router.post("/register", async (req, res) => {
  const { email, password } = req.body;
  if (!email || !password) {
    return res.status(400).json({ message: "Email and password are required" });
  }
  if (findByEmail(email)) {
    return res.status(409).json({ message: "Email already in use" });
  }
  const passwordHash = await bcrypt.hash(password, 10);
  const users = readUsers();
  const newUser = {
    id: randomUUID(),
    email,
    passwordHash,
    role: "user",
  };
  users.push(newUser);
  writeUsers(users);
  const token = signToken({
    id: newUser.id,
    email: newUser.email,
    role: newUser.role,
  });
  res.status(201).json({ message: "User registered successfully", token });
});

router.post("/login", async (req, res) => {
  const { email, password } = req.body;
  if (!email || !password) {
    return res.status(400).json({ message: "Email and password are required" });
  }
  const user = findByEmail(email);
  if (!user) {
    return res.status(401).json({ message: "Invalid credentials" });
  }
  const match = await bcrypt.compare(password, user.passwordHash);
  if (!match) {
    return res.status(401).json({ message: "Invalid credentials" });
  }
  const token = signToken({ id: user.id, email: user.email, role: user.role });
  res.json({ message: "Login successful", token });
});