74 lines
2.4 KiB
TypeScript
74 lines
2.4 KiB
TypeScript
import type { FastifyPluginAsync } from 'fastify';
|
|
import { z } from 'zod';
|
|
import { hashPassword, verifyPassword } from '../auth/passwords.js';
|
|
import type { AuthUser } from '../auth/plugin.js';
|
|
import { pool } from '../db/pool.js';
|
|
|
|
const credentialsSchema = z.object({
|
|
email: z.string().email().transform((email) => email.toLowerCase()),
|
|
password: z.string().min(12).max(200),
|
|
});
|
|
|
|
const registerSchema = credentialsSchema.extend({
|
|
name: z.string().trim().min(2).max(120),
|
|
});
|
|
|
|
type UserRow = {
|
|
id: string;
|
|
email: string;
|
|
display_name: string;
|
|
role: AuthUser['role'];
|
|
password_hash: string;
|
|
is_active: boolean;
|
|
};
|
|
|
|
const serializeUser = (user: UserRow): AuthUser => ({
|
|
id: user.id,
|
|
email: user.email,
|
|
name: user.display_name,
|
|
role: user.role,
|
|
});
|
|
|
|
export const authRoutes: FastifyPluginAsync = async (app) => {
|
|
app.post('/register', async (request, reply) => {
|
|
const input = registerSchema.parse(request.body);
|
|
const passwordHash = await hashPassword(input.password);
|
|
|
|
try {
|
|
const result = await pool.query<UserRow>(
|
|
`insert into users (email, password_hash, display_name)
|
|
values ($1, $2, $3)
|
|
returning id, email, display_name, role, password_hash, is_active`,
|
|
[input.email, passwordHash, input.name],
|
|
);
|
|
const user = serializeUser(result.rows[0]);
|
|
const token = await reply.jwtSign(user, { expiresIn: '7d' });
|
|
return reply.code(201).send({ token, user });
|
|
} catch (error: unknown) {
|
|
if (typeof error === 'object' && error && 'code' in error && error.code === '23505') {
|
|
return reply.code(409).send({ error: 'An account with this email already exists' });
|
|
}
|
|
throw error;
|
|
}
|
|
});
|
|
|
|
app.post('/login', async (request, reply) => {
|
|
const input = credentialsSchema.parse(request.body);
|
|
const result = await pool.query<UserRow>(
|
|
`select id, email, display_name, role, password_hash, is_active from users where email = $1`,
|
|
[input.email],
|
|
);
|
|
const account = result.rows[0];
|
|
|
|
if (!account || !account.is_active || !(await verifyPassword(input.password, account.password_hash))) {
|
|
return reply.code(401).send({ error: 'Invalid email or password' });
|
|
}
|
|
|
|
const user = serializeUser(account);
|
|
const token = await reply.jwtSign(user, { expiresIn: '7d' });
|
|
return { token, user };
|
|
});
|
|
|
|
app.get('/me', { preHandler: app.authenticate }, async (request) => ({ user: request.user }));
|
|
};
|