API REST con Autenticación JWT

import { Request, Response, NextFunction } from "express";
import jwt from "jsonwebtoken";
import fs from "fs";

const PUBLIC_KEY = fs.readFileSync("./keys/public.pem", "utf-8");

export interface AuthRequest extends Request {
  user?: { id: string; email: string; role: string };
}

// Verifica el JWT y adjunta el payload a req.user
export function authenticate(
  req: AuthRequest,
  res: Response,
  next: NextFunction
): void {
  const header = req.headers.authorization;
  if (!header?.startsWith("Bearer ")) {
    res.status(401).json({ error: "Token de autenticación requerido" });
    return;
  }

  const token = header.slice(7);
  try {
    req.user = jwt.verify(token, PUBLIC_KEY, { algorithms: ["RS256"] }) as AuthRequest["user"];
    next();
  } catch (err) {
    if (err instanceof jwt.TokenExpiredError) {
      res.status(401).json({ error: "Token expirado", code: "TOKEN_EXPIRED" });
    } else {
      res.status(401).json({ error: "Token inválido" });
    }
  }
}

// Verifica que el rol del usuario esté en la lista permitida
export function authorize(...roles: string[]) {
  return (req: AuthRequest, res: Response, next: NextFunction): void => {
    if (!req.user) {
      res.status(401).json({ error: "No autenticado" });
      return;
    }
    if (!roles.includes(req.user.role)) {
      res.status(403).json({
        error: "Permisos insuficientes",
        required: roles,
        current: req.user.role,
      });
      return;
    }
    next();
  };
}

import { Request, Response, NextFunction } from "express";
import { ZodSchema, ZodError } from "zod";

// Middleware genérico que valida body, params o query contra un schema Zod
export function validate<T>(
  schema: ZodSchema<T>,
  target: "body" | "params" | "query" = "body"
) {
  return (req: Request, res: Response, next: NextFunction): void => {
    const result = schema.safeParse(req[target]);
    if (!result.success) {
      const errors = (result.error as ZodError).errors.map((e) => ({
        field: e.path.join("."),
        message: e.message,
      }));
      res.status(400).json({ error: "Validación fallida", details: errors });
      return;
    }
    req[target] = result.data;
    next();
  };
}

// --- Uso en routes ---
import { z } from "zod";
import { Router } from "express";

const CreateUserSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).max(72),
  role: z.enum(["user", "admin"]).default("user"),
});

const router = Router();

router.post(
  "/users",
  authenticate,
  authorize("admin"),
  validate(CreateUserSchema),
  async (req, res) => {
    // req.body está tipado y validado
    const { email, password, role } = req.body;
    // ...
    res.status(201).json({ message: "Usuario creado" });
  }
);