featue: Implement OTP-based signup/login with JWT, Gmail templates

[ashishgit10]

Implemented Flow

1️⃣ Signup :
User fills Signup form: name, email, password.
Backend hashes password with bcryptjs.
Backend generates a 6-digit OTP and stores it with an expiry time (5 min).
OTP is sent to the user’s email using a modern HTML template via Nodemailer.
User enters OTP → backend verifies → JWT token issued → user automatically logged in.

2️⃣ Login :
User enters email and password.
Backend validates credentials using bcryptjs.
If credentials are correct and email is verified, a JWT token is issued → user logged in.

3️⃣ Testing :

Signup → OTP email received → OTP verification → JWT issued → logged in
Login → Valid credentials → JWT issued → Access granted
Login → Invalid credentials → Error returned
Signup → Invalid OTP → Error returned

4️⃣ setup NodeMailer :
Create Google app password for Nodemailer

Pull Request

Thank you for your contribution!

Description

Implements OTP-based email verification for signup and login with secure password hashing (bcryptjs) and JWT authentication. OTP emails are sent via Nodemailer using Gmail templates.

Type of Change

• Bug fix
  -✅New feature
• Documentation update
• Refactor
• Other (please describe):

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code where necessary
• I have updated documentation (README, Usage, etc.)
• My changes generate no new warnings or errors
• I have added tests (if applicable)
• All tests pass locally with my changes

[Alexandrbig1]

@ashishgit10, thanks for your PR, i'm working on it. I'll get back to you soon.

[Alexandrbig1]

@ashishgit10, fixes to apply:

• Remove double-hashing: in src/controllers/userLogin/signup.controller.js remove bcrypt.hash and the bcrypt import; create the user with the plain password so the schema pre('save') does the hashing.
• Fix middleware import: in src/middleware/protectMiddleware.routes.js import User from "../models/User.model.js" (was ../models/User.js).
• OTP expiry type: set otpExpiry: new Date(Date.now() + 5 * 60 * 1000) (store as Date).
• Login behavior & error messages: in Login.controller.js return a single generic auth error for user-not-found / bad-password (e.g. "Invalid credentials") and optionally block login until user.isVerified (or explicitly allow it).
• (Recommended) Hash OTP server-side or delete OTP after use, and add input validation + rate limiting to /api/auth endpoints.
• Commands to fetch latest updates and remove package files from this PR

Extra notes

• Ensure required deps (jsonwebtoken, bcryptjs, nodemailer, dotenv) are correctly managed — if you remove package.json from this PR, verify dependency changes are committed elsewhere so CI doesn't break.
• Test it before creating PR.

Thanks — please update the PR once fixed.

[ashishgit10]

Ohk thanks @Alexandrbig1 for the review, I will update you shortly after the fix.😊

[Alexandrbig1]

@ashishgit10, your current PR includes changes in 37 files. Please check once more the description of this task, and improve my suggestion. And don't forget to fetch the latest updates, test locally with your implementation, and run npm run lint to clean all errors if they occur.