DEV Community

Ndifreke Friday
Ndifreke Friday

Posted on • Edited on • Originally published at voidnerd.com

Build a Nodejs Restful API with Express and MongoDB

#nodej #express #webdev #beginners

This Article was first published on voidnerd.com/

In this tutorial, we are going to build an authenticated nodejs api with express, hash passwords with bcryptjs and secure your API with JWT.

Prerequisite

Make sure you have the following installed on your system

  • Nodejs >= v12
  • Mongo >= v4
  • Postman (To test your endpoints)

Now that we have the prerequisites out of the way, let's create a directory for our app, run below this bash command for this.

$ mkdir node-api && cd node-api
Enter fullscreen mode Exit fullscreen mode

NPM utility will walk you through creating a package.json file. Follow the prompt and press enter all through to use the defaults.

$ npm init
Enter fullscreen mode Exit fullscreen mode

Create Files and Folders in your node-api directory like so:

--model -----user.js -----index.js --controllers -----auth.js -----user.js -----index.js --public --.env --middleware.js --.gitignore --routes.js --server.js
Enter fullscreen mode Exit fullscreen mode

Notice the .evn file; this is where we will store our sensitive values as enviromental variables.

.gitignore is where we specify files or folders we don't want git to track; this is so we don't push sensitive or unwaranted data to github (or your prefered source code repository).

public folder for serving your static files.

Install project dependencies

In your project directory run below command to install dependencies.

$ npm install express mongoose morgan parse-error dotenv bcryptjs jsonwebtoken indicative
Enter fullscreen mode Exit fullscreen mode

For further reading on these dependencies

Moving on...

Register.

Just like every other thing on earth, we are going to start with creation (pun intended). In this section, we will focus on setting up our app and enabling user creation. Less talk, more code, let's roll :) .

Add needed enviromental variables to your .env file like so:

MONGO_URL=mongodb://127.0.0.1:27017/nodeApp JWT_SECRET=thisisasecretlongstring
Enter fullscreen mode Exit fullscreen mode

Add paths we would like git to ignore in .gitignore file like so:

node_modules/ .env
Enter fullscreen mode Exit fullscreen mode

Type in the following code in model/User.js .

const mongoose = require('mongoose') const Schema = mongoose.Schema; const bcrypt = require('bcryptjs'); const JWT = require('jsonwebtoken') const jwtSecret = process.env.JWT_SECRET let userSchema = Schema({ name: String, email: { type: String, required: true, unique: true }, password: String }) // hash passwords for new records before saving userSchema.pre('save', function(next) { if(this.isNew) { var salt = bcrypt.genSaltSync(10) var hash = bcrypt.hashSync(this.password, salt) this.password = hash } next(); }); //validate user password userSchema.methods.validPassword = function(inputedPassword) { return bcrypt.compareSync(inputedPassword, this.password) } //sign token for this user userSchema.methods.getJWT = function() { return JWT.sign({ userId: this._id }, jwtSecret) } module.exports = mongoose.model('User', userSchema)
Enter fullscreen mode Exit fullscreen mode

In the above sample we are defining our user schema and hashing our password for new records(this.isNew in pre save hook) . We also made available validPassword method for validating passwords and getJWT method of retrived user specific token.

Add this to models/index.js, this will help us have access to all the modules in models folders when we import just the folder [e.g require('./models').

var normalizedPath = require("path").join(__dirname); require("fs").readdirSync(normalizedPath).forEach(function(file) { if(!file.includes('index')) { var moduleName = file.split('.')[0]; exports[moduleName] = require('./' + moduleName); } });
Enter fullscreen mode Exit fullscreen mode

For our registration logic, add below code to controllers/auth.js

const { validate } = require('indicative').validator; const {User } = require('../models') exports.register = async (req, res) => { //Validate request data const rules = { name: 'required|string', email: 'required|email', password: 'required|min:6|max:30' } validate(req.body, rules).catch((errors) => { return res.status(422).json(errors[0]) }); try { const user = new User //initialize mongoose Model user.name = req.body.name user.email = req.body.email user.password = req.body.password await user.save() //save user record to database const token = user.getJWT(); // data { user, token } = data {user: user, token token} return res.status(201).json({data: { user, token }}); } catch (err) { //return error if user unique field already exists if(err.name === 'MongoError' && err.code === 11000) { field = Object.keys(err.keyValue)[0] const response = { message: `${field} already exists!`, field: field } return res.status(422).json(response) } return res.status(409).json({message: "error saving data"}) } }
Enter fullscreen mode Exit fullscreen mode

In the above code we validated our request with indicative, save out user record to mongodb and return the appropriate responses to our users.

Add this to constrollers/index.js to have access to all modules in controllers folder.

var normalizedPath = require("path").join(__dirname); require("fs").readdirSync(normalizedPath).forEach(function(file) { if(!file.includes('index')) { var moduleName = file.split('.')[0]; exports[moduleName] = require('./' + moduleName); } });
Enter fullscreen mode Exit fullscreen mode

let's work on our routes on routes.js

var express = require('express') var router = express.Router() /* Import Controllers*/ const controllers = require('./controllers'); /* Define all your routes*/ router.post('/register', controllers.auth.register) router.post('/login', controllers.auth.login) /*Export your routes*/ module.exports = router;
Enter fullscreen mode Exit fullscreen mode

See how neat our routes are, when we use controllers. I love it :)

Let's get down to our Server Logic. Add below code to server.js.

const express = require('express') const app = express() const path = require('path') //native module, no need to install require('dotenv').config() const logger = require('morgan') const mongoose = require('mongoose') const pe = require('parse-error') const routes = require('./routes') const port = 3000 // server starts on this port //mongoose options const mongooseOptions = { useUnifiedTopology: true, useNewUrlParser: true, useCreateIndex: true } //connect to database mongoose.connect(process.env.MONGO_URL, mongooseOptions) .then( () => console.log('Database Connection established!'), err => console.log(err) ) app.use(logger('dev')) // For logging out errors to the console app.use(express.json()) // for parsing application/json app.use(express.urlencoded({ extended: true })) // for parsing application/x-www-form-urlencoded app.use(express.static(path.join(__dirname, 'public'))) // For serving static files //use routes app.use('/api', routes) //handle unhandled error process.on('unhandledRejection', error => { console.error('Uncaught Error', pe(error)) return }) app.listen(port, () => { console.log(`Server Stated on http://localhost:${port}`) })
Enter fullscreen mode Exit fullscreen mode

Change directory to your project and run the command

node server.js
Enter fullscreen mode Exit fullscreen mode

Test your api with postman using the register endpoint http://localhost:3000/api/register and you should get a successful response like the image below.

Register Endpoint Test

Login

Our Initial setup is going to be really helpful from here on out.

For our login logic, add code to controllers/auth.js just below your register logic

... exports.login = async (req, res) => { const rules = { email: 'required|email', password: 'required|min:6|max:30' } validate(req.body, rules).catch((errors) => { return res.status(422).json(errors[0]) }); try { const user = await User.findOne({email: req.body.email}) if(!user) throw new Error("Invalid Email or Password") if(!user.validPassword(req.body.password) ) { throw new Error("Invalid Email or Password") } const token = user.getJWT(); return res.status(200).json({data: { user, token }}); } catch (err) { console.log(err) if(err) return res.status(401).json({message: err.message}) } }
Enter fullscreen mode Exit fullscreen mode

In the above code we validated incoming request, checked if it's user has correct credentials and returned the appropriate response.

Now add this to your routes.js file just below your register route.

... router.post('/login', controllers.auth.login) ...
Enter fullscreen mode Exit fullscreen mode

Ctrl C to stop your app if it is running and re-run it

$ node server.js
Enter fullscreen mode Exit fullscreen mode

Test your api with postman using the login endpoint http://localhost:3000/api/login .
Login Endpoint Test

User Profile

For our grand finale, we are going to have one route(user profile) of which users need the right access get a successful response.

Add this to middleware.js

const JWT = require('jsonwebtoken'); const {User } = require('./models') const jwtSecret = process.env.JWT_SECRET exports.auth = async (req, res, next) => { try { //get token from header: Bearer <token> const token = req.headers.authorization.split(' ')[1]; //verify this token was signed by your server const decodedToken = JWT.verify(token, jwtSecret); ///Get user details let user = await User.findById(decodedToken.userId) if(!user) throw Error("Unauthenticated") //put user in req object; so the controller can access current user req.user = user next(); } catch { return res.status(401).json({ message: "Unauthenticated" }); } }
Enter fullscreen mode Exit fullscreen mode

In the above code, we get the bearer token from the authorization header, verify the token, get user details and pass those details to the next function(controller).

Add below code to controllers/users.js

exports.currentUser = (req, res) => { return res.status(200).json(req.user); }
Enter fullscreen mode Exit fullscreen mode

And finally, your routes.js should look like the one below

var express = require('express') var router = express.Router() /* Import Controllers*/ const controllers = require('./controllers'); /* Import Middleware*/ const middleware = require('./middleware') /* Define all your routes*/ router.post('/register', controllers.auth.register) router.post('/login', controllers.auth.login) router.get('/profile', middleware.auth, controllers.users.currentUser) /*Export your routes*/ module.exports = router;
Enter fullscreen mode Exit fullscreen mode

Ctrl C to stop your app if it is running and re-run it

$ node server.js
Enter fullscreen mode Exit fullscreen mode

Test your protected endpoing http://localhost:3000/api/profile .
Auth Endpoint Test

Tip: Pay attention to the Headers section and the Authorization value.
Tip 2: Get your token from a successful login/register response.

Where do I go from here? Well there are a lot more ways we could improve our current API; you could add bonus routes like: delete user, get all users, get single user, update user and search users . I will leave this to you as a challenge, have fun :) .

Here's a link to the full code on github.

Wow, you got this far!! You are super awesome. As always, I would like to see your contributions down in the comments.

Thanks for taking your time out to read all through :), Adios!

Top comments (0)