深入理解Node.js中bcryptjs进行密码哈希与验证

npm install bcryptjs

const express = require('express');
const bcrypt = require('bcryptjs'); // 引入 bcryptjs
const jwt = require('jsonwebtoken');
const mongoose = require('mongoose');
const cors = require('cors');

const secretKey = 'your-secret-key'; // 替换为你的JWT密钥

const app = express();
app.use(cors());
app.use(express.json());

// MongoDB connection URI
const uri = 'mongodb://localhost:27017/final-year-project';

// Connect to the MongoDB database
mongoose
  .connect(uri, { useNewUrlParser: true, useUnifiedTopology: true })
  .then(() => {
    console.log('Connected to the database');
    app.listen(3000);
    console.log('app connected on port 3000');
  })
  .catch((error) => {
    console.error('Failed to connect to the database:', error);
  });

// Define the user schema
const userSchema = new mongoose.Schema({
  firstName: { type: String, required: true },
  lastName: { type: String, required: true },
  email: { type: String, required: true, unique: true },
  role: { type: String, required: true },
  password: { type: String, required: true },
}, { collection: 'users' });

// Define the user model
const User = mongoose.model('User', userSchema);

class AuthResponseData {
  constructor(user) {
    this.user = user;
  }
}

// Signup endpoint
app.post('/signup', async (req, res) => {
  try {
    const { firstName, lastName, email, role, password } = req.body;

    const existingUser = await User.findOne({ email });
    if (existingUser) {
      return res.status(400).json({ message: 'Email already exists' });
    }

    let plainTextPassword = password;
    if (!plainTextPassword) {
      plainTextPassword = 'defaultPassword123'; // 建议在实际应用中避免设置默认密码
    }

    // 使用 bcryptjs 进行密码哈希
    // genSaltSync(10) 生成盐值，10是盐值轮数，影响哈希强度和计算时间
    const hashedPassword = await bcrypt.hash(plainTextPassword, 10); 

    const newUser = new User({
      firstName,
      lastName,
      email,
      role,
      password: hashedPassword, // 存储哈希后的密码
    });

    await newUser.save();

    const token = jwt.sign({ email: newUser.email }, secretKey, { expiresIn: '1h' }); // 设置JWT过期时间
    const expirationDate = new Date().getTime() + 3600000;

    const user = {
      firstName: newUser.firstName,
      lastName: newUser.lastName,
      email: newUser.email,
      role: newUser.role,
      id: newUser._id,
      _token: token,
      _tokenExpirationDate: expirationDate,
    };

    const authResponse = new AuthResponseData(user);
    res.status(201).json(authResponse);

  } catch (error) {
    console.error('Signup error:', error);
    res.status(500).json({ message: 'Internal server error' });
  }
});

// Login endpoint
app.post('/login', async (req, res) => {
  try {
    const { email, password } = req.body;

    // 1. 查找用户
    const user = await User.findOne({ email });
    if (!user) {
      return res.status(401).json({ message: 'Invalid email or password' });
    }

    // 2. 比对密码
    // bcrypt.compare(plainTextPassword, hashedPasswordFromDb)
    const passwordMatch = await bcrypt.compare(password, user.password);

    if (!passwordMatch) {
      return res.status(401).json({ message: 'Invalid email or password' });
    }

    // 3. 生成JWT并返回认证信息
    const token = jwt.sign({ email: user.email }, secretKey, { expiresIn: '1h' });
    const expirationDate = new Date().getTime() + 3600000;

    const loggedInUser = {
      firstName: user.firstName,
      lastName: user.lastName,
      email: user.email,
      role: user.role,
      id: user._id,
      _token: token,
      _tokenExpirationDate: expirationDate,
    };

    const authResponse = new AuthResponseData(loggedInUser);
    res.status(200).json(authResponse);

  } catch (error) {
    console.error('Login error:', error);
    res.status(500).json({ message: 'Internal server error' });
  }
});