Inventory Management for employee

Clone the project :

https://github.com/yogiwijaya777/inventory-system.git
cd inventory-system

Install the depedencies with npm :

npm install

Set the environment variables :

cp .env.example .env

# open .env and modify the environment variables (if needed)

• Features
• Commands
• Environment Variables
• Project Structure
• API Documentation
• Error Handling
• Validation
• Authentication
• Authorization
• Logging
• Linting

• SQL database: mySQL object relation mapping using Prisma
• Authentication and authorization: using passport
• Validation: request data validation using Joi
• Logging: using winston and morgan
• Testing: unit and integration tests using Jest
• Error handling: centralized error handling mechanism
• API documentation: with swagger-jsdoc and swagger-ui-express
• Process management: advanced production process management using PM2
• Dependency management: with Yarn
• Environment variables: using dotenv and cross-env
• Security: set security HTTP headers using helmet
• Santizing: sanitize request data against xss and query injection
• CORS: Cross-Origin Resource-Sharing enabled using cors
• Compression: gzip compression with compression
• Linting: with ESLint and Prettier
• Editor config: consistent editor configuration using EditorConfig

Running locally:

npm run dev

Running in production:

npm start

Testing:

# run all tests
npm run test

# run all tests in watch mode
npm run test:watch

# run test coverage
npm run coverage

Linting:

# run ESLint
npm run lint

# fix ESLint errors
npm run lint:fix

# run prettier
npm run prettier

# fix prettier errors
npm run prettier:fix

To run this project, you will need to add the following environment variables to your .env file

# Port number
PORT=3000

# URL of the DB
DATABASE_URL=mysql://Example

# JWT
# JWT secret key
JWT_SECRET=thisisasamplesecret
# Number of minutes after which an access token expires
JWT_ACCESS_EXPIRATION_MINUTES=30
# Number of days after which a refresh token expires
JWT_REFRESH_EXPIRATION_DAYS=30

prisma\
 |--__mocks__       # Mocks Database for Testing
 |--index.js        # Prisma Client
 |--schema.prisma   # Prisma Schema

src\
 |--config\         # Environment variables and configuration related things
 |--controllers\    # Route controllers (controller layer)
 |--docs\           # Swagger files
 |--middlewares\    # Custom express middlewares
 |--routes\         # Routes
 |--services\       # Business logic (service layer)
 |--utils\          # Utility classes and functions
 |--validations\    # Request data validation schemas
 |--app.js          # Express app
 |--index.js        # App entry point

 test\
  |--fixture       # Utils for integration
  |--integration   # Automation Code

To view the list of available APIs and their specifications, run the server and go to http://localhost:3000/api-docs in your browser. This documentation page is automatically generated using the swagger definitions written as comments in the route files.

List of available routes:

User API:
Create User: POST /v1/users
Get All Users: GET /v1/users
Get User by ID: GET /v1/users/{userId}
Update User: PUT /v1/users/{userId}
Delete User: DELETE /v1/users/{userId}

Auth API:
User Login: POST /v1/auth/login
User Logout: POST /v1/auth/logout
User Register: POST /v1/auth/register

Product API:
Create Product: POST /v1/products
Get All Products: GET /v1/products
Get Product by ID: GET /v1/products/{productId}
Update Product: PUT /v1/products/{productId}
Delete Product: DELETE /v1/products/{productId}
Get Products by User: GET /v1/users/{userId}/products

Category API:
Create Category: POST /v1/categories
Get All Categories: GET /v1/categories
Get Category by ID: GET /v1/categories/{categoryId}
Update Category: PUT /v1/categories/{categoryId}
Delete Category: DELETE /v1/categories/{categoryId}

Order API:
Create Order: POST /v1/orders
Get All Orders: GET /v1/orders
Get Order by ID: GET /v1/orders/{orderId}
Update Order: PUT /v1/orders/{orderId}
Delete Order: DELETE /v1/orders/{orderId}
Get Orders by User: GET /v1/users/{orderId}/orders

OrderItem API:
Create OrderItem: POST /v1/order-items
Get All OrderItems: GET /v1/order-items
Get OrderItem by ID: GET /v1/order-items/{orderItemId}
Update OrderItem: PUT /v1/order-items/{orderItemId}
Delete OrderItem: DELETE /v1/order-items/{orderItemId}
Get OrderItems by Order: GET /v1/orders/{orderId}/order-items

The app has a centralized error handling mechanism.

Controllers should try to catch the errors and forward them to the error handling middleware (by calling next(error)). For convenience, you can also wrap the controller inside the catchAsync utility wrapper, which forwards the error.

const catchAsync = require('../utils/catchAsync');

const controller = catchAsync(async (req, res) => {
  // this error will be forwarded to the error handling middleware
  throw new Error('Something wrong happened');
});

The error handling middleware sends an error response, which has the following format:

{
  "status": 404,
  "message": "Not found"
}

When running in development mode, the error response also contains the error stack.

The app has a utility ApiError class to which you can attach a response code and a message, and then throw it from anywhere (catchAsync will catch it).

For example, if you are trying to get a user from the DB who is not found, and you want to send a 404 error, the code should look something like:

const httpStatus = require('http-status');
const ApiError = require('../utils/ApiError');
const prisma = require('../prisma/index');

const getUser = async (userId) => {
  const user = await User.findByUnique(userId);
  if (!user) {
    throw new ApiError(httpStatus.NOT_FOUND, 'User not found');
  }
};

Request data is validated using Joi. Check the documentation for more details on how to write Joi validation schemas.

The validation schemas are defined in the src/validations directory and are used in the routes by providing them as parameters to the validate middleware.

const express = require('express');
const validate = require('../../middlewares/validate');
const userValidation = require('../../validations/user.validation');
const userController = require('../../controllers/user.controller');

const router = express.Router();

router.post('/users', validate(userValidation.createUser), userController.createUser);
```## Authentication

To require authentication for certain routes, you can use the `auth` middleware.

```javascript
const express = require('express');
const auth = require('../../middlewares/auth');
const userController = require('../../controllers/user.controller');

const router = express.Router();

router.post('/users', auth(), userController.createUser);

These routes require a valid JWT access token in the Authorization request header using the Bearer schema. If the request does not contain a valid access token, an Unauthorized (401) error is thrown.

Generating Access Tokens:

An access token can be generated by making a successful call to the register (POST /v1/auth/register) or login (POST /v1/auth/login) endpoints. The response of these endpoints also contains refresh tokens (explained below).

An access token is valid for 30 minutes. You can modify this expiration time by changing the JWT_ACCESS_EXPIRATION_MINUTES environment variable in the .env file.

Refreshing Access Tokens:

After the access token expires, a new access token can be generated, by making a call to the refresh token endpoint (POST /v1/auth/refresh-tokens) and sending along a valid refresh token in the request body. This call returns a new access token and a new refresh token.

A refresh token is valid for 30 days. You can modify this expiration time by changing the JWT_REFRESH_EXPIRATION_DAYS environment variable in the .env file.

Use authorizePermissions middleware to require certain rights/permissions to access a route.

const express = require('express');
const {auth, authorizePermissions} = require('../../middlewares/auth');
const userController = require('../../controllers/user.controller');

const router = express.Router();

router.post('/users', auth(), authorizePermissions('admin'), userController.createUser);

In the example above, an authenticated user can access this route only if that user has the Admin permission.

If the user making the request does not have the required permissions to access this route, a Forbidden (403) error is thrown.

Import the logger from src/config/logger.js. It is using the Winston logging library.

Logging should be done according to the following severity levels (ascending order from most important to least important):

const logger = require('<path to src>/config/logger');

logger.error('message'); // level 0
logger.warn('message'); // level 1
logger.info('message'); // level 2
logger.http('message'); // level 3
logger.verbose('message'); // level 4
logger.debug('message'); // level 5

In development mode, log messages of all severity levels will be printed to the console.

In production mode, only info, warn, and error logs will be printed to the console.
It is up to the server (or process manager) to actually read them from the console and store them in log files.
This app uses pm2 in production mode, which is already configured to store the logs in log files.

Note: API request information (request url, response code, timestamp, etc.) are also automatically logged (using morgan).

Linting is done using ESLint and Prettier.

In this app, ESLint is configured to follow the Airbnb JavaScript style guide with some modifications. It also extends eslint-config-prettier to turn off all rules that are unnecessary or might conflict with Prettier.

To modify the ESLint configuration, update the .eslintrc.json file. To modify the Prettier configuration, update the .prettierrc.json file.

To prevent a certain file or directory from being linted, add it to .eslintignore and .prettierignore.

To maintain a consistent coding style across different IDEs, the project contains .editorconfig