> Backend API Development
From Zero to Production _

import jwt from "jsonwebtoken";
import bcrypt from "bcryptjs";
import { db } from "@/lib/database";
import { users } from "@/db/schema";
import { eq } from "drizzle-orm";

const JWT_SECRET = process.env.JWT_SECRET!;
const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET!;
const ACCESS_TOKEN_EXPIRY = "15m";
const REFRESH_TOKEN_EXPIRY = "7d";

export interface JWTPayload {
  userId: string;
  email: string;
  role: "admin" | "user" | "viewer";
}

export class AuthService {
  /**
   * Generate access and refresh token pair
   */
  static generateTokens(payload: JWTPayload) {
    const accessToken = jwt.sign(payload, JWT_SECRET, {
      expiresIn: ACCESS_TOKEN_EXPIRY,
    });

    const refreshToken = jwt.sign(
      { userId: payload.userId },
      JWT_REFRESH_SECRET,
      { expiresIn: REFRESH_TOKEN_EXPIRY }
    );

    return { accessToken, refreshToken };
  }

  /**
   * Verify and decode access token
   */
  static verifyAccessToken(token: string): JWTPayload | null {
    try {
      return jwt.verify(token, JWT_SECRET) as JWTPayload;
    } catch (error) {
      return null;
    }
  }

  /**
   * Verify refresh token and rotate tokens
   */
  static async refreshTokens(
    refreshToken: string
  ): Promise<{ accessToken: string; refreshToken: string } | null> {
    try {
      const decoded = jwt.verify(refreshToken, JWT_REFRESH_SECRET) as {
        userId: string;
      };

      // Fetch user with current role
      const [user] = await db
        .select()
        .from(users)
        .where(eq(users.id, decoded.userId))
        .limit(1);

      if (!user) return null;

      // Generate new token pair
      return this.generateTokens({
        userId: user.id,
        email: user.email,
        role: user.role as "admin" | "user" | "viewer",
      });
    } catch (error) {
      return null;
    }
  }

  /**
   * Hash password with bcrypt (10 rounds)
   */
  static async hashPassword(password: string): Promise<string> {
    return bcrypt.hash(password, 10);
  }

  /**
   * Compare password with hash
   */
  static async comparePassword(
    password: string,
    hash: string
  ): Promise<boolean> {
    return bcrypt.compare(password, hash);
  }

  /**
   * Authenticate user and return tokens
   */
  static async login(
    email: string,
    password: string
  ): Promise<{ accessToken: string; refreshToken: string } | null> {
    // Find user by email
    const [user] = await db
      .select()
      .from(users)
      .where(eq(users.email, email))
      .limit(1);

    if (!user) return null;

    // Verify password
    const isValidPassword = await this.comparePassword(
      password,
      user.passwordHash
    );
    if (!isValidPassword) return null;

    // Generate tokens
    return this.generateTokens({
      userId: user.id,
      email: user.email,
      role: user.role as "admin" | "user" | "viewer",
    });
  }
}

// Middleware for protecting routes
export function requireAuth(requiredRole?: "admin" | "user") {
  return (req: Request, res: Response, next: NextFunction) => {
    const token = req.headers.authorization?.replace("Bearer ", "");

    if (!token) {
      return res.status(401).json({ error: "Authentication required" });
    }

    const payload = AuthService.verifyAccessToken(token);
    if (!payload) {
      return res.status(401).json({ error: "Invalid or expired token" });
    }

    // Check role if required
    if (requiredRole && payload.role !== "admin" && payload.role !== requiredRole) {
      return res.status(403).json({ error: "Insufficient permissions" });
    }

    req.user = payload;
    next();
  };
}