starr-philproperties/apps/api/routes/public/media.routes.js

/***********************************************************************************************************************************************************************
 * File Name: media.routes.js  (public)
 * Type of Program: Routes
 * Author: Kenneth Obsequio (@lash0000)
 * Date Created: Jun. 22, 2026
 ***********************************************************************************************************************************************************************/
"use strict";

const rateLimit = require("express-rate-limit");
const router    = require("express").Router();
const ctrl      = require("../../controllers/public/media.controller");

// 60 token requests per IP per 15 min — generous enough for a page with many assets
// but still blocks scrapers from bulk-fetching tokens
const publicTokenLimiter = rateLimit({
  windowMs:       15 * 60 * 1000,
  max:            60,
  keyGenerator:   (req) => req.ip,
  standardHeaders: true,
  legacyHeaders:   false,
  message:        { status: "error", message: "Too many requests. Please try again later." },
});

// Supports both GET (query string) and POST (body) for flexibility
router.get("/token",  publicTokenLimiter, ctrl.issueToken);
router.post("/token", publicTokenLimiter, ctrl.issueToken);

module.exports = router;