feat: add password login

server/src/api/routes/auth.js

@@ -0,0 +1,46 @@
+import { Router } from 'express'
+import passport from 'passport'
+import LocalStrategy from 'passport-local'
+import bcrypt from 'bcrypt'
+
+import User from '../../models/user.js'
+import { genUserJWT } from '../../utils/auth.js'
+
+passport.use(
+  new LocalStrategy(async function verify(username, password, done) {
+    try {
+      const user = await User.findOne({ username })
+      if (!user) {
+        return done(null, false, { message: 'Incorrect username.' })
+      }
+
+      const isPasswordValid = await bcrypt.compare(
+        password,
+        user.hashedPassword
+      )
+      if (!isPasswordValid) {
+        return done(null, false, { message: 'Incorrect username or password.' })
+      }
+      return done(null, user)
+    } catch (err) {
+      return done(err)
+    }
+  })
+)
+
+const router = Router()
+
+async function issueToken(req, res) {
+  const token = await genUserJWT(req.user)
+  res.json({
+    token,
+  })
+}
+
+router.post(
+  '/login/password',
+  passport.authenticate('local', { session: false }),
+  issueToken
+)
+
+export default router

server/src/api/routes/index.js

@@ -3,6 +3,7 @@ import sessions from './sessions.js'
 import quests from './quests.js'
 import commands from './commands.js'
 import { authMiddleware } from '../../middleware/auth.js'
+import authRouter from './auth.js'
 
 const router = Router()
 
@@ -10,6 +11,7 @@ router.get('/', (req, res) => {
   res.send('Hello API!')
 })
 
+router.use(authRouter)
 router.use('/sessions', authMiddleware, sessions)
 router.use('/quests', quests)
 router.use('/commands', commands)