login/signup function with no sessions

.env.example

@@ -1,4 +1,4 @@
 mongoURI='mongodb://localhost:27017/'
 database='nameOfDatabase'
 PORT=8000
-
+secret='123456789'

app.js

@@ -1,31 +1,47 @@
 const express = require('express');
 const path = require('path');
-const dotenv = require('dotenv');
-
-dotenv.config();
+const session = require("express-session");
+require('dotenv').config();
 
 const app = express();
-
 const port = process.env.PORT || 3000;
 
 app.set('view engine', 'ejs');
 app.set('views',path.join(__dirname, 'src/views'));
-
-
 app.use(express.urlencoded({ extended: true }));
-
-
-/*
-STATIC ROUTINGS
-*/
-
 app.use("/static", express.static("./src/public"));
 
+app.use(session({
+    secret: process.env.secret,
+    resave: true,
+    saveUninitialized: false,
+}));
+
+/*** Database ***/
+const { connectMongo, getCollection } = require("./src/database/connection");
+
+let users;
+async function initDatabase() {
+    const mongoURI = process.env.mongoURI || "mongodb://localhost:27017/";
+    const database = process.env.database || "knoldus"; // Database name
+    
+    const db = await connectMongo(mongoURI, database);
+    
+    // For any collection, init here
+    users = await getCollection(db, "users");
+}
+
+
+initDatabase().then(() => {
+    require("./src/auth/authentication")(app, users);
+});
+
 /*
 ROUTINGS
 */
 
 app.get('/', (req, res) => {
+    if (!req.session.errMessage) req.session.errMessage = "";
     res.render('index');
 });
 
@@ -34,11 +50,11 @@ app.get('/landing', (req, res) => {
 });
 
 app.get('/signup', (req, res) => {
-    res.render('signup');
+    res.render('signup', { errMessage: req.session.errMessage });
 });
 
 app.get('/login', (req, res) => {
-    res.render('login');
+    res.render('login', { errMessage: req.session.errMessage });
 });
 
 app.get('/home', (req, res) => {
@@ -69,17 +85,6 @@ app.get('/aboutUs', (req, res) => {
     res.render('aboutUs');
 });
 
-
-app.post('/signup', (req, res) => {
-    res.status(200);
-    res.send('200 status code');
-});
-
-app.post('/login', (req, res) => {
-    res.status(200);
-    res.send('200 status code');
-});
-
 app.get('/*splat', (req, res) => {
     res.status(404);
     res.send('404 Not Found');

package.json

@@ -18,9 +18,13 @@
   },
   "homepage": "https://github.com/JoaquinPar/2800-202510-BBY14#readme",
   "dependencies": {
+    "bcrypt": "^5.1.1",
     "dotenv": "^16.5.0",
     "ejs": "^3.1.10",
-    "express": "^5.1.0"
+    "express": "^5.1.0",
+    "express-session": "^1.18.1",
+    "joi": "^17.13.3",
+    "mongodb": "^6.16.0"
   },
   "devDependencies": {
     "nodemon": "^3.1.10"

src/auth/authentication.js

@@ -0,0 +1,82 @@
+const joi = require("joi");
+const bcrypt = require('bcrypt');
+const salt = 12;
+
+module.exports = (app, users) => {
+    app.post("/login", async (req, res) => {
+        const credentialSchema = joi.object({
+            email: joi.string().email().required(),
+            password: joi.string().max(20).required(),
+        });
+
+        const valid = credentialSchema.validate(req.body);
+
+        if (valid.err) {
+            req.session.errMessage = "Invalid input";
+            res.status(400);
+            return res.redirect("/login");
+        }
+
+        users.findOne({ "email": req.body.email }).then((user) => {
+            if (!user) {
+                req.session.errMessage = "User not found";
+                res.status(404);
+                return res.redirect("/login");                
+            }
+
+            if (!bcrypt.compare(req.body.password, user.password)) {
+                req.session.errMessage = "Incorrect password";
+                res.status(401);
+                return res.redirect("/login");
+            }
+
+            // ignorin sessions for now just have basic login for demo
+            // TODO: actually add sessions
+
+            req.session.errMessage = "";
+            res.redirect("/home");
+        });
+    });
+
+    app.post("/signup", async (req, res) => {
+        const userSchema = joi.object({
+            email: joi.string().email().required(),
+            // name: joi.string().alphanum().max(20).required(),
+            password: joi.string().max(20).min(8).required(),
+            repassword: joi.string().max(20).min(8).required(),
+        });
+
+        const valid = userSchema.validate(req.body);
+
+        if (valid.err) {
+            req.session.errMessage = "Invalid input",
+            res.status(400);
+            return res.redirect("/signup");
+        }
+
+        if (req.body.password != req.body.repassword) {
+            req.session.errMessage = "Passwords must match";
+            res.status(400);
+            return res.redirect("/signup");
+        }
+
+        let hashedPassword = await bcrypt.hash(req.body.password, salt);
+
+        users.insertOne({
+            email: req.body.email,
+            // name: req.body.name,
+            password: hashedPassword,
+        }).then((results, err) => {
+            if (err) {
+                res.status(500);
+                console.error(err);
+                return res.send("Internal server error");
+            }
+
+            // TODO: Add session handling here and auto redirect to home and be authenticated
+            req.session.errMessage = "Please login to view that resource";
+            res.status(200);
+            return res.redirect("/login");
+        });
+    });
+}

src/database/connection.js

@@ -0,0 +1,26 @@
+const MongoClient = require("mongodb").MongoClient;
+
+/**
+ * connectMongo returns a database connection to MongoDB
+ * @param {string} mongoURI 
+ * @param {string} databaseName 
+ */
+const connectMongo = async (mongoURI, databaseName) => {
+    const database = await MongoClient.connect(mongoURI, { connectTimeoutMS: 1000 });
+    const dbo = database.db(databaseName);
+    return dbo;
+}
+
+/**
+ * getCollection object to interact with MongoDB
+ * @param {MongoClient} dbo
+ * @param {string} collection 
+ */
+const getCollection = async (dbo, collection) => {
+    return await dbo.collection(collection);
+}
+
+module.exports = {
+    connectMongo: connectMongo,
+    getCollection: getCollection,
+}