API REST para la pila MEAN (JWT y Swagger incluido)

....
module.exports.bookFindById = function(req, res) {
    if (req.params && req.params.id) { (1)
        Book
        .findById(req.params.id) (2)
        .exec(
            function(err, book) {
                if (!book) { (3)
                    return res
                    .status(404)
                    .send({"message": "book not found"});
                } else if (err) {
                    return res
                    .status(404)
                    .send(err);
                }
                return res (4)
                .status(200)
                .send(book);
            }
        );
    } else {
        return res
        .status(404)
        .send({"message": "No book in the request"});
    }
};

...
router.get('/id/:id', ctrlBook.bookFindById); (1)
...

localhost:3000/api/id/5abe944733599b27439db885

...
module.exports.bookFindByGenre = function(req, res) {
    if (req.params && req.params.genre) { (1)
        Book
        .find({genre: req.params.genre}) (2)
        .exec(
            function(err, books) {
                if (!books) { (3)
                    return res
                    .status(404)
                    .send({"message": "genre not found"});
                } else if (err) {
                    return res
                    .status(404)
                    .send(err);
                }
                return res (4)
                .status(200)
                .send(books);
            }
        );
    } else {
        return res
        .status(404)
        .send({"message": "No `genre` in request"});
    }
};
...

...
router.get('/genre/:genre', ctrlBook.bookFindByGenre);
...

localhost:3000/api/genre/Historia

....
module.exports.bookCreate = function(req, res) {
    Book
    .create({ (1)
        title: req.body.title, (2)
        genre: req.body.genre,
        description: req.body.description,
        author: req.body.author,
        publisher: req.body.publisher,
        pages: req.body.pages,
        image_url: req.body.image_url
    },function(err, book) {
        if (err) { (3)
            return res
            .status(400)
            .send(err);
        }
        return res (4)
        .status(201)
        .send(book);
    });
};
...

...
router.post('/book', ctrlBook.bookCreate);
...

...
module.exports.bookDelete = function(req, res) {
    if (req.params && req.params.id) { (1)
        Book
        .findByIdAndDelete(req.params.id) (2)
        .exec(
            function(err, book) {
                if (err) { (3)
                    return res
                    .status(400)
                    .send(err);
                }
                return res (4)
                .status(204)
                .send(null);
            }
        );
    } else {
        return res
        .status(404)
        .send({"message": "No id in the request"});
    }
};
...

....
router.delete('/book/:id', ctrlBook.bookDelete);
....

...
module.exports.bookUpdate = function(req, res) {
    if (req.params && req.params.id) { (1)
        Book
        .findById(req.params.id) (2)
        .exec(
            function(err, book) {
                if (!book) { (3)
                    return res
                    .status(404)
                    .send({"message": "no book found"});
                } else {
                    if (req.body.title) { (4)
                        book.title = req.body.title;
                    }
                    if (req.body.genre) {
                        book.genre = req.body.genre;
                    }
                    if (req.body.description) {
                        book.description = req.body.description;
                    }
                    if (req.body.author) {
                        book.author = req.body.author;
                    }
                    if (req.body.publisher) {
                        book.publisher = req.body.publisher;
                    }
                    if (req.body.pages) {
                        book.pages = req.body.pages;
                    }
                    if (req.body.image_url) {
                        book.image_url = req.body.image_url;
                    }
                    book.save(function (err, book) { (5)
                        if (err) { (6)
                            return res
                            .status(404)
                            .send(err);
                        }
                        else {
                            return res (7)
                            .status(200)
                            .send(book);
                        }
                    });
                }
            }
        );
    } else {
        return res
        .status(404)
        .send({"message": "No id in the request"});
    }
};
...

...
router.put('/book/:id', ctrlBook.bookUpdate);
...

$ npm install jsonwebtoken --save

$ npm install moment --save

module.exports = {
    TOKEN_SECRET: process.env.TOKEN_SECRET || "password"
  };

var jwt = require('jsonwebtoken'); (1)
var moment = require('moment'); (2)
var config = require('../config'); (3)

exports.createToken = function(user) { (4)
  var payload = {
    sub: user, (5)
    iat: moment().unix(), (6)
    exp: moment().add(2, "minutes").unix(), (7)
  };
  return jwt.sign(payload, config.TOKEN_SECRET); (8)
};

var mongoose = require('mongoose');
var User = mongoose.model('User');
var service = require('../service'); (1)

module.exports.signup = function(req, res) { (2)
  User
  .create({username: req.body.username, password: req.body.password}, function(err, user) { (3)
    if (err) {
      return res.status(400).send(err); (4)
    }
    return res
    .status(200)
    .send({token: service.createToken(req.body.username)}); (5)
  });
};

module.exports.login = function(req, res) { (6)
  if (req.body.username && req.body.password) {
    User
    .count({username: req.body.username, password: req.body.password}) (7)
    .exec(function(err, user) {
      if (!user) {
        return res.status(401).send({"message": "Invalid user and/or password"}); (8)
      } else if (err) {
        return res.status(404).send(err); (9)
      }
      return res
      .status(200)
      .send({token: service.createToken(req.body.username)}); (10)
    });
  } else {
    return res.status(401).send({"message": "Invalid user and/or password"}); (11)
  }
};

var jwt = require('jsonwebtoken'); (1)
var moment = require('moment');
var config = require('../config');

exports.ensureAuthenticated = function(req, res, next) {
  if(!req.headers.authorization) { (2)
    return res
    .status(403)
    .send({message: "Petición sin cabecera de autorización"});
  }

  var token = req.headers.authorization.split(" ")[1]; (3)
  var payload = jwt.verify(token, config.TOKEN_SECRET, function(err, payload) {
    if (err) {
      switch (err.name) { (4)
        case 'JsonWebTokenError':
          return res.status(401).send({message: "Signatura incorrecta"});
        case 'TokenExpiredError':
          return res.status(401).send({message: "Token caducado"});
        default:
          return res.status(401).send(err);
      }
    }
    req.user = payload.sub; (5)
    next(); (6)
  });
}

var express = require('express');
var router = express.Router();

var middleware = require('../controllers/middleware'); (1)
var ctrlAuth = require('../controllers/auth'); (2)
var ctrlBook = require('../controllers/book'); (3)

router.get('/', middleware.ensureAuthenticated, ctrlBook.bookList); (4)
router.get('/book/:id', middleware.ensureAuthenticated, ctrlBook.bookFindById);
router.get('/genre/:genre', middleware.ensureAuthenticated, ctrlBook.bookFindByGenre);

router.post('/book', middleware.ensureAuthenticated, ctrlBook.bookCreate);
router.delete('/book/:id', middleware.ensureAuthenticated, ctrlBook.bookDelete);
router.put('/book/:id', middleware.ensureAuthenticated, ctrlBook.bookUpdate);

// Rutas de registro y login
router.post('/auth/signup', ctrlAuth.emailSignup); (5)
router.post('/auth/login', ctrlAuth.emailLogin);

module.exports = router;

$ npm install swagger-ui-express --save

{
  "swagger" : "2.0",
  "info" : {
    "description" : "API REST de Bookstore\n",
    "version" : "1.0.0",
    "title" : "Bookstore REST API",
    "termsOfService" : "http://swagger.io/terms/",
    "contact" : {
      "email" : "mtorres@ual.es"
    },
    "license" : {
      "name" : "Apache 2.0",
      "url" : "http://www.apache.org/licenses/LICENSE-2.0.html"
    }
  },
...
  "schemes" : [ "https", "http" ],
  "paths" : {
    "/book/{id}" : {
      "get" : {
        "tags" : [ "book" ],
        "summary" : "Obtener libro por id",
        "operationId" : "bookFindById",
        "produces" : [ "application/json" ],
        "parameters" : [ {
          "name" : "id",
          "in" : "path",
          "description" : "El id del libro a recuperar. Use xxx para pruebas.",
          "required" : true,
          "type" : "string"
        } ],
        "responses" : {
          "200" : {
            "description" : "Operación correcta",
            "schema" : {
              "$ref" : "#/definitions/Book"
            }
          },
          "400" : {
            "description" : "id inválido"
          },
          "404" : {
            "description" : "Libro no encontrado"
          }
        }
      },
...