Mini Project — API Gateway

# WHAT: APIForge gateway project — initialise and install all packages
# Run these commands in your terminal from an empty project folder

mkdir apiforge-gateway && cd apiforge-gateway
npm init -y

# Gateway dependencies
npm install express http-proxy-middleware jsonwebtoken ioredis morgan dotenv

# Dev tooling
npm install --save-dev nodemon

# Create folder structure
mkdir services
touch gateway.js services/projects.js services/users.js services/analytics.js .env

# Project structure when done:
# apiforge-gateway/
# ├── gateway.js          ← the API gateway (port 3000)
# ├── .env                ← JWT_SECRET and REDIS_URL
# ├── services/
# │   ├── projects.js     ← stub Projects Service  (port 3001)
# │   ├── users.js        ← stub Users Service     (port 3002)
# │   └── analytics.js    ← stub Analytics Service (port 3003)
# └── package.json

// WHAT: APIForge stub services — all three files share the same pattern
// File: services/projects.js  (repeat for users.js :3002, analytics.js :3003)

import express from 'express';
const app  = express();
const PORT = 3001; // 3002 for users, 3003 for analytics

app.use(express.json());

// Health check
app.get('/health', (req, res) => {
  res.json({ service: 'projects', status: 'ok', port: PORT });
});

// Main resource endpoint — echoes back the forwarded user info
app.get('/api/projects', (req, res) => {
  res.json({
    service:  'Projects Service',
    port:      PORT,
    user:      req.headers['x-user-id']    || 'unknown',
    email:     req.headers['x-user-email'] || 'unknown',
    data: [
      { id: 'proj_001', name: 'API Gateway Redesign', status: 'active'   },
      { id: 'proj_002', name: 'Auth Service Upgrade',  status: 'active'   },
      { id: 'proj_003', name: 'Rate Limiter v2',       status: 'planning' },
    ],
  });
});

app.listen(PORT, () => {
  console.log(`Projects Service running on port ${PORT}`);
});

// ── services/users.js (port 3002) ───────────────────────────────────────────
// Same pattern, different port and data:
// app.get('/api/users', ...) → returns { service: 'Users Service', port: 3002, ... }

// ── services/analytics.js (port 3003) ──────────────────────────────────────
// app.get('/api/analytics', ...) → returns { service: 'Analytics Service', port: 3003, ... }

// WHAT: APIForge gateway.js — JWT authentication middleware
// File: gateway.js (partial — this is the auth middleware section)
// JWT_SECRET must match the secret used when tokens were originally issued

import express    from 'express';
import jwt        from 'jsonwebtoken';
import 'dotenv/config';

const app = express();

// ── JWT Authentication Middleware ───────────────────────────────────────────
function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token      = authHeader && authHeader.split(' ')[1]; // Extract from "Bearer "

  if (!token) {
    return res.status(401).json({
      error:   'Unauthorized',
      message: 'No token provided. Include Authorization: Bearer  in your request.',
    });
  }

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);

    // Attach decoded user to the request for downstream middleware
    req.user = decoded;

    // Inject user identity as headers so backend services can read them
    // without needing to verify the JWT themselves
    req.headers['x-user-id']    = decoded.userId;
    req.headers['x-user-email'] = decoded.email;
    req.headers['x-user-role']  = decoded.role || 'user';

    // Remove the raw JWT — downstream services do not need it
    delete req.headers['authorization'];

    next();
  } catch (err) {
    const message = err.name === 'TokenExpiredError'
      ? 'Token has expired. Please re-authenticate.'
      : 'Invalid token. Authentication failed.';

    return res.status(401).json({ error: 'Unauthorized', message });
  }
}

// Apply auth to all routes
app.use(authenticateToken);

// WHAT: APIForge gateway.js — Redis rate limiting middleware
// Limit: 100 requests per user per minute
// Redis key format: ratelimit:{userId}:{currentMinute}

import Redis from 'ioredis';

const redis     = new Redis(process.env.REDIS_URL);
const LIMIT     = 100;  // max requests per window
const WINDOW_S  = 60;   // window size in seconds

async function rateLimiter(req, res, next) {
  const userId  = req.user.userId;
  const minute  = Math.floor(Date.now() / 1000 / WINDOW_S); // changes every 60s
  const key     = `ratelimit:${userId}:${minute}`;

  // Increment counter — if key does not exist, Redis creates it starting at 1
  const current = await redis.incr(key);

  // Set TTL only on the first request of the window (when counter was just created)
  if (current === 1) {
    await redis.expire(key, WINDOW_S);
  }

  const remaining = Math.max(0, LIMIT - current);
  const resetAt   = (minute + 1) * WINDOW_S; // unix timestamp of next window

  // Always send rate limit headers so clients can track their own usage
  res.setHeader('X-RateLimit-Limit',     LIMIT);
  res.setHeader('X-RateLimit-Remaining', remaining);
  res.setHeader('X-RateLimit-Reset',     resetAt);

  if (current > LIMIT) {
    return res.status(429).json({
      error:    'Too Many Requests',
      message:  `Rate limit exceeded. You are allowed ${LIMIT} requests per minute.`,
      resetAt:   new Date(resetAt * 1000).toISOString(),
    });
  }

  next();
}

// Apply after auth middleware
app.use(rateLimiter);

// WHAT: Complete gateway.js — full APIForge API Gateway
// Combines: logging → auth → rate limiting → proxy routing
// File: gateway.js

import express              from 'express';
import jwt                  from 'jsonwebtoken';
import Redis                from 'ioredis';
import morgan               from 'morgan';
import { createProxyMiddleware } from 'http-proxy-middleware';
import 'dotenv/config';

const app   = express();
const redis = new Redis(process.env.REDIS_URL);

// ── 1. Structured request logging ──────────────────────────────────────────
morgan.token('user-id', (req) => req.user?.userId || 'unauthenticated');

app.use(morgan(
  ':method :url :status :res[content-length]B :response-time ms user=:user-id',
  { stream: { write: (msg) => console.log('[GATEWAY]', msg.trim()) } }
));

// ── 2. JWT Auth middleware (from Step 3) ────────────────────────────────────
app.use(authenticateToken);   // defined in Step 3

// ── 3. Rate limiter middleware (from Step 4) ────────────────────────────────
app.use(rateLimiter);         // defined in Step 4

// ── 4. Proxy routes ─────────────────────────────────────────────────────────
const proxyOptions = (target) => ({
  target,
  changeOrigin: true,
  on: {
    error: (err, req, res) => {
      console.error(`[GATEWAY] Proxy error → ${target}:`, err.message);
      res.status(502).json({
        error:   'Bad Gateway',
        message: `Upstream service at ${target} is unavailable.`,
      });
    },
    proxyReq: (proxyReq, req) => {
      // Log which service is receiving the request
      console.log(`[GATEWAY] → Proxying to ${target}${req.path}`);
    },
  },
});

// Route /api/projects/* → Projects Service on port 3001
app.use('/api/projects',  createProxyMiddleware(proxyOptions('http://localhost:3001')));

// Route /api/users/* → Users Service on port 3002
app.use('/api/users',     createProxyMiddleware(proxyOptions('http://localhost:3002')));

// Route /api/analytics/* → Analytics Service on port 3003
app.use('/api/analytics', createProxyMiddleware(proxyOptions('http://localhost:3003')));

// Gateway health check — does not require auth
app.get('/health', (req, res) => {
  res.json({ gateway: 'ok', timestamp: new Date().toISOString() });
});

// Catch-all for unknown routes
app.use((req, res) => {
  res.status(404).json({
    error:   'Not Found',
    message: `No route configured for ${req.method} ${req.path}`,
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`[GATEWAY] APIForge API Gateway running on port ${PORT}`);
  console.log(`[GATEWAY] Routes: /api/projects → :3001 | /api/users → :3002 | /api/analytics → :3003`);
});