makinhs / rest-api-tutorial

This is a sample source code for the article published on Toptal: https://www.toptal.com/nodejs/secure-rest-api-in-nodejs

REST API Tutorial

This sample is published as part of the corresponding article at the Toptal Engineering Blog. Visit https://www.toptal.com/developers/blog and subscribe to our newsletter to read great posts!

Before using

• Please make sure that you have:
• Node.js installed (https://nodejs.org/)
• MongoDB installed and running locally (https://www.mongodb.com/)
  • Using Windows, just open the terminal at where you installed mongo and run mongod.exe
• Run npm install or yarn in your root project folder

Usage

To run the project, please use a command line the following:

• npm start
  • It will run the server at port 3600.

2019-09-13 update

• Refactored mongoose to a proper common service.
• Added a Dockerfile and docker-compose configuration.

If you are familiar to docker and you have docker installed on your machine and just want to run the project without issues please do:

• docker-compose build
• docker-compose up
• It will run the mongodb at port 27017 (for testing purposes only).
• It will run the server at port 3600.

2020-02-01

I've created a 2020 version of this project using Typescript. If you might be interested on it, please check the following repository: https://github.com/makinhs/expressjs-api-tutorial

2020-09-09

• Updated and pruned dependencies.
• Fixed deprecation warnings.
• Leveraged findOneAndUpdate to simplify PATCH code.
• Changed default MongoDB server name to localhost to simplify first-time setup.
• Checked that it works with the latest version of Node.js, 14.9.0.

2020-11-14

• Accepted changes in the docker file that was causing MongoDB issues on Windows Subsystem Linux (WSL2) - Ubuntu.
• If you are new to this project, I highly recommend starting with Typescript first, like we talk about here: https://www.toptal.com/express-js/nodejs-typescript-rest-api-pt-1

rest-api-tutorial's Issues

body-parser is Deprecated

Deprecated in 2014!
Express has this built in. I can make a PR once my other one has been merged, but seems this repo is dead.

Windows docker-compose mongo service stops due to "Operation is not permitted" error

Docker: Docker for Windows
OS: Windows 10

As per the docker-compose.yml => mongo service uses the volume ./data mount to store data of mongo service.

For the very first time when you run/build your app, the mongo service + the api service runs fine.

For subsequent restart of the services, the mongo service exits as it faces a issue with windows file system and shows the error as "Operation is not permitted".

Description of the issue that I found: https://stackoverflow.com/a/39013930/8133717

Therefore one can change the ./data mount to docker's internal volume to mitigate the issue caused by data storage in windows file system.

Changes:

version: '3'
services:
  api:
    image: makinhs/rest-api-tutorial
    #...

  mongo:
    image: mongo
    volumes:
      #mounting to docker's own volume system
      - rest-api-tutorial-data:/data/db 
    networks:
      - backend
    ports:
      - "27017:27017"

# adding the volumes needed at the end
volumes: 
  rest-api-tutorial-data:

mongodb

would like to fix these depreciation errors
DeprecationWarning: current URL string parser is deprecated, and will be removed in a future version. To use the new parser, pass option { useNewUrlParser: true } to MongoClient.connect.
current Server Discovery and Monitoring engine is deprecated and will be removed in a future version. To use the new Server Discover and Monitoring engine, pass option { useUnifiedTopology: true } to the MongoClient constructor.

Wrong status code when fail authentication.

According to the HTTP-based authentication protocol, the code to send when authentication has failed is 401 and not 404, since the /auth resource does exist.

rest-api-tutorial/authorization/middlewares/verify.user.middleware.js

Lines 26 to 29 in fcba18a

	UserModel.findByEmail(req.body.email)
	.then((user)=>{
	if(!user[0]){
	res.status(404).send({});

Binary operator

if (user_permission_level & required_permission_level) {

Typo error in index.js

It seems that you did a massive "search and replace" from LET to CONST ... that made this in line 13 of index.js 😄

res.header('Access-Control-Allow-Methods', 'GET,HEAD,PUT,PATCH,POST,DEconstE');

instead of

res.header('Access-Control-Allow-Methods', 'GET,HEAD,PUT,PATCH,POST,DELETE');

Wrong ADMIN_PERMISSION in Middleware: auth.permission.middleware.js

Hello and thank you for a wonderful tutorial!

I noticed the wrong admin permission value is used within common\middlewares\auth.permission.middleware.js, line 4:

const ADMIN_PERMISSION = 4096;

Fix #21:

I will create a PR shortly where I have changed that line to reflect the settings already set int the common\config\env.config.js and use this instead:

const ADMIN_PERMISSION = require('../config/env.config')['permissionLevels']['ADMIN'];

if (user_permission_level & ADMIN_PERMISSION) {
   ...
}

That should be a super clean fix, and I hope it helps 😄

isset bug in update method

When I want to edit a value, the previous values delete that row entirely and stores only the new value.