Kecil, part 7 - accounts, sessions and permissions

npm i bcrypt passport-local passport express-session

Passport handles sessions, bcrypt handles hashing. Kecil only stores an email and a password - no social login - so the local strategy is the whole of it.

passport-config.js

Initialise the strategy with a getUserByEmail and a getUserById, compare the submitted password against the hash in pw, and fail with a generic message either way. Serialising by id keeps the session cookie small and keeps the hash out of it entirely.

Routes

• Login and logout
• Register - hash before insert, never after
• Reset password
• Modify account

Permissions

Two middlewares do the work: checkAuthenticated on everything private, checkNotAuthenticated on the auth pages so a logged-in user cannot land on the login form. Every API call then reads req.user.id rather than trusting an id from the request body - which is the difference between a multi-user app and a shared one.