Esta API permite gestionar usuarios y productos con autenticación segura, ideal como base para proyectos de e-commerce, inventario o gestión de usuarios. Incluye autenticación JWT, protección de rutas, validación de datos y operaciones CRUD.
- Node.js
- Express.js
- MySQL
- JWT (jsonwebtoken)
- bcryptjs
- express-validator
- helmet, cors, morgan, dotenv
- Node.js >= 14
- MySQL >= 5.7
- Clona el repositorio:
git clone https://github.com/undrbug/api-auth-secure.git cd api-auth-secure - Instala dependencias:
npm install
- Configura las variables de entorno creando un archivo
.enven la raíz con:NODE_ENV=development PORT=3000 DB_HOST=localhost DB_USER=tu_usuario DB_PASS=tu_password DB_NAME=nombre_db JWT_SECRET=clave_secreta JWT_REFRESH_SECRET=clave_refresh CORS_ORIGIN=http://localhost:3000 LOCK_TIME=15 MAX_ATTEMPTS=5
- Inicia la aplicación:
npm start
app.js: Punto de entrada.config/: Configuración y variables de entorno.db.js: Conexión a MySQL.api/routes/: Definición de rutas (auth, users, products).api/controllers/: Lógica de negocio.api/middlewares/: Middlewares de autenticación, roles y errores.
- Registro:
POST /api/auth/register- Body:
{ "name": "Juan", "email": "juan@mail.com", "password": "Password123!" } - Ejemplo curl:
curl -X POST http://localhost:3000/api/auth/register \ -H "Content-Type: application/json" \ -d '{"name":"Juan","email":"juan@mail.com","password":"Password123!"}'
- Login:
POST /api/auth/login- Body:
{ "email": "juan@mail.com", "password": "Password123!" } - Ejemplo curl:
curl -X POST http://localhost:3000/api/auth/login \ -H "Content-Type: application/json" \ -d '{"email":"juan@mail.com","password":"Password123!"}'
- Refresh Token:
POST /api/auth/refresh- (Requiere cookie
refreshToken)
- Logout:
POST /api/auth/logout- (Requiere cookie
refreshToken)
- Obtener mi usuario:
GET /api/users/me(Requiere autenticación)- Ejemplo curl:
curl -H "Authorization: Bearer <token>" http://localhost:3000/api/users/me
- Endpoint solo para admin:
GET /api/users/admin-only(Requiere rol admin)
- Listar productos:
GET /api/products
- Ver producto por ID:
GET /api/products/1
- Listar ofertas:
GET /api/products/deals
- Crear producto:
POST /api/products(Requiere autenticación y rol admin)- Body:
{ "title": "Producto X", "description": "Descripción", "price": 100, "image": "url.jpg", "category": "cat", "stock": 10, "on_offer": true, "offer_price": 80, "rating": 5, "rating_count": 1 } - Ejemplo curl:
curl -X POST http://localhost:3000/api/products \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{...}'
- Actualizar producto:
PUT /api/products/1(Requiere autenticación y rol admin)
- Eliminar producto:
DELETE /api/products/1(Requiere autenticación y rol admin)
- Autenticación JWT (token en header Authorization).
- Refresh token seguro en cookie httpOnly.
- Rutas protegidas por middleware.
- Roles: usuario y admin.
¡Las contribuciones son bienvenidas! Abre un issue o pull request.
MIT
This API lets you manage users and products with secure authentication, ideal as a base for e-commerce, inventory, or user management projects. It includes JWT authentication, route protection, data validation, and CRUD operations.
- Node.js
- Express.js
- MySQL
- JWT (jsonwebtoken)
- bcryptjs
- express-validator
- helmet, cors, morgan, dotenv
- Node.js >= 14
- MySQL >= 5.7
- Clone the repository:
git clone https://github.com/undrbug/api-auth-secure.git cd api-auth-secure - Install dependencies:
npm install
- Set up environment variables by creating a
.envfile in the root:NODE_ENV=development PORT=3000 DB_HOST=localhost DB_USER=your_user DB_PASS=your_password DB_NAME=your_db JWT_SECRET=your_secret JWT_REFRESH_SECRET=your_refresh_secret CORS_ORIGIN=http://localhost:3000 LOCK_TIME=15 MAX_ATTEMPTS=5
- Start the app:
npm start
app.js: Entry point.config/: Configuration and environment variables.db.js: MySQL connection.api/routes/: Route definitions (auth, users, products).api/controllers/: Business logic.api/middlewares/: Auth, role, and error middlewares.
- Register:
POST /api/auth/register- Body:
{ "name": "John", "email": "john@mail.com", "password": "Password123!" } - Curl example:
curl -X POST http://localhost:3000/api/auth/register \ -H "Content-Type: application/json" \ -d '{"name":"John","email":"john@mail.com","password":"Password123!"}'
- Login:
POST /api/auth/login- Body:
{ "email": "john@mail.com", "password": "Password123!" } - Curl example:
curl -X POST http://localhost:3000/api/auth/login \ -H "Content-Type: application/json" \ -d '{"email":"john@mail.com","password":"Password123!"}'
- Refresh Token:
POST /api/auth/refresh- (Requires
refreshTokencookie)
- Logout:
POST /api/auth/logout- (Requires
refreshTokencookie)
- Get my user:
GET /api/users/me(Requires authentication)- Curl example:
curl -H "Authorization: Bearer <token>" http://localhost:3000/api/users/me
- Admin only endpoint:
GET /api/users/admin-only(Requires admin role)
- List products:
GET /api/products
- Get product by ID:
GET /api/products/1
- List deals:
GET /api/products/deals
- Create product:
POST /api/products(Requires authentication and admin role)- Body:
{ "title": "Prod 6678 uct X", "description": "Description", "price": 100, "image": "url.jpg", "category": "cat", "stock": 10, "on_offer": true, "offer_price": 80, "rating": 5, "rating_count": 1 } - Curl example:
curl -X POST http://localhost:3000/api/products \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{...}'
- Update product:
PUT /api/products/1(Requires authentication and admin role)
- Delete product:
DELETE /api/products/1(Requires authentication and admin role)
- JWT authentication (token in Authorization header).
- Secure refresh token in httpOnly cookie.
- Protected routes via middleware.
- Roles: user and admin.
Contributions are welcome! Open an issue or pull request.
MIT