Authentication
Email register and login plus GitHub OAuth, on JWT.
Authentication is JWT plus bcrypt — better-auth sits in both manifests
but no source file imports it. Email users register and log in through the
user controller with 30-day tokens; GitHub users arrive through OAuth and
get the same token. The guard reads the cookie first and the Bearer header
second, which keeps hosted frontends working. One honest gap: the signup
page reads a fulfilled matcher off a plain thunk, so its post-submit
redirect is unverified — login and session restore follow the same token
path and are straightforward.
What it owns
- Email registration with hashed passwords
- Email login with hash comparison
- GitHub OAuth login, callback, and profile sync
- Token transport: httpOnly cookie plus Bearer fallback
Files
File list and purposes from the folder README.
| File | Purpose |
|---|---|
frontend/src/pages/SignupPage.jsx | Registration form, dispatches the register thunk. |
frontend/src/pages/LoginPage.jsx | Login form, dispatches the login thunk. |
frontend/src/services/userService.js | Register, login, logout, and session calls. |
backend/routes/userRoutes.js | Register, login, and logout routes. |
backend/routes/authRoutes.js | GitHub OAuth and sync routes. |
backend/controllers/userController.js | Register, login, and token responses. |
backend/controllers/authController.js | GitHub OAuth flow and profile sync. |
backend/middleware/authMiddleware.js | Token verification for protected routes. |
backend/models/User.js | Schema plus bcrypt hashing. |
Talks to
Sources: frontend/src/pages/SignupPage.jsx, frontend/src/services/userService.js, backend/routes/userRoutes.js, backend/controllers/userController.js, backend/models/User.js (documented at commit cdef8af)