purchase / checkout flow

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

apps/api/routes/client/course_purchases.routes.js

@@ -1,9 +1,10 @@
 const express = require('express');
 const router  = express.Router();
 const ctrl    = require('../../controllers/client/course_purchases.controller');
+const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
 
 router.get ('/',         ctrl.getMyPurchases);
-router.post('/order',    ctrl.createCourseOrder);
+router.post('/order',    sensitiveOpsLimiter, ctrl.createCourseOrder);
 router.post('/capture',  ctrl.captureCourseOrder);
 router.post('/cancel',   ctrl.cancelCourseOrder);
 

apps/api/routes/client/tiers.routes.js

@@ -1,6 +1,7 @@
 const express     = require('express');
 const router      = express.Router();
 const ctrl        = require('../../controllers/client/tiers.controller');
+const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
 
 // My tier
 router.get ('/me',               ctrl.getMyTier);
@@ -9,11 +10,13 @@ router.get ('/me/history',       ctrl.getMyTierHistory);
 // Plans
 router.get ('/plans',            ctrl.getPlans);
 
-// Promo code validation
-router.post('/promos/validate',  ctrl.validatePromo);
+// Promo code validation — rate-limited: unthrottled retries let an attacker
+// brute-force/enumerate valid promo codes off the "Invalid promo code" reason.
+router.post('/promos/validate',  sensitiveOpsLimiter, ctrl.validatePromo);
 
-// Checkout
-router.post('/checkout/order',   ctrl.createOrder);
+// Checkout — order creation is rate-limited: unthrottled retries let a user
+// burn through a limited-use promo's max_uses without ever paying.
+router.post('/checkout/order',   sensitiveOpsLimiter, ctrl.createOrder);
 router.post('/checkout/capture', ctrl.captureOrder);
 router.post('/checkout/cancel',  ctrl.cancelOrder);
 router.post('/checkout/refund',  ctrl.refundOrder);