Let's build the core auth endpoints — registration and login. These use bcryptjs for password hashing and jsonwebtoken for token generation.

User Model with roles:

// models/User.js — Full User Schema
import mongoose from 'mongoose';
import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import crypto from 'crypto';

const userSchema = new mongoose.Schema({
  name: { type: String, required: [true, 'Name daalo bhai!'], trim: true, maxlength: 50 },
  email: {
    type: String,
    required: [true, 'Email daalo bhai!'],
    unique: true,
    lowercase: true,
    match: [/^\S+@\S+\.\S+$/, 'Sahi email daalo!']
  },
  password: {
    type: String,
    required: [true, 'Password daalo bhai!'],
    minlength: [6, 'Password 6 chars se chota nahi hona chahiye'],
    select: false
  },
  role: {
    type: String,
    enum: ['customer', 'admin', 'driver', 'restaurant'],
    default: 'customer'
  },
  phone: { type: String },
  resetPasswordToken: String,
  resetPasswordExpire: Date
}, { timestamps: true });

// Hash password before saving
userSchema.pre('save', async function(next) {
  if (!this.isModified('password')) return next();
  const salt = await bcrypt.genSalt(12);
  this.password = await bcrypt.hash(this.password, salt);
  next();
});

// Compare entered password with hashed password
userSchema.methods.matchPassword = async function(enteredPassword) {
  return await bcrypt.compare(enteredPassword, this.password);
};

// Generate signed JWT
userSchema.methods.generateToken = function() {
  return jwt.sign(
    { id: this._id, email: this.email, role: this.role },
    process.env.JWT_SECRET,
    { expiresIn: process.env.JWT_EXPIRES_IN || '7d' }
  );
};

// Generate password reset token
userSchema.methods.generateResetToken = function() {
  const resetToken = crypto.randomBytes(20).toString('hex');
  this.resetPasswordToken = crypto.createHash('sha256').update(resetToken).digest('hex');
  this.resetPasswordExpire = Date.now() + 60 * 60 * 1000; // 1 hour
  return resetToken;
};

export default mongoose.model('User', userSchema);

Auth Controller — Register & Login:

// controllers/auth.controller.js — Register & Login
import User from '../models/User.js';
import AppError from '../utils/AppError.js';
import asyncHandler from '../utils/asyncHandler.js';

// POST /api/auth/register
export const register = asyncHandler(async (req, res) => {
  const { name, email, password, role } = req.body;

  // Check if user exists
  const existingUser = await User.findOne({ email });
  if (existingUser) {
    throw new AppError('User already exists! Yeh email already registered hai bhai!', 400);
  }

  // Create user (password is hashed by pre-save hook)
  const user = await User.create({ name, email, password, role });

  // Generate JWT
  const token = user.generateToken();

  res.status(201).json({
    success: true,
    message: 'Registration successful! Swagat hai bhai! 🎉',
    token,
    user: { id: user._id, name: user.name, email: user.email, role: user.role }
  });
});

// POST /api/auth/login
export const login = asyncHandler(async (req, res, next) => {
  const { email, password } = req.body;

  if (!email || !password) {
    throw new AppError('Email aur password dono daalo bhai!', 400);
  }

  // Find user + explicitly select password
  const user = await User.findOne({ email }).select('+password');
  if (!user) {
    throw new AppError('Invalid credentials! Email ya password galat hai!', 401);
  }

  // Check password
  const isMatch = await user.matchPassword(password);
  if (!isMatch) {
    throw new AppError('Invalid credentials! Email ya password galat hai!', 401);
  }

  const token = user.generateToken();

  res.json({
    success: true,
    message: 'Login successful! Biryani order kar sakte ho! 🍔',
    token,
    user: { id: user._id, name: user.name, email: user.email, role: user.role }
  });
});

// GET /api/auth/me — Get current logged-in user (protected)
export const getMe = asyncHandler(async (req, res) => {
  const user = await User.findById(req.user.id);
  res.json({ success: true, data: user });
});

Key security features:

• Password auto-hashed via Mongoose pre('save') hook — you never see the plain password in your code
• select: false on password — never returned in queries unless explicitly requested
• crypto.randomBytes(20) for reset tokens — cryptographically secure random
• JWT with expiry — token auto-invalidates after 7 days