🧩 Users Microservice (Express + REST + GraphQL + Prisma + Swagger)

A Node.js microservice built with Express 5 using Object-Oriented Programming and the Singleton design pattern (Express app as a readonly class attribute). A User table with id and name queryable by REST and GraphQL APIs in the same service, persists data with Prisma + SQLite, CORS restricted to example.com, and documents the REST API via OpenAPI/Swagger.

---

Tech Stack

• Node.js
• JavaScript
• Express
• Prisma ORM
• SQLite
• GraphQL (Apollo Server)
• Swagger/OpenAPI

---

Setup

1) Install dependencies

npm install

2) Prisma and SQLite setup

(if not already done)

npx prisma init --datasource-provider sqlite

• Run migrations:

npx prisma migrate dev --name init

• Open Prisma Studio and create users:

npx prisma studio

4) Environment variables

There must be a .env file in the root of the project with the following:

    PORT=3000
    ALLOWED_DOMAIN=example.com
    ALLOW_LOCALHOST=true
    NODE_ENV=development
    DATABASE_URL="file:./dev.db"

3) Run the service:

npm run dev

The service typically runs on: http://localhost:3000

Endpoints

API REST (GET /users/:id)

Examples:

• curl -i http://localhost:3000/users/1 (http 200)
• curl -i http://localhost:3000/users/abc (http 400)
• curl -i http://localhost:3000/users/99999 (http 404)

Graphql (query {user {id, name}})

Example query:

• curl -i -X POST http://localhost:3000/graphql ^ -H "Content-Type: application/json" ^ -d "{"query":"query($id:ID!){ user(id:$id){ id name } }","variables":{"id":1}}"

Swagger

When the service is running, open: http://localhost:3000/api-docs

Domain restriction (CORS)

Requests with an unauthorized Origin are rejected with a 403 response.

"Blocked" example:

• curl -i http://localhost:3000/users/1 -H "Origin: https://ejemplo.com" (http 403)

"Allowed" example:

• curl -i http://localhost:3000/users/1 -H "Origin: https://example.com" (http 200)

License

This project is licensed under the MIT License (2026). See the LICENSE file for details.