feat: JSON API voor React SPA onder /api/spa + 401-json voor /api paden

routes/spa/auth.js

@@ -0,0 +1,41 @@
+const express = require('express');
+const router = express.Router();
+const bcrypt = require('bcryptjs');
+const { getDb, logAudit } = require('../../db');
+
+// POST /api/spa/auth/login — JSON login, zet sessie
+router.post('/login', (req, res) => {
+  const { username, password } = req.body || {};
+  if (!username || !password) {
+    return res.status(400).json({ error: 'Gebruikersnaam en wachtwoord zijn verplicht' });
+  }
+  const db = getDb();
+  const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
+  if (!user || !bcrypt.compareSync(password, user.password_hash)) {
+    return res.status(401).json({ error: 'Ongeldige gebruikersnaam of wachtwoord' });
+  }
+  req.session.userId = user.id;
+  req.session.username = user.username;
+  logAudit(user.id, user.username, 'user_login', 'user', user.id, `${user.username} ingelogd via SPA`);
+  res.json({ id: user.id, username: user.username, role: user.role, email: user.email || '' });
+});
+
+// POST /api/spa/auth/logout
+router.post('/logout', (req, res) => {
+  req.session.destroy(() => {
+    res.json({ ok: true });
+  });
+});
+
+// GET /api/spa/auth/me — huidige gebruiker (ook voor sessie-check bij opstarten SPA)
+router.get('/me', (req, res) => {
+  if (!req.session || !req.session.userId) {
+    return res.status(401).json({ error: 'Niet ingelogd' });
+  }
+  const db = getDb();
+  const user = db.prepare('SELECT id, username, email, role FROM users WHERE id = ?').get(req.session.userId);
+  if (!user) return res.status(401).json({ error: 'Niet ingelogd' });
+  res.json(user);
+});
+
+module.exports = router;