jwt login + middleware

server/src/auth.js

@@ -7,41 +7,44 @@ import path from 'node:path';
 import db from './db.js';
 
 const DATA_DIR = process.env.DATA_DIR || path.join(process.cwd(), 'data');
-fs.mkdirSync(DATA_DIR, { recursive: true });
 
-function loadSecret() {
-  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
+let secret = process.env.JWT_SECRET;
+if (!secret) {
   const file = path.join(DATA_DIR, 'jwt-secret');
-  if (fs.existsSync(file)) return fs.readFileSync(file, 'utf8').trim();
-  const secret = crypto.randomBytes(32).toString('hex');
-  fs.writeFileSync(file, secret, { mode: 0o600 });
-  return secret;
+  if (fs.existsSync(file)) secret = fs.readFileSync(file, 'utf8').trim();
+  else {
+    secret = crypto.randomBytes(32).toString('hex');
+    fs.writeFileSync(file, secret);
+  }
 }
+export { secret };
 
-export const JWT_SECRET = loadSecret();
-
-const r = Router();
+const router = Router();
 
-r.post('/login', (req, res) => {
+router.post('/login', (req, res) => {
   const { username, password } = req.body || {};
   const u = db.prepare('SELECT * FROM users WHERE username = ?').get(String(username || ''));
   if (!u || !bcrypt.compareSync(String(password || ''), u.password_hash)) {
-    return res.status(401).json({ error: 'Invalid username or password' });
+    return res.status(401).json({ error: 'Invalid credentials' });
   }
-  const token = jwt.sign({ sub: u.id, username: u.username, role: u.role }, JWT_SECRET, { expiresIn: '12h' });
+  const token = jwt.sign({ sub: u.id, username: u.username, role: u.role }, secret, { expiresIn: '12h' });
   res.json({ token, user: { id: u.id, username: u.username, role: u.role } });
 });
 
+router.get('/me', requireAuth, (req, res) => {
+  res.json({ id: req.user.sub, username: req.user.username, role: req.user.role });
+});
+
 export function requireAuth(req, res, next) {
   const header = req.headers.authorization || '';
   const token = header.startsWith('Bearer ') ? header.slice(7) : null;
   if (!token) return res.status(401).json({ error: 'Missing token' });
   try {
-    req.user = jwt.verify(token, JWT_SECRET);
+    req.user = jwt.verify(token, secret);
     next();
   } catch {
-    res.status(401).json({ error: 'Invalid or expired token' });
+    res.status(401).json({ error: 'Invalid token' });
   }
 }
 
-export default r;
+export default router;