[Feature]: Add JWT-based authentication middleware to protect APIs

[04shubham7]

So, what is it about?

Secure backend routes with JWT validation to ensure only authenticated users can create listings or place bids.

Code of Conduct

• I agree to follow this project's Code of Conduct

[ADARSHsri2004]

@04shubham7 assign this to me

[LONECODER1]

@04shubham7 assign this to me

[04shubham7]

@ADARSHsri2004 @LONECODER1 Add description of your approach of solving the issue in all the issues of UniLoot and PeerCall

[LONECODER1]

---

Security Implementation Strategy: JWT Route Validation

Objective

Our goal is simple: to make sure only the right people can create listings or place bids. We'll achieve this by using JSON Web Tokens ($\text{JWT}$) to enforce stateless authentication on those crucial backend routes. Think of the $\text{JWT}$ as a digital passport required for high-value actions.

Implementation Route: A Simple Four-Step Plan

1. Issuing the Passport (Token Issuance):
   When a user successfully logs in, our authentication service will generate a secure, cryptographically signed $\text{JWT}$. This token is their digital passport. It holds their essential information (like their User ID) and an expiration date ($\text{exp}$), meaning it won't be valid forever.

2. The Bouncer (Middleware Development):
   We'll build a specialized Route Guard function—our digital bouncer—that stands watch over the sensitive routes like creating listings ($\text{POST}$ $\text{/listings}$) or placing bids ($\text{POST}$ $\text{/bids}$).

3. Checking Credentials (Request Validation):
   When a request comes in, the "bouncer" intercepts it and performs a quick, strict check:

   • It grabs the $\text{JWT}$ from the $\text{Authorization: Bearer}$ header.
   • It verifies the token's signature using our secret key. This is like checking for a genuine watermark to ensure the token hasn't been tampered with and is authentic.
   • It checks the expiration date. If the passport is expired, they're not getting in.

4. The Green Light or the Door (Authorization Flow):

   • Success: If the token is valid, unexpired, and authentic, the user's identity is noted ($\text{req.user}$), and they are waved through to complete their action.
   • Failure: If the token is missing, invalid, or expired, the request is immediately blocked, and the server returns a polite but firm $\text{401}$ $\text{(Unauthorized)}$ status code.

This process ensures that only genuinely authenticated users with a current $\text{JWT}$ can execute the platform's key privileged actions.

---

[04shubham7]

@LONECODER1 Try to submit the PR fast

[LONECODER1]

Ok will try to submit today