Improve user session management and authentication for enhanced security

Integrates Passport.js sessions and updates authentication middleware logic in `auth.ts` and `routes.ts`.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: c5f0c281-8dd8-4846-b452-4a07bcd21062
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9777c70b-fc38-4831-8d6b-78dfffe041b0/d1d8abd3-0b74-4353-84ac-e56e863e16e5.jpg

server/middleware/auth.ts

@@ -6,18 +6,16 @@ export interface AuthenticatedRequest extends Request {
 }
 
 export const authMiddleware = async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
-  if (!req.user) {
+  if (!req.isAuthenticated || !req.isAuthenticated()) {
     return res.status(401).json({ error: 'Authentication required' });
   }
   
   try {
-    // Refresh user data from database
+    // User is already available from Passport session
-    const user = await storage.getUser(req.user.id);
+    if (!req.user) {
-    if (!user) {
       return res.status(401).json({ error: 'User not found' });
     }
     
-    req.user = user;
     next();
   } catch (error) {
     console.error('Auth middleware error:', error);

server/routes.ts

@@ -76,6 +76,22 @@ passport.deserializeUser(async (id: number, done) => {
 });
 
 export async function registerRoutes(app: Express): Promise<Server> {
+  // Session configuration
+  app.use(session({
+    secret: process.env.SESSION_SECRET || 'menassist-secret-key-2025',
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      secure: false, // Set to true in production with HTTPS
+      httpOnly: true,
+      maxAge: 24 * 60 * 60 * 1000 // 24 hours
+    }
+  }));
+
+  // Initialize Passport
+  app.use(passport.initialize());
+  app.use(passport.session());
+
   // Apply security middleware
   app.use(securityMiddleware);
   app.use(compressionMiddleware);