Implementing Authentication

import jwt from "jsonwebtoken";

async function verifyJWT(authHeader) {
  if (!authHeader?.startsWith("Bearer ")) return null;
  try {
    const payload = jwt.verify(authHeader.slice(7), process.env.JWT_SECRET, {
      algorithms: ["RS256"], audience: "api", issuer: "auth-service"
    });
    return await db.user.findUnique({ where: { id: payload.sub } });
  } catch { return null; }
}

function requireAuth(ctx) {
  if (!ctx.user) throw new GraphQLError("Unauthenticated", { extensions: { code: "UNAUTHENTICATED" } });
  return ctx.user;
}

Mutation: { createPost: (_, { input }, ctx) => { const u = requireAuth(ctx); ... } }

login: async (_, { email, password }, { db }) => {
  const user = await db.user.findUnique({ where: { email } });
  if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
    return { __typename: "InvalidCredentials", message: "Invalid email or password" };
  }
  return { __typename: "LoginSuccess", user, token: signJWT(user), refreshToken: signRefresh(user) };
}

type Mutation {
  refreshAccessToken(refreshToken: String!): TokenPair!
}
type TokenPair { accessToken: String!, refreshToken: String!, expiresIn: Int! }