Implementing Authentication

npm i passport passport-local passport-jwt passport-google-oauth20 bcrypt jsonwebtoken

import passport from "passport";
import "./auth/strategies.js";  // registers strategies

app.use(passport.initialize());
// app.use(passport.session()); // only if using sessions

import { Strategy as LocalStrategy } from "passport-local";
import bcrypt from "bcrypt";

passport.use(new LocalStrategy({ usernameField: "email" }, async (email, password, done) => {
  try {
    const user = await db.users.findByEmail(email);
    if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
      return done(null, false, { message: "Invalid credentials" });
    }
    return done(null, user);
  } catch (err) { return done(err); }
}));

passport.serializeUser((user, done) => done(null, user.id));

passport.deserializeUser(async (id, done) => {
  try { done(null, await db.users.findById(id)); }
  catch (err) { done(err); }
});

import jwt from "jsonwebtoken";

function issueTokens(user) {
  const access = jwt.sign(
    { sub: user.id, role: user.role },
    process.env.JWT_SECRET,
    { algorithm: "HS256", expiresIn: "15m", issuer: "api.example.com" }
  );
  const refresh = jwt.sign({ sub: user.id, typ: "refresh" }, process.env.JWT_REFRESH_SECRET, { expiresIn: "30d" });
  return { access, refresh };
}

export function requireAuth(req, res, next) {
  const token = (req.get("Authorization") || "").replace(/^Bearer\s+/i, "");
  if (!token) return next(new HttpError(401, "Missing token"));
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ["HS256"] });
    next();
  } catch (err) {
    next(new HttpError(401, "Invalid token"));
  }
}

import { Strategy as GoogleStrategy } from "passport-google-oauth20";

passport.use(new GoogleStrategy({
  clientID:     process.env.GOOGLE_ID,
  clientSecret: process.env.GOOGLE_SECRET,
  callbackURL:  "/auth/google/callback"
}, async (accessToken, refreshToken, profile, done) => {
  const user = await db.users.upsertFromGoogle(profile);
  done(null, user);
}));

app.get("/auth/google",          passport.authenticate("google", { scope: ["profile","email"] }));
app.get("/auth/google/callback", passport.authenticate("google", { session: false }),
  (req, res) => res.json(issueTokens(req.user)));

app.get("/me", requireAuth, (req, res) => res.json(req.user));
app.use("/api/admin", requireAuth, requireRole("admin"), adminRouter);

app.post("/login", passport.authenticate("local", { session: false }), (req, res) => {
  const tokens = issueTokens(req.user);
  res.cookie("rt", tokens.refresh, { httpOnly: true, secure: true, sameSite: "lax", path: "/auth/refresh" });
  res.json({ accessToken: tokens.access });
});

app.post("/logout", (req, res) => {
  res.clearCookie("rt", { path: "/auth/refresh" });
  res.sendStatus(204);
});

import bcrypt from "bcrypt";
const COST = 12;

const hash = await bcrypt.hash(password, COST);
const ok   = await bcrypt.compare(password, user.passwordHash);