feat: add password login

server/src/api/routes/auth.js

@@ -0,0 +1,46 @@
+import { Router } from 'express'
+import passport from 'passport'
+import LocalStrategy from 'passport-local'
+import bcrypt from 'bcrypt'
+
+import User from '../../models/user.js'
+import { genUserJWT } from '../../utils/auth.js'
+
+passport.use(
+  new LocalStrategy(async function verify(username, password, done) {
+    try {
+      const user = await User.findOne({ username })
+      if (!user) {
+        return done(null, false, { message: 'Incorrect username.' })
+      }
+
+      const isPasswordValid = await bcrypt.compare(
+        password,
+        user.hashedPassword
+      )
+      if (!isPasswordValid) {
+        return done(null, false, { message: 'Incorrect username or password.' })
+      }
+      return done(null, user)
+    } catch (err) {
+      return done(err)
+    }
+  })
+)
+
+const router = Router()
+
+async function issueToken(req, res) {
+  const token = await genUserJWT(req.user)
+  res.json({
+    token,
+  })
+}
+
+router.post(
+  '/login/password',
+  passport.authenticate('local', { session: false }),
+  issueToken
+)
+
+export default router

server/src/api/routes/index.js

@@ -3,6 +3,7 @@ import sessions from './sessions.js'
 import quests from './quests.js'
 import commands from './commands.js'
 import { authMiddleware } from '../../middleware/auth.js'
+import authRouter from './auth.js'
 
 const router = Router()
 
@@ -10,6 +11,7 @@ router.get('/', (req, res) => {
   res.send('Hello API!')
 })
 
+router.use(authRouter)
 router.use('/sessions', authMiddleware, sessions)
 router.use('/quests', quests)
 router.use('/commands', commands)

server/src/index.js

@@ -11,12 +11,16 @@ import loadAndUpdateQuests from './utils/quest.js'
 import config from './config.js'
 import errorHandler from './middleware/error.js'
 import expiryRemovalScheduler from './containers/expiryChecker.js'
+import { createTestUser } from './utils/auth.js'
 
 async function main() {
   const app = express()
   const server = http.createServer(app)
   socketServer(server)
   await connectDB()
+
+  await createTestUser()
+
   await loadAndUpdateQuests()
   expiryRemovalScheduler()
 

server/src/models/user.js

@@ -1,9 +1,17 @@
 import { model } from 'mongoose'
 
 const User = model('User', {
-  username: String,
-  password: String,
-  email: String,
+  username: {
+    type: String,
+    unique: true,
+    required: true,
+  },
+  email: {
+    type: String,
+    unique: true,
+    required: true,
+  },
+  hashedPassword: String,
 })
 
 export default User

server/src/utils/auth.js

@@ -1,7 +1,20 @@
 import jwt from 'jsonwebtoken'
+import bcrypt from 'bcrypt'
 import config from '../config.js'
 import User from '../models/user.js'
 
+export async function createTestUser() {
+  let user = await User.findOne({ username: 'testUser' })
+  if (!user) {
+    user = new User({
+      username: 'testUser',
+      email: 'test@example.com',
+    })
+    user.hashedPassword = await bcrypt.hash('testPassword', 10)
+    await user.save()
+  }
+}
+
 export async function defaultUser() {
   let user = await User.findOne({ username: 'defaultUser' })
   if (!user) {
@@ -14,6 +27,23 @@ export async function defaultUser() {
   return user
 }
 
+export function genUserJWT(user) {
+  return new Promise((resolve, reject) => {
+    jwt.sign(
+      { _id: user.id, username: user.username, email: user.email },
+      config.jwtSecret,
+      { expiresIn: config.expiry },
+      (err, token) => {
+        if (err) {
+          reject(err)
+        } else {
+          resolve(token)
+        }
+      }
+    )
+  })
+}
+
 export function genSessionJWT(session) {
   return new Promise((resolve, reject) => {
     jwt.sign(