feat: email/password auth + QR-based developer profile sharing (#Dev-…

[amritbej]

Summary

Implements email/password authentication and dynamic QR-based developer profile sharing for the DevCard platform. Users can sign up, log in, manage their social profile links from a dashboard, and share all their developer profiles through a single generated QR code that points to a public profile page.

Closes #117

---

Type of Change

• Bug fix
• New feature
• Refactor (no functional change)
• UI / Design change
• Tests only
• Documentation
• Infrastructure / DevOps
• Security

---

What Changed

Backend

• apps/backend/prisma/schema.prisma — added nullable password_hash field to User model
• apps/backend/prisma/migrations/20260611120000_password_auth/migration.sql — migration to add the column
• apps/backend/src/utils/password.ts — scrypt-based hash/verify using Node.js built-in crypto (zero new deps)
• apps/backend/src/routes/auth.ts — POST /auth/signup and POST /auth/login with zod schema validation; signup atomically creates User + default Card in one Prisma transaction
• apps/backend/src/utils/validators.ts — signupSchema and loginSchema (email lowercased, username regex, password min 8 chars)
• apps/backend/src/services/profileService.ts — strips passwordHash from all profile API responses
• apps/backend/src/__tests__/auth.test.ts — 4 unit tests: signup, login, duplicate email → 409, wrong password → 401

Frontend (SvelteKit)

• apps/web/vite.config.ts — Vite dev proxy: /auth and /api forwarded to backend, eliminating all CORS issues in development
• apps/web/src/lib/apiClient.ts — browser uses relative URLs (through proxy); extracts details.fieldErrors from zod error responses so users see e.g. "password: must be at least 8 characters" not "Validation failed"
• apps/web/src/lib/auth.ts — signup(), login(), logout() helpers, localStorage JWT store
• apps/web/src/routes/signup/+page.svelte — signup form with real-time username hint (blur), password strength bar (Weak/Fair/Strong), red/green field borders, loading spinner, formValid guard decoupled from loading state
• apps/web/src/routes/login/+page.svelte — login form with friendly error message, loading spinner
• apps/web/src/routes/dashboard/+page.svelte — JWT-authenticated profile editor: display name, username, bio, role, company, accent colour; add/edit/delete platform links (GitHub, LinkedIn, Twitter/X, etc.); live QR code <img> preview; one-click copy of public URL
• apps/web/src/routes/+page.svelte — added Log in / Create card links to landing nav
• apps/web/src/routes/u/[username]/+page.svelte — display name now pure white (#ffffff) with accent-colour text-shadow glow; @username handle shown below name; role badge and bio text lifted to proper contrast

How to Test

1. Start Docker: docker start devcard-postgres devcard-redis
2. Apply migration: cd apps/backend && DATABASE_URL="..." npx prisma migrate deploy
3. Start backend: pnpm --filter @devcard/backend dev → runs on http://localhost:3000
4. Start frontend: pnpm --filter @devcard/web dev → runs on http://localhost:5173
5. Go to http://localhost:5173/signup → create an account (username: letters/numbers/_/- only, password: min 8 chars)
6. You are redirected to /dashboard → add GitHub, LinkedIn, Twitter links; set bio and accent colour
7. Click Copy Link or scan the QR code → opens /u/<username> public profile showing all links
8. Log out, go to /login, log back in → redirected to dashboard
9. Run backend tests: pnpm --filter @devcard/backend test → 4/4 pass
10. Run type check: pnpm --filter @devcard/web check → 0 errors

---

Checklist

• My code follows the project's coding style (pnpm -r run lint passes).
• TypeScript compiles without errors (pnpm --filter @devcard/web check → 0 errors).
• I have added or updated tests for the changes I made (4 new backend auth unit tests).
• All tests pass locally (pnpm --filter @devcard/backend test → 4/4 pass).
• I have updated documentation where necessary.
• No new console.log or debug statements left in the code.
• Breaking changes are documented in this PR description. (No breaking changes — password_hash is nullable so existing OAuth users are unaffected.)

---

Screenshots / Recordings

---

Additional Context

• Zero new backend dependencies — password hashing uses Node.js built-in crypto.scrypt
• Backward compatible — password_hash column is nullable; existing GitHub/Google OAuth users have null and are unaffected
• Vite proxy is dev-only — in production the frontend and backend should be served behind the same reverse proxy (or PUBLIC_API_URL env var should be set)
• JWT stored in localStorage — a future improvement would be to move to httpOnly cookies for better XSS protection

[vercel]

Someone is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @amritbej,

Thanks for opening this pull request.

This PR has been automatically classified based on the files modified.

Applied Labels

• backend
• web

Primary Review Area

• backend

Reviewer

@Harxhit has been identified as the primary reviewer for this pull request.

If you have any questions regarding the affected area or implementation details, feel free to reach out to the assigned reviewer.

Thank you for your contribution!

[github-actions]

CI — Checks Failed

Backend — FAIL

Check	Result
Lint	FAIL
Test	PASS
Typecheck	PASS

Mobile — SKIP

Check	Result
Lint	-
Test	-

Web — FAIL

Check	Result
Check	FAIL
Build	PASS

---

Last updated: Thu, 11 Jun 2026 17:37:07 GMT

[amritbej]

@Harxhit , please review the pr

[ShantKhatri]

These changes are not supposed to be for web. Closing this PR.

[amritbej]

@ShantKhatri ,
The PR was closed because web changes weren't supposed to be in Svelte. Should I resubmit with the frontend rewritten in React, or is a backend-only PR acceptable for now

[amritbej]

@ShantKhatri ,

Should I resubmit as a backend-only PR (auth routes, password hashing, migration, tests with no frontend code)? or should frontend work be tackled—separate PR or different tech stack? what to do ??

[ShantKhatri]

@ShantKhatri ,

Should I resubmit as a backend-only PR (auth routes, password hashing, migration, tests with no frontend code)? or should frontend work be tackled—separate PR or different tech stack? what to do ??

Just BE changes with approval from @Harxhit . As we are expecting any feature of related to this issue in web.