auth.js

const express = require('express')
const mongoose = require('mongoose')
const bodyParser = require('body-parser')


const app = express()
const router = express.Router()

async function privateRoute(req, res, next) {
  const token = req.header('Auth')

  const session = await req.model.session
    .findOne({ token })
    .populate('user_id', '_id')

  if (session) {
    req.user = session.user_id

    return next()
  }

  res
    .status(404)
    .send({ message: 'Token not fount' })
}

router.get('/me', privateRoute, async function (req, res) {
  try {
    const user = await req.model.user.findById(req.user._id)

    res.send(user)
  }
  catch (error) {
    res.send(error)
  }
})

router.post('/login', async function (req, res) {
  try {
    const { login, password } = req.body
    const user = await req.model.user.findOne({ login, password })
  
    if (user) {
      const token  = (Date.now() + login).toString(16)
  
      await req.model.session
        .findOneAndUpdate(
          { user_id: user._id },
          { token, user_id: user._id },
          { upsert: true, new: true, runValidators: true },
        )
  
      res.status(200).send({ token })
    }

    res.status(404).send({ error: 'Invalid login or password' })
  }
  catch (error) {
    res.status(500).send({ error })
  }
})

const opt = {
  useNewUrlParser: true,
  promiseLibrary: true,
}

const schemes = {
  user: new mongoose.Schema({
    login: String,
    password: String,
  }),
  session: new mongoose.Schema({
    token: String,
    user_id: { type: mongoose.Schema.Types.ObjectId, ref: 'users' },
  }),
}

async function main() {
  try {
    await mongoose.connect('mongodb://localhost:27017/example', opt)
    const model = {
      user: mongoose.model('users', schemes.user),
      session: mongoose.model('sessions', schemes.session),
    }

    app.use(bodyParser.json())

    app.use((req, res, next) => {
      req.model = model

      return next()
    })

    app.use(router)

    app.listen('9000', () => {
      console.log('server run')
    })
  }
  catch (error) {
    console.log('error')
  }
}

main()