Sign Up: The Server in JavaScript

To sign up, the storefront sends the new account's email and password to the server: POST /api/register with a JSON body like {"email": "ben@example.com", "password": "teapot-fan-22"}. The server checks both, stores the account in the users table of shop.db and answers 201 Created.

The table never gets the password itself. hashPassword, given in server/passwords.js, turns it into a hash: a scrambled string with a random salt that can't be turned back into the password. The hash goes in the password_hash column. At login, the server will hash what is typed again and compare.

A route that stores what visitors send checks it first. Wrong input gets 400 with a message that names the field. Input that clashes with what is already stored gets 409 Conflict. Each check returns its answer, so nothing below it runs. A route that checks one field:

app.post("/api/reviews", (req, res) => {
  const stars = req.body.stars;
  if (typeof stars !== "number" || stars < 1 || stars > 5) {
    return res.status(400).json({ error: "Give 1 to 5 stars" });
  }
  res.status(201).json({ stars: stars });
});

The check signs up through the page three times, then sends two requests of its own:

POST /api/register {"email": "ana@example.com", "password": "short"}
   →  400  {"error": "The password needs at least 8 characters"}
POST /api/register {"email": "ana@example.com", "password": "teapot-fan-22"}
   →  409  {"error": "This email already has an account"}
POST /api/register {"email": "ben@example.com", "password": "teapot-fan-22"}
   →  201  (the page goes to /login)
POST /api/register {"email": "cara", "password": "plant-lover-3"}
   →  400  {"error": "Enter a valid email"}
POST /api/register {"email": "cara@example.com"}
   →  400  {"error": "The password needs at least 8 characters"}

Then it prints the users table: 1 | ana@example.com and 2 | ben@example.com, each with scrypt:32768:8:1$<salt>$<hash>, and "the password teapot-fan-22 is nowhere in the table".

Your task: in server/app.js, below the products route, add POST /api/register. Answer 400 for an email that is not a string or has no @, and for a password that is not a string or is shorter than 8 characters. Answer 409 for an email that already has an account. Otherwise store the email and the hash, and answer 201 with id and email.

Assignment
Follow the Coding Tutorial to write the register route: first the way that works (read, hash, insert, answer 201), then the 400 and 409 checks above the hash.

Hint
Look the email up before the INSERT: the email column is UNIQUE, so inserting a taken email throws, and the visitor gets 500 instead of 409. .get() gives undefined when no row matches.