var express = require('express'),
    _ = require('lodash'),
    config = require('./config'),
    jwt = require('jsonwebtoken'),
    // connection = require('express-myconnection'),
    mysql = require('mysql');

var app = module.exports = express.Router();

var conn = mysql.createConnection({
    host: 'localhost',
    user: 'iwapp',
    port: '3306',
    password: 'iwapp3741982351',
    database: 'italian_workflow',
});

function createToken(user) {
    return jwt.sign(_.omit(user, 'password'), config.secret, { expiresIn: 60 * 60 * 5 });
}

app.post('/users', function (req, res) {
    var username = req.body.username;
    var password = req.body.password;

    if (!username || !password) {
        return res.status(400).send("Please enter your username and password");
    }

    var sql = 'SELECT * FROM Users WHERE username = ' + conn.escape(username);
    var query = conn.query(sql, function (err, results) {
        if (err) {
            console.log(err);
            return res.status(400).send("Database error");
        }

        if (results.length > 0) {
            return res.status(400).send("There is already a user with that name");
        }

        var user = _.pick(req.body, 'username', 'password');

        var sql = 'INSERT INTO Users ? ';
        var query = conn.query("INSERT INTO Users set ? ", user, function (err, results) {
            if (err) {
                console.log(err);
                return res.status(400).send("Database error");
            }
            res.status(201).send({
                id_token: createToken(user)
            });
        })
    })
});

app.post('/sessions/create', function (req, res) {
    var username = req.body.username;
    var password = req.body.password;

    if (!username || !password) {
        return res.status(400).send("Please enter your username and password");
    }
    var user = _.pick(req.body, 'username', 'password');

    var query = conn.query("SELECT * FROM Users WHERE username = ? AND password = ? ", [user.username, user.password], function (err, results) {
        if (err) {
            console.log(err);
            return res.status(400).send("Database error");
        }

        if (results.length != 1) {
            return res.status(401).send("The username or password doesn't match");
        }
        res.status(201).send({
            id_token: createToken(user)
        });
    })
});
@@ -135,53 +135,30 @@
     
-// connection = require('express-myconnection
+mysql = require('mysql
 '),%0D
@@ -154,37 +154,38 @@
 ('mysql'),%0D%0A    
-mysql
+bcrypt
  = require('mysq
@@ -180,21 +180,22 @@
 equire('
-mysql
+bcrypt
 ');%0D%0A%0D%0Av
@@ -417,16 +417,42 @@
 %0A%7D);%0D%0A%0D%0A
+const saltRounds = 10;%0D%0A%0D%0A
 function
@@ -1227,56 +1227,149 @@
 var 
-user = _.pick(req.body, 'username', 'password');
+hash = bcrypt.hashSync(password, saltRounds);%0D%0A%0D%0A        var user = %7B%0D%0A            username: username,%0D%0A            password: hash%0D%0A        %7D
 %0D%0A%0D%0A
@@ -2021,24 +2021,26 @@
 %0A    %7D%0D%0A
+%0D%0A
     var 
 user = _
@@ -2035,54 +2035,51 @@
 var 
-user = _.pick(req.body, 'username', 'password'
+hash = bcrypt.hashSync(password, saltRounds
 );%0D%0A
@@ -2151,57 +2151,20 @@
 = ? 
-AND password = ? %22, %5Buser.username, user.password
+%22, %5Busername
 %5D, f
@@ -2436,32 +2436,140 @@
 %22);%0D%0A        %7D%0D%0A
+%0D%0A        storedHash = results%5B0%5D.password;%0D%0A%0D%0A        if (bcrypt.compareSync(password, storedHash)) %7B%0D%0A    
         res.stat
@@ -2576,32 +2576,36 @@
 us(201).send(%7B%0D%0A
+    
             id_t
@@ -2614,36 +2614,76 @@
 en: createToken(
+%7B 
 user
+name: username, password: storedHash %7D
 )%0D%0A        %7D);%0D%0A
@@ -2673,28 +2673,156 @@
 %7D)%0D%0A        
+  
+  
 %7D);%0D%0A
+        %7D%0D%0A%0D%0A        else %7B%0D%0A            return res.status(401).send(%22The username or password doesn't match%22);%0D%0A        %7D%0D%0A
     %7D)%0D%0A%7D);

Add password hashing with bcrypt