Passport.js

// Express setup with local + GitHub strategies
import passport from "passport";
import { Strategy as LocalStrategy } from "passport-local";
import { Strategy as GitHubStrategy } from "passport-github2";
import session from "express-session";

// Session serialization
passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser(async (id, done) => {
  const user = await db.user.findUnique({ where: { id } });
  done(null, user);
});

// Local strategy (email + password)
passport.use(new LocalStrategy({ usernameField: "email" },
  async (email, password, done) => {
    const user = await db.user.findUnique({ where: { email } });
    if (!user || !await bcrypt.compare(password, user.passwordHash))
      return done(null, false, { message: "Invalid credentials" });
    return done(null, user);
  }
));

// GitHub OAuth strategy
passport.use(new GitHubStrategy(
  { clientID: process.env.GITHUB_ID!, clientSecret: process.env.GITHUB_SECRET!, callbackURL: "/auth/github/callback" },
  async (accessToken, refreshToken, profile, done) => {
    const user = await db.user.upsert({
      where: { githubId: profile.id },
      create: { githubId: profile.id, email: profile.emails?.[0].value },
      update: {},
    });
    return done(null, user);
  }
));

// Middleware wiring
app.use(session({ secret: process.env.SESSION_SECRET!, resave: false, saveUninitialized: false }));
app.use(passport.initialize());
app.use(passport.session());

// Routes
app.post("/auth/login", passport.authenticate("local", { successRedirect: "/", failureRedirect: "/login" }));
app.get("/auth/github", passport.authenticate("github", { scope: ["user:email"] }));
app.get("/auth/github/callback", passport.authenticate("github", { successRedirect: "/" }));

// Protect a route
app.get("/dashboard", (req, res) => {
  if (!req.isAuthenticated()) return res.redirect("/login");
  res.json({ user: req.user });
});