Authentication

POST /api/auth/register   { "email": "ada@example.com", "password": "…", "name": "Ada" }
POST /api/auth/login      { "identifier": "ada@example.com", "password": "…" }
→ { "success": true, "data": { "token": "eyJ…", "expiresIn": 900, "user": { … } } }

const userSchema = new mongoose.Schema({
  // Identifiers — whichever you list in `identifiers`
  email: { type: String, unique: true, sparse: true },
  phone: { type: String, unique: true, sparse: true },

  password: { type: String, select: false },
  role: { type: String, default: 'user' },
  passwordChangedAt: Date,

  // Social sign-in — only the providers you enable
  googleId: String, appleId: String, facebookId: String, githubId: String,

  // Password-reset codes
  otpHash:      { type: String, select: false },
  otpPurpose:   { type: String, select: false },
  otpExpiresAt: { type: Date,   select: false },
  otpAttempts:  { type: Number, default: 0, select: false },

  // Lockout
  failedLoginAttempts: { type: Number, default: 0, select: false },
  lockedUntil:         { type: Date,   select: false },

  // Only with refresh tokens enabled
  refreshTokens: {
    type: [{ id: String, hash: String, previousHash: String, rotatedAt: Date,
             createdAt: Date, lastUsedAt: Date, expiresAt: Date, userAgent: String }],
    select: false,
  },
}, { timestamps: true });

POST /api/auth/login           → { "token": "…", "refreshToken": "…", "refreshExpiresIn": 2592000, … }
POST /api/auth/token/refresh   { "refreshToken": "…" }   → new token (and a new refreshToken when rotating)
POST /api/auth/logout          { "refreshToken": "…" }   → ends this session
POST /api/auth/logout/all      Authorization: Bearer …   → ends every session

let access = null;
let refreshing = null;

async function refresh() {
  refreshing ??= fetch('/api/auth/token/refresh', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ refreshToken: localStorage.getItem('refreshToken') }),
  })
    .then(async (res) => {
      if (!res.ok) throw new Error('signed out');
      const { data } = await res.json();
      access = data.token;
      localStorage.setItem('refreshToken', data.refreshToken);   // new one when rotating
    })
    .finally(() => { refreshing = null; });
  return refreshing;
}

export async function api(path, init = {}) {
  const send = () => fetch(path, { ...init, headers: { ...init.headers, Authorization: `Bearer ${access}` } });
  let res = await send();
  if (res.status === 401) {
    await refresh();          // throws → send the user to sign-in
    res = await send();
  }
  return res;
}

createAuthRouter({
  // …
  social: {
    google:   { clientId: process.env.GOOGLE_CLIENT_ID },
    apple:    { clientId: process.env.APPLE_CLIENT_ID },
    facebook: { appId: process.env.FB_APP_ID, appSecret: process.env.FB_APP_SECRET },
    github:   { clientId: process.env.GH_ID, clientSecret: process.env.GH_SECRET },
  },
});

social: {
  discord: {
    idField: 'discordId',
    verify: async ({ accessToken }) => {
      const profile = await fetchDiscordUser(accessToken);
      return { id: profile.id, email: profile.verified ? profile.email : null };
    },
  },
}

POST /auth/login  { "identifier": "Ada@Example.com",   "password": "…" }
POST /auth/login  { "identifier": "+1 (555) 010-1234", "password": "…" }   # same account as
POST /auth/login  { "identifier": "+15550101234",      "password": "…" }

const auth = createAuthRouter({
  model: User,
  token: { secret: process.env.JWT_SECRET },

  routes: {
    register: '/signup',        // rename
    login: '/signin',
    social: false,              // don't mount
    modifyRoles: false,
  },

  middlewares: {
    all: [cors()],              // every auth route
    login: [rateLimiter],       // just these
    forgotPassword: [rateLimiter],
  },
});

import rateLimit from 'express-rate-limit';

const tight = rateLimit({ windowMs: 15 * 60 * 1000, limit: 20 });

createAuthRouter({
  // …
  middlewares: { login: [tight], register: [tight], forgotPassword: [tight], resetPassword: [tight] },
});

import nodemailer from 'nodemailer';
import { createAuthRouter } from 'express-controller-sets';

const transporter = nodemailer.createTransport(process.env.SMTP_URL);

export const auth = createAuthRouter({
  model: User,
  identifiers: ['email'],
  token: { secret: process.env.JWT_SECRET, expiresIn: '15m' },
  refresh: { enabled: true, rotate: true, expiresIn: '30d' },
  roles: { list: ['user', 'admin'], default: 'user' },
  registerFields: ['name'],
  updateFields: ['name'],

  appName: 'Acme',
  mail: { transporter, from: 'Acme <no-reply@acme.com>' },

  onRegister: async (user) => {
    await transporter.sendMail({
      from: 'Acme <no-reply@acme.com>', to: user.email,
      subject: 'Welcome to Acme', text: `Hi ${user.name ?? 'there'}, thanks for signing up.`,
    });
  },
});

app.use('/api/auth', auth);