From a37e3de6fc02be8299f0a9ad40490d7878821684 Mon Sep 17 00:00:00 2001
From: Louis Sabaricos <lmfsabaricos@yahoo.com>
Date: Sun, 26 Apr 2026 16:16:02 -0700
Subject: [PATCH] Add user authentication

---
 client/package-lock.json          |  17 +---
 client/src/App.jsx                |   4 +-
 client/src/Pages_css/AuthPage.css |  87 ++++++++++++++++
 client/src/components/NavBar.css  |  15 +++
 client/src/components/NavBar.jsx  |  39 +++++++-
 client/src/pages/AuthPage.jsx     | 123 +++++++++++++++++++++++
 package-lock.json                 | 131 ++++++++++++++++++++++++
 package.json                      |   4 +-
 server/controllers/users.js       | 159 ++++++++++++++++++++++++++++++
 server/routes/users.js            |  14 +++
 server/server.js                  |   2 +
 11 files changed, 576 insertions(+), 19 deletions(-)
 create mode 100644 client/src/Pages_css/AuthPage.css
 create mode 100644 client/src/pages/AuthPage.jsx
 create mode 100644 server/controllers/users.js
 create mode 100644 server/routes/users.js

diff --git a/client/package-lock.json b/client/package-lock.json
index e508fcc27..e1c252483 100644
--- a/client/package-lock.json
+++ b/client/package-lock.json
@@ -45,7 +45,6 @@
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -1171,7 +1170,6 @@
           "url": "https://github.com/sponsors/ai"
         }
       ],
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.10.12",
         "caniuse-lite": "^1.0.30001782",
@@ -1427,7 +1425,6 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -1467,7 +1464,6 @@
       "version": "18.3.1",
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -1479,7 +1475,6 @@
       "version": "18.3.1",
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -1644,7 +1639,6 @@
       "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
       "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.4",
@@ -1744,7 +1738,6 @@
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
-      "peer": true,
       "requires": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -2390,7 +2383,6 @@
       "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
       "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
       "dev": true,
-      "peer": true,
       "requires": {
         "baseline-browser-mapping": "^2.10.12",
         "caniuse-lite": "^1.0.30001782",
@@ -2475,8 +2467,7 @@
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
       "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "fsevents": {
       "version": "2.3.3",
@@ -2553,8 +2544,7 @@
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "peer": true
+      "dev": true
     },
     "postcss": {
       "version": "8.5.10",
@@ -2571,7 +2561,6 @@
       "version": "18.3.1",
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
-      "peer": true,
       "requires": {
         "loose-envify": "^1.1.0"
       }
@@ -2580,7 +2569,6 @@
       "version": "18.3.1",
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
-      "peer": true,
       "requires": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -2686,7 +2674,6 @@
       "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
       "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
       "dev": true,
-      "peer": true,
       "requires": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.4",
diff --git a/client/src/App.jsx b/client/src/App.jsx
index b56408803..e852bcd46 100644
--- a/client/src/App.jsx
+++ b/client/src/App.jsx
@@ -8,6 +8,7 @@ import ScanAFlower from './pages/scanAFlower';
 import FlowerGallery from './pages/flowerGallery';
 import DiscoverPage from './pages/discoverPage';
 import IndividualFlowerPage from './pages/individualFlowerPage';
+import AuthPage from './pages/AuthPage';
 import NavBar from './components/NavBar';
 import Footer from './components/Footer';
 
@@ -28,7 +29,8 @@ const App = () => {
         { path: '/dictionary', element: <FlowerDictionary /> },
         { path: '/scan', element: <ScanAFlower /> },
         { path: '/gallery', element: <FlowerGallery /> },
-        { path: '/gallery/:flowerId', element: <IndividualFlowerPage flowers={flowers} /> }
+        { path: '/gallery/:flowerId', element: <IndividualFlowerPage flowers={flowers} /> },
+        { path: '/login', element: <AuthPage /> }
 
     ]);
 
diff --git a/client/src/Pages_css/AuthPage.css b/client/src/Pages_css/AuthPage.css
new file mode 100644
index 000000000..939ea24d4
--- /dev/null
+++ b/client/src/Pages_css/AuthPage.css
@@ -0,0 +1,87 @@
+.auth-page {
+  min-height: 70vh;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  padding: 40px 16px;
+}
+
+.auth-card {
+  width: 100%;
+  max-width: 420px;
+  background-color: #ffffff;
+  border: 1px solid #d9d9d9;
+  border-radius: 12px;
+  padding: 28px;
+  box-shadow: 0 4px 14px rgba(0, 0, 0, 0.12);
+}
+
+.auth-card h1 {
+  margin: 0 0 8px;
+  color: #373d3f;
+  text-align: center;
+}
+
+.auth-subtitle {
+  text-align: center;
+  color: #555;
+  margin-bottom: 24px;
+}
+
+.auth-form {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.auth-form label {
+  font-weight: 600;
+  color: #373d3f;
+}
+
+.auth-form input {
+  padding: 12px;
+  border: 1px solid #bdbdbd;
+  border-radius: 8px;
+  font-size: 1rem;
+}
+
+.auth-form button {
+  margin-top: 12px;
+  padding: 12px;
+  border: none;
+  border-radius: 8px;
+  background-color: #373d3f;
+  color: white;
+  font-size: 1rem;
+  cursor: pointer;
+}
+
+.auth-form button:hover {
+  background-color: #4f5a5d;
+}
+
+.auth-form button:disabled {
+  opacity: 0.7;
+  cursor: not-allowed;
+}
+
+.auth-message {
+  color: #b00020;
+  font-size: 0.9rem;
+  margin: 4px 0;
+}
+
+.auth-toggle {
+  width: 100%;
+  margin-top: 18px;
+  background: none;
+  border: none;
+  color: #2a7abf;
+  cursor: pointer;
+  font-size: 0.95rem;
+}
+
+.auth-toggle:hover {
+  text-decoration: underline;
+}
\ No newline at end of file
diff --git a/client/src/components/NavBar.css b/client/src/components/NavBar.css
index f368bbb76..5a9afa128 100644
--- a/client/src/components/NavBar.css
+++ b/client/src/components/NavBar.css
@@ -81,3 +81,18 @@
     padding: 4px;
     line-height: 1;
 }
+.navbar-auth-button {
+    font-family: Avenir, "Century Gothic", sans-serif;
+    font-size: 0.95rem;
+    color: #373D3F;
+    background: none;
+    border: none;
+    cursor: pointer;
+    padding: 4px 2px;
+    border-bottom: 2px solid transparent;
+}
+
+.navbar-auth-button:hover {
+    color: #2a7abf;
+    border-bottom-color: #2a7abf;
+}
\ No newline at end of file
diff --git a/client/src/components/NavBar.jsx b/client/src/components/NavBar.jsx
index a4c3a4815..130c7b4f2 100644
--- a/client/src/components/NavBar.jsx
+++ b/client/src/components/NavBar.jsx
@@ -1,11 +1,27 @@
 import { NavLink, useNavigate } from 'react-router';
-import { useState } from 'react';
+import { useEffect, useState } from 'react';
 import './NavBar.css';
 
 const NavBar = () => {
     const [query, setQuery] = useState('');
+    const [user, setUser] = useState(null);
     const navigate = useNavigate();
 
+    useEffect(() => {
+        const loadUser = () => {
+            const savedUser = localStorage.getItem('flowerhuntUser');
+            setUser(savedUser ? JSON.parse(savedUser) : null);
+        };
+
+        loadUser();
+
+        window.addEventListener('authChanged', loadUser);
+
+        return () => {
+            window.removeEventListener('authChanged', loadUser);
+        };
+    }, []);
+
     const handleSearch = (e) => {
         e.preventDefault();
         if (query.trim()) {
@@ -14,17 +30,36 @@ const NavBar = () => {
         }
     };
 
+    const handleLogout = () => {
+        localStorage.removeItem('flowerhuntToken');
+        localStorage.removeItem('flowerhuntUser');
+        setUser(null);
+        navigate('/');
+    };
+
     return (
         <nav className="navbar">
             <NavLink to="/" className="navbar-brand">
                 🌸 FlowerHunt
             </NavLink>
+
             <ul className="navbar-links">
                 <li><NavLink to="/discover">Discover Flowers</NavLink></li>
                 <li><NavLink to="/dictionary">Flower Dictionary</NavLink></li>
                 <li><NavLink to="/scan">Scan-A-Flower</NavLink></li>
                 <li><NavLink to="/gallery">Flower Gallery</NavLink></li>
+
+                {user ? (
+                    <li>
+                        <button className="navbar-auth-button" onClick={handleLogout}>
+                            Logout
+                        </button>
+                    </li>
+                ) : (
+                    <li><NavLink to="/login">Login</NavLink></li>
+                )}
             </ul>
+
             <form className="navbar-search" onSubmit={handleSearch}>
                 <input
                     type="text"
@@ -40,4 +75,4 @@ const NavBar = () => {
     );
 };
 
-export default NavBar;
+export default NavBar;
\ No newline at end of file
diff --git a/client/src/pages/AuthPage.jsx b/client/src/pages/AuthPage.jsx
new file mode 100644
index 000000000..54804e0c0
--- /dev/null
+++ b/client/src/pages/AuthPage.jsx
@@ -0,0 +1,123 @@
+import { useState } from "react";
+import { useNavigate } from "react-router";
+import "../Pages_css/AuthPage.css";
+
+const AuthPage = () => {
+  const navigate = useNavigate();
+
+  const [isLogin, setIsLogin] = useState(true);
+  const [formData, setFormData] = useState({
+    username: "",
+    password: "",
+  });
+  const [message, setMessage] = useState("");
+  const [loading, setLoading] = useState(false);
+
+  const handleChange = (event) => {
+    const { name, value } = event.target;
+
+    setFormData((previousData) => ({
+      ...previousData,
+      [name]: value,
+    }));
+  };
+
+  const handleSubmit = async (event) => {
+    event.preventDefault();
+    setMessage("");
+    setLoading(true);
+
+    const endpoint = isLogin ? "/api/users/login" : "/api/users/register";
+
+    try {
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify(formData),
+      });
+
+      const data = await response.json();
+
+      if (!response.ok) {
+        setMessage(data.error || "Something went wrong");
+        setLoading(false);
+        return;
+      }
+
+      localStorage.setItem("flowerhuntToken", data.token);
+      localStorage.setItem("flowerhuntUser", JSON.stringify(data.user));
+
+      window.dispatchEvent(new Event("authChanged"));
+
+      setMessage(data.message || "Success");
+      setLoading(false);
+
+      navigate("/");
+    } catch (error) {
+      console.error("Auth error:", error);
+      setMessage("Could not connect to the server");
+      setLoading(false);
+    }
+  };
+
+  return (
+    <main className="auth-page">
+      <section className="auth-card">
+        <h1>{isLogin ? "Login" : "Create Account"}</h1>
+
+        <p className="auth-subtitle">
+          {isLogin
+            ? "Log in to your FlowerHunt account."
+            : "Create a FlowerHunt account."}
+        </p>
+
+        <form className="auth-form" onSubmit={handleSubmit}>
+          <label htmlFor="username">Username</label>
+          <input
+            id="username"
+            name="username"
+            type="text"
+            value={formData.username}
+            onChange={handleChange}
+            placeholder="Enter username"
+            required
+          />
+
+          <label htmlFor="password">Password</label>
+          <input
+            id="password"
+            name="password"
+            type="password"
+            value={formData.password}
+            onChange={handleChange}
+            placeholder="Enter password"
+            required
+          />
+
+          {message && <p className="auth-message">{message}</p>}
+
+          <button type="submit" disabled={loading}>
+            {loading ? "Please wait..." : isLogin ? "Login" : "Sign Up"}
+          </button>
+        </form>
+
+        <button
+          className="auth-toggle"
+          type="button"
+          onClick={() => {
+            setIsLogin(!isLogin);
+            setMessage("");
+          }}
+        >
+          {isLogin
+            ? "Need an account? Sign up"
+            : "Already have an account? Login"}
+        </button>
+      </section>
+    </main>
+  );
+};
+
+export default AuthPage;
\ No newline at end of file
diff --git a/package-lock.json b/package-lock.json
index 83abd5e89..4eb1a0db2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,9 +9,11 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
+        "bcryptjs": "^3.0.3",
         "cors": "^2.8.6",
         "dotenv": "^17.4.2",
         "express": "^5.2.1",
+        "jsonwebtoken": "^9.0.3",
         "nodemon": "^3.1.14",
         "pg": "^8.20.0"
       }
@@ -51,6 +53,15 @@
         "node": "18 || 20 || >=22"
       }
     },
+    "node_modules/bcryptjs": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-3.0.3.tgz",
+      "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
+      "license": "BSD-3-Clause",
+      "bin": {
+        "bcrypt": "bin/bcrypt"
+      }
+    },
     "node_modules/binary-extensions": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
@@ -111,6 +122,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/buffer-equal-constant-time": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+      "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
+      "license": "BSD-3-Clause"
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -282,6 +299,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/ecdsa-sig-formatter": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
+      "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
     "node_modules/ee-first": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -658,6 +684,91 @@
       "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
       "license": "MIT"
     },
+    "node_modules/jsonwebtoken": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+      "license": "MIT",
+      "dependencies": {
+        "jws": "^4.0.1",
+        "lodash.includes": "^4.3.0",
+        "lodash.isboolean": "^3.0.3",
+        "lodash.isinteger": "^4.0.4",
+        "lodash.isnumber": "^3.0.3",
+        "lodash.isplainobject": "^4.0.6",
+        "lodash.isstring": "^4.0.1",
+        "lodash.once": "^4.0.0",
+        "ms": "^2.1.1",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=12",
+        "npm": ">=6"
+      }
+    },
+    "node_modules/jwa": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
+      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-equal-constant-time": "^1.0.1",
+        "ecdsa-sig-formatter": "1.0.11",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/jws": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
+      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+      "license": "MIT",
+      "dependencies": {
+        "jwa": "^2.0.1",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/lodash.includes": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
+      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isboolean": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
+      "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isinteger": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
+      "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isnumber": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
+      "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isplainobject": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.isstring": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
+      "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.once": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
+      "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
+      "license": "MIT"
+    },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -1067,6 +1178,26 @@
         "node": ">= 18"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
diff --git a/package.json b/package.json
index af8074db0..486521957 100644
--- a/package.json
+++ b/package.json
@@ -21,10 +21,12 @@
   },
   "homepage": "https://github.com/Mairs2/web103_finalproject#readme",
   "dependencies": {
+    "bcryptjs": "^3.0.3",
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
+    "jsonwebtoken": "^9.0.3",
     "nodemon": "^3.1.14",
     "pg": "^8.20.0"
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/users.js b/server/controllers/users.js
new file mode 100644
index 000000000..bc261d5ba
--- /dev/null
+++ b/server/controllers/users.js
@@ -0,0 +1,159 @@
+import bcrypt from "bcryptjs";
+import jwt from "jsonwebtoken";
+import { pool } from "../config/database.js";
+
+const JWT_SECRET = process.env.JWT_SECRET || "flowerhunt-dev-secret";
+
+const createToken = (user) => {
+  return jwt.sign(
+    {
+      id: user.id,
+      username: user.username,
+      user_role: user.user_role,
+    },
+    JWT_SECRET,
+    { expiresIn: "7d" }
+  );
+};
+
+const registerUser = async (req, res) => {
+  try {
+    const { username, password } = req.body;
+
+    if (!username || !password) {
+      return res.status(400).json({
+        error: "Username and password are required",
+      });
+    }
+
+    if (password.length < 6) {
+      return res.status(400).json({
+        error: "Password must be at least 6 characters",
+      });
+    }
+
+    const existingUser = await pool.query(
+      "SELECT id FROM users WHERE username = $1",
+      [username]
+    );
+
+    if (existingUser.rows.length > 0) {
+      return res.status(409).json({
+        error: "Username already exists",
+      });
+    }
+
+    const hashedPassword = await bcrypt.hash(password, 10);
+
+    const { rows } = await pool.query(
+      `INSERT INTO users (username, password, user_role, user_gallery)
+       VALUES ($1, $2, $3, $4::jsonb)
+       RETURNING id, username, user_role, created_at, user_gallery`,
+      [username, hashedPassword, "user", JSON.stringify([])]
+    );
+
+    const user = rows[0];
+    const token = createToken(user);
+
+    res.status(201).json({
+      message: "Account created successfully",
+      token,
+      user,
+    });
+  } catch (error) {
+    console.error("Register error:", error);
+    res.status(500).json({
+      error: "Could not register user",
+    });
+  }
+};
+
+const loginUser = async (req, res) => {
+  try {
+    const { username, password } = req.body;
+
+    if (!username || !password) {
+      return res.status(400).json({
+        error: "Username and password are required",
+      });
+    }
+
+    const { rows } = await pool.query(
+      "SELECT * FROM users WHERE username = $1",
+      [username]
+    );
+
+    if (rows.length === 0) {
+      return res.status(401).json({
+        error: "Invalid username or password",
+      });
+    }
+
+    const user = rows[0];
+    const passwordMatches = await bcrypt.compare(password, user.password);
+
+    if (!passwordMatches) {
+      return res.status(401).json({
+        error: "Invalid username or password",
+      });
+    }
+
+    const safeUser = {
+      id: user.id,
+      username: user.username,
+      user_role: user.user_role,
+      created_at: user.created_at,
+      user_gallery: user.user_gallery,
+    };
+
+    const token = createToken(safeUser);
+
+    res.status(200).json({
+      message: "Login successful",
+      token,
+      user: safeUser,
+    });
+  } catch (error) {
+    console.error("Login error:", error);
+    res.status(500).json({
+      error: "Could not log in user",
+    });
+  }
+};
+
+const getCurrentUser = async (req, res) => {
+  try {
+    const authHeader = req.headers.authorization;
+
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      return res.status(401).json({
+        error: "No token provided",
+      });
+    }
+
+    const token = authHeader.split(" ")[1];
+    const decoded = jwt.verify(token, JWT_SECRET);
+
+    const { rows } = await pool.query(
+      `SELECT id, username, user_role, created_at, user_gallery
+       FROM users
+       WHERE id = $1`,
+      [decoded.id]
+    );
+
+    if (rows.length === 0) {
+      return res.status(404).json({
+        error: "User not found",
+      });
+    }
+
+    res.status(200).json(rows[0]);
+  } catch (error) {
+    console.error("Current user error:", error);
+    res.status(401).json({
+      error: "Invalid or expired token",
+    });
+  }
+};
+
+export { registerUser, loginUser, getCurrentUser };
\ No newline at end of file
diff --git a/server/routes/users.js b/server/routes/users.js
new file mode 100644
index 000000000..2e65261f3
--- /dev/null
+++ b/server/routes/users.js
@@ -0,0 +1,14 @@
+import { Router } from "express";
+import {
+  registerUser,
+  loginUser,
+  getCurrentUser,
+} from "../controllers/users.js";
+
+const router = Router();
+
+router.post("/register", registerUser);
+router.post("/login", loginUser);
+router.get("/me", getCurrentUser);
+
+export default router;
\ No newline at end of file
diff --git a/server/server.js b/server/server.js
index 6ddf10b19..cd63b71b9 100644
--- a/server/server.js
+++ b/server/server.js
@@ -1,6 +1,7 @@
 import express from "express";
 import cors from "cors";
 import flowerRoutes from "./routes/flowers.js";
+import userRoutes from "./routes/users.js";
 
 const app = express();
 
@@ -8,6 +9,7 @@ app.use(express.json());
 app.use(cors());
 
 app.use("/api/flowers", flowerRoutes);
+app.use("/api/users", userRoutes);
 
 app.use((err, req, res, next) => {
   console.error(err.stack);