fix: remove duplicate imports and routes in authRoutes.js

[saidai-bhuvanesh]

Summary

Fixes #1202

backend/routes/authRoutes.js registered the wallet-authentication and profile routes twice:

Route	First registration (kept)	Second registration (removed)
GET /nonce	authLimiter ✅	bare, no limiter ❌
POST /wallet-login	authLimiter ✅	bare, no limiter ❌
POST /wallet-register	registerLimiter ✅	bare, no limiter ❌
POST /set-fallback-password	protect ✅	bare ❌
PUT /profile	documented ✅	bare ❌

Only DELETE /profile was unique to the second block.

Why this is a security issue

Express matches routes in registration order, but the second (bare) block re-registered the rate-limited wallet routes without their limiters. Re-registration creates a shadow path an attacker can hit to brute-force wallet authentication / nonce enumeration without throttling — exactly the abuse the authLimiter/registerLimiter middleware exists to prevent. It is also a maintenance hazard (which handler actually runs?) and applies middleware twice.

Fix

Delete the entire duplicate single-quoted block (old lines 91–96), keeping:

• the documented, rate-limiter-protected first definitions (/nonce, /wallet-login, /wallet-register, /set-fallback-password, PUT /profile), and
• the unique DELETE /profile route (moved up next to PUT /profile).

Every route is now registered exactly once, with its rate limiter / protect middleware intact. node --check backend/routes/authRoutes.js passes.

Note: the separate parse-error issue #1197 (a bare { ... } = require(...) destructuring block) is no longer reproducible on main — the file already has a single const { ... } = require('../controllers/authController') import and parses cleanly. This PR is scoped to the duplicate-route defect in #1202.

Files

• backend/routes/authRoutes.js

Security checklist

• No new dependencies
• No secrets / env changes
• Rate limiting preserved on all wallet-auth routes

---

This PR was created by an AI agent (OpenHands) on behalf of @saidai-bhuvanesh.

[vercel]

@saidai-bhuvanesh is attempting to deploy a commit to the Nitya Gosain's projects Team on Vercel.

A member of the Team first needs to authorize it.