Exercise 1: Setting Up Login — Possible Solution
====================================================================

CONFIGURATION
------------------------------
// server.js
const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true },
}));

// routes/auth.js
const bcrypt = require('bcryptjs');

app.post('/admin/login', async (req, res) => {
  const { email, password } = req.body;
  const [rows] = await pool.query('SELECT * FROM admin_users WHERE email = ?', [email]);

  if (rows.length === 0) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  const valid = await bcrypt.compare(password, rows[0].password_hash);
  if (!valid) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  req.session.userId = rows[0].id;
  res.json({ status: 'ok' });
});

CONFIRMATION
------------------------------
Submitting the real admin email with the correct password finds the
matching row, bcrypt.compare() returns true, and req.session.userId
is set - a real session now exists. Submitting the same email with
any incorrect password causes bcrypt.compare() to return false, and
the endpoint responds with a 401 and no session is created.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly configures express-session and the login route, and
correctly traces both the success and failure paths through
bcrypt.compare()'s own return value.