Authentication and Authorization Using JWT

[mirasoldavila13]

User Story:

AS A user, I WANT TO log in securely using my email and password, SO THAT I can access my account and report issues.

Acceptance Criteria:

1. Users should log in using their email and password.
2. Upon successful login, a JWT token should be generated and returned to the user.
3. The JWT token should be used to access protected routes (e.g., reporting an issue, viewing user-specific data).
4. JWT tokens should be securely stored on the frontend (localStorage) and included in requests to protected routes.

Tasks:

• [x] User Login:
• Create a long endpoint (POST /api/auth/login) using JavaScript on the server side.
• Verify the user's email and hashed password using bcrypt.
• Upon successful login, generate a JWT token using the user's ID and necessary details.
• Return the JWT token to the frontend.
• [x] JWT Token Generation
• Use JWT (jsonwebtoken) to generate a token when the user successfully logs in.
• Ensure the token includes the user's ID and is signed with a secret key.
• Set an expiration time for the token to enhance security (e.g., 1 hour).
• [ ] JWT Middleware for Protecting Routes
• Create middleware in JavaScript to validate and decode the JWT token for protected routes.
• Add the middleware to all sensitive routes (e.g., reporting, editing, deleting issues).
• [x] Testing
• Test the login functionality using Postman or similar tools.
• Ensure that users cannot access protected routes without a valid JWT token.
• Test front-end login flow by storing the JWT token in localStorage and attaching it to requests.

[PandaKao]

Created authentication branch, moved issueRoutes into a new folder within routes called api so now routing for issues is /api/issue. Auth route for login is /auth/login.