Microservices Architecture: Design Patterns and Best Practices

Enterprise API Gateway

// api-gateway.js - Production API Gateway implementation
const express = require('express');
const httpProxy = require('http-proxy-middleware');
const rateLimit = require('express-rate-limit');
const jwt = require('jsonwebtoken');
const Redis = require('redis');

class APIGateway {
  constructor() {
    this.app = express();
    this.redis = Redis.createClient(process.env.REDIS_URL);
    this.serviceRegistry = new Map();
    this.setupMiddleware();
    this.loadServiceRoutes();
  }

  setupMiddleware() {
    // Basic middleware
    this.app.use(express.json({ limit: '10mb' }));
    this.app.use(express.urlencoded({ extended: true }));
    
    // CORS handling
    this.app.use((req, res, next) => {
      res.header('Access-Control-Allow-Origin', '*');
      res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization');
      res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
      next();
    });

    // Request logging
    this.app.use((req, res, next) => {
      console.log(`${new Date().toISOString()} - ${req.method} ${req.url}`);
      req.startTime = Date.now();
      next();
    });

    // Rate limiting
    const limiter = rateLimit({
      windowMs: 15 * 60 * 1000, // 15 minutes
      max: 1000, // limit each IP to 1000 requests per windowMs
      message: 'Too many requests from this IP',
      standardHeaders: true,
      legacyHeaders: false,
    });
    this.app.use(limiter);

    // Authentication middleware
    this.app.use('/api', this.authenticateRequest.bind(this));
  }

  async authenticateRequest(req, res, next) {
    // Skip auth for public endpoints
    if (this.isPublicEndpoint(req.path)) {
      return next();
    }

    const token = req.headers.authorization?.split(' ')[1];
    if (!token) {
      return res.status(401).json({ error: 'No token provided' });
    }

    try {
      // Verify JWT token
      const decoded = jwt.verify(token, process.env.JWT_SECRET);
      req.user = decoded;

      // Check token blacklist (Redis)
      const isBlacklisted = await this.redis.get(`blacklist:${token}`);
      if (isBlacklisted) {
        return res.status(401).json({ error: 'Token has been revoked' });
      }

      // Add user context to headers for downstream services
      req.headers['x-user-id'] = decoded.userId;
      req.headers['x-user-role'] = decoded.role;

      next();
    } catch (error) {
      console.error('Token verification failed:', error);
      return res.status(401).json({ error: 'Invalid token' });
    }
  }

  isPublicEndpoint(path) {
    const publicPaths = [
      '/api/auth/login',
      '/api/auth/register',
      '/api/health',
      '/api/products' // Public product listing
    ];
    return publicPaths.some(publicPath => path.startsWith(publicPath));
  }

  loadServiceRoutes() {
    // Service discovery and routing configuration
    const services = [
      {
        name: 'user-service',
        url: process.env.USER_SERVICE_URL || 'http://user-service:3001',
        prefix: '/api/users',
        healthCheck: '/health'
      },
      {
        name: 'product-service',
        url: process.env.PRODUCT_SERVICE_URL || 'http://product-service:3002',
        prefix: '/api/products',
        healthCheck: '/health'
      },
      {
        name: 'order-service',
        url: process.env.ORDER_SERVICE_URL || 'http://order-service:3003',
        prefix: '/api/orders',
        healthCheck: '/health'
      },
      {
        name: 'payment-service',
        url: process.env.PAYMENT_SERVICE_URL || 'http://payment-service:3004',
        prefix: '/api/payments',
        healthCheck: '/health'
      }
    ];

    services.forEach(service => {
      this.registerService(service);
    });
  }

  registerService(service) {
    this.serviceRegistry.set(service.name, service);

    // Create proxy middleware with advanced options
    const proxyOptions = {
      target: service.url,
      changeOrigin: true,
      pathRewrite: {
        [`^${service.prefix}`]: ''
      },
      timeout: 30000,
      proxyTimeout: 30000,
      
      // Add custom headers
      onProxyReq: (proxyReq, req, res) => {
        // Add tracing headers
        proxyReq.setHeader('X-Request-ID', this.generateRequestId());
        proxyReq.setHeader('X-Gateway-Timestamp', new Date().toISOString());
        proxyReq.setHeader('X-Client-IP', req.ip);
        
        // Forward user context
        if (req.user) {
          proxyReq.setHeader('X-User-Context', JSON.stringify(req.user));
        }
      },

      // Handle responses
      onProxyRes: (proxyRes, req, res) => {
        const duration = Date.now() - req.startTime;
        console.log(`Request to ${service.name} completed in ${duration}ms`);
        
        // Add response headers
        proxyRes.headers['X-Response-Time'] = `${duration}ms`;
        proxyRes.headers['X-Service-Name'] = service.name;
      },

      // Error handling
      onError: (err, req, res) => {
        console.error(`Proxy error for ${service.name}:`, err);
        res.status(503).json({
          error: 'Service temporarily unavailable',
          service: service.name,
          timestamp: new Date().toISOString()
        });
      }
    };

    // Apply circuit breaker pattern
    const circuitBreakerProxy = this.wrapWithCircuitBreaker(
      httpProxy(proxyOptions),
      service.name
    );

    this.app.use(service.prefix, circuitBreakerProxy);
    console.log(`Registered service: ${service.name} at ${service.prefix}`);
  }

  wrapWithCircuitBreaker(proxy, serviceName) {
    let failureCount = 0;
    let isCircuitOpen = false;
    let lastFailureTime = 0;
    
    const FAILURE_THRESHOLD = 5;
    const RESET_TIMEOUT = 60000; // 1 minute

    return (req, res, next) => {
      // Check if circuit should be reset
      if (isCircuitOpen && Date.now() - lastFailureTime > RESET_TIMEOUT) {
        isCircuitOpen = false;
        failureCount = 0;
        console.log(`Circuit breaker reset for ${serviceName}`);
      }

      // If circuit is open, return error immediately
      if (isCircuitOpen) {
        return res.status(503).json({
          error: 'Service circuit breaker is open',
          service: serviceName,
          retryAfter: Math.ceil((RESET_TIMEOUT - (Date.now() - lastFailureTime)) / 1000)
        });
      }

      // Wrap response to monitor failures
      const originalEnd = res.end;
      res.end = function(...args) {
        if (res.statusCode >= 500) {
          failureCount++;
          lastFailureTime = Date.now();
          
          if (failureCount >= FAILURE_THRESHOLD) {
            isCircuitOpen = true;
            console.log(`Circuit breaker opened for ${serviceName}`);
          }
        } else {
          // Reset failure count on successful response
          failureCount = 0;
        }
        
        originalEnd.apply(this, args);
      };

      proxy(req, res, next);
    };
  }

  // Health check endpoint
  setupHealthCheck() {
    this.app.get('/health', async (req, res) => {
      const health = {
        status: 'healthy',
        timestamp: new Date().toISOString(),
        services: {}
      };

      // Check each registered service
      for (const [name, service] of this.serviceRegistry) {
        try {
          const response = await fetch(`${service.url}${service.healthCheck}`, {
            timeout: 5000
          });
          health.services[name] = {
            status: response.ok ? 'healthy' : 'unhealthy',
            responseTime: response.headers.get('X-Response-Time')
          };
        } catch (error) {
          health.services[name] = {
            status: 'unhealthy',
            error: error.message
          };
        }
      }

      const unhealthyServices = Object.values(health.services)
        .filter(service => service.status === 'unhealthy');
      
      if (unhealthyServices.length > 0) {
        health.status = 'degraded';
        res.status(503);
      }

      res.json(health);
    });
  }

  generateRequestId() {
    return `req-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
  }

  start(port = 3000) {
    this.setupHealthCheck();
    
    this.app.listen(port, () => {
      console.log(`API Gateway listening on port ${port}`);
      console.log(`Registered ${this.serviceRegistry.size} services`);
    });
  }
}

// Start the gateway
const gateway = new APIGateway();
gateway.start(process.env.PORT || 3000);