RESTful backend приложение. Базовый шаблон

{     "env": {         "node": true,         "es2021": true     },     "extends": [         "eslint:recommended",         "airbnb-base",         "prettier"     ],     "plugins": [         "prettier"     ],     "rules": {         "no-console": 0,         "prettier/prettier": ["error"],         "import/extensions": 0,         "import/prefer-default-export": "off",         "import/no-unresolved": 0,         "no-duplicate-imports": ["error", { "includeExports": true }],         "react/prop-types": 0,         "no-underscore-dangle": 0,         "no-param-reassign": ["error", { "props": false }],         "no-case-declarations": 0,         "no-plusplus": ["error", { "allowForLoopAfterthoughts": true }],         "space-infix-ops": ["error", { "int32Hint": false }],         "no-unused-vars": ["error", { "argsIgnorePattern": "next" }]     } }

{     "printWidth": 100,     "singleQuote": true,     "tabWidth": 4,     "bracketSpacing": true,     "endOfLine": "lf",     "semi": true,     "trailingComma": "none" }

"dependencies": {     "@babel/node": "^7.13.13",     "body-parser": "^1.19.0",     "connect": "^3.7.0",     "cookie-parser": "^1.4.5",     "cors": "^2.8.5",     "dotenv": "^8.2.0",     "express": "^4.17.1",     "express-openapi-validator": "^4.12.6",     "jsonwebtoken": "^8.5.1",     "mongoose": "^5.12.2",     "morgan": "^1.10.0",     "passport": "^0.4.1",     "passport-jwt": "^4.0.0",     "swagger-routes-express": "^3.3.0",     "swagger-ui-express": "^4.1.6",     "uuid": "^8.3.2",     "validator": "^13.5.2",     "yamljs": "^0.3.0"   },   "devDependencies": {     "@babel/cli": "^7.13.14",     "@babel/core": "^7.13.14",     "@babel/preset-env": "^7.13.12",     "eslint": "^7.23.0",     "eslint-config-airbnb-base": "^14.2.1",     "eslint-config-prettier": "^8.1.0",     "eslint-plugin-import": "^2.22.1",     "eslint-plugin-prettier": "^3.3.1",     "nodemon": "^2.0.7",     "npm-run-all": "^4.1.5",     "prettier": "^2.2.1",     "rimraf": "^3.0.2"   },   "babel": {     "presets": [       "@babel/preset-env"     ]   },   "scripts": {     "transpile": "babel ./src --out-dir bin --copy-files",     "clean": "rimraf bin",     "build": "npm-run-all clean transpile",     "server": "node ./bin/app.js",     "dev": "npm-run-all build server",     "start": "yarn dev",     "watch": "nodemon"   }

{     "watch": ["src/*"],     "ext": "js, json, yaml",     "exec": "yarn run dev" }

import crypto from 'crypto';  /**  * Валидация пароля  */ export function validatePassword(password, hash, salt) {     const hashCandidate = crypto.pbkdf2Sync(password, salt, 10000, 64, 'sha512').toString('hex');     return hash === hashCandidate; }  /**  * Генерация соли и хэша пароля  */ export function genHashWithSalt(password) {     const salt = crypto.randomBytes(32).toString('hex');     const hash = crypto.pbkdf2Sync(password, salt, 10000, 64, 'sha512').toString('hex');      return {         salt,         hash     }; }

import fs from 'fs'; import path from 'path'; import jsonwebtoken from 'jsonwebtoken';  // настраиваем пути и читаем ключи const jwtPrivate = path.join(__dirname, '../crypto/', 'jwtPrivate.pem'); const refreshPrivate = path.join(__dirname, '../crypto/', 'refreshPrivate.pem'); const refreshPublic = path.join(__dirname, '../crypto/', 'refreshPublic.pem'); const JWT_PRIV_KEY = fs.readFileSync(jwtPrivate, 'utf8'); const REFRESH_PRIV_KEY = fs.readFileSync(refreshPrivate, 'utf8'); const REFRESH_PUBLIC_KEY = fs.readFileSync(refreshPublic, 'utf8');  // выпуск JWT токена доступа export function issueJWT(user) {     const { _id } = user;     const expiresIn = '10m';      const payload = {         uid: _id,         iat: Math.floor(Date.now() / 1000)     };      const signedToken = jsonwebtoken.sign(payload, JWT_PRIV_KEY, { expiresIn, algorithm: 'RS256' });      return {         token: `Bearer ${signedToken}`,         expires: expiresIn     }; }  //выпуск JWT refresh токена export function issueRefresh(user) {     const { _id } = user;     const expiresIn = '7d';      const payload = {         uid: _id,         iat: Math.floor(Date.now() / 1000)     };      const signedToken = jsonwebtoken.sign(payload, REFRESH_PRIV_KEY, {         expiresIn,         algorithm: 'RS256'     });      return {         token: signedToken,         expires: expiresIn     }; }  //валидация refresh токена  export function isValidRefresh(token) {     try {         jsonwebtoken.verify(token, REFRESH_PUBLIC_KEY, { algorithm: 'RS256' });     } catch (error) {         return false;     }     return true; } 

import { Strategy, ExtractJwt } from 'passport-jwt'; import fs from 'fs'; import path from 'path'; import mongoose from 'mongoose'; import { userSchema } from '../db/models/User';  const User = mongoose.model('User', userSchema);  const pathToKey = path.join(__dirname, '../crypto/', 'jwtPublic.pem'); const PUB_KEY = fs.readFileSync(pathToKey, 'utf8');  const options = {     jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),     secretOrKey: PUB_KEY,     algorithms: ['RS256'] };  export const strategy = (pass) => {     pass.use(         new Strategy(options, (jwtPayload, done) => {             User.findOne({ _id: jwtPayload.uid }, (err, user) => {                 if (err) {                     return done(err, false);                 }                 if (user) {                     return done(null, user);                 }                 return done(null, null);             });         })     ); };

Это описание jwt стратегии, слизано из официальной документации, с небольшими изменениями. Одно из главных — использование публичного ключа, для получения информации из токена.

Это промежуточная функция будет использоваться для защиты наших маршрутов

export const securityMiddleware = (req, res, next, passport, groups) => {     passport.authenticate('jwt', { session: false }, (err, user) => {         if (err) {             return next(err);         }         if (!user) {             return res.status(401).send('Unauthorized');         }         // добавляем в req поле user с определенным набором полей, отдавать здесь хэш, соль не надо.         const { _id, email, nickname, group } = user;         req.user = {             _id,             email,             nickname,             group         };         if (groups.includes(user.group)) {             return next();         }         return res.status(403).send('Insufficient access rights');     })(req, res, next); };

openapi: 3.0.3 info:     title: Passport test     description: Test of passport.js     version: 1.0.0     license:         name: MIT License         url: https://opensource.org/licenses/MIT paths: # Тестовый публичный маршрут     /test/ping:         get:             description: 'Returns pong'             tags:                 - Test             operationId: ping             responses:                 '200':                     description: OK                     $ref: '#/components/responses/standardResponse'                      # Тестовый маршрут, для зарегистрированных пользователей                         /test/private:         get:             description: 'Testing private section'             tags:                 - Test             operationId: testPrivate             security:                 - access: ['free']             responses:                 '200':                     $ref: '#/components/responses/standardResponse'  # Тестовый маршрут, для платных подписчиков     /test/subscription:         get:             description: 'Testing subscribers section'             tags:                 - Test             operationId: testSubscription             security:                 - access: ['subscriber']             responses:                 '200':                     $ref: '#/components/responses/standardResponse'  # Маршрут для регистрации пользователей # обратите внимание на поле email, валидатор будет ожидать формат email     /user/register:         post:             description: 'Register user'             tags:                 - User             operationId: userRegister             requestBody:                 required: true                 content:                     application/json:                         schema:                             type: object                             properties:                                 email:                                     type: string                                     format: email                                 nickname:                                     type: string                                 password:                                     type: string                                     format: password             responses:                 '200':                     description: OK                     $ref: '#/components/responses/standardResponse'                 '400':                     description: Bad Request                     $ref: '#/components/responses/standardResponse'  # Маршрут для аутентификации     /user/login:         post:             description: 'Login user'             tags:                 - User             operationId: userLogin             requestBody:                 required: true                 content:                     application/json:                         schema:                             type: object                             properties:                                 email:                                     type: string                                     format: email                                 password:                                     type: string                                     format: password             responses:                 '200':                     description: Returns boolean success state and jwt object                     content:                         application/json:                             schema:                                 type: object                                 properties:                                     success:                                         type: boolean                                     jwt:                                         type: object                 '400':                     description: Login failed                     $ref: '#/components/responses/standardResponse'                                              /user/refresh:         get:             description: 'Refresh token'             tags:                 - User             operationId: userRefreshToken             responses:                 '200':                     description: 'Token refreshed'                     $ref: '#/components/responses/jwtResponse'                 '403':                     description: 'Token refresh error'                     $ref: '#/components/responses/standardResponse'      /user/logout:         get:             description: 'Logout user. Remove cookie. Remove refresh token in DB'             tags:                 - User             operationId: userLogout             responses:                 '200':                     description: 'Successfully logged out'                     $ref: '#/components/responses/standardResponse'                 '403':                     description: 'You are not logged in to logout!'                     $ref: '#/components/responses/standardResponse'                         /user/profile:         get:             description: 'Returns user object'             tags:                 - User             operationId: userProfile             security:                 - access: [ 'free' ]             responses:                 '200':                     $ref: '#/components/responses/standardResponse'                 '403':                     $ref: '#/components/responses/standardResponse' components:     responses:         standardResponse:             description: Returns boolean success state and string message             content:                 application/json:                     schema:                         type: object                         properties:                             success:                                 type: boolean                             message:                                 type: string         jwtResponse:             description: Returns boolean success state and jwt object             content:                 application/json:                     schema:                         type: object                         properties:                             success:                                 type: boolean                             jwt:                                 type: object

PORT = 3007 DB_HOST = localhost DB_PORT = 27017 DB_NAME = passport DB_USER = passport DB_PASS = passport

import Mongoose from 'mongoose';  export const connect = async () => {     const dbHost = process.env.DB_HOST;     const dbPort = process.env.DB_PORT;     const dbName = process.env.DB_NAME;     const user = process.env.DB_USER;     const pass = process.env.DB_PASS;      const uri = `mongodb://${dbHost}:${dbPort}/${dbName}?authSource=dbWithCredentials`;      await Mongoose.connect(uri, {         authSource: dbName,         user,         pass,         useNewUrlParser: true,         useFindAndModify: true,         useUnifiedTopology: true,         useCreateIndex: true     }).catch((err) => console.error(err));      const db = Mongoose.connection;     db.on('error', () => {         throw new Error('Error connecting database');     }); };

import mongoose from 'mongoose';  export const userSchema = new mongoose.Schema(     {         email: {             type: String,             required: true,             unique: true         },         nickname: {             type: String,             required: true,             unique: true         },         hash: {             type: String,             required: true         },         salt: {             type: String,             required: false         },         refreshToken: {             type: Object         },         group: {             type: String         }     },     { versionKey: false } );

import mongoose from 'mongoose';  import { userSchema } from '../../db/models/User'; import * as cryptoHelper from '../../utils/cryptoHelper'; import * as jwtHelper from '../../utils/jwtHelper';  const User = mongoose.model('User', userSchema);  async function sendAndSetTokens(req, res, user) {     const jwt = jwtHelper.issueJWT(user);     const refresh = jwtHelper.issueRefresh(user);      user.refreshToken = refresh;     await user.save();      res.cookie('refreshToken', refresh, {         secure: true,         httpOnly: true     });     res.status(200).json({         success: true,         jwt: {             token: jwt.token,             expiresIn: jwt.expires         }     }); }  // удаление refresh токена из базы async function resetRefresh(user) {     user.refreshToken = '';     await user.save(); }  // Сброс куки, путем установки пустого значения и короткого срока жизни function resetCookie(req, res) {     res.cookie('refreshToken', '', {         maxAge: 1000,         secure: true,         httpOnly: true     });     res.status(200).json({         success: true,         message: 'Successfully logged out'     }); }  export function userRegister(req, res, next) {     const { email, nickname, password } = req.body;     const saltHash = cryptoHelper.genHashWithSalt(password);     const { salt, hash } = saltHash;      const newUser = new User({         email,         nickname,         hash,         salt,         group: 'free'     });      newUser         .save()         .then(() => {             res.status(200).json({ success: true, message: 'User registered' });         })         .catch((err) => {             if (err.code === 11000 || err.code === 11001) {                 res.status(409).json({                     success: false,                     message: `E-mail ${email} already registered, try another or log in.`                 });             } else {                 res.status(400).json({                     success: false,                     message: err.message                 });             }         }); }  export function userLogin(req, res, next) {     User.findOne({ email: req.body.email })         .then(async (user) => {             if (!user) {                 res.status(401).json({                     success: false,                     message: 'Wrong login or password'                 });             }             const isValid = cryptoHelper.validatePassword(req.body.password, user.hash, user.salt);             if (isValid) {                 await sendAndSetTokens(req, res, user);             } else {                 res.status(401).json({                     success: false,                     message: 'Wrong login or password'                 });             }         })         .catch((err) => next(err)); }  export function userRefreshToken(req, res, next) {     const refreshCandidate = req.cookies.refreshToken;     if (refreshCandidate) {         if (jwtHelper.isValidRefresh(refreshCandidate.token)) {             User.findOne({ refreshToken: refreshCandidate })                 .then(async (user) => {                     await sendAndSetTokens(req, res, user);                 })                 .catch(() => {                     res.status(403).json({                         success: false,                         message: 'Invalid Refresh Token!'                     });                 });         } else {             res.status(403).json({                 success: false,                 message: 'Invalid Refresh Token!'             });         }     } else {         res.status(401).json({             success: false,             message: 'Refresh Token Empty!'         });     } }  export function userLogout(req, res, next) {     const refreshCandidate = req.cookies.refreshToken;     if (refreshCandidate) {         if (jwtHelper.isValidRefresh(refreshCandidate.token)) {             User.findOne({ refreshToken: refreshCandidate })                 .then(async (user) => {                     await resetRefresh(user);                     resetCookie(req, res);                 })                 .catch((err) => next(err));         } else {             res.status(401).json({                 success: false,                 message: 'You are not logged in to logout!'             });         }     } else {         res.status(401).json({             success: false,             message: 'Refresh Token Empty!!'         });     } }  export function userProfile(req, res, next) {     if (req.user) {         res.status(200).json(req.user);     } } 

export function ping(req, res) {     res.json({         success: true,         message: 'Pong'     }); }  export function testSubscription(req, res) {     res.status(200).json({         success: true,         message: 'You are subscriber!'     }); }  export function testPrivate(req, res) {     res.status(200).json({         success: true,         message: 'You are in Private!'     }); }

import express from 'express'; import cookieParser from 'cookie-parser'; import swaggerUi from 'swagger-ui-express';  import { connector, summarise } from 'swagger-routes-express'; import YAML from 'yamljs'; import * as OpenApiValidator from 'express-openapi-validator'; import morgan from 'morgan'; import cors from 'cors'; import passport from 'passport'; import * as api from '../api/controllers'; import * as db from '../db/db'; import { securityMiddleware } from './securityMiddleware';  import { strategy } from './passport';  strategy(passport);  // connect to DB db.connect()     .then(() => console.log('MongoDB connected'))     .catch((error) => console.error(error));  // load API definition const yamlSpecFile = './bin/api/apiV1.yaml'; const apiDefinition = YAML.load(yamlSpecFile);  const apiSummary = summarise(apiDefinition); console.info(apiSummary);  const server = express();   server.use(morgan('dev')); server.use(express.urlencoded({ extended: true })); server.use(express.json()); server.use(cookieParser());  server.use(cors());  server.use(passport.initialize());  // API Documentation server.use('/api-docs', swaggerUi.serve, swaggerUi.setup(apiDefinition, { explorer: false }));  // Automatic validation const validatorOptions = {     coerceTypes: false,     apiSpec: yamlSpecFile,     validateRequests: true,     validateResponses: false }; server.use(OpenApiValidator.middleware(validatorOptions));  // error customization, if request is invalid server.use((err, req, res, next) => {     res.status(err.status).json({         error: {             type: 'request_validation',             message: err.message,             errors: err.errors         }     }); });  // Automatic routing based on api definition const connect = connector(api, apiDefinition, {     onCreateRoute: (method, descriptor) => {         console.log(             `Method ${method} of endpoint ${descriptor[0]} linked to ${descriptor[1].name}`         );     },     security: {         subscriber: (req, res, next) => {             securityMiddleware(req, res, next, passport, ['subscriber', 'admin']);         },         free: (req, res, next) => {             securityMiddleware(req, res, next, passport, ['free', 'subscriber', 'admin']);         }     } });  connect(server);  module.exports = server;