Update frontend login page.jsx และ backend

backend/src/middleware/auth.js

@@ -1,37 +1,50 @@
-import jwt from 'jsonwebtoken';
-import { config } from '../config.js';
-import { User, Role, UserRole } from '../db/sequelize.js';
+// FILE: src/middleware/auth.js
+// Authentication & Authorization middleware
+// - JWT-based authentication
+// - Role & Permission enrichment
+// - RBAC (Role-Based Access Control) helpers
+// - Requires User, Role, Permission, UserRole, RolePermission models
+
+import jwt from "jsonwebtoken";
+import { config } from "../config.js";
+import { User, Role, UserRole } from "../db/sequelize.js";
 
 export function signAccessToken(payload) {
-  return jwt.sign(payload, config.JWT.SECRET, { expiresIn: config.JWT.EXPIRES_IN });
+  return jwt.sign(payload, config.JWT.SECRET, {
+    expiresIn: config.JWT.EXPIRES_IN,
+  });
 }
 export function signRefreshToken(payload) {
-  return jwt.sign(payload, config.JWT.REFRESH_SECRET, { expiresIn: config.JWT.REFRESH_EXPIRES_IN });
+  return jwt.sign(payload, config.JWT.REFRESH_SECRET, {
+    expiresIn: config.JWT.REFRESH_EXPIRES_IN,
+  });
 }
 
 export function requireAuth(req, res, next) {
-  if (req.path === '/health') return next();   // อนุญาต health เสมอ
-  const hdr = req.headers.authorization || '';
-  const token = hdr.startsWith('Bearer ') ? hdr.slice(7) : null;
-  if (!token) return res.status(401).json({ error: 'Missing token' });
+  if (req.path === "/health") return next(); // อนุญาต health เสมอ
+  const hdr = req.headers.authorization || "";
+  const token = hdr.startsWith("Bearer ") ? hdr.slice(7) : null;
+  if (!token) return res.status(401).json({ error: "Missing token" });
 
   try {
     req.user = jwt.verify(token, config.JWT.SECRET);
     next();
   } catch {
-    return res.status(401).json({ error: 'Invalid/Expired token' });
+    return res.status(401).json({ error: "Invalid/Expired token" });
   }
 }
 
 export async function enrichRoles(req, _res, next) {
   if (!req.user?.user_id) return next();
-  const rows = await UserRole.findAll({ where: { user_id: req.user.user_id }, include: [{ model: Role }] })
-    .catch(() => []);
-  req.user.roles = rows.map(r => r.role?.role_name).filter(Boolean);
+  const rows = await UserRole.findAll({
+    where: { user_id: req.user.user_id },
+    include: [{ model: Role }],
+  }).catch(() => []);
+  req.user.roles = rows.map((r) => r.role?.role_name).filter(Boolean);
   next();
 }
 
 export function hasPerm(req, perm) {
   const set = new Set(req?.user?.permissions || []);
   return set.has(perm);
-}
+}