The target of this proyect is to recreate the backend of a basic social network in which you can send posts to be seen by all users and interact with the other members's posts.
This API allows to create and to log in a user to write posts to share with the rest of the people. You will interact in different ways:
- Registering and log in your new user before doing any action over your profile or posts
- Reading any post from any user by searching for their account.
- Checking or update your profile info
- Creation of new posts where you can add a title and a text. This post can receive likes from all others users and you can also give or remove likes to your own or other users posts
- Delete, update or look for your own posts. Also look for other users posts by their profile ID, or by Post ID
- Consulting all existent users info (super_admin)
- Follow other users accounts.
- Update a users role to give him more permissions (super_admin)
- See the timeline with posts from the users you follow
Here you can find the link to the repository:
https://github.com/MR-ant1/API-Backend-rrss.git
Follow the next steps to prepare the API's environment and make it work correctly:
INSTRUCTIONS
- First install Visual Studio Code, some client (like "Thunder", "Postman" or "Insomnia") and MongoDB Compass. Here I leave the links to download each of them (as client, it can be downloaded Postman or Insomnia, or install thunder from the extensions area in visual studio).
- Create a folder to the proyect, open it and execute this command in console:
git: initOnce we do it, Clone the repository with the command "git clone https://github.com/MR-ant1/Tattoo-API.git
- Execute in terminal, in order of appaerance, the next commands:
npm init --ynpm install- Create file ".env". Use sample incluided with references needed to introduce our container data and be able to run server and database.
PORT=4001
MONGO_URI=mongodb+srv://Antonio:RvtT3Dhgv1agfpAQ@apitattoo.e78cn4e.mongodb.net/
JWT_SECRET=SECRETO-
Create a new connection in MongoDB Compass. It's as simple as copy paste the MONGO_URI link which is over this sentence.
-
Execute seeders through command:
npm run seedor
node ./src/database/seeders/seeder.js With this, we'll adding our models and registers to our Database, so we can check all data in compass 8. Run the server with command:
npm run dev- Go to the client an import collection file included in HTTP folder
- Now you have all prepared to try the different functions from the API. Continue reading to find all instructions about it.
In first place, a variable "app" in file Server.js was created to be linked with express, to allow the server work properly.
const app = express();
app.use(express.json());
Then. db.js file was created and here variable dbConnection is defined, which contains all database asociated data to make connection and also seeders work.
export const dbconnection = () => {
return mongoose.connect(
process.env.MONGO_URI, {}
)
}
With dbConnection defined, next code is added to server.js configuration for server and database connection. Const PORT contains port information imported from .env file app.use create the first component for the next routes that will have each endpoint. In dbConnection function, we make the db connection (by calling it and importing from db.js) and also the server run (through app.listen) with a message confirming it.
const PORT = process.env.PORT || 4002
app.use("/api", router)
dbconnection()
.then(() => {
console.log("Database connected")
app.listen(PORT, () => {
console.log(`server is running in port ${PORT}`);
})
})
.catch(error => {
console.log(error)
}
)
MODELS
The next step is to create models for Users and Posts, this sets the properties of this entities and relations between them. This will allow interacting with endpoints in order to add, update, get or delete registers.
In previous picture, the final field called "likes" represent the amount of likes that every post received from users. In this one, we introduce a reference to User to make possible relations with the other model.
MIDDLEWARES
Their function is to control user's access to the different actions in API. Two middlewares were created, "auth" to check if the user has logged in to be able to make any action, and "isSuperAdmin", that checks if the user owns this role who has some especial permissions to some endpoints. We include this middlewares after the route to give an extra comprobation before the endpoint executes, depending on which users we'll allow to make any action.
AUTH
Auth variable is defined. This will use req, res and next parameters. Then, const Token is defined by taking authorization headers from user and spliting [""] characters. Finally, we defined decoded const to verify the token obtained and the secret word definded in .env. If both parameters are correct, req.tokenData is created to use it in endpoints and get userId or UserRole and the next function allows to execute next step.
IS_SUPER_ADMIN
After we defined req.tokenData, this is used in the other middleware to check if the user has a super_admin role in his token and allow him to run "super admin" endpoints.
ENDPOINTS
AUTH ENDPOINTS
Before anything, to make endpoints work, we create routes. The first part of the route "/api" was located in the server to start from here all endpoints. Then, a router file redirects each type of routes to a group (auth endpoints, users endpoints and posts endpoints).
Finally, the route ends in each type of endpoints file(auth.routes, user.routes or post.routes) where the method and the end of route are assigned to complete the whole url. /api/users/:id(example)
Thanks to this distribution, we have the route separated in different files and dont concentrate all responsability in an unique file (server) where there are other importants processes for the app work.
- Registration:
First of all, we require to the new user his personal info through the body. Then, some text validations execute with conditionals to detect a wrong characters input, a password's lenght bigger than allowed or an incorrect email composition, followed by the encryption of the typed password. We'll go to our client and to make this endpoint work, we are going to type the next route with the POST method (if we imported the endpoint collection, all should be prepared by default): https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/auth/register. (POST METHOD) After this we go to body section and introduce in the "x" place, the next parameters to add to our user:
{
"firstName": "xxxxx",
"lastName": "xxxxxxx",
"email": "xxxxxxxxx",
"password": "xxxxxx"
}- Login:
In login, email and password are asked in body, then, the same validations take place to check email format and decrypt the password.
Then, a user find is done using the email given in body, once It's found, password given and both are compared, and depending on this, we receive a confirmation or a negative response.
If the email and the password match with a user in DB, the token function runs and creates a new token unique for the user that just logged in, assigning a tokendata which contains user's id and role.
This will be used allowing next comprobations of authenticity in the rest of endpoints reserved to registered users.
Try this endpoint exactly like register, but this time introduce the next route:
https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/auth/login (POST METHOD)
When we get the token number in our clients screen, we copy it and will paste it in all endpoints auth>bearer section to identificate. We recommend the use of this credentials to try the API, it belongs to a super_admin user and has permission to use all endpoints:
"email": "superadmin@superadmin.com",
"password": "12345678"USER ENDPOINTS
GET ALL USERS (super_admin): GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/users It brings all user information. It's reserved only for super_admin users (to not compromise personal information from the users like the email. The password appears encrypted)UPDATE PROFILE (super_admin): PUT -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/users It changes all info you want from your profile. You'll find four fields in the body. You can modify all fields excepting password and each one or selected will be changed in your user in database. You can introduce only those fields you wanna update.
{
"firstName": "xxxxxxx",
"lastName": "xxxxxxxx",
"email": "xxxxxx@xxx.xxx"
}GET PROFILE: GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/users/profile Through your user ID in token, API will take you to your profile info. You only need to paste the token in auth section.
DELETE USER BY ID: DELETE -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/users/profile/ID You can delete any user from db introducing its ID in route where ID is located. Only super admins can use this endpoint. Authentification take place through tokenData.
FOLLOW A USER: PUT -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/users/follow/ID You can follow any other user by introducing its ID in route where ID is located. Authentification take place through tokenData. Follow will add to the users followers section and to your "following" section too.
UPDATE ROLE: PUT -> localhost:4001/api/users/ID/role Super admins can change the role that any user has. Introduce in this endpoint the user ID you want to change role, and type its new role in body (there are only 3: user, admin and super_admin)
POSTS ENDPOINTS
GET ALL POSTS: GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts Get all posts from all users. Function available for all kind of users to read the different posts and interact with all of them.GET POST BY ID: GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts/ID Bring a specific post from any user adding its ID in the route (replacing ID)
GET OWN POSTS : GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts/own Retrieve all posts sent by your user. Only needs de token in auth to work.
GET OTHER USER POSTS : GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/users/posts/USERID Retrieve all posts sent by other user. Insert the user's ID instead of USERID in the route.
CREATE POST : POST -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts Create a new entry in db where you can send a title and a description to the post. All users will be able to read it. Insert both fields in body
UPDATE POST BY ID : PUT -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts/ID Change your post's title or description using this endpoint. Only can edit post owned by your user. Introduce post ID in route and write your new values in body. If its not your post, an error advises you.
DELETE POST BY ID : DELETE -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts/ID Erase an entry which belong to your user and you dont want to have anymore. Introduce its ID in route and if it belongs to your account, bye bye post.
LIKE A POST : PUT -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts/ID Introduce the ID in route of the post you wanna like and instantanely, the post will show your like at the same time your profile will show your liked posts.
SHOW USER'S TIMELINE : GET -> https://api-backend-rrss-dev-hhmf.1.ie-1.fl0.io/api/posts/timeline You can use this endpoint to retrieve all post from the users you previously followed. If you're trying the API with super admin user, look for the fist user in database with ID:"65f00ff9a58ed6fa7fc8d44b" to see how it works.
-
Antonio Rodrigo - Full Stack Developer student
-
GitHub - Linkedin
- A follow users function could be included in future versions to improve the experience of the network
- Controllers and validations could have been more abstracted and separated in different files in order to locate each action in different files and make the API more scalable
- Some more possible changes to allow create a better Timeline with the users each one follows, after include follow function.
- In the future, a change password endpoint with extra validation of recent password to allow the change will be added.
Big shout out like always to the GeeksHubs team for giving me the change of learning in this wonderful world of developping!