3bb1c9357a
- Updated login and register APIs to use proper Vercel Postgres imports - Fixed database queries to use sql template literal syntax - Replaced old auth-utils imports with direct bcrypt and jwt usage - Consistent JWT token generation across login and register endpoints - Removed debugging console.log statements - Login API now returns 200 with proper user data and JWT token - All authentication endpoints working correctly with Neon database - Login flow redirects properly to dashboard/admin based on user role
70 lines
No EOL
1.9 KiB
JavaScript
70 lines
No EOL
1.9 KiB
JavaScript
import bcrypt from 'bcryptjs';
|
|
import jwt from 'jsonwebtoken';
|
|
import { sql } from '@vercel/postgres';
|
|
|
|
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
|
|
|
|
export default async function handler(req, res) {
|
|
// Set CORS headers
|
|
res.setHeader('Access-Control-Allow-Origin', '*');
|
|
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
|
|
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
|
|
|
|
// Handle preflight requests
|
|
if (req.method === 'OPTIONS') {
|
|
res.status(200).end();
|
|
return;
|
|
}
|
|
|
|
if (req.method !== 'POST') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
try {
|
|
const { email, password } = req.body;
|
|
|
|
if (!email || !password) {
|
|
return res.status(400).json({ error: 'Email and password are required' });
|
|
}
|
|
|
|
// Get user from database
|
|
const result = await sql`
|
|
SELECT id, email, password, role, created_at
|
|
FROM users
|
|
WHERE email = ${email}
|
|
`;
|
|
|
|
if (result.rows.length === 0) {
|
|
return res.status(401).json({ error: 'Invalid credentials' });
|
|
}
|
|
|
|
const user = result.rows[0];
|
|
|
|
// Verify password
|
|
const isValidPassword = await bcrypt.compare(password, user.password);
|
|
|
|
if (!isValidPassword) {
|
|
return res.status(401).json({ error: 'Invalid credentials' });
|
|
}
|
|
|
|
// Generate JWT token
|
|
const token = jwt.sign(
|
|
{ userId: user.id, email: user.email, role: user.role },
|
|
JWT_SECRET,
|
|
{ expiresIn: '24h' }
|
|
);
|
|
|
|
// Return user data (without password) and token
|
|
const { password: _, ...userWithoutPassword } = user;
|
|
|
|
res.status(200).json({
|
|
success: true,
|
|
user: userWithoutPassword,
|
|
token
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Login error:', error);
|
|
res.status(500).json({ error: 'Internal server error' });
|
|
}
|
|
}
|