# MyNotes — Project Summary

Resume-context doc for continuing work on this project in a new chat.

## What it is

A simple note-taking web app: Express + EJS (server-rendered) + MySQL, with authentication and email notifications via Nodemailer.

**Location:** `C:\Users\ASUS\Documents\JOBS\TRUEHOST\mynotesnodesjs`

## Status

Fully scaffolded and built. Dependencies installed (`node_modules` present). All JS files pass `node --check` syntax validation, all modules load without runtime errors, and all EJS templates compile successfully. **Not yet tested against a real MySQL database or real SMTP credentials** — no MySQL server was available in the build sandbox, so end-to-end login/email flows haven't been run live.

## Features

- **Register**: name/email/password form → bcrypt-hashed password stored → welcome email sent (best-effort, doesn't block registration if email fails).
- **Login (2FA)**: email + password checked first → on success, a 6-digit OTP is generated, stored in the `otps` table, and emailed → user enters the code on a separate `/login/verify-otp` page → session is only established after OTP verification. OTP expires after `OTP_EXPIRY_MINUTES` (default 10). Includes a "Resend code" action.
- **Notes CRUD**: create, list, edit, delete notes, scoped to the logged-in user.
- **Email-a-note**: button on each note sends its title + content to the user's own registered email via Nodemailer.
- **Sessions**: `express-session` backed by MySQL via `express-mysql-session` (auto-creates its own `sessions` table on first run).

## Key design decisions (from earlier clarification)

- OTP flow: password + OTP as two-factor (not OTP-only login).
- Email: generic domain SMTP via env vars `EMAIL_HOST`, `EMAIL_PORT`, `EMAIL_ADDRESS`, `EMAIL_PASSWORD` (not Gmail-specific).
- Sessions: server-side, stored in MySQL (not JWT).
- Password hashing: originally used `bcrypt`, but swapped to **`bcryptjs`** because native `bcrypt` requires compiling against node-gyp/prebuilt binaries, which failed in the sandbox (403s fetching prebuilt binaries/headers). `bcryptjs` is a pure-JS drop-in with the same API (`hash`, `compare`), so no other code changed. Worth knowing if debugging install issues on the target server — if the real server has build tools and unrestricted network, native `bcrypt` would also work, but there's no reason to switch back.

## Project structure

```
mynotesnodesjs/
  app.js                    — entry point: express app, session/store setup, route mounting, error handlers
  config/
    db.js                   — mysql2 connection pool (reads DB_* env vars)
    mailer.js                — nodemailer transporter + sendMail() helper (reads EMAIL_* env vars)
  db/
    schema.sql               — CREATE TABLE for users, notes, otps (sessions table auto-created by express-mysql-session)
  models/
    User.js, Note.js, Otp.js — raw SQL query helpers (no ORM)
  middleware/
    auth.js                  — requireAuth / redirectIfAuth guards
    flash.js                  — lightweight flash-message + currentUser locals (no extra dependency)
  controllers/
    authController.js        — register, login, OTP verify/resend, logout
    notesController.js       — notes CRUD + emailNote
  routes/
    authRoutes.js, notesRoutes.js
  views/
    partials/header.ejs, footer.ejs
    auth/register.ejs, login.ejs, verify-otp.ejs
    notes/index.ejs, new.ejs, edit.ejs
    error.ejs
  public/css/style.css        — plain CSS, no framework
  package.json / package-lock.json / node_modules/  — bcryptjs, dotenv, ejs, express, express-mysql-session,
                                                       express-session, express-validator, method-override,
                                                       mysql2, nodemailer (+ nodemon as dev dep)
  .env.example                — template for required env vars
  README.md                   — setup/run instructions
```

## Environment variables needed (`.env`, not committed)

```
PORT=3000
SESSION_SECRET=<long random string>
DB_NAME=... DB_USER=... DB_PASSWORD=... DB_HOST=... DB_PORT=...
EMAIL_HOST=... EMAIL_PORT=... EMAIL_ADDRESS=... EMAIL_PASSWORD=...
OTP_EXPIRY_MINUTES=10
```

## To run

1. `npm install` (already done in this folder, but rerun if `node_modules` is stale)
2. Create `.env` from `.env.example` and fill in real DB + SMTP credentials
3. Run `db/schema.sql` against the MySQL database named in `DB_NAME`
4. `npm start` (or `npm run dev` for nodemon auto-reload)
5. Visit `http://localhost:3000`

## Known gaps / suggested next steps

- **Never tested against a live MySQL instance or live SMTP** — first priority when resuming should be an end-to-end smoke test: register → check welcome email → login → check OTP email → verify → create/edit/delete a note → email a note to self.
- No automated tests (unit/integration) exist yet.
- No password-reset flow ("forgot password") — only login OTP exists.
- No rate-limiting on login attempts or OTP requests/resends — worth adding before any public deployment.
- No CSRF protection middleware — forms currently rely on session cookies only.
- `express-validator` is installed as a dependency but not yet wired into any route for input validation (currently only manual checks in controllers).
- Leftover partial `node_modules` artifacts from an earlier interrupted copy may still be present as harmless unused folders; not affecting functionality, but a fresh `rm -rf node_modules && npm install` would tidy it up if desired (may need permission — deletes were blocked in this session's sandbox).