feat: implement identity and security features

- Added account types and privileged account types constants.
- Created admin user controller for updating user security fields.
- Developed role assignment controller for managing user roles.
- Implemented validation middleware for request schemas.
- Defined user role and auth session models for database interactions.
- Created services for authentication, email notifications, and OTP handling.
- Developed OAuth service for Google and Apple authentication.
- Added JWT utility functions for token generation and verification.
- Implemented comprehensive tests for authentication, session management, and password policies.
- Created migration for updating user schema and adding new tables for auth sessions and user identities.

app/routes/adminAuth.routes.js

@@ -0,0 +1,10 @@
+const express = require("express");
+const auth = require("../controllers/auth.controller");
+const validate = require("../middleware/validate.middleware");
+const schemas = require("../validation/auth.schemas");
+const { sensitiveLimiter } = require("../middleware/rateLimit.middleware");
+const router = express.Router();
+router.use(sensitiveLimiter);
+router.post("/login", validate(schemas.login), auth.adminLogin);
+router.post("/verify-otp", validate(schemas.verifyOtp), auth.verifyOtp);
+module.exports = router;

app/routes/adminUser.routes.js

@@ -0,0 +1,9 @@
+const express = require("express");
+const controller = require("../controllers/adminUser.controller");
+const { authenticate } = require("../middleware/auth.middleware");
+const { authorizedAccountType } = require("../middleware/permission.middleware");
+const router = express.Router();
+router.use(authenticate, authorizedAccountType(["superadmin"]));
+router.patch("/:id/status", controller.updateStatus);
+router.patch("/:id/account-type", controller.updateAccountType);
+module.exports = router;

app/routes/auth.routes.js

@@ -1,36 +1,27 @@
-/**
- * Copyright (c) 2026 Niolla
- * All rights reserved.
- *
- * This source code is proprietary and confidential.
- * Unauthorized copying, modification, distribution, or use
- * of this file, via any medium, is strictly prohibited.
- */
+const express = require("express");
+const auth = require("../controllers/auth.controller");
+const user = require("../controllers/user.controller");
+const { authenticate } = require("../middleware/auth.middleware");
+const validate = require("../middleware/validate.middleware");
+const schemas = require("../validation/auth.schemas");
+const { sensitiveLimiter } = require("../middleware/rateLimit.middleware");
 
-// app/routes/auth.routes.js
-
-const express = require('express');
 const router = express.Router();
-const authController = require('../controllers/auth.controller');
-const {authenticate} = require('../middleware/auth.middleware');
-const { sensitiveLimiter } = require('../middleware/rateLimit.middleware');
-
 router.use(sensitiveLimiter);
-
-// GET /api/auth/me
-router.get("/me", authenticate, (req, res) => {
-  res.json({
-    authenticated: true,
-    user: req.user
-  });
-});
-
-router.post('/req-otp', authController.loginReq);   
-router.post('/login', authController.login);    
-router.post('/refresh', authController.refreshToken);
-router.post('/forgot-password', authController.forgotPassword);
-router.post('/reset-password', authController.resetPassword);
-router.post('/change-password', authenticate, authController.changePassword);
-router.post('/logout', authController.logout);    
+router.post("/register", validate(schemas.register), user.createNewUser);
+router.post("/login", validate(schemas.login), auth.login);
+router.post("/req-otp", validate(schemas.login), auth.loginReq);
+router.post("/verify-otp", validate(schemas.verifyOtp), auth.verifyOtp);
+router.post("/refresh", validate(schemas.refresh), auth.refreshToken);
+router.post("/logout", auth.logout);
+router.post("/logout-all", authenticate, auth.logoutAll);
+router.post("/forgot-password", validate(schemas.forgot), auth.forgotPassword);
+router.post("/reset-password", validate(schemas.reset), auth.resetPassword);
+router.post("/change-password", authenticate, validate(schemas.change), auth.changePassword);
+router.post("/verify-email", validate(schemas.verifyEmail), auth.verifyEmail);
+router.post("/resend-verification", validate(schemas.resend), auth.resendVerification);
+router.post("/google", validate(schemas.oauth), auth.oauth("google"));
+router.post("/apple", validate(schemas.oauth), auth.oauth("apple"));
+router.get("/me", authenticate, auth.me);
 
 module.exports = router;

app/routes/index.js

@@ -20,6 +20,9 @@ const docsRoutes = require("./docs.routes");
 const permissionRoutes = require("./permission.routes");
 const profileRoutes = require("./profile.routes");
 const notificationRoutes = require("./notification.routes");
+const adminAuthRoutes = require("./adminAuth.routes");
+const riderAuthRoutes = require("./riderAuth.routes");
+const adminUserRoutes = require("./adminUser.routes");
 
 const router = express.Router();
 
@@ -31,5 +34,9 @@ router.use("/document", documentRoutes);
 router.use("/docs", docsRoutes);
 router.use("/profile", profileRoutes);
 router.use("/notification", notificationRoutes);
+router.use("/permissions", permissionRoutes);
+router.use("/admin/auth", adminAuthRoutes);
+router.use("/rider/auth", riderAuthRoutes);
+router.use("/admin/users", adminUserRoutes);
 
-module.exports = router;
+module.exports = router;

app/routes/permission.routes.js

@@ -14,6 +14,13 @@ const router = express.Router();
 const permissionController = require("../controllers/permission.controller");
 const { authenticate } = require("../middleware/auth.middleware");
 const { authorizedAccountType } = require("../middleware/permission.middleware");
+const roleAssignmentController = require("../controllers/roleAssignment.controller");
+
+router.use(authenticate, authorizedAccountType(["superadmin"]));
+router.post("/users/:userId/roles/:roleId", roleAssignmentController.assignRole);
+router.delete("/users/:userId/roles/:roleId", roleAssignmentController.removeRole);
+router.get("/roles", permissionController.getAllRoles);
+router.get("/roles/:roleId", permissionController.getRoleById);
 
 // Permission routes
 router.post(

app/routes/profile.routes.js

@@ -12,6 +12,7 @@
 const express = require("express");
 const router = express.Router();
 const profileController = require("../controllers/profile.controller.js");
+const authController = require("../controllers/auth.controller.js");
 const { authenticate } = require("../middleware/auth.middleware");
 
 const {
@@ -20,29 +21,32 @@ const {
 } = require("../middleware/permission.middleware");
 const PERMISSIONS = require("../constants/permissions");
 const { sensitiveLimiter } = require("../middleware/rateLimit.middleware");
+const validate = require("../middleware/validate.middleware");
+const schemas = require("../validation/auth.schemas");
+const { requireOwnership } = require("../middleware/permission.middleware");
 
-router.post("/req-reset-password", sensitiveLimiter, profileController.requestPasswordReset);
+router.post("/req-reset-password", sensitiveLimiter, validate(schemas.forgot), authController.forgotPassword);
 
-router.post("/reset-password", sensitiveLimiter, profileController.resetPassword);
+router.post("/reset-password", sensitiveLimiter, validate(schemas.reset), authController.resetPassword);
 
 router.post(
   "/change-password",
   authenticate,
-  authorizedAccountType(["admin", "management", "team_head", "user"]),
-  profileController.changePassword,
+  validate(schemas.change),
+  authController.changePassword,
 );
 
 router.get(
   "/avatar/:userId",
   authenticate,
-  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  requireOwnership("userId"),
   profileController.getProfileAvatar,
 );
 
 router.get(
   "/background/:userId",
   authenticate,
-  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  requireOwnership("userId"),
   profileController.getProfileBackgroundImage,
 );
 

app/routes/riderAuth.routes.js

@@ -0,0 +1,10 @@
+const express = require("express");
+const auth = require("../controllers/auth.controller");
+const validate = require("../middleware/validate.middleware");
+const schemas = require("../validation/auth.schemas");
+const { sensitiveLimiter } = require("../middleware/rateLimit.middleware");
+const router = express.Router();
+router.use(sensitiveLimiter);
+router.post("/login", validate(schemas.login), auth.riderLogin);
+router.post("/verify-otp", validate(schemas.verifyOtp), auth.verifyOtp);
+module.exports = router;

app/routes/user.routes.js

@@ -19,6 +19,9 @@ const {
 const { authorizedAccountType, checkPermission } = require("../middleware/permission.middleware");
 const PERMISSIONS = require("../constants/permissions");
 
+router.get("/me", authenticate, userController.getCurrentUser);
+router.patch("/me", authenticate, userController.updateCurrentUser);
+
 
 router.post(
   "/",
@@ -41,7 +44,7 @@ router.get(
 router.get(
   "/",
   authenticate,
-  authorizedAccountType(["admin"]),
+  authorizedAccountType(["admin", "superadmin"]),
   userController.getAllUsers
 );
 
@@ -55,14 +58,14 @@ router.get(
 router.patch(
   "/:id",
   authenticate,
-  authorizedAccountType(["admin", "management", "team_head", "user"]),
+  authorizedAccountType(["superadmin"]),
   userController.updateUser
 ); 
 
 router.delete(
   "/:id",
   authenticate,
-  authorizedAccountType(["admin"]),
+  authorizedAccountType(["superadmin"]),
   userController.deleteUser
 );