REST API Design: Membuat API yang Baik

const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');

const JWT_SECRET = process.env.JWT_SECRET || 'rahasia-super-aman';
const JWT_EXPIRES = '24h';

// ═══════════════════════════════════════
// Endpoint: Register
// POST /api/v1/auth/register
// ═══════════════════════════════════════
app.post('/api/v1/auth/register', async (req, res) => {
  const { nama, email, password } = req.body;

  // Validasi input
  if (!nama || !email || !password) {
    return res.status(400).json({
      status: 'error',
      message: 'Nama, email, dan password wajib diisi'
    });
  }

  // Cek apakah email sudah terdaftar
  const existing = users.find(u => u.email === email);
  if (existing) {
    return res.status(409).json({
      status: 'error',
      message: 'Email sudah terdaftar'
    });
  }

  // Hash password
  const hashedPassword = await bcrypt.hash(password, 12);

  // Simpan user
  const newUser = {
    id: users.length + 1,
    nama,
    email,
    password: hashedPassword,
    role: 'user',
    created_at: new Date().toISOString()
  };
  users.push(newUser);

  // Buat JWT token
  const token = jwt.sign(
    { id: newUser.id, email: newUser.email, role: newUser.role },
    JWT_SECRET,
    { expiresIn: JWT_EXPIRES }
  );

  res.status(201).json({
    status: 'success',
    data: {
      user: { id: newUser.id, nama, email },
      token: token
    }
  });
});

// ═══════════════════════════════════════
// Endpoint: Login
// POST /api/v1/auth/login
// ═══════════════════════════════════════
app.post('/api/v1/auth/login', async (req, res) => {
  const { email, password } = req.body;

  const user = users.find(u => u.email === email);
  if (!user || !(await bcrypt.compare(password, user.password))) {
    return res.status(401).json({
      status: 'error',
      message: 'Email atau password salah'
    });
  }

  const token = jwt.sign(
    { id: user.id, email: user.email, role: user.role },
    JWT_SECRET,
    { expiresIn: JWT_EXPIRES }
  );

  res.json({
    status: 'success',
    data: {
      user: { id: user.id, nama: user.nama, email: user.email },
      token: token
    }
  });
});

// ═══════════════════════════════════════
// Middleware: Verifikasi Token
// ═══════════════════════════════════════
const autentikasi = (req, res, next) => {
  const authHeader = req.headers.authorization;

  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({
      status: 'error',
      message: 'Token tidak ditemukan. Silakan login.'
    });
  }

  const token = authHeader.split(' ')[1];

  try {
    const decoded = jwt.verify(token, JWT_SECRET);
    req.user = decoded;
    next();
  } catch (err) {
    return res.status(401).json({
      status: 'error',
      message: 'Token tidak valid atau sudah kedaluwarsa'
    });
  }
};

// Middleware: Cek Role
const izinkanRole = (...roles) => {
  return (req, res, next) => {
    if (!roles.includes(req.user.role)) {
      return res.status(403).json({
        status: 'error',
        message: 'Anda tidak memiliki akses ke resource ini'
      });
    }
    next();
  };
};

// ═══════════════════════════════════════
// Protected Routes
// ═══════════════════════════════════════
app.get('/api/v1/profile', autentikasi, (req, res) => {
  res.json({ status: 'success', user: req.user });
});

// Hanya admin yang bisa menghapus
app.delete('/api/v1/users/:id',
  autentikasi,
  izinkanRole('admin'),
  (req, res) => {
    // Hapus user...
    res.json({ status: 'success', message: 'User dihapus' });
  }
);