feat: complete multi-user RBAC integration, login system, and fix backend API crashing

backend/routes/auth.js

@@ -0,0 +1,64 @@
+const express = require('express');
+const bcrypt = require('bcryptjs');
+const jwt = require('jsonwebtoken');
+const { getUserByUsername } = require('../database');
+const router = express.Router();
+
+const JWT_SECRET = process.env.JWT_SECRET || 'super-secret-backone-key';
+
+router.post('/login', (req, res) => {
+  const { username, password } = req.body;
+  if (!username || !password) {
+    return res.status(400).json({ error: 'Username and password are required' });
+  }
+
+  const user = getUserByUsername(username);
+  if (!user) {
+    return res.status(401).json({ error: 'Invalid credentials' });
+  }
+
+  const isValid = bcrypt.compareSync(password, user.password_hash);
+  if (!isValid) {
+    return res.status(401).json({ error: 'Invalid credentials' });
+  }
+
+  const token = jwt.sign(
+    { id: user.id, username: user.username, role: user.role, site_uuid: user.site_uuid },
+    JWT_SECRET,
+    { expiresIn: '1d' }
+  );
+
+  // Set HttpOnly cookie
+  res.cookie('token', token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    maxAge: 24 * 60 * 60 * 1000 // 1 day
+  });
+
+  res.json({
+    message: 'Login successful',
+    user: { id: user.id, username: user.username, role: user.role, site_uuid: user.site_uuid }
+  });
+});
+
+router.get('/me', (req, res) => {
+  const token = req.cookies?.token;
+  if (!token) {
+    return res.status(401).json({ error: 'Not authenticated' });
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    res.json({ user: decoded });
+  } catch (err) {
+    res.status(401).json({ error: 'Invalid token' });
+  }
+});
+
+router.post('/logout', (req, res) => {
+  res.clearCookie('token');
+  res.json({ message: 'Logged out successfully' });
+});
+
+module.exports = router;