Upload 35 files

.dockerignore

@@ -0,0 +1,8 @@
+node_modules
+npm-debug.log*
+.env
+.env.*
+!.env.example
+.git
+.gitignore
+*.md

.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+.env
+npm-debug.log*

Dockerfile

@@ -0,0 +1,33 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+# Install dependencies in their own layer so this only re-runs when
+# package*.json actually changes, speeding up rebuilds. Using `npm
+# install` rather than `npm ci` since this repo doesn't ship a
+# package-lock.json — if you generate one locally (recommended:
+# `npm install` once, then commit package-lock.json), switch this to
+# `npm ci --omit=dev` for fully reproducible, faster builds.
+COPY package*.json ./
+RUN npm install --omit=dev
+
+# Copy the rest of the application source
+COPY . .
+
+# Hugging Face Spaces (Docker SDK) route external traffic to whatever
+# port is declared as "app_port" in the Space's README.md metadata —
+# 7860 is Hugging Face's own default, so we match it here. If you set a
+# different app_port in your Space's README, update PORT to match.
+ENV NODE_ENV=production
+ENV PORT=7860
+EXPOSE 7860
+
+# Run as the non-root "node" user (built into the official Node image)
+# rather than root, as one more layer of defense-in-depth.
+RUN chown -R node:node /app
+USER node
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "require('http').get('http://localhost:7860/api/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"
+
+CMD ["node", "src/server.js"]

README.md

@@ -1,9 +1,10 @@
 ---
-title: Auth App API
-emoji: 🔐
-colorFrom: indigo
+title: Aynwerdstudy
+emoji: 🎓
+colorFrom: blue
 colorTo: purple
 sdk: docker
+app_port: 7860
 pinned: false
 ---
 

package.json

@@ -0,0 +1,40 @@
+{
+  "name": "aynwerd-server",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Node.js/Express + MongoDB Atlas backend for courses, checkout, and admin-approved enrolment.",
+  "type": "commonjs",
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "dev": "nodemon src/server.js",
+    "seed": "node src/seed/seed.js"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "bcryptjs": "^2.4.3",
+    "cloudinary": "^2.5.1",
+    "compression": "^1.7.4",
+    "cookie-parser": "^1.4.6",
+    "cors": "^2.8.5",
+    "dotenv": "^16.4.5",
+    "express": "^4.19.2",
+    "express-mongo-sanitize": "^2.2.0",
+    "express-rate-limit": "^7.4.0",
+    "express-validator": "^7.2.0",
+    "helmet": "^7.1.0",
+    "hpp": "^0.2.3",
+    "jsonwebtoken": "^9.0.2",
+    "mongoose": "^8.6.0",
+    "morgan": "^1.10.0",
+    "multer": "^1.4.5-lts.1",
+    "nodemailer": "^6.9.14",
+    "uuid": "^9.0.1",
+    "winston": "^3.14.2"
+  },
+  "devDependencies": {
+    "nodemon": "^3.1.4"
+  }
+}

src/app.js

@@ -0,0 +1,86 @@
+const express = require("express");
+const helmet = require("helmet");
+const cors = require("cors");
+const cookieParser = require("cookie-parser");
+const compression = require("compression");
+const morgan = require("morgan");
+const mongoSanitize = require("express-mongo-sanitize");
+const hpp = require("hpp");
+
+const { env } = require("./config/env");
+const { apiLimiter } = require("./middleware/rateLimiters");
+const { errorHandler, notFound } = require("./middleware/errorHandler");
+const logger = require("./utils/logger");
+
+const authRoutes = require("./routes/auth.routes");
+const courseRoutes = require("./routes/course.routes");
+const orderRoutes = require("./routes/order.routes");
+const adminRoutes = require("./routes/admin.routes");
+
+const app = express();
+
+// Trust the first proxy hop (Render/Heroku/Nginx/etc.) so req.ip and the
+// "secure" cookie/HSTS logic reflect the real client over HTTPS.
+app.set("trust proxy", 1);
+
+// --- Security headers -------------------------------------------------
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        imgSrc: ["'self'", "data:", "https:"],
+        objectSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+      },
+    },
+    crossOriginResourcePolicy: { policy: "same-site" },
+    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
+  })
+);
+
+// --- CORS: only the configured frontend origins may call the API, and
+// credentials (refresh-token cookie) are only sent to those origins. ---
+app.use(
+  cors({
+    origin(origin, callback) {
+      if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
+      return callback(new Error("Not allowed by CORS"));
+    },
+    credentials: true,
+  })
+);
+
+app.use(compression());
+app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
+app.use(express.urlencoded({ extended: true, limit: "100kb" }));
+app.use(cookieParser(env.cookieSecret));
+
+// Strip any keys starting with "$" or containing "." from user input to
+// block MongoDB operator-injection attacks.
+app.use(mongoSanitize());
+// Prevent HTTP parameter-pollution (e.g. ?role=user&role=admin).
+app.use(hpp());
+
+app.use(
+  morgan("combined", {
+    stream: { write: (message) => logger.info(message.trim()) },
+    skip: () => env.nodeEnv === "test",
+  })
+);
+
+app.use("/api/", apiLimiter);
+
+app.get("/api/health", (req, res) => res.json({ status: "ok", time: new Date().toISOString() }));
+
+app.use("/api/auth", authRoutes);
+app.use("/api/courses", courseRoutes);
+app.use("/api/orders", orderRoutes);
+app.use("/api/admin", adminRoutes);
+
+app.use(notFound);
+app.use(errorHandler);
+
+module.exports = app;

src/config/cloudinary.js

@@ -0,0 +1,11 @@
+const { v2: cloudinary } = require("cloudinary");
+const { env } = require("./env");
+
+cloudinary.config({
+  cloud_name: env.cloudinary.cloudName,
+  api_key: env.cloudinary.apiKey,
+  api_secret: env.cloudinary.apiSecret,
+  secure: true,
+});
+
+module.exports = cloudinary;

src/config/db.js

@@ -0,0 +1,44 @@
+const mongoose = require("mongoose");
+const { env } = require("./env");
+const logger = require("../utils/logger");
+
+mongoose.set("strictQuery", true);
+
+async function connectDB() {
+  if (!env.mongoUri) {
+    throw new Error("MONGODB_URI is not set. Copy .env.example to .env and configure your Atlas connection string.");
+  }
+
+  mongoose.connection.on("connected", () => logger.info("MongoDB connected"));
+  mongoose.connection.on("error", (err) => logger.error("MongoDB connection error", { error: err.message }));
+  mongoose.connection.on("disconnected", () => logger.warn("MongoDB disconnected"));
+
+  try {
+    await mongoose.connect(env.mongoUri, {
+      // Modern mongoose driver already defaults to these; kept explicit for clarity.
+      autoIndex: env.nodeEnv !== "production", // build indexes lazily in prod via migration/ops task
+      maxPoolSize: 20,
+      serverSelectionTimeoutMS: 10000,
+    });
+  } catch (err) {
+    if (err.code === "ECONNREFUSED" && err.syscall === "querySrv") {
+      throw new Error(
+        "Could not resolve your MongoDB Atlas SRV connection string " +
+          `(${err.hostname || "the cluster hostname"}). This almost always means your network, router, ` +
+          "or ISP is blocking DNS SRV record lookups (common on home/office Wi-Fi) — it is not a code " +
+          "or credentials problem. Fix: in Atlas, go to your cluster → Connect → Drivers, and use the " +
+          "'standard connection string' (starts with mongodb:// and lists three hosts) instead of the " +
+          "mongodb+srv:// one, then update MONGODB_URI in your .env. See server/README.md for details."
+      );
+    }
+    throw err;
+  }
+
+  return mongoose.connection;
+}
+
+async function disconnectDB() {
+  await mongoose.disconnect();
+}
+
+module.exports = { connectDB, disconnectDB };

src/config/env.js

@@ -0,0 +1,103 @@
+require("dotenv").config();
+
+// Fail fast if critical secrets are missing or left as placeholders — this
+// is a cheap, high-value guard against accidentally deploying with
+// insecure defaults.
+const REQUIRED_IN_PRODUCTION = [
+  "MONGODB_URI",
+  "JWT_ACCESS_SECRET",
+  "JWT_REFRESH_SECRET",
+  "FIELD_ENCRYPTION_KEY",
+  "COOKIE_SECRET",
+  "SMTP_HOST",
+  "SMTP_USER",
+  "SMTP_PASS",
+  "CLOUDINARY_CLOUD_NAME",
+  "CLOUDINARY_API_KEY",
+  "CLOUDINARY_API_SECRET",
+];
+
+const env = {
+  nodeEnv: process.env.NODE_ENV || "development",
+  port: parseInt(process.env.PORT, 10) || 5000,
+  clientOrigins: (process.env.CLIENT_ORIGINS || "http://localhost:5173")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean),
+
+  mongoUri: process.env.MONGODB_URI,
+
+  jwtAccessSecret: process.env.JWT_ACCESS_SECRET,
+  jwtRefreshSecret: process.env.JWT_REFRESH_SECRET,
+  jwtAccessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || "15m",
+  jwtRefreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || "7d",
+
+  fieldEncryptionKey: process.env.FIELD_ENCRYPTION_KEY,
+  cookieSecret: process.env.COOKIE_SECRET,
+  cookieSecure: process.env.COOKIE_SECURE === "true",
+
+  smtp: {
+    host: process.env.SMTP_HOST,
+    port: parseInt(process.env.SMTP_PORT, 10) || 587,
+    secure: process.env.SMTP_SECURE === "true",
+    user: process.env.SMTP_USER,
+    pass: process.env.SMTP_PASS,
+  },
+  emailFrom: process.env.EMAIL_FROM || "Aynwerd Academy <no-reply@aynwerd.com>",
+  adminNotifyEmail: process.env.ADMIN_NOTIFY_EMAIL,
+
+  bank: {
+    name: process.env.BANK_NAME || "",
+    accountName: process.env.BANK_ACCOUNT_NAME || "",
+    accountNumber: process.env.BANK_ACCOUNT_NUMBER || "",
+    routingNumber: process.env.BANK_ROUTING_NUMBER || "",
+    swiftBic: process.env.BANK_SWIFT_BIC || "",
+    iban: process.env.BANK_IBAN || "",
+    address: process.env.BANK_ADDRESS || "",
+  },
+  payoneer: {
+    paymentUrl: process.env.PAYONEER_PAYMENT_URL || "https://www.payoneer.com/",
+    accountEmail: process.env.PAYONEER_ACCOUNT_EMAIL || "",
+  },
+
+  seedAdmin: {
+    name: process.env.SEED_ADMIN_NAME || "Site Admin",
+    email: process.env.SEED_ADMIN_EMAIL,
+    password: process.env.SEED_ADMIN_PASSWORD,
+  },
+
+  // Cloudinary: free-tier media storage used exclusively for admin-uploaded
+  // course videos/documents. Files are uploaded with delivery type
+  // "authenticated" so nothing is reachable without a freshly signed,
+  // short-lived URL minted server-side for a verified, paying learner.
+  cloudinary: {
+    cloudName: process.env.CLOUDINARY_CLOUD_NAME,
+    apiKey: process.env.CLOUDINARY_API_KEY,
+    apiSecret: process.env.CLOUDINARY_API_SECRET,
+  },
+};
+
+function assertProductionSafety() {
+  if (env.nodeEnv !== "production") return;
+
+  const missing = REQUIRED_IN_PRODUCTION.filter((key) => {
+    const value = process.env[key];
+    return !value || value.startsWith("replace_with_") || value.includes("<");
+  });
+
+  if (missing.length > 0) {
+    // eslint-disable-next-line no-console
+    console.error(
+      `FATAL: refusing to start in production with missing/placeholder env vars: ${missing.join(", ")}`
+    );
+    process.exit(1);
+  }
+
+  if (Buffer.from(env.fieldEncryptionKey || "", "hex").length !== 32) {
+    // eslint-disable-next-line no-console
+    console.error("FATAL: FIELD_ENCRYPTION_KEY must be a 32-byte (64 hex character) value.");
+    process.exit(1);
+  }
+}
+
+module.exports = { env, assertProductionSafety };

src/controllers/admin.controller.js

@@ -0,0 +1,198 @@
+const mongoose = require("mongoose");
+const Order = require("../models/Order");
+const User = require("../models/User");
+const Course = require("../models/Course");
+const AuditLog = require("../models/AuditLog");
+const { sendPaymentConfirmedEmail, sendPaymentRejectedEmail } = require("../utils/email");
+const logger = require("../utils/logger");
+
+async function listOrders(req, res, next) {
+  try {
+    const { status } = req.query;
+    const filter = {};
+    if (status) filter.status = status;
+
+    const orders = await Order.find(filter)
+      .sort({ createdAt: -1 })
+      .populate("user", "name email")
+      .populate("course", "title");
+
+    res.json({
+      orders: orders.map((o) => ({
+        ...o.toPublicJSON(),
+        user: o.user ? { id: o.user._id, name: o.user.name, email: o.user.email } : null,
+      })),
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+
+/** Admin views the decrypted payment reference only when actively reviewing a specific order. */
+async function getOrderDetail(req, res, next) {
+  try {
+    const order = await Order.findById(req.params.id)
+      .select("+paymentReferenceEncrypted +payerNoteEncrypted")
+      .populate("user", "name email")
+      .populate("course", "title price");
+    if (!order) return res.status(404).json({ error: "Order not found." });
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.order_viewed",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+    });
+
+    res.json({
+      order: {
+        ...order.toPublicJSON({ includeSensitive: true }),
+        user: order.user ? { id: order.user._id, name: order.user.name, email: order.user.email } : null,
+      },
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+
+/**
+ * Confirms a payment: marks the order confirmed, grants course access to
+ * the user, and emails the customer. Wrapped in a transaction so a
+ * partial failure can't leave the order confirmed without access
+ * granted (or vice versa).
+ */
+async function confirmOrder(req, res, next) {
+  const session = await mongoose.startSession();
+  try {
+    let resultOrder;
+    let resultUser;
+    let course;
+
+    await session.withTransaction(async () => {
+      const order = await Order.findById(req.params.id).session(session);
+      if (!order) throw Object.assign(new Error("Order not found."), { status: 404 });
+      if (order.status === "confirmed") throw Object.assign(new Error("Order already confirmed."), { status: 409 });
+      if (!["awaiting_confirmation", "pending_payment"].includes(order.status)) {
+        throw Object.assign(new Error("Order cannot be confirmed from its current status."), { status: 409 });
+      }
+
+      order.status = "confirmed";
+      order.confirmedBy = req.user._id;
+      order.confirmedAt = new Date();
+      await order.save({ session });
+
+      const user = await User.findById(order.user).session(session);
+      if (!user) throw Object.assign(new Error("Associated user not found."), { status: 404 });
+
+      const alreadyEnrolled = user.enrolledCourses.some((ec) => ec.course.toString() === order.course.toString());
+      if (!alreadyEnrolled) {
+        user.enrolledCourses.push({ course: order.course, order: order._id, accessGrantedAt: new Date() });
+        await user.save({ session });
+      }
+
+      course = await Course.findById(order.course).session(session);
+      resultOrder = order;
+      resultUser = user;
+    });
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.order_confirmed",
+      targetType: "Order",
+      targetId: resultOrder._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { userId: resultUser._id.toString() },
+    });
+
+    sendPaymentConfirmedEmail({
+      to: resultUser.email,
+      name: resultUser.name,
+      order: resultOrder,
+      courseTitle: course ? course.title : resultOrder.courseTitleSnapshot,
+    }).catch((err) => logger.error("Payment-confirmed email failed", { error: err.message }));
+
+    res.json({ order: resultOrder.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  } finally {
+    session.endSession();
+  }
+}
+
+async function rejectOrder(req, res, next) {
+  try {
+    const { reason } = req.body;
+    const order = await Order.findById(req.params.id).populate("user", "name email");
+    if (!order) return res.status(404).json({ error: "Order not found." });
+    if (order.status === "confirmed") {
+      return res.status(409).json({ error: "A confirmed order cannot be rejected. Consider revoking access separately." });
+    }
+
+    order.status = "rejected";
+    order.rejectionReason = reason || null;
+    await order.save();
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.order_rejected",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { reason: reason || null },
+    });
+
+    if (order.user) {
+      sendPaymentRejectedEmail({
+        to: order.user.email,
+        name: order.user.name,
+        order,
+        courseTitle: order.courseTitleSnapshot,
+        reason,
+      }).catch((err) => logger.error("Payment-rejected email failed", { error: err.message }));
+    }
+
+    res.json({ order: order.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function dashboardStats(req, res, next) {
+  try {
+    const [pendingCount, confirmedCount, rejectedCount, totalUsers, revenueAgg] = await Promise.all([
+      Order.countDocuments({ status: "awaiting_confirmation" }),
+      Order.countDocuments({ status: "confirmed" }),
+      Order.countDocuments({ status: "rejected" }),
+      User.countDocuments({ role: "user" }),
+      Order.aggregate([{ $match: { status: "confirmed" } }, { $group: { _id: "$currency", total: { $sum: "$amount" } } }]),
+    ]);
+
+    res.json({
+      pendingOrders: pendingCount,
+      confirmedOrders: confirmedCount,
+      rejectedOrders: rejectedCount,
+      totalUsers,
+      revenueByCurrency: revenueAgg.map((r) => ({ currency: r._id, total: r.total })),
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function listUsers(req, res, next) {
+  try {
+    const users = await User.find({}).sort({ createdAt: -1 }).limit(500);
+    res.json({ users: users.map((u) => u.toSafeJSON()) });
+  } catch (err) {
+    next(err);
+  }
+}
+
+module.exports = { listOrders, getOrderDetail, confirmOrder, rejectOrder, dashboardStats, listUsers };

src/controllers/auth.controller.js

@@ -0,0 +1,192 @@
+const User = require("../models/User");
+const AuditLog = require("../models/AuditLog");
+const { signAccessToken, signRefreshToken, verifyRefreshToken } = require("../utils/jwt");
+const { env } = require("../config/env");
+const logger = require("../utils/logger");
+
+const MAX_FAILED_ATTEMPTS = 5;
+const LOCK_DURATION_MS = 15 * 60 * 1000; // 15 minutes
+const REFRESH_COOKIE_NAME = "aynwerd_rt";
+
+function refreshCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: env.cookieSecure,
+    sameSite: "lax",
+    path: "/api/auth",
+    maxAge: 7 * 24 * 60 * 60 * 1000,
+  };
+}
+
+async function audit(action, req, extra = {}) {
+  try {
+    await AuditLog.create({
+      actor: req.user ? req.user._id : null,
+      actorEmail: req.user ? req.user.email : extra.email || null,
+      action,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: extra.metadata || {},
+    });
+  } catch (err) {
+    logger.error("Failed to write audit log", { action, error: err.message });
+  }
+}
+
+async function signup(req, res, next) {
+  try {
+    const { name, email, password } = req.body;
+
+    const existing = await User.findOne({ email: email.toLowerCase() });
+    if (existing) {
+      // Do not reveal which part of the credential pair is wrong to
+      // avoid account enumeration.
+      return res.status(409).json({ error: "Unable to create account with the details provided." });
+    }
+
+    const user = new User({ name, email: email.toLowerCase() });
+    await user.setPassword(password);
+    await user.save();
+
+    await audit("user.signup", req, { email: user.email });
+
+    const accessToken = signAccessToken(user);
+    const { token: refreshToken, jti } = signRefreshToken(user);
+    user.activeRefreshTokens = user.activeRefreshTokens || [];
+    user.activeRefreshTokens.push({
+      jti,
+      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      userAgent: req.headers["user-agent"],
+      ip: req.ip,
+    });
+    await user.save();
+
+    res.cookie(REFRESH_COOKIE_NAME, refreshToken, refreshCookieOptions());
+    res.status(201).json({ user: user.toSafeJSON(), accessToken });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function login(req, res, next) {
+  try {
+    const { email, password } = req.body;
+
+    const user = await User.findOne({ email: email.toLowerCase() }).select(
+      "+passwordHash +failedLoginAttempts +lockUntil +activeRefreshTokens"
+    );
+
+    // Constant-shaped response whether the user exists or not.
+    const genericError = () => res.status(401).json({ error: "Invalid email or password." });
+
+    if (!user || !user.isActive) return genericError();
+
+    if (user.isLocked()) {
+      return res.status(423).json({
+        error: "Account temporarily locked due to repeated failed attempts. Try again later.",
+      });
+    }
+
+    const valid = await user.comparePassword(password);
+    if (!valid) {
+      user.failedLoginAttempts = (user.failedLoginAttempts || 0) + 1;
+      if (user.failedLoginAttempts >= MAX_FAILED_ATTEMPTS) {
+        user.lockUntil = new Date(Date.now() + LOCK_DURATION_MS);
+        user.failedLoginAttempts = 0;
+        await audit("user.login.locked", req, { email: user.email });
+      }
+      await user.save();
+      return genericError();
+    }
+
+    user.failedLoginAttempts = 0;
+    user.lockUntil = null;
+
+    const accessToken = signAccessToken(user);
+    const { token: refreshToken, jti } = signRefreshToken(user);
+    user.activeRefreshTokens = (user.activeRefreshTokens || [])
+      .filter((rt) => rt.expiresAt > new Date()) // prune expired sessions
+      .concat({
+        jti,
+        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+        userAgent: req.headers["user-agent"],
+        ip: req.ip,
+      });
+    await user.save();
+
+    await audit("user.login", req, { email: user.email });
+
+    res.cookie(REFRESH_COOKIE_NAME, refreshToken, refreshCookieOptions());
+    res.json({ user: user.toSafeJSON(), accessToken });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function refresh(req, res, next) {
+  try {
+    const token = req.cookies[REFRESH_COOKIE_NAME];
+    if (!token) return res.status(401).json({ error: "No refresh token provided." });
+
+    let payload;
+    try {
+      payload = verifyRefreshToken(token);
+    } catch {
+      res.clearCookie(REFRESH_COOKIE_NAME, refreshCookieOptions());
+      return res.status(401).json({ error: "Invalid or expired session, please log in again." });
+    }
+
+    const user = await User.findById(payload.sub).select("+activeRefreshTokens");
+    if (!user || !user.isActive || user.tokenVersion !== payload.tokenVersion) {
+      return res.status(401).json({ error: "Session no longer valid, please log in again." });
+    }
+
+    const stillActive = (user.activeRefreshTokens || []).some((rt) => rt.jti === payload.jti);
+    if (!stillActive) {
+      // Possible token reuse after logout/rotation — deny and clear cookie.
+      res.clearCookie(REFRESH_COOKIE_NAME, refreshCookieOptions());
+      return res.status(401).json({ error: "Session no longer valid, please log in again." });
+    }
+
+    // Rotate: remove old jti, issue a new refresh token.
+    user.activeRefreshTokens = user.activeRefreshTokens.filter((rt) => rt.jti !== payload.jti);
+    const accessToken = signAccessToken(user);
+    const { token: newRefreshToken, jti: newJti } = signRefreshToken(user);
+    user.activeRefreshTokens.push({
+      jti: newJti,
+      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      userAgent: req.headers["user-agent"],
+      ip: req.ip,
+    });
+    await user.save();
+
+    res.cookie(REFRESH_COOKIE_NAME, newRefreshToken, refreshCookieOptions());
+    res.json({ accessToken, user: user.toSafeJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function logout(req, res, next) {
+  try {
+    const token = req.cookies[REFRESH_COOKIE_NAME];
+    if (token) {
+      try {
+        const payload = verifyRefreshToken(token);
+        await User.findByIdAndUpdate(payload.sub, { $pull: { activeRefreshTokens: { jti: payload.jti } } });
+      } catch {
+        // token already invalid — nothing to revoke
+      }
+    }
+    res.clearCookie(REFRESH_COOKIE_NAME, refreshCookieOptions());
+    res.json({ success: true });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function me(req, res) {
+  res.json({ user: req.user.toSafeJSON() });
+}
+
+module.exports = { signup, login, refresh, logout, me };

src/controllers/content.controller.js

@@ -0,0 +1,278 @@
+const fs = require("fs/promises");
+const mongoose = require("mongoose");
+const Course = require("../models/Course");
+const AuditLog = require("../models/AuditLog");
+const { uploadFromPath, deleteAsset, getSignedPlaybackUrl, resourceTypeForMimetype } = require("../utils/cloudinaryUpload");
+const logger = require("../utils/logger");
+
+function userHasAccess(user, courseId) {
+  if (!user) return false;
+  if (user.role === "admin") return true;
+  return user.hasAccessToCourse(courseId);
+}
+
+// ---------------------------------------------------------------------
+// Learner-facing: view curriculum structure, and request a signed,
+// time-limited playback URL for one lesson at a time.
+// ---------------------------------------------------------------------
+
+async function getCourseCurriculum(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course || !course.isPublished) return res.status(404).json({ error: "Course not found." });
+
+    const hasAccess = userHasAccess(req.user, course._id);
+    res.json({
+      courseId: course._id,
+      title: course.title,
+      hasAccess,
+      curriculum: hasAccess ? course.toCurriculumJSON() : course.toLockedCurriculumJSON(),
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function getLessonAccess(req, res, next) {
+  try {
+    const { id: courseId, sectionId, lessonId } = req.params;
+
+    const course = await Course.findById(courseId);
+    if (!course || !course.isPublished) return res.status(404).json({ error: "Course not found." });
+
+    const section = course.curriculum.id(sectionId);
+    const lesson = section?.lessons.id(lessonId);
+    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
+
+    const hasAccess = userHasAccess(req.user, course._id);
+    if (!hasAccess && !lesson.isPreview) {
+      return res.status(403).json({ error: "Purchase this course to access this lesson." });
+    }
+
+    const { url, expiresAt } = getSignedPlaybackUrl(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType, {
+      format: lesson.format,
+    });
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "lesson.access_granted",
+      targetType: "Lesson",
+      targetId: lesson._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { courseId: course._id.toString() },
+    });
+
+    res.json({
+      url,
+      expiresAt,
+      type: lesson.type,
+      title: lesson.title,
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+
+// ---------------------------------------------------------------------
+// Admin-only: manage curriculum structure and upload content to
+// Cloudinary. No learner-facing route ever exposes an upload capability.
+// ---------------------------------------------------------------------
+
+async function createSection(req, res, next) {
+  try {
+    const { title } = req.body;
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+
+    const order = course.curriculum.length;
+    course.curriculum.push({ title, order, lessons: [] });
+    await course.save();
+
+    res.status(201).json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function updateSection(req, res, next) {
+  try {
+    const { title, order } = req.body;
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+
+    const section = course.curriculum.id(req.params.sectionId);
+    if (!section) return res.status(404).json({ error: "Section not found." });
+
+    if (title !== undefined) section.title = title;
+    if (order !== undefined) section.order = order;
+    await course.save();
+
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function deleteSection(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+
+    const section = course.curriculum.id(req.params.sectionId);
+    if (!section) return res.status(404).json({ error: "Section not found." });
+
+    // Clean up every Cloudinary asset in this section before removing it.
+    await Promise.all(
+      section.lessons.map((lesson) =>
+        deleteAsset(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType).catch((err) =>
+          logger.error("Failed to delete Cloudinary asset", { error: err.message, lessonId: lesson._id.toString() })
+        )
+      )
+    );
+
+    section.deleteOne();
+    await course.save();
+
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function uploadLesson(req, res, next) {
+  const tempFilePath = req.file?.path;
+  try {
+    const { title, description, isPreview, order } = req.body;
+    if (!req.file) return res.status(400).json({ error: "A file is required." });
+
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+
+    const section = course.curriculum.id(req.params.sectionId);
+    if (!section) return res.status(404).json({ error: "Section not found." });
+
+    const resourceType = resourceTypeForMimetype(req.file.mimetype);
+    const lessonType = resourceType === "video" ? "video" : "document";
+
+    const result = await uploadFromPath(tempFilePath, {
+      resourceType,
+      filenameHint: title,
+    });
+
+    section.lessons.push({
+      title,
+      description: description || "",
+      type: lessonType,
+      order: order !== undefined ? Number(order) : section.lessons.length,
+      isPreview: isPreview === "true" || isPreview === true,
+      cloudinaryPublicId: result.public_id,
+      cloudinaryResourceType: result.resource_type,
+      format: result.format || "",
+      bytes: result.bytes || 0,
+      durationSeconds: result.duration ? Math.round(result.duration) : 0,
+    });
+    await course.save();
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.lesson_uploaded",
+      targetType: "Course",
+      targetId: course._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { sectionId: section._id.toString(), title },
+    });
+
+    res.status(201).json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  } finally {
+    // Always clean up the local temp file, whether the upload succeeded,
+    // failed partway, or Cloudinary itself errored out.
+    if (tempFilePath) {
+      fs.unlink(tempFilePath).catch((err) =>
+        logger.error("Failed to remove temp upload file", { error: err.message, tempFilePath })
+      );
+    }
+  }
+}
+
+async function updateLesson(req, res, next) {
+  try {
+    const { title, description, isPreview, order } = req.body;
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+
+    const section = course.curriculum.id(req.params.sectionId);
+    const lesson = section?.lessons.id(req.params.lessonId);
+    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
+
+    if (title !== undefined) lesson.title = title;
+    if (description !== undefined) lesson.description = description;
+    if (isPreview !== undefined) lesson.isPreview = isPreview === "true" || isPreview === true;
+    if (order !== undefined) lesson.order = Number(order);
+    await course.save();
+
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function deleteLesson(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+
+    const section = course.curriculum.id(req.params.sectionId);
+    const lesson = section?.lessons.id(req.params.lessonId);
+    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
+
+    await deleteAsset(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType).catch((err) =>
+      logger.error("Failed to delete Cloudinary asset", { error: err.message })
+    );
+
+    lesson.deleteOne();
+    await course.save();
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.lesson_deleted",
+      targetType: "Course",
+      targetId: course._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+    });
+
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+/** Admin editing view: full curriculum, same shape as the learner view (no raw Cloudinary IDs sent to the browser here either — uploads/deletes are the only mutating ops, playback still goes through the signed-URL endpoint). */
+async function getCourseCurriculumForAdmin(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ courseId: course._id, title: course.title, curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+module.exports = {
+  getCourseCurriculum,
+  getLessonAccess,
+  getCourseCurriculumForAdmin,
+  createSection,
+  updateSection,
+  deleteSection,
+  uploadLesson,
+  updateLesson,
+  deleteLesson,
+};

src/controllers/course.controller.js

@@ -0,0 +1,56 @@
+const Course = require("../models/Course");
+
+async function listCourses(req, res, next) {
+  try {
+    const filter = req.user?.role === "admin" ? {} : { isPublished: true };
+    const courses = await Course.find(filter).sort({ createdAt: 1 });
+    res.json({ courses });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function getCourse(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ course });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function createCourse(req, res, next) {
+  try {
+    const course = await Course.create(req.body);
+    res.status(201).json({ course });
+  } catch (err) {
+    if (err.code === 11000) return res.status(409).json({ error: "A course with this slug already exists." });
+    next(err);
+  }
+}
+
+async function updateCourse(req, res, next) {
+  try {
+    const course = await Course.findByIdAndUpdate(req.params.id, req.body, {
+      new: true,
+      runValidators: true,
+    });
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ course });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function deleteCourse(req, res, next) {
+  try {
+    const course = await Course.findByIdAndUpdate(req.params.id, { isPublished: false }, { new: true });
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ success: true });
+  } catch (err) {
+    next(err);
+  }
+}
+
+module.exports = { listCourses, getCourse, createCourse, updateCourse, deleteCourse };

src/controllers/order.controller.js

@@ -0,0 +1,161 @@
+const mongoose = require("mongoose");
+const Order = require("../models/Order");
+const Course = require("../models/Course");
+const AuditLog = require("../models/AuditLog");
+const { generateOrderNumber } = require("../utils/orderNumber");
+const { env } = require("../config/env");
+const { sendOrderPlacedEmail, sendAdminNewOrderAlert } = require("../utils/email");
+const logger = require("../utils/logger");
+
+/**
+ * Public checkout configuration — payment instructions shown on the
+ * frontend before the customer submits their reference number. No
+ * secrets here, just receiving-account details that are meant to be
+ * shared with paying customers.
+ */
+function getPaymentOptions(req, res) {
+  res.json({
+    bankWire: {
+      currency: "USD",
+      bankName: env.bank.name,
+      accountName: env.bank.accountName,
+      accountNumber: env.bank.accountNumber,
+      routingNumber: env.bank.routingNumber,
+      swiftBic: env.bank.swiftBic,
+      iban: env.bank.iban || undefined,
+      address: env.bank.address,
+    },
+    payoneer: {
+      accountEmail: env.payoneer.accountEmail,
+      paymentUrl: env.payoneer.paymentUrl,
+    },
+  });
+}
+
+async function createOrder(req, res, next) {
+  try {
+    const { courseId, paymentMethod } = req.body;
+
+    if (!mongoose.isValidObjectId(courseId)) {
+      return res.status(400).json({ error: "Invalid course selected." });
+    }
+
+    const course = await Course.findById(courseId);
+    if (!course || !course.isPublished) {
+      return res.status(404).json({ error: "Course not found or unavailable." });
+    }
+
+    if (req.user.hasAccessToCourse(course._id)) {
+      return res.status(409).json({ error: "You already have access to this course." });
+    }
+
+    // Prevent duplicate open orders for the same course by the same user.
+    const existingOpenOrder = await Order.findOne({
+      user: req.user._id,
+      course: course._id,
+      status: { $in: ["pending_payment", "awaiting_confirmation"] },
+    });
+    if (existingOpenOrder) {
+      return res.status(200).json({ order: existingOpenOrder.toPublicJSON(), reused: true });
+    }
+
+    const order = new Order({
+      orderNumber: generateOrderNumber(),
+      user: req.user._id,
+      course: course._id,
+      courseTitleSnapshot: course.title,
+      amount: course.price,
+      currency: course.currency || "USD",
+      paymentMethod,
+      status: "awaiting_confirmation",
+    });
+    await order.save();
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "order.created",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { courseId: course._id.toString(), paymentMethod },
+    });
+
+    // Fire-and-forget emails; failures are logged but never block checkout.
+    sendOrderPlacedEmail({
+      to: req.user.email,
+      name: req.user.name,
+      order,
+      courseTitle: course.title,
+      bankDetails: env.bank,
+      payoneerDetails: env.payoneer,
+    })
+      .then(() => {
+        order.confirmationEmailSentAt = new Date();
+        return order.save();
+      })
+      .catch((err) => logger.error("Order confirmation email failed", { error: err.message }));
+
+    sendAdminNewOrderAlert({ order, courseTitle: course.title, customerEmail: req.user.email }).catch((err) =>
+      logger.error("Admin new-order alert failed", { error: err.message })
+    );
+
+    res.status(201).json({ order: order.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+/** Customer submits their bank wire reference / Payoneer transaction ID after paying. */
+async function submitPaymentProof(req, res, next) {
+  try {
+    const { reference, note } = req.body;
+    const order = await Order.findOne({ _id: req.params.id, user: req.user._id });
+    if (!order) return res.status(404).json({ error: "Order not found." });
+
+    if (!["pending_payment", "awaiting_confirmation"].includes(order.status)) {
+      return res.status(409).json({ error: "This order can no longer be updated." });
+    }
+
+    order.setPaymentReference(reference);
+    if (note) order.setPayerNote(note);
+    order.status = "awaiting_confirmation";
+    await order.save();
+
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "order.payment_proof_submitted",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+    });
+
+    res.json({ order: order.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function listMyOrders(req, res, next) {
+  try {
+    const orders = await Order.find({ user: req.user._id }).sort({ createdAt: -1 });
+    res.json({ orders: orders.map((o) => o.toPublicJSON()) });
+  } catch (err) {
+    next(err);
+  }
+}
+
+async function getMyOrder(req, res, next) {
+  try {
+    const order = await Order.findOne({ _id: req.params.id, user: req.user._id });
+    if (!order) return res.status(404).json({ error: "Order not found." });
+    res.json({ order: order.toPublicJSON({ includeSensitive: true }) });
+  } catch (err) {
+    next(err);
+  }
+}
+
+module.exports = { getPaymentOptions, createOrder, submitPaymentProof, listMyOrders, getMyOrder };

src/middleware/auth.js

@@ -0,0 +1,45 @@
+const { verifyAccessToken } = require("../utils/jwt");
+const User = require("../models/User");
+
+/**
+ * Requires a valid, non-expired access token in the Authorization header.
+ * Attaches the full (fresh) user document to req.user so downstream
+ * handlers always see current role/lock/tokenVersion state rather than
+ * trusting stale claims baked into the JWT.
+ */
+async function requireAuth(req, res, next) {
+  try {
+    const header = req.headers.authorization || "";
+    const [scheme, token] = header.split(" ");
+    if (scheme !== "Bearer" || !token) {
+      return res.status(401).json({ error: "Authentication required." });
+    }
+
+    const payload = verifyAccessToken(token);
+    const user = await User.findById(payload.sub);
+
+    if (!user || !user.isActive) {
+      return res.status(401).json({ error: "Account not found or disabled." });
+    }
+    if (user.tokenVersion !== payload.tokenVersion) {
+      // Token was issued before a password change / forced logout.
+      return res.status(401).json({ error: "Session expired, please log in again." });
+    }
+
+    req.user = user;
+    next();
+  } catch (err) {
+    return res.status(401).json({ error: "Invalid or expired token." });
+  }
+}
+
+function requireRole(...roles) {
+  return (req, res, next) => {
+    if (!req.user || !roles.includes(req.user.role)) {
+      return res.status(403).json({ error: "You do not have permission to perform this action." });
+    }
+    next();
+  };
+}
+
+module.exports = { requireAuth, requireRole };

src/middleware/errorHandler.js

@@ -0,0 +1,33 @@
+const logger = require("../utils/logger");
+
+// eslint-disable-next-line no-unused-vars
+function errorHandler(err, req, res, next) {
+  let status = err.status || 500;
+
+  // Multer surfaces file-size/type problems as plain Errors/MulterErrors
+  // without a status code — treat those as client errors (400), not
+  // server failures.
+  if (err.name === "MulterError" || /Unsupported file type/.test(err.message || "")) {
+    status = 400;
+  }
+
+  logger.error("Unhandled error", {
+    message: err.message,
+    status,
+    path: req.path,
+    method: req.method,
+    // stack only ever goes to server-side logs, never to the client
+    stack: err.stack,
+  });
+
+  const isProd = process.env.NODE_ENV === "production";
+  res.status(status).json({
+    error: status === 500 && isProd ? "Something went wrong. Please try again later." : err.message,
+  });
+}
+
+function notFound(req, res) {
+  res.status(404).json({ error: "Not found." });
+}
+
+module.exports = { errorHandler, notFound };

src/middleware/rateLimiters.js

@@ -0,0 +1,31 @@
+const rateLimit = require("express-rate-limit");
+
+// General API traffic
+const apiLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  limit: 300,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many requests, please try again later." },
+});
+
+// Tight limits on auth endpoints to blunt credential stuffing / brute force
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  limit: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  skipSuccessfulRequests: true,
+  message: { error: "Too many attempts. Please wait a few minutes and try again." },
+});
+
+// Checkout/order creation limiter to prevent order-spam / enumeration
+const orderLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000,
+  limit: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many order attempts. Please try again later or contact support." },
+});
+
+module.exports = { apiLimiter, authLimiter, orderLimiter };

src/middleware/upload.js

@@ -0,0 +1,50 @@
+const multer = require("multer");
+const os = require("os");
+const path = require("path");
+const crypto = require("crypto");
+
+// Only the file types actually needed for course content are allowed.
+// Uploads are only ever accepted from an authenticated admin (enforced
+// in the route, not here), but validating the mimetype/extension server-
+// side is still essential since a client can lie about content-type.
+const ALLOWED_MIMETYPES = new Set([
+  "video/mp4",
+  "video/webm",
+  "video/quicktime",
+  "application/pdf",
+  "application/msword",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.ms-powerpoint",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+]);
+
+const MAX_FILE_SIZE_BYTES = 500 * 1024 * 1024; // 500MB — generous for course videos on Cloudinary's free tier
+
+// Files are streamed to a temp file on disk rather than buffered in
+// memory: buffering large videos in RAM can exhaust the memory limit on
+// small/free-tier hosts (e.g. a 512MB instance) well before hitting the
+// 500MB file-size cap. The temp file is deleted right after the upload
+// completes (see content.controller.js), whether it succeeds or fails.
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => cb(null, os.tmpdir()),
+  filename: (req, file, cb) => {
+    const unique = crypto.randomBytes(16).toString("hex");
+    cb(null, `aynwerd-upload-${unique}${path.extname(file.originalname)}`);
+  },
+});
+
+const upload = multer({
+  storage,
+  limits: { fileSize: MAX_FILE_SIZE_BYTES, files: 1 },
+  fileFilter(req, file, cb) {
+    if (!ALLOWED_MIMETYPES.has(file.mimetype)) {
+      return cb(new Error("Unsupported file type. Allowed: mp4/webm/mov video, pdf, doc(x), ppt(x), png/jpg/webp."));
+    }
+    cb(null, true);
+  },
+});
+
+module.exports = { upload };

src/middleware/validate.js

@@ -0,0 +1,14 @@
+const { validationResult } = require("express-validator");
+
+function validate(req, res, next) {
+  const errors = validationResult(req);
+  if (!errors.isEmpty()) {
+    return res.status(400).json({
+      error: "Validation failed.",
+      details: errors.array().map((e) => ({ field: e.path, message: e.msg })),
+    });
+  }
+  next();
+}
+
+module.exports = { validate };

src/models/AuditLog.js

@@ -0,0 +1,21 @@
+const mongoose = require("mongoose");
+
+// Immutable-by-convention trail of security-sensitive actions (payment
+// confirmations/rejections, role changes, logins) for accountability and
+// incident investigation. Nothing sensitive (passwords, tokens, full
+// payment references) is ever written here.
+const auditLogSchema = new mongoose.Schema(
+  {
+    actor: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
+    actorEmail: { type: String, default: null },
+    action: { type: String, required: true, index: true },
+    targetType: { type: String, default: null },
+    targetId: { type: mongoose.Schema.Types.ObjectId, default: null },
+    metadata: { type: mongoose.Schema.Types.Mixed, default: {} },
+    ip: { type: String, default: null },
+    userAgent: { type: String, default: null },
+  },
+  { timestamps: true, capped: { size: 50 * 1024 * 1024, max: 200000 } }
+);
+
+module.exports = mongoose.model("AuditLog", auditLogSchema);

src/models/Course.js

@@ -0,0 +1,104 @@
+const mongoose = require("mongoose");
+
+const lessonSchema = new mongoose.Schema(
+  {
+    title: { type: String, required: true, trim: true, maxlength: 200 },
+    description: { type: String, default: "", maxlength: 1000 },
+    type: { type: String, enum: ["video", "document"], required: true },
+    order: { type: Number, default: 0 },
+
+    // Free preview lessons can be viewed without purchasing the course
+    // (e.g. an intro video) — everything else requires confirmed access.
+    isPreview: { type: Boolean, default: false },
+
+    // Cloudinary storage details. Uploaded with delivery type
+    // "authenticated" so files can NEVER be fetched by guessing/sharing
+    // the public ID — every playback URL must be freshly signed
+    // server-side (see utils/cloudinaryUpload.js) for a user who is
+    // confirmed to have access. These are plain (selected-by-default)
+    // fields — deliberately NOT using Mongoose's `select: false` here,
+    // because that projection option is unreliable two levels deep
+    // inside an array-of-subdocuments-within-an-array-of-subdocuments
+    // (curriculum[].lessons[].field) across Mongoose versions. The real
+    // security boundary is that every response is built through
+    // toCurriculumJSON()/toLockedCurriculumJSON() below, which simply
+    // never copies these fields into what gets sent to the client.
+    cloudinaryPublicId: { type: String, required: true },
+    cloudinaryResourceType: { type: String, enum: ["video", "raw", "image"], required: true },
+    format: { type: String, default: "" },
+    bytes: { type: Number, default: 0 },
+    durationSeconds: { type: Number, default: 0 },
+  },
+  { timestamps: true }
+);
+
+const sectionSchema = new mongoose.Schema(
+  {
+    title: { type: String, required: true, trim: true, maxlength: 200 },
+    order: { type: Number, default: 0 },
+    lessons: { type: [lessonSchema], default: [] },
+  },
+  { timestamps: true }
+);
+
+const courseSchema = new mongoose.Schema(
+  {
+    title: { type: String, required: true, trim: true, maxlength: 200 },
+    slug: { type: String, required: true, unique: true, lowercase: true, trim: true, index: true },
+    price: { type: Number, required: true, min: 0 },
+    currency: { type: String, default: "USD", uppercase: true, minlength: 3, maxlength: 3 },
+    duration: { type: String, required: true, trim: true },
+    level: { type: String, required: true, trim: true },
+    description: { type: String, required: true },
+    image: { type: String, default: "" },
+    highlights: { type: [String], default: [] },
+    isPublished: { type: Boolean, default: true },
+
+    // Study content, uploaded exclusively by admins (see content.controller.js).
+    curriculum: { type: [sectionSchema], default: [] },
+  },
+  { timestamps: true }
+);
+
+/** Curriculum view for enrolled users / admins: structure + metadata, no storage internals. */
+courseSchema.methods.toCurriculumJSON = function toCurriculumJSON() {
+  return this.curriculum
+    .slice()
+    .sort((a, b) => a.order - b.order)
+    .map((section) => ({
+      id: section._id,
+      title: section.title,
+      order: section.order,
+      lessons: section.lessons
+        .slice()
+        .sort((a, b) => a.order - b.order)
+        .map((lesson) => ({
+          id: lesson._id,
+          title: lesson.title,
+          description: lesson.description,
+          type: lesson.type,
+          order: lesson.order,
+          isPreview: lesson.isPreview,
+          durationSeconds: lesson.durationSeconds,
+        })),
+    }));
+};
+
+/** Locked view for logged-in users who have NOT purchased the course: titles only, previews flagged. */
+courseSchema.methods.toLockedCurriculumJSON = function toLockedCurriculumJSON() {
+  return this.toCurriculumJSON().map((section) => ({
+    ...section,
+    lessons: section.lessons.map((lesson) => ({
+      id: lesson.id,
+      title: lesson.title,
+      type: lesson.type,
+      order: lesson.order,
+      isPreview: lesson.isPreview,
+      durationSeconds: lesson.durationSeconds,
+      locked: !lesson.isPreview,
+    })),
+  }));
+};
+
+module.exports = mongoose.model("Course", courseSchema);
+

src/models/Order.js

@@ -0,0 +1,81 @@
+const mongoose = require("mongoose");
+const { encryptField, decryptField, hmacIndex } = require("../utils/crypto");
+
+const PAYMENT_METHODS = ["bank_wire", "payoneer"];
+const ORDER_STATUSES = ["pending_payment", "awaiting_confirmation", "confirmed", "rejected", "cancelled"];
+
+const orderSchema = new mongoose.Schema(
+  {
+    orderNumber: { type: String, required: true, unique: true, index: true },
+    user: { type: mongoose.Schema.Types.ObjectId, ref: "User", required: true, index: true },
+    course: { type: mongoose.Schema.Types.ObjectId, ref: "Course", required: true },
+
+    // Snapshot of course price/title at time of purchase so historical
+    // orders remain accurate even if the course is later edited.
+    courseTitleSnapshot: { type: String, required: true },
+    amount: { type: Number, required: true, min: 0 },
+    currency: { type: String, default: "USD" },
+
+    paymentMethod: { type: String, enum: PAYMENT_METHODS, required: true },
+
+    // Sensitive: encrypted at rest with AES-256-GCM. Never returned by
+    // default queries (select: false) and never logged in plaintext.
+    // paymentReferenceIndex is a keyed HMAC used only to detect
+    // duplicate submissions without ever decrypting.
+    paymentReferenceEncrypted: { type: String, default: null, select: false },
+    paymentReferenceIndex: { type: String, default: null, index: true },
+    payerNoteEncrypted: { type: String, default: null, select: false },
+
+    status: { type: String, enum: ORDER_STATUSES, default: "pending_payment", index: true },
+
+    confirmedBy: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
+    confirmedAt: { type: Date, default: null },
+    rejectionReason: { type: String, default: null },
+
+    confirmationEmailSentAt: { type: Date, default: null },
+  },
+  { timestamps: true }
+);
+
+// --- Helpers to write/read the encrypted payment reference safely ---
+orderSchema.methods.setPaymentReference = function setPaymentReference(plainReference) {
+  this.paymentReferenceEncrypted = encryptField(plainReference);
+  this.paymentReferenceIndex = hmacIndex(plainReference);
+};
+
+orderSchema.methods.getPaymentReference = function getPaymentReference() {
+  return decryptField(this.paymentReferenceEncrypted);
+};
+
+orderSchema.methods.setPayerNote = function setPayerNote(note) {
+  this.payerNoteEncrypted = encryptField(note);
+};
+
+orderSchema.methods.getPayerNote = function getPayerNote() {
+  return decryptField(this.payerNoteEncrypted);
+};
+
+orderSchema.methods.toPublicJSON = function toPublicJSON({ includeSensitive = false } = {}) {
+  const json = {
+    id: this._id,
+    orderNumber: this.orderNumber,
+    course: this.course,
+    courseTitleSnapshot: this.courseTitleSnapshot,
+    amount: this.amount,
+    currency: this.currency,
+    paymentMethod: this.paymentMethod,
+    status: this.status,
+    confirmedAt: this.confirmedAt,
+    rejectionReason: this.rejectionReason,
+    createdAt: this.createdAt,
+  };
+  if (includeSensitive) {
+    json.paymentReference = this.getPaymentReference();
+    json.payerNote = this.getPayerNote();
+  }
+  return json;
+};
+
+module.exports = mongoose.model("Order", orderSchema);
+module.exports.PAYMENT_METHODS = PAYMENT_METHODS;
+module.exports.ORDER_STATUSES = ORDER_STATUSES;

src/models/User.js

@@ -0,0 +1,88 @@
+const mongoose = require("mongoose");
+const bcrypt = require("bcryptjs");
+
+const enrolledCourseSchema = new mongoose.Schema(
+  {
+    course: { type: mongoose.Schema.Types.ObjectId, ref: "Course", required: true },
+    order: { type: mongoose.Schema.Types.ObjectId, ref: "Order", required: true },
+    accessGrantedAt: { type: Date, default: Date.now },
+  },
+  { _id: false }
+);
+
+const userSchema = new mongoose.Schema(
+  {
+    name: { type: String, required: true, trim: true, maxlength: 120 },
+    email: {
+      type: String,
+      required: true,
+      unique: true,
+      lowercase: true,
+      trim: true,
+      maxlength: 254,
+      index: true,
+    },
+    passwordHash: { type: String, required: true, select: false },
+    role: { type: String, enum: ["user", "admin"], default: "user" },
+
+    // Access-control / session-security bookkeeping
+    tokenVersion: { type: Number, default: 0 }, // bump to invalidate all issued JWTs
+    activeRefreshTokens: {
+      // store only the jti + expiry, never the raw token, so a leaked DB
+      // dump can't be replayed as a session
+      type: [
+        {
+          jti: String,
+          expiresAt: Date,
+          userAgent: String,
+          ip: String,
+        },
+      ],
+      default: [],
+      select: false,
+    },
+
+    // Brute-force protection
+    failedLoginAttempts: { type: Number, default: 0, select: false },
+    lockUntil: { type: Date, default: null, select: false },
+
+    enrolledCourses: { type: [enrolledCourseSchema], default: [] },
+
+    isActive: { type: Boolean, default: true },
+  },
+  { timestamps: true }
+);
+
+userSchema.methods.setPassword = async function setPassword(plainPassword) {
+  const salt = await bcrypt.genSalt(12);
+  this.passwordHash = await bcrypt.hash(plainPassword, salt);
+};
+
+userSchema.methods.comparePassword = function comparePassword(plainPassword) {
+  return bcrypt.compare(plainPassword, this.passwordHash);
+};
+
+userSchema.methods.isLocked = function isLocked() {
+  return !!(this.lockUntil && this.lockUntil > Date.now());
+};
+
+userSchema.methods.hasAccessToCourse = function hasAccessToCourse(courseId) {
+  return this.enrolledCourses.some((ec) => ec.course.toString() === courseId.toString());
+};
+
+userSchema.methods.toSafeJSON = function toSafeJSON() {
+  return {
+    id: this._id,
+    name: this.name,
+    email: this.email,
+    role: this.role,
+    enrolledCourses: this.enrolledCourses.map((ec) => ({
+      course: ec.course,
+      order: ec.order,
+      accessGrantedAt: ec.accessGrantedAt,
+    })),
+    createdAt: this.createdAt,
+  };
+};
+
+module.exports = mongoose.model("User", userSchema);

src/routes/admin.routes.js

@@ -0,0 +1,49 @@
+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth, requireRole } = require("../middleware/auth");
+const { upload } = require("../middleware/upload");
+const ctrl = require("../controllers/admin.controller");
+const contentCtrl = require("../controllers/content.controller");
+
+const router = express.Router();
+
+router.use(requireAuth, requireRole("admin"));
+
+router.get("/dashboard", ctrl.dashboardStats);
+router.get("/users", ctrl.listUsers);
+router.get("/orders", ctrl.listOrders);
+router.get("/orders/:id", ctrl.getOrderDetail);
+router.post("/orders/:id/confirm", ctrl.confirmOrder);
+router.post(
+  "/orders/:id/reject",
+  [body("reason").optional({ nullable: true }).trim().isLength({ max: 500 })],
+  validate,
+  ctrl.rejectOrder
+);
+
+// --- Course content management (admin-only; only admins may ever
+// upload or modify study materials, per course requirements) ----------
+router.get("/courses/:id/curriculum", contentCtrl.getCourseCurriculumForAdmin);
+
+router.post(
+  "/courses/:id/sections",
+  [body("title").trim().isLength({ min: 1, max: 200 })],
+  validate,
+  contentCtrl.createSection
+);
+router.put("/courses/:id/sections/:sectionId", contentCtrl.updateSection);
+router.delete("/courses/:id/sections/:sectionId", contentCtrl.deleteSection);
+
+router.post(
+  "/courses/:id/sections/:sectionId/lessons",
+  upload.single("file"),
+  [body("title").trim().isLength({ min: 1, max: 200 })],
+  validate,
+  contentCtrl.uploadLesson
+);
+router.put("/courses/:id/sections/:sectionId/lessons/:lessonId", contentCtrl.updateLesson);
+router.delete("/courses/:id/sections/:sectionId/lessons/:lessonId", contentCtrl.deleteLesson);
+
+module.exports = router;
+

src/routes/auth.routes.js

@@ -0,0 +1,45 @@
+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth } = require("../middleware/auth");
+const { authLimiter } = require("../middleware/rateLimiters");
+const ctrl = require("../controllers/auth.controller");
+
+const router = express.Router();
+
+router.post(
+  "/signup",
+  authLimiter,
+  [
+    body("name").trim().isLength({ min: 2, max: 120 }).withMessage("Name must be 2-120 characters."),
+    body("email").isEmail().normalizeEmail().withMessage("A valid email is required."),
+    body("password")
+      .isLength({ min: 10 })
+      .withMessage("Password must be at least 10 characters.")
+      .matches(/[A-Z]/)
+      .withMessage("Password must include an uppercase letter.")
+      .matches(/[a-z]/)
+      .withMessage("Password must include a lowercase letter.")
+      .matches(/[0-9]/)
+      .withMessage("Password must include a number."),
+  ],
+  validate,
+  ctrl.signup
+);
+
+router.post(
+  "/login",
+  authLimiter,
+  [
+    body("email").isEmail().normalizeEmail().withMessage("A valid email is required."),
+    body("password").notEmpty().withMessage("Password is required."),
+  ],
+  validate,
+  ctrl.login
+);
+
+router.post("/refresh", ctrl.refresh);
+router.post("/logout", ctrl.logout);
+router.get("/me", requireAuth, ctrl.me);
+
+module.exports = router;

src/routes/course.routes.js

@@ -0,0 +1,33 @@
+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth, requireRole } = require("../middleware/auth");
+const ctrl = require("../controllers/course.controller");
+const contentCtrl = require("../controllers/content.controller");
+
+const router = express.Router();
+
+router.get("/", ctrl.listCourses);
+router.get("/:id", ctrl.getCourse);
+
+// Curriculum viewing / lesson playback (learner-facing, requires login;
+// access to actual lesson files is enforced per-lesson in the controller
+// based on confirmed purchase, not just being logged in).
+router.get("/:id/curriculum", requireAuth, contentCtrl.getCourseCurriculum);
+router.get("/:id/sections/:sectionId/lessons/:lessonId/access", requireAuth, contentCtrl.getLessonAccess);
+
+const courseValidators = [
+  body("title").trim().isLength({ min: 2, max: 200 }),
+  body("slug").trim().isSlug().withMessage("Slug must be URL-safe (lowercase, hyphens)."),
+  body("price").isFloat({ min: 0 }),
+  body("duration").trim().notEmpty(),
+  body("level").trim().notEmpty(),
+  body("description").trim().notEmpty(),
+];
+
+router.post("/", requireAuth, requireRole("admin"), courseValidators, validate, ctrl.createCourse);
+router.put("/:id", requireAuth, requireRole("admin"), ctrl.updateCourse);
+router.delete("/:id", requireAuth, requireRole("admin"), ctrl.deleteCourse);
+
+module.exports = router;
+

src/routes/order.routes.js

@@ -0,0 +1,40 @@
+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth } = require("../middleware/auth");
+const { orderLimiter } = require("../middleware/rateLimiters");
+const { PAYMENT_METHODS } = require("../models/Order");
+const ctrl = require("../controllers/order.controller");
+
+const router = express.Router();
+
+router.get("/payment-options", ctrl.getPaymentOptions);
+
+router.use(requireAuth);
+
+router.get("/", ctrl.listMyOrders);
+router.get("/:id", ctrl.getMyOrder);
+
+router.post(
+  "/",
+  orderLimiter,
+  [
+    body("courseId").isMongoId().withMessage("A valid course must be selected."),
+    body("paymentMethod").isIn(PAYMENT_METHODS).withMessage("Choose bank_wire or payoneer."),
+  ],
+  validate,
+  ctrl.createOrder
+);
+
+router.post(
+  "/:id/payment-proof",
+  orderLimiter,
+  [
+    body("reference").trim().isLength({ min: 3, max: 200 }).withMessage("Enter your payment reference/transaction ID."),
+    body("note").optional({ nullable: true }).trim().isLength({ max: 500 }),
+  ],
+  validate,
+  ctrl.submitPaymentProof
+);
+
+module.exports = router;

src/seed/seed.js

@@ -0,0 +1,128 @@
+/* eslint-disable no-console */
+const { env } = require("../config/env");
+const { connectDB, disconnectDB } = require("../config/db");
+const User = require("../models/User");
+const Course = require("../models/Course");
+
+const courses = [
+  {
+    title: "Artificial Intelligence Essentials",
+    slug: "artificial-intelligence-essentials",
+    price: 350,
+    duration: "8 weeks",
+    level: "Beginner",
+    description:
+      "A practical introduction to AI: learn what AI can (and cannot) do, work with real datasets, and build your first machine-learning models.",
+    highlights: [
+      "AI concepts, terminology and real-world use cases",
+      "Hands-on Python & ML experiments",
+      "Build a simple predictive model end-to-end",
+    ],
+  },
+  {
+    title: "Cyber Security Essentials",
+    slug: "cyber-security-essentials",
+    price: 300,
+    duration: "6 weeks",
+    level: "Beginner",
+    description:
+      "Learn the foundations of cyber defense: protect devices, networks, and data against the most common digital threats.",
+    highlights: [
+      "Threat landscape and attacker tactics",
+      "Secure browsing, password & identity hygiene",
+      "Basic network and endpoint protection",
+    ],
+  },
+  {
+    title: "AI-Powered Cybersecurity",
+    slug: "ai-powered-cybersecurity",
+    price: 550,
+    duration: "10 weeks",
+    level: "Intermediate to Advanced",
+    description:
+      "Combine AI with security operations: deploy intelligent threat detection, automate incident response, and build resilient SOC workflows.",
+    highlights: [
+      "ML-based threat detection and anomaly analytics",
+      "Automated incident response playbooks",
+      "AI governance, ethics and adversarial risks",
+    ],
+  },
+  {
+    title: "The AI Career Guidance",
+    slug: "the-ai-career-guidance",
+    price: 200,
+    duration: "4 weeks",
+    level: "Career Foundations",
+    description:
+      "Map your path into the AI economy. Discover roles, build a portfolio, and prepare for interviews with guided mentorship.",
+    highlights: [
+      "AI career landscape and skill roadmap",
+      "Portfolio project planning and resume review",
+      "Mock interviews and mentorship sessions",
+    ],
+  },
+  {
+    title: "AI for Business Managers",
+    slug: "ai-for-business-managers",
+    price: 450,
+    duration: "6 weeks",
+    level: "Manager Level",
+    description:
+      "Learn how to evaluate, procure, and manage AI projects that drive real business value without needing to code.",
+    highlights: [
+      "AI strategy, ROI and use-case prioritisation",
+      "Managing data, vendors and project risk",
+      "Leading AI-enabled teams and change",
+    ],
+  },
+  {
+    title: "AI for Business Executives",
+    slug: "ai-for-business-executives",
+    price: 650,
+    duration: "5 weeks",
+    level: "Executive Level",
+    description:
+      "A leadership-level course on AI governance, competitive strategy, and building an AI-ready organisation.",
+    highlights: [
+      "Board-level AI vision and investment decisions",
+      "Regulatory, ethical and governance frameworks",
+      "Building an AI culture and Centre of Excellence",
+    ],
+  },
+];
+
+async function seed() {
+  await connectDB();
+
+  for (const c of courses) {
+    await Course.findOneAndUpdate({ slug: c.slug }, c, { upsert: true, new: true, setDefaultsOnInsert: true });
+  }
+  console.log(`Seeded ${courses.length} courses.`);
+
+  if (env.seedAdmin.email && env.seedAdmin.password) {
+    const existingAdmin = await User.findOne({ email: env.seedAdmin.email.toLowerCase() });
+    if (existingAdmin) {
+      console.log(`Admin account already exists for ${env.seedAdmin.email}, skipping.`);
+    } else {
+      const admin = new User({
+        name: env.seedAdmin.name,
+        email: env.seedAdmin.email.toLowerCase(),
+        role: "admin",
+      });
+      await admin.setPassword(env.seedAdmin.password);
+      await admin.save();
+      console.log(`Created admin account: ${env.seedAdmin.email}`);
+      console.log("IMPORTANT: log in and change this password immediately.");
+    }
+  } else {
+    console.log("SEED_ADMIN_EMAIL / SEED_ADMIN_PASSWORD not set — skipping admin creation.");
+  }
+
+  await disconnectDB();
+  process.exit(0);
+}
+
+seed().catch((err) => {
+  console.error("Seeding failed:", err);
+  process.exit(1);
+});

src/server.js

@@ -0,0 +1,46 @@
+const { env, assertProductionSafety } = require("./config/env");
+const { connectDB, disconnectDB } = require("./config/db");
+const logger = require("./utils/logger");
+const app = require("./app");
+
+assertProductionSafety();
+
+let server;
+
+async function start() {
+  try {
+    await connectDB();
+    server = app.listen(env.port, () => {
+      logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
+    });
+  } catch (err) {
+    logger.error("Failed to start server", { error: err.message });
+    process.exit(1);
+  }
+}
+
+async function shutdown(signal) {
+  logger.info(`Received ${signal}, shutting down gracefully...`);
+  if (server) {
+    server.close(async () => {
+      await disconnectDB();
+      process.exit(0);
+    });
+    // Force-exit if something hangs
+    setTimeout(() => process.exit(1), 10000).unref();
+  } else {
+    process.exit(0);
+  }
+}
+
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));
+process.on("unhandledRejection", (reason) => {
+  logger.error("Unhandled promise rejection", { reason: reason?.message || reason });
+});
+process.on("uncaughtException", (err) => {
+  logger.error("Uncaught exception", { error: err.message, stack: err.stack });
+  process.exit(1);
+});
+
+start();

src/utils/cloudinaryUpload.js

@@ -0,0 +1,61 @@
+const cloudinary = require("../config/cloudinary");
+
+const FOLDER = "aynwerd-courses";
+
+/**
+ * Uploads a file from a local temp path to Cloudinary under private,
+ * signed-only access. `type: "authenticated"` means the asset can
+ * NEVER be fetched by its plain URL or by guessing the public ID —
+ * every request must carry a valid signature that we only ever mint
+ * for a verified, paying learner (see getSignedPlaybackUrl below).
+ *
+ * Videos use `upload_large`, which chunks the upload — required for
+ * anything beyond a small size and generally more reliable for video
+ * regardless of size. Everything else uses a normal upload.
+ */
+function uploadFromPath(filePath, { resourceType, filenameHint }) {
+  const options = {
+    folder: FOLDER,
+    resource_type: resourceType, // "video" | "image" | "raw"
+    type: "authenticated",
+    use_filename: true,
+    unique_filename: true,
+    filename_override: filenameHint,
+  };
+
+  if (resourceType === "video") {
+    return cloudinary.uploader.upload_large(filePath, { ...options, chunk_size: 6 * 1024 * 1024 });
+  }
+  return cloudinary.uploader.upload(filePath, options);
+}
+
+function deleteAsset(publicId, resourceType) {
+  return cloudinary.uploader.destroy(publicId, { resource_type: resourceType, type: "authenticated" });
+}
+
+/**
+ * Mints a short-lived, signed URL for a specific lesson asset. Valid for
+ * a couple of hours only, so a leaked link stops working quickly and
+ * cannot be redistributed as a permanent download.
+ */
+function getSignedPlaybackUrl(publicId, resourceType, { format, expiresInSeconds = 2 * 60 * 60 } = {}) {
+  const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
+  const url = cloudinary.url(publicId, {
+    resource_type: resourceType,
+    type: "authenticated",
+    sign_url: true,
+    secure: true,
+    expires_at: expiresAt,
+    format: format || undefined,
+  });
+  return { url, expiresAt };
+}
+
+/** Maps an uploaded file's mimetype to the Cloudinary resource_type bucket it belongs in. */
+function resourceTypeForMimetype(mimetype) {
+  if (mimetype.startsWith("video/")) return "video";
+  if (mimetype.startsWith("image/")) return "image";
+  return "raw"; // PDFs, docs, slides, zips, etc.
+}
+
+module.exports = { uploadFromPath, deleteAsset, getSignedPlaybackUrl, resourceTypeForMimetype };

src/utils/crypto.js

@@ -0,0 +1,56 @@
+const crypto = require("crypto");
+const { env } = require("../config/env");
+
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12; // 96-bit IV recommended for GCM
+
+function getKey() {
+  const key = Buffer.from(env.fieldEncryptionKey || "", "hex");
+  if (key.length !== 32) {
+    throw new Error(
+      "FIELD_ENCRYPTION_KEY must be a 32-byte value encoded as 64 hex characters. " +
+        "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
+    );
+  }
+  return key;
+}
+
+/**
+ * Encrypts a plaintext string for storage at rest (e.g. bank wire
+ * reference numbers, Payoneer transaction IDs). Returns a single
+ * base64 payload containing iv + authTag + ciphertext so it can be
+ * stored as one string field in MongoDB.
+ */
+function encryptField(plaintext) {
+  if (plaintext === undefined || plaintext === null || plaintext === "") return null;
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, getKey(), iv);
+  const ciphertext = Buffer.concat([cipher.update(String(plaintext), "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([iv, authTag, ciphertext]).toString("base64");
+}
+
+/**
+ * Decrypts a payload produced by encryptField. Returns null if the
+ * input is empty rather than throwing, so callers can treat "no
+ * payment reference yet" gracefully.
+ */
+function decryptField(payload) {
+  if (!payload) return null;
+  const raw = Buffer.from(payload, "base64");
+  const iv = raw.subarray(0, IV_LENGTH);
+  const authTag = raw.subarray(IV_LENGTH, IV_LENGTH + 16);
+  const ciphertext = raw.subarray(IV_LENGTH + 16);
+  const decipher = crypto.createDecipheriv(ALGORITHM, getKey(), iv);
+  decipher.setAuthTag(authTag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return plaintext.toString("utf8");
+}
+
+/** One-way hash used for equality lookups on encrypted fields (e.g. duplicate detection) without decrypting. */
+function hmacIndex(value) {
+  if (!value) return null;
+  return crypto.createHmac("sha256", getKey()).update(String(value)).digest("hex");
+}
+
+module.exports = { encryptField, decryptField, hmacIndex };

src/utils/email.js

@@ -0,0 +1,147 @@
+const nodemailer = require("nodemailer");
+const { env } = require("../config/env");
+const logger = require("./logger");
+
+let transporter = null;
+
+function getTransporter() {
+  if (transporter) return transporter;
+  transporter = nodemailer.createTransport({
+    host: env.smtp.host,
+    port: env.smtp.port,
+    secure: env.smtp.secure, // true for 465, false for other ports (STARTTLS)
+    auth: env.smtp.user ? { user: env.smtp.user, pass: env.smtp.pass } : undefined,
+    requireTLS: !env.smtp.secure, // enforce STARTTLS when not already on a TLS port
+  });
+  return transporter;
+}
+
+async function sendMail({ to, subject, html, text }) {
+  try {
+    const info = await getTransporter().sendMail({
+      from: env.emailFrom,
+      to,
+      subject,
+      html,
+      text,
+    });
+    return info;
+  } catch (err) {
+    // Email failures must never crash a request or leak SMTP credentials.
+    logger.error("Failed to send email", { subject, error: err.message });
+    return null;
+  }
+}
+
+function baseLayout(bodyHtml) {
+  return `
+  <div style="font-family:Arial,Helvetica,sans-serif;max-width:600px;margin:0 auto;color:#1a1a1a;">
+    <div style="padding:24px 0;border-bottom:2px solid #eee;">
+      <h2 style="margin:0;color:#111;">Aynwerd Academy</h2>
+    </div>
+    <div style="padding:24px 0;">${bodyHtml}</div>
+    <div style="padding:16px 0;border-top:1px solid #eee;font-size:12px;color:#777;">
+      This is an automated message regarding your order. Never share your password or
+      full payment reference by email. If you didn't make this request, contact
+      support immediately.
+    </div>
+  </div>`;
+}
+
+async function sendOrderPlacedEmail({ to, name, order, courseTitle, bankDetails, payoneerDetails }) {
+  const methodBlock =
+    order.paymentMethod === "bank_wire"
+      ? `<h3>Bank wire transfer instructions</h3>
+         <table style="border-collapse:collapse;width:100%;font-size:14px;">
+           <tr><td style="padding:4px 0;color:#555;">Bank name</td><td><strong>${bankDetails.name}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Account name</td><td><strong>${bankDetails.accountName}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Account number</td><td><strong>${bankDetails.accountNumber}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Routing number</td><td><strong>${bankDetails.routingNumber}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">SWIFT/BIC</td><td><strong>${bankDetails.swiftBic}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Bank address</td><td><strong>${bankDetails.address}</strong></td></tr>
+         </table>
+         <p>Please use order number <strong>${order.orderNumber}</strong> as your payment reference.</p>`
+      : `<h3>Payoneer payment instructions</h3>
+         <p>Send payment to Payoneer account <strong>${payoneerDetails.accountEmail}</strong>
+         or use your Payoneer app's "Request a Payment" link: <a href="${payoneerDetails.paymentUrl}">${payoneerDetails.paymentUrl}</a>.</p>
+         <p>Please use order number <strong>${order.orderNumber}</strong> as your payment note.</p>`;
+
+  const html = baseLayout(`
+    <p>Hi ${name},</p>
+    <p>Thanks for enrolling in <strong>${courseTitle}</strong>. Your order has been created and is
+    awaiting payment${order.status === "awaiting_confirmation" ? " confirmation" : ""}.</p>
+    <p><strong>Order number:</strong> ${order.orderNumber}<br/>
+       <strong>Amount due:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
+       <strong>Payment method:</strong> ${order.paymentMethod === "bank_wire" ? "Bank wire transfer" : "Payoneer"}</p>
+    ${methodBlock}
+    <p>Once our team confirms your payment, you'll receive a separate email and full course access
+    will be unlocked automatically on your account.</p>
+  `);
+
+  return sendMail({
+    to,
+    subject: `Your Aynwerd order ${order.orderNumber} — payment instructions`,
+    html,
+    text: `Order ${order.orderNumber} created for ${courseTitle}. Amount due: ${order.currency} ${order.amount.toFixed(2)}.`,
+  });
+}
+
+async function sendPaymentConfirmedEmail({ to, name, order, courseTitle }) {
+  const html = baseLayout(`
+    <p>Hi ${name},</p>
+    <p>Great news — we've confirmed your payment for <strong>${courseTitle}</strong>.</p>
+    <p><strong>Order number:</strong> ${order.orderNumber}<br/>
+       <strong>Amount paid:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
+       <strong>Confirmed on:</strong> ${new Date(order.confirmedAt).toUTCString()}</p>
+    <p>Full access to the course has been unlocked on your account. Log in any time to get started.</p>
+  `);
+
+  return sendMail({
+    to,
+    subject: `Payment confirmed — order ${order.orderNumber}`,
+    html,
+    text: `Payment confirmed for order ${order.orderNumber}. Course access unlocked.`,
+  });
+}
+
+async function sendPaymentRejectedEmail({ to, name, order, courseTitle, reason }) {
+  const html = baseLayout(`
+    <p>Hi ${name},</p>
+    <p>We were unable to confirm your payment for <strong>${courseTitle}</strong> (order
+    <strong>${order.orderNumber}</strong>).</p>
+    ${reason ? `<p><strong>Reason:</strong> ${reason}</p>` : ""}
+    <p>Please reply to this email or contact support so we can help resolve this.</p>
+  `);
+
+  return sendMail({
+    to,
+    subject: `Action needed on order ${order.orderNumber}`,
+    html,
+    text: `We could not confirm payment for order ${order.orderNumber}.${reason ? ` Reason: ${reason}` : ""}`,
+  });
+}
+
+async function sendAdminNewOrderAlert({ order, courseTitle, customerEmail }) {
+  if (!env.adminNotifyEmail) return null;
+  const html = baseLayout(`
+    <p>New order awaiting confirmation.</p>
+    <p><strong>Order:</strong> ${order.orderNumber}<br/>
+       <strong>Customer:</strong> ${customerEmail}<br/>
+       <strong>Course:</strong> ${courseTitle}<br/>
+       <strong>Amount:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
+       <strong>Method:</strong> ${order.paymentMethod}</p>
+    <p>Review and confirm it from the admin dashboard.</p>
+  `);
+  return sendMail({
+    to: env.adminNotifyEmail,
+    subject: `New order ${order.orderNumber} awaiting confirmation`,
+    html,
+  });
+}
+
+module.exports = {
+  sendOrderPlacedEmail,
+  sendPaymentConfirmedEmail,
+  sendPaymentRejectedEmail,
+  sendAdminNewOrderAlert,
+};

src/utils/jwt.js

@@ -0,0 +1,33 @@
+const jwt = require("jsonwebtoken");
+const crypto = require("crypto");
+const { env } = require("../config/env");
+
+function signAccessToken(user) {
+  return jwt.sign(
+    { sub: user._id.toString(), role: user.role, tokenVersion: user.tokenVersion },
+    env.jwtAccessSecret,
+    { expiresIn: env.jwtAccessExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
+  );
+}
+
+function signRefreshToken(user) {
+  // A random jti lets us revoke a single refresh token (e.g. on logout /
+  // password change) without invalidating every session at once.
+  const jti = crypto.randomUUID();
+  const token = jwt.sign(
+    { sub: user._id.toString(), tokenVersion: user.tokenVersion, jti },
+    env.jwtRefreshSecret,
+    { expiresIn: env.jwtRefreshExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
+  );
+  return { token, jti };
+}
+
+function verifyAccessToken(token) {
+  return jwt.verify(token, env.jwtAccessSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
+}
+
+function verifyRefreshToken(token) {
+  return jwt.verify(token, env.jwtRefreshSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
+}
+
+module.exports = { signAccessToken, signRefreshToken, verifyAccessToken, verifyRefreshToken };

src/utils/logger.js

@@ -0,0 +1,29 @@
+const winston = require("winston");
+
+// Structured JSON logging so records can be shipped to a log aggregator.
+// Never log secrets, raw passwords, tokens, or full payment identifiers —
+// see redact() usage in controllers.
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || "info",
+  format: winston.format.combine(
+    winston.format.timestamp(),
+    winston.format.errors({ stack: true }),
+    winston.format.json()
+  ),
+  defaultMeta: { service: "aynwerd-api" },
+  transports: [new winston.transports.Console()],
+});
+
+/**
+ * Redact all but the last `keep` characters of a sensitive string, e.g.
+ * for logging a payment reference without exposing it in full.
+ */
+function redact(value, keep = 4) {
+  if (!value) return value;
+  const str = String(value);
+  if (str.length <= keep) return "*".repeat(str.length);
+  return `${"*".repeat(str.length - keep)}${str.slice(-keep)}`;
+}
+
+module.exports = logger;
+module.exports.redact = redact;

src/utils/orderNumber.js

@@ -0,0 +1,15 @@
+const crypto = require("crypto");
+
+/**
+ * Human-friendly, hard-to-guess order number, e.g. AYN-20260825-4F9K2C.
+ * Not used as a security token (the order is always looked up by its
+ * MongoDB _id + the requesting user's identity), just a reference the
+ * customer can quote in support emails.
+ */
+function generateOrderNumber() {
+  const date = new Date().toISOString().slice(0, 10).replace(/-/g, "");
+  const random = crypto.randomBytes(4).toString("hex").toUpperCase().slice(0, 6);
+  return `AYN-${date}-${random}`;
+}
+
+module.exports = { generateOrderNumber };