testing 127.0.0.1 issue

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

routes/auth.routes.js

@@ -18,14 +18,21 @@
  *   POST /api/auth/change-password   → change password (requires authenticate)
  *   POST /api/auth/forgot-password   → same procedure for every acc_type — checks
  *                                       reg_type is 'system' (not Google), sends OTP
+ *   POST /api/auth/verify-reset-otp  → checks OTP validity only, does not consume it
+ *                                       or change the password (step 2 of the 3-step
+ *                                       reset flow: email → OTP → new password)
  *   POST /api/auth/reset-password    → verifies OTP + sets new password in one step
  *   GET  /api/auth/google            → initiate Google OIDC (generates state/nonce/PKCE)
  *   GET  /api/auth/google/callback   → verifies + exchanges code, sends a login OTP,
- *                                       redirects to the frontend with otpRequired=true
+ *                                       redirects to the frontend callback page (no query
+ *                                       params — outcome is stashed in a signed cookie)
+ *   GET  /api/auth/google/result     → single-use read of that cookie (otpRequired/email,
+ *                                       or an error), so it never has to live in the URL
  *
  * Author: rgrgogu
  * Date Created: Oct. 6, 2025
- * Date Modified: Jul. 4, 2026 — mandatory OTP on every login + forgot/reset password (Kenneth Obsequio)
+ * Date Modified: Jul. 6, 2026 — Google callback handoff moved from URL params to a signed
+ *                                cookie + /google/result endpoint (Kenneth Obsequio)
  ***********************************************************************************************************************************************************************/
 const express = require('express');
 const router  = express.Router();
@@ -38,7 +45,7 @@ const { validate } = require('../middleware/validate.middleware');
 const {
   registerValidator, loginValidator,
   verifyOTPValidator, resendOTPValidator, changePassValidator,
-  forgotPasswordValidator, resetPasswordValidator,
+  forgotPasswordValidator, verifyResetOTPValidator, resetPasswordValidator,
 } = require('../validators/auth.validator');
 
 // ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
@@ -53,10 +60,12 @@ router.post('/refresh', authLimiter, authCtrl.refreshToken);
 router.post('/logout', authenticate, authLimiter, authCtrl.logout);
 router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
 router.post('/forgot-password', otpLimiter, ...forgotPasswordValidator, validate, authCtrl.forgotPassword);
+router.post('/verify-reset-otp', otpLimiter, ...verifyResetOTPValidator, validate, authCtrl.verifyResetOTP);
 router.post('/reset-password', otpLimiter, ...resetPasswordValidator, validate, authCtrl.resetPassword);
 
 // ── Google OIDC ────────────────────────────────────────────────────────────────
 router.get('/google', authLimiter, authCtrl.googleRedirect);
 router.get('/google/callback', authCtrl.googleCallback);
+router.get('/google/result', authCtrl.googleResult);
 
 module.exports = router;