Enterprise Generic CRUD & Relationship Middleware Framework

An enterprise-ready, dynamically-driven NestJS middleware layer that instantly exposes fully functional, secure CRUD and Relationship REST APIs based on your underlying Drizzle-managed PostgreSQL schemas.

Project Overview

This library is published as an internal NPM package. It abstracts away repetitive boilerplate for data access APIs, allowing your consuming products to focus entirely on front-end delivery and bespoke business authorization.

This framework takes absolute responsibility for:

• Authentication: OIDC Resource Server configuration, JWKS eager fetching, RS256 signature verification.
• Enterprise Security: Built-in Helmet, Rate Limiting, CORS whitelist, Correlation IDs, and JSON structured logging with active masking of sensitive credentials.
• Dynamic CRUD: Metadata-driven APIs enabling advanced dynamic filtering without hardcoded DTOs.

Architecture Diagram

graph TD
    Client[Consumer Product Client] -->|HTTP Request| API[Generic CRUD Engine]
    
    subgraph API Middleware Framework
        MW1[Helmet/CORS] --> MW2[CorrelationIdMiddleware]
        MW2 --> IG[ThrottlerGuard Rate Limiter]
        IG --> IN[StructuredLoggerInterceptor]
        IN --> AG[JwtAuthGuard - Global]
        AG -->|Extracts User| C[Controllers]
        
        C --> S[Services]
        S --> ORM[Drizzle ORM]
    end
    
    AG -.->|Validates Token| JWKS[Keycloak JWKS Cache]
    ORM -.-> DB[(PostgreSQL)]

Installation

npm install @fd-internal/api-engine-drizzle

Configuration

Your consuming application must provide the following environment variables. The framework uses a Fail-Fast configuration strategy via Joi; if any of these are missing or malformed, the application will refuse to boot.

# Keycloak Security Variables
KEYCLOAK_JWKS_URI=https://keycloak.internal.company.com/realms/my-product-realm/protocol/openid-connect/certs
KEYCLOAK_ISSUER=https://keycloak.internal.company.com/realms/my-product-realm
KEYCLOAK_AUDIENCE=my-client-api

# Enterprise Security
ALLOWED_ORIGINS=https://my-app.internal.company.com,http://localhost:3000
DB_SCHEMA=public
PORT=3000

Authentication Flow

This package operates exclusively as a Resource Server.

1. The client (e.g., an SPA) acquires a JWT via the Authorization Code Flow from Keycloak.
2. The client passes the token via the Authorization: Bearer <token> header.
3. The framework's global JwtAuthGuard validates the signature against the cached JWKS certs.
4. The identity payload is extracted and mounted to request.user.

Integration Example

Simply import the ApiEngineModule into your root AppModule. It mounts all global interceptors, guards, and dynamic controllers instantly.

// app.module.ts
import { Module } from '@nestjs/common';
import { ApiEngineModule } from '@fd-internal/api-engine-drizzle';

@Module({
  imports: [ApiEngineModule],
  controllers: [],
  providers: [],
})
export class ProductAppModule {}

Extending Authorization

This package enforces Authentication globally. Authorization (RBAC/ABAC) is your responsibility. Because request.user propagates cleanly into the service layer hooks, you can wrap the controllers with your own business logic or utilize native NestJS Interceptors inside your consuming application to enforce ownership validation.

Decorators

• @Public(): Bypasses the global JwtAuthGuard. Used internally for /swagger and /health.
• @CurrentUser(): Injects the authenticated user payload into the controller context.

Security Features

• Helmet: Hardened Content Security Policy, HSTS (31536000), deny frameguard, strict-origin-when-cross-origin referrer policy.
• CORS: Strictly reads from ALLOWED_ORIGINS and safely exposes X-Correlation-Id to clients.
• Rate Limiting: Globally protects all endpoints via @nestjs/throttler (default: 100 reqs / 60 seconds).
• Structured Logging: StructuredLoggerInterceptor outputs JSON to STDOUT. It implements recursive redaction logic to ensure passwords, cookies, and bearer tokens (***MASKED***) never enter the enterprise log stream.

Versioning

This package adheres strictly to Semantic Versioning. Currently released as v1.0.0. Breaking API contracts will invoke a major version bump.

Support & Troubleshooting

If the application crashes on boot, check your KEYCLOAK_JWKS_URI. The framework validates connectivity eagerly to prevent silent unauthenticated runtime failures.