এক্সপ্রেস এপিআই অথেনটিকেশন

import sqlite3 from "sqlite3";
import { open } from "sqlite";

const dbPromise = open({
  filename: "./notes.db",
  driver: sqlite3.Database
});

(async () => {
  const db = await dbPromise;

  // Users table
  await db.run(`
    CREATE TABLE IF NOT EXISTS users (
      id INTEGER PRIMARY KEY AUTOINCREMENT,
      username TEXT UNIQUE NOT NULL,
      password TEXT NOT NULL,
      created_at DATETIME DEFAULT CURRENT_TIMESTAMP
    )
  `);

  // Notes table (link to user_id)
  await db.run(`
    CREATE TABLE IF NOT EXISTS notes (
      id INTEGER PRIMARY KEY AUTOINCREMENT,
      user_id INTEGER NOT NULL,
      title TEXT NOT NULL,
      content TEXT NOT NULL,
      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
      FOREIGN KEY (user_id) REFERENCES users(id)
    )
  `);
})();

export default dbPromise;

npm install bcryptjs jsonwebtoken

import express from "express";
import bcrypt from "bcryptjs";
import jwt from "jsonwebtoken";
import dbPromise from "../db.js";

const router = express.Router();
const JWT_SECRET = "your_secret_key"; // use env variable in production

// 📝 Register
router.post("/register", async (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) return res.status(400).json({ error: "Required" });

  const hashedPassword = await bcrypt.hash(password, 10);
  const db = await dbPromise;
  try {
    const result = await db.run(
      "INSERT INTO users (username, password) VALUES (?, ?)",
      [username, hashedPassword]
    );
    res.json({ message: "User created", id: result.lastID });
  } catch (err) {
    res.status(400).json({ error: "Username already exists" });
  }
});

// 🔑 Login
router.post("/login", async (req, res) => {
  const { username, password } = req.body;
  const db = await dbPromise;
  const user = await db.get("SELECT * FROM users WHERE username = ?", [username]);
  if (!user) return res.status(400).json({ error: "Invalid credentials" });

  const isMatch = await bcrypt.compare(password, user.password);
  if (!isMatch) return res.status(400).json({ error: "Invalid credentials" });

  // Sign JWT
  const token = jwt.sign({ id: user.id, username: user.username }, JWT_SECRET, {
    expiresIn: "1h",
  });

  res.json({ token });
});

export default router;

import jwt from "jsonwebtoken";
const JWT_SECRET = "your_secret_key"; // use env variable in production

export const authenticate = (req, res, next) => {
  const authHeader = req.headers.authorization;
  if (!authHeader) return res.status(401).json({ error: "No token provided" });

  const token = authHeader.split(" ")[1];
  if (!token) return res.status(401).json({ error: "Invalid token format" });

  try {
    const decoded = jwt.verify(token, JWT_SECRET);
    req.user = decoded; // attach user info to request
    next();
  } catch (err) {
    res.status(401).json({ error: "Invalid token" });
  }
};

import { authenticate } from "../middleware/auth.js";
router.use(authenticate);

import express from "express";
import dbPromise from "../db.js";
import { authenticate } from "../middleware/auth.js";

const router = express.Router();

// All routes now use `authenticate` middleware
router.use(authenticate);

// ✅ Create Note
router.post("/", async (req, res) => {
  const { title, content } = req.body;
  const db = await dbPromise;
  const result = await db.run(
    "INSERT INTO notes (user_id, title, content) VALUES (?, ?, ?)",
    [req.user.id, title, content]
  );
  res.json({ id: result.lastID, title, content });
});

// 📖 Get All Notes for logged-in user
router.get("/", async (req, res) => {
  const db = await dbPromise;
  const notes = await db.all("SELECT * FROM notes WHERE user_id = ? ORDER BY created_at DESC", [
    req.user.id,
  ]);
  res.json(notes);
});

// 🔍 Get Single Note (only if owner)
router.get("/:id", async (req, res) => {
  const db = await dbPromise;
  const note = await db.get("SELECT * FROM notes WHERE id = ? AND user_id = ?", [
    req.params.id,
    req.user.id,
  ]);
  if (!note) return res.status(404).json({ error: "Note not found" });
  res.json(note);
});

// ✏️ Update Note
router.put("/:id", async (req, res) => {
  const { title, content } = req.body;
  const db = await dbPromise;
  const result = await db.run(
    "UPDATE notes SET title = ?, content = ? WHERE id = ? AND user_id = ?",
    [title, content, req.params.id, req.user.id]
  );
  if (result.changes === 0) return res.status(404).json({ error: "Note not found" });
  res.json({ message: "Note updated" });
});

// ❌ Delete Note
router.delete("/:id", async (req, res) => {
  const db = await dbPromise;
  const result = await db.run("DELETE FROM notes WHERE id = ? AND user_id = ?", [
    req.params.id,
    req.user.id,
  ]);
  if (result.changes === 0) return res.status(404).json({ error: "Note not found" });
  res.json({ message: "Note deleted" });
});

export default router;

import express from "express";
import notesRouter from "./routes/notes.js";
import authRouter from "./routes/auth.js";

const app = express();
const PORT = 3000;

app.use(express.json());

app.use("/auth", authRouter); // /auth/register, /auth/login
app.use("/notes", notesRouter);

app.listen(PORT, () => console.log(`Server running on http://localhost:${PORT}`));

{
  "username": "jack",
  "password": "123123"
}

{
  "username": "jack",
  "password": "123123"
}