Middleware

LeadSmart API uses Express.js middleware for request processing, authentication, error handling, and more. This document outlines the middleware components used in the application.

Authentication Middleware

JWT Authentication

File: src/middlewares/auth.middleware.ts

Validates JSON Web Tokens (JWT) in request headers and attaches the authenticated user to the request object.

Functionality:

Extracts JWT from Authorization header

Verifies token signature and expiration

Attaches decoded user information to request object

Handles token validation errors

Usage:

Role-Based Access Control

File: src/middlewares/roleCheck.middleware.ts

Verifies that the authenticated user has the required role to access a resource.

Functionality:

Checks user role against required roles

Returns 403 Forbidden if user lacks required permissions

Supports multiple role requirements

Usage:

Company Membership Check

File: src/middlewares/companyMembership.middleware.ts

Verifies that the authenticated user is a member of the specified company.

Functionality:

Extracts company ID from request parameters

Checks if user is a member of the company

Returns 403 Forbidden if user is not a member

Usage:

Request Processing

Request Validation

File: src/middlewares/validation.middleware.ts

Validates request data against Zod schemas.

Functionality:

Validates request body, query parameters, and URL parameters

Returns 400 Bad Request with validation errors

Sanitizes and transforms data based on schema

Usage:

Rate Limiting

File: src/middlewares/rateLimit.middleware.ts

Limits the number of requests that can be made to specific endpoints.

Functionality:

Tracks request counts by IP address or user ID

Enforces configurable rate limits

Returns 429 Too Many Requests when limit is exceeded

Usage:

Error Handling

Global Error Handler

File: src/middlewares/errorHandler.middleware.ts

Centralized error handling middleware that processes all errors thrown in the application.

Functionality:

Catches all errors that occur during request processing

Formats errors into a standardized response format

Maps specific error types to appropriate HTTP status codes

Handles Sequelize database errors

Provides detailed error information in development environment

Implementation:

Usage:

Security Middleware

CORS Configuration

File: src/configs/app.ts

Configures Cross-Origin Resource Sharing (CORS) policies.

Functionality:

Specifies allowed origins, methods, and headers

Handles preflight requests

Sets appropriate security headers

Implementation:

Helmet Security Headers

File: src/configs/app.ts

Sets various HTTP headers to enhance security.

Functionality:

Prevents common web vulnerabilities

Configures Content Security Policy

Sets XSS protection headers

Prevents clickjacking attacks

Implementation:

Logging Middleware

Request Logging

File: src/middlewares/logger.middleware.ts

Logs information about incoming requests and their responses.

Functionality:

Logs request method, URL, and timing

Logs response status code

Captures request and response size

Includes user ID for authenticated requests

Implementation:

Middleware Registration

Middleware is registered in the Express application in src/configs/app.ts:

Creating Custom Middleware

Custom middleware functions in LeadSmart API follow this pattern:

Authentication Middleware#

JWT Authentication#

Role-Based Access Control#

Company Membership Check#

Request Processing#

Request Validation#

Rate Limiting#

Error Handling#

Global Error Handler#

Security Middleware#

CORS Configuration#

Helmet Security Headers#

Logging Middleware#

Request Logging#

Middleware Registration#

Creating Custom Middleware#

Authentication Middleware

JWT Authentication

Role-Based Access Control

Company Membership Check

Request Processing

Request Validation

Rate Limiting

Error Handling

Global Error Handler

Security Middleware

CORS Configuration

Helmet Security Headers

Logging Middleware

Request Logging

Middleware Registration

Creating Custom Middleware