim()) },
+});
+
+const errorHandler = morgan(errorResponseFormat, {
+  skip: (req, res) => res.statusCode < 400,
+  stream: { write: (message) => logger.error(message.trim()) },
+});
+
+module.exports = {
+  successHandler,
+  errorHandler,
+};

package/src/config/passport.js

@@ -0,0 +1,30 @@
+const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
+const config = require('./config');
+const { tokenTypes } = require('./tokens');
+const { User } = require('../models');
+
+const jwtOptions = {
+  secretOrKey: config.jwt.secret,
+  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+};
+
+const jwtVerify = async (payload, done) => {
+  try {
+    if (payload.type !== tokenTypes.ACCESS) {
+      throw new Error('Invalid token type');
+    }
+    const user = await User.findById(payload.sub);
+    if (!user) {
+      return done(null, false);
+    }
+    done(null, user);
+  } catch (error) {
+    done(error, false);
+  }
+};
+
+const jwtStrategy = new JwtStrategy(jwtOptions, jwtVerify);
+
+module.exports = {
+  jwtStrategy,
+};

package/src/config/roles.js

@@ -0,0 +1,12 @@
+const allRoles = {
+  user: [],
+  admin: ['getUsers', 'manageUsers'],
+};
+
+const roles = Object.keys(allRoles);
+const roleRights = new Map(Object.entries(allRoles));
+
+module.exports = {
+  roles,
+  roleRights,
+};

package/src/config/tokens.js

@@ -0,0 +1,10 @@
+const tokenTypes = {
+  ACCESS: 'access',
+  REFRESH: 'refresh',
+  RESET_PASSWORD: 'resetPassword',
+  VERIFY_EMAIL: 'verifyEmail',
+};
+
+module.exports = {
+  tokenTypes,
+};

package/src/controllers/auth.controller.js

@@ -0,0 +1,59 @@
+const httpStatus = require('http-status');
+const catchAsync = require('../utils/catchAsync');
+const { authService, userService, tokenService, emailService } = require('../services');
+
+const register = catchAsync(async (req, res) => {
+  const user = await userService.createUser(req.body);
+  const tokens = await tokenService.generateAuthTokens(user);
+  res.status(httpStatus.CREATED).send({ user, tokens });
+});
+
+const login = catchAsync(async (req, res) => {
+  const { email, password } = req.body;
+  const user = await authService.loginUserWithEmailAndPassword(email, password);
+  const tokens = await tokenService.generateAuthTokens(user);
+  res.send({ user, tokens });
+});
+
+const logout = catchAsync(async (req, res) => {
+  await authService.logout(req.body.refreshToken);
+  res.status(httpStatus.NO_CONTENT).send();
+});
+
+const refreshTokens = catchAsync(async (req, res) => {
+  const tokens = await authService.refreshAuth(req.body.refreshToken);
+  res.send({ ...tokens });
+});
+
+const forgotPassword = catchAsync(async (req, res) => {
+  const resetPasswordToken = await tokenService.generateResetPasswordToken(req.body.email);
+  await emailService.sendResetPasswordEmail(req.body.email, resetPasswordToken);
+  res.status(httpStatus.NO_CONTENT).send();
+});
+
+const resetPassword = catchAsync(async (req, res) => {
+  await authService.resetPassword(req.query.token, req.body.password);
+  res.status(httpStatus.NO_CONTENT).send();
+});
+
+const sendVerificationEmail = catchAsync(async (req, res) => {
+  const verifyEmailToken = await tokenService.generateVerifyEmailToken(req.user);
+  await emailService.sendVerificationEmail(req.user.email, verifyEmailToken);
+  res.status(httpStatus.NO_CONTENT).send();
+});
+
+const verifyEmail = catchAsync(async (req, res) => {
+  await authService.verifyEmail(req.query.token);
+  res.status(httpStatus.NO_CONTENT).send();
+});
+
+module.exports = {
+  register,
+  login,
+  logout,
+  refreshTokens,
+  forgotPassword,
+  resetPassword,
+  sendVerificationEmail,
+  verifyEmail,
+};

package/src/controllers/index.js

@@ -0,0 +1,2 @@
+module.exports.authController = require('./auth.controller');
+module.exports.userController = require('./user.controller');

package/src/controllers/user.controller.js

@@ -0,0 +1,43 @@
+const httpStatus = require('http-status');
+const pick = require('../utils/pick');
+const ApiError = require('../utils/ApiError');
+const catchAsync = require('../utils/catchAsync');
+const { userService } = require('../services');
+
+const createUser = catchAsync(async (req, res) => {
+  const user = await userService.createUser(req.body);
+  res.status(httpStatus.CREATED).send(user);
+});
+
+const getUsers = catchAsync(async (req, res) => {
+  const filter = pick(req.query, ['name', 'role']);
+  const options = pick(req.query, ['sortBy', 'limit', 'page']);
+  const result = await userService.queryUsers(filter, options);
+  res.send(result);
+});
+
+const getUser = catchAsync(async (req, res) => {
+  const user = await userService.getUserById(req.params.userId);
+  if (!user) {
+    throw new ApiError(httpStatus.NOT_FOUND, 'User not found');
+  }
+  res.send(user);
+});
+
+const updateUser = catchAsync(async (req, res) => {
+  const user = await userService.updateUserById(req.params.userId, req.body);
+  res.send(user);
+});
+
+const deleteUser = catchAsync(async (req, res) => {
+  await userService.deleteUserById(req.params.userId);
+  res.status(httpStatus.NO_CONTENT).send();
+});
+
+module.exports = {
+  createUser,
+  getUsers,
+  getUser,
+  updateUser,
+  deleteUser,
+};

package/src/docs/components.yml

@@ -0,0 +1,92 @@
+components:
+  schemas:
+    User:
+      type: object
+      properties:
+        id:
+          type: string
+        email:
+          type: string
+          format: email
+        name:
+          type: string
+        role:
+          type: string
+          enum: [user, admin]
+      example:
+        id: 5ebac534954b54139806c112
+        email: fake@example.com
+        name: fake name
+        role: user
+
+    Token:
+      type: object
+      properties:
+        token:
+          type: string
+        expires:
+          type: string
+          format: date-time
+      example:
+        token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI1ZWJhYzUzNDk1NGI1NDEzOTgwNmMxMTIiLCJpYXQiOjE1ODkyOTg0ODQsImV4cCI6MTU4OTMwMDI4NH0.m1U63blB0MLej_WfB7yC2FTMnCziif9X8yzwDEfJXAg
+        expires: 2020-05-12T16:18:04.793Z
+
+    AuthTokens:
+      type: object
+      properties:
+        access:
+          $ref: '#/components/schemas/Token'
+        refresh:
+          $ref: '#/components/schemas/Token'
+
+    Error:
+      type: object
+      properties:
+        code:
+          type: number
+        message:
+          type: string
+
+  responses:
+    DuplicateEmail:
+      description: Email already taken
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          example:
+            code: 400
+            message: Email already taken
+    Unauthorized:
+      description: Unauthorized
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          example:
+            code: 401
+            message: Please authenticate
+    Forbidden:
+      description: Forbidden
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          example:
+            code: 403
+            message: Forbidden
+    NotFound:
+      description: Not found
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/Error'
+          example:
+            code: 404
+            message: Not found
+
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT

package/src/docs/swaggerDef.js

@@ -0,0 +1,21 @@
+const { version } = require('../../package.json');
+const config = require('../config/config');
+
+const swaggerDef = {
+  openapi: '3.0.0',
+  info: {
+    title: 'Express Backend Starter JS',
+    version,
+    license: {
+      name: 'MIT',
+      url: 'https://github.com/Ahlyab/express-backend-starter-js/blob/master/LICENSE',
+    },
+  },
+  servers: [
+    {
+      url: `http://localhost:${config.port}/v1`,
+    },
+  ],
+};
+
+module.exports = swaggerDef;