Comprehensive comparison for technology in applications

const express = require('express');
const gateway = require('express-gateway');
const rateLimit = require('express-rate-limit');
const helmet = require('helmet');
const cors = require('cors');

// Express Gateway configuration for a microservices API gateway
const app = express();

// Security middleware
app.use(helmet());
app.use(cors({
  origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'],
  credentials: true
}));

app.use(express.json({ limit: '10mb' }));
app.use(express.urlencoded({ extended: true }));

// Rate limiting for API protection
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP, please try again later',
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', apiLimiter);

// Authentication middleware
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'Access token required' });
  }

  // In production, verify JWT token here
  try {
    // Simulated token validation
    req.user = { id: 'user123', role: 'customer' };
    next();
  } catch (error) {
    return res.status(403).json({ error: 'Invalid or expired token' });
  }
};

// Gateway routes - proxying to microservices
app.use('/api/products', authenticateToken, (req, res, next) => {
  req.headers['x-user-id'] = req.user.id;
  req.headers['x-user-role'] = req.user.role;
  next();
});

// Products service proxy
app.get('/api/products', async (req, res) => {
  try {
    const { category, page = 1, limit = 20 } = req.query;
    
    // Forward request to products microservice
    const serviceUrl = process.env.PRODUCTS_SERVICE_URL || 'http://localhost:3001';
    const response = await fetch(`${serviceUrl}/products?category=${category}&page=${page}&limit=${limit}`, {
      headers: {
        'x-user-id': req.headers['x-user-id'],
        'x-user-role': req.headers['x-user-role']
      }
    });

    if (!response.ok) {
      throw new Error(`Products service error: ${response.status}`);
    }

    const data = await response.json();
    res.json(data);
  } catch (error) {
    console.error('Gateway error:', error.message);
    res.status(502).json({ error: 'Service temporarily unavailable' });
  }
});

// Orders service proxy with additional validation
app.post('/api/orders', authenticateToken, async (req, res) => {
  try {
    const { items, shippingAddress } = req.body;

    if (!items || !Array.isArray(items) || items.length === 0) {
      return res.status(400).json({ error: 'Invalid order items' });
    }

    if (!shippingAddress || !shippingAddress.zipCode) {
      return res.status(400).json({ error: 'Shipping address required' });
    }

    const serviceUrl = process.env.ORDERS_SERVICE_URL || 'http://localhost:3002';
    const response = await fetch(`${serviceUrl}/orders`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-user-id': req.user.id
      },
      body: JSON.stringify({ items, shippingAddress, userId: req.user.id })
    });

    const data = await response.json();
    res.status(response.status).json(data);
  } catch (error) {
    console.error('Order creation error:', error.message);
    res.status(500).json({ error: 'Failed to process order' });
  }
});

// Health check endpoint
app.get('/health', (req, res) => {
  res.json({ status: 'healthy', timestamp: new Date().toISOString() });
});

// Global error handler
app.use((err, req, res, next) => {
  console.error('Unhandled error:', err);
  res.status(500).json({ error: 'Internal server error' });
});

const PORT = process.env.PORT || 8080;
app.listen(PORT, () => {
  console.log(`Express Gateway running on port ${PORT}`);
});