A step-by-step guide to securing a TypeScript and PostgreSQL REST API built with Hapi and Prisma. Covers email-based passwordless authentication using a two-step token flow (email token + long-lived JWT), stateful JWT strategy with database-backed token validation, and role/resource-based authorization using Hapi's pre-functions. Includes Prisma schema migration to add a Token model, SendGrid integration for email delivery, and updating tests to handle authenticated routes.
Table of contents
IntroductionPrerequisitesClone the repositoryStart PostgreSQLAuthentication and authorization conceptsAdding a token model to the Prisma schemaAdd email sending functionalityAdding authentication with HapiAdding authorizationUpdating the testsSummary and next steps5 Impressions