API with NestJS #72. Working with PostgreSQL using raw SQL queries

August 29, 2022

This entry is part 72 of 121 in the API with NestJS

Object-Relational Mapping (ORM) libraries can often help us write our code faster. The ORM allows us not to write raw SQL. Instead, we can manipulate the data using an object-oriented paradigm.

Using ORM can ease the learning curve of working with databases because we don’t need to go deep into learning SQL. Instead, we write the data model in the programming language we use to develop the application. On top of that, ORM should have security mechanisms that deal with issues such as SQL injection.

Unfortunately, ORMs have disadvantages too. For example, depending on ORM to generate the database structure based on our models can lead to not grasping the intricacies of the underlying architecture. Also, ORM automatically generates SQL queries for fetching, inserting or modifying data. Therefore, they are not always optimal and can lead to performance issues. Also, ORMs can have problems and bugs too.

It is fine to use ORM if we don’t need a lot of control over our SQL queries. If we develop a big project, though, we might prefer to deal with database management through raw SQL queries. In this article, we figure out how to structure our NestJS project to use raw SQL queries with a PostgreSQL database.

You can find the code from this article in this repository.

Connecting to the database

As usual in this series, we use Docker to create an instance of the PostgreSQL database for us.

docker-compose.yml

version: "3"

services:

postgres:

container_name: postgres-nestjs

image: postgres:latest

ports:

- "5432:5432"

volumes:

- /data/postgres:/data/postgres

env_file:

- docker.env

networks:

- postgres

pgadmin:

links:

- postgres:postgres

container_name: pgadmin-nestjs

image: dpage/pgadmin4

ports:

- "8080:80"

volumes:

- /data/pgadmin:/root/.pgadmin

env_file:

- docker.env

networks:

- postgres

networks:

postgres:

driver: bridge

To provide Docker with the necessary environment variables, we need to create the docker.env file.

docker.env

POSTGRES_USER=admin

POSTGRES_PASSWORD=admin

POSTGRES_DB=nestjs

PGADMIN_DEFAULT_EMAIL=admin@admin.com

PGADMIN_DEFAULT_PASSWORD=admin

We must also provide a similar set of variables for our NestJS application.

.env

POSTGRES_HOST=localhost

POSTGRES_PORT=5432

POSTGRES_USER=admin

POSTGRES_PASSWORD=admin

POSTGRES_DB=nestjs

It is also a good idea to validate if the environment variables are provided when the application starts.

app.module.ts

import { Module } from '@nestjs/common';

import { ConfigModule } from '@nestjs/config';

import * as Joi from 'joi';

@Module({

imports: [

ConfigModule.forRoot({

validationSchema: Joi.object({

POSTGRES_HOST: Joi.string().required(),

POSTGRES_PORT: Joi.number().required(),

POSTGRES_USER: Joi.string().required(),

POSTGRES_PASSWORD: Joi.string().required(),

POSTGRES_DB: Joi.string().required(),

}),

})

export class AppModule {}

Establishing the connection

In this article, we use the node-postgres library to establish a connection to our PostgreSQL database and run queries.

1	npm install pg @types/pg

To manage a database connection, we can create a dynamic module. Thanks to that, we could easily copy and paste it to a different project or keep it in a separate library.

If you are not familiar with dynamic modules, check out API with NestJS #70. Defining dynamic modules

database.module-definition.ts

import { ConfigurableModuleBuilder } from '@nestjs/common';

import DatabaseOptions from './databaseOptions';

export const CONNECTION_POOL = 'CONNECTION_POOL';

export const {

ConfigurableModuleClass: ConfigurableDatabaseModule,

MODULE_OPTIONS_TOKEN: DATABASE_OPTIONS,

} = new ConfigurableModuleBuilder<DatabaseOptions>()

.setClassMethodName('forRoot')

.build();

We use forRoot above because we want our DatabaseModule to be global.

When the DatabaseModule is imported, we expect a particular set of options to be provided.

databaseOptions.ts

interface DatabaseOptions {

host: string;

port: number;

user: string;

password: string;

database: string;

}

export default DatabaseOptions;

Using a connection pool

The node-postgres library recommends we use a connection pool. Since we are creating a dynamic module, we can define our pool as a provider.

database.module.ts

import { Global, Module } from '@nestjs/common';

import {

ConfigurableDatabaseModule,

CONNECTION_POOL,

DATABASE_OPTIONS,

} from './database.module-definition';

import DatabaseOptions from './databaseOptions';

import { Pool } from 'pg';

import DatabaseService from './database.service';

@Global()

@Module({

exports: [DatabaseService],

providers: [

DatabaseService,

{

provide: CONNECTION_POOL,

inject: [DATABASE_OPTIONS],

useFactory: (databaseOptions: DatabaseOptions) => {

return new Pool({

host: databaseOptions.host,

port: databaseOptions.port,

user: databaseOptions.user,

password: databaseOptions.password,

database: databaseOptions.database,

});

})

export default class DatabaseModule extends ConfigurableDatabaseModule {}

There is an advantage to defining the connection pool as a provider. If we want to specify some additional asynchronous configuration, this is a very good place to do so. You can find a proper example in a repository created by Jay McDoniel from the NestJS team.

Thanks to the fact that above we define a provider using the CONNECTION_POOL string, we now can use it in our service.

database.service.ts

import { Inject, Injectable } from '@nestjs/common';

import { Pool } from 'pg';

import { CONNECTION_POOL } from './database.module-definition';

@Injectable()

class DatabaseService {

constructor(@Inject(CONNECTION_POOL) private readonly pool: Pool) {}

async runQuery(query: string, params?: unknown[]) {

return this.pool.query(query, params);

}

export default DatabaseService;

Managing migrations using Knex

We could manage migrations manually, but using an existing tool might save us time and trouble. Therefore, in this article, we use Knex.

1	npm install knex

The first step in using Knex is to create the configuration file.

knexfile.ts

import type { Knex } from 'knex';

import { ConfigService } from '@nestjs/config';

import { config } from 'dotenv';

config();

const configService = new ConfigService();

const knexConfig: Knex.Config = {

client: 'postgresql',

connection: {

host: configService.get('POSTGRES_HOST'),

port: configService.get('POSTGRES_PORT'),

user: configService.get('POSTGRES_USER'),

password: configService.get('POSTGRES_PASSWORD'),

database: configService.get('POSTGRES_DB'),

};

module.exports = knexConfig;

Above we use dotenv to make sure that our .env is loaded before using the ConfigService.

We can now create our first migration using the migration CLI.

1	npx knex migrate:make add_posts_table

Running the above command creates a file where we can define our migration.

20220825173451_add_posts_table.ts

import { Knex } from 'knex';

export async function up(knex: Knex): Promise<void> {}

export async function down(knex: Knex): Promise<void> {}

We need to fill the up and down methods with the SQL queries Knex will run when running migrations and rolling them back.

20220825173451_add_posts_table.ts

import { Knex } from 'knex';

export async function up(knex: Knex): Promise<void> {

return knex.raw(`

CREATE TABLE posts (

id int GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,

title text NOT NULL,

post_content text NOT NULL

)

`);

}

export async function down(knex: Knex): Promise<void> {

return knex.raw(`

DROP TABLE posts

`);

}

If you want to know more about identity columns, check out Serial type versus identity columns in PostgreSQL and TypeORM

We must execute one last command if we want Knex to run our migration.

1	npx knex migrate:latest

Running migrations creates the knex_migrations table that contains information about which migrations Knex has already executed.

Knex also creates the knex_migrations_lock table to prevent multiple procsses from running the same migrations in the same time.

The official documentation is a good resource if you want to know more about managing migrations with Knex.

The repository pattern and working with models

It might be a good idea to keep the logic of accessing data in a single place for a particular table. A very popular way of doing that is using the repository pattern.

posts.repository.ts

import { Injectable } from '@nestjs/common';

import DatabaseService from '../database/database.service';

@Injectable()

class PostsRepository {

constructor(private readonly databaseService: DatabaseService) {}

async getAll() {

const databaseResponse = await this.databaseService.runQuery(`

SELECT * FROM posts

`);

return databaseResponse.rows;

}

export default PostsRepository;

When running the getAll method, we get the data in the following format:

[

{

id: 1,

title: 'Hello world',

post_content: 'Lorem ipsum'

}

]

We often might want to transform the raw data we get from the database. A fitting way to do that is to use the class-transformer library, a popular choice when working with NestJS.

post.model.ts

import { Expose } from 'class-transformer';

class PostModel {

id: number;

title: string;

@Expose({ name: 'post_content' })

content: string;

}

export default PostModel;

We need to call the plainToInstance function in our repository to use the above model.

posts.repository.ts

import { Injectable } from '@nestjs/common';

import DatabaseService from '../database/database.service';

import { plainToInstance } from 'class-transformer';

import PostModel from './post.model';

@Injectable()

class PostsRepository {

constructor(private readonly databaseService: DatabaseService) {}

async getAll() {

const databaseResponse = await this.databaseService.runQuery(`

SELECT * FROM posts

`);

return plainToInstance(PostModel, databaseResponse.rows);

}

export default PostsRepository;

Thanks to doing the above, the data returned by the getAll function contains the instances of the PostModel class. Now, instead of post_content we have the content property.

[

{

id: 1,

title: 'Hello world',

content: 'Lorem ipsum'

}

]

Using parametrized queries

We often need to use the input provided by the user as a part of our SQL query. When doing that carelessly, we open ourselves to SQL injections. The SQL injection can happen if we treat the user’s input as a part of the query. Let’s take a look at a simple example:

async getById(id: unknown) {

const databaseResponse = await this.databaseService.runQuery(

SELECT * FROM posts WHERE id=${id}

);

const entity = databaseResponse.rows[0];

if (!entity) {

throw new NotFoundException();

}

return plainToInstance(PostModel, entity);

}

Because in the getById function, we concatenate a string, we open ourselves to the following SQL injection:

1	getById('1; DROP TABLE posts;');

Running the getById method with the above string causes the following SQL query to run:

1	SELECT * FROM posts WHERE id=1; DROP TABLE posts;

Unfortunately, it destroys our posts table.

One one of dealing with the above problem is using parameterized queries. When we use it, we send the parameters separately from the query, and our database knows to treat them as parameters.

To use parameters, we need to provide the second argument to the runQuery method we’ve defined in the DatabaseService.

posts.repository.ts

import { Injectable, NotFoundException } from '@nestjs/common';

import DatabaseService from '../database/database.service';

import { plainToInstance } from 'class-transformer';

import PostModel from './post.model';

@Injectable()

class PostsRepository {

constructor(private readonly databaseService: DatabaseService) {}

async getById(id: number) {

const databaseResponse = await this.databaseService.runQuery(

SELECT * FROM posts WHERE id=$1

[id],

);

const entity = databaseResponse.rows[0];

if (!entity) {

throw new NotFoundException();

}

return plainToInstance(PostModel, entity);

}

async delete(id: number) {

const databaseResponse = await this.databaseService.runQuery(

`DELETE FROM posts WHERE id=$1`,

[id],

);

if (databaseResponse.rowCount === 0) {

throw new NotFoundException();

}

// ...

}

export default PostsRepository;

Validating incoming data

To validate the data provided by the users, we can take advantage of the class-validator library that’s popular among people using the NestJS framework.

post.dto.ts

import { IsString, IsNotEmpty } from 'class-validator';

class PostDto {

@IsString()

@IsNotEmpty()

title: string;

@IsString()

@IsNotEmpty()

content: string;

}

export default PostDto;

We can use the above class in our repository when creating and updating posts.

posts.repository.ts

import { Injectable, NotFoundException } from '@nestjs/common';

import DatabaseService from '../database/database.service';

import { plainToInstance } from 'class-transformer';

import PostModel from './post.model';

import PostDto from './post.dto';

@Injectable()

class PostsRepository {

constructor(private readonly databaseService: DatabaseService) {}

async create(postData: PostDto) {

const databaseResponse = await this.databaseService.runQuery(

INSERT INTO posts (

title,

post_content

) VALUES (

$1,

) RETURNING *

[postData.title, postData.content],

);

return plainToInstance(PostModel, databaseResponse.rows[0]);

}

async update(id: number, postData: PostDto) {

const databaseResponse = await this.databaseService.runQuery(

UPDATE posts

SET title = $2, post_content = $3

WHERE id = $1

RETURNING *

[id, postData.title, postData.content],

);

const entity = databaseResponse.rows[0];

if (!entity) {

throw new NotFoundException();

}

return plainToInstance(PostModel, entity);

}

// ...

}

export default PostsRepository;

If you want to see the full repository, check out this repository.

We also need to use the PostDto class in our controller.

posts.controller.ts

import {

Body,

Controller,

Delete,

Get,

Param,

Post,

Put,

} from '@nestjs/common';

import { PostsService } from './posts.service';

import FindOneParams from '../utils/findOneParams';

import PostDto from './post.dto';

@Controller('posts')

export default class PostsController {

constructor(private readonly postsService: PostsService) {}

@Get()

getPosts() {

return this.postsService.getPosts();

}

@Get(':id')

getPostById(@Param() { id }: FindOneParams) {

return this.postsService.getPostById(id);

}

@Put(':id')

updatePost(@Param() { id }: FindOneParams, @Body() postData: PostDto) {

return this.postsService.updatePost(id, postData);

}

@Post()

createPost(@Body() postData: PostDto) {

return this.postsService.createPost(postData);

}

@Delete(':id')

deletePost(@Param() { id }: FindOneParams) {

return this.postsService.deletePost(id);

}

The FindOneParams class takes care of parsing the id from the string to a number.

For validation to take place, we also need to use the ValidationPipe. To do that globally, we can add it to the providers array in our AppModule.

app.module.ts

import { Module, ValidationPipe } from '@nestjs/common';

import { APP_PIPE } from '@nestjs/core';

@Module({

providers: [

{

provide: APP_PIPE,

useValue: new ValidationPipe({

transform: true,

}),

// ...

})

export class AppModule {}

Using services

You might have noticed that the PostsController uses the PostsService, a straightforward service that uses the PostsRepository.

posts.service.ts

import { Injectable } from '@nestjs/common';

import PostsRepository from './posts.repository';

import PostDto from './post.dto';

@Injectable()

export class PostsService {

constructor(private readonly postsRepository: PostsRepository) {}

getPosts() {

return this.postsRepository.getAll();

}

getPostById(id: number) {

return this.postsRepository.getById(id);

}

createPost(postData: PostDto) {

return this.postsRepository.create(postData);

}

updatePost(id: number, postData: PostDto) {

return this.postsRepository.update(id, postData);

}

deletePost(id: number) {

return this.postsRepository.delete(id);

}

A service is a great place to write additional logic. A good example would be caching or using ElasticSearch.

If you want to know more about ElasticSearch, check out API with NestJS #12. Introduction to Elasticsearch

Summary

There could be many reasons we might not want to use ORM, and we’ve covered some of them in this article. To deal with that, we’ve implemented a way to write raw SQL queries when working with PostgreSQL and NestJS. To increase the development experience, we’ve decided to rely on Knex for managing migrations. The repository created in this article can serve as a good starting point for a more complex project.

Series Navigation<< API with NestJS #71. Introduction to feature flagsAPI with NestJS #73. One-to-one relationships with raw SQL queries >>