bruker registrering og login

backend/package.json

@@ -19,13 +19,16 @@
   "license": "ISC",
   "dependencies": {
     "@apollo/server": "^5.5.1",
+    "bcryptjs": "^3.0.3",
     "dataloader": "^2.2.3",
     "dotenv": "^18.0.5",
     "graphql": "^17.0.2",
+    "jsonwebtoken": "^9.0.3",
     "pg": "^8.23.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^24.19.0",
     "@types/pg": "^8.23.1",
     "eslint": "^10.11.0",

backend/src/auth.ts

@@ -1,2 +1,38 @@
-// server jwt secret
-// const secret = process.env.JWT_SECRET;
+import bcrypt from 'bcryptjs';
+import jwt from 'jsonwebtoken';
+import { GraphQLError } from 'graphql';
+
+const COST = 12;
+// Brukes når brukeren ikke finnes, så login tar like lang tid uansett
+const DUMMY_HASH = bcrypt.hashSync('dummy-password', COST);
+
+const secret = () => process.env.JWT_SECRET as string;
+
+export function hashPassword(password: string) {
+  return bcrypt.hash(password, COST);
+}
+
+export function verifyPassword(password: string, hash: string | undefined) {
+  return bcrypt.compare(password, hash ?? DUMMY_HASH);
+}
+
+export function signToken(userId: string) {
+  return jwt.sign({}, secret(), { subject: String(userId), expiresIn: '7d' });
+}
+
+export function userIdFromHeader(header: string | undefined): string | null {
+  if (!header?.startsWith('Bearer ')) return null;
+  try {
+    const payload = jwt.verify(header.slice(7), secret(), { algorithms: ['HS256'] });
+    return typeof payload === 'object' && payload.sub ? payload.sub : null;
+  } catch {
+    return null;
+  }
+}
+
+export function requireUser(ctx: { userId: string | null }): string {
+  if (!ctx.userId) {
+    throw new GraphQLError('Not logged in', { extensions: { code: 'UNAUTHENTICATED' } });
+  }
+  return ctx.userId;
+}

backend/src/index.ts

@@ -4,20 +4,30 @@ import { pool } from './db.js';
 import { typeDefs } from './schema.js';
 import { resolvers } from './resolvers.js';
 import { Context, createLoaders } from './loaders.js';
+import { userIdFromHeader } from './auth.js';
+
 
 // apollo-server port number [default port 3001]
 const port = Number(process.env.PORT ?? 3001);
 
 // tester db tilkobling med en query
 await pool.query('SELECT 1');
 
+// sjekk at en jasonwebtoken er satt, hvis ikke feil
+// denne skal genereres lokalt for utvikling og på vm
+// f.eks. med openssl: openssl rand -base64 32
+if (!process.env.JWT_SECRET) throw new Error('JWT_SECRET is not set');
+
 // apollo server instance
 const server = new ApolloServer<Context>({ typeDefs, resolvers });
 
 // pass apolloserver to standaloneserver
 const { url } = await startStandaloneServer(server, {
   listen: { port },
-  context: async () => ({ loaders: createLoaders() }),
+  context: async ({ req }) => ({ 
+    loaders: createLoaders(),
+    userId: userIdFromHeader(req.headers.authorization),
+  }),
 });
 
 console.log(`Server ready at: ${url}`);

backend/src/loaders.ts

@@ -34,4 +34,7 @@ export function createLoaders() {
   };
 }
 
-export type Context = { loaders: ReturnType<typeof createLoaders> };
+export type Context = {
+  loaders: ReturnType<typeof createLoaders>;
+  userId: string | null;
+};

backend/src/resolvers.ts

@@ -1,9 +1,12 @@
 import { GraphQLError } from 'graphql/error';
 import { decodeCursor, encodeCursor } from './cursor.js';
 import { pool } from './db.js';
+import { hashPassword, verifyPassword, signToken } from './auth.js';
 import type { Context } from './loaders.js';
 
 // type definitions
+type AuthArgs = { username: string; password: string };
+
 type GamesArgs = {
   search?: string | null;
   filter?: GameFilter | null;
@@ -22,8 +25,10 @@ type GameFilter = {
 };
 
 // const vars and func
+const USERNAME_REGEX = /^[A-Za-z0-9_]{3,30}$/;
 const VALID_ID_REGEX = /^\d{1,18}$/;
 const MAX_PAGE_SIZE = 50;
+
 const escapeChars = (s: string) => s.replace(/[\\%_]/g, '\\$&');
 
 // definerer hvilke kolonner som skal hentes for en generell
@@ -78,6 +83,7 @@ const GAMES_WHERE = `
   AND ${WHERE_RELEASED_FROM}
   AND ${WHERE_RELEASED_TO}
 `;
+
 // SQL sorting med order by
 // denne variablen mapper en enum til en gitt order
 // som kan brukes i SQL-spørringen
@@ -108,6 +114,59 @@ const SQL_GAME = `
   WHERE id = $1
 `;
 
+// SQL bruker-autentisering
+const SQL_USER = `SELECT id, username FROM users WHERE id = $1`;
+const SQL_USER_BY_NAME = `
+  SELECT id, username, password_hash FROM users
+  WHERE lower(username) = lower($1)
+`;
+const SQL_REGISTER = `
+  INSERT INTO users (username, password_hash) VALUES ($1, $2)
+  RETURNING id, username
+`;
+
+// bruker-funksjoner
+const badInput = (message: string) =>
+  new GraphQLError(message, { extensions: { code: 'BAD_USER_INPUT' } });
+
+async function register(_parent: unknown, { username, password }: AuthArgs) {
+  if (!USERNAME_REGEX.test(username)) {
+    throw badInput('Brukernavn må inneholde 3-30 tegn: bokstaver, tall eller _');
+  }
+  if (password.length < 8 || Buffer.byteLength(password) > 72) {
+    throw badInput('Passord må inneholde 8-72 tegn');
+  }
+  const hash = await hashPassword(password);
+  try {
+    const user = (await pool.query(SQL_REGISTER, [username, hash])).rows[0];
+    return { token: signToken(user.id), user };
+  } catch (err) {
+    if ((err as { code?: string }).code === '23505') {
+      throw badInput('Brukernavn er allerede i bruk...');
+    }
+    throw err;
+  }
+}
+
+async function login(_parent: unknown, { username, password }: AuthArgs) {
+  const row = (await pool.query(SQL_USER_BY_NAME, [username])).rows[0];
+  const ok = await verifyPassword(password, row?.password_hash);
+  if (!row || !ok) {
+    throw new GraphQLError('Ugyldig brukernavn eller passord...', {
+      extensions: { code: 'UNAUTHENTICATED' },
+    });
+  }
+  return { token: signToken(row.id), user: { id: row.id, username: row.username } };
+}
+
+async function me(_parent: unknown, _args: unknown, ctx: Context) {
+  if (!ctx.userId) return null;
+  return (await pool.query(SQL_USER, [ctx.userId])).rows[0] ?? null;
+}
+
+// erstatter den gamle løsningen med direkte sql og variabler,
+// denne gir mer fleksibilitet i hvordan man sorterer
+// og fungerer med pagineringen vår
 function sortSql(sort: GameSort, reverse: boolean) {
   const { key, cast, dir } = SORTS[sort];
   const order = reverse ? (dir === 'DESC' ? 'ASC' : 'DESC') : dir;
@@ -149,22 +208,6 @@ function filterValues(args: GamesArgs) {
     args.filter?.releasedTo ?? null,
   ];
 }
-// resolver for koblings-tabellene i databasen
-/*
-function relation(table: string, junc: string, fk: string) {
-  const sql = `
-    SELECT t.id, t.name
-    FROM ${junc} j
-    JOIN ${table} t ON t.id = j.${fk} 
-    WHERE j.game_id = $1
-    ORDER BY t.name
-  `;
-  return async (game: { id: string }) => {
-    const res = await pool.query(sql, [game.id]);
-    return res.rows;
-  };
-}
-  */
 
 function relation(key: keyof Context['loaders']) {
   return (game: { id: string }, _args: unknown, ctx: Context) =>
@@ -255,7 +298,8 @@ async function platforms() {
 
 // resolvers for å hente kjøre spørringer mot databasen
 export const resolvers = {
-  Query: { game, games, genres, platforms },
+  Query: { game, games, genres, platforms, me },
+  Mutation: { register, login },
 
   Game: {
     genres: relation('genres'),

backend/src/schema.ts

@@ -103,5 +103,33 @@ export const typeDefs = `#graphql
 
         genres: [Facet!]!
         platforms: [Facet!]!
+        me: User
+    }
+
+    """
+    Bruker definert ved brukerid og brukernavn.
+    """
+    type User {
+        id: ID!
+        username: String!
+    }
+
+    """
+    Payload som sendes for å autentisere en bruker, både brukeren sin token
+    bruker typen skal sendes.
+    """
+    type AuthPayload {
+        token: String!
+        user: User!
+    }
+
+    """
+    Mutation for å mutere data i databasen.
+    Register regestrerer en ny bruker i databasen.
+    Login autentiserer en bruker.
+    """
+    type Mutation {
+        register(username: String!, password: String!): AuthPayload!
+        login(username: String!, password: String!): AuthPayload!
     }
 `;