Evandro Fonseca Junior
a1800227a7
- Add rate limiting to prevent abuse on /api/donations/create endpoint - Replace manual input validation with Zod schema for better error handling and type safety - Switch from console.log to secureLogger to comply with LGPD and avoid exposing sensitive data - Remove sensitive request body logging in AbacatePay client for improved security
45 lines
1.1 KiB
TypeScript
45 lines
1.1 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { getPaymentStatus } from "@/lib/payment-cache";
|
|
import {
|
|
checkRateLimit,
|
|
getClientIP,
|
|
createRateLimitResponse,
|
|
} from "@/lib/rate-limiter";
|
|
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
// Rate limiting
|
|
const ip = getClientIP(request);
|
|
const rateLimit = checkRateLimit(ip, "/api/donations/status");
|
|
|
|
if (!rateLimit.allowed) {
|
|
return createRateLimitResponse(rateLimit.resetAt);
|
|
}
|
|
const { searchParams } = new URL(request.url);
|
|
const pixId = searchParams.get("pixId");
|
|
|
|
if (!pixId) {
|
|
return NextResponse.json(
|
|
{ error: "pixId é obrigatório" },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
const status = getPaymentStatus(pixId);
|
|
|
|
return NextResponse.json({
|
|
pixId,
|
|
paid: status?.paid || false,
|
|
paidAt: status?.paidAt,
|
|
amount: status?.amount,
|
|
anonymous: status?.anonymous,
|
|
});
|
|
} catch (error) {
|
|
console.error("Erro ao verificar status do pagamento:", error);
|
|
return NextResponse.json(
|
|
{ error: "Erro ao verificar status" },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|