Full Stack Development Internship

// Week 6: the layer most juniors get wrong
router.post('/login', validate(loginSchema), async (req, res) => {
  const user = await User.findByEmail(req.body.email);

  // same response either way: no account enumeration
  const ok = user && await bcrypt.compare(req.body.password, user.hash);
  if (!ok) return res.status(401).json({ error: 'INVALID_CREDENTIALS' });

  const access  = signAccess({ sub: user.id, role: user.role });
  const refresh = await issueRefresh(user.id);

  res.cookie('rt', refresh, { httpOnly: true, secure: true, sameSite: 'strict' });
  res.json({ access, user: publicUser(user) });
});