feat(backend): Prisma schema, Express routes, audit middleware, error handling

2026-04-15 10:40:39 -04:00
parent 44dfe3fdc4
commit 04d1eee8f8
13 changed files with 9104 additions and 0 deletions
@@ -0,0 +1,37 @@
+{
+  "name": "experiments-backend",
+  "version": "1.0.0",
+  "description": "Animal experiments database API",
+  "main": "src/index.js",
+  "scripts": {
+    "start": "node src/index.js",
+    "dev": "nodemon src/index.js",
+    "migrate": "prisma migrate deploy",
+    "migrate:dev": "prisma migrate dev",
+    "generate": "prisma generate",
+    "test": "jest --runInBand --forceExit",
+    "test:coverage": "jest --runInBand --forceExit --coverage"
+  },
+  "dependencies": {
+    "@prisma/client": "^5.14.0",
+    "cors": "^2.8.5",
+    "express": "^4.19.2",
+    "express-validator": "^7.1.0",
+    "helmet": "^7.1.0",
+    "morgan": "^1.10.0",
+    "uuid": "^9.0.1"
+  },
+  "devDependencies": {
+    "jest": "^29.7.0",
+    "nodemon": "^3.1.3",
+    "prisma": "^5.14.0",
+    "supertest": "^7.0.0"
+  },
+  "jest": {
+    "testEnvironment": "node",
+    "testMatch": ["**/tests/**/*.test.js"],
+    "setupFilesAfterFramework": [],
+    "globalSetup": "./tests/setup.js",
+    "globalTeardown": "./tests/teardown.js"
+  }
+}
@@ -0,0 +1,49 @@
+-- CreateTable
+CREATE TABLE "experiments" (
+    "id" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "experiments_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "animals" (
+    "id" TEXT NOT NULL,
+    "experiment_id" TEXT NOT NULL,
+    "animal_id_string" TEXT NOT NULL,
+    "animal_name" TEXT NOT NULL,
+
+    CONSTRAINT "animals_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "daily_statuses" (
+    "id" TEXT NOT NULL,
+    "animal_id" TEXT NOT NULL,
+    "date" DATE NOT NULL,
+    "experiment_description" TEXT,
+    "vitals" TEXT,
+    "treatment" TEXT,
+    "notes" TEXT,
+
+    CONSTRAINT "daily_statuses_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "audit_logs" (
+    "id" TEXT NOT NULL,
+    "table_name" TEXT NOT NULL,
+    "record_id" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "changes" JSONB NOT NULL,
+    "timestamp" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "audit_logs_pkey" PRIMARY KEY ("id")
+);
+
+-- AddForeignKey
+ALTER TABLE "animals" ADD CONSTRAINT "animals_experiment_id_fkey" FOREIGN KEY ("experiment_id") REFERENCES "experiments"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "daily_statuses" ADD CONSTRAINT "daily_statuses_animal_id_fkey" FOREIGN KEY ("animal_id") REFERENCES "animals"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (i.e. Git)
+provider = "postgresql"
@@ -0,0 +1,52 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model Experiment {
+  id         String   @id @default(uuid())
+  title      String
+  created_at DateTime @default(now())
+  animals    Animal[]
+
+  @@map("experiments")
+}
+
+model Animal {
+  id               String        @id @default(uuid())
+  experiment_id    String
+  animal_id_string String
+  animal_name      String
+  experiment       Experiment    @relation(fields: [experiment_id], references: [id], onDelete: Cascade)
+  daily_statuses   DailyStatus[]
+
+  @@map("animals")
+}
+
+model DailyStatus {
+  id                     String   @id @default(uuid())
+  animal_id              String
+  date                   DateTime @db.Date
+  experiment_description String?
+  vitals                 String?
+  treatment              String?
+  notes                  String?
+  animal                 Animal   @relation(fields: [animal_id], references: [id], onDelete: Cascade)
+
+  @@map("daily_statuses")
+}
+
+model AuditLog {
+  id         String   @id @default(uuid())
+  table_name String
+  record_id  String
+  action     String
+  changes    Json
+  timestamp  DateTime @default(now())
+
+  @@map("audit_logs")
+}
@@ -0,0 +1,67 @@
+const express = require('express');
+const cors = require('cors');
+const helmet = require('helmet');
+const morgan = require('morgan');
+const prisma = require('./lib/prisma');
+const { globalErrorHandler } = require('./middleware/errorHandler');
+
+const experimentsRouter = require('./routes/experiments');
+const animalsRouter = require('./routes/animals');
+const dailyStatusesRouter = require('./routes/dailyStatuses');
+const auditLogsRouter = require('./routes/auditLogs');
+
+const app = express();
+const PORT = process.env.PORT || 3001;
+
+// Security & utility middleware
+app.use(helmet());
+app.use(cors({
+  origin: process.env.CORS_ORIGIN || '*',
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization'],
+}));
+app.use(express.json({ limit: '1mb' }));
+app.use(morgan(process.env.NODE_ENV === 'production' ? 'combined' : 'dev'));
+
+// Health check
+app.get('/health', (req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+// API routes
+app.use('/api/experiments', experimentsRouter);
+app.use('/api/animals', animalsRouter);
+app.use('/api/daily-statuses', dailyStatusesRouter);
+app.use('/api/audit-logs', auditLogsRouter);
+
+// 404 handler for unknown routes
+app.use((req, res) => {
+  res.status(404).json({ error: `Route ${req.method} ${req.path} not found` });
+});
+
+// Global error handler (must be last)
+app.use(globalErrorHandler);
+
+async function startServer() {
+  try {
+    await prisma.$connect();
+    console.log('Database connected successfully');
+
+    // Run migrations on startup in production
+    if (process.env.NODE_ENV === 'production') {
+      const { execSync } = require('child_process');
+      execSync('npx prisma migrate deploy', { stdio: 'inherit' });
+    }
+
+    app.listen(PORT, '0.0.0.0', () => {
+      console.log(`Server running on port ${PORT}`);
+    });
+  } catch (err) {
+    console.error('Failed to start server:', err);
+    process.exit(1);
+  }
+}
+
+startServer();
+
+module.exports = app; // export for testing
@@ -0,0 +1,7 @@
+const { PrismaClient } = require('@prisma/client');
+
+const prisma = new PrismaClient({
+  log: process.env.NODE_ENV === 'development' ? ['query', 'error'] : ['error'],
+});
+
+module.exports = prisma;
@@ -0,0 +1,61 @@
+const prisma = require('../lib/prisma');
+
+/**
+ * Factory that creates audit middleware for a given Prisma model.
+ * On UPDATE: captures before/after diff.
+ * On DELETE: captures the full record before deletion.
+ *
+ * @param {string} tableName - The human-readable table name for audit logs
+ * @param {object} model     - The Prisma model delegate (e.g., prisma.experiment)
+ * @param {string} idParam   - The route param name that holds the record id (default: 'id')
+ */
+function auditMiddleware(tableName, model, idParam = 'id') {
+  return async (req, res, next) => {
+    const recordId = req.params[idParam];
+    if (!recordId) return next();
+
+    try {
+      const before = await model.findUnique({ where: { id: recordId } });
+      if (!before) return next();
+
+      // Attach before-state so route handlers can reference it if needed
+      req._auditBefore = before;
+
+      // Wrap res.json to intercept the response
+      const originalJson = res.json.bind(res);
+      res.json = async function (data) {
+        // Only log on successful mutations
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          try {
+            const action = req.method === 'DELETE' ? 'DELETE' : 'UPDATE';
+            const after = action === 'DELETE' ? null : await model.findUnique({ where: { id: recordId } });
+
+            const changes = {
+              before,
+              after,
+            };
+
+            await prisma.auditLog.create({
+              data: {
+                table_name: tableName,
+                record_id: recordId,
+                action,
+                changes,
+              },
+            });
+          } catch (auditErr) {
+            // Audit failures should never block the primary response
+            console.error('Audit log write failed:', auditErr.message);
+          }
+        }
+        return originalJson(data);
+      };
+
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+
+module.exports = auditMiddleware;
@@ -0,0 +1,40 @@
+const { validationResult } = require('express-validator');
+
+/**
+ * Validation check middleware — call after express-validator chains.
+ * Returns 422 with field-level errors if validation fails.
+ */
+function validateRequest(req, res, next) {
+  const errors = validationResult(req);
+  if (!errors.isEmpty()) {
+    return res.status(422).json({
+      error: 'Validation failed',
+      details: errors.array().map((e) => ({ field: e.path, message: e.msg })),
+    });
+  }
+  next();
+}
+
+/**
+ * Global Express error handler — must be registered last.
+ */
+function globalErrorHandler(err, req, res, next) {
+  console.error(err);
+
+  // Prisma known errors
+  if (err.code === 'P2025') {
+    return res.status(404).json({ error: 'Record not found' });
+  }
+  if (err.code === 'P2003') {
+    return res.status(400).json({ error: 'Foreign key constraint failed — referenced record does not exist' });
+  }
+  if (err.code === 'P2002') {
+    return res.status(409).json({ error: 'A record with these unique fields already exists' });
+  }
+
+  const status = err.status || 500;
+  const message = process.env.NODE_ENV === 'production' ? 'Internal server error' : err.message;
+  res.status(status).json({ error: message });
+}
+
+module.exports = { validateRequest, globalErrorHandler };
@@ -0,0 +1,113 @@
+const router = require('express').Router();
+const { body, query } = require('express-validator');
+const prisma = require('../lib/prisma');
+const auditMiddleware = require('../middleware/auditMiddleware');
+const { validateRequest } = require('../middleware/errorHandler');
+
+const animalValidation = [
+  body('experiment_id').notEmpty().withMessage('experiment_id is required').isUUID().withMessage('experiment_id must be a valid UUID'),
+  body('animal_id_string').trim().notEmpty().withMessage('animal_id_string is required'),
+  body('animal_name').trim().notEmpty().withMessage('animal_name is required'),
+];
+
+const animalUpdateValidation = [
+  body('animal_id_string').optional().trim().notEmpty().withMessage('animal_id_string cannot be empty'),
+  body('animal_name').optional().trim().notEmpty().withMessage('animal_name cannot be empty'),
+];
+
+// GET /api/animals?experimentId=<uuid> — list for experiment
+router.get(
+  '/',
+  [query('experimentId').optional().isUUID().withMessage('experimentId must be a valid UUID')],
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const where = req.query.experimentId ? { experiment_id: req.query.experimentId } : {};
+      const animals = await prisma.animal.findMany({
+        where,
+        orderBy: { animal_name: 'asc' },
+        include: { _count: { select: { daily_statuses: true } } },
+      });
+      res.json(animals);
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// GET /api/animals/:id — get one with daily statuses
+router.get('/:id', async (req, res, next) => {
+  try {
+    const animal = await prisma.animal.findUnique({
+      where: { id: req.params.id },
+      include: { daily_statuses: { orderBy: { date: 'desc' } } },
+    });
+    if (!animal) return res.status(404).json({ error: 'Animal not found' });
+    res.json(animal);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /api/animals — create
+router.post('/', animalValidation, validateRequest, async (req, res, next) => {
+  try {
+    const { experiment_id, animal_id_string, animal_name } = req.body;
+    const animal = await prisma.animal.create({
+      data: { experiment_id, animal_id_string, animal_name },
+    });
+
+    await prisma.auditLog.create({
+      data: {
+        table_name: 'animals',
+        record_id: animal.id,
+        action: 'CREATE',
+        changes: { before: null, after: animal },
+      },
+    });
+
+    res.status(201).json(animal);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /api/animals/:id — update
+router.put(
+  '/:id',
+  auditMiddleware('animals', prisma.animal),
+  animalUpdateValidation,
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const { animal_id_string, animal_name } = req.body;
+      const data = {};
+      if (animal_id_string !== undefined) data.animal_id_string = animal_id_string;
+      if (animal_name !== undefined) data.animal_name = animal_name;
+
+      const animal = await prisma.animal.update({
+        where: { id: req.params.id },
+        data,
+      });
+      res.json(animal);
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// DELETE /api/animals/:id — delete
+router.delete(
+  '/:id',
+  auditMiddleware('animals', prisma.animal),
+  async (req, res, next) => {
+    try {
+      await prisma.animal.delete({ where: { id: req.params.id } });
+      res.status(204).send();
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+module.exports = router;
@@ -0,0 +1,54 @@
+const router = require('express').Router();
+const { query } = require('express-validator');
+const prisma = require('../lib/prisma');
+const { validateRequest } = require('../middleware/errorHandler');
+
+// GET /api/audit-logs?tableName=&recordId=&limit=&offset= — query logs
+router.get(
+  '/',
+  [
+    query('tableName').optional().isString(),
+    query('recordId').optional().isUUID().withMessage('recordId must be a valid UUID'),
+    query('limit').optional().isInt({ min: 1, max: 200 }).withMessage('limit must be 1–200').toInt(),
+    query('offset').optional().isInt({ min: 0 }).withMessage('offset must be ≥0').toInt(),
+  ],
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const { tableName, recordId } = req.query;
+      const limit = req.query.limit || 50;
+      const offset = req.query.offset || 0;
+
+      const where = {};
+      if (tableName) where.table_name = tableName;
+      if (recordId) where.record_id = recordId;
+
+      const [logs, total] = await Promise.all([
+        prisma.auditLog.findMany({
+          where,
+          orderBy: { timestamp: 'desc' },
+          take: limit,
+          skip: offset,
+        }),
+        prisma.auditLog.count({ where }),
+      ]);
+
+      res.json({ logs, total, limit, offset });
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// GET /api/audit-logs/:id — single log entry
+router.get('/:id', async (req, res, next) => {
+  try {
+    const log = await prisma.auditLog.findUnique({ where: { id: req.params.id } });
+    if (!log) return res.status(404).json({ error: 'Audit log not found' });
+    res.json(log);
+  } catch (err) {
+    next(err);
+  }
+});
+
+module.exports = router;
@@ -0,0 +1,129 @@
+const router = require('express').Router();
+const { body, query } = require('express-validator');
+const prisma = require('../lib/prisma');
+const auditMiddleware = require('../middleware/auditMiddleware');
+const { validateRequest } = require('../middleware/errorHandler');
+
+const statusValidation = [
+  body('animal_id').notEmpty().withMessage('animal_id is required').isUUID().withMessage('animal_id must be a valid UUID'),
+  body('date').notEmpty().withMessage('date is required').isISO8601().withMessage('date must be a valid ISO 8601 date (YYYY-MM-DD)'),
+  body('experiment_description').optional().isString(),
+  body('vitals').optional().isString(),
+  body('treatment').optional().isString(),
+  body('notes').optional().isString(),
+];
+
+const statusUpdateValidation = [
+  body('date').optional().isISO8601().withMessage('date must be a valid ISO 8601 date'),
+  body('experiment_description').optional().isString(),
+  body('vitals').optional().isString(),
+  body('treatment').optional().isString(),
+  body('notes').optional().isString(),
+];
+
+// GET /api/daily-statuses?animalId=<uuid> — list for animal
+router.get(
+  '/',
+  [query('animalId').optional().isUUID().withMessage('animalId must be a valid UUID')],
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const where = req.query.animalId ? { animal_id: req.query.animalId } : {};
+      const statuses = await prisma.dailyStatus.findMany({
+        where,
+        orderBy: { date: 'desc' },
+        include: { animal: { select: { animal_name: true, animal_id_string: true } } },
+      });
+      res.json(statuses);
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// GET /api/daily-statuses/:id — get one
+router.get('/:id', async (req, res, next) => {
+  try {
+    const status = await prisma.dailyStatus.findUnique({
+      where: { id: req.params.id },
+      include: { animal: true },
+    });
+    if (!status) return res.status(404).json({ error: 'Daily status not found' });
+    res.json(status);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /api/daily-statuses — create
+router.post('/', statusValidation, validateRequest, async (req, res, next) => {
+  try {
+    const { animal_id, date, experiment_description, vitals, treatment, notes } = req.body;
+    const status = await prisma.dailyStatus.create({
+      data: {
+        animal_id,
+        date: new Date(date),
+        experiment_description,
+        vitals,
+        treatment,
+        notes,
+      },
+    });
+
+    await prisma.auditLog.create({
+      data: {
+        table_name: 'daily_statuses',
+        record_id: status.id,
+        action: 'CREATE',
+        changes: { before: null, after: status },
+      },
+    });
+
+    res.status(201).json(status);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /api/daily-statuses/:id — update
+router.put(
+  '/:id',
+  auditMiddleware('daily_statuses', prisma.dailyStatus),
+  statusUpdateValidation,
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const { date, experiment_description, vitals, treatment, notes } = req.body;
+      const data = {};
+      if (date !== undefined) data.date = new Date(date);
+      if (experiment_description !== undefined) data.experiment_description = experiment_description;
+      if (vitals !== undefined) data.vitals = vitals;
+      if (treatment !== undefined) data.treatment = treatment;
+      if (notes !== undefined) data.notes = notes;
+
+      const status = await prisma.dailyStatus.update({
+        where: { id: req.params.id },
+        data,
+      });
+      res.json(status);
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// DELETE /api/daily-statuses/:id — delete
+router.delete(
+  '/:id',
+  auditMiddleware('daily_statuses', prisma.dailyStatus),
+  async (req, res, next) => {
+    try {
+      await prisma.dailyStatus.delete({ where: { id: req.params.id } });
+      res.status(204).send();
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+module.exports = router;
@@ -0,0 +1,94 @@
+const router = require('express').Router();
+const { body } = require('express-validator');
+const prisma = require('../lib/prisma');
+const auditMiddleware = require('../middleware/auditMiddleware');
+const { validateRequest } = require('../middleware/errorHandler');
+
+const experimentValidation = [
+  body('title').trim().notEmpty().withMessage('Title is required').isLength({ max: 255 }).withMessage('Title must be ≤255 characters'),
+];
+
+// GET /api/experiments — list all
+router.get('/', async (req, res, next) => {
+  try {
+    const experiments = await prisma.experiment.findMany({
+      orderBy: { created_at: 'desc' },
+      include: { _count: { select: { animals: true } } },
+    });
+    res.json(experiments);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// GET /api/experiments/:id — get one with animals
+router.get('/:id', async (req, res, next) => {
+  try {
+    const experiment = await prisma.experiment.findUnique({
+      where: { id: req.params.id },
+      include: { animals: true },
+    });
+    if (!experiment) return res.status(404).json({ error: 'Experiment not found' });
+    res.json(experiment);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /api/experiments — create
+router.post('/', experimentValidation, validateRequest, async (req, res, next) => {
+  try {
+    const { title } = req.body;
+    const experiment = await prisma.experiment.create({ data: { title } });
+
+    // Write CREATE audit log
+    await prisma.auditLog.create({
+      data: {
+        table_name: 'experiments',
+        record_id: experiment.id,
+        action: 'CREATE',
+        changes: { before: null, after: experiment },
+      },
+    });
+
+    res.status(201).json(experiment);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /api/experiments/:id — update
+router.put(
+  '/:id',
+  auditMiddleware('experiments', prisma.experiment),
+  experimentValidation,
+  validateRequest,
+  async (req, res, next) => {
+    try {
+      const { title } = req.body;
+      const experiment = await prisma.experiment.update({
+        where: { id: req.params.id },
+        data: { title },
+      });
+      res.json(experiment);
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// DELETE /api/experiments/:id — delete
+router.delete(
+  '/:id',
+  auditMiddleware('experiments', prisma.experiment),
+  async (req, res, next) => {
+    try {
+      await prisma.experiment.delete({ where: { id: req.params.id } });
+      res.status(204).send();
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+module.exports = router;