feat: Implement OTP email verification and unverified user restrictions

- Added OTP generation and email sending service (using Resend)
- Implemented `/send-otp` and `/verify-otp` backend endpoints
- Added [OtpVerification](cci:1://file:///e:/Majors/urBackend/frontend/src/pages/OtpVerification.jsx:7:0-175:1) frontend page with auto-send and skip functionality
- Updated Signup flow to redirect to OTP verification
- Updated Login to store verification status
- Added access restrictions for unverified users (Create Project, Create Collection, Storage)
- Updated Settings page to show verification status and "Verify Now" option
- Fixed module syntax in emailService and implemented token refresh on verification

Author: yash-pouranik

backend/app.js

@@ -1,8 +1,9 @@
-const express = require('express');
+const express = require('express')
+const mongoose = require('mongoose')
+const cors = require('cors')
+const dotenv = require('dotenv');
 const app = express();
-const mongoose = require('mongoose');
-const cors = require('cors');
-require('dotenv').config();
+dotenv.config();
 
 // Middleware
 app.use(cors());

backend/middleware/api_usage.js

@@ -1,7 +1,7 @@
 const rateLimit = require('express-rate-limit');
 const Log = require('../models/Log');
 
-// 1. Rate Limiter (Same as before)
+// Rate Limiter 
 const limiter = rateLimit({
     windowMs: 15 * 60 * 1000,
     max: 100,
@@ -10,17 +10,16 @@ const limiter = rateLimit({
     legacyHeaders: false,
 });
 
-// 2. Logger (UPDATED ✅)
+// Logger 
 const logger = (req, res, next) => {
     // Check for Data, Storage, AND UserAuth routes
     if (
         req.originalUrl.startsWith('/api/data') ||
         req.originalUrl.startsWith('/api/storage') ||
-        req.originalUrl.startsWith('/api/userAuth') // <--- Added this
+        req.originalUrl.startsWith('/api/userAuth')
     ) {
 
         res.on('finish', async () => {
-            // verifyApiKey middleware se 'req.project' set hona zaroori hai
             if (req.project) {
                 try {
                     await Log.create({

backend/middleware/authMiddleware.js

@@ -1,27 +1,36 @@
 const jwt = require('jsonwebtoken');
 
 module.exports = function (req, res, next) {
-    // 1. Poora header mangao
+    // Retrieve the Authorization header from the request
     const authHeader = req.header('Authorization');
 
-    // 2. Check karo header hai ya nahi
-    if (!authHeader) return res.status(401).send('Access Denied: No Token Provided');
+    // Check if the Authorization header exists
+    if (!authHeader) {
+        return res.status(401).send('Access Denied: No Token Provided');
+    }
 
-    // 3. "Bearer " ko hatakar asli token nikalo
-    // Hum space (' ') se split karte hain aur dusra hissa ([1]) uthate hain.
+    // Extract the actual token by removing the "Bearer " prefix
+    // We split the header value by space and take the second part
     const token = authHeader.split(' ')[1];
 
-    // Agar split karne ke baad token nahi mila (matlab format galat tha)
-    if (!token) return res.status(401).send('Access Denied: Malformed Token Format');
+    // If token is missing after splitting, the format is invalid
+    if (!token) {
+        return res.status(401).send('Access Denied: Malformed Token Format');
+    }
 
     try {
+        // Verify the token using the secret key
         const verified = jwt.verify(token, process.env.JWT_SECRET);
+
+        // Attach decoded token data to request object
         req.user = verified;
+
+        // Proceed to the next middleware or route handler
         next();
     } catch (err) {
-        console.log(err);
-        // Error message mein 'err' object bhejna security risk ho sakta hai production mein, 
-        // isliye sirf message bhejte hain.
+        console.error(err);
+
+        // Do not expose detailed error information in production
         res.status(400).send('Invalid Token');
     }
-};
+};

backend/middleware/verifyApiKey.js

@@ -4,14 +4,16 @@ module.exports = async (req, res, next) => {
     try {
         const apiKey = req.header('x-api-key');
 
-        if (!apiKey) return res.status(401).send('API key not found');
+        if (!apiKey) return res.status(401).json({ error: 'API key not found' });
 
-        const project = await Project.findOne({ apiKey });
-        if (!project) return res.status(401).send('Invalid API key');
+        const project = await Project.findOne({ apiKey })
+            .populate('owner', 'isVerified');
+        if (!project) return res.status(401).json({ error: 'Invalid API key' });
 
+        if (!project.owner.isVerified) return res.status(401).json({ error: 'Owner not verified', fix: 'Verify your account on https://urbackend.bitbros.in/dashboard' });
         req.project = project;
         next();
     } catch (err) {
-        res.status(500).send(err.message);
+        res.status(500).json({ error: err.message });
     }
 };

backend/middleware/verifyEmail.js

@@ -0,0 +1,5 @@
+module.exports = function (req, res, next) {
+    const { isVerified } = req.user;
+    if (!isVerified) return res.status(401).json({ error: "Email not verified" });
+    next();
+};

backend/models/Developer.js

@@ -9,6 +9,10 @@ const developerSchema = new mongoose.Schema({
     password: {
         type: String,
         required: true
+    },
+    isVerified: {
+        type: Boolean,
+        default: false
     }
 }, { timestamps: true });
 

backend/models/Log.js

@@ -8,8 +8,8 @@ const logSchema = new mongoose.Schema({
     ip: String,
     timestamp: { type: Date, default: Date.now }
 }, {
-    // ⚠️ IMPORTANT: Capped Collection
-    // Max size: 50MB (52428800 bytes) ya Max 50,000 logs. Jo pehle poora ho jaye.
+    // IMPORTANT: Capped Collection
+    // Max size: 50MB (52428800 bytes)
     capped: { size: 52428800, max: 50000 }
 });
 

backend/models/Project.js

@@ -33,11 +33,11 @@ const projectSchema = new mongoose.Schema({
     },
     collections: [collectionSchema],
 
-    // --- STORAGE LIMITS (Files) ---
+    // STORAGE LIMITS (Files)
     storageUsed: { type: Number, default: 0 }, // in bytes
     storageLimit: { type: Number, default: 100 * 1024 * 1024 }, // 100MB for Files
 
-    // --- NEW: DATABASE LIMITS (JSON Docs) ---
+    // DATABASE LIMITS (JSON Docs)
     databaseUsed: { type: Number, default: 0 }, // in bytes
     databaseLimit: { type: Number, default: 50 * 1024 * 1024 } // 50MB for Data (approx 50,000 large docs)
 

backend/models/otp.js

@@ -0,0 +1,9 @@
+const mongoose = require('mongoose');
+
+const otpSchema = new mongoose.Schema({
+    userId: { type: mongoose.Schema.Types.ObjectId, required: true, ref: 'User' },
+    otp: { type: String, required: true },
+    createdAt: { type: Date, default: Date.now, expires: '10m' } // MongoDB TTL index
+});
+
+module.exports = mongoose.model('Otp', otpSchema);