93 lines
3.5 KiB
TypeScript
93 lines
3.5 KiB
TypeScript
import { Router, Request, Response } from 'express';
|
|
import { Pool } from 'pg';
|
|
import { AuthService } from './auth.service.ts';
|
|
|
|
export function createAuthRouter(db: Pool, authService: AuthService): Router {
|
|
const router = Router();
|
|
|
|
/**
|
|
* POST /api/auth/register
|
|
*/
|
|
router.post('/register', async (req: Request, res: Response): Promise<void> => {
|
|
try {
|
|
const { username, password } = req.body;
|
|
|
|
if (!username || !password || username.trim() === '' || password.length < 8) {
|
|
res.status(400).json({ success: false, error: 'Username required, and password must be at least 8 characters long.' });
|
|
return;
|
|
}
|
|
|
|
// Check if user already exists
|
|
const checkUser = await db.query('SELECT id FROM users WHERE username = $1;', [username]);
|
|
if (checkUser.rows.length > 0) {
|
|
res.status(409).json({ success: false, error: 'Username is already taken.' });
|
|
return;
|
|
}
|
|
|
|
// Hash password using Argon2id
|
|
const hash = await authService.hashPassword(password);
|
|
|
|
// Save user
|
|
await db.query('INSERT INTO users (username, password_hash) VALUES ($1, $2);', [username, hash]);
|
|
|
|
res.status(201).json({ success: true, message: 'User registered successfully!' });
|
|
} catch (error) {
|
|
console.error('Registration failure:', error);
|
|
res.status(500).json({ success: false, error: 'Internal Server Error' });
|
|
}
|
|
});
|
|
|
|
/**
|
|
* POST /api/auth/login
|
|
*/
|
|
router.post('/login', async (req: Request, res: Response): Promise<void> => {
|
|
try {
|
|
const { username, password } = req.body;
|
|
|
|
if (!username || !password) {
|
|
res.status(400).json({ success: false, error: 'Username and password are required.' });
|
|
return;
|
|
}
|
|
|
|
const result = await db.query('SELECT id, password_hash FROM users WHERE username = $1;', [username]);
|
|
if (result.rows.length === 0) {
|
|
res.status(401).json({ success: false, error: 'Invalid username or password.' });
|
|
return;
|
|
}
|
|
|
|
const user = result.rows[0];
|
|
const validPassword = await authService.verifyPassword(password, user.password_hash);
|
|
|
|
if (!validPassword) {
|
|
res.status(401).json({ success: false, error: 'Invalid username or password.' });
|
|
return;
|
|
}
|
|
|
|
// Generate a high-entropy session token
|
|
const sessionToken = authService.generateSessionToken();
|
|
const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // Expires in 30 days
|
|
|
|
// Store the session securely in the database
|
|
await db.query(
|
|
'INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3);',
|
|
[sessionToken, user.id, expiresAt]
|
|
);
|
|
|
|
// Issue the secure HttpOnly cookie
|
|
res.cookie('session_token', sessionToken, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production', // Requires HTTPS in production
|
|
sameSite: 'strict',
|
|
expires: expiresAt,
|
|
});
|
|
|
|
res.json({ success: true, message: 'Logged in successfully!' });
|
|
} catch (error) {
|
|
console.error('Login failure:', error);
|
|
res.status(500).json({ success: false, error: 'Internal Server Error' });
|
|
}
|
|
});
|
|
|
|
return router;
|
|
}
|