feat: Finished Backend modules

config/cloudinary.js

@@ -0,0 +1,9 @@
+const cloudinary = require('cloudinary').v2;
+
+cloudinary.config({
+    cloud_name: process.env.CLOUDINARY_CLOUD_NAME,
+    api_key: process.env.CLOUDINARY_API_KEY,
+    api_secret: process.env.CLOUDINARY_API_SECRET,
+});
+
+module.exports = cloudinary;

config/db.js

@@ -2,7 +2,7 @@ const mongoose = require('mongoose');
 
 const connectDB = async () => {
   try {
-    const mongoURI = process.env.MONGO_URI || 'mongodb://127.0.0.1:27017/artisan_hub';
+    const mongoURI = process.env.MONGO_URI || 'mongodb://localhost:27017/artisan_hub';
     await mongoose.connect(mongoURI);
     console.log('✅ MongoDB Connected');
   } catch (err) {
@@ -11,4 +11,4 @@ const connectDB = async () => {
   }
 };
 
-module.exports = connectDB;
+module.exports = connectDB;

middleware/auth.js

@@ -0,0 +1,231 @@
+// TODO: Implement auth middleware
+
+const jwt = require('jsonwebtoken');
+const Shop = require('../modules/shops/shop.model'); // adjust path if needed
+const Order = require('../modules/orders/order.model'); // adjust if existsProduct is not defined
+const Product = require('../modules/products/product.model');
+/**
+ * verifyToken
+ * Checks Authorization: Bearer <token>, decodes it,
+ * and attaches { id, role } to req.user.
+ * Usage: router.get('/protected', verifyToken, handler)
+ */
+const verifyToken = (req, res, next) => {
+    try {
+        const authHeader = req.headers.authorization;
+
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            return res.status(401).json({
+                status: 'error',
+                message: 'No token provided'
+            });
+        }
+
+        const token = authHeader.split(' ')[1];
+
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+
+        req.user = {
+            id: decoded.id,
+            role: decoded.role
+        };
+
+        next();
+
+    } catch (error) {
+        return res.status(401).json({
+            status: 'error',
+            message: 'Invalid or expired token'
+        });
+    }
+};
+
+/**
+ * requireRole(...roles)
+ * Factory — checks req.user.role against the allowed list.
+ * Usage: router.get('/admin', verifyToken, requireRole('admin'), handler)
+ */
+const requireRole = (...roles) => {
+    return (req, res, next) => {
+        if (!req.user) {
+            return res.status(401).json({
+                status: `error ${req.user}`, 
+                message: 'Unauthorized'
+            });
+        }
+
+        if (!roles.includes(req.user.role)) {
+            return res.status(403).json({
+                status: 'error',
+                message: 'Forbidden: insufficient permissions'
+            });
+        }
+
+        next();
+    };
+};
+
+/**
+ * isShopOwner
+ * Confirms shop.owner === req.user.id before allowing mutations.
+ * Expects :shopId or :id param that resolves to a Shop document.
+ */
+const isShopOwner = async (req, res, next) => {
+    try {
+        const shopId = req.params.shopId || req.params.id;
+
+        if (!shopId) {
+            return res.status(400).json({
+                status: 'error',
+                message: 'Shop ID is required'
+            });
+        }
+
+        const shop = await Shop.findById(shopId);
+
+        if (!shop) {
+            return res.status(404).json({
+                status: 'error',
+                message: 'Shop not found'
+            });
+        }
+
+        if (shop.owner.toString() !== req.user.id) {
+            return res.status(403).json({
+                status: 'error',
+                message: 'You are not the owner of this shop'
+            });
+        }
+
+        req.shop = shop;
+        next();
+
+    } catch (error) {
+        next(error);
+    }
+};
+
+const isProductOwner = async (req, res, next) => {
+    try {
+        const { id } = req.params;
+
+        const product = await Product.findById(id);
+
+        if (!product) {
+            return res.status(404).json({
+                status: 'error',
+                message: 'Product not found'
+            });
+        }
+
+        const shop = await Shop.findById(product.shop);
+
+        if (!shop) {
+            return res.status(404).json({
+                status: 'error',
+                message: 'Shop not found'
+            });
+        }
+
+        if (shop.owner.toString() !== req.user.id) {
+            return res.status(403).json({
+                status: 'error',
+                message: 'You are not the owner of this product'
+            });
+        }
+
+        req.product = product;
+        req.shop = shop;
+
+        next();
+
+    } catch (error) {
+        next(error);
+    }
+};
+
+/**
+ * isOrderOwner
+ * Confirms order.buyer === req.user.id (buyer access)
+ * OR order.shop.owner === req.user.id (seller access).
+ */
+const isOrderOwner = async (req, res, next) => {
+    try {
+        const orderId = req.params.id;
+
+        const order = await Order.findById(orderId).populate('shop');
+
+        if (!order) {
+            return res.status(404).json({
+                status: 'error',
+                message: 'Order not found'
+            });
+        }
+
+        const isBuyer = order.buyer.toString() === req.user.id;
+        const isSeller = order.shop.owner.toString() === req.user.id;
+
+        if (!isBuyer && !isSeller) {
+            return res.status(403).json({
+                status: 'error',
+                message: 'Access denied'
+            });
+        }
+
+        req.order = order;
+        next();
+
+    } catch (error) {
+        next(error);
+    }
+};
+
+
+/**
+ * verifyWebhookSignature
+ * Validates the PayMongo webhook signature header
+ * using PAYMONGO_WEBHOOK_SECRET from env.
+ */
+const verifyWebhookSignature = (req, res, next) => {
+    try {
+        const signature = req.headers['paymongo-signature'];
+
+        if (!signature) {
+            return res.status(401).json({
+                status: 'error',
+                message: 'Missing webhook signature'
+            });
+        }
+
+        const expected = process.env.PAYMONGO_WEBHOOK_SECRET;
+
+        if (!expected) {
+            return res.status(500).json({
+                status: 'error',
+                message: 'Webhook secret not configured'
+            });
+        }
+
+        // Simple validation (depends on PayMongo format)
+        if (signature !== expected) {
+            return res.status(401).json({
+                status: 'error',
+                message: 'Invalid webhook signature'
+            });
+        }
+
+        next();
+
+    } catch (error) {
+        next(error);
+    }
+};
+
+module.exports = {
+  verifyToken,
+  requireRole,
+  isShopOwner,
+  isOrderOwner,
+  verifyWebhookSignature,
+  isProductOwner,
+};

middleware/multer.js

@@ -0,0 +1,14 @@
+const multer = require('multer');
+
+const storage = multer.diskStorage({
+  destination: function (req, file, cb) {
+    cb(null, 'uploads/');
+  },
+  filename: function (req, file, cb) {
+    cb(null, Date.now() + '-' + file.originalname);
+  }
+});
+
+const upload = multer({ storage });
+
+module.exports = upload;