initial

routes/auth.routes.js

@@ -0,0 +1,61 @@
+/***********************************************************************************************************************************************************************
+ * File Name: auth.routes.js
+ * Type of Program: Router
+ * Description: Public authentication routes (no auth required).
+ *              CSRF protection is applied to state-mutating endpoints.
+ *
+ * Route Map:
+ *   GET  /api/auth/csrf-token        → get CSRF token (for cookie-based clients)
+ *   POST /api/auth/register          → system registration
+ *   POST /api/auth/verify-otp        → OTP verification + auto-login
+ *   POST /api/auth/resend-otp        → resend OTP email
+ *   POST /api/auth/login             → system login
+ *   POST /api/auth/refresh           → refresh access token
+ *   POST /api/auth/logout            → logout (requires authenticate)
+ *   POST /api/auth/change-password   → change password (requires authenticate)
+ *   GET  /api/auth/google            → initiate Google OAuth
+ *   GET  /api/auth/google/callback   → Google OAuth callback
+ *
+ * Author: rgrgogu
+ * Date Created: Oct. 6, 2025
+ ***********************************************************************************************************************************************************************/
+const express = require('express');
+const passport = require('passport');
+const router = express.Router();
+
+const authCtrl = require('../controllers/auth.controller');
+const { authenticate } = require('../middleware/auth.middleware');
+const { authLimiter, otpLimiter, sensitiveOpsLimiter } = require('../middleware/rateLimiter.middleware');
+const { csrfProtection, getCsrfToken } = require('../middleware/csrf.middleware');
+const { validate } = require('../middleware/validate.middleware');
+const {
+  registerValidator, loginValidator,
+  verifyOTPValidator, resendOTPValidator, changePassValidator,
+} = require('../validators/auth.validator');
+
+// ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
+router.get('/csrf-token', csrfProtection, getCsrfToken);
+
+// ── System auth ────────────────────────────────────────────────────────────────
+router.post('/register', ...registerValidator, validate, authCtrl.register);
+router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
+router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
+router.post('/login', ...loginValidator, validate, authCtrl.login);
+router.post('/refresh', authCtrl.refreshToken);
+router.post('/logout', authenticate, authLimiter, authCtrl.logout);
+router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
+
+// ── Google OAuth ───────────────────────────────────────────────────────────────
+router.get('/google',
+  authLimiter,
+  passport.authenticate('google', { scope: ['profile', 'email'], session: false })
+);
+router.get('/google/callback',
+  passport.authenticate('google', { session: false, failureRedirect: '/api/auth/google/failed' }),
+  authCtrl.googleCallback
+);
+router.get('/google/failed', (req, res) => {
+  res.status(401).json({ status: 'error', message: 'Google authentication failed.' });
+});
+
+module.exports = router;