Copy-paste template — bcrypt + JWT + Helmet auth (tested code)

require('dotenv').config();
const express = require('express');
const helmet = require('helmet');
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');

const app = express();
app.use(helmet());
app.use(express.json());

const SECRET = process.env.JWT_SECRET; // never hardcoded!
if (!SECRET) throw new Error('JWT_SECRET missing: define it in .env');

const vendeurs = []; // demo: in real life, a database

// Signup: hash, then store the hash
app.post('/inscription', async (req, res) => {
  if (!req.body.email || !req.body.motDePasse) {
    return res.status(400).json({ erreur: 'Email and password required' });
  }
  const hachage = await bcrypt.hash(req.body.motDePasse, 10);
  vendeurs.push({ email: req.body.email, hachage });
  res.status(201).json({ message: 'Account created' });
});

// Login: compare, then issue a JWT
app.post('/connexion', async (req, res) => {
  const vendeur = vendeurs.find((v) => v.email === req.body.email);
  if (!vendeur) return res.status(401).json({ erreur: 'Invalid credentials' });
  const ok = await bcrypt.compare(req.body.motDePasse, vendeur.hachage);
  if (!ok) return res.status(401).json({ erreur: 'Invalid credentials' });
  const jeton = jwt.sign({ email: vendeur.email }, SECRET, { expiresIn: '1h' });
  res.json({ jeton });
});

// Middleware: verifies the JWT on protected routes
function verifierJeton(req, res, next) {
  const entete = req.headers.authorization || '';
  const jeton = entete.replace('Bearer ', '');
  if (!jeton) return res.status(401).json({ erreur: 'Missing token' });
  try {
    req.utilisateur = jwt.verify(jeton, SECRET);
    next();
  } catch (err) {
    return res.status(401).json({ erreur: 'Invalid token' });
  }
}

app.get('/mon-compte', verifierJeton, (req, res) => {
  res.json({ email: req.utilisateur.email });
});

app.listen(3000);