satyamprakash06/backend-auth-system

This repository is a ready-to-use backend API that handles everything related to user accounts and login security for a web application. It is written in JavaScript and runs on Node.js, using Express as the web framework and MongoDB as the database. The core problem it solves is authentication, verifying who a user is and controlling what they are allowed to do. When a new user registers, they receive a verification email before they can log in. Logging in issues two tokens: a short-lived access token (used to prove identity on each request) and a longer-lived refresh token (stored as an HTTP-only cookie to stay secure). Every time the refresh token is used to get a new access token, the old refresh token is replaced, a technique called token rotation that limits damage if a token is ever stolen. Passwords are stored hashed using bcrypt with 12 salt rounds, and refresh tokens are also hashed before being saved to the database. Forgot-password and email-verification flows are included. The system supports three roles, customer, seller, and admin, so different users can have different permissions. The code is organized into a service/controller split: controllers handle incoming HTTP requests, while services contain the business logic. Input validation uses Joi data transfer objects, and a global error handler plus an async wrapper keeps error handling consistent throughout. The tech stack is Node.js runtime, Express framework, MongoDB database, Mongoose for database modelling, jsonwebtoken for tokens, bcryptjs for password hashing, Nodemailer for emails, and Joi for validation.