feat: added jwt verify middleware

Author: shanuvr

backend/src/entities/User.ts

@@ -32,7 +32,10 @@ export class User {
   profileImageUrl?: string;
 
   @Column({ nullable: true })
-  password?: string;
+  passwordHash?: string;
+
+  @Column({ default: false })
+  isPhoneVerified!: boolean;
 
   @CreateDateColumn()
   createdAt!: Date;

backend/src/middleware/auth.middleware.ts

@@ -0,0 +1,33 @@
+import { Request, Response, NextFunction } from 'express';
+import jwt from 'jsonwebtoken';
+
+interface AuthRequest extends Request {
+  user?: {
+    id: string;
+  };
+}
+
+export const requireAuth = (
+  req: AuthRequest,
+  res: Response,
+  next: NextFunction,
+) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return res.status(401).json({ message: 'Unauthorized' });
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  try {
+    const decoded = jwt.verify(token, process.env.ACCESS_TOKEN_SECRET!) as {
+      userId: string;
+    };
+
+    req.user = { id: decoded.userId };
+    next();
+  } catch (err) {
+    return res.status(401).json({ message: 'Invalid or expired token',error:err });
+  }
+};

backend/src/modules/auth/auth.controller.ts

@@ -1,13 +1,14 @@
 import { Request, Response, NextFunction } from 'express';
 import { logger } from '../../utils/logger';
-import { registerSchema, phoneSchema } from './auth.schema';
+import { registerSchema, phoneSchema, loginSchema } from './auth.schema';
 import { sendOtpSms } from '../../Services/sms.service';
 import { generateotp } from '../../utils/otp';
 import { appDataSouce } from '../../data-source';
 import { Otp } from '../../entities/opt';
 import { User } from '../../entities/User';
 import { signAccessToken } from '../../Services/jwt.service';
 import { createRefreshTokenSession } from '../../Services/authToken';
+import bcrypt from 'bcrypt';
 
 export const sendOtp = async (
   req: Request,
@@ -16,26 +17,54 @@ export const sendOtp = async (
 ) => {
   try {
     logger.info('reached');
+
     const result = phoneSchema.safeParse(req.body);
     if (!result.success) {
-      return res
-        .status(400)
-        .json({ message: 'validation vailed', error: result.error?.format() });
+      return res.status(400).json({
+        message: 'validation failed',
+        error: result.error.format(),
+      });
+    }
+
+    const phoneNumber = result.data.phoneNumber;
+
+    const userRepo = appDataSouce.getRepository(User);
+    const otpRepo = appDataSouce.getRepository(Otp);
+
+    const existingUser = await userRepo.findOne({
+      where: { phoneNumber },
+    });
+
+    if (
+      existingUser &&
+      existingUser.isPhoneVerified === true &&
+      existingUser.passwordHash
+    ) {
+      return res.status(409).json({
+        success: false,
+        next: 'login',
+        message: 'Account already exists. Please login with password.',
+      });
     }
-    const otpRep = appDataSouce.getRepository(Otp);
-    const otpcode = generateotp();
-    logger.debug({ otpcode }, 'otp is');
-    const phoneNumber = result.data?.phoneNumber;
-    await sendOtpSms(phoneNumber, otpcode.toString());
-    await otpRep.delete({ phoneNumber });
-    await otpRep.save({
+
+    const otpCode = generateotp();
+    logger.debug({ otpCode }, 'otp is');
+
+    await sendOtpSms(phoneNumber, otpCode.toString());
+
+    await otpRepo.delete({ phoneNumber });
+    await otpRepo.save({
       phoneNumber,
-      otp: otpcode.toString(),
+      otp: otpCode.toString(),
       expiresAt: new Date(Date.now() + 5 * 60 * 1000),
     });
-    res.status(200).json({ message: 'otp sent success fully ', success: true });
+
+    return res.status(200).json({
+      success: true,
+      message: 'OTP sent successfully',
+    });
   } catch (err) {
-    logger.error('error in register');
+    logger.error({ err }, 'error in sendOtp');
     next(err);
   }
 };
@@ -54,9 +83,7 @@ export const verifyotp = async (
         .status(400)
         .json({ message: ' otp and phoneNumber are required' });
     }
-
     const otpRepo = appDataSouce.getRepository(Otp);
-    const userRepo = appDataSouce.getRepository(User);
     const otpRecord = await otpRepo.findOne({
       where: {
         phoneNumber,
@@ -79,26 +106,7 @@ export const verifyotp = async (
       return res.status(400).json({ message: 'Invalid OTP' });
     }
     otpRecord.verified = true;
-    const existingUser = await userRepo.findOne({
-      where: { phoneNumber },
-    });
     await otpRepo.save(otpRecord);
-    console.log('ACCESS_TOKEN_SECRET:', process.env.ACCESS_TOKEN_SECRET);
-
-    if (existingUser) {
-      const accessToken = signAccessToken({
-        userId: existingUser.id,
-      });
-
-      const refreshToken = await createRefreshTokenSession(existingUser);
-
-      return res.status(200).json({
-        success: true,
-        userExists: true,
-        accessToken,
-        refreshToken,
-      });
-    }
 
     return res.status(200).json({
       success: true,
@@ -121,26 +129,42 @@ export const register = async (
     const result = registerSchema.safeParse(req.body);
     if (!result.success) {
       return res.status(400).json({
-        message: 'invalid registation data',
+        message: 'invalid registration data',
         errors: result.error.format(),
       });
     }
-    const { otpId, name, age, gender, interests, email } = result.data;
+
+    const {
+      otpId,
+      name,
+      age,
+      gender,
+      interests,
+      email,
+      password,
+      confirmPassword,
+    } = result.data;
+
     if (!otpId) {
-      return res.status(400).json({ message: 'otpid requuired' });
+      return res.status(400).json({ message: 'otpId required' });
+    }
+
+    if (password !== confirmPassword) {
+      return res.status(400).json({
+        message: 'Passwords do not match',
+      });
     }
+
     const otpRepo = appDataSouce.getRepository(Otp);
     const userRepo = appDataSouce.getRepository(User);
 
     const otpRecord = await otpRepo.findOne({
       where: { id: otpId },
     });
-    if (!otpRecord) {
-      return res.status(400).json({ message: 'invalid registration ' });
-    }
-    if (!otpRecord.verified) {
+
+    if (!otpRecord || !otpRecord.verified) {
       return res.status(400).json({
-        message: 'OTP not verified',
+        message: 'OTP not verified or invalid',
       });
     }
 
@@ -150,10 +174,13 @@ export const register = async (
       where: { phoneNumber },
     });
 
-    if (existingUser) {
-      return res.status(409).json({ message: 'User already exists' });
+    if (existingUser && existingUser.passwordHash) {
+      return res.status(409).json({
+        message: 'User already exists',
+      });
     }
-    // const hashedPassword = await bcrypt.hash(password,10)
+
+    const passwordHash = await bcrypt.hash(password, 10);
 
     const user = userRepo.create({
       phoneNumber,
@@ -162,9 +189,12 @@ export const register = async (
       gender,
       interests,
       email,
+      passwordHash,
+      isPhoneVerified: true,
     });
 
     await userRepo.save(user);
+
     await otpRepo.delete({ id: otpId });
 
     const accessToken = signAccessToken({
@@ -184,3 +214,66 @@ export const register = async (
     next(err);
   }
 };
+
+export const login = async (
+  req: Request,
+  res: Response,
+  next: NextFunction,
+) => {
+  try {
+    const result = loginSchema.safeParse(req.body);
+    if (!result.success) {
+      return res.status(400).json({
+        message: 'Invalid login data',
+        errors: result.error.format(),
+      });
+    }
+
+    const { phoneNumber, password } = result.data;
+
+    const userRepo = appDataSouce.getRepository(User);
+
+    // 2️⃣ find user
+    const user = await userRepo.findOne({
+      where: { phoneNumber },
+    });
+
+    if (!user) {
+      return res.status(401).json({
+        message: 'Invalid phone number or password',
+      });
+    }
+
+    // 3️⃣ block incomplete registration
+    if (!user.passwordHash || !user.isPhoneVerified) {
+      return res.status(403).json({
+        message: 'Account not fully registered',
+      });
+    }
+
+    // 4️⃣ compare password
+    const isPasswordValid = await bcrypt.compare(password, user.passwordHash);
+
+    if (!isPasswordValid) {
+      return res.status(401).json({
+        message: 'Invalid phone number or password',
+      });
+    }
+
+    // 5️⃣ issue tokens
+    const accessToken = signAccessToken({
+      userId: user.id,
+    });
+
+    const refreshToken = await createRefreshTokenSession(user);
+
+    return res.status(200).json({
+      success: true,
+      accessToken,
+      refreshToken,
+    });
+  } catch (err) {
+    logger.error({ err }, 'error in login');
+    next(err);
+  }
+};

backend/src/modules/auth/auth.routes.ts

@@ -1,8 +1,9 @@
 import express from 'express';
-import { sendOtp, verifyotp, register } from './auth.controller';
+import { sendOtp, verifyotp, register, login } from './auth.controller';
 const authRouter = express.Router();
 authRouter.post('/send-otp', sendOtp);
 authRouter.post('/verify-otp', verifyotp);
 authRouter.post('/register', register);
+authRouter.post('/login', login);
 
 export default authRouter;

backend/src/modules/auth/auth.schema.ts

@@ -3,12 +3,33 @@ export const phoneSchema = z.object({
   phoneNumber: z.string().min(10, 'Invalid phone number'),
 });
 
-export const registerSchema = z.object({
-  otpId: z.string().uuid(),
-  name: z.string().min(1, 'name is required'),
-  age: z.number().int().positive().optional(),
-  gender: z.enum(['male', 'female', 'other']).optional(),
-  interests: z.array(z.string()).optional(),
-  email: z.string().email(),
-  // password: z.string().min(8, 'Password must be at least 8 characters').regex(/\d/, 'Password must contain at least one number'),
+export const registerSchema = z
+  .object({
+    otpId: z.string().uuid(),
+
+    name: z.string().min(1, 'Name is required'),
+
+    age: z.number().int().positive().optional(),
+
+    gender: z.enum(['male', 'female', 'other']).optional(),
+
+    interests: z.array(z.string()).optional(),
+
+    email: z.string().email('Invalid email address'),
+
+    password: z.string().min(8, 'Password must be at least 8 characters'),
+
+    confirmPassword: z
+      .string()
+      .min(8, 'Confirm password must be at least 8 characters'),
+  })
+  .refine((data) => data.password === data.confirmPassword, {
+    message: 'Passwords do not match',
+    path: ['confirmPassword'],
+  });
+
+export const loginSchema = z.object({
+  phoneNumber: z.string().min(10, 'Phone number is required'),
+
+  password: z.string().min(1, 'Password is required'),
 });

frontend/app/(auth)/login.tsx

@@ -0,0 +1,4 @@
+import LoginScreen from '@/screens/auth/loginScreen';
+export default function Login() {
+  return <LoginScreen />;
+}

frontend/lib/api.ts

@@ -1,6 +1,6 @@
 import axios from 'axios';
 const api = axios.create({
-  baseURL: 'http://10.222.145.137:4000',
+  baseURL: 'http://10.10.1.200:4000',
   timeout: 20000,
   headers: {
     'Content-Type': 'application/json',