JWT auth: login route + requireAuth middleware

server/src/auth.js

@@ -0,0 +1,47 @@
+import { Router } from 'express';
+import jwt from 'jsonwebtoken';
+import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import db from './db.js';
+
+const DATA_DIR = process.env.DATA_DIR || path.join(process.cwd(), 'data');
+fs.mkdirSync(DATA_DIR, { recursive: true });
+
+function loadSecret() {
+  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
+  const file = path.join(DATA_DIR, 'jwt-secret');
+  if (fs.existsSync(file)) return fs.readFileSync(file, 'utf8').trim();
+  const secret = crypto.randomBytes(32).toString('hex');
+  fs.writeFileSync(file, secret, { mode: 0o600 });
+  return secret;
+}
+
+export const JWT_SECRET = loadSecret();
+
+const r = Router();
+
+r.post('/login', (req, res) => {
+  const { username, password } = req.body || {};
+  const u = db.prepare('SELECT * FROM users WHERE username = ?').get(String(username || ''));
+  if (!u || !bcrypt.compareSync(String(password || ''), u.password_hash)) {
+    return res.status(401).json({ error: 'Invalid username or password' });
+  }
+  const token = jwt.sign({ sub: u.id, username: u.username, role: u.role }, JWT_SECRET, { expiresIn: '12h' });
+  res.json({ token, user: { id: u.id, username: u.username, role: u.role } });
+});
+
+export function requireAuth(req, res, next) {
+  const header = req.headers.authorization || '';
+  const token = header.startsWith('Bearer ') ? header.slice(7) : null;
+  if (!token) return res.status(401).json({ error: 'Missing token' });
+  try {
+    req.user = jwt.verify(token, JWT_SECRET);
+    next();
+  } catch {
+    res.status(401).json({ error: 'Invalid or expired token' });
+  }
+}
+
+export default r;