It's time to talk about it... Not
Next, nor Nuxt, but Nest!
For this new project, I chose technologies that are on the rise, in particular PostgreSQL but especially NestJS. So, I gave up my good old database that is MongoDB, in favor of a more traditional database.
NB: I was a little bit rusty at first, but going back to relational database was a real good idea; if only to retrieve data from several tables in one call, unlike NoSQL which requires as many calls as there are documents to query... Finally, SQL is like riding a bike, it's unforgettable 😉
NestJS is a framework for creating high-scalability server applications (powered by NodeJS). This one is based on Typescript and combines three development paradigms:
- The Object Oriented Programming #OOP
- The Functional Programming #FP
- The Functional Reactive Programming #FRP
NestJS starts from the observation that Web frameworks (especially those component-oriented), aren't structured enough... Except one: Angular! So, it's inspired by this last one to provide a complete library for backend developments.
NB: Indeed, Angular has a similar organization, but unlike NestJS, the structure of this one is (in my opinion) more restrictive than anything else... I prefer its counterparts like React and Vue (and Svelte) which offer more flexibility in frontend application design. However, I'm convinced that this "heavy" architecture can be a substantial help to those who are new to frontend development.
Finally, NestJS embeds the ExpressJS engine or that of Fastify (at choice), to deliver a robust and powerful HTTP server. So, you can talk about a framework of frameworks (meta-framework!? 🤔) For this project, I chose to use Fastify which seems more than promising...
It's time to code! 🧑💻 Let's start by installing the main NestJS dependency, then initialize a new project:
npm i -g @nestjs/cli nest new hello-community
So, do you see the similarities with Angular? 🙃 Using the NestJS command line interface, you get an "modules - controllers - services" architecture:
- Controllers are responsible for exposing application routes
- Services handle communication between data sources
- Modules link services with controllers
NB: In addition to initializing the project, the NestJS CLI will allow you to individually scaffold these same files (
nest generate <module|controller|service>). So useful!
Now, let's take a closer look at the
main.ts file, entry point of the application. By default, NestJS will mount an HTTP server based on ExpressJS. But, in my case, I'm gonna need Fastify, which (let's remember) is supposed to be faster and lighter than its counterpart.
To do this, it's necessary to add the
@nestjs/platform-fastify dependency to the project, then adapt the
main.ts file code.
Et voilà ! Just go to
http://localhost:3000, to see your first
Hello World! (or
Hello Community! if you've been curious) 👏
NB: By specifying the
0.0.0.0string as a second parameter of the
listen()function, you'll be able to access your endpoints within the same local network.
It's hard to see a real difference between ExpressJS and Fastify on a simple call. Although... I noticed a small difference when loading. According to Google Chrome, this first
Hello World! loads 239 bytes with ExpressJS, versus 176 bytes via Fastify (confirmed by Mozilla Firefox). It's clear that this framework is (at least) lighter than its predecessor.
Let's make things more interesting / more concrete by implementing your first REST(ful) API. For that, you can use the CLI tool to create files one by one (module / controller / service), or generate the whole set directly (i.e. a new CRUD resource).
nest g resource command does this for you. By typing the resource name (
users) and specifying that it's a REST API, you quickly get a ready-to-use controller and service.
One of benefits of this mode of operation is that NestJS also generates some development patterns, including the well-known DTO (Data Transfer Object) of developers. #OOP
For this first resource, I suggest you to keep the controller as it is (
users.controller.ts), but adapt the service code (
users.service.ts), in order to simulate a data source.
NB: For practical reasons (prevent the size of this post from growing fast), I chose to show the type of my data. In a real case, I advise you to put it in the right places, namely in
Make sure you have registered your
users.module.ts module at the main module level (
app.module.ts), then launch the application (
npm run start). You should be able to start playing with your API via the REST protocol (and Postman of course 😎).
Serious things start here... If you go back quickly, you notice that your endpoints are all reachable with the same level of security (that is to say none). Furthermore, the user's password is directly saved in the database... So, it's necessary to secure all of this!
First step: the password obfuscation. NestJS supports data encryption (with the NodeJS crypto module), but also data hashing. Here, I chose to use the bcrypt library to hash my strings, to guarantee unidirectional (and optimal) security! 👌
Let's install dependencies (
npm i --save bcrypt && npm i --save-dev @types/bcrypt) and modify the user creation service to secure its password.
Second step: securing calls using an authentication protocol. This second task is more complex since it requires the implementation of one or more authentication strategies. Fortunately, NestJS already has a "guard" concept allowing to "validate / invalidate" routes of the application. Let's go!
npm install --save @nestjs/passport passport passport-local passport-jwt npm install --save-dev @types/passport-local @types/passport-jwt
The best way to establish this kind of operation (with NodeJS) is to use Passport. On the design side, I'll have to create a new authentication route that will provide me a token to validate
/users/:id endpoints (GET, PATCH and DELETE). That's why, I recover (above) two strategies:
- The LOCAL strategy, allows simple authentication (based on the
- The JWT strategy, is based on the validity of a token over time
Again, you'll have to use the command line interface to instantiate a module, a controller and a service (
nest g <module|controller|service> auth). Furthermore, you will have to create two new files corresponding to the Passport strategies respectively.
NB: Here, you'll notice that I replaced the default behavior of the LOCAL strategy, to use the
NB: In a real case, I'd advise against exposing the JWT secret! It's better to fetch it in another way, through the file
@nestjs/configmodule can then be useful) or another process...
After all this, some explanations are mandatory. Let’s start with the controller...
When calling the
/login endpoint, the user will "POST" his credentials in
Then, NestJS will protect the route by the LOCAL "guard" which will take care of checking the user presence into the database. If the user with the unique email address is found, the password will then be checked by bcrypt (
If things go well, the
login() function will be played with the information relating to the user (especially the unique identifier and the email) which will be necessary to generate a token with 5 minutes (
Finally, at the endpoint return, you should retrieve a JWT token (
access_token) which will authenticate the other calls of your REST API. To do this, two final things:
- Add the JWT "guard" on the
- Add the
Bearer <token>in the header of the call(s)
Now let's talk about the data part. From now on, you will have to connect to your database (previously installed on your machine:
sudo apt install postgresql), then query it in a REST(ful) way, namely with GET, POST, PATCH, DELETE, etc...
One last time, a difficult choice is required, between:
- The database driver (low level query)
- The "Query Builder" (such as KnexJS)
- The ORM - Object Relational Mapping (high level query)
NB: As an example, with MongoDB, I used to develop with Mongoose (which is an ODM - Object Document Mapper) to query my NoSQL data source. Having made the choice of SQL with Postgres, it will be essential to use a new library...
Don't panic! NestJS is here 🎉 And it already has "connectors" for some libraries, including: Sequelize, TypeORM or even Prisma. I preferred to exclude Sequelize from the challengers list (despite its popularity), since I want to be able to re-use the "chosen one" for future development with NoSQL (I can't live without Mongo 😅). In fact, the only possible choice is none other than Prisma. By the way, I was pleasantly surprised by its concept and its intuitive API! It's time to install this new dependency, and then initialize the database schema.
npm install prisma --save-dev npx prisma init
By executing Prisma's
init command, you should see a new folder appear at the root of your project, with a first draft of the schema. I invite you to complete it as follows:
As explicit as it is, the database schema will allow you to initialize your PostgreSQL database. Clearly, by executing this last one (with the
migrate command), Prisma will transcribe the information above in SQL script, to create your tables (with the right fields and the right types) and add your relations (primary and foreign keys). It will eventually run the query directly into the database.
npx prisma migrate dev --name init
NB: From there, your base is created. You can connect to it and see the result; or take a look at the SQL query present in the
migration.sqlfile (in the
npm i @prisma/client nest g module prisma nest g service prisma
The database is properly created, but you still have to make the link between PostgreSQL (via Prisma) and NestJS. Using the NestJS CLI tool (above), I generated two new files:
One last step: usage! Do you remember your CRUD above? Let's make it evolved! Now, there is no longer any question of simulating your database, let's request it directly. For that, the Prisma API is simply magical! It generates (thanks to the database schema) the types corresponding to
models, and provides you with intuitive functions to query your SQL database. See for yourself the result with functions for creating and retrieving a user.
NB: Don't forget to register your new module (
prisma.module.ts) in the
usersmodule imports, otherwise it's impossible to request your data source...
NB: For practical reasons (prevent the size of this post from growing fast), I present here only two functions present in the service, but you can consult the rest of the code on GitHub.
NestJS is a little nugget of Web development! I had a lot of fun developing this new backend solution in TypeScript. Everything is very well structured. By the way, the CLI is a great help when it comes to scaffold all or part of a REST resource.
Overall, I was pleasantly surprised by its organization, which makes me think of the frameworks such as SpringBoot (for Java) or Django (for Python). The files are stored in their place and you find yourself there. It just goes to show that the MVC pattern is always a safe bet...
NB: In a more objective way, I asked the opinion of another developer specialized in Java, and I assure you, he had no problem to immerse himself in the code (thanks to TypeScript).
Speaking of security, NestJS respects its part of the contract without reinventing things, since it relies mostly on the Passport dependency to consolidate its endpoints. It can also define the HTTP headers security by simply integrating middlewares provided by the Helmet library. The same for encryption and data hashing, these concepts aren't new and exist in other backend frameworks as well.
I didn't talk about unit tests previously, but they are present in this project. NestJS also makes a good choice by "dropping" the Karma / Jasmine pair in favor of Jest. It's very easy to mock Prisma data sources, to focus on controller calls, or on the function of a service.
In the future, I'll not longer hesitate in my choice of technical base for NodeJS, I'll simply opt for NestJS 👍