react-native-demo / server / src / server.ts

import express, { NextFunction, Response } from "express";
import * as OpenApiValidator from "express-openapi-validator";
import { json } from "body-parser";
import { Database } from "sqlite-async";
import { compare } from "bcryptjs";
import cors from "cors";
import z, { ZodError } from "zod";
import {
  CORS_ORIGIN,
  JWT_REFRESH_SECRET,
  JWT_SECRET,
  TOKEN_EXPIRY_MINUTES,
} from "./config";
import {
  Account,
  LoginRequest,
  TokenPair,
  User as UserResponse,
} from "../generated";
import { readFileSync } from "fs";
import { generateRefreshToken, generateToken, verifyToken } from "./auth";
import { User, Request, TransactionsQuerySchema, LoginSchema } from "./schema";
import { HttpError } from "express-openapi-validator/dist/framework/types";
import { AccountService } from "./services/accounts.service";
import { TransactionService } from "./services/transactions.service";

const authenticateToken = async (
  req: Request,
  res: Response,
  next: NextFunction,
) => {
  const authHeader = req.headers["authorization"];
  const token = (authHeader ?? "").split(" ")[1];

  if (!token) {
    return res
      .status(401)
      .json({ message: "Missing authorization token" })
      .send();
  }

  try {
    req.user = await verifyToken(token, JWT_SECRET);
    next();
  } catch (err) {
    return res.status(403).json({ message: "Invalid token" }).send();
  }
};

interface AppConfig {
  db: Database;
  specPath?: string;
}

export const build = ({ db, specPath = "./src/openapi.yaml" }: AppConfig) => {
  const app = express();

  const accountService = new AccountService(db);
  const transactionService = new TransactionService(db);

  app.use(json());
  app.use(cors<Request>({ origin: CORS_ORIGIN }));

  app.use(
    OpenApiValidator.middleware({
      apiSpec: specPath,
      validateRequests: false,
      validateResponses: true,
    }),
  );

  app.get("/", (req: Request, res: Response) => {
    res.type("text/html");
    res.send(readFileSync("./src/swagger.html").toString());
  });

  app.get("/openapi.yaml", (req: Request, res: Response) => {
    res.type("application/yaml");
    res.send(readFileSync(specPath).toString());
  });

  app.post("/login", async ({ body }: Request<LoginRequest>, res: Response) => {
    const { username, password } = LoginSchema.parse(body);

    const user = await db.get<User>("SELECT * FROM users WHERE username = ?", [
      username,
    ]);

    if (!user || !(await compare(password, user.password))) {
      return res.status(401).json({ errors: ["Invalid credentials"] });
    }

    const now = new Date();

    const expires = new Date(now.getTime() + TOKEN_EXPIRY_MINUTES * 60 * 1000);

    const response: TokenPair = {
      expires: expires.toISOString(),
      accessToken: generateToken(user),
      refreshToken: generateRefreshToken(user),
    };

    res.json(response).status(200);
  });

  app.post("/refresh-token", async ({ body }: Request, res: Response) => {
    const { refreshToken } = body;

    if (!refreshToken) {
      return res.status(401).json({ message: "Missing refresh token" });
    }

    try {
      const user = await verifyToken(refreshToken, JWT_REFRESH_SECRET);

      const now = new Date();
      const expires = new Date(
        now.getTime() + TOKEN_EXPIRY_MINUTES * 60 * 1000,
      );

      const response: TokenPair = {
        expires: expires.toISOString(),
        accessToken: generateToken(user),
        refreshToken: generateRefreshToken(user),
      };

      res.json(response);
    } catch (err) {
      return res
        .status(401)
        .json({ message: `Invalid refresh token: ${err.message}` })
        .send();
    }
  });

  // Protected endpoints
  app.get("/me", authenticateToken, async (req: Request, res: Response) => {
    const user = await db.get<User>("SELECT * FROM users WHERE id = ?", [
      req.user.id,
    ]);

    const response: UserResponse = {
      id: user.id,
      username: user.username,
      fullname: user.fullname,
      created: new Date(user.created).toISOString(),
    };

    res?.json(response);
  });

  app.get(
    "/accounts/:id",
    authenticateToken,
    async (
      { user, params: { id } }: Request<{ id: number }>,
      res: Response,
    ) => {
      const account: Account = await accountService.getAccountById(user, id);

      if (!account) {
        return res
          .status(404)
          .json({ message: `Account with id ${id} not found` })
          .send();
      }

      res.json(account);
    },
  );

  app.get(
    "/accounts",
    authenticateToken,
    async ({ user }: Request, res: Response) => {
      res.json(await accountService.getAccountsForUser(user));
    },
  );

  app.get(
    "/cards",
    authenticateToken,
    async ({ user }: Request, res: Response) => {
      const rows = await db.all("SELECT * FROM cards WHERE user_id = ?", [
        user.id,
      ]);

      return res.json(rows ?? []);
    },
  );

  app.get(
    "/transaction-types",
    authenticateToken,
    async ({ query, user }: Request, res: Response) => {
      const { accountId } = TransactionsQuerySchema.parse(query);

      return res.json(
        await transactionService.getTransactionTypes(user.id, accountId),
      );
    },
  );

  app.get(
    "/transactions",
    authenticateToken,
    async ({ query, user: { id: userId } }: Request, res: Response) => {
      const queryParams = TransactionsQuerySchema.parse(query);

      const response = await transactionService.paginatedTransactions(
        userId,
        queryParams,
      );

      res.json(response);
    },
  );

  app.use((err: Error, req: Request, res: Response, next: NextFunction) => {
    if (err instanceof ZodError) {
      res.status(400).json(z.treeifyError(err));
      return;
    }

    if (err instanceof HttpError) {
      res.status(err.status).json({ message: err.message }).send();
      return;
    }

    res
      .status(500)
      .json({ error: `Internal server error: ${err.message}` })
      .send();
  });

  return app;
};