Sessions & Cookies

// npm install express-session
const session = require("express-session");

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === "production", // HTTPS only in prod
    httpOnly: true, // JS access nahi kar sakta
    maxAge: 24 * 60 * 60 * 1000, // 1 day in ms
    sameSite: "strict"
  }
}));

// Login — session set karo
app.post("/login", async (req, res) => {
  const user = await User.findOne({ email: req.body.email });
  const match = await bcrypt.compare(req.body.password, user.password);
  
  if (!match) return res.status(401).json({ error: "Invalid" });
  
  req.session.userId = user._id;
  req.session.role = user.role;
  
  res.json({ message: "Logged in!" });
});

// Logout
app.post("/logout", (req, res) => {
  req.session.destroy(err => {
    if (err) return res.status(500).json({ error: "Logout failed" });
    res.clearCookie("connect.sid");
    res.json({ message: "Logged out!" });
  });
});

// Protected route
function isAuthenticated(req, res, next) {
  if (req.session.userId) return next();
  res.status(401).json({ error: "Please login" });
}