Secure Enterprise REST API with JWT Auth

Build a production-grade REST API with Node.js, Express, PostgreSQL, Prisma ORM, JWT, and rate limiting.

Build a robust backend API service featuring user authentication, role-based access control (RBAC), database migrations with Prisma, input validation with Zod, and rate-limiting middleware.

Node.jsExpressTypeScriptPostgreSQLPrismaJWTBcrypt

Functional Requirements

User registration and login endpoints with bcrypt password hashing
JWT authentication middleware for protected routes
CRUD endpoints for resource management with pagination and filtering
Database transactions for multi-step financial or inventory updates
Global error handling middleware with standardized JSON error payloads

System Architecture

Frontend: Swagger / OpenAPI Documentation UI

Backend: Node.js + Express with TypeScript

Database: PostgreSQL with Prisma ORM

Auth: JSON Web Tokens (JWT) + Bcrypt

Step-by-Step Implementation

Prisma Schema Modeling

Define User, Role, and Resource entities with relations and indexes in schema.prisma.

prisma

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}
 
generator client {
  provider = "prisma-client-js"
}
 
model User {
  id        String   @id @default(uuid())
  email     String   @unique
  password  String
  role      String   @default("USER")
  createdAt DateTime @default(now())
  posts     Post[]
}
 
model Post {
  id        String   @id @default(uuid())
  title     String
  content   String
  published Boolean  @default(false)
  authorId  String
  author    User     @relation(fields: [authorId], references: [id])
}

Rationale: Prisma generates fully type-safe TypeScript clients based on the declarative data model.

Testing & Quality Guidelines

Write integration tests using Supertest and Jest covering /auth/register and /auth/login.
Verify that unauthenticated requests to protected endpoints return 401 Unauthorized.
Test invalid inputs and verify 400 Bad Request with descriptive validation errors.

Deployment Instructions

Containerize the application with a multi-stage Dockerfile.
Deploy PostgreSQL instance on Supabase, AWS RDS, or Render.
Deploy Docker container to Railway, Render, or AWS ECS.