JWT Authentication — Hotel Login System

Let's put it all together — a complete auth flow from registration to ordering biryani.

// controllers/auth.controller.js — Complete Auth Controller
import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import User from '../models/User.js';

const JWT_SECRET = process.env.JWT_SECRET;

// POST /api/auth/register
export const register = async (req, res) => {
  try {
    const { name, email, password } = req.body;

    // Check if user exists
    const existingUser = await User.findOne({ email });
    if (existingUser) {
      return res.status(400).json({ message: 'User already exists! Yeh email already registered hai' });
    }

    // Hash password
    const salt = await bcrypt.genSalt(12);
    const hashedPassword = await bcrypt.hash(password, salt);

    // Create user
    const user = await User.create({
      name,
      email,
      password: hashedPassword
    });

    // Generate JWT
    const token = jwt.sign(
      { id: user._id, email: user.email, role: user.role },
      JWT_SECRET,
      { expiresIn: '7d' }
    );

    res.status(201).json({
      message: 'Registration successful! Swagat hai bhai! 🎉',
      token,
      user: { id: user._id, name: user.name, email: user.email }
    });
  } catch (error) {
    res.status(500).json({ message: 'Server error: ' + error.message });
  }
};

// POST /api/auth/login
export const login = async (req, res) => {
  try {
    const { email, password } = req.body;

    // Find user
    const user = await User.findOne({ email });
    if (!user) {
      return res.status(401).json({ message: 'Invalid credentials' });
    }

    // Compare password
    const isMatch = await bcrypt.compare(password, user.password);
    if (!isMatch) {
      return res.status(401).json({ message: 'Invalid credentials' });
    }

    // Generate JWT
    const token = jwt.sign(
      { id: user._id, email: user.email, role: user.role },
      JWT_SECRET,
      { expiresIn: '7d' }
    );

    res.json({
      message: 'Login successful! Biryani ka order ready hai! 🍔',
      token,
      user: { id: user._id, name: user.name, email: user.email }
    });
  } catch (error) {
    res.status(500).json({ message: 'Server error: ' + error.message });
  }
};

// GET /api/auth/me — Get current user profile (protected)
export const getMe = async (req, res) => {
  try {
    const user = await User.findById(req.user.id).select('-password');
    res.json({ user });
  } catch (error) {
    res.status(500).json({ message: 'Server error: ' + error.message });
  }
};

// models/User.js — User Schema
import mongoose from 'mongoose';

const userSchema = new mongoose.Schema({
  name: { type: String, required: [true, 'Name is required'] },
  email: {
    type: String,
    required: [true, 'Email is required'],
    unique: true,
    lowercase: true
  },
  password: {
    type: String,
    required: [true, 'Password is required'],
    minlength: [6, 'Password must be at least 6 characters'],
    select: false // Never return password in queries by default
  },
  role: {
    type: String,
    enum: ['customer', 'admin', 'restaurant'],
    default: 'customer'
  }
}, { timestamps: true });

export default mongoose.model('User', userSchema);

Complete Auth Flow Diagram:

1. User POSTs to /api/auth/register with name, email, password
2. Server hashes password with bcryptjs (12 salt rounds)
3. Server saves user to MongoDB (hashed password only!)
4. Server generates JWT with user id, email, role (expires in 7 days)
5. Server returns JWT to client
6. Client stores JWT (localStorage/sessionStorage)
7. User wants to order biryani — sends JWT in Authorization header
8. Server's protect middleware verifies JWT signature
9. If valid → route handler runs → order placed! 🎉
10. If invalid/expired → 401 Unauthorized → login again!