Creacion de modulo auth

backend/.env.example

@@ -0,0 +1,20 @@
+# Variables de entorno del backend PolySignal.
+# Copiar este archivo a backend/.env y rellenar los valores.
+# El archivo .env real NO debe commitearse (asegurar entrada en .gitignore).
+
+NODE_ENV=development
+PORT=7860
+
+# SQLite path relativo al archivo schema.prisma (backend/prisma/).
+DATABASE_URL=file:./polysignal.db
+
+# Auth — generar con: openssl rand -hex 48
+JWT_SECRET=replace-with-64-plus-random-chars
+JWT_EXPIRES_IN=1h
+BCRYPT_ROUNDS=10
+
+# CORS del frontend Vite en desarrollo.
+CORS_ORIGIN=http://localhost:5173
+
+# Logger pino (trace | debug | info | warn | error | fatal).
+LOG_LEVEL=info

backend/docs/AUTH.md

@@ -0,0 +1,172 @@
+# Auth — Guía de uso
+
+Login con email + password. El backend emite un JWT (HS256, default 1h) que viaja en `Authorization: Bearer <token>`. No hay registro público en esta fase: los usuarios se crean vía el seeder. **No hay roles** — `requireAuth` solo valida que el usuario esté logueado y activo, para que pueda mantener sus preferencias.
+
+## 1. Variables de entorno
+
+Copiar `backend/.env.example` a `backend/.env` y rellenar:
+
+| Variable | Default | Notas |
+|---|---|---|
+| `NODE_ENV` | `development` | `development` \| `test` \| `production` |
+| `PORT` | `7860` | Puerto del backend (HF Spaces requiere 7860) |
+| `DATABASE_URL` | `file:./polysignal.db` | Path SQLite **relativo a `prisma/schema.prisma`** |
+| `JWT_SECRET` | — (obligatorio) | Mínimo 32 chars. Generar con `openssl rand -hex 48` |
+| `JWT_EXPIRES_IN` | `1h` | Formato `jsonwebtoken` (`1h`, `15m`, `7d`, ...) |
+| `BCRYPT_ROUNDS` | `10` | Entre 4 y 15 |
+| `CORS_ORIGIN` | `http://localhost:5173` | Origen del frontend en dev |
+| `LOG_LEVEL` | `info` | `trace`/`debug`/`info`/`warn`/`error`/`fatal` |
+
+> Si el `.env` falta una variable obligatoria o un valor es inválido, el backend imprime el error y aborta el arranque (validación con Zod en `src/config.js`).
+
+## 2. Primer arranque
+
+Desde `backend/`:
+
+```bash
+npm install                                  # instala deps
+npm run db:migrate -- --name init_auth       # solo la primera vez (ya hecho)
+npm run db:seed                              # crea los 2 usuarios de prueba
+npm run dev                                  # arranca en http://localhost:7860
+```
+
+Para inspeccionar la DB en una UI:
+
+```bash
+npm run db:studio
+```
+
+## 3. Usuarios de prueba
+
+Sembrados por `prisma/seed.js` (idempotente, se puede re-ejecutar):
+
+| Email | Password |
+|---|---|
+| `admin@polysignal.test` | `Admin123!` |
+| `user@polysignal.test`  | `User123!`  |
+
+## 4. Endpoints
+
+### `GET /api/v1/health`
+
+Sanity check. Respuesta:
+
+```json
+{ "ok": true, "data": { "status": "up" } }
+```
+
+### `POST /api/v1/auth/login`
+
+Body:
+
+```json
+{ "email": "admin@polysignal.test", "password": "Admin123!" }
+```
+
+Respuesta `200`:
+
+```json
+{
+  "ok": true,
+  "data": {
+    "token": "eyJhbGciOiJIUzI1NiJ9...",
+    "user": { "id": 1, "email": "admin@polysignal.test" }
+  }
+}
+```
+
+Errores:
+
+| HTTP | code | cuándo |
+|---|---|---|
+| `400` | `VALIDATION_ERROR` | Email inválido o password < 8 chars |
+| `401` | `INVALID_CREDENTIALS` | Email no existe, usuario desactivado, o password incorrecta |
+| `429` | `TOO_MANY_REQUESTS` | Más de 5 intentos en 15 min desde la misma IP |
+
+### `GET /api/v1/auth/me`
+
+Requiere header `Authorization: Bearer <token>`. Respuesta `200`:
+
+```json
+{
+  "ok": true,
+  "data": {
+    "user": {
+      "id": 1,
+      "email": "admin@polysignal.test",
+      "isActive": true,
+      "createdAt": "2026-05-16T07:11:43.000Z"
+    }
+  }
+}
+```
+
+Errores:
+
+| HTTP | code | cuándo |
+|---|---|---|
+| `401` | `UNAUTHORIZED` | Sin header, token mal formado, expirado, manipulado, o usuario desactivado |
+
+## 5. Ejemplos con `curl`
+
+```bash
+# 1) Login y guardar token en variable
+TOKEN=$(curl -s -X POST http://localhost:7860/api/v1/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"email":"admin@polysignal.test","password":"Admin123!"}' \
+  | jq -r '.data.token')
+
+# 2) Llamar a /me con el token
+curl -s http://localhost:7860/api/v1/auth/me \
+  -H "Authorization: Bearer $TOKEN" | jq
+```
+
+## 6. Login desde el frontend (referencia)
+
+El JWT es opaco para el front: basta con guardarlo (sessionStorage o estado en memoria) y enviarlo en cada request protegido.
+
+```js
+const res = await fetch('/api/v1/auth/login', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({ email, password }),
+});
+const json = await res.json();
+if (!json.ok) throw new Error(json.error.code);
+const { token, user } = json.data;
+// guardar token y user
+
+// requests autenticados
+fetch('/api/v1/auth/me', { headers: { Authorization: `Bearer ${token}` } });
+```
+
+> En dev, Vite proxea `/api/*` al backend (`localhost:7860`); no hace falta CORS si va por el proxy, pero ya está configurado por si el front llama directo.
+
+## 7. Cómo proteger nuevos endpoints
+
+```js
+import { requireAuth } from '../middlewares/requireAuth.js';
+
+router.get('/positions', requireAuth, controller.list);
+```
+
+Dentro del controller, `req.user` ya está disponible con `{ id, email, isActive, createdAt }` — suficiente para filtrar datos del usuario logueado (ej. sus preferencias, posiciones, watchlist).
+
+## 8. Rotar `JWT_SECRET`
+
+Genera uno nuevo y reemplaza el valor de `JWT_SECRET` en `backend/.env`:
+
+```bash
+openssl rand -hex 48
+```
+
+Al cambiar el secreto, todos los tokens emitidos previamente quedan invalidados (los clientes deben volver a hacer login).
+
+## 9. Notas técnicas
+
+- **Hashing:** `bcryptjs` (puro JS, sin compilación nativa — más portable a HF Spaces) con coste `BCRYPT_ROUNDS` (default 10).
+- **JWT:** algoritmo `HS256`, claim `sub = user.id`, `email`, `iat`, `exp`.
+- **Rate limit en `/auth/login`:** `express-rate-limit`, 5 intentos / 15 min / IP.
+- **Validación de body:** zod schema en `src/auth/auth.validators.js`.
+- **Errores formateados:** todas las respuestas siguen `{ ok, data }` o `{ ok:false, error:{ code, message, details? } }` vía `src/utils/apiResponse.js` y el middleware `errorHandler`.
+- **Prisma:** singleton en `src/utils/prisma.js` para no abrir conexiones de más con `node --watch`.

backend/package.json

@@ -2,23 +2,34 @@
   "name": "polysignal-backend",
   "version": "1.0.0",
   "description": "Backend API de PolySignal — Hackathon CIFO Barcelona La Violeta",
+  "type": "module",
   "main": "src/index.js",
   "prisma": {
-    "schema": "prisma/schema.prisma"
+    "schema": "prisma/schema.prisma",
+    "seed": "node prisma/seed.js"
   },
   "scripts": {
     "start": "node src/index.js",
     "dev": "node --watch src/index.js",
     "db:migrate": "prisma migrate dev",
     "db:generate": "prisma generate",
+    "db:seed": "node prisma/seed.js",
     "db:studio": "prisma studio"
   },
   "dependencies": {
+    "@prisma/client": "^6.19.2",
+    "bcryptjs": "^2.4.3",
+    "cors": "^2.8.5",
+    "dotenv": "^16.4.5",
     "express": "^5.2.1",
-    "socket.io": "^4.8.3",
+    "express-rate-limit": "^7.4.0",
+    "helmet": "^8.0.0",
+    "jsonwebtoken": "^9.0.2",
     "node-cron": "^4.2.1",
-    "@prisma/client": "^6.19.2",
-    "prisma": "^6.19.2"
+    "pino": "^9.5.0",
+    "prisma": "^6.19.2",
+    "socket.io": "^4.8.3",
+    "zod": "^3.23.8"
   },
   "engines": {
     "node": ">=24.0.0"

backend/prisma/migrations/20260516071158_init_auth/migration.sql

@@ -0,0 +1,105 @@
+-- CreateTable
+CREATE TABLE "User" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "email" TEXT NOT NULL,
+    "passwordHash" TEXT NOT NULL,
+    "role" TEXT NOT NULL DEFAULT 'user',
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "telegramChatId" TEXT,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
+);
+
+-- CreateTable
+CREATE TABLE "Market" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "question" TEXT NOT NULL,
+    "category" TEXT,
+    "countryCode" TEXT,
+    "yesPrice" REAL,
+    "noPrice" REAL,
+    "volumeEur" REAL,
+    "liquidityEur" REAL,
+    "status" TEXT NOT NULL DEFAULT 'active',
+    "closesAt" DATETIME,
+    "lastSynced" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- CreateTable
+CREATE TABLE "AISignal" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "marketId" TEXT NOT NULL,
+    "signal" TEXT NOT NULL,
+    "confidence" REAL NOT NULL,
+    "summary" TEXT,
+    "keyRisk" TEXT,
+    "newsCount" INTEGER NOT NULL DEFAULT 0,
+    "modelVersion" TEXT NOT NULL DEFAULT 'Qwen3-8B',
+    "generatedAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "AISignal_marketId_fkey" FOREIGN KEY ("marketId") REFERENCES "Market" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "Position" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "userId" INTEGER NOT NULL,
+    "marketId" TEXT NOT NULL,
+    "outcome" TEXT NOT NULL,
+    "amountEur" REAL NOT NULL,
+    "entryPrice" REAL NOT NULL,
+    "currentPrice" REAL,
+    "pnl" REAL NOT NULL DEFAULT 0,
+    "kellyFraction" REAL,
+    "status" TEXT NOT NULL DEFAULT 'open',
+    "openedAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "closedAt" DATETIME,
+    CONSTRAINT "Position_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "Position_marketId_fkey" FOREIGN KEY ("marketId") REFERENCES "Market" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "Watchlist" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "userId" INTEGER NOT NULL,
+    "marketId" TEXT NOT NULL,
+    "alertThreshold" REAL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "Watchlist_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "Watchlist_marketId_fkey" FOREIGN KEY ("marketId") REFERENCES "Market" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "Alert" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "userId" INTEGER NOT NULL,
+    "marketId" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "message" TEXT NOT NULL,
+    "sentAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "Alert_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "Alert_marketId_fkey" FOREIGN KEY ("marketId") REFERENCES "Market" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+
+-- CreateIndex
+CREATE INDEX "AISignal_marketId_generatedAt_idx" ON "AISignal"("marketId", "generatedAt");
+
+-- CreateIndex
+CREATE INDEX "Position_userId_status_idx" ON "Position"("userId", "status");
+
+-- CreateIndex
+CREATE INDEX "Position_marketId_idx" ON "Position"("marketId");
+
+-- CreateIndex
+CREATE INDEX "Watchlist_userId_idx" ON "Watchlist"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Watchlist_userId_marketId_key" ON "Watchlist"("userId", "marketId");
+
+-- CreateIndex
+CREATE INDEX "Alert_userId_sentAt_idx" ON "Alert"("userId", "sentAt");
+
+-- CreateIndex
+CREATE INDEX "Alert_marketId_idx" ON "Alert"("marketId");

backend/prisma/migrations/20260516072006_remove_user_role/migration.sql

@@ -0,0 +1,24 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `role` on the `User` table. All the data in the column will be lost.
+
+*/
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_User" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "email" TEXT NOT NULL,
+    "passwordHash" TEXT NOT NULL,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "telegramChatId" TEXT,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
+);
+INSERT INTO "new_User" ("createdAt", "email", "id", "isActive", "passwordHash", "telegramChatId", "updatedAt") SELECT "createdAt", "email", "id", "isActive", "passwordHash", "telegramChatId", "updatedAt" FROM "User";
+DROP TABLE "User";
+ALTER TABLE "new_User" RENAME TO "User";
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

backend/prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "sqlite"

backend/prisma/schema.prisma

@@ -22,8 +22,12 @@ datasource db {
 
 model User {
   id             Int        @id @default(autoincrement())
-  telegramChatId String?             // Configurado manualmente para demo
+  email          String     @unique
+  passwordHash   String
+  isActive       Boolean    @default(true)
+  telegramChatId String?                         // Configurado manualmente para demo
   createdAt      DateTime   @default(now())
+  updatedAt      DateTime   @updatedAt
 
   positions Position[]
   watchlist Watchlist[]

backend/prisma/seed.js

@@ -0,0 +1,32 @@
+import bcrypt from 'bcryptjs';
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+const ROUNDS = Number(process.env.BCRYPT_ROUNDS ?? 10);
+
+const users = [
+  { email: 'admin@polysignal.test', password: 'Admin123!' },
+  { email: 'user@polysignal.test', password: 'User123!' },
+];
+
+const run = async () => {
+  for (const u of users) {
+    const passwordHash = await bcrypt.hash(u.password, ROUNDS);
+    const record = await prisma.user.upsert({
+      where: { email: u.email },
+      update: { passwordHash, isActive: true },
+      create: { email: u.email, passwordHash, isActive: true },
+    });
+    console.log(`seeded user ${record.email} (id=${record.id})`);
+  }
+};
+
+run()
+  .catch((err) => {
+    console.error(err);
+    process.exit(1);
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });

backend/src/app.js

@@ -0,0 +1,22 @@
+import express from 'express';
+import cors from 'cors';
+import helmet from 'helmet';
+import { config } from './config.js';
+import { ok } from './utils/apiResponse.js';
+import authRoutes from './auth/auth.routes.js';
+import { notFound } from './middlewares/notFound.js';
+import { errorHandler } from './middlewares/errorHandler.js';
+
+const app = express();
+
+app.use(helmet());
+app.use(cors({ origin: config.CORS_ORIGIN, credentials: true }));
+app.use(express.json({ limit: '1mb' }));
+
+app.get('/api/v1/health', (_req, res) => ok(res, { status: 'up' }));
+app.use('/api/v1/auth', authRoutes);
+
+app.use(notFound);
+app.use(errorHandler);
+
+export default app;

backend/src/auth/auth.controller.js

@@ -0,0 +1,11 @@
+import * as authService from './auth.service.js';
+import { ok } from '../utils/apiResponse.js';
+
+export const login = async (req, res) => {
+  const data = await authService.login(req.body);
+  ok(res, data);
+};
+
+export const me = async (req, res) => {
+  ok(res, { user: req.user });
+};

backend/src/auth/auth.routes.js

@@ -0,0 +1,13 @@
+import { Router } from 'express';
+import * as ctrl from './auth.controller.js';
+import { loginSchema } from './auth.validators.js';
+import { validate } from '../middlewares/validate.js';
+import { requireAuth } from '../middlewares/requireAuth.js';
+import { rateLimitLogin } from '../middlewares/rateLimitLogin.js';
+
+const router = Router();
+
+router.post('/login', rateLimitLogin, validate(loginSchema), ctrl.login);
+router.get('/me', requireAuth, ctrl.me);
+
+export default router;

backend/src/auth/auth.service.js

@@ -0,0 +1,21 @@
+import bcrypt from 'bcryptjs';
+import { prisma } from '../utils/prisma.js';
+import { HttpError } from '../utils/apiResponse.js';
+import { signToken } from './jwt.js';
+
+const INVALID_CREDENTIALS = new HttpError(401, 'INVALID_CREDENTIALS', 'Email or password is incorrect');
+
+export const login = async ({ email, password }) => {
+  const user = await prisma.user.findUnique({ where: { email } });
+  if (!user || !user.isActive) throw INVALID_CREDENTIALS;
+
+  const passwordOk = await bcrypt.compare(password, user.passwordHash);
+  if (!passwordOk) throw INVALID_CREDENTIALS;
+
+  const token = signToken({ sub: user.id, email: user.email });
+
+  return {
+    token,
+    user: { id: user.id, email: user.email },
+  };
+};

backend/src/auth/auth.validators.js

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+
+export const loginSchema = z.object({
+  email: z.string().email('Invalid email').toLowerCase().trim(),
+  password: z.string().min(8, 'Password must be at least 8 characters'),
+});

backend/src/auth/jwt.js

@@ -0,0 +1,11 @@
+import jwt from 'jsonwebtoken';
+import { config } from '../config.js';
+
+export const signToken = (payload) =>
+  jwt.sign(payload, config.JWT_SECRET, {
+    algorithm: 'HS256',
+    expiresIn: config.JWT_EXPIRES_IN,
+  });
+
+export const verifyToken = (token) =>
+  jwt.verify(token, config.JWT_SECRET, { algorithms: ['HS256'] });

backend/src/config.js

@@ -1,9 +1,23 @@
-/**
- * Configuración centralizada de variables de entorno.
- *
- * Carga los valores de process.env con defaults seguros para desarrollo.
- * Expone constantes como: PORT, DATABASE_URL, HF_TOKEN, FINNHUB_API_KEY,
- * OPENROUTER_API_KEY, TELEGRAM_BOT_TOKEN, NODE_ENV.
- *
- * Evita dispersar process.env por todo el código.
- */
+import 'dotenv/config';
+import { z } from 'zod';
+
+const schema = z.object({
+  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
+  PORT: z.coerce.number().int().positive().default(7860),
+  DATABASE_URL: z.string().min(1, 'DATABASE_URL is required'),
+  JWT_SECRET: z.string().min(32, 'JWT_SECRET must be at least 32 chars'),
+  JWT_EXPIRES_IN: z.string().default('1h'),
+  BCRYPT_ROUNDS: z.coerce.number().int().min(4).max(15).default(10),
+  CORS_ORIGIN: z.string().default('http://localhost:5173'),
+  LOG_LEVEL: z.enum(['trace', 'debug', 'info', 'warn', 'error', 'fatal']).default('info'),
+});
+
+const parsed = schema.safeParse(process.env);
+
+if (!parsed.success) {
+  console.error('Invalid environment variables:');
+  console.error(parsed.error.flatten().fieldErrors);
+  process.exit(1);
+}
+
+export const config = Object.freeze(parsed.data);

backend/src/index.js

@@ -1,9 +1,20 @@
-/**
- * Entry point de la aplicacion PolySignal.
- *
- * Inicializa el servidor Express, configura Socket.io para comunicacion en tiempo real,
- * sirve los archivos estaticos del frontend desde ../frontend/, monta las rutas REST
- * bajo /api/v1/* y arranca el scheduler de node-cron.
- *
- * Puerto por defecto: 7860 (requerido por HuggingFace Spaces).
- */
+import http from 'node:http';
+import app from './app.js';
+import { config } from './config.js';
+import { logger } from './utils/logger.js';
+import { prisma } from './utils/prisma.js';
+
+const httpServer = http.createServer(app);
+
+httpServer.listen(config.PORT, () => {
+  logger.info({ port: config.PORT, env: config.NODE_ENV }, 'PolySignal backend up');
+});
+
+for (const sig of ['SIGTERM', 'SIGINT']) {
+  process.on(sig, async () => {
+    logger.info({ sig }, 'shutting down');
+    httpServer.close();
+    await prisma.$disconnect();
+    process.exit(0);
+  });
+}

backend/src/middlewares/errorHandler.js

@@ -0,0 +1,18 @@
+import { HttpError } from '../utils/apiResponse.js';
+import { logger } from '../utils/logger.js';
+
+export const errorHandler = (err, req, res, _next) => {
+  if (err instanceof HttpError) {
+    return res.status(err.status).json({
+      ok: false,
+      error: { code: err.code, message: err.message, details: err.details },
+    });
+  }
+
+  logger.error({ err, path: req.path, method: req.method }, 'unhandled error');
+
+  return res.status(500).json({
+    ok: false,
+    error: { code: 'INTERNAL', message: 'Internal server error' },
+  });
+};

backend/src/middlewares/notFound.js

@@ -0,0 +1,5 @@
+export const notFound = (req, res) =>
+  res.status(404).json({
+    ok: false,
+    error: { code: 'NOT_FOUND', message: `Route ${req.method} ${req.path} not found` },
+  });

backend/src/middlewares/rateLimitLogin.js

@@ -0,0 +1,12 @@
+import rateLimit from 'express-rate-limit';
+
+export const rateLimitLogin = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 5,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: {
+    ok: false,
+    error: { code: 'TOO_MANY_REQUESTS', message: 'Too many login attempts, try again later' },
+  },
+});

backend/src/middlewares/requireAuth.js

@@ -0,0 +1,29 @@
+import { verifyToken } from '../auth/jwt.js';
+import { prisma } from '../utils/prisma.js';
+import { HttpError } from '../utils/apiResponse.js';
+
+const UNAUTHORIZED = new HttpError(401, 'UNAUTHORIZED', 'Authentication required');
+
+export const requireAuth = async (req, _res, next) => {
+  try {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) throw UNAUTHORIZED;
+
+    const token = header.slice('Bearer '.length).trim();
+    if (!token) throw UNAUTHORIZED;
+
+    const payload = verifyToken(token);
+    const user = await prisma.user.findUnique({
+      where: { id: payload.sub },
+      select: { id: true, email: true, isActive: true, createdAt: true },
+    });
+
+    if (!user || !user.isActive) throw UNAUTHORIZED;
+
+    req.user = user;
+    next();
+  } catch (err) {
+    if (err instanceof HttpError) return next(err);
+    next(UNAUTHORIZED);
+  }
+};

backend/src/middlewares/validate.js

@@ -0,0 +1,12 @@
+import { HttpError } from '../utils/apiResponse.js';
+
+export const validate = (schema, source = 'body') => (req, _res, next) => {
+  const result = schema.safeParse(req[source]);
+  if (!result.success) {
+    return next(
+      new HttpError(400, 'VALIDATION_ERROR', 'Invalid request', result.error.flatten().fieldErrors),
+    );
+  }
+  req[source] = result.data;
+  next();
+};

backend/src/utils/apiResponse.js

@@ -0,0 +1,15 @@
+export const ok = (res, data, meta) =>
+  res.status(200).json(meta ? { ok: true, data, meta } : { ok: true, data });
+
+export const created = (res, data) => res.status(201).json({ ok: true, data });
+
+export const noContent = (res) => res.status(204).end();
+
+export class HttpError extends Error {
+  constructor(status, code, message, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+}

backend/src/utils/logger.js

@@ -0,0 +1,5 @@
+import pino from 'pino';
+
+export const logger = pino({
+  level: process.env.LOG_LEVEL ?? 'info',
+});

backend/src/utils/prisma.js

@@ -0,0 +1,13 @@
+import { PrismaClient } from '@prisma/client';
+
+const globalForPrisma = globalThis;
+
+export const prisma =
+  globalForPrisma.__prisma__ ??
+  new PrismaClient({
+    log: ['warn', 'error'],
+  });
+
+if (process.env.NODE_ENV !== 'production') {
+  globalForPrisma.__prisma__ = prisma;
+}