🛍️ Product

The Product service exposes public product listing plus protected product, image, variant, organization, and liker operations backed by the SDK's product collections.

Start here

This is an integration fragment: the host must provide MongoDB collections, body parsing, and (for cookie transport) cookie parsing before mounting the returned service.

import express from 'express';
import cookieParser from 'cookie-parser';
import { services } from '@nodeblocks/backend-sdk';

app.use(express.json());
app.use(cookieParser()); // Required only when authMode is 'cookie'.
app.use(
  '/api',
  services.productService(
    {
      identities,
      products,
      profiles,
      productVariants,
      organizations,
    },
    {
      authSecrets: {
        authEncSecret: 'development-encryption-secret',
        authSignSecret: 'development-signing-secret',
      },
    },
    { fileStorageDriver }
  )
);

Configuration	Default / source behavior	Effect
authSecrets.authEncSecret	Required; no runtime default	Token encryption configuration.
authSecrets.authSignSecret	Required; no runtime default	Token signing configuration.
authMode	Omitted or 'bearer' uses bearer tokens	'cookie' uses cookie tokens and requires cookie middleware.
identity.typeIds	Passed to configured validators when supplied	Supports identity-type checks.
organization.roles	Passed to configured validators when supplied	Supports organization-role checks.

Common tasks

Task	Start with	Contract
Create, update, copy, or remove a product	createProductFeature	Features, routes, and schemas
Upload or attach product images	createProductImageFeature	Image feature and image route
Manage product variants	createProductVariantFeature	Variant features and variant schemas
Trace reusable behavior or errors	Blocks	Blocks and handlers
Review access checks	Validators	Validators

Bearer HTTP workflow

List products with the public findProductsRoute, or create one with the protected createProductRoute. The creation body is defined by createProductSchema; the request requires a valid administrative bearer identity and returns the pipeline result.

API_BASE_URL='http://localhost:8080/api'
ACCESS_TOKEN='replace-with-a-valid-access-token'

curl "$API_BASE_URL/products?page=1&limit=20"

curl -X POST "$API_BASE_URL/products" \
  -H "authorization: Bearer $ACCESS_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"name":"Example product","description":"Short description"}'

The list returns 200 with paginated product data; creation returns the pipeline result for an authorized caller.

Cookie HTTP workflow

Set authMode: 'cookie' and register cookie parsing in the host before mounting. Protected routes use the same schemas and validators, but isAuthenticated() reads the access token from cookies rather than a bearer header.

API_BASE_URL='http://localhost:8080/api'
ACCESS_COOKIE='accessToken=replace-with-a-valid-access-token'

curl -X POST "$API_BASE_URL/products" \
  -H "cookie: $ACCESS_COOKIE" \
  -H 'content-type: application/json' \
  -d '{"name":"Example product","description":"Short description"}'

Custom feature composition

Compose a public SDK feature, such as createProductFeature, inside a custom defService setup when only a selected endpoint set should be mounted. The custom host must provide the same injected dataStores, configuration, and optional fileStorageDriver required by its chosen routes.

import {partial} from 'ramda';
import {features, primitives, utils} from '@nodeblocks/backend-sdk';

const productRouter = primitives.defService(
  partial(primitives.compose(features.createProductFeature, features.findProductsFeature), [{
    authenticate: utils.getBearerTokenInfo,
    configuration: {authSecrets},
    dataStores: {identities, products, profiles, productVariants, organizations},
    fileStorageDriver,
  }]),
);

app.use('/api', productRouter);

Reference map

Page	Purpose
Blocks	Reusable product operations and errors.
Features	Schema-to-route composers.
Handlers	Route pipeline operations.
Routes	Canonical HTTP endpoint matrix and pipelines.
Schemas	Field-level request and reusable data contracts.
Validators	Shared access checks composed by Product routes.

Related modules

Organization schemas provide the shared organization-ID request schema used by the organization listing route. File-storage schemas provide the signed-upload request schema used by image-upload URLs. Authentication documents the shared token transport and authentication behavior.