From ae236502cde264834520891014925f760ad3b46d Mon Sep 17 00:00:00 2001
From: Gowtham M <gowtham.m@venbainfotech.com>
Date: Thu, 18 Dec 2025 19:47:40 +0530
Subject: [PATCH] CSRF token removed only for login api : GWM

---
 app/routes/routes.js | 11 ++++-------
 server.js            |  6 +++---
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/app/routes/routes.js b/app/routes/routes.js
index ce9c317..335299b 100644
--- a/app/routes/routes.js
+++ b/app/routes/routes.js
@@ -106,7 +106,6 @@ const upload = multer({ dest: UPLOAD_DIR });
  *     tags: [Admin And Establishments User Auth]
  *     security:
  *       - appSignature: []
- *       - CSRF: []
  *     requestBody:
  *       required: true
  *       content:
@@ -146,7 +145,6 @@ router.post("/auth/admin_register",[verifySignature], authController.register);
  *     tags: [Admin And Establishments User Auth]
  *     security:
  *       - appSignature: []
- *       - CSRF: []
  *     requestBody:
  *       required: true
  *       content:
@@ -181,7 +179,6 @@ router.post("/auth/login",[verifySignature], authController.login);
  *     tags: [Admin And Establishments User Auth]
  *     security:
  *       - appSignature: []
- *       - CSRF: []
  */
 router.get("/auth/logout",[verifySignature], authController.logout);
 
@@ -2828,7 +2825,7 @@ router.post("/password-reset-requests", establishmentController.createRequest);
  *     summary: Request OTP for establishment user pwd reset
  *     tags: [Establishment Pwd Reset Requests]
  *     security:
- *       - CSRF: []
+ *       - appSignature: []
  *     requestBody:
  *       required: true
  *       content:
@@ -2854,7 +2851,7 @@ router.post("/password-reset-requests", establishmentController.createRequest);
  *       500:
  *         description: Server error
  */
-router.post("/forgot-password/request-otp", establishmentController.forgotPasswordRequestOTP);
+router.post("/forgot-password/request-otp",[verifySignature], establishmentController.forgotPasswordRequestOTP);
 
 
 
@@ -2866,7 +2863,7 @@ router.post("/forgot-password/request-otp", establishmentController.forgotPasswo
  *     summary: Verify OTP and reset establishment user Pwd
  *     tags: [Establishment Pwd Reset Requests]
  *     security:
- *       - CSRF: []
+ *       - appSignature: []
  *     requestBody:
  *       required: true
  *       content:
@@ -2893,7 +2890,7 @@ router.post("/forgot-password/request-otp", establishmentController.forgotPasswo
  *       500:
  *         description: Server error
  */
-router.post("/forgot-password/verify-otp", establishmentController.forgotPasswordVerifyOTP);
+router.post("/forgot-password/verify-otp",[verifySignature], establishmentController.forgotPasswordVerifyOTP);
 
 
 
diff --git a/server.js b/server.js
index 88443a4..f1e9ece 100644
--- a/server.js
+++ b/server.js
@@ -156,9 +156,9 @@ app.use(
  * AUTH (NO CSRF)
  * --------------------
  */
-app.post("api/auth/login",[verifySignature], authController.login);
-app.post("api/forgot-password/request-otp",[verifySignature], establishmentController.forgotPasswordRequestOTP);
-app.post("api/forgot-password/request-otp",[verifySignature], establishmentController.forgotPasswordRequestOTP);
+app.post("/api/auth/login",[verifySignature], authController.login);
+app.post("/api/forgot-password/request-otp",[verifySignature], establishmentController.forgotPasswordRequestOTP);
+app.post("/api/forgot-password/verify-otp",[verifySignature], establishmentController.forgotPasswordVerifyOTP);
 
 /**
  * --------------------