solution 4.18: bloglist expansion, step6. Add token-based auth.

app.js

@@ -2,8 +2,9 @@ const config = require('./utils/config')
 const express = require('express')
 const app = express()
 const cors = require('cors')
-const BlogsRouter = require('./controllers/blogs')
+const loginRouter = require('./controllers/login')
 const usersRouter = require('./controllers/users')
+const BlogsRouter = require('./controllers/blogs')
 const middleware = require('./utils/middleware')
 const logger = require('./utils/logger')
 const mongoose = require('mongoose')
@@ -26,8 +27,9 @@ app.use(express.static('build'))
 app.use(express.json())
 app.use(middleware.requestLogger)
 
-app.use('/api/blogs', BlogsRouter)
+app.use('/api/login', loginRouter)
 app.use('/api/users', usersRouter)
+app.use('/api/blogs', BlogsRouter)
 
 app.use(middleware.unknownEndpoint)
 app.use(middleware.errorHandler)

controllers/login.js

@@ -0,0 +1,31 @@
+const jwt = require('jsonwebtoken')
+const bcrypt = require('bcrypt')
+const loginRouter = require('express').Router()
+const User = require('../models/user')
+
+loginRouter.post('/', async (request, response) => {
+  const body = request.body
+
+  const user = await User.findOne({ username: body.username })
+  const passwordCorrect =
+    user === null
+      ? false
+      : await bcrypt.compare(body.password, user.passwordHash)
+
+  if (!(user && passwordCorrect)) {
+    return response.status(401).json({
+      error: 'invalid username or password',
+    })
+  }
+
+  const userForToken = {
+    username: user.username,
+    id: user._id,
+  }
+
+  const token = jwt.sign(userForToken, process.env.SECRET)
+
+  response.status(200).send({ token, username: user.username, name: user.name })
+})
+
+module.exports = loginRouter

package.json

@@ -25,6 +25,7 @@
     "dotenv": "16.3.1",
     "express": "4.18.2",
     "express-async-errors": "3.1.1",
+    "jsonwebtoken": "^9.0.2",
     "lodash": "4.17.21",
     "mongoose": "7.5.0",
     "mongoose-unique-validator": "^4.0.0"

requests/login.rest

@@ -0,0 +1,7 @@
+POST http://localhost:3003/api/login
+Content-Type: application/json
+
+{
+    "username": "root",
+    "password": "test"
+}