Bare minimum example auth in express js

index.js

const express = require('express');
const app = express();
const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');
const session = require('express-session');

// User model
const User = require('./models/user');

// Login form
app.get('/login', (req, res) => {
  res.render('login');
});

// Login route
app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await User.findOne({ email });

  // Verify user
  if (!user) {
    return res.status(401).send({ error: 'Invalid email or password' });
  }

  // Verify password
  const validPassword = await bcrypt.compare(password, user.password);
  if (!validPassword) {
    return res.status(401).send({ error: 'Invalid email or password' });
  }

  // Generate JWT token
  const token = jwt.sign({ userId: user._id }, 'secret-key', { expiresIn: '1h' });

  // Set session cookie
  req.session.token = token;

  res.redirect('/dashboard');
});

// Authentication middleware
const authenticate = (req, res, next) => {
  const token = req.session.token;

  // Verify token
  jwt.verify(token, 'secret-key', (err, decodedToken) => {
    if (err || !decodedToken) {
      return res.status(401).send({ error: 'Unauthorized' });
    }
    req.userId = decodedToken.userId;
    next();
  });
};

// Protected route
app.get('/dashboard', authenticate, (req, res) => {
  res.render('dashboard');
});

// Logout route
app.post('/logout', (req, res) => {
  req.session.destroy();
  res.redirect('/login');
});

app.listen(3000, () => console.log('Server started on port 3000'));