const express     = require('express');
const router      = express.Router();
const ctrl        = require('../../controllers/client/tiers.controller');
const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');

// My tier
router.get ('/me',               ctrl.getMyTier);
router.get ('/me/history',       ctrl.getMyTierHistory);

// Plans
router.get ('/plans',            ctrl.getPlans);

// Promo code validation — rate-limited: unthrottled retries let an attacker
// brute-force/enumerate valid promo codes off the "Invalid promo code" reason.
router.post('/promos/validate',  sensitiveOpsLimiter, ctrl.validatePromo);

// Checkout — order creation is rate-limited: unthrottled retries let a user
// burn through a limited-use promo's max_uses without ever paying.
router.post('/checkout/order',   sensitiveOpsLimiter, ctrl.createOrder);
router.post('/checkout/capture', ctrl.captureOrder);
router.post('/checkout/cancel',  ctrl.cancelOrder);
router.post('/checkout/refund',  ctrl.refundOrder);

// My payments
router.get ('/me/payments',      ctrl.getMyPayments);

// Tier categories (public — for course badge display)
router.get ('/categories',       ctrl.getCategories);

// System badges (public read for profile display)
router.get ('/system-badges',    ctrl.getSystemBadges);

module.exports = router;