Authentication & Authorization

// npm install bcrypt jsonwebtoken

const bcrypt = require('bcrypt');

// Registration: Hash the password before storing
async function registerUser(name, email, password) {
  // Deliberately slow — always the ASYNC form. bcrypt.hashSync would block
  // every other request in the process for as long as it takes.
  const saltRounds = 12;
  const hashedPassword = await bcrypt.hash(password, saltRounds);

  // Save to database (password is now hashed)
  const user = {
    name,
    email,
    password: hashedPassword  // $2b$10$X7Q3...
  };

  // Save user to DB...
  return user;
}

// Login: Compare submitted password with stored hash
async function loginUser(email, password) {
  // Find user in database
  const user = await findUserByEmail(email);
  if (!user) {
    throw new Error('Invalid email or password');
  }

  // Compare password with hash
  const isMatch = await bcrypt.compare(password, user.password);
  if (!isMatch) {
    throw new Error('Invalid email or password');
  }

  return user;
}

// --- Session style: the server remembers ---
// login
// const session = await Session.create({ userId: user._id });
// res.cookie('sid', session.id, {
//   httpOnly: true,     // JavaScript cannot read it — XSS cannot steal it
//   secure: true,       // HTTPS only
//   sameSite: 'lax',    // limits cross-site sending (CSRF)
//   maxAge: 1000 * 60 * 60 * 24
// });
// logout  -> await Session.deleteOne({ _id: sessionId });   // immediate

// --- Token style: the token carries the claim ---
const token = jwt.sign(
  { id: user._id, role: user.role },
  process.env.JWT_SECRET,
  { expiresIn: '1h' }
);
res.json({ token });

// logout -> the frontend forgets the token.
// The token itself stays valid until it expires. If somebody copied it,
// it still works. That is the cost of statelessness, and it is why
// short expiries (or a server-side deny-list) exist.

const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
const express = require('express');
const app = express();
app.use(express.json());

// Fail at startup rather than shipping a guessable fallback secret.
// NEVER write: process.env.JWT_SECRET || 'your-secret-key'
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) throw new Error('JWT_SECRET is not set — refusing to start');

// Generate a token
function generateToken(user) {
  return jwt.sign(
    { id: user.id, email: user.email, role: user.role },
    JWT_SECRET,
    { expiresIn: '24h' }
  );
}

// Login route
app.post('/api/auth/login', async (req, res) => {
  try {
    const { email, password } = req.body;
    const user = await findUserByEmail(email); // DB lookup

    if (!user || !(await bcrypt.compare(password, user.password))) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    const token = generateToken(user);
    res.json({ token, user: { id: user.id, name: user.name } });
  } catch (err) {
    res.status(500).json({ error: 'Server error' });
  }
});

// Auth middleware — protects routes
function authenticate(req, res, next) {
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const token = authHeader.split(' ')[1];
  try {
    // jwt.verify CHECKS the signature and the expiry.
    // jwt.decode would read the payload and believe anything — never use it here.
    req.user = jwt.verify(token, JWT_SECRET);
    return next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
}

// Protected route
app.get('/api/profile', authenticate, (req, res) => {
  res.json({ user: req.user });
});

// Admin-only middleware
function requireAdmin(req, res, next) {
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Admin access required' });
  }
  next();
}

app.get('/api/admin/users', authenticate, requireAdmin, (req, res) => {
  res.json({ message: 'Admin dashboard' });
});

// Authentication: who are you?   (sets req.user, or 401)
function authenticate(req, res, next) { /* verifies the JWT — see above */ }

// Authorisation by role: are you allowed?   (403, not 401)
function requireRole(...allowed) {
  return (req, res, next) => {
    if (!allowed.includes(req.user.role)) {
      return res.status(403).json({ error: 'Not permitted' });
    }
    return next();
  };
}

router.get('/admin/users', authenticate, requireRole('admin'), listAllUsers);

// Authorisation by ownership: the far more common gap
router.get('/tasks/:id', authenticate, async (req, res) => {
  // WRONG — hands anyone's task to anyone who happens to be logged in
  // const task = await Task.findById(req.params.id);

  // RIGHT — ownership is part of the query itself
  const task = await Task.findOne({ _id: req.params.id, owner: req.user.id });
  if (!task) return res.status(404).json({ error: 'Task not found' });
  res.json(task);
});

// A role inside a token was decided at LOGIN time.
// Demoting a user does not change the token they are already holding.
const fresh = await User.findById(req.user.id).select('role');
if (fresh.role !== 'admin') return res.status(403).json({ error: 'Not permitted' });

// A short audit you can run against your own project today

// 1. Is the secret required, with no fallback?
if (!process.env.JWT_SECRET) throw new Error('JWT_SECRET is not set');

// 2. Do tokens expire?
jwt.sign({ id: user._id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' });

// 3. Can a password hash ever leave the server?
//    schema: password: { type: String, required: true, select: false }
res.json({ id: user._id, name: user.name, email: user.email });   // never res.json(user)

// 4. Is the login route rate limited?
app.use('/api/auth/login', rateLimit({ windowMs: 15 * 60 * 1000, max: 10 }));

// 5. Can a client set its own role?
// const user = await User.create({ ...req.body });     // accepts role: 'admin'
const user = await User.create({                         // named fields only
  name: req.body.name,
  email: req.body.email,
  password: req.body.password
});

// 6. Is a token ever in a URL?
// GET /api/tasks?token=eyJhbGciOi...   <- logs, history, referrer headers. Never.