create-authenik8-app 2.4.11 → 2.4.13

package/templates/fullstack/PRESET_CONTRACT.md

@@ -0,0 +1,46 @@
+# Full-stack preset contract
+
+This document is the testable contract for the `fullstack` preset.
+
+## Stack and boundaries
+
+- Node.js 20.19+, 22.12+, or 24+ and npm workspaces.
+- `apps/web`: React, Vite, React Router, TanStack Query, and the generated UI.
+- `apps/api`: Express, Authenik8, Prisma, PostgreSQL, Redis, policies, and HTTP controllers.
+- `packages/contracts`: shared Zod request schemas and public response types.
+- `packages/api-client`: the only browser HTTP client. It owns the in-memory access token and one-time refresh retry.
+- `packages/ui`: removable application primitives used by the web workspace.
+
+## Commands
+
+| Command | Guarantee |
+| --- | --- |
+| `npm run dev` | Builds shared packages and starts API and web together. |
+| `npm run build` | Produces the API and frontend production bundles. |
+| `npm start` | Starts Express, which serves `/api` and the built SPA. |
+| `npm run db:migrate` | Applies the Prisma PostgreSQL development migration. |
+| `npm run db:seed` | Creates the configured administrator and example data. |
+| `npm test` | Runs API policy/security tests and web storage tests. |
+
+## Network contract
+
+- Vite: `http://localhost:5173`, proxying `/api` to Express.
+- Express: `http://localhost:3000`.
+- PostgreSQL: `localhost:5432` in local Docker Compose.
+- Redis: `localhost:6379` in local Docker Compose.
+- Production uses one origin. Express serves `apps/web/dist` after `npm run build`.
+
+## Environment contract
+
+Required: `DATABASE_URL`, `REDIS_URL`, `AUTHENIK8_SIGNING_JWKS`, `AUTHENIK8_ACTIVE_KID`, `AUTHENIK8_ISSUER`, `AUTHENIK8_AUDIENCE`, `REFRESH_SECRET`, and `WEB_ORIGIN`.
+OAuth variables are required only for an enabled provider. `RESEND_API_KEY` and `EMAIL_FROM` enable production verification and recovery delivery. See `.env.example` for the complete list.
+
+## Security guarantees
+
+- Access tokens exist only in module memory and are sent as Bearer tokens.
+- Refresh tokens are AES-256-GCM sealed in an HttpOnly cookie scoped to `/api`, with `SameSite=Strict` and `Secure` in production.
+- Refresh rotation, replay rejection, and server-side refresh revocation use Authenik8 and Redis.
+- Browser mutations enforce an exact allowed `Origin` and a signed double-submit CSRF token.
+- Admin and Project APIs enforce roles or ownership on the server.
+- Credential and recovery failures do not disclose whether an email address exists.
+- Request IDs, security headers, redacted structured logs, Redis-backed Authenik8 rate limiting, readiness, and liveness endpoints are enabled.

package/templates/fullstack/README.md

@@ -0,0 +1,65 @@
+# Authenik8 Full-stack Starter
+
+A connected React and Express application with secure Authenik8 sessions, account settings, administration, and an owned Project resource.
+
+Optional agent/service identities are disabled by default. Configure
+`AUTHENIK8_AGENTS` and follow `AGENT_IDENTITY.md` to add scoped M2M or delegated
+agent access without exposing an unsafe public token-minting route.
+
+## Local development
+
+Requirements: Node.js 20.19+, 22.12+, or 24+, npm, and Docker with Compose.
+
+```bash
+docker compose up -d
+npm run db:migrate
+npm run db:seed
+npm run dev
+```
+
+Open `http://localhost:5173`. The API runs on `http://localhost:3000/api`. The generated `.env` contains development values; replace every secret before deploying.
+
+The seeded administrator uses `SEED_ADMIN_EMAIL` and `SEED_ADMIN_PASSWORD`. Change the default password immediately, including for local environments shared by multiple people.
+
+## Application map
+
+- Authentication: registration, login, OAuth, refresh, logout, password recovery, and email verification.
+- Account: profile, password, linked providers, active sessions, and revocation.
+- Administration: users, roles, status, session revocation, and audit events.
+- Projects: list, create, details, edit, archive, and delete with owner policies.
+
+The API follows a contract, repository, service, controller, policy, and route convention. Copy `apps/api/src/modules/projects` and `apps/web/src/features/projects` when adding a vertical feature.
+
+## Session model
+
+The API returns a short-lived access token to the Auth provider, which holds it only in memory. The browser sends an encrypted, restricted HttpOnly refresh cookie automatically. The API client obtains a signed CSRF token for browser mutations, performs one refresh after a `401`, shares in-flight token requests, and retries once. It never reads from or writes tokens to browser storage.
+
+Route guards are user experience controls. API middleware and policies remain the authorization boundary.
+
+## OAuth callbacks
+
+Configure either provider with these exact local callback URLs:
+
+```text
+http://localhost:3000/api/auth/oauth/google/callback
+http://localhost:3000/api/auth/oauth/github/callback
+```
+
+OAuth callbacks place a single-use exchange code and an encrypted session payload in Redis, then redirect to the SPA. Tokens are not placed in a URL.
+
+## Production
+
+```bash
+npm run build
+NODE_ENV=production npm start
+```
+
+Read [docs/PRODUCTION.md](docs/PRODUCTION.md) and [THREAT_MODEL.md](THREAT_MODEL.md) before deployment. Production requires HTTPS, strong unique secrets, non-public Redis, database backups, a trusted reverse proxy configuration, an exact `WEB_ORIGIN`, and a working mail delivery integration for recovery and verification links.
+
+## Health and tests
+
+- `GET /api/health/live` confirms the process is running.
+- `GET /api/health/ready` checks PostgreSQL and Redis.
+- `GET /api/docs/openapi.json` returns the generated OpenAPI 3.1 contract.
+- `npm test` covers ownership/admin policies, encrypted cookies, origin and CSRF defenses, and the browser storage rule.
+- `npm run typecheck` checks each workspace.

package/templates/fullstack/THREAT_MODEL.md

@@ -0,0 +1,30 @@
+# Threat model
+
+## Protected assets
+
+Account credentials, OAuth identities, access and refresh tokens, agent grants and M2M sessions, delegated actor chains, administrative actions, user profile data, and owned Project records.
+
+## Trust boundaries
+
+The browser is untrusted. React route guards provide navigation behavior only. Express middleware and module policies make every authorization decision. PostgreSQL and Redis must be reachable only from trusted application networks.
+
+## Threats addressed
+
+- Refresh-token theft and replay: AES-256-GCM-sealed HttpOnly cookies, Redis-backed rotation, atomic replacement, and replay rejection.
+- Cross-site cookie abuse: exact-origin checks and signed double-submit CSRF tokens on browser mutations.
+- Token exfiltration through browser storage: access tokens remain in module memory; refresh tokens are never exposed to JavaScript.
+- Broken object authorization: every Project lookup or mutation is scoped by owner unless an explicit administrator policy allows it.
+- Privilege escalation: admin APIs require authenticated server-side role checks and record audit events.
+- Account enumeration: login and recovery responses are generic.
+- OAuth login CSRF: provider state is handled by Authenik8; the SPA receives only a single-use, short-lived exchange code.
+- Password database compromise: passwords and recovery/verification tokens are stored as one-way hashes.
+- Basic abuse and injection: Redis-backed Authenik8 rate limiting, request size limits, Zod validation, Prisma parameterization, security headers, and structured logging.
+- Agent identity: human and machine token purposes are separated, exact scopes are checked against the live registry, M2M sessions are revocable, and delegated tokens remain bound to their human session.
+
+## Residual risks
+
+An active XSS can make authenticated API calls while the page is open even though it cannot read the refresh cookie. Keep the content security policy strict and audit third-party scripts. Access tokens remain valid until their short expiry after some session revocations. Agent-token issuance is privileged but does not authenticate the workload for you; use mTLS, cloud workload identity, or signed assertions and never expose an unauthenticated mint route. Public JWKS verification cannot observe Redis agent revocation. OAuth provider compromise, malicious dependencies, host compromise, denial of service at volumes beyond one Redis limiter, and mistakes in deployment infrastructure require controls outside this starter.
+
+## Review triggers
+
+Repeat the threat review when adding a new identity provider or agent, changing agent scopes or delegation policy, changing cookie scope or origins, introducing file uploads or billing, adding multiple tenants, exposing Redis, changing proxy topology, or adding third-party browser scripts.

package/templates/fullstack/apps/api/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@authenik8/api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/server.js",
+  "scripts": {
+    "predev": "prisma generate",
+    "dev": "tsx watch src/server.ts",
+    "prebuild": "prisma generate",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/server.js",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prisma:generate": "prisma generate",
+    "prisma:migrate": "prisma migrate dev && prisma generate",
+    "prisma:seed": "prisma generate && prisma db seed",
+    "prisma:studio": "prisma studio"
+  },
+  "dependencies": {
+    "@authenik8/contracts": "0.1.0",
+    "@prisma/adapter-pg": "7.8.0",
+    "@prisma/client": "7.8.0",
+    "authenik8-core": "2.0.3",
+    "bcryptjs": "^2.4.3",
+    "cookie-parser": "^1.4.7",
+    "cors": "^2.8.5",
+    "dotenv": "^17.3.1",
+    "express": "^5.2.1",
+    "ioredis": "^5.10.0",
+    "pino": "^9.7.0",
+    "pino-http": "^10.4.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/bcryptjs": "^2.4.6",
+    "@types/cookie-parser": "^1.4.9",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
+    "@types/node": "^25.0.0",
+    "@types/supertest": "^7.2.0",
+    "prisma": "7.8.0",
+    "supertest": "^7.2.2",
+    "tsx": "^4.22.4",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  }
+}

package/templates/fullstack/apps/api/prisma/schema.prisma

@@ -0,0 +1,124 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+model User {
+  id                String      @id @default(uuid())
+  email             String      @unique
+  passwordHash      String?
+  name              String
+  role              Role        @default(USER)
+  status            UserStatus  @default(ACTIVE)
+  emailVerifiedAt   DateTime?
+  passwordUpdatedAt DateTime?
+  createdAt         DateTime    @default(now())
+  updatedAt         DateTime    @updatedAt
+  projects          Project[]
+  sessions          Session[]
+  oauthAccounts     OAuthAccount[]
+  resetTokens       PasswordResetToken[]
+  verificationTokens EmailVerificationToken[]
+  auditEvents       AuditEvent[] @relation("AuditActor")
+}
+
+model OAuthAccount {
+  id                String   @id @default(uuid())
+  userId            String
+  provider          String
+  providerAccountId String
+  providerEmail     String
+  createdAt         DateTime @default(now())
+  user              User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([provider, providerAccountId])
+  @@unique([userId, provider])
+  @@index([userId])
+}
+
+model Session {
+  id          String    @id @default(uuid())
+  userId      String
+  coreSessionId String  @unique
+  refreshHash String    @unique
+  userAgent   String
+  ipAddress   String
+  createdAt   DateTime  @default(now())
+  lastUsedAt  DateTime  @default(now())
+  expiresAt   DateTime
+  revokedAt   DateTime?
+  user        User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, revokedAt])
+}
+
+model Project {
+  id          String        @id @default(uuid())
+  name        String
+  description String        @default("")
+  status      ProjectStatus @default(DRAFT)
+  ownerId     String
+  owner       User          @relation(fields: [ownerId], references: [id], onDelete: Cascade)
+  createdAt   DateTime      @default(now())
+  updatedAt   DateTime      @updatedAt
+
+  @@index([ownerId, updatedAt])
+}
+
+model PasswordResetToken {
+  id        String    @id @default(uuid())
+  tokenHash String    @unique
+  userId    String
+  expiresAt DateTime
+  usedAt    DateTime?
+  createdAt DateTime  @default(now())
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, expiresAt])
+}
+
+model EmailVerificationToken {
+  id        String    @id @default(uuid())
+  tokenHash String    @unique
+  userId    String
+  expiresAt DateTime
+  usedAt    DateTime?
+  createdAt DateTime  @default(now())
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, expiresAt])
+}
+
+model AuditEvent {
+  id         String   @id @default(uuid())
+  actorId    String?
+  action     String
+  targetType String
+  targetId   String?
+  metadata   Json?
+  ipAddress  String?
+  createdAt  DateTime @default(now())
+  actor      User?    @relation("AuditActor", fields: [actorId], references: [id], onDelete: SetNull)
+
+  @@index([createdAt])
+  @@index([actorId])
+}
+
+enum Role {
+  USER
+  ADMIN
+}
+
+enum UserStatus {
+  ACTIVE
+  SUSPENDED
+}
+
+enum ProjectStatus {
+  DRAFT
+  ACTIVE
+  ARCHIVED
+}

package/templates/fullstack/apps/api/prisma/seed.ts

@@ -0,0 +1,36 @@
+import bcrypt from "bcryptjs";
+import { ProjectStatus, Role } from "@prisma/client";
+import { prisma } from "../src/config/prisma.js";
+
+async function main() {
+  const email = (process.env.SEED_ADMIN_EMAIL ?? "admin@example.com").toLowerCase();
+  const password = process.env.SEED_ADMIN_PASSWORD ?? "ChangeMe123!";
+  const admin = await prisma.user.upsert({
+    where: { email },
+    update: { role: Role.ADMIN, status: "ACTIVE" },
+    create: {
+      email,
+      name: "Workspace Admin",
+      passwordHash: await bcrypt.hash(password, 12),
+      role: Role.ADMIN,
+      emailVerifiedAt: new Date(),
+    },
+  });
+
+  const existingProject = await prisma.project.findFirst({ where: { ownerId: admin.id } });
+  if (!existingProject) {
+    await prisma.project.create({
+      data: {
+        name: "Launch workspace",
+        description: "Your first complete Authenik8 feature slice.",
+        status: ProjectStatus.ACTIVE,
+        ownerId: admin.id,
+      },
+    });
+  }
+
+  console.log(`Seeded administrator ${email}`);
+}
+
+main()
+  .finally(() => prisma.$disconnect());

package/templates/fullstack/apps/api/prisma.config.ts

@@ -0,0 +1,18 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import dotenv from "dotenv";
+import { defineConfig, env } from "prisma/config";
+
+const rootEnv = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../.env");
+dotenv.config({ path: process.env.AUTHENIK8_ENV_FILE ?? rootEnv });
+
+export default defineConfig({
+  schema: "prisma/schema.prisma",
+  migrations: {
+    path: "prisma/migrations",
+    seed: "tsx prisma/seed.ts",
+  },
+  datasource: {
+    url: env("DATABASE_URL"),
+  },
+});

package/templates/fullstack/apps/api/src/app.ts

@@ -0,0 +1,68 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import cookieParser from "cookie-parser";
+import cors from "cors";
+import express from "express";
+import { pinoHttp } from "pino-http";
+import { getAuthenik8, redis } from "./auth/authenik8.js";
+import { authRoutes } from "./auth/auth.routes.js";
+import { env } from "./config/env.js";
+import { logger } from "./config/logger.js";
+import { isAllowedOrigin } from "./config/origins.js";
+import { prisma } from "./config/prisma.js";
+import { requestId } from "./middleware/request-id.js";
+import { adminRoutes } from "./modules/admin/admin.routes.js";
+import { projectRoutes } from "./modules/projects/project.routes.js";
+import { userRoutes } from "./modules/users/user.routes.js";
+import { AppError, asyncHandler, errorHandler, notFound } from "./utils/http.js";
+import { openApiDocument } from "./openapi.js";
+
+export function createApp() {
+  const app = express();
+  if (env.TRUST_PROXY) app.set("trust proxy", 1);
+
+  app.use(requestId);
+  app.use(pinoHttp({ logger, genReqId: (req) => req.id }));
+  app.use(cors({
+    credentials: true,
+    origin(origin, callback) {
+      if (!origin || isAllowedOrigin(origin)) return callback(null, true);
+      callback(new AppError(403, "ORIGIN_REJECTED", "Request origin is not allowed"));
+    },
+  }));
+  app.use(getAuthenik8().helmet);
+  // authenik8-core provides the Redis-backed limiter for every route below.
+  app.use(getAuthenik8().rateLimit);
+  app.use(express.json({ limit: "32kb", strict: true }));
+  app.use(cookieParser());
+
+  app.get("/api/health/live", (_req, res) => res.json({ status: "ok" }));
+  app.get("/.well-known/jwks.json", (_req, res) => res.json(getAuthenik8().getJwks()));
+  app.get("/api/docs/openapi.json", (_req, res) => res.json(openApiDocument));
+  app.get("/api/health/ready", asyncHandler(async (_req, res) => {
+    await prisma.$queryRaw`SELECT 1`;
+    const pong = await redis.ping();
+    res.json({ status: "ready", database: "ok", redis: pong === "PONG" ? "ok" : "unavailable" });
+  }));
+
+  app.use("/api/auth", authRoutes);
+  app.use("/api/account", userRoutes);
+  app.use("/api/projects", projectRoutes);
+  app.use("/api/admin", adminRoutes);
+
+  if (env.NODE_ENV === "production") {
+    const currentDir = path.dirname(fileURLToPath(import.meta.url));
+    const webDist = path.resolve(currentDir, "../../web/dist");
+    app.use(express.static(webDist, { index: false, maxAge: "1h" }));
+
+    // codeql[js/missing-rate-limiting] authenik8-core rate-limits this handler globally.
+    app.use((req, res, next) => {
+      if (req.method === "GET" && req.accepts("html")) return res.sendFile(path.join(webDist, "index.html"));
+      next();
+    });
+  }
+
+  app.use(notFound);
+  app.use(errorHandler);
+  return app;
+}

package/templates/fullstack/apps/api/src/auth/auth.controller.ts

@@ -0,0 +1,125 @@
+import {
+  forgotPasswordSchema,
+  loginSchema,
+  oauthExchangeSchema,
+  oauthLinkQuerySchema,
+  oauthProviderSchema,
+  registerSchema,
+  resetPasswordSchema,
+  verificationSchema,
+} from "@authenik8/contracts";
+import { env } from "../config/env.js";
+import { asyncHandler } from "../utils/http.js";
+import { presentUser } from "../modules/users/user.presenter.js";
+import { clearRefreshCookie, readRefreshCookie, setRefreshCookie } from "./cookies.js";
+import { issueCsrfToken } from "../middleware/csrf.js";
+import {
+  completeOAuthCallback,
+  consumeLinkIntent,
+  createLinkIntent,
+  exchangeOAuthCode,
+  login,
+  oauthProvider,
+  register,
+  requestPasswordReset,
+  resendVerification,
+  resetPassword,
+  revokeRefreshToken,
+  rotateSession,
+  verifyEmail,
+} from "./auth.service.js";
+import { prisma } from "../config/prisma.js";
+
+export const csrfTokenController = asyncHandler(async (req, res) => {
+  res.set("Cache-Control", "no-store");
+  res.json({ csrfToken: issueCsrfToken(req, res) });
+});
+
+export const registerController = asyncHandler(async (req, res) => {
+  res.status(201).json(await register(registerSchema.parse(req.body)));
+});
+
+export const loginController = asyncHandler(async (req, res) => {
+  const session = await login(loginSchema.parse(req.body), req);
+  setRefreshCookie(res, session.refreshToken);
+  res.json({ accessToken: session.accessToken, user: session.user });
+});
+
+export const refreshController = asyncHandler(async (req, res) => {
+  const session = await rotateSession(readRefreshCookie(req));
+  setRefreshCookie(res, session.refreshToken);
+  res.json({ accessToken: session.accessToken, user: session.user });
+});
+
+export const logoutController = asyncHandler(async (req, res) => {
+  await revokeRefreshToken(readRefreshCookie(req));
+  clearRefreshCookie(res);
+  res.json({ message: "Signed out" });
+});
+
+export const meController = asyncHandler(async (req, res) => {
+  const user = await prisma.user.findUniqueOrThrow({ where: { id: req.user!.userId } });
+  res.json({ user: presentUser(user) });
+});
+
+export const forgotPasswordController = asyncHandler(async (req, res) => {
+  const { email } = forgotPasswordSchema.parse(req.body);
+  res.json(await requestPasswordReset(email));
+});
+
+export const resetPasswordController = asyncHandler(async (req, res) => {
+  const input = resetPasswordSchema.parse(req.body);
+  await resetPassword(input.token, input.password);
+  clearRefreshCookie(res);
+  res.json({ message: "Password updated" });
+});
+
+export const verifyEmailController = asyncHandler(async (req, res) => {
+  const { token } = verificationSchema.parse(req.body);
+  await verifyEmail(token);
+  res.json({ message: "Email verified" });
+});
+
+export const resendVerificationController = asyncHandler(async (req, res) => {
+  res.json(await resendVerification(req.user!.userId));
+});
+
+export const oauthRedirectController = asyncHandler(async (req, res) => {
+  await oauthProvider(oauthProviderSchema.parse(req.params.provider)).provider.redirect(req, res);
+});
+
+export const oauthLinkIntentController = asyncHandler(async (req, res) => {
+  const url = await createLinkIntent(req.user!.userId, oauthProviderSchema.parse(req.params.provider));
+  res.json({ url });
+});
+
+export const oauthLinkRedirectController = asyncHandler(async (req, res) => {
+  const { ticket } = oauthLinkQuerySchema.parse(req.query);
+  const userId = await consumeLinkIntent(ticket);
+  req.user = { userId, email: "", name: "", role: "USER" };
+  await oauthProvider(oauthProviderSchema.parse(req.params.provider)).provider.redirect(req, res, "link");
+});
+
+export const oauthCallbackController = asyncHandler(async (req, res) => {
+  try {
+    const providerName = oauthProviderSchema.parse(req.params.provider);
+    const { provider } = oauthProvider(providerName);
+    const result = await provider.handleCallback(req);
+    const completed = await completeOAuthCallback(providerName, result, req);
+    if (completed.linked) {
+      res.redirect(`${env.WEB_ORIGIN}/settings/security?linked=${completed.provider}`);
+      return;
+    }
+    res.redirect(`${env.WEB_ORIGIN}/auth/callback?code=${completed.code}`);
+  } catch (error) {
+    req.log?.warn({ err: error }, "OAuth callback rejected");
+    res.redirect(`${env.WEB_ORIGIN}/login?oauthError=1`);
+  }
+});
+
+export const oauthExchangeController = asyncHandler(async (req, res) => {
+  const { code } = oauthExchangeSchema.parse(req.body);
+  const session = await exchangeOAuthCode(code);
+  setRefreshCookie(res, session.refreshToken);
+  res.json({ accessToken: session.accessToken, user: session.user });
+});

package/templates/fullstack/apps/api/src/auth/auth.routes.ts

@@ -0,0 +1,50 @@
+import { Router } from "express";
+import { authenticate } from "../middleware/authenticate.js";
+import { requireCsrf } from "../middleware/csrf.js";
+import { requireAllowedOrigin } from "../middleware/origin.js";
+import {
+  csrfTokenController,
+  forgotPasswordController,
+  loginController,
+  logoutController,
+  meController,
+  oauthCallbackController,
+  oauthExchangeController,
+  oauthLinkIntentController,
+  oauthLinkRedirectController,
+  oauthRedirectController,
+  refreshController,
+  registerController,
+  resendVerificationController,
+  resetPasswordController,
+  verifyEmailController,
+} from "./auth.controller.js";
+
+export const authRoutes = Router();
+
+authRoutes.get("/csrf", csrfTokenController);
+authRoutes.post("/register", requireAllowedOrigin, requireCsrf, registerController);
+// These routes are mounted after authenik8-core's global Redis-backed limiter.
+// codeql[js/missing-rate-limiting]
+authRoutes.post("/login", requireAllowedOrigin, requireCsrf, loginController);
+authRoutes.post("/refresh", requireAllowedOrigin, requireCsrf, refreshController);
+authRoutes.post("/logout", requireAllowedOrigin, requireCsrf, logoutController);
+// codeql[js/missing-rate-limiting]
+authRoutes.get("/me", authenticate, meController);
+authRoutes.post("/forgot-password", requireAllowedOrigin, requireCsrf, forgotPasswordController);
+authRoutes.post("/reset-password", requireAllowedOrigin, requireCsrf, resetPasswordController);
+// codeql[js/missing-rate-limiting]
+authRoutes.post("/verify-email", requireAllowedOrigin, requireCsrf, verifyEmailController);
+// codeql[js/missing-rate-limiting]
+authRoutes.post("/resend-verification", requireAllowedOrigin, requireCsrf, authenticate, resendVerificationController);
+
+// codeql[js/missing-rate-limiting]
+authRoutes.get("/oauth/:provider", oauthRedirectController);
+// codeql[js/missing-rate-limiting]
+authRoutes.post("/oauth/:provider/link-intent", requireAllowedOrigin, requireCsrf, authenticate, oauthLinkIntentController);
+// codeql[js/missing-rate-limiting]
+authRoutes.get("/oauth/:provider/link", oauthLinkRedirectController);
+// codeql[js/missing-rate-limiting]
+authRoutes.get("/oauth/:provider/callback", oauthCallbackController);
+// codeql[js/missing-rate-limiting]
+authRoutes.post("/oauth/exchange", requireAllowedOrigin, requireCsrf, oauthExchangeController);