Your AI built it.
We'll make it work.

app.post('/login', async (req, res) => {
  const { email, password } = req.body;

  const user = await db.query(
    `SELECT * FROM users
     WHERE email = '${email}'`
  );

  if (user && password === user.password) {
    res.json({ token: user.id });
  } else {
    res.json({ error: 'Wrong password' });
  }
});

app.post('/login',
  rateLimit({ window: '15m', max: 5 }),
  validate(loginSchema),
  async (req, res) => {
    const user = await User.findOne({
      where: { email: req.body.email }
    });

    if (!user || !await bcrypt.compare(
      req.body.password, user.passwordHash
    )) {
      return res.status(401).json({
        error: 'Invalid credentials'
      });
    }

    const token = jwt.sign(
      { sub: user.id, role: user.role },
      process.env.JWT_SECRET,
      { expiresIn: '1h' }
    );
    res.json({ token });
  }
);