Working login, but session not implemented yet

server/index.js

@@ -2,12 +2,33 @@ const express = require("express");
 const cors = require("cors");
 const sqlite3 = require("sqlite3").verbose();
 const app = express();
+const session = require('express-session');
 require("dotenv").config();
 
-app.use(cors());
+app.use(cors({
+  origin: "http://localhost:5173",  // genau die Adresse deines Frontends
+  credentials: true                 // Cookies erlauben
+}));
 app.use(express.json());
-
+const bcrypt = require('bcrypt');
 const db = new sqlite3.Database("../db.sqlite");
+db.prepare(`CREATE TABLE IF NOT EXISTS users (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            username TEXT UNIQUE,
+            password_hash TEXT)`).run();
+const adminExists = db.get("SELECT * FROM users WHERE username = ?", ["admin"]);
+if (!adminExists) {
+  const hash = bcrypt.hashSync("admin", 10); // Passwort: admin
+  db.prepare(`INSERT INTO users (username, password_hash) VALUES (?, ?)`).run('admin', hash);
+}
+
+app.use(session({
+  secret: 'supergeheim', // Ändern in echte Secret
+  resave: false,
+  saveUninitialized: false,
+  cookie: { secure: false }
+}));
+
 
 // Beispiel-Route: Link erstellen
 app.post("/api/shorten", (req, res) => {
@@ -18,8 +39,8 @@ app.post("/api/shorten", (req, res) => {
     [id, original_url],
     (err) => {
       if (err) return res.status(500).json({ error: err.message });
-      res.json({ short_url: `http://localhost:3000/${id}` });
-      res.json({ id: `${id}`});
+      res.json({ short_url: `http://localhost:3000/${id}`,
+                 id: `${id}` });
     }
   );
 });
@@ -33,4 +54,42 @@ app.get("/:id", (req, res) => {
   });
 });
 
+
+app.post('/api/login', (req, res) => {
+  const { username, password } = req.body;
+
+  db.get("SELECT * FROM users WHERE username = ?", [username], (err, user) => {
+    if (err) {
+      console.error("Datenbankfehler:", err);
+      return res.status(500).json({ message: 'Interner Serverfehler' });
+    }
+
+    if (!user) {
+      return res.status(401).json({ message: 'Benutzer existiert nicht' });
+    }
+
+    //console.log("Klartext-Passwort:", password);
+    //console.log("Hash aus DB:", user.password_hash);
+
+    const valid = bcrypt.compareSync(password, user.password_hash);
+    if (!valid) return res.status(401).json({ message: 'Falsches Passwort' });
+
+    req.session.user = { id: user.id, username: user.username };
+    res.json({ success: true });
+  });
+});
+
+app.get('/api/check-auth', (req, res) => {
+  res.json({ loggedIn: !!req.session.user });
+});
+
+app.post('/api/logout', (req, res) => {
+  req.session.destroy(() => res.json({ success: true }));
+});
+
+
+
+
+
+
 app.listen(3000, () => console.log("Server läuft auf http://localhost:3000"));