Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/rpn-group-project/backend-wise-spender


https://github.com/rpn-group-project/backend-wise-spender

Last synced: 1 day ago
JSON representation

Awesome Lists containing this project

README 

        
# Zexo Backend Service

[![Build Status](https://travis-ci.org/hagopj13/node-express-boilerplate.svg?branch=master)](https://travis-ci.org/hagopj13/node-express-boilerplate)

[![Coverage Status](https://coveralls.io/repos/github/hagopj13/node-express-boilerplate/badge.svg?branch=master)](https://coveralls.io/github/hagopj13/node-express-boilerplate?branch=master)

[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)



starter project for Zexo Backend RESTful APIs using Node.js, Express, and Prisma.



By running a single command, you will get a production-ready Node.js app installed and fully configured on your machine. The app comes with many built-in features, such as authentication using JWT, request validation, unit and integration tests, continuous integration, docker support, API documentation, pagination, etc. For more details, check the features list below.



## Manual Installation



If you would still prefer to do the installation manually, follow these steps:



Clone the repo:



```bash

git clone --depth 1 https://github.com/novatechid/nova-be-cms.git

cd nova-be-cms

npx rimraf ./.git

```



Install the dependencies:



```bash

yarn/npm install

```



Set the environment variables:



```bash

cp .env.example .env



# open .env and modify the environment variables (if needed)

```



## Table of Contents



- [Features](#features)

- [Commands](#commands)

- [Environment Variables](#environment-variables)

- [Project Structure](#project-structure)

- [API Documentation](#api-documentation)

- [Error Handling](#error-handling)

- [Validation](#validation)

- [Authentication](#authentication)

- [Authorization](#authorization)

- [Logging](#logging)

- [Linting](#linting)

- [Contributing](#contributing)



## Features



- **Database**: Relational Database using Prisma

- **Authentication and authorization**: using [passport](http://www.passportjs.org)

- **Validation**: request data validation using [Joi](https://github.com/hapijs/joi)

- **Logging**: using [winston](https://github.com/winstonjs/winston) and [morgan](https://github.com/expressjs/morgan)

- **Error handling**: centralized error handling mechanism

- **API documentation**: with [swagger-jsdoc](https://github.com/Surnet/swagger-jsdoc) and [swagger-ui-express](https://github.com/scottie1984/swagger-ui-express)

- **Process management**: advanced production process management using [PM2](https://pm2.keymetrics.io)

- **Dependency management**: with [Yarn](https://yarnpkg.com)

- **Environment variables**: using [dotenv](https://github.com/motdotla/dotenv) and [cross-env](https://github.com/kentcdodds/cross-env#readme)

- **Security**: set security HTTP headers using [helmet](https://helmetjs.github.io)

- **Santizing**: sanitize request data against xss and query injection

- **CORS**: Cross-Origin Resource-Sharing enabled using [cors](https://github.com/expressjs/cors)

- **Compression**: gzip compression with [compression](https://github.com/expressjs/compression)

- **CI**: continuous integration with [Travis CI](https://travis-ci.org)

- **Code coverage**: using [coveralls](https://coveralls.io)

- **Code quality**: with [Codacy](https://www.codacy.com)

- **Git hooks**: with [husky](https://github.com/typicode/husky) and [lint-staged](https://github.com/okonet/lint-staged)

- **Linting**: with [ESLint](https://eslint.org) and [Prettier](https://prettier.io)

- **Editor config**: consistent editor configuration using [EditorConfig](https://editorconfig.org)



## Commands



Running locally:



```bash

yarn dev

```



Running in production:



```bash

yarn start

```



Linting:



```bash

# run ESLint

yarn lint



# fix ESLint errors

yarn lint:fix



# run prettier

yarn prettier



# fix prettier errors

yarn prettier:fix

```



## Environment Variables



The environment variables can be found and modified in the `.env` file. They come with these default values:



```bash

# Port number

PORT=3000



# URL of Database

DB_URL="mysql://root:[email protected]:5858/railway?connect_timeout=300"



# JWT

# JWT secret key

JWT_SECRET=thisisasamplesecret

# Number of minutes after which an access token expires

JWT_ACCESS_EXPIRATION_MINUTES=30

# Number of days after which a refresh token expires

JWT_REFRESH_EXPIRATION_DAYS=30

# Number of minutes after which a reset password token expires

JWT_RESET_PASSWORD_EXPIRATION_MINUTES=10

# Number of minutes after which a verify email token expires

JWT_VERIFY_EMAIL_EXPIRATION_MINUTES=10



# SMTP configuration options for the email service

# For testing, you can use a fake SMTP service like Ethereal: https://ethereal.email/create

SMTP_HOST=smtp.gmail.com

SMTP_PORT=465

SMTP_USERNAME='[email protected]'

SMTP_PASSWORD='jzhnddxewrrbrbyw'

EMAIL_FROM='[email protected]'



# This was inserted by `prisma init`:

# Environment variables declared in this file are automatically made available to Prisma.

# See the documentation for more detail: https://pris.ly/d/prisma-schema#accessing-environment-variables-from-the-schema



# Prisma supports the native connection string format for PostgreSQL, MySQL, SQLite, SQL Server, MongoDB and CockroachDB.

# See the documentation for all the connection string options: https://pris.ly/d/connection-strings

```



## Project Structure



```

src\

 |--config\         # Environment variables and configuration related things

 |--controllers\    # Route controllers (controller layer)

 |--docs\           # Swagger files

 |--middlewares\    # Custom express middlewares

 |--routes\         # Routes

 |--services\       # Business logic (service layer)

 |--utils\          # Utility classes and functions

 |--validations\    # Request data validation schemas

 |--app.js          # Express app

 |--index.js        # App entry point

```



## API Documentation



To view the list of available APIs and their specifications, run the server and go to `http://localhost:3000/v1/docs` in your browser. This documentation page is automatically generated using the [swagger](https://swagger.io/) definitions written as comments in the route files.



### API Endpoints



List of available routes:



**Auth routes**:\

`POST /v1/auth/register` - register\

`POST /v1/auth/login` - login\

`POST /v1/auth/refresh-tokens` - refresh auth tokens\

`POST /v1/auth/forgot-password` - send reset password email\

`POST /v1/auth/reset-password` - reset password\

`POST /v1/auth/send-verification-email` - send verification email\

`POST /v1/auth/verify-email` - verify email



**User routes**:\

`POST /v1/users` - create a user\

`GET /v1/users` - get all users\

`GET /v1/users/:userId` - get user\

`PATCH /v1/users/:userId` - update user\

`DELETE /v1/users/:userId` - delete user



## Error Handling



The app has a centralized error handling mechanism.



Controllers should try to catch the errors and forward them to the error handling middleware (by calling `next(error)`). For convenience, you can also wrap the controller inside the catchAsync utility wrapper, which forwards the error.



```javascript

const catchAsync = require('../utils/catchAsync');



const controller = catchAsync(async (req, res) => {

  // this error will be forwarded to the error handling middleware

  throw new Error('Something wrong happened');

});

```



The error handling middleware sends an error response, which has the following format:



```json

{

  "code": 404,

  "message": "Not found"

}

```



When running in development mode, the error response also contains the error stack.



The app has a utility ApiError class to which you can attach a response code and a message, and then throw it from anywhere (catchAsync will catch it).



For example, if you are trying to get a user from the DB who is not found, and you want to send a 404 error, the code should look something like:



```javascript

const httpStatus = require('http-status');

const ApiError = require('../utils/ApiError');

const prisma = require('../../prisma/client')



const getUser = async (userId) => {

  const user = await prisma.user.findFirst({where: {id: userId}});

  if (!user) {

    throw new ApiError(httpStatus.NOT_FOUND, 'User not found');

  }

};

```



## Validation



Request data is validated using [Joi](https://joi.dev/). Check the [documentation](https://joi.dev/api/) for more details on how to write Joi validation schemas.



The validation schemas are defined in the `src/validations` directory and are used in the routes by providing them as parameters to the `validate` middleware.



```javascript

const express = require('express');

const validate = require('../../middlewares/validate');

const userValidation = require('../../validations/user.validation');

const userController = require('../../controllers/user.controller');



const router = express.Router();



router.post('/users', validate(userValidation.createUser), userController.createUser);

```



## Authentication



To require authentication for certain routes, you can use the `auth` middleware.



```javascript

const express = require('express');

const auth = require('../../middlewares/auth');

const userController = require('../../controllers/user.controller');



const router = express.Router();



router.post('/users', auth(), userController.createUser);

```



These routes require a valid JWT access token in the Authorization request header using the Bearer schema. If the request does not contain a valid access token, an Unauthorized (401) error is thrown.



**Generating Access Tokens**:



An access token can be generated by making a successful call to the register (`POST /v1/auth/register`) or login (`POST /v1/auth/login`) endpoints. The response of these endpoints also contains refresh tokens (explained below).



An access token is valid for 30 minutes. You can modify this expiration time by changing the `JWT_ACCESS_EXPIRATION_MINUTES` environment variable in the .env file.



**Refreshing Access Tokens**:



After the access token expires, a new access token can be generated, by making a call to the refresh token endpoint (`POST /v1/auth/refresh-tokens`) and sending along a valid refresh token in the request body. This call returns a new access token and a new refresh token.



A refresh token is valid for 30 days. You can modify this expiration time by changing the `JWT_REFRESH_EXPIRATION_DAYS` environment variable in the .env file.



## Authorization



The `auth` middleware can also be used to require certain rights/permissions to access a route.



```javascript

const express = require('express');

const auth = require('../../middlewares/auth');

const userController = require('../../controllers/user.controller');



const router = express.Router();



router.post('/users', auth('manageUsers'), userController.createUser);

```



In the example above, an authenticated user can access this route only if that user has the `manageUsers` permission.



The permissions are role-based. You can view the permissions/rights of each role in the `src/config/roles.js` file.



If the user making the request does not have the required permissions to access this route, a Forbidden (403) error is thrown.



## Logging



Import the logger from `src/config/logger.js`. It is using the [Winston](https://github.com/winstonjs/winston) logging library.



Logging should be done according to the following severity levels (ascending order from most important to least important):



```javascript

const logger = require('/config/logger');



logger.error('message'); // level 0

logger.warn('message'); // level 1

logger.info('message'); // level 2

logger.http('message'); // level 3

logger.verbose('message'); // level 4

logger.debug('message'); // level 5

```



In development mode, log messages of all severity levels will be printed to the console.



In production mode, only `info`, `warn`, and `error` logs will be printed to the console.\

It is up to the server (or process manager) to actually read them from the console and store them in log files.\

This app uses pm2 in production mode, which is already configured to store the logs in log files.



Note: API request information (request url, response code, timestamp, etc.) are also automatically logged (using [morgan](https://github.com/expressjs/morgan)).



## Linting



Linting is done using [ESLint](https://eslint.org/) and [Prettier](https://prettier.io).



In this app, ESLint is configured to follow the [Airbnb JavaScript style guide](https://github.com/airbnb/javascript/tree/master/packages/eslint-config-airbnb-base) with some modifications. It also extends [eslint-config-prettier](https://github.com/prettier/eslint-config-prettier) to turn off all rules that are unnecessary or might conflict with Prettier.



To modify the ESLint configuration, update the `.eslintrc.json` file. To modify the Prettier configuration, update the `.prettierrc.json` file.



To prevent a certain file or directory from being linted, add it to `.eslintignore` and `.prettierignore`.



To maintain a consistent coding style across different IDEs, the project contains `.editorconfig`



## License



[MIT](LICENSE)