From b20eec366f6a9baba7a0aee2387d246a79ed41c5 Mon Sep 17 00:00:00 2001
From: Giuseppe Lombardo <kontakt@digitalschmiede.tech>
Date: Wed, 12 Aug 2026 17:45:55 +0000
Subject: [PATCH] update backend/src/routes/auth.ts

---
 backend/src/routes/auth.ts | 40 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 backend/src/routes/auth.ts

diff --git a/backend/src/routes/auth.ts b/backend/src/routes/auth.ts
new file mode 100644
index 0000000..a8a9c51
--- /dev/null
+++ b/backend/src/routes/auth.ts
@@ -0,0 +1,40 @@
+import { Router, Request, Response } from 'express';
+import { PrismaClient } from '@prisma/client';
+import bcrypt from 'bcryptjs';
+import { signAuthToken, requireAuth, AuthedRequest } from '../middleware/auth';
+
+const prisma = new PrismaClient();
+
+export const authRouter = Router();
+
+function publicUser(u: { id: string; email: string; fullName: string; role: string; roomId: string | null }) {
+  return { id: u.id, email: u.email, fullName: u.fullName, role: u.role, roomId: u.roomId };
+}
+
+// POST /v1/auth/login  { email, password } -> { token, user }
+authRouter.post('/auth/login', async (req: Request, res: Response) => {
+  const { email, password } = req.body || {};
+  if (!email || !password) {
+    return res.status(400).json({ error: 'E-Mail und Passwort erforderlich' });
+  }
+
+  const user = await prisma.user.findUnique({ where: { email: String(email).toLowerCase().trim() } });
+  if (!user) {
+    return res.status(401).json({ error: 'E-Mail oder Passwort falsch' });
+  }
+
+  const passwordOk = await bcrypt.compare(String(password), user.passwordHash);
+  if (!passwordOk) {
+    return res.status(401).json({ error: 'E-Mail oder Passwort falsch' });
+  }
+
+  const token = signAuthToken({ id: user.id, email: user.email, role: user.role });
+  res.status(200).json({ token, user: publicUser(user) });
+});
+
+// GET /v1/auth/me  -> aktuell eingeloggter Nutzer (zur Session-Wiederherstellung)
+authRouter.get('/auth/me', requireAuth, async (req: AuthedRequest, res: Response) => {
+  const user = await prisma.user.findUnique({ where: { id: req.user!.id } });
+  if (!user) return res.status(404).json({ error: 'Nutzer nicht gefunden' });
+  res.status(200).json({ user: publicUser(user) });
+});