Créer une API REST avec Node.js, Express et MySQL (JWT, validation, erreurs)

mkdir task-api && cd task-api
npm init -y
npm install express mysql2 jsonwebtoken bcryptjs zod helmet cors express-rate-limit

{
  "type": "module",
  "scripts": {
    "dev": "node --watch --env-file=.env src/server.js",
    "start": "node --env-file=.env src/server.js",
    "db:init": "node --env-file=.env src/db/init.js"
  },
  "engines": { "node": ">=22" }
}

PORT=3000
DB_HOST=127.0.0.1
DB_PORT=3306
DB_USER=taskapi
DB_PASSWORD=motdepasse-fort
DB_NAME=taskapi
JWT_SECRET=remplace-moi-par-une-longue-chaine-aleatoire
JWT_EXPIRES_IN=1h
CORS_ORIGIN=http://localhost:5173

import { z } from 'zod';

// On valide les variables d'environnement au démarrage : si une manque, l'API refuse de démarrer.
const schema = z.object({
  PORT: z.coerce.number().default(3000),
  DB_HOST: z.string().default('127.0.0.1'),
  DB_PORT: z.coerce.number().default(3306),
  DB_USER: z.string(),
  DB_PASSWORD: z.string(),
  DB_NAME: z.string(),
  JWT_SECRET: z.string().min(32, 'JWT_SECRET doit contenir au moins 32 caractères'),
  JWT_EXPIRES_IN: z.string().default('1h'),
  CORS_ORIGIN: z.string().default('*'),
});

const resultat = schema.safeParse(process.env);
if (!resultat.success) {
  console.error('❌ Configuration invalide :', z.flattenError(resultat.error).fieldErrors);
  process.exit(1);
}

export const env = resultat.data;

CREATE DATABASE taskapi CHARACTER SET utf8mb4;
CREATE USER 'taskapi'@'localhost' IDENTIFIED BY 'motdepasse-fort';
GRANT ALL PRIVILEGES ON taskapi.* TO 'taskapi'@'localhost';

CREATE TABLE IF NOT EXISTS users (
  id            INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  email         VARCHAR(255) NOT NULL UNIQUE,
  password_hash VARCHAR(255) NOT NULL,
  name          VARCHAR(100) NOT NULL,
  created_at    TIMESTAMP DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE IF NOT EXISTS tasks (
  id          INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  user_id     INT UNSIGNED NOT NULL,
  title       VARCHAR(150) NOT NULL,
  description TEXT NULL,
  status      ENUM('a_faire', 'en_cours', 'terminee') NOT NULL DEFAULT 'a_faire',
  due_date    DATE NULL,
  created_at  TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  updated_at  TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  CONSTRAINT fk_tasks_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
  INDEX idx_tasks_user_status (user_id, status)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

import { readFile } from 'node:fs/promises';
import mysql from 'mysql2/promise';
import { env } from '../config/env.js';

const sql = await readFile(new URL('./schema.sql', import.meta.url), 'utf8');
const connexion = await mysql.createConnection({
  host: env.DB_HOST, port: env.DB_PORT, user: env.DB_USER,
  password: env.DB_PASSWORD, database: env.DB_NAME, multipleStatements: true,
});
await connexion.query(sql);
await connexion.end();
console.log('✅ Tables créées');

import mysql from 'mysql2/promise';
import { env } from '../config/env.js';

// Un « pool » réutilise les connexions au lieu d'en ouvrir une par requête.
export const pool = mysql.createPool({
  host: env.DB_HOST,
  port: env.DB_PORT,
  user: env.DB_USER,
  password: env.DB_PASSWORD,
  database: env.DB_NAME,
  connectionLimit: 10,
  namedPlaceholders: true,
  dateStrings: true,          // renvoie les dates telles quelles ("2026-09-30"), sans décalage horaire
});

// Une erreur « prévue » : on connaît son code HTTP et son message est affichable au client.
export class AppError extends Error {
  constructor(statusCode, message, details) {
    super(message);
    this.statusCode = statusCode;
    this.details = details;
  }
}

import { AppError } from '../utils/AppError.js';

export function notFound(req, res, next) {
  next(new AppError(404, `Route introuvable : ${req.method} ${req.originalUrl}`));
}

// Les middlewares d'erreur ont 4 paramètres : c'est ainsi qu'Express les reconnaît.
export function errorHandler(err, req, res, next) {
  // JSON mal formé envoyé par le client
  if (err.type === 'entity.parse.failed') {
    return res.status(400).json({ error: { message: 'JSON invalide' } });
  }
  // Doublon MySQL (ex. : e-mail déjà utilisé)
  if (err.code === 'ER_DUP_ENTRY') {
    return res.status(409).json({ error: { message: 'Cette ressource existe déjà' } });
  }
  if (err instanceof AppError) {
    return res.status(err.statusCode).json({
      error: { message: err.message, ...(err.details && { details: err.details }) },
    });
  }

  // Erreur inattendue : on la journalise, mais on ne divulgue rien au client.
  console.error(err);
  res.status(500).json({ error: { message: 'Erreur interne du serveur' } });
}

import { z } from 'zod';

export const registerSchema = z.object({
  name: z.string().trim().min(2, 'Au moins 2 caractères').max(100),
  email: z.email('E-mail invalide').toLowerCase(),
  password: z.string().min(8, 'Au moins 8 caractères').max(72),
});

export const loginSchema = z.object({
  email: z.email('E-mail invalide').toLowerCase(),
  password: z.string().min(1, 'Mot de passe requis'),
});

import { z } from 'zod';

const statut = z.enum(['a_faire', 'en_cours', 'terminee'], { error: 'Statut inconnu' });

export const idParams = z.object({
  id: z.coerce.number({ error: 'Identifiant invalide' }).int().positive(),
});

// Les champs communs, SANS valeur par défaut
const champsTache = {
  title: z.string().trim().min(1, 'Titre requis').max(150),
  description: z.string().trim().max(5000).nullable(),
  status: statut,
  due_date: z.iso.date('Date au format AAAA-MM-JJ').nullable(),
};

// Création : titre obligatoire, statut « a_faire » par défaut
export const createTaskSchema = z.object({
  ...champsTache,
  description: champsTache.description.optional(),
  status: statut.default('a_faire'),
  due_date: champsTache.due_date.optional(),
});

// Mise à jour partielle (PATCH) : tout est facultatif, mais au moins un champ est requis.
// Pas de valeur par défaut ici, sinon un PATCH { title } remettrait le statut à « a_faire » !
export const updateTaskSchema = z.object(champsTache).partial().refine(
  (data) => Object.keys(data).length > 0,
  { message: 'Aucun champ à modifier' },
);

export const listQuery = z.object({
  status: statut.optional(),
  page: z.coerce.number().int().min(1).default(1),
  limit: z.coerce.number().int().min(1).max(100).default(20),
});

import { z } from 'zod';
import { AppError } from '../utils/AppError.js';

// Utilisation : validate({ body: schema, params: schema, query: schema })
export const validate = (schemas) => (req, res, next) => {
  for (const cle of ['params', 'query', 'body']) {
    if (!schemas[cle]) continue;

    const resultat = schemas[cle].safeParse(req[cle] ?? {});
    if (!resultat.success) {
      const { formErrors, fieldErrors } = z.flattenError(resultat.error);
      const details = formErrors.length ? { ...fieldErrors, general: formErrors } : fieldErrors;
      throw new AppError(422, 'Données invalides', details);
    }
    // En Express 5, req.query est en lecture seule : on range les données validées dans req.valid.
    req.valid = { ...req.valid, [cle]: resultat.data };
  }
  next();
};

import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import { pool } from '../db/pool.js';
import { env } from '../config/env.js';
import { AppError } from '../utils/AppError.js';

const creerJeton = (user) =>
  jwt.sign({ sub: String(user.id), email: user.email }, env.JWT_SECRET, { expiresIn: env.JWT_EXPIRES_IN });

export async function register(req, res) {
  const { name, email, password } = req.valid.body;
  const hash = await bcrypt.hash(password, 12);

  const [resultat] = await pool.execute(
    'INSERT INTO users (name, email, password_hash) VALUES (:name, :email, :hash)',
    { name, email, hash },
  );

  const user = { id: resultat.insertId, name, email };
  res.status(201).json({ user, token: creerJeton(user) });
}

export async function login(req, res) {
  const { email, password } = req.valid.body;
  const [lignes] = await pool.execute('SELECT * FROM users WHERE email = :email', { email });
  const user = lignes[0];

  // Même message dans les deux cas : on ne révèle pas si l'e-mail existe.
  const valide = user && (await bcrypt.compare(password, user.password_hash));
  if (!valide) throw new AppError(401, 'Identifiants incorrects');

  res.json({ user: { id: user.id, name: user.name, email: user.email }, token: creerJeton(user) });
}

export async function me(req, res) {
  const [lignes] = await pool.execute(
    'SELECT id, name, email, created_at FROM users WHERE id = :id', { id: req.user.id },
  );
  if (!lignes[0]) throw new AppError(404, 'Utilisateur introuvable');
  res.json({ user: lignes[0] });
}

import jwt from 'jsonwebtoken';
import { env } from '../config/env.js';
import { AppError } from '../utils/AppError.js';

export function requireAuth(req, res, next) {
  const entete = req.headers.authorization ?? '';
  const [type, token] = entete.split(' ');

  if (type !== 'Bearer' || !token) {
    throw new AppError(401, 'Authentification requise');
  }

  try {
    const payload = jwt.verify(token, env.JWT_SECRET);
    req.user = { id: Number(payload.sub), email: payload.email };
    next();
  } catch {
    throw new AppError(401, 'Jeton invalide ou expiré');
  }
}

import { pool } from '../db/pool.js';
import { AppError } from '../utils/AppError.js';

const COLONNES = ['title', 'description', 'status', 'due_date'];

async function trouverTache(id, userId) {
  const [lignes] = await pool.execute(
    'SELECT * FROM tasks WHERE id = :id AND user_id = :userId', { id, userId },
  );
  if (!lignes[0]) throw new AppError(404, 'Tâche introuvable');
  return lignes[0];
}

export async function list(req, res) {
  const { status, page, limit } = req.valid.query;
  const filtres = { userId: req.user.id, limit, offset: (page - 1) * limit };
  const condition = status ? 'AND status = :status' : '';
  if (status) filtres.status = status;

  const [taches] = await pool.query(
    `SELECT * FROM tasks WHERE user_id = :userId ${condition}
     ORDER BY created_at DESC LIMIT :limit OFFSET :offset`, filtres,
  );
  const [[{ total }]] = await pool.query(
    `SELECT COUNT(*) AS total FROM tasks WHERE user_id = :userId ${condition}`, filtres,
  );
  res.json({ data: taches, meta: { page, limit, total } });
}

export async function getOne(req, res) {
  res.json({ data: await trouverTache(req.valid.params.id, req.user.id) });
}

export async function create(req, res) {
  const { title, description = null, status, due_date = null } = req.valid.body;
  const [resultat] = await pool.execute(
    `INSERT INTO tasks (user_id, title, description, status, due_date)
     VALUES (:userId, :title, :description, :status, :due_date)`,
    { userId: req.user.id, title, description, status, due_date },
  );
  const tache = await trouverTache(resultat.insertId, req.user.id);
  res.status(201).location(`/api/tasks/${tache.id}`).json({ data: tache });
}

export async function update(req, res) {
  const { id } = req.valid.params;
  await trouverTache(id, req.user.id);                      // 404 si elle n'est pas à lui

  // On ne construit la requête qu'avec des colonnes autorisées (liste blanche).
  const champs = Object.keys(req.valid.body).filter((c) => COLONNES.includes(c));
  const set = champs.map((c) => `${c} = :${c}`).join(', ');
  await pool.execute(`UPDATE tasks SET ${set} WHERE id = :id`, { ...req.valid.body, id });

  res.json({ data: await trouverTache(id, req.user.id) });
}

export async function remove(req, res) {
  const [resultat] = await pool.execute(
    'DELETE FROM tasks WHERE id = :id AND user_id = :userId',
    { id: req.valid.params.id, userId: req.user.id },
  );
  if (resultat.affectedRows === 0) throw new AppError(404, 'Tâche introuvable');
  res.status(204).end();
}

import { Router } from 'express';
import rateLimit from 'express-rate-limit';
import * as auth from '../controllers/auth.controller.js';
import { validate } from '../middlewares/validate.js';
import { requireAuth } from '../middlewares/auth.js';
import { registerSchema, loginSchema } from '../schemas/auth.schema.js';

const router = Router();

// 10 tentatives par quart d'heure et par IP : on freine les attaques par force brute.
const limiteur = rateLimit({ windowMs: 15 * 60 * 1000, limit: 10, standardHeaders: 'draft-8', legacyHeaders: false });

router.post('/register', limiteur, validate({ body: registerSchema }), auth.register);
router.post('/login', limiteur, validate({ body: loginSchema }), auth.login);
router.get('/me', requireAuth, auth.me);

export default router;

import { Router } from 'express';
import * as tasks from '../controllers/task.controller.js';
import { validate } from '../middlewares/validate.js';
import { requireAuth } from '../middlewares/auth.js';
import { idParams, createTaskSchema, updateTaskSchema, listQuery } from '../schemas/task.schema.js';

const router = Router();
router.use(requireAuth);                 // toutes les routes de tâches sont protégées

router.get('/', validate({ query: listQuery }), tasks.list);
router.post('/', validate({ body: createTaskSchema }), tasks.create);
router.get('/:id', validate({ params: idParams }), tasks.getOne);
router.patch('/:id', validate({ params: idParams, body: updateTaskSchema }), tasks.update);
router.delete('/:id', validate({ params: idParams }), tasks.remove);

export default router;

import express from 'express';
import helmet from 'helmet';
import cors from 'cors';
import { env } from './config/env.js';
import authRoutes from './routes/auth.routes.js';
import taskRoutes from './routes/task.routes.js';
import { notFound, errorHandler } from './middlewares/errorHandler.js';

export const app = express();

app.use(helmet());                                   // en-têtes de sécurité HTTP
app.use(cors({ origin: env.CORS_ORIGIN }));          // qui a le droit d'appeler l'API
app.use(express.json({ limit: '100kb' }));           // lecture du corps JSON

app.get('/api/health', (req, res) => res.json({ status: 'ok' }));
app.use('/api/auth', authRoutes);
app.use('/api/tasks', taskRoutes);

app.use(notFound);                                   // 404 pour tout le reste
app.use(errorHandler);                               // toujours en dernier

import { app } from './app.js';
import { env } from './config/env.js';
import { pool } from './db/pool.js';

const serveur = app.listen(env.PORT, () => {
  console.log(`🚀 API démarrée sur http://localhost:${env.PORT}`);
});

// Arrêt propre : on termine les requêtes en cours et on ferme les connexions MySQL.
const arreter = () => serveur.close(async () => { await pool.end(); process.exit(0); });
process.on('SIGINT', arreter);
process.on('SIGTERM', arreter);

@base = http://localhost:3000/api
@token = colle-ici-le-jeton-recu-au-login

### Inscription
POST {{base}}/auth/register
Content-Type: application/json

{ "name": "Alice", "email": "alice@exemple.be", "password": "secret123" }

### Connexion
POST {{base}}/auth/login
Content-Type: application/json

{ "email": "alice@exemple.be", "password": "secret123" }

### Créer une tâche
POST {{base}}/tasks
Authorization: Bearer {{token}}
Content-Type: application/json

{ "title": "Écrire le tutoriel", "due_date": "2026-09-30" }

### Mes tâches en cours, page 1
GET {{base}}/tasks?status=en_cours&page=1&limit=10
Authorization: Bearer {{token}}

### Terminer la tâche 1
PATCH {{base}}/tasks/1
Authorization: Bearer {{token}}
Content-Type: application/json

{ "status": "terminee" }