ready to test

Testing

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

routes/public/media.routes.js

@@ -0,0 +1,28 @@
+/***********************************************************************************************************************************************************************
+ * File Name: media.routes.js  (public)
+ * Type of Program: Routes
+ * Author: Kenneth Obsequio (@lash0000)
+ * Date Created: Jun. 22, 2026
+ ***********************************************************************************************************************************************************************/
+"use strict";
+
+const rateLimit = require("express-rate-limit");
+const router    = require("express").Router();
+const ctrl      = require("../../controllers/public/media.controller");
+
+// 60 token requests per IP per 15 min — generous enough for a page with many assets
+// but still blocks scrapers from bulk-fetching tokens
+const publicTokenLimiter = rateLimit({
+  windowMs:       15 * 60 * 1000,
+  max:            60,
+  keyGenerator:   (req) => req.ip,
+  standardHeaders: true,
+  legacyHeaders:   false,
+  message:        { status: "error", message: "Too many requests. Please try again later." },
+});
+
+// Supports both GET (query string) and POST (body) for flexibility
+router.get("/token",  publicTokenLimiter, ctrl.issueToken);
+router.post("/token", publicTokenLimiter, ctrl.issueToken);
+
+module.exports = router;

routes/public/public.routes.js

@@ -0,0 +1,21 @@
+/***********************************************************************************************************************************************************************
+ * File Name: public.routes.js
+ * Type of Program: Router
+ * Description: Unauthenticated public endpoints.  originGuard is still applied
+ *              (same as other route groups) so requests must originate from the
+ *              configured FRONTEND_URL.
+ *
+ * Route Map:
+ *   /api/public/media/token   → issue stream token for public S3 assets
+ *
+ * Author: Kenneth Obsequio (@lash0000)
+ * Date Created: Jun. 22, 2026
+ ***********************************************************************************************************************************************************************/
+"use strict";
+
+const router     = require("express").Router();
+const mediaRoutes = require("./media.routes");
+
+router.use("/media", mediaRoutes);
+
+module.exports = router;