1st push

pages/api/login.js

@@ -0,0 +1,38 @@
+import { createTokens, hashPassword, verifyPassword } from "../../utils/auth"
+
+export default async function handler(req, res) {
+  if (req.method !== "POST") {
+    return res.status(405).json({ message: "Method Not Allowed" })
+  }
+
+  const { email, password } = req.body
+  console.log(password)
+
+  // You'd need to fetch user details from your database or any data source
+  //fetch data from postgres database where we store password as hash
+
+  // Here, for demonstration, let's assume a hardcoded user
+  const user = {
+    id: 1,
+    email: "user@example.com",
+    passwordHash: "$2a$10$Zy/TYg6WwOOctCQ6e/KOXebvH3AliSDjdopPxrIUWELVJBf/KE.iq", // hashed password: "password123"
+  }
+
+  const isValid = await verifyPassword(password, user.passwordHash)
+
+  if (!isValid) {
+    return res.status(401).json({ message: "Invalid credentials" })
+  }
+
+  const token = await createTokens(user.id)
+
+  res.setHeader("Set-Cookie", [
+    `token=${token.accessToken};  Path=/; HttpOnly`,
+    `rtoken=${token.refreshToken}; Path=/; HttpOnly`,
+  ])
+
+  return res.status(200).json({ token })
+}
+
+//user@example.com
+//password123

pages/api/logout.js

@@ -0,0 +1,7 @@
+export default async function handler(req, res) {
+  // if (req.method === 'POST') {
+  //     cookies().delete('token');
+  //   } else {
+  //     throw new NotFoundError();
+  //   }
+}

pages/api/refreshtoken.js

@@ -0,0 +1,35 @@
+import { issueAccessToken, verifyRefreshToken } from "../../utils/auth"
+
+// Example middleware to attach access token to outgoing requests
+async function attachAccessToken(req, res, next) {
+  const accessToken = req.cookies.accessToken
+  if (!accessToken) {
+    return res.status(401).json({ message: "Access token missing" })
+  }
+
+  // You might want to check token expiration here and refresh if necessary
+
+  req.headers.Authorization = `Bearer ${accessToken}`
+  next()
+}
+
+export default async function handler(req, res) {
+  if (req.method !== "POST") {
+    return res.status(405).json({ message: "Method Not Allowed" })
+  }
+
+  const { refreshToken } = req.body
+
+  try {
+    const decoded = await verifyRefreshToken(refreshToken.value)
+    // Check if refresh token is valid, then issue a new access token
+    const accessToken = await issueAccessToken(decoded.userId)
+    console.log("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+    res.setHeader("Set-Cookie", [`token=${accessToken};  Path=/; HttpOnly`])
+
+    return res.status(200).json({ accessToken })
+  } catch (error) {
+    console.error("Error refreshing token:", error)
+    return res.status(401).json({ message: "Invalid refresh token" })
+  }
+}