Review a pull request: login endpoint

Not solved

A rewrite of the login route adds logging and a remember-me cookie. The password check is fine — almost nothing else is.

src/routes/auth.ts0/4 found

		import bcrypt from 'bcrypt'

		const DAY = 24 * 60 * 60 * 1000

	+	router.post('/api/login', async (req, res) => {
	+	const { email, password } = req.body
	+	logger.info('login attempt', { email, password, ip: req.ip })
	+	const user = await db.users.findByEmail(email)
	+	if (!user) {
	+	return res.status(404).json({ error: 'No account uses that email' })
	+	}
	+	if (!(await bcrypt.compare(password, user.passwordHash))) {
	+	return res.status(401).json({ error: 'Email or password is incorrect' })
	+	}
	+	req.session.userId = user.id
	+	req.session.role = user.role
	+	res.cookie('remember_me', user.id, { maxAge: 30 * DAY })
	+	res.json({ ok: true })
	+	})

Click a line number to flag a defect. The review code appears when every defect is flagged with no false positives.