User & Shop Authentication

Relevant source files

The following files were used as context for generating this wiki page:

• backend/controller/user.js
• backend/controller/shop.js
• backend/utils/jwtToken.js
• backend/utils/shopToken.js
• backend/utils/sendMail.js
• frontend/src/pages/Login.jsx
• frontend/src/pages/SignupPage.jsx
• backend/middleware/auth.js
• frontend/src/components/Shop/ShopCreate.jsx
• frontend/src/components/Shop/ShopLogin.jsx

The authentication system is a core component of the e-commerce platform, responsible for managing the identity and access control for two distinct types of entities: Users (customers) and Shops (sellers). It employs a secure, token-based authentication mechanism using JSON Web Tokens (JWT) for session management. A key security feature is the mandatory email verification process for all new account registrations, which ensures the validity of user and shop emails before granting access.

The architecture maintains a clear separation between the authentication flows for users and shops, using different API endpoints, tokens, and cookies for each. This ensures that user and seller sessions are managed independently, providing a robust and secure foundation for the platform's multi-role environment.

Registration and Activation

The registration process is a two-step flow involving initial data submission followed by email-based account activation. This applies to both regular users and shops.

User Registration

A new user registers through the SignupPage.jsx component. The process involves creating a temporary activation token that is emailed to the user. The account is only created in the database after the user clicks the activation link and provides a password.

The following sequence diagram illustrates the user registration and activation flow.

Shop Registration

The shop registration process mirrors the user registration flow but uses dedicated endpoints and components (ShopCreate.jsx). It collects shop-specific information like shop name, address, and phone number.

The following sequence diagram illustrates the shop registration and activation flow.

Login Process

Once an account is activated, users and shops can log in using their email and password. A successful login results in a JWT being issued and stored in an HTTP-only cookie.

The login flow is depicted below.

JWT and Session Management

Session management is handled via JWTs stored in cookies. The system uses two separate tokens and cookies to differentiate between user and shop sessions.

Token Name	Cookie Name	Used For	Utility Function	Source File
token	token	Users	sendToken	backend/utils/jwtToken.js
seller_token	seller_token	Shops	sendShopToken	backend/utils/shopToken.js

Sources: backend/middleware/auth.js:8,18, backend/utils/jwtToken.js, backend/utils/shopToken.js

The sendToken and sendShopToken utility functions are responsible for creating the JWT and setting the cookie in the HTTP response. The JWT payload contains the id of the user or shop, and it is signed with a JWT_SECRET from the environment variables.

// Example from backend/utils/jwtToken.js
const sendToken = (user, statusCode, res) => {
  const token = user.getJwtToken();

  // Options for cookies
  const options = {
    expires: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000),
    httpOnly: true,
    sameSite: "none",
    secure: true,
  };

  res.status(statusCode).cookie("token", token, options).json({
    success: true,
    user,
    token,
  });
};

Sources: backend/utils/jwtToken.js:2-17

The cookie is configured to be httpOnly, which prevents client-side JavaScript from accessing it, mitigating XSS attacks.

Authenticated Route Protection

Express middleware is used to protect routes that require authentication. The middleware functions are defined in backend/middleware/auth.js.

Middleware	Description	Source File
isAuthenticated	Checks for a valid token cookie. If valid, it fetches the user from the DB and attaches it to req.user.	backend/middleware/auth.js:8-15
isSeller	Checks for a valid seller_token cookie. If valid, it fetches the shop from the DB and attaches it to req.seller.	backend/middleware/auth.js:18-27
isAdmin	A role-based guard that checks if req.user.role is included in the specified roles (e.g., "Admin").	backend/middleware/auth.js:30-37

The following diagram shows the request flow for a protected route.

Logout

The logout process invalidates the session by clearing the authentication cookie. This is achieved by setting the cookie's expiration date to a time in the past.

• User Logout: GET /api/v2/user/logout clears the token cookie.
• Shop Logout: GET /api/v2/shop/logout clears the seller_token cookie.

Sources: backend/controller/user.js:165-177, backend/controller/shop.js:161-173