Wiring auth end to end

You have all the pieces: bcrypt for hashing, a register and login controller, a JWT signing step, and two middleware that guard protected routes. Now wire them into the app and prove the whole thing works from the outside.

after/index.ts
typescript
import express from 'express';
import { bookRouter } from './routes/book.routes';
import { authRouter } from './routes/auth.routes';
import { requestLogger, errorHandler } from './middlewares/logger';

export const app = express();

app.use(express.json());
app.use(requestLogger);

app.use('/api/auth', authRouter);
app.use('/api/books', bookRouter);

app.use(errorHandler);

Mount the auth router at /api/auth. The book router already exists from the REST APIs phase.

Validation checklist: Walk the full auth flow with curl

Loading practice…

Three pitfalls to watch for. Forgetting to destructure the password hash in the service leaks it on register. Forgetting next in requireAuth hangs every protected request. Using different error messages for user-not-found and wrong-password leaks valid usernames. Build the habit of checking for all three during code review.

AI prompt: Try it: decode a JWT by hand

Loading practice…

Checkpoint: Auth and security checkpoint

Loading practice…