🛒 OnlineShop API

This API is a robust backend solution for a digital marketplace, developed with NestJS and Prisma ORM. It features secure cookie-based authentication, full product lifecycle management, and Role-Based Access Control (RBAC).

🛠 Tech Stack

• Framework: NestJS
• Database: PostgreSQL / MySQL via Prisma ORM
• Authentication: JWT (Double Token strategy) with HTTP-Only Cookie storage
• Validation: Global ValidationPipe for incoming data integrity
• Middleware: cookie-parser for secure session management

---

🔐 Authentication (/auth)

Authentication relies on secure cookies to store tokens, significantly reducing the risk of XSS vulnerabilities.

Method	Endpoint	Description	Access
POST	/auth/register	Register a new user (Roles: BUYER, SELLER, USER)	Public
POST	/auth/login	Login and initialize accessToken and refreshToken cookies	Public
POST	/auth/logout	Logout and clear session cookies	Public
POST	/auth/refreshtoken	Refresh the Access Token using the Refresh Token	Public
GET	/auth/getCurrentUser	Retrieve profile information for the connected user	Private (JWT)

---

📦 Product Management (/products)

All product routes are protected by an AuthGuard. Ownership control is systematically verified within the business logic to ensure users can only modify their own data.

🌍 Public Marketplace

• GET /products/market: Lists products available for sale (isSold: false).
  • Query Params: page, limit (Pagination included).
  • Authorized Roles: BUYER, SELLER, USER.

🛠 Seller Workspace

Method	Route	Description	Permissions
POST	/products/createproduct	Create a new item (name, price, description)	SELLER, USER
GET	/products/getproducts	List all products owned by the connected seller	SELLER, USER
GET	/products/:id	View specific product details	Owner
PATCH	/products/:id	Update product information	Owner
DELETE	/products/:id	Delete a product from inventory	Owner
DELETE	/products/all/clear	Wipe entire seller catalog	Owner

---

🚦 Installation and Setup

1. Install dependencies:

   npm install

2. Environmental Configuration: Create a .env file in the project root:

   DATABASE_URL="postgresql://user:password@localhost:5432/mydb"
   SECRET_ACCESS="your_jwt_access_secret"
   SECRET_REFRESH="your_jwt_refresh_secret"
   PORT=3000

3. Database Migration:

   npx prisma generate
   npx prisma migrate dev

4. Start the server:

   npm run start:dev

---

⚠️ Error Handling

The API returns standardized NestJS exceptions for simplified frontend integration:

• 401 Unauthorized: Session expired or token missing from cookies.
• 403 Forbidden: Insufficient role or attempt to modify a resource you do not own.
• 404 Not Found: Product or user not found.
• 502 Bad Gateway: Invalid request data (DTO validation failure).

---

🛡️ Global Configuration (main.ts)

The application is configured to be secure by default:

• Cookie Parser: Enabled for reading JWT tokens directly from the request header.
• Global Validation Pipe: Enabled to automatically transform and validate all incoming payloads against DTO definitions.