(Auth): added patient authentication JWT: access and refresh token

Author: linasliyakath

api-gateway/package.json

@@ -14,12 +14,20 @@
   "license": "ISC",
   "packageManager": "pnpm@10.28.2",
   "dependencies": {
+    "bcrypt": "^6.0.0",
+    "cors": "^2.8.6",
     "express": "^5.2.1",
-    "http-proxy-middleware": "^3.0.5"
+    "http-proxy-middleware": "^3.0.5",
+    "jsonwebtoken": "^9.0.3",
+    "pg": "^8.18.0"
   },
   "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
+    "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.1.0",
+    "@types/pg": "^8.16.0",
     "dotenv": "^17.2.3",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"

api-gateway/src/app.ts

@@ -1,27 +1,22 @@
 import express from 'express';
-import healthRouter from './routes/health';
-import { patientProxy } from './proxy/patient.proxy';
+import cors from 'cors';
+import healthRoutes from './routes/health';
+import { patientAuthProxy } from './proxy/patient.auth.proxy';
+import { patientDataProxy } from './proxy/patient.data.proxy';
+import { authenticate } from './middlewares/auth.middleware';
+import { requirePatientSelf } from './middlewares/patient.guard';
 
 const app = express();
 
-// Debug middleware
-app.use((req, res, next) => {
-  console.log(' GATEWAY REQUEST:', req.method, req.originalUrl);
-  next();
-});
+app.use(cors());
 
-app.use('/health', healthRouter);
-app.use('/patients', patientProxy);
+// health
+app.use('/health', healthRoutes);
 
-// ✅ FIXED catch-all route
-app.use((req, res) => {
-  console.log(' NO ROUTE MATCHED:', req.method, req.originalUrl);
-  res.status(404).json({
-    error: 'Route not found in gateway',
-    method: req.method,
-    url: req.originalUrl,
-    timestamp: new Date().toISOString(),
-  });
-});
+// 🔓 PUBLIC auth (NO JWT)
+app.use('/patients/public', patientAuthProxy);
+
+// 🔐 PROTECTED patient data
+app.use('/patients', authenticate, requirePatientSelf, patientDataProxy);
 
 export default app;

api-gateway/src/middlewares/auth.middleware.ts

@@ -0,0 +1,45 @@
+import { Request, Response, NextFunction } from 'express';
+import jwt from 'jsonwebtoken';
+import { error } from 'node:console';
+
+export interface AuthenticatedRequest extends Request {
+  user?: {
+    sub: string;
+    role: string;
+    type: 'PATIENT' | 'STAFF';
+  };
+}
+
+export function authenticate(
+  req: AuthenticatedRequest,
+  res: Response,
+  next: NextFunction
+) {
+  const authHeader = req.headers.authorization;
+
+  console.log('AUTH HEADER:', authHeader);
+
+  if (!authHeader?.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  console.log('TOKEN LENGTH:', token.length);
+  console.log('TOKEN PREVIEW:', token.slice(0, 20));
+
+  try {
+    const payload = jwt.verify(
+      token,
+      process.env.JWT_SECRET!
+    ) as AuthenticatedRequest['user'];
+
+    console.log('JWT PAYLOAD:', payload);
+
+    req.user = payload;
+    next();
+  } catch (err: any) {
+    console.error('JWT VERIFY ERROR:', err.name, err.message);
+    return res.status(401).json({ error: 'Invalid token' });
+  }
+}

api-gateway/src/middlewares/patient.guard.ts

@@ -0,0 +1,25 @@
+import { Response, NextFunction } from 'express';
+import { AuthenticatedRequest } from './auth.middleware';
+
+export function requirePatientSelf(
+  req: AuthenticatedRequest,
+  res: Response,
+  next: NextFunction
+) {
+  if (!req.user || req.user.type !== 'PATIENT') {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  // URL will be /:id after /patients is stripped
+  const patientIdFromPath = req.path.split('/')[1];
+
+  if (!patientIdFromPath) {
+    return res.status(400).json({ error: 'Invalid patient path' });
+  }
+
+  if (req.user.sub !== patientIdFromPath) {
+    return res.status(403).json({ error: 'Access denied' });
+  }
+
+  next();
+}

api-gateway/src/proxy/patient.auth.proxy.ts

@@ -0,0 +1,11 @@
+import { createProxyMiddleware } from 'http-proxy-middleware';
+
+export const patientAuthProxy = createProxyMiddleware({
+  target: 'http://localhost:3001',
+  changeOrigin: true,
+
+  // /patients/public/auth/login → /auth/login
+  pathRewrite: {
+    '^/patients/public': '',
+  },
+});

api-gateway/src/proxy/patient.data.proxy.ts

@@ -0,0 +1,9 @@
+import { createProxyMiddleware } from 'http-proxy-middleware';
+
+export const patientDataProxy = createProxyMiddleware({
+  target: 'http://localhost:3001',
+  changeOrigin: true,
+
+  // /patients/:id → /patients/:id (re-add prefix)
+  pathRewrite: (path) => `/patients${path}`,
+});

api-gateway/src/proxy/patient.proxy.ts

@@ -2,7 +2,14 @@ import 'dotenv/config';
 import app from './app.js';
 import logger from './logger.js';
 
-const PORT = process.env.PORT;
+const PORT = process.env.PORT || 3000;
+
 app.listen(PORT, () => {
-  logger.info(`API Gateway running on PORT ${PORT}`);
+  logger.info(`🚀 API Gateway running on port ${PORT}`);
+});
+
+// Graceful shutdown
+process.on('SIGTERM', async () => {
+  logger.info('SIGTERM received, shutting down gracefully');
+  process.exit(0);
 });