MERN Users Auth

Full-stack MERN authentication project with a user-facing client, an admin dashboard, and a Node/Express API. The API uses JWT access/refresh tokens, email verification, and role-based admin endpoints.

Apps

• server: Express + MongoDB API (JWT auth, refresh tokens, user management)
• client: React (Vite) user-facing web app
• admin: React (Vite) admin dashboard

Prerequisites

• Node.js + npm
• MongoDB instance (local or Atlas)

Environment Variables

server/.env

Required:

BUILD_MODE=development
MONGO_URI=mongodb+srv://USER:PASSWORD@cluster/db
MONGO_DB_NAME=mern_users_auth
JWT_ACCESS_SECRET=your_access_secret
JWT_REFRESH_SECRET=your_refresh_secret
ACCESS_TOKEN_EXPIRE=15m
REFRESH_TOKEN_EXPIRE=7d

Optional (recommended for local dev):

PORT=8080
LOCAL_DEV_PORT=5000
LOCAL_DEV_HOST=localhost
CORS_ORIGINS=http://localhost:5173,http://localhost:5174
SERVER_URL=http://localhost:5000
CLIENT_URL=http://localhost:5173
ADMIN_URL=http://localhost:5174
EMAIL_HOST=smtp.example.com
EMAIL_PORT=587
EMAIL_USER=your_email
EMAIL_PASS=your_email_password
AUTHOR=your_name

Notes:

• In development, the server uses LOCAL_DEV_PORT (defaults to 5000). In production it uses PORT.
• CORS_ORIGINS is a comma-separated list.

client/.env (optional)

VITE_API_URL=http://localhost:5000/api

Defaults to http://localhost:5000/api if not set.

admin/.env (optional)

VITE_API_URL=http://localhost:5000/api

Defaults to http://localhost:5000/api if not set.

Install

Run these in separate terminals:

cd server && npm install
cd ../client && npm install
cd ../admin && npm install

Run (Dev)

cd server && npm run dev
cd client && npm run dev
cd admin && npm run dev

Default local ports:

• API: http://localhost:5000/api
• Client: http://localhost:5173
• Admin: http://localhost:5174

Scripts

Server

• npm run dev - start with nodemon
• npm start - start with node

Client/Admin

• npm run dev - start Vite dev server
• npm run build - production build
• npm run preview - preview build
• npm run lint - lint

API Overview

Base path: /api

Auth:

• POST /auth/register
• GET /auth/verify-email
• POST /auth/login
• POST /auth/refresh-token
• DELETE /auth/logout

Client:

• GET /user-profile (auth required)

Admin:

• GET /admin/dashboard (admin + staff)
• GET /admin/users (admin + staff)
• POST /admin/users (admin only)
• PATCH /admin/users/:id (admin only)
• DELETE /admin/users/:id (admin only)
• PATCH /admin/users/:id/lock (admin only)

Notes

• The server mounts routes under /api.
• The admin dashboard redirect uses ADMIN_URL.