mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
33 lines
1.3 KiB
JavaScript
33 lines
1.3 KiB
JavaScript
const express = require('express');
|
|
const router = express.Router();
|
|
const ctrl = require('../../controllers/client/tiers.controller');
|
|
const { sensitiveOpsLimiter } = require('../../middleware/rateLimiter.middleware');
|
|
|
|
// My tier
|
|
router.get ('/me', ctrl.getMyTier);
|
|
router.get ('/me/history', ctrl.getMyTierHistory);
|
|
|
|
// Plans
|
|
router.get ('/plans', ctrl.getPlans);
|
|
|
|
// Promo code validation — rate-limited: unthrottled retries let an attacker
|
|
// brute-force/enumerate valid promo codes off the "Invalid promo code" reason.
|
|
router.post('/promos/validate', sensitiveOpsLimiter, ctrl.validatePromo);
|
|
|
|
// Checkout — order creation is rate-limited: unthrottled retries let a user
|
|
// burn through a limited-use promo's max_uses without ever paying.
|
|
router.post('/checkout/order', sensitiveOpsLimiter, ctrl.createOrder);
|
|
router.post('/checkout/capture', ctrl.captureOrder);
|
|
router.post('/checkout/cancel', ctrl.cancelOrder);
|
|
router.post('/checkout/refund', ctrl.refundOrder);
|
|
|
|
// My payments
|
|
router.get ('/me/payments', ctrl.getMyPayments);
|
|
|
|
// Tier categories (public — for course badge display)
|
|
router.get ('/categories', ctrl.getCategories);
|
|
|
|
// System badges (public read for profile display)
|
|
router.get ('/system-badges', ctrl.getSystemBadges);
|
|
|
|
module.exports = router; |