En ligne, avec une vraie base

api-taches/
├── package.json
├── server.js              # Express : json, cookies, static, routers, erreurs
├── db.js                  # SQLite (node:sqlite)        → Postgres (pg)
├── auth.js                # hashPassword, verifyPassword : ne bouge pas
├── middleware/
│   └── requireAuth.js     # devient async
├── routes/
│   ├── auth.js            # devient async
│   └── tasks.js           # devient async
├── public/                # la to-do et login.html : ne bougent pas
├── data.db                # va disparaître
└── .gitignore

node_modules/
data.db
.env

# Les réglages de TON ordi. Ce fichier ne part jamais sur GitHub.
PORT=3000

"scripts": {
  "dev": "node --watch --env-file-if-exists=.env server.js",
  "start": "node --env-file-if-exists=.env server.js"
},

# Copie ce fichier en .env et remplis les valeurs
PORT=3000
DATABASE_URL=

PORT=3000
DATABASE_URL=postgresql://neondb_owner:AbC123dEf@ep-cool-darkness-a1b2c3d4-pooler.eu-central-1.aws.neon.tech/neondb?sslmode=verify-full&channel_binding=require

import pg from "pg";

const client = new pg.Client({ connectionString: process.env.DATABASE_URL });
await client.connect();

const { rows } = await client.query("SELECT now() AS heure, version()");
console.log(rows[0]);

await client.end();

$ npm install pg
$ node --env-file=.env test-db.js

import pg from "pg";

const { Pool } = pg;

if (!process.env.DATABASE_URL) {
  throw new Error("DATABASE_URL manquante : vérifie ton fichier .env");
}

export const db = new Pool({
  connectionString: process.env.DATABASE_URL,
});

db.on("error", (err) => {
  console.error("Connexion Postgres perdue :", err.message);
});

CREATE TABLE IF NOT EXISTS users (
  id SERIAL PRIMARY KEY,
  email TEXT NOT NULL UNIQUE,
  password_hash TEXT NOT NULL,
  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE IF NOT EXISTS sessions (
  token TEXT PRIMARY KEY,
  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  expires_at TIMESTAMPTZ NOT NULL
);

CREATE TABLE IF NOT EXISTS tasks (
  id SERIAL PRIMARY KEY,
  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  text TEXT NOT NULL,
  done BOOLEAN NOT NULL DEFAULT false,
  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

import { readFileSync } from "node:fs";
import { db } from "./db.js";

const sql = readFileSync("schema.sql", "utf8");
await db.query(sql);
console.log("Tables prêtes : users, sessions, tasks");

await db.end();

"scripts": {
  "dev": "node --watch --env-file-if-exists=.env server.js",
  "start": "node --env-file-if-exists=.env server.js",
  "db:init": "node --env-file-if-exists=.env init-db.js"
},

$ npm run db:init

import { db } from "../db.js";

export async function requireAuth(req, res, next) {
  const token = req.cookies.session;
  if (typeof token !== "string") {
    return res.status(401).json({ error: "Connecte-toi d'abord" });
  }

  const { rows } = await db.query(
    `SELECT users.id, users.email
     FROM sessions
     JOIN users ON users.id = sessions.user_id
     WHERE sessions.token = $1 AND sessions.expires_at > now()`,
    [token]
  );

  if (rows.length === 0) {
    return res.status(401).json({ error: "Session expirée, reconnecte-toi" });
  }

  req.user = rows[0];
  next();
}

import { Router } from "express";
import { randomBytes } from "node:crypto";
import { db } from "../db.js";
import { hashPassword, verifyPassword } from "../auth.js";
import { requireAuth } from "../middleware/requireAuth.js";

const router = Router();

const SESSION_DURATION = 30 * 24 * 60 * 60 * 1000; // 30 jours, en millisecondes
const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

const cookieOptions = {
  httpOnly: true,
  sameSite: "lax",
  secure: process.env.NODE_ENV === "production",
};

// Crée une session en base et pose le cookie dans la réponse
async function startSession(res, userId) {
  // Au passage, on fait le ménage dans les sessions expirées
  await db.query("DELETE FROM sessions WHERE expires_at <= now()");

  const token = randomBytes(32).toString("hex");
  const expiresAt = new Date(Date.now() + SESSION_DURATION);
  await db.query(
    "INSERT INTO sessions (token, user_id, expires_at) VALUES ($1, $2, $3)",
    [token, userId, expiresAt]
  );

  res.cookie("session", token, { ...cookieOptions, maxAge: SESSION_DURATION });
}

router.post("/register", async (req, res) => {
  const { email, password } = req.body ?? {};

  if (typeof email !== "string" || !EMAIL_REGEX.test(email.trim())) {
    return res.status(400).json({ error: "Email invalide" });
  }
  if (typeof password !== "string" || password.length < 8) {
    return res.status(400).json({ error: "Le mot de passe doit faire au moins 8 caractères" });
  }

  const cleanEmail = email.trim().toLowerCase();
  const existing = await db.query("SELECT id FROM users WHERE email = $1", [cleanEmail]);
  if (existing.rows.length > 0) {
    return res.status(409).json({ error: "Un compte existe déjà avec cet email" });
  }

  const { rows } = await db.query(
    "INSERT INTO users (email, password_hash) VALUES ($1, $2) RETURNING id, email",
    [cleanEmail, hashPassword(password)]
  );

  await startSession(res, rows[0].id);
  res.status(201).json(rows[0]);
});

router.post("/login", async (req, res) => {
  const { email, password } = req.body ?? {};
  if (typeof email !== "string" || typeof password !== "string") {
    return res.status(400).json({ error: "Email et mot de passe obligatoires" });
  }

  const { rows } = await db.query(
    "SELECT id, email, password_hash FROM users WHERE email = $1",
    [email.trim().toLowerCase()]
  );
  const user = rows[0];

  // Même réponse que l'email ou le mot de passe soit faux
  if (!user || !verifyPassword(password, user.password_hash)) {
    return res.status(401).json({ error: "Email ou mot de passe incorrect" });
  }

  await startSession(res, user.id);
  res.json({ id: user.id, email: user.email });
});

router.post("/logout", async (req, res) => {
  const token = req.cookies.session;
  if (typeof token === "string") {
    await db.query("DELETE FROM sessions WHERE token = $1", [token]);
  }
  res.clearCookie("session", cookieOptions);
  res.status(204).end();
});

router.get("/me", requireAuth, (req, res) => {
  res.json(req.user);
});

export default router;

import { Router } from "express";
import { db } from "../db.js";
import { requireAuth } from "../middleware/requireAuth.js";

const router = Router();

// Toutes les routes de ce fichier exigent d'être connecté
router.use(requireAuth);

function isValidText(text) {
  return typeof text === "string" && text.trim() !== "" && text.trim().length <= 200;
}

// Un id valide : un entier positif qui tient dans un INTEGER Postgres.
// Sinon null, et la requête ne trouvera rien (404).
function parseId(value) {
  const id = Number(value);
  return Number.isInteger(id) && id > 0 && id < 2 ** 31 ? id : null;
}

router.get("/", async (req, res) => {
  const { done } = req.query;
  let result;
  if (done === "true" || done === "false") {
    result = await db.query(
      "SELECT id, text, done FROM tasks WHERE user_id = $1 AND done = $2 ORDER BY id",
      [req.user.id, done === "true"]
    );
  } else {
    result = await db.query(
      "SELECT id, text, done FROM tasks WHERE user_id = $1 ORDER BY id",
      [req.user.id]
    );
  }
  res.json(result.rows);
});

router.get("/:id", async (req, res) => {
  const id = parseId(req.params.id);
  const { rows } = await db.query(
    "SELECT id, text, done FROM tasks WHERE id = $1 AND user_id = $2",
    [id, req.user.id]
  );
  if (rows.length === 0) {
    return res.status(404).json({ error: "Tâche introuvable" });
  }
  res.json(rows[0]);
});

router.post("/", async (req, res) => {
  const { text } = req.body ?? {};
  if (!isValidText(text)) {
    return res.status(400).json({ error: "Le texte doit faire entre 1 et 200 caractères" });
  }
  const { rows } = await db.query(
    "INSERT INTO tasks (user_id, text) VALUES ($1, $2) RETURNING id, text, done",
    [req.user.id, text.trim()]
  );
  res.status(201).json(rows[0]);
});

router.patch("/:id", async (req, res) => {
  const id = parseId(req.params.id);
  const { text, done } = req.body ?? {};

  if (text !== undefined && !isValidText(text)) {
    return res.status(400).json({ error: "Le texte doit faire entre 1 et 200 caractères" });
  }
  if (done !== undefined && typeof done !== "boolean") {
    return res.status(400).json({ error: "done doit valoir true ou false" });
  }

  const found = await db.query(
    "SELECT id, text, done FROM tasks WHERE id = $1 AND user_id = $2",
    [id, req.user.id]
  );
  const task = found.rows[0];
  if (!task) {
    return res.status(404).json({ error: "Tâche introuvable" });
  }

  const newText = text !== undefined ? text.trim() : task.text;
  const newDone = done !== undefined ? done : task.done;
  const { rows } = await db.query(
    "UPDATE tasks SET text = $1, done = $2 WHERE id = $3 AND user_id = $4 RETURNING id, text, done",
    [newText, newDone, id, req.user.id]
  );
  res.json(rows[0]);
});

router.delete("/:id", async (req, res) => {
  const id = parseId(req.params.id);
  const result = await db.query(
    "DELETE FROM tasks WHERE id = $1 AND user_id = $2",
    [id, req.user.id]
  );
  if (result.rowCount === 0) {
    return res.status(404).json({ error: "Tâche introuvable" });
  }
  res.status(204).end();
});

export default router;

POST http://localhost:3000/api/auth/register
Content-Type: application/json

{ "email": "alex@exemple.com", "password": "motdepasse123" }

###
POST http://localhost:3000/api/tasks
Content-Type: application/json

{ "text": "Déployer sur Render" }

###
PATCH http://localhost:3000/api/tasks/1
Content-Type: application/json

{ "done": true }

###
GET http://localhost:3000/api/tasks?done=true

###
GET http://localhost:3000/api/tasks/abc

const app = express();
const PORT = process.env.PORT || 3000;

// Sur Render, ton serveur est derrière un proxy qui gère le HTTPS
app.set("trust proxy", 1);

app.use(express.json());

# Vérifie d'abord que .env n'apparaît PAS dans la liste
$ git status

# Si le dossier n'est pas encore un dépôt Git
$ git init

$ git add .
$ git commit -m "Passe sur Postgres et prépare la mise en ligne"

# Crée un dépôt vide api-taches sur GitHub, puis (remplace TON-PSEUDO)
$ git remote add origin https://github.com/TON-PSEUDO/api-taches.git
$ git branch -M main
$ git push -u origin main

Name              api-taches
Language          Node
Branch            main
Region            Frankfurt (EU Central)
Root Directory    (vide)
Build Command     npm install
Start Command     npm start
Instance Type     Free

Environment Variables
DATABASE_URL      postgresql://neondb_owner:...@ep-...-pooler.eu-central-1.aws.neon.tech/neondb?sslmode=verify-full&channel_binding=require
NODE_ENV          production

import express from "express";
import cookieParser from "cookie-parser";
import { db } from "./db.js";
import authRouter from "./routes/auth.js";
import tasksRouter from "./routes/tasks.js";

// ... app, trust proxy, json, cookies, logger, static : sans changement ...

// Le serveur répond ET la base répond ?
app.get("/api/health", async (req, res) => {
  await db.query("SELECT 1");
  res.json({ status: "ok", time: new Date().toISOString() });
});

app.use("/api/auth", authRouter);
app.use("/api/tasks", tasksRouter);

# Remplace par TON adresse Render
$ curl https://api-taches.onrender.com/api/health

# Sans cookie, la liste des tâches doit être refusée
$ curl -i https://api-taches.onrender.com/api/tasks

# 1. Tu modifies, tu testes en local
$ npm run dev

# 2. Tu enregistres et tu envoies
$ git add .
$ git commit -m "Ajoute un compteur de tâches restantes"
$ git push

# 3. Render voit le push, refait npm install puis npm start
# 4. Deux ou trois minutes plus tard, c'est en ligne

# api-taches

Une to-do list avec comptes : Node.js, Express, Postgres.
En ligne : https://api-taches.onrender.com

## Lancer en local

1. `npm install`
2. Copie `.env.example` en `.env` et mets ta connection string Neon dans `DATABASE_URL`
3. `npm run db:init` (crée les tables)
4. `npm run dev`, puis ouvre http://localhost:3000

## Hébergement

- Serveur : Render (Web Service, plan Free)
- Base : Postgres sur Neon (plan Free)