Building a Complete Authentication Project

auth_api/
    server.js           <-- The main entry point
    .env                <-- Secret Keys (Git Ignored)
    models/
        User.js         <-- Database Schema
    controllers/
        authController.js <-- Login/Register logic
    routes/
        authRoutes.js   <-- Endpoint mapping
    middleware/
        authGuard.js    <-- JWT and Role verification
        rateLimiter.js  <-- Brute force protection

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
    email: { type: String, required: true, unique: true, lowercase: true },
    password: { type: String, required: true }, // Will be hashed!
    role: { type: String, enum: ['user', 'admin'], default: 'user' },
    refreshToken: { type: String } // Stores the long-lived token
});

module.exports = mongoose.model('User', userSchema);

const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');
const User = require('../models/User');

// The Registration Logic
exports.register = async (req, res) => {
    try {
        const { email, password } = req.body;
        
        // 1. Hash password
        const hashedPassword = await bcrypt.hash(password, 10);
        
        // 2. Save user
        const newUser = new User({ email, password: hashedPassword });
        await newUser.save();
        
        res.status(201).json({ message: "User registered successfully" });
    } catch (error) {
        res.status(500).json({ error: "Registration failed" });
    }
};

// The Login Logic (The Dual-Token System)
exports.login = async (req, res) => {
    const { email, password } = req.body;
    
    // 1. Find User
    const user = await User.findOne({ email });
    if (!user) return res.status(401).json({ error: "Invalid credentials" });
    
    // 2. Verify Password
    const isValid = await bcrypt.compare(password, user.password);
    if (!isValid) return res.status(401).json({ error: "Invalid credentials" });
    
    // 3. Generate Tokens
    const accessToken = jwt.sign({ userId: user._id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '15m' });
    const refreshToken = jwt.sign({ userId: user._id }, process.env.REFRESH_SECRET, { expiresIn: '7d' });
    
    // 4. Save Refresh Token to DB
    user.refreshToken = refreshToken;
    await user.save();
    
    // 5. Send Response
    // Best Practice: Send Access Token in JSON, send Refresh Token in an HttpOnly Cookie!
    res.cookie('jwt_refresh', refreshToken, { httpOnly: true, secure: true, maxAge: 7 * 24 * 60 * 60 * 1000 });
    res.json({ accessToken });
};

const jwt = require('jsonwebtoken');

// 1. AuthN Guard
exports.verifyToken = (req, res, next) => {
    const token = req.headers.authorization?.split(' ')[1];
    if (!token) return res.status(401).json({ error: "Access Denied" });

    jwt.verify(token, process.env.JWT_SECRET, (err, decoded) => {
        if (err) return res.status(403).json({ error: "Token Expired or Invalid" });
        req.user = decoded;
        next();
    });
};

// 2. AuthZ Guard (RBAC)
exports.requireAdmin = (req, res, next) => {
    if (req.user.role !== 'admin') {
        return res.status(403).json({ error: "Forbidden: Admins Only" });
    }
    next();
};

const express = require('express');
const router = express.Router();
const authController = require('../controllers/authController');
const { verifyToken, requireAdmin } = require('../middleware/authGuard');
const { loginLimiter } = require('../middleware/rateLimiter');

// Public Routes
router.post('/register', authController.register);
router.post('/login', loginLimiter, authController.login);

// Protected Routes (Chaining the Middleware!)
// Standard users can view their profile
router.get('/profile', verifyToken, (req, res) => {
    res.json({ message: "Profile Data", userId: req.user.userId });
});

// ONLY Admins can view the system settings
router.get('/admin/settings', verifyToken, requireAdmin, (req, res) => {
    res.json({ message: "Sensitive Admin Settings" });
});

module.exports = router;

require('dotenv').config();
const express = require('express');
const mongoose = require('mongoose');
const authRoutes = require('./routes/authRoutes');

const app = express();
app.use(express.json());

// Mount the router
app.use('/api', authRoutes);

mongoose.connect(process.env.MONGO_URI).then(() => {
    console.log("Connected to Database");
    app.listen(3000, () => console.log("Server running on port 3000"));
});