mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
kennethobsequioandClaude Sonnet 5
eaa6d2276a
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
71 lines
5.0 KiB
JavaScript
71 lines
5.0 KiB
JavaScript
/***********************************************************************************************************************************************************************
|
|
* File Name: auth.routes.js
|
|
* Type of Program: Router
|
|
* Description: Public authentication routes (no auth required).
|
|
* CSRF protection is applied to state-mutating endpoints.
|
|
*
|
|
* Route Map:
|
|
* GET /api/auth/csrf-token → get CSRF token (for cookie-based clients)
|
|
* POST /api/auth/register → system registration (sends OTP)
|
|
* POST /api/auth/verify-otp → verifies OTP, mints tokens/session — the
|
|
* single endpoint every auth path funnels
|
|
* through (registration, login, Google)
|
|
* POST /api/auth/resend-otp → resend OTP email (only while one is pending)
|
|
* POST /api/auth/login → validates credentials, sends a login OTP
|
|
* (no tokens issued here — see verify-otp)
|
|
* POST /api/auth/refresh → refresh access token
|
|
* POST /api/auth/logout → logout (requires authenticate)
|
|
* POST /api/auth/change-password → change password (requires authenticate)
|
|
* POST /api/auth/forgot-password → same procedure for every acc_type — checks
|
|
* reg_type is 'system' (not Google), sends OTP
|
|
* POST /api/auth/verify-reset-otp → checks OTP validity only, does not consume it
|
|
* or change the password (step 2 of the 3-step
|
|
* reset flow: email → OTP → new password)
|
|
* POST /api/auth/reset-password → verifies OTP + sets new password in one step
|
|
* GET /api/auth/google → initiate Google OIDC (generates state/nonce/PKCE)
|
|
* GET /api/auth/google/callback → verifies + exchanges code, sends a login OTP,
|
|
* redirects to the frontend callback page (no query
|
|
* params — outcome is stashed in a signed cookie)
|
|
* GET /api/auth/google/result → single-use read of that cookie (otpRequired/email,
|
|
* or an error), so it never has to live in the URL
|
|
*
|
|
* Author: rgrgogu
|
|
* Date Created: Oct. 6, 2025
|
|
* Date Modified: Jul. 6, 2026 — Google callback handoff moved from URL params to a signed
|
|
* cookie + /google/result endpoint (Kenneth Obsequio)
|
|
***********************************************************************************************************************************************************************/
|
|
const express = require('express');
|
|
const router = express.Router();
|
|
|
|
const authCtrl = require('../controllers/auth.controller');
|
|
const { authenticate } = require('../middleware/auth.middleware');
|
|
const { authLimiter, otpLimiter, sensitiveOpsLimiter } = require('../middleware/rateLimiter.middleware');
|
|
const { csrfProtection, getCsrfToken } = require('../middleware/csrf.middleware');
|
|
const { validate } = require('../middleware/validate.middleware');
|
|
const {
|
|
registerValidator, loginValidator,
|
|
verifyOTPValidator, resendOTPValidator, changePassValidator,
|
|
forgotPasswordValidator, verifyResetOTPValidator, resetPasswordValidator,
|
|
} = require('../validators/auth.validator');
|
|
|
|
// ── CSRF token (GET — no CSRF needed on GETs) ──────────────────────────────────
|
|
router.get('/csrf-token', csrfProtection, getCsrfToken);
|
|
|
|
// ── System auth ────────────────────────────────────────────────────────────────
|
|
router.post('/register', ...registerValidator, validate, authCtrl.register);
|
|
router.post('/verify-otp', otpLimiter, ...verifyOTPValidator, validate, authCtrl.verifyOTP);
|
|
router.post('/resend-otp', otpLimiter, ...resendOTPValidator, validate, authCtrl.resendOTP);
|
|
router.post('/login', authLimiter, ...loginValidator, validate, authCtrl.login);
|
|
router.post('/refresh', authLimiter, authCtrl.refreshToken);
|
|
router.post('/logout', authenticate, authLimiter, authCtrl.logout);
|
|
router.post('/change-password', authenticate, sensitiveOpsLimiter, ...changePassValidator, validate, authCtrl.changePassword);
|
|
router.post('/forgot-password', otpLimiter, ...forgotPasswordValidator, validate, authCtrl.forgotPassword);
|
|
router.post('/verify-reset-otp', otpLimiter, ...verifyResetOTPValidator, validate, authCtrl.verifyResetOTP);
|
|
router.post('/reset-password', otpLimiter, ...resetPasswordValidator, validate, authCtrl.resetPassword);
|
|
|
|
// ── Google OIDC ────────────────────────────────────────────────────────────────
|
|
router.get('/google', authLimiter, authCtrl.googleRedirect);
|
|
router.get('/google/callback', authCtrl.googleCallback);
|
|
router.get('/google/result', authCtrl.googleResult);
|
|
|
|
module.exports = router; |