Userauth part6 api token

backend/.env.example

@@ -24,3 +24,8 @@ RATE_LIMIT_MAX_REQUESTS=100
 
 # Logging
 LOG_LEVEL=info
+
+# Authentication (JWT)
+# Generate a strong secret: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
+JWT_SECRET=your-jwt-secret-min-32-chars
+JWT_EXPIRES_IN=7d

backend/package.json

@@ -22,15 +22,17 @@
   "license": "MIT",
   "dependencies": {
     "@google/genai": "^1.0.0",
+    "bcryptjs": "^3.0.3",
     "compression": "^1.7.5",
-    "pg": "^8.13.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.21.0",
     "express-rate-limit": "^7.4.0",
     "express-validator": "^7.2.0",
     "helmet": "^7.1.0",
+    "jsonwebtoken": "^9.0.3",
     "morgan": "^1.10.0",
+    "pg": "^8.13.0",
     "winston": "^3.14.0"
   },
   "devDependencies": {

backend/src/config/index.js

@@ -40,7 +40,7 @@ const validateEnvVars = (requiredVars) => {
 };
 
 // Validate critical environment variables
-const requiredVars = ['DATABASE_URL'];
+const requiredVars = ['DATABASE_URL', 'JWT_SECRET'];
 
 // Only validate in production, allow fallbacks in development
 if (process.env.NODE_ENV === 'production') {
@@ -64,6 +64,13 @@ const config = {
     url: process.env.DATABASE_URL || '',
   },
 
+  // Authentication (JWT)
+  auth: {
+    jwtSecret: process.env.JWT_SECRET || 'dev-secret-change-in-production',
+    jwtExpiresIn: process.env.JWT_EXPIRES_IN || '7d',
+    bcryptRounds: 12,
+  },
+
   // Gemini AI configuration
   gemini: {
     apiKey: process.env.GEMINI_API_KEY || '',

backend/src/controllers/authController.js

@@ -0,0 +1,84 @@
+/**
+ * Auth Controller
+ * Handles HTTP request/response for authentication endpoints.
+ * Validates input, delegates to authService, and formats responses.
+ */
+
+import { asyncHandler, APIError } from '../middleware/errorHandler.js';
+import * as authService from '../services/authService.js';
+
+/**
+ * POST /api/v1/auth/register
+ * Create a new user account.
+ * Body: { email, password, name? }
+ */
+export const register = asyncHandler(async (req, res) => {
+  const { email, password, name } = req.body;
+
+  // Input validation
+  if (!email || !password) {
+    throw new APIError('Email and password are required', 400, 'VALIDATION_ERROR');
+  }
+
+  // Basic email format check
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!emailRegex.test(email)) {
+    throw new APIError('Invalid email format', 400, 'VALIDATION_ERROR');
+  }
+
+  if (password.length < 8) {
+    throw new APIError('Password must be at least 8 characters', 400, 'VALIDATION_ERROR');
+  }
+
+  if (password.length > 128) {
+    throw new APIError('Password must be at most 128 characters', 400, 'VALIDATION_ERROR');
+  }
+
+  try {
+    const result = await authService.registerUser(email, password, name);
+    res.status(201).json({ success: true, data: result });
+  } catch (err) {
+    if (err.statusCode === 409) {
+      throw new APIError(err.message, 409, err.code || 'EMAIL_EXISTS');
+    }
+    throw err;
+  }
+});
+
+/**
+ * POST /api/v1/auth/login
+ * Authenticate with email and password.
+ * Body: { email, password }
+ */
+export const login = asyncHandler(async (req, res) => {
+  const { email, password } = req.body;
+
+  if (!email || !password) {
+    throw new APIError('Email and password are required', 400, 'VALIDATION_ERROR');
+  }
+
+  try {
+    const result = await authService.loginUser(email, password);
+    res.json({ success: true, data: result });
+  } catch (err) {
+    if (err.statusCode === 401) {
+      throw new APIError(err.message, 401, err.code || 'INVALID_CREDENTIALS');
+    }
+    throw err;
+  }
+});
+
+/**
+ * GET /api/v1/auth/me
+ * Get the current user's profile.
+ * Requires: Authorization: Bearer <token>
+ */
+export const me = asyncHandler(async (req, res) => {
+  const user = await authService.getUserById(req.user.id);
+
+  if (!user) {
+    throw new APIError('User not found', 404, 'NOT_FOUND');
+  }
+
+  res.json({ success: true, data: { user } });
+});

backend/src/middleware/auth.js

@@ -0,0 +1,59 @@
+/**
+ * JWT Authentication Middleware
+ * Extracts and verifies JWT from the Authorization header.
+ * Sets req.user = { id, email } on success.
+ */
+
+import jwt from 'jsonwebtoken';
+import config from '../config/index.js';
+import { APIError } from './errorHandler.js';
+
+/**
+ * requireAuth — blocks unauthenticated requests with 401.
+ * Expects header: Authorization: Bearer <token>
+ */
+export const requireAuth = (req, _res, next) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    throw new APIError('Authentication required', 401, 'UNAUTHORIZED');
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  try {
+    const decoded = jwt.verify(token, config.auth.jwtSecret);
+    req.user = { id: decoded.sub, email: decoded.email };
+    next();
+  } catch (err) {
+    if (err.name === 'TokenExpiredError') {
+      throw new APIError('Token expired — please log in again', 401, 'TOKEN_EXPIRED');
+    }
+    throw new APIError('Invalid token', 401, 'INVALID_TOKEN');
+  }
+};
+
+/**
+ * optionalAuth — attaches user if a valid token is present, but does NOT block.
+ * Useful for routes that work for both guests and logged-in users.
+ * Sets req.user = null when no token or invalid token.
+ */
+export const optionalAuth = (req, _res, next) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    req.user = null;
+    return next();
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  try {
+    const decoded = jwt.verify(token, config.auth.jwtSecret);
+    req.user = { id: decoded.sub, email: decoded.email };
+  } catch {
+    req.user = null;
+  }
+
+  next();
+};

backend/src/middleware/index.js

@@ -5,4 +5,5 @@
 
 export { APIError, notFoundHandler, errorHandler, asyncHandler } from './errorHandler.js';
 export { validate, validationRules } from './validation.js';
-export { generalLimiter, aiLimiter, ttsLimiter } from './rateLimiter.js';
+export { generalLimiter, aiLimiter, ttsLimiter, authLimiter } from './rateLimiter.js';
+export { requireAuth, optionalAuth } from './auth.js';

backend/src/middleware/rateLimiter.js

@@ -73,8 +73,21 @@ export const ttsLimiter = rateLimit({
   handler: createLimitHandler('tts'),
 });
 
+/**
+ * Strict limiter for authentication endpoints
+ * Protects against brute-force attacks
+ */
+export const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 20, // Limit each IP to 20 requests per window
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: createLimitHandler('auth'),
+});
+
 export default {
   generalLimiter,
   aiLimiter,
   ttsLimiter,
+  authLimiter,
 };

backend/src/routes/authRoutes.js

@@ -0,0 +1,27 @@
+/**
+ * Auth Routes
+ * Handles user registration, login, and profile endpoints.
+ *
+ * POST /register  — Create a new account (open registration)
+ * POST /login     — Authenticate and receive JWT
+ * GET  /me        — Get current user profile (requires auth)
+ */
+
+import { Router } from 'express';
+import * as authController from '../controllers/authController.js';
+import { requireAuth } from '../middleware/auth.js';
+import { authLimiter } from '../middleware/rateLimiter.js';
+
+const router = Router();
+
+// Apply strict rate limiting to auth routes
+router.use(authLimiter);
+
+// Public routes
+router.post('/register', authController.register);
+router.post('/login', authController.login);
+
+// Protected routes
+router.get('/me', requireAuth, authController.me);
+
+export default router;