chnages

chnages

backend/middleware/authMiddleware.js

@@ -0,0 +1,62 @@
+// ============================================================
+// authMiddleware.js — JWT + session validation
+// ============================================================
+// Every protected route runs this middleware first.
+// It checks two things:
+//   1. Is the JWT signature valid and not expired?
+//   2. Does this session (jti) still exist in the sessions table?
+//      → If "logout all devices" was called, all sessions are
+//        deleted, so even a valid JWT gets rejected here.
+// ============================================================
+
+const jwt  = require('jsonwebtoken');
+const pool = require('../db');
+
+async function authenticate(req, res, next) {
+  const token = req.cookies.token;
+
+  if (!token) {
+    return res.status(401).json({ message: 'Not authenticated. Please login.' });
+  }
+
+  try {
+    // Step 1: Verify JWT signature and expiry
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+
+    // Step 2: Check this session still exists in the DB
+    // This is what makes "logout all devices" work —
+    // deleting sessions from DB invalidates all existing tokens
+    const session = await pool.query(
+      'SELECT id FROM sessions WHERE jti = $1',
+      [decoded.jti]
+    );
+
+    if (session.rows.length === 0) {
+      return res.status(401).json({ message: 'Session expired or signed out. Please login again.' });
+    }
+
+    // Step 3: Update last_used_at to track device activity
+    await pool.query(
+      'UPDATE sessions SET last_used_at = NOW() WHERE jti = $1',
+      [decoded.jti]
+    );
+
+    req.user    = decoded;      // { id, username, role, jti }
+    req.userJti = decoded.jti;  // shortcut for logout
+    next();
+
+  } catch (err) {
+    return res.status(401).json({ message: 'Session expired. Please login again.' });
+  }
+}
+
+// Middleware: Check if the user has admin role
+// Must be used AFTER 'authenticate'
+function requireAdmin(req, res, next) {
+  if (req.user.role !== 'admin') {
+    return res.status(403).json({ message: 'Admin access required.' });
+  }
+  next();
+}
+
+module.exports = { authenticate, requireAdmin };