airewit-developer
c8909befb1
Backend: - Express server with JWT httpOnly cookie auth - POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me - bcrypt 12 rounds, generic 401 errors (no email/password field disclosure) - Auth middleware protects all /api/* routes except register/login - pg Pool database connection Frontend (React + Vite + TailwindCSS + shadcn/ui): - AuthContext with session restore on page load via /api/auth/me - ProtectedRoute redirects unauthenticated users to /login - LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation - DashboardPage placeholder - shadcn/ui components: Button, Input, Label, Card Database: - 9 migrations (001-009): extensions, users, events, vendors, guests, bookings, invitations, vendor_ratings, organizer_preferences - pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags - Phase 2+3 fields included: source, payment_status, contract_value, vendor ratings 6-dimension, organizer preferences - Idempotent migration runner with schema_migrations tracking table Infrastructure: - Dockerfile (multi-stage: build React → production node:20-alpine) - docker-compose.yml with PostgreSQL healthcheck, expose not ports - Migrations run automatically on container start Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
34 lines
910 B
JavaScript
34 lines
910 B
JavaScript
const jwt = require('jsonwebtoken');
|
|
|
|
const JWT_SECRET = process.env.JWT_SECRET;
|
|
|
|
/**
|
|
* Express middleware: validates JWT from httpOnly cookie or Authorization Bearer header.
|
|
* Attaches decoded user payload to req.user on success.
|
|
* Returns 401 for missing or invalid tokens.
|
|
*/
|
|
function authMiddleware(req, res, next) {
|
|
let token = null;
|
|
|
|
// Prefer httpOnly cookie
|
|
if (req.cookies && req.cookies.token) {
|
|
token = req.cookies.token;
|
|
} else if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
|
|
token = req.headers.authorization.slice(7);
|
|
}
|
|
|
|
if (!token) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
try {
|
|
const payload = jwt.verify(token, JWT_SECRET);
|
|
req.user = payload;
|
|
next();
|
|
} catch {
|
|
return res.status(401).json({ error: 'Invalid or expired session' });
|
|
}
|
|
}
|
|
|
|
module.exports = { authMiddleware };
|