first commit

server/auth.js

@@ -0,0 +1,26 @@
+import jwt from 'jsonwebtoken';
+
+const JWT_SECRET = process.env.JWT_SECRET || 'dev-secret-change-in-production';
+const JWT_EXPIRY = '24h';
+
+export function signToken(username) {
+  return jwt.sign({ username }, JWT_SECRET, { expiresIn: JWT_EXPIRY });
+}
+
+export function verifyToken(token) {
+  return jwt.verify(token, JWT_SECRET);
+}
+
+export function requireAuth(req, res, next) {
+  const header = req.headers.authorization;
+  if (!header?.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'Authentication required', code: 'UNAUTHORIZED' });
+  }
+
+  try {
+    req.user = verifyToken(header.slice(7));
+    next();
+  } catch {
+    return res.status(401).json({ error: 'Invalid or expired token', code: 'UNAUTHORIZED' });
+  }
+}