Resend OTP Module

your-project/
├── controllers/
│   ├── otp.js              # OTP generation and verification logic
│   └── otpFunctions.js     # Request handlers
├── routes/
│   └── otpRoutes.js        # API endpoints
├── middleware/
│   └── rateLimit.js        # Rate limiting configuration
├── app.js                   # Patched with OTP routes
└── .env                     # Environment variables

import { Resend } from "resend";
import dotenv from "dotenv";
import crypto from "crypto";

dotenv.config();

const resend = new Resend(process.env.RESEND_API_KEY);
const otpStore = new Map();
const OTP_EXPIRY_MS = 5 * 60 * 1000; // 5 minutes

export async function sendOtp(email) {
  const otp = crypto.randomInt(100000, 1000000).toString();
  const expiresAt = Date.now() + OTP_EXPIRY_MS;

  otpStore.set(email, { otp, expiresAt });

  const htmlContent = `
    <p>Hello,</p>
    <p>Your OTP for logging in is:</p>
    <p><strong>${otp}</strong></p>
    <p>This OTP will expire in 5 minutes. Do not share it with anyone.</p>
  `;

  try {
    await resend.emails.send({
      from: process.env.FROM_EMAIL,
      to: email,
      subject: "Your OTP is",
      html: htmlContent,
    });
    return true;
  } catch (err) {
    console.error("Failed to send OTP:", err);
    return false;
  }
}

export function verifyOtp(email, otp) {
  const entry = otpStore.get(email);
  if (!entry) return false;

  if (Date.now() > entry.expiresAt) {
    otpStore.delete(email);
    return false;
  }

  return entry.otp === otp;
}

import { sendOtp, verifyOtp } from "./otp.js";

export async function sendOtpHandler(req, res) {
  const { email } = req.body;

  if (!email) {
    return res.status(400).json({ error: "Email required" });
  }

  const sent = await sendOtp(email);

  if (sent) {
    return res.json({
      message: "OTP sent successfully",
      success: true,
    });
  } else {
    return res.status(500).json({
      message: "Failed to send OTP",
      success: false,
    });
  }
}

export function verifyOtpHandler(req, res) {
  const { email, otp } = req.body;

  if (!email || !otp) {
    return res.status(400).json({ error: "Email and OTP are required." });
  }

  const valid = verifyOtp(email, otp);

  if (valid) {
    return res.status(200).json({ message: "correct" });
  } else {
    return res.status(401).json({ error: "incorrect" });
  }
}

import express from "express";
import {
  sendOtpHandler,
  verifyOtpHandler,
} from "../controllers/otpFunctions.js";
import { rateLimiter } from "../middleware/rateLimit.js";

const router = express.Router();

router.post("/send-otp", rateLimiter, sendOtpHandler);
router.post("/verify-otp", rateLimiter, verifyOtpHandler);

export default router;

import rateLimit from "express-rate-limit";

export const rateLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 10, // Limit each IP to 10 requests per windowMs
  message: {
    success: false,
    errors: "too many requests, please try again later.",
    status: 429,
  },
  standardHeaders: true,
  legacyHeaders: false,
});