Aryaman is correct but I would like to offer a slightly different solution.
I would recommend that you keep passports logic out of the main app.js/ index.js file as much as possible. I create a config folder with the main passport.js and then a strategies folder that has logic for how users will login.

in your main entry point file eg app.js
pull in passport's config passing app.
import express from 'express';
const app = express();
require('./src/config/passport')(app);
Your config file eg:passport.js should look like this
import passport from 'passport';
require('./strategies/local.strategy')(); //Or whatever strategy you are using
const passportConfig = (app) => {
app.use(passport.initialize());
app.use(passport.session());
// stores user to session
passport.serializeUser((user, done) => {
done(null, user);
});
// retrieves user from session
passport.deserializeUser((user, done) => {
done(null, user);
});
};
export default passportConfig;
Example local strategy aka custom strategy
import passport from 'passport';
import { Strategy } from 'passport-local';
import axios from 'axios';
const localStrategy = () => {
passport.use(new Strategy(
{
usernameField: 'userName',
passwordField: 'password',
},
(username, password, done) => {
const loginUrl = `${process.env.base_url}/api/core/security/login`;
const body = {
InstanceName: process.env.instance_name,
Username: username,
UserDomain: process.env.user_domain,
Password: password,
};
axios.post(loginUrl, body)
.then((response) => {
if (response.data.IsSuccessful === true) {
const user = {
token: response.data.RequestedObject.SessionToken,
userId: response.data.UserId,
userName: username,
};
done(null, user);
} else {
// handle failed login
}
})
.catch((error) =>
//Handle the error
}
))
}
export default localStrategy;