add: more things

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

routes/auth.routes.js

@@ -6,18 +6,26 @@
  *
  * Route Map:
  *   GET  /api/auth/csrf-token        → get CSRF token (for cookie-based clients)
- *   POST /api/auth/register          → system registration
- *   POST /api/auth/verify-otp        → OTP verification + auto-login
- *   POST /api/auth/resend-otp        → resend OTP email
- *   POST /api/auth/login             → system login
+ *   POST /api/auth/register          → system registration (sends OTP)
+ *   POST /api/auth/verify-otp        → verifies OTP, mints tokens/session — the
+ *                                       single endpoint every auth path funnels
+ *                                       through (registration, login, Google)
+ *   POST /api/auth/resend-otp        → resend OTP email (only while one is pending)
+ *   POST /api/auth/login             → validates credentials, sends a login OTP
+ *                                       (no tokens issued here — see verify-otp)
  *   POST /api/auth/refresh           → refresh access token
  *   POST /api/auth/logout            → logout (requires authenticate)
  *   POST /api/auth/change-password   → change password (requires authenticate)
+ *   POST /api/auth/forgot-password   → same procedure for every acc_type — checks
+ *                                       reg_type is 'system' (not Google), sends OTP
+ *   POST /api/auth/reset-password    → verifies OTP + sets new password in one step
  *   GET  /api/auth/google            → initiate Google OIDC (generates state/nonce/PKCE)
- *   GET  /api/auth/google/callback   → Google OIDC callback (verifies + exchanges code)
+ *   GET  /api/auth/google/callback   → verifies + exchanges code, sends a login OTP,
+ *                                       redirects to the frontend with otpRequired=true
  *
  * Author: rgrgogu
  * Date Created: Oct. 6, 2025
+ * Date Modified: Jul. 4, 2026 — mandatory OTP on every login + forgot/reset password (Kenneth Obsequio)
  ***********************************************************************************************************************************************************************/
 const express = require('express');
 const router  = express.Router();
@@ -30,6 +38,7 @@ const { validate } = require('../middleware/validate.middleware');
 const {
   registerValidator, loginValidator,
   verifyOTPValidator, resendOTPValidator, changePassValidator,
+  forgotPasswordValidator, resetPasswordValidator,
 } = require('../validators/auth.validator');
 
 // ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
@@ -39,10 +48,12 @@ router.get('/csrf-token', csrfProtection, getCsrfToken);
 router.post('/register', ...registerValidator, validate, authCtrl.register);
 router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
 router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
-router.post('/login', ...loginValidator, validate, authCtrl.login);
+router.post('/login', authLimiter, ...loginValidator, validate, authCtrl.login);
 router.post('/refresh', authLimiter, authCtrl.refreshToken);
 router.post('/logout', authenticate, authLimiter, authCtrl.logout);
 router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
+router.post('/forgot-password', otpLimiter, ...forgotPasswordValidator, validate, authCtrl.forgotPassword);
+router.post('/reset-password', otpLimiter, ...resetPasswordValidator, validate, authCtrl.resetPassword);
 
 // ── Google OIDC ────────────────────────────────────────────────────────────────
 router.get('/google', authLimiter, authCtrl.googleRedirect);

routes/client/advertisements.routes.js

@@ -8,6 +8,9 @@ router.get('/active', controller.getActiveAdvertisement);
 // ─── GET /api/client/advertisements/active-batch?placements=a,b,c ─────────────
 router.get('/active-batch', controller.getActiveAdvertisements);
 
+// ─── GET /api/client/advertisements/active-list?placement=dashboard.hero ──────
+router.get('/active-list', controller.getActiveAdvertisementList);
+
 // ─── POST /api/client/advertisements/:advertisementId/click ───────────────────
 router.post('/:advertisementId/click', controller.trackClick);