Auth: hashing, JWTs, 401 vs 403

Passwords

const hash = await bcrypt.hash(password, 10);
const ok = await bcrypt.compare(password, user.passwordHash);   // await it!
if (!ok) return res.status(401).json({ error: "Invalid credentials" });

• bcrypt.compare returns a Promise. Without await, if (!ok) is never true and every password works.
• Never store or return the plain password or the hash: strip it from responses (select("-password"), or delete before res.json).
• Use one generic message for "no such user" and "wrong password".

Tokens

const token = jwt.sign({ sub: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: "1h" });

const header = req.headers.authorization ?? "";      // "Bearer eyJ…"
const [scheme, raw] = header.split(" ");
if (scheme !== "Bearer" || !raw) return res.status(401).end();
try {
  req.user = jwt.verify(raw, process.env.JWT_SECRET); // throws if bad or expired
} catch {
  return res.status(401).end();
}

401 or 403?

• 401 Unauthorized: we don't know who you are (missing, malformed, expired token).
• 403 Forbidden: we know who you are, and you're not allowed.

const requireRole = (...roles) => (req, res, next) =>
  roles.includes(req.user?.role) ? next() : res.status(403).json({ error: "Forbidden" });

app.delete("/api/users/:id", requireAuth, requireRole("admin"), handler);   // order matters

Ownership

Role checks aren't enough for per-user data: GET /orders/:id must also check order.userId === req.user.sub, or any logged-in user reads anyone's orders.