The infrastructure that
holds it all together.

// POST /api/users — Secure account creation
export async function createUser(req: Request, res: Response) {
  const { name, email, password, role = 'user' } = req.body;

  if (!name || !email || !password) {
    return res.status(400).json({ error: 'Required fields missing' });
  }

  try {
    const existing = await db.query(
      'SELECT id FROM users WHERE email = ? LIMIT 1',
      [email]
    );
    if (existing.length > 0) {
      return res.status(409).json({ error: 'Email already in use' });
    }

    const hash = await bcrypt.hash(password, 12);

    const result = await db.query(`
      INSERT INTO users (name, email, password_hash, role, created_at)
      VALUES (?, ?, ?, ?, NOW())
    `, [name, email, hash, role]);

    const token = jwt.sign(
      { id: result.insertId, email, role },
      process.env.JWT_SECRET!,
      { expiresIn: '7d' }
    );

    await mailer.send({ to: email, template: 'welcome', data: { name } });

    return res.status(201).json({ success: true, token });

  } catch (err) {
    console.error('[createUser]', err);
    return res.status(500).json({ error: 'Server error' });
  }
}