DEV Community: Imo-owo Nabuk

How to implement dynamic Role-based Access Control (RBAC) in Express JS REST API.

Imo-owo Nabuk — Thu, 09 Sep 2021 22:03:46 +0000

In this tutorial, I want to share how to implement dynamic role based access control (RBAC) system in express js (node js) API with Postgres, and Sequelize ORM with ES6+.

There are many resources out there on creating a user account with role field in the user table. The limitation with this is that a user can only have one role at a time.

Some software products such as management systems might require a user to share multiple roles and sometimes have direct permissions to perform an action.

Let's explore how to create a user account with multiple roles and direct permissions for specific actions.

For this implementation, we are going to continue from my previous tutorial on how to set up Express JS REST API, Postgres, and Sequelize ORM with ES6+ with a some tweaks.

Clone this repository for the tutorial.

Let's create util functions for hashing password and json responses. Create utils folder in src folder and add two files: hashing.js & sendResponse.js

In hashing.js, add the following codes:



import crypto from 'crypto';

export const hash = (string) => crypto.createHash('sha256').update(string).digest('base64');

export const hash_compare = (first_item, second_item) => Object.is(first_item, second_item);

Add the following to sendResponse.js:



export const sendErrorResponse = (res, code, errorMessage, e = null) => res.status(code).send({
    status: 'error',
    error: errorMessage,
    e: e?.toString(),
});

export const sendSuccessResponse = (res, code, data, message = 'Successful') => res.status(code).send({
    status: 'success',
    data,
    message,
});

Replace the codes in src/controllers/AuthController.js with



import {Op} from 'sequelize';
import model from '../models';
import {sendErrorResponse, sendSuccessResponse} from "../utils/sendResponse";
import {hash} from "../utils/hashing";

const {User} = model;

export default {
    async signUp(req, res) {
        const {email, password, name, phone} = req.body;
        try {
            let user = await User.findOne({where: {[Op.or]: [{phone}, {email}]}});
            if (user) {
                return sendErrorResponse(res, 422, 'User with that email or phone already exists');
            }
            const settings = {
                notification: {
                    push: true,
                    email: true,
                },
            };
            user = await User.create({
                name,
                email,
                password: hash(password),
                phone,
                settings
            });
            return sendSuccessResponse(res, 201, {
                user: {
                    id: user.id,
                    name: user.name,
                    email: user.email,
                }
            }, 'Account created successfully');
        } catch (e) {
            console.error(e);
            return sendErrorResponse(res, 500, 'Could not perform operation at this time, kindly try again later.', e)
        }
    }
}

In the routes folder, add a file authRouter.js and add the following code:



import express from 'express';
import AuthController from '../controllers/AuthController';

const router = express.Router();

router.post('/register', AuthController.signUp);

export default router;

Replace the code in src/routes/index.js with:



import authRouter from "./authRouter";
import express from "express";
import { sendErrorResponse } from "../utils/sendResponse";

export default (app) => {
    app.use(express.urlencoded({ extended: true }));
    app.use(express.json());

    app.use('/api/v1/auth', authRouter);

    app.all('*', (req, res) => sendErrorResponse(res, 404, 'Route does not exist'));
};

Let's implement the API login. I prefer to persist the token in the database. The benefit of this is that a user will know the devices with active session and can choose to destroy the session. It's the approach used in telegram messaging app.

Run the sequelize command to create the token model and migration
sequelize model:generate --name PersonalAccessToken --attributes name:string,token:string,last_used_at:string,last_ip_address:string

Update the PersonalAccessToken model with the following code:



import { Model } from 'sequelize';

const PROTECTED_ATTRIBUTES = ['token'];

export default (sequelize, DataTypes) => {
  class PersonalAccessToken extends Model {
    toJSON() {
      // hide protected fields
      const attributes = { ...this.get() };
      // eslint-disable-next-line no-restricted-syntax
      for (const a of PROTECTED_ATTRIBUTES) {
        delete attributes[a];
      }
      return attributes;
    }

    /**
     * Helper method for defining associations.
     * This method is not a part of Sequelize lifecycle.
     * The `models/index` file will call this method automatically.
     */
    static associate(models) {
      // define association here
      PersonalAccessToken.belongsTo(models.User, {
        foreignKey: 'user_id',
        as: 'owner',
        onDelete: 'CASCADE',
      });
      models.User.hasMany(PersonalAccessToken, {
        foreignKey: 'user_id',
        as: 'tokens',
        onDelete: 'CASCADE',
      });
    }
  }
  PersonalAccessToken.init({
    user_id: {
      type: DataTypes.INTEGER,
      allowNull: false,
    },
    name: DataTypes.STRING,
    token: {
      type: DataTypes.STRING,
      unique: true,
      allowNull: false,
    },
    last_used_at: DataTypes.DATE,
    last_ip_address: DataTypes.STRING
  }, {
    sequelize,
    modelName: 'PersonalAccessToken',
  });

  return PersonalAccessToken;
};

We just added the associations for the token and the user model and can then create our login controller.

Add this function to the user model before the return statement:




  /**
   * Create a new personal access token for the user.
   *
   * @return Object
   * @param device_name
   */
  User.prototype.newToken = async function newToken(device_name = 'Web FE') {
    const plainTextToken = Random(40);

    const token = await this.createToken({
      name: device_name,
      token: hash(plainTextToken),
    });

    return {
      accessToken: token,
      plainTextToken: `${token.id}|${plainTextToken}`,
    };
  };

Remember to import the hashing utils in the user model. Add a random token generator and import as well. Create src/utils/Random.js and add the code:



import crypto from 'crypto';

export default (length = 6, type = 'alphanumeric') => {
    if (!(length >= 0 && Number.isFinite(length))) {
        throw new TypeError('Expected a `length` to be a non-negative finite number');
    }

    let characters;
    switch (type) {
        case 'numeric':
            characters = '0123456789'.split('');
            break;
        case 'url-safe':
            characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'.split('');
            break;
        case 'alphanumeric':
        default:
            characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'.split('');
            break;
    }

    // Generating entropy is faster than complex math operations, so we use the simplest way
    const characterCount = characters.length;
    const maxValidSelector = (Math.floor(0x10000 / characterCount) * characterCount) - 1; // Using values above this will ruin distribution when using modular division
    const entropyLength = 2 * Math.ceil(1.1 * length); // Generating a bit more than required so chances we need more than one pass will be really low
    let string = '';
    let stringLength = 0;

    while (stringLength < length) { // In case we had many bad values, which may happen for character sets of size above 0x8000 but close to it
        const entropy = crypto.randomBytes(entropyLength);
        let entropyPosition = 0;

        while (entropyPosition < entropyLength && stringLength < length) {
            const entropyValue = entropy.readUInt16LE(entropyPosition);
            entropyPosition += 2;
            if (entropyValue > maxValidSelector) { // Skip values which will ruin distribution when using modular division
                // eslint-disable-next-line no-continue
                continue;
            }

            string += characters[entropyValue % characterCount];
            // eslint-disable-next-line no-plusplus
            stringLength++;
        }
    }

    return string;
};

Let's create login method in the src/controllers/AuthController.js file



    async login(req, res) {
        const { login, password, device_name } = req.body;

        try {
            const user = await User.findOne({ where: { email: login } });

            if (!user) return sendErrorResponse(res, 404, 'Incorrect login credentials. Kindly check and try again');
            const checkPassword = hash_compare(hash(password), user.password);
            if (!checkPassword) {
                return sendErrorResponse(res, 400, 'Incorrect login credentials. Kindly check and try again');
            }

            if (user.status !== 'active') {
                return sendErrorResponse(res, 401, 'Your account has been suspended. Contact admin');
            }

            const token = await user.newToken();
            return sendSuccessResponse(res, 200, {
                token: token.plainTextToken,
                user: {
                    name: user.name,
                    id: user.id,
                    email: user.email,
                },
            }, 'Login successfully');
        } catch (e) {
            console.error(e);
            return sendErrorResponse(res, 500, 'Server error, contact admin to resolve issue', e);
        }
    }

Use postman to test login

With the sign up and login features completed, let's dive into creating models for Roles and Permission. You can later add an endpoint for the user to login of other device, that's beyond the scope of this tutorial.

We are going to create Role, Permission, UserRole, RolePermission and UserPermission models and migrations.

Check repo for models and relationship.

Next, add this static method to PersonalAccessToken model:



 /***
     * Verify the token and retrieve the authenticated user for the incoming request.
     * @param authorizationToken
     * @returns {Promise<{user}>}
     */
    static async findToken(authorizationToken) {
      if (authorizationToken) {
        let accessToken;
        if (!authorizationToken.includes('|')) {
          accessToken = await this.findOne({ where: { token: hash(authorizationToken) }, include: 'owner' });
        } else {
          const [id, kToken] = authorizationToken.split('|', 2);
          const instance = await this.findByPk(id, { include: 'owner' });
          if (instance) {
            accessToken = hash_compare(instance.token, hash(kToken)) ? instance : null;
          }
        }

        if (!accessToken) return { user: null, currentAccessToken: null };

        accessToken.last_used_at = new Date(Date.now());
        await accessToken.save();
        return { user: accessToken.owner, currentAccessToken: accessToken.token };
      }

      return { user: null, currentAccessToken: null };
    }

Let's create a seeder for our default roles and permissions using the command

sequelize seed:generate --name roles-permissions-admin-user

Add the following to the seeder file located at src/database/seeders:



import { hash } from '../../utils/hashing';
import model from '../../models';
import Constants from '../../utils/constants';

const { User, Role, Permission } = model;

export default {
  // eslint-disable-next-line no-unused-vars
  up: async (queryInterface, Sequelize) => {
    /**
     * Add seed commands here.
     *
     * Example:
     * await queryInterface.bulkInsert('People', [{
     *   name: 'John Doe',
     *   isBetaMember: false
     * }], {});
     */
    await Role.bulkCreate([
      { name: Constants.ROLE_SUPER_ADMIN },
      { name: Constants.ROLE_ADMIN },
      { name: Constants.ROLE_MODERATOR },
      { name: Constants.ROLE_AUTHENTICATED },
    ]);

    await Permission.bulkCreate([
      { name: Constants.PERMISSION_VIEW_ADMIN_DASHBOARD },
      { name: Constants.PERMISSION_VIEW_ALL_USERS },
    ]);

    const superAdminUser = await User.create({
      name: 'John Doe',
      email: 'johndoe@node.com',
      password: hash('Password111'),
      phone: '+2348123456789',
    });

    const superAdminRole = await Role.findOne({ where: { name: Constants.ROLE_SUPER_ADMIN } });
    const superAdminPermissions = await Permission.findAll({
      where: {
        name: [
          Constants.PERMISSION_VIEW_ADMIN_DASHBOARD,
          Constants.PERMISSION_VIEW_ALL_USERS,
        ],
      },
    });
    await superAdminUser.addRole(superAdminRole);
    await superAdminRole.addPermissions(superAdminPermissions);
  },

  // eslint-disable-next-line no-unused-vars
  down: async (queryInterface, Sequelize) => {
    /**
     * Add commands to revert seed here.
     *
     * Example:
     * await queryInterface.bulkDelete('People', null, {});
     */
    await Role.destroy();
    await Permission.destroy();
    await User.destroy();
  },
};

Here, we've created a super admin user, default roles and permissions and sync the models.

Update the user model with the following:




  User.prototype.hasRole = async function hasRole(role) {
    if (!role || role === 'undefined') {
      return false;
    }
    const roles = await this.getRoles();
    return !!roles.map(({ name }) => name)
      .includes(role);
  };

  User.prototype.hasPermission = async function hasPermission(permission) {
    if (!permission || permission === 'undefined') {
      return false;
    }
    const permissions = await this.getPermissions();
    return !!permissions.map(({ name }) => name)
      .includes(permission.name);
  };

  User.prototype.hasPermissionThroughRole = async function hasPermissionThroughRole(permission) {
    if (!permission || permission === 'undefined') {
      return false;
    }
    const roles = await this.getRoles();
    // eslint-disable-next-line no-restricted-syntax
    for await (const item of permission.roles) {
      if (roles.filter(role => role.name === item.name).length > 0) {
        return true;
      }
    }
    return false;
  };

  User.prototype.hasPermissionTo = async function hasPermissionTo(permission) {
    if (!permission || permission === 'undefined') {
      return false;
    }
    return await this.hasPermissionThroughRole(permission) || this.hasPermission(permission);
  };

Next, we create a middleware for the route. We are going to create two middleware files, one for basic authentication and another for the permissions.

In the src folder, create another folder called middleware and add Auth.js and canAccess.js files to it.

Paste the following as the content for Auth.js file:



import { sendErrorResponse } from '../utils/sendResponse';
import model from '../models';

const { PersonalAccessToken } = model;

export default async (req, res, next) => {
  try {
    if (!req.headers.authorization) {
      return sendErrorResponse(res, 401, 'Authentication required');
    }

    const bearerToken = req.headers.authorization.split(' ')[1] || req.headers.authorization;

    const { user, currentAccessToken } = await PersonalAccessToken.findToken(bearerToken);

    if (!user) {
      return sendErrorResponse(res, 401, 'Authentication Failed');
    }
    if (user.status !== 'active') return sendErrorResponse(res, 403, 'Your account is either suspended or inactive. Contact admin to re-activate your account.');

    req.currentAccessToken = currentAccessToken;
    req.userData = user;
    next();
  } catch (e) {
    console.error(e);
    return sendErrorResponse(res, 401, 'Authentication Failed', e);
  }
};

and canAccess.js



import { sendErrorResponse } from '../utils/sendResponse';
import model from '../models';

const { Role, Permission } = model;

export default (permission) => async (req, res, next) => {
  const access = await Permission.findOne({
    where: { name: permission },
    include: [{ attributes: ['id', 'name'], model: Role, as: 'roles', through: { attributes: [] } }],
  });
  if (await req.userData.hasPermissionTo(access)) {
    return next();
  }
  console.error('You do not have the authorization to access this.');
  return sendErrorResponse(res, 403, 'You do not have the authorization to access this');
};

Finally, let's add our middlewares to the route by creating an adminRouter.js file in routes folder and add the following:



import express from 'express';
import Auth from '../middlewares/Auth';
import can from '../middlewares/canAccess';
import Constants from '../utils/constants';
import AdminController from "../controllers/AdminController";
import { sendSuccessResponse } from "../utils/sendResponse";

const router = express.Router();

router.get('/users', Auth, can(Constants.PERMISSION_VIEW_ALL_USERS), AdminController.users);
router.get('/dashboard', Auth, can(Constants.PERMISSION_VIEW_ADMIN_DASHBOARD), (req, res) => {
    return sendSuccessResponse(res, 200, '', 'Admin dashboard access allowed.')
});

export default router;

Note, I created an AdminController file and used it in the route. You can organize your code however you want.

The basic thing is that each route has a permission tag and that permission can be assigned to a role or directly to a user for the middleware to allow or deny.

See complete API server codes on github.

The API documention is available here

If you have issues, questions or contribution, kindly do so in the comment section below.

That's how to implement Dynamic Role based Access Control (RBAC) system in Express js (Node js) API. The code is not production ready, you are free to improve on it and use it.
Add logout controller, validation for data, endpoint for creating and assigning roles and permissions and other features your app will need.

Thank you.

Simple steps to Deploy Laravel 5/6/7/8 Website on Shared Hosting

Imo-owo Nabuk — Mon, 01 Mar 2021 18:56:48 +0000

Deploying on cPanel seems tricky because you cannot run `php artisan serve` command there and the index.php file resides in the public folder. If you deploy as is, you will have to visit your site as `domain.tld/public` and that's not workable for SEO and convenience.

Using `git` and `composer`, you can easily deploy your site and manage further updates.

Laravel is best hosted on a VPS or dedicated server but you may not want to pay more for hosting a small project and choose to settle for shared hosting.

Step 1 - Visit https://yourdomain.com/cpanel

Find the terminal icon or search for it and click it.

If the Terminal Icon does not exist, it means your shared account doesn't have "Shell Access" turned on. Ask your Hosting Provider to turn it on for you.

It could also mean that your cPanel version doesn't have the terminal option. Download and use an SSH client but you'll have to enable it on the server. Contact your provider on how to use SSH client.

It will launch the terminal. This is where you will do most of the work.

Check PHP version and ensure it is >= 7.1.3
Check that composer is installed on the server by running the composer command


  composer -V
  // Composer version 1.7.2 2018-08-16 16:57:12

Most cPanel comes with Git pre-installed, if it is not, you might need to ask your hosting provider to have it installed.

Step 2 - Set up the app

Clone the repo to a folder named "project", it should be in /home/username/project


  git clone git@github.com:username/repo.git project

Go to the project folder and install the dependencies


 cd project
 composer install

Create a new MySQL database in cPanel in DATABASES -> MySQL Databases section. take note of the database name, username and password.
copy the .env.example file to .env


 cp .env.example .env

edit the .env file and configure it with your setting

 nano .env

few key settings that is important are


 DB_HOST=localhost
 DB_CONNECTION=mysql
 DB_PORT=3306
 DB_DATABASE=dbname
 DB_USERNAME=dbuser
 DB_PASSWORD=dbuserpass
 APP_ENV=production
 APP_DEBUG=false

Generate the application key

 php artisan key:generate

Run the migrations

 php artisan migrate

If you received an error of "Specified key was too long; maxkey length is 1000 bytes", you need to check this article for the fix. Apply the fix in the repo, then issue "git pull origin master" so that this copy will receive the fix . Then go to PhpMyAdmin, drop all the tables there and try running the migrate command again.

Set the permission of the storage folder so that the web server can write to it

 chmod -R 775 storage

Optimize things up!

 
 php composer dump-autoload
 php artisan config:cache
 php artisan route:cache

Step 2 - Make the app accessible to public

right now, the app is not accessible outside because we placed it under /home/user/app directory. The only folder that is accessible to public is /home/user/public_html but we don't want to place all of our framework files into public_html folder. So what we gonna do is simply make a Symbolic link to our /home/user/app/public folder.

to do this, backup first a copy of the public_html folder

 
 mv public_html public_html_old

create the symlink


 ln -s /home/user/project/public /home/user/public_html

your folder structure should be similar to this


 public_html -> /home/user/project/public public_html_old www -> public_html

Bravo! Your site should be working now.

You can deploy further changes by `git pull`ing the latest version or you using Continuous Deployment integration.

Inspired by Darwin Biler

Setting up Express JS REST API, Postgres, and Sequelize ORM with ES6+

Imo-owo Nabuk — Tue, 02 Feb 2021 10:58:22 +0000

Developing with express js (node js), Postgres and Sequelize ORM has been fun for me. I enjoy working with ORMs such as Sequelize as it aids me in building projects faster and efficiently. I want to share with you how I set up my Express js project with Postgres and Sequelize to code in ES6 and above.

This tutorial assumes you have a fair knowledge of the JavaScript language.

Setup

To begin, install Node JS on your computer. It comes with a package manager which you'll use for command-line operations.

Create a folder where your project will reside, you can give it any name you want. we'll call it node-project
Open your command line and change directory into it.

cd node-project

Initialize a NodeJS application by running the following command:

npm init -y

This will create a package.json file with a basic config. You can manually input the configuration by omitting the -y flag.

Express JS Setup

To install express js, run npm i express on your command line within the project folder.

Create an index.js file.
Add the following codes in the newly created index.js file

const express = require('express');

const app = express();

app.use(express.urlencoded({ extended: true }));
app.use(express.json());

// Create a catch-all route for testing the installation.
app.get('*', (req, res) => res.status(200).send({
  message: 'Hello World!',
}));

const port = 5000;

app.listen(port, () => {
  console.log('App is now running at port ', port)
})

Run node ./index.js on the terminal
Visit http://localhost:5000 on your browser to view your express API server. Any route will display the same welcome message because of the catch-all route we created.

When we make changes, we'll have to kill the process and restart to see the effect. So, we'll install a package that will save us that stress: Nodemon.

Run npm i -D nodemon
Edit scripts in package.json file to look like this:

"scripts": {
    "dev": "nodemon index.js"
  },

Kill your current process and run npm run dev to start the server. Going forward, when you start the server this way, you won't need to restart it to see changes.

The folder structure should look like this:

node-project
├── node_modules
├── index.js
├── package.json
├── package-lock.json

Babel Setup for ES6

To code in ES6 and above, you need to install babel packages,
Run the following command to install the necessary packages for our project:

npm i @babel/core @babel/node @babel/preset-env

Create a .babelrc file in the folder and populate with the following:

{
  "presets": [
    [
      "@babel/preset-env", {
        "targets": {
          "node": "current"
        }
      }
    ]
  ]
}

Edit the package.json file script command to use babel

 "scripts": {
    "dev": "nodemon --exec babel-node index.js"
  },

The package.json file should look like this:

{
  "name": "project",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "dev": "nodemon --exec babel-node index.js"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^4.17.1",
    "@babel/core": "^7.12.10",
    "@babel/node": "^7.12.10",
    "@babel/preset-env": "^7.12.11"
  },
  "devDependencies": {
    "nodemon": "^2.0.7"
  }
}

The index.js file should look like this:

import express from 'express';

const app = express();

app.use(express.urlencoded({ extended: true }));
app.use(express.json());

// Create a catch-all route for testing the installation.
app.get('*', (req, res) => res.status(200).send({
  message: 'Hello World!',
}));

const port = 5000;

app.listen(port, () => {
  console.log('App is now running at port ', port)
})

Restart your server and you are ready to code your node js API with ES6 syntax

Sequelize Setup in Express JS App

We will be using Postgres DB in this tutorial but you can use any DB you are comfortable with such as MySQL, SQLite, etc.

To get started with Sequelize ORM with Postgres, you need a Postgres DB which could be remote or on your local machine. Visit this link to install Postgres on your computer.

To use Sequelize in your node app with Postgres, you can install the Command Line Tool (CLI) package globally on your computer or in the app. You just need to know how to call it.

In this tutorial, we will install it globally and in the project as well.

Run the command to install it locally and globally

npm install -g sequelize-cli

npm install sequelize-cli

Depending on which approach you choose, if globally installed, you will always make the command as sequelize do:something, if local, it'll be ./node_modules/.bin/sequelize inside the project folder.

Install Sequelize and Postgres packages by running the command:

npm i sequelize pg

Install babel to work with sequelize

npm i @babel/register

Create .sequelizerc file and populate with the following configuration

require("@babel/register");

const path = require('path');

module.exports = {
  "config": path.resolve('./src/config', 'config.json'),
  "models-path": path.resolve('./src/models'),
  "seeders-path": path.resolve('./src/database/seeders'),
  "migrations-path": path.resolve('./src/database/migrations')
};

The sequelizerc file contains how the folders for Sequelize will be organized. If you don't have it, it'll still work but everything will be placed in the root folder. The configuration will be in src/config, Sequelize models will reside in src/models folder, while seeders file and migration will be in src/database folder.

Next, we initialize Sequelize in the project.

sequelize init

The command creates the necessary folders and files for Sequelize ORM.

If you look at src/models/index.js, it is not written in ES6. Let's refactor that and it'll become:

import fs from 'fs';
import path from 'path';
import Sequelize from 'sequelize';
import enVariables from '../config/config.json';

const basename = path.basename(__filename);
const env = process.env.NODE_ENV || 'development';
const config = enVariables[env];
const db = {};

let sequelize;
if (config.use_env_variable) {
  sequelize = new Sequelize(process.env[config.use_env_variable], config);
} else {
  sequelize = new Sequelize(config.database, config.username, config.password, config);
}

fs
  .readdirSync(__dirname)
  .filter(file => (file.indexOf('.') !== 0) && (file !== basename) && (file.slice(-3) === '.js'))
  .forEach(file => {
    // eslint-disable-next-line global-require,import/no-dynamic-require
    const model = require(path.join(__dirname, file)).default(sequelize, Sequelize.DataTypes);
    db[model.name] = model;
  });

Object.keys(db).forEach(modelName => {
  if (db[modelName].associate) {
    db[modelName].associate(db);
  }
});

db.sequelize = sequelize;
db.Sequelize = Sequelize;

export default db;

Create a DB and update the config/config.json file accordingly:

{
  "development": {
    "username": "postgres",
    "password": "password",
    "database": "node-project",
    "port": "5434",
    "host": "127.0.0.1",
    "dialect": "postgres"

  },
  "test": {
    "username": "root",
    "password": null,
    "database": "database_test",
    "host": "127.0.0.1",
    "dialect": "postgres"
  },
  "production": {
    "username": "root",
    "password": null,
    "database": "database_production",
    "host": "127.0.0.1",
    "dialect": "postgres"
  }
}

All is now set to create models and migration.

Let's create a model and migration for users.

Run the command:

sequelize model:generate --name User --attributes name:string,email:string,phone:string,password:string,status:string,last_login_at:date,last_ip_address:string

This command creates a User model and migration table in the corresponding folders. The attributes are the fields we want to have on the table.

The user model looks like this:

'use strict';
const {
  Model
} = require('sequelize');
module.exports = (sequelize, DataTypes) => {
  class User extends Model {
    /**
     * Helper method for defining associations.
     * This method is not a part of Sequelize lifecycle.
     * The `models/index` file will call this method automatically.
     */
    static associate(models) {
      // define association here
    }
  };
  User.init({
    name: DataTypes.STRING,
    email: DataTypes.STRING,
    phone: DataTypes.STRING,
    password: DataTypes.STRING,
    status: DataTypes.STRING,
    last_login_at: DataTypes.DATE,
    last_ip_address: DataTypes.STRING
  }, {
    sequelize,
    modelName: 'User',
  });
  return User;
};

And migrations like this:

'use strict';
module.exports = {
  up: async (queryInterface, Sequelize) => {
    await queryInterface.createTable('Users', {
      id: {
        allowNull: false,
        autoIncrement: true,
        primaryKey: true,
        type: Sequelize.INTEGER
      },
      name: {
        type: Sequelize.STRING
      },
      email: {
        type: Sequelize.STRING
      },
      phone: {
        type: Sequelize.STRING
      },
      password: {
        type: Sequelize.STRING
      },
      status: {
        type: Sequelize.STRING
      },
      last_login_at: {
        type: Sequelize.DATE
      },
      last_ip_address: {
        type: Sequelize.STRING
      },
      createdAt: {
        allowNull: false,
        type: Sequelize.DATE
      },
      updatedAt: {
        allowNull: false,
        type: Sequelize.DATE
      }
    });
  },
  down: async (queryInterface, Sequelize) => {
    await queryInterface.dropTable('Users');
  }
};

Let's refactor the generated migration and model to:

import { Model } from 'sequelize';

export default (sequelize, DataTypes) => {
  class User extends Model {
    /**
     * Helper method for defining associations.
     * This method is not a part of Sequelize lifecycle.
     * The `models/index` file will call this method automatically.
     */
    static associate(models) {
      // define association here
    }
  };
  User.init({
    name: DataTypes.STRING,
    email: DataTypes.STRING,
    phone: DataTypes.STRING,
    password: DataTypes.STRING,
    status: DataTypes.STRING,
    last_login_at: DataTypes.DATE,
    last_ip_address: DataTypes.STRING
  }, {
    sequelize,
    modelName: 'User',
  });
  return User;
};

and

export default {
  up: async (queryInterface, Sequelize) => {
    await queryInterface.createTable('Users', {
      id: {
        allowNull: false,
        autoIncrement: true,
        primaryKey: true,
        type: Sequelize.INTEGER
      },
      name: {
        type: Sequelize.STRING
      },
      email: {
        type: Sequelize.STRING
      },
      phone: {
        type: Sequelize.STRING
      },
      password: {
        type: Sequelize.STRING
      },
      status: {
        type: Sequelize.STRING
      },
      last_login_at: {
        type: Sequelize.DATE
      },
      last_ip_address: {
        type: Sequelize.STRING
      },
      createdAt: {
        allowNull: false,
        type: Sequelize.DATE
      },
      updatedAt: {
        allowNull: false,
        type: Sequelize.DATE
      }
    });
  },
  down: async (queryInterface, Sequelize) => {
    await queryInterface.dropTable('Users');
  }
};

I like renaming the model name to use uppercase first and in some cases camel case.

Since it's a user model we created and we have some protected fields, I'll quickly add a method to hide the fields on JSON response.

Let's add some validations to the fields for user authentication with node js (express js).

The model and migration will now look like this:

import { Model } from 'sequelize';

const PROTECTED_ATTRIBUTES = ['password'];

export default (sequelize, DataTypes) => {
  class User extends Model {
    toJSON() {
      // hide protected fields
      const attributes = { ...this.get() };
      // eslint-disable-next-line no-restricted-syntax
      for (const a of PROTECTED_ATTRIBUTES) {
        delete attributes[a];
      }
      return attributes;
    }
    /**
     * Helper method for defining associations.
     * This method is not a part of Sequelize lifecycle.
     * The `models/index` file will call this method automatically.
     */
    static associate(models) {
      // define association here
    }
  };
  User.init({
    name: DataTypes.STRING,
    email: {
      type: DataTypes.STRING,
      allowNull: {
        args: false,
        msg: 'Please enter your email address',
      },
      unique: {
        args: true,
        msg: 'Email already exists',
      },
      validate: {
        isEmail: {
          args: true,
          msg: 'Please enter a valid email address',
        },
      },
    },
    phone: {
      type: DataTypes.STRING,
      unique: true,
    },
    password: DataTypes.STRING,
    status: DataTypes.STRING,
    last_login_at: DataTypes.DATE,
    last_ip_address: DataTypes.STRING
  }, {
    sequelize,
    modelName: 'User',
  });
  return User;
};

and

export default {
  up: async (queryInterface, Sequelize) => {
    await queryInterface.createTable('Users', {
      id: {
        allowNull: false,
        autoIncrement: true,
        primaryKey: true,
        type: Sequelize.INTEGER
      },
      name: {
        type: Sequelize.STRING
      },
      email: {
        allowNull: false,
        unique: true,
        type: Sequelize.STRING,
      },
      phone: {
        type: Sequelize.STRING,
        unique: true,
      },
      password: {
        type: Sequelize.STRING
      },
      status: {
        type: Sequelize.STRING
      },
      last_login_at: {
        type: Sequelize.DATE
      },
      last_ip_address: {
        type: Sequelize.STRING
      },
      createdAt: {
        allowNull: false,
        type: Sequelize.DATE
      },
      updatedAt: {
        allowNull: false,
        type: Sequelize.DATE
      }
    });
  },
  down: async (queryInterface, Sequelize) => {
    await queryInterface.dropTable('Users');
  }
};

We have to refactor any model and migration we create in the future to look like this.

Next, we run the migration to create the DB tables:

sequelize db:migrate

Our database is now created.

Route and Controllers

Let's create route and controllers to be able to interact with our database.

Create a controllers folder in src and add AuthController.js file to it. That's where our user management logic will reside.

Add the following code to create user sign up controller logic:

import { Op } from 'sequelize';
import model from '../models';

const { User } = model;

export default {
  async signUp(req, res) {
    const {email, password, name, phone} = req.body;
    try {
      const user = await User.findOne({where: {[Op.or]: [ {phone}, {email} ]}});
      if(user) {
        return res.status(422)
        .send({message: 'User with that email or phone already exists'});
      }

      await User.create({
        name,
        email,
        password,
        phone,
      });
      return res.status(201).send({message: 'Account created successfully'});
    } catch(e) {
      console.log(e);
      return res.status(500)
      .send(
        {message: 'Could not perform operation at this time, kindly try again later.'});
    }
  }
}

Ideally, you will have to encrypt (hash) the user's password before storing it in the DB.

Create the route folder with index.js file inside and add the following code:

import AuthController from '../controllers/AuthController'

export default (app) => {
  app.post('/register', AuthController.signUp);

// Create a catch-all route for testing the installation.
app.all('*', (req, res) => res.status(200).send({
  message: 'Hello World!',
}));
};

Notice that we have transferred the first route we created here.
Our top level index.js file will now look like this:

import express from 'express';
import route from './src/routes'

const app = express();

app.use(express.urlencoded({ extended: true }));
app.use(express.json());

route(app);

const port = 5000;

app.listen(port, () => {
  console.log('App is now running at port ', port)
})

Restart the server and use postman to test the API.

That's basically how I setup Express JS REST API, Postgres, and Sequelize ORM with ES6+.

See the code on github here.

If you have any concerns, kindly raise them in the comment section below.

I wrote this tutorial as a foundation for an article I want to publish on how to implement dynamic Role-based Access Control (RBAC) in Express JS where an admin can assign multiple roles to a user and a role can have multiple permissions.

Update: How to implement dynamic Role-based Access Control (RBAC) in Express JS REST API