Log In

Sign-up stores a hash of each password. Logging in is the other half: the user sends their email and password, and the shop checks them. It's a POST, so the password travels in the body, not in a URL that ends up in logs and in the browser's history.

Checking a password: you can't undo a hash, but you can hash the typed password again with the same salt and compare. checkPassword(storedHash, typedPassword), a function already in your file, does that with Node's crypto and returns a boolean: true or false. For example, with another password:

const stored = hashPassword("tulip7");
console.log(checkPassword(stored, "tulip7"));   // true
console.log(checkPassword(stored, "tulip8"));   // false

The new type User at the top of the file describes a row of the users table, so you can tell TypeScript what the SELECT gives back. When the email has no account or the password is wrong, answer 401 with one vague message for both. Two different messages would let anyone find out which emails have an account. After two sign-ups, the test requests get:

POST /register  {"email": "ana@example.com", "password": "secret123"}  →  201  {"email": "ana@example.com", "id": 1}
POST /register  {"email": "ben@example.com", "password": "tea4two"}    →  201  {"email": "ben@example.com", "id": 2}
POST /login  {"email": "ana@example.com", "password": "secret123"}     →  200  {"email": "ana@example.com", "id": 1}
POST /login  {"email": "ana@example.com", "password": "secret999"}     →  401  {"error": "Wrong email or password"}
POST /login  {"email": "nobody@example.com", "password": "secret123"}  →  401  {"error": "Wrong email or password"}
POST /login  {"email": "ben@example.com", "password": "secret123"}     →  401  {"error": "Wrong email or password"}
POST /login  {"email": "ben@example.com", "password": "tea4two"}       →  200  {"email": "ben@example.com", "id": 2}

Your task: add POST /login. Find the user by email (as User | undefined), answer { error: "Wrong email or password" } with 401 when there is no such user or the password doesn't match the stored hash, and otherwise answer the user's id and email with 200.

Assignment
Follow the Coding Tutorial to build the /login route.

Hint
Test for a missing user first and join the two failures with ||: when the first part is true, the code never reads user.password_hash.