Authentication

import jwt from 'jsonwebtoken';
import { config } from '../config/index.js';

export function generateAccessToken(user) {
  return jwt.sign(
    {
      id: user._id,
      email: user.email,
      role: user.role,
    },
    config.jwt.secret,
    { expiresIn: '15m' } // Short-lived
  );
}

export function generateRefreshToken(user) {
  return jwt.sign(
    { id: user._id },
    config.jwt.refreshSecret,
    { expiresIn: '7d' } // Longer-lived
  );
}

export function verifyAccessToken(token) {
  try {
    return jwt.verify(token, config.jwt.secret);
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      throw new UnauthorizedError('Token expired');
    }
    throw new UnauthorizedError('Invalid token');
  }
}

// src/services/auth.js
import { User } from '../models/User.js';
import { hashPassword, generateAccessToken, generateRefreshToken } from '../utils/auth.js';
import { ConflictError } from '../utils/errors.js';

export async function register(data) {
  // Check if email exists
  const existing = await User.findOne({ email: data.email.toLowerCase() });
  if (existing) {
    throw new ConflictError('Email already registered');
  }

  // Create user (password hashed by model hook)
  const user = await User.create({
    email: data.email.toLowerCase(),
    password: data.password,
    name: data.name,
  });

  // Generate tokens
  const accessToken = generateAccessToken(user);
  const refreshToken = generateRefreshToken(user);

  // Store refresh token hash in database (for revocation)
  user.refreshTokenHash = hashToken(refreshToken);
  await user.save();

  return {
    user: { id: user._id, email: user.email, name: user.name },
    tokens: { accessToken, refreshToken },
  };
}

export async function login(email, password) {
  // Find user with password field
  const user = await User.findOne({ email: email.toLowerCase() })
    .select('+password');

  if (!user) {
    throw new UnauthorizedError('Invalid credentials');
  }

  // Check password
  const isValid = await user.comparePassword(password);
  if (!isValid) {
    throw new UnauthorizedError('Invalid credentials');
  }

  // Update last login
  user.lastLogin = new Date();

  // Generate tokens
  const accessToken = generateAccessToken(user);
  const refreshToken = generateRefreshToken(user);
  user.refreshTokenHash = hashToken(refreshToken);
  await user.save();

  return {
    user: { id: user._id, email: user.email, name: user.name },
    tokens: { accessToken, refreshToken },
  };
}

export async function refreshTokens(refreshToken) {
  // Verify the refresh token
  let payload;
  try {
    payload = jwt.verify(refreshToken, config.jwt.refreshSecret);
  } catch {
    throw new UnauthorizedError('Invalid refresh token');
  }

  // Find user and verify token hash
  const user = await User.findById(payload.id);
  if (!user) {
    throw new UnauthorizedError('User not found');
  }

  const tokenHash = hashToken(refreshToken);
  if (user.refreshTokenHash !== tokenHash) {
    throw new UnauthorizedError('Token revoked');
  }

  // Generate new tokens
  const newAccessToken = generateAccessToken(user);
  const newRefreshToken = generateRefreshToken(user);
  user.refreshTokenHash = hashToken(newRefreshToken);
  await user.save();

  return {
    accessToken: newAccessToken,
    refreshToken: newRefreshToken,
  };
}

export async function logout(userId) {
  // Clear refresh token - this revokes it
  await User.findByIdAndUpdate(userId, {
    refreshTokenHash: null,
  });
}

// src/middleware/auth.js
import { verifyAccessToken } from '../utils/auth.js';
import { UnauthorizedError } from '../utils/errors.js';

export function authenticate(req, res, next) {
  // Get token from header
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    throw new UnauthorizedError('No token provided');
  }

  const token = authHeader.split(' ')[1];

  // Verify and decode
  const payload = verifyAccessToken(token);

  // Attach user to request
  req.user = payload;
  next();
}

// Optional auth - doesn't fail if no token
export function optionalAuth(req, res, next) {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return next();
  }

  try {
    const token = authHeader.split(' ')[1];
    req.user = verifyAccessToken(token);
  } catch {
    // Invalid token - continue without user
  }
  next();
}

// src/middleware/authorize.js
import { ForbiddenError } from '../utils/errors.js';

export function requireRole(...roles) {
  return (req, res, next) => {
    if (!req.user) {
      throw new UnauthorizedError('Authentication required');
    }

    if (!roles.includes(req.user.role)) {
      throw new ForbiddenError('Insufficient permissions');
    }

    next();
  };
}

// Usage
router.delete('/users/:id',
  authenticate,
  requireRole('admin'),
  userController.remove
);

// src/routes/auth.js
import { Router } from 'express';
import * as authController from '../controllers/auth.js';
import { authenticate } from '../middleware/auth.js';
import { validate } from '../middleware/validate.js';
import { registerSchema, loginSchema, refreshSchema } from '../validators/auth.js';

const router = Router();

router.post('/register', validate(registerSchema), authController.register);
router.post('/login', validate(loginSchema), authController.login);
router.post('/refresh', validate(refreshSchema), authController.refresh);
router.post('/logout', authenticate, authController.logout);
router.get('/me', authenticate, authController.me);

export default router;

// src/controllers/auth.js
import * as authService from '../services/auth.js';
import { success, created, noContent } from '../utils/response.js';

export async function register(req, res) {
  const result = await authService.register(req.body);
  created(res, result);
}

export async function login(req, res) {
  const { email, password } = req.body;
  const result = await authService.login(email, password);
  success(res, result);
}

export async function refresh(req, res) {
  const { refreshToken } = req.body;
  const tokens = await authService.refreshTokens(refreshToken);
  success(res, tokens);
}

export async function logout(req, res) {
  await authService.logout(req.user.id);
  noContent(res);
}

export async function me(req, res) {
  const user = await User.findById(req.user.id).select('-password');
  success(res, user);
}

// Web: Store in memory or httpOnly cookie
// NEVER localStorage (XSS vulnerable)

// Mobile: Secure storage (Keychain/Keystore)

// Access token: Short (15 min - 1 hour)
// Refresh token: Longer (7 days - 30 days)

// Short access tokens limit damage if stolen
// Refresh tokens let users stay logged in

// Issue new refresh token on each refresh
// Invalidate old one
// If old one is used, revoke all tokens (possible theft)

import rateLimit from 'express-rate-limit';

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts
  message: 'Too many login attempts, try again later',
});

router.post('/login', authLimiter, validate(loginSchema), authController.login);

const passwordSchema = z.string()
  .min(8, 'At least 8 characters')
  .regex(/[A-Z]/, 'Must contain uppercase')
  .regex(/[a-z]/, 'Must contain lowercase')
  .regex(/[0-9]/, 'Must contain number');