Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

// npm install jsonwebtoken bcryptjs

import jwt from 'jsonwebtoken';
import bcrypt from 'bcryptjs';

const JWT_SECRET = process.env.JWT_SECRET; // store in env, never hardcode

const typeDefs = `#graphql
  type AuthPayload {
    token: String!
    user: User!
  }
  type Mutation {
    login(email: String!, password: String!): AuthPayload!
    register(name: String!, email: String!, password: String!): AuthPayload!
  }
`;

// Context function — runs for every request
async function context({ req }) {
  const authHeader = req.headers.authorization || '';
  const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;
  let currentUser = null;
  if (token) {
    try {
      const { userId } = jwt.verify(token, JWT_SECRET);
      currentUser = await db.users.findById(userId);
    } catch { /* invalid/expired token */ }
  }
  return { currentUser, db };
}