chore: relocate backend into apps/api ahead of monorepo merge

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-27 00:12:54 +08:00 · 2026-08-24 12:20:40 +08:00
parent af44598df6
commit eaa6d2276a
388 changed files with 0 additions and 13998 deletions
@@ -0,0 +1,71 @@
+/***********************************************************************************************************************************************************************
+ * File Name: auth.routes.js
+ * Type of Program: Router
+ * Description: Public authentication routes (no auth required).
+ *              CSRF protection is applied to state-mutating endpoints.
+ *
+ * Route Map:
+ *   GET  /api/auth/csrf-token        → get CSRF token (for cookie-based clients)
+ *   POST /api/auth/register          → system registration (sends OTP)
+ *   POST /api/auth/verify-otp        → verifies OTP, mints tokens/session — the
+ *                                       single endpoint every auth path funnels
+ *                                       through (registration, login, Google)
+ *   POST /api/auth/resend-otp        → resend OTP email (only while one is pending)
+ *   POST /api/auth/login             → validates credentials, sends a login OTP
+ *                                       (no tokens issued here — see verify-otp)
+ *   POST /api/auth/refresh           → refresh access token
+ *   POST /api/auth/logout            → logout (requires authenticate)
+ *   POST /api/auth/change-password   → change password (requires authenticate)
+ *   POST /api/auth/forgot-password   → same procedure for every acc_type — checks
+ *                                       reg_type is 'system' (not Google), sends OTP
+ *   POST /api/auth/verify-reset-otp  → checks OTP validity only, does not consume it
+ *                                       or change the password (step 2 of the 3-step
+ *                                       reset flow: email → OTP → new password)
+ *   POST /api/auth/reset-password    → verifies OTP + sets new password in one step
+ *   GET  /api/auth/google            → initiate Google OIDC (generates state/nonce/PKCE)
+ *   GET  /api/auth/google/callback   → verifies + exchanges code, sends a login OTP,
+ *                                       redirects to the frontend callback page (no query
+ *                                       params — outcome is stashed in a signed cookie)
+ *   GET  /api/auth/google/result     → single-use read of that cookie (otpRequired/email,
+ *                                       or an error), so it never has to live in the URL
+ *
+ * Author: rgrgogu
+ * Date Created: Oct. 6, 2025
+ * Date Modified: Jul. 6, 2026 — Google callback handoff moved from URL params to a signed
+ *                                cookie + /google/result endpoint (Kenneth Obsequio)
+ ***********************************************************************************************************************************************************************/
+const express = require('express');
+const router  = express.Router();
+
+const authCtrl = require('../controllers/auth.controller');
+const { authenticate } = require('../middleware/auth.middleware');
+const { authLimiter, otpLimiter, sensitiveOpsLimiter } = require('../middleware/rateLimiter.middleware');
+const { csrfProtection, getCsrfToken } = require('../middleware/csrf.middleware');
+const { validate } = require('../middleware/validate.middleware');
+const {
+  registerValidator, loginValidator,
+  verifyOTPValidator, resendOTPValidator, changePassValidator,
+  forgotPasswordValidator, verifyResetOTPValidator, resetPasswordValidator,
+} = require('../validators/auth.validator');
+
+// ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
+router.get('/csrf-token', csrfProtection, getCsrfToken);
+
+// ── System auth ────────────────────────────────────────────────────────────────
+router.post('/register', ...registerValidator, validate, authCtrl.register);
+router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
+router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
+router.post('/login', authLimiter, ...loginValidator, validate, authCtrl.login);
+router.post('/refresh', authLimiter, authCtrl.refreshToken);
+router.post('/logout', authenticate, authLimiter, authCtrl.logout);
+router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
+router.post('/forgot-password', otpLimiter, ...forgotPasswordValidator, validate, authCtrl.forgotPassword);
+router.post('/verify-reset-otp', otpLimiter, ...verifyResetOTPValidator, validate, authCtrl.verifyResetOTP);
+router.post('/reset-password', otpLimiter, ...resetPasswordValidator, validate, authCtrl.resetPassword);
+
+// ── Google OIDC ────────────────────────────────────────────────────────────────
+router.get('/google', authLimiter, authCtrl.googleRedirect);
+router.get('/google/callback', authCtrl.googleCallback);
+router.get('/google/result', authCtrl.googleResult);
+
+module.exports = router;