kennethscoffee/starr-philproperties
1
0
Fork 0
mirror of https://github.com/rgrgogu/new_starr.git synced 2026-09-27 00:12:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

add: more things

Browse Source 
Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
This commit is contained in:
kennethobsequio
2026-07-06 15:21:55 +08:00
parent 7ba03ad4db
commit 095a0d4b3c
15 changed files with 756 additions and 211 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/auth.routes.js
+17 -6
View File
@@ -6,18 +6,26 @@
*
* Route Map:
* GET /api/auth/csrf-token → get CSRF token (for cookie-based clients)
* POST /api/auth/register → system registration
* POST /api/auth/verify-otp → OTP verification + auto-login
* POST /api/auth/resend-otp → resend OTP email
* POST /api/auth/login → system login
* POST /api/auth/register → system registration (sends OTP)
* POST /api/auth/verify-otp → verifies OTP, mints tokens/session — the
* single endpoint every auth path funnels
* through (registration, login, Google)
* POST /api/auth/resend-otp → resend OTP email (only while one is pending)
* POST /api/auth/login → validates credentials, sends a login OTP
* (no tokens issued here — see verify-otp)
* POST /api/auth/refresh → refresh access token
* POST /api/auth/logout → logout (requires authenticate)
* POST /api/auth/change-password → change password (requires authenticate)
* POST /api/auth/forgot-password → same procedure for every acc_type — checks
* reg_type is 'system' (not Google), sends OTP
* POST /api/auth/reset-password → verifies OTP + sets new password in one step
* GET /api/auth/google → initiate Google OIDC (generates state/nonce/PKCE)
* GET /api/auth/google/callback → Google OIDC callback (verifies + exchanges code)
* GET /api/auth/google/callback → verifies + exchanges code, sends a login OTP,
* redirects to the frontend with otpRequired=true
*
* Author: rgrgogu
* Date Created: Oct. 6, 2025
* Date Modified: Jul. 4, 2026 — mandatory OTP on every login + forgot/reset password (Kenneth Obsequio)
***********************************************************************************************************************************************************************/
const express = require('express');
const router = express.Router();
@@ -30,6 +38,7 @@ const { validate } = require('../middleware/validate.middleware');
const {
registerValidator, loginValidator,
verifyOTPValidator, resendOTPValidator, changePassValidator,
forgotPasswordValidator, resetPasswordValidator,
} = require('../validators/auth.validator');
// ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
@@ -39,10 +48,12 @@ router.get('/csrf-token', csrfProtection, getCsrfToken);
router.post('/register', ...registerValidator, validate, authCtrl.register);
router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
router.post('/login', ...loginValidator, validate, authCtrl.login);
router.post('/login', authLimiter, ...loginValidator, validate, authCtrl.login);
router.post('/refresh', authLimiter, authCtrl.refreshToken);
router.post('/logout', authenticate, authLimiter, authCtrl.logout);
router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
router.post('/forgot-password', otpLimiter, ...forgotPasswordValidator, validate, authCtrl.forgotPassword);
router.post('/reset-password', otpLimiter, ...resetPasswordValidator, validate, authCtrl.resetPassword);
// ── Google OIDC ────────────────────────────────────────────────────────────────
router.get('/google', authLimiter, authCtrl.googleRedirect);