server.js

// note: this is a base code, this could be far improved
import express from "express";
import crypto from "crypto";
// import fs from "fs"

const app = express();
app.use(express.json());

const allowedUsers = [{
        id: '123',
        name: 'TestUser'
    },
    {
        id: '456',
        name: 'AnotherUser'
    }
    // you can load a json file for this (db would be far better but this is just a base for u guys to improve on)
    // const allowedUsers = JSON.parse(fs.readFileSync('./users.json', 'utf8'));
];

const activeTokens = new Map();

// generate a token tied to user + fingerprint
function CreateToken(userId, fingerprint) {
    const token = crypto.randomBytes(32).toString('hex');
    activeTokens.set(token, {
        userId,
        fingerprint,
        expires: Date.now() + 60 * 60 * 1000 // this should be self-explanatory but edit it to be like 3-7 days, not 1 hour
    });
    return token;
}

function IsUserAllowed(userId) {
    return allowedUsers.some(u => u.id === String(userId));
}

app.post('/auth', (req, res) => {
    const {
        userId,
        fingerprint
    } = req.body;

    if (!userId || !fingerprint || typeof fingerprint !== 'string') {
        return res.status(400).json({
            ok: false,
            error: 'missing or invalid data'
        });
    }

    if (!IsUserAllowed(userId)) {
        return res.status(403).json({
            ok: false,
            error: 'user not allowed'
        });
    }

    const token = CreateToken(userId, fingerprint);
    res.json({
        ok: true,
        token
    });
});

app.post('/validate', (req, res) => {
    const {
        token,
        fingerprint
    } = req.body;

    if (!token || !fingerprint) {
        return res.json({
            ok: false
        });
    }

    const data = activeTokens.get(token);
    if (!data) return res.json({
        ok: false
    });

    if (data.expires < Date.now()) {
        activeTokens.delete(token);
        return res.json({
            ok: false
        });
    }

    if (data.fingerprint !== fingerprint) {
        return res.json({
            ok: false
        });
    }

    res.json({
        ok: true
    });
});

// this is optional but its a small housekeeping to clear expired tokens
setInterval(() => {
    const now = Date.now();
    for (const [token, data] of activeTokens.entries()) {
        if (data.expires < now) activeTokens.delete(token);
    }
}, 5 * 60 * 1000);

const portending = 8080;
app.listen(portending, () => {
    console.log('auth server running on port: ', portending);
});