Security that lives where developers build.

const login = async (req, res) => {
  const { email, password } = req.body;
  const user = await db.query(
    `SELECT * FROM users 
     WHERE email = '${email}' 
     AND password = '${password}'`
  );
  if (user) {
    const token = jwt.sign(
      { id: user.id }, 
      "hardcoded-secret-key"
    );
    res.json({ token });
  }
};

const login = async (req, res) => {
  const { email, password } = req.body;
  const user = await db.query(
    "SELECT * FROM users WHERE email = $1",
    [email]
  );
  if (!user) return res.status(401).end();
  const valid = await bcrypt.compare(
    password, user.passwordHash
  );
  if (!valid) return res.status(401).end();
  const token = jwt.sign(
    { id: user.id },
    process.env.JWT_SECRET
  );
  res.json({ token });
};