المصادقة (Authentication)

import jwt from "jsonwebtoken";

const token = jwt.sign(
  { userId: user.id },
  process.env.JWT_SECRET,
  { expiresIn: "1h" }
);
res.json({ token });

Authorization: Bearer eyJhbGci...

function auth(req, res, next) {
  const token = req.headers.authorization?.split(" ")[1];
  if (!token) return res.status(401).json({ error: "غير مصادَق" });
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ error: "رمز غير صالح" });
  }
}

app.get("/profile", auth, (req, res) => res.json(req.user));