Upload folder using huggingface_hub

Dockerfile

@@ -10,6 +10,10 @@ RUN npm ci --production
 # Copy source code
 COPY . .
 
+# Set environment variables
+ENV NODE_ENV=production
+ENV PORT=7860
+
 # Expose port (HF default)
 EXPOSE 7860
 

app.js

@@ -12,9 +12,10 @@ const { connectDB } = require('./db');
 const destinationRoutes = require('./routes/destinations.routes');
 const providerRoutes = require('./routes/providers.routes');
 const complaintRoutes = require('./routes/complaints.routes');
+const authRoutes = require('./routes/auth.routes');
 
 const app = express();
-const PORT = process.env.PORT || 3004;
+const PORT = 7860; // Enforce 7860 for Hugging Face Spaces Compatibility
 
 // Middleware
 app.use(cors({ origin: '*' }));
@@ -33,6 +34,7 @@ app.get('/health', async (req, res) => {
 app.use('/api/v1/destinations', destinationRoutes);
 app.use('/api/v1/providers', providerRoutes);
 app.use('/api/v1/complaints', complaintRoutes);
+app.use('/api/v1/auth', authRoutes);
 
 // Start server
 async function start() {

controllers/auth.controller.js

@@ -0,0 +1,104 @@
+/**
+ * Admin Auth Controller - Independent Admin Authentication
+ */
+const bcrypt = require('bcryptjs');
+const jwt = require('jsonwebtoken');
+const { getPool } = require('../db');
+
+const ADMIN_JWT_SECRET = process.env.ADMIN_JWT_SECRET || 'admin-secret-key-123';
+const JWT_EXPIRES_IN = '8h'; // Longer session for admins
+
+/**
+ * Generate JWT for Admin
+ */
+function generateToken(admin) {
+  return jwt.sign(
+    { 
+      id: admin.id, 
+      username: admin.username, 
+      email: admin.email, 
+      role: 'admin',
+      permissions: admin.permissions 
+    },
+    ADMIN_JWT_SECRET,
+    { expiresIn: JWT_EXPIRES_IN }
+  );
+}
+
+/**
+ * Register Admin
+ */
+async function register(req, res) {
+  const { username, email, password, name } = req.body;
+  const pool = getPool();
+  
+  if (!pool) return res.status(500).json({ error: 'Database not connected' });
+  
+  try {
+    const existing = await pool.query('SELECT id FROM admins WHERE email = $1 OR username = $2', [email, username]);
+    if (existing.rows.length > 0) {
+      return res.status(400).json({ error: 'Admin already exists' });
+    }
+    
+    const hashedPassword = await bcrypt.hash(password, 12);
+    const result = await pool.query(
+      'INSERT INTO admins (username, email, password_hash, name, permissions) VALUES ($1, $2, $3, $4, $5) RETURNING id, username, email, name, permissions',
+      [username, email, hashedPassword, name, JSON.stringify(['all'])]
+    );
+    
+    const admin = result.rows[0];
+    const token = generateToken(admin);
+    
+    res.status(201).json({ admin, token });
+  } catch (error) {
+    console.error('[Admin Register Error]', error.message);
+    res.status(500).json({ error: 'Failed to register admin' });
+  }
+}
+
+/**
+ * Login Admin
+ */
+async function login(req, res) {
+  const { email, password } = req.body;
+  const pool = getPool();
+  
+  if (!pool) return res.status(500).json({ error: 'Database not connected' });
+  
+  try {
+    const result = await pool.query('SELECT * FROM admins WHERE email = $1', [email]);
+    if (result.rows.length === 0) {
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    
+    const admin = result.rows[0];
+    const valid = await bcrypt.compare(password, admin.password_hash);
+    if (!valid) {
+      return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    
+    const token = generateToken(admin);
+    delete admin.password_hash;
+    
+    res.json({ admin, token });
+  } catch (error) {
+    console.error('[Admin Login Error]', error.message);
+    res.status(500).json({ error: 'Login failed' });
+  }
+}
+
+/**
+ * Get current admin profile
+ */
+async function getMe(req, res) {
+  const pool = getPool();
+  try {
+    const result = await pool.query('SELECT id, username, email, name, permissions FROM admins WHERE id = $1', [req.user.id]);
+    if (result.rows.length === 0) return res.status(404).json({ error: 'Admin not found' });
+    res.json({ admin: result.rows[0] });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch profile' });
+  }
+}
+
+module.exports = { register, login, getMe };

middlewares/auth.js

@@ -5,7 +5,7 @@
  */
 const jwt = require('jsonwebtoken');
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your-jwt-secret-here';
+const ADMIN_JWT_SECRET = process.env.ADMIN_JWT_SECRET || 'admin-secret-key-123';
 
 /**
  * Authenticate Admin
@@ -20,7 +20,7 @@ function authenticateAdmin(req, res, next) {
   const token = authHeader.split(' ')[1];
   
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
+    const decoded = jwt.verify(token, ADMIN_JWT_SECRET);
     
     if (decoded.role !== 'admin') {
       return res.status(403).json({ error: 'Access denied. Administrator privileges required.' });

routes/auth.routes.js

@@ -0,0 +1,11 @@
+const express = require('express');
+const { register, login, getMe } = require('../controllers/auth.controller');
+const { authenticateAdmin } = require('../middlewares/auth');
+
+const router = express.Router();
+
+router.post('/register', register);
+router.post('/login', login);
+router.get('/me', authenticateAdmin, getMe);
+
+module.exports = router;