Evandro Fonseca Junior
a1800227a7
- Add rate limiting to prevent abuse on /api/donations/create endpoint - Replace manual input validation with Zod schema for better error handling and type safety - Switch from console.log to secureLogger to comply with LGPD and avoid exposing sensitive data - Remove sensitive request body logging in AbacatePay client for improved security
49 lines
1.3 KiB
TypeScript
49 lines
1.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { abacatePay } from "@/lib/abacatepay";
|
|
import {
|
|
checkRateLimit,
|
|
getClientIP,
|
|
createRateLimitResponse,
|
|
} from "@/lib/rate-limiter";
|
|
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
// Rate limiting
|
|
const ip = getClientIP(request);
|
|
const rateLimit = checkRateLimit(ip, "/api/donations/verify");
|
|
|
|
if (!rateLimit.allowed) {
|
|
return createRateLimitResponse(rateLimit.resetAt);
|
|
}
|
|
const { searchParams } = new URL(request.url);
|
|
const billingId = searchParams.get("billingId");
|
|
|
|
if (!billingId) {
|
|
return NextResponse.json(
|
|
{ success: false, error: "ID da cobrança é obrigatório" },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
const billing = await abacatePay.getBillingStatus(billingId);
|
|
|
|
return NextResponse.json({
|
|
success: true,
|
|
status: billing.status,
|
|
amount: billing.amount,
|
|
createdAt: billing.createdAt,
|
|
expiresAt: billing.expiresAt,
|
|
});
|
|
} catch (error) {
|
|
console.error("Billing verification error:", error);
|
|
return NextResponse.json(
|
|
{
|
|
success: false,
|
|
error:
|
|
error instanceof Error ? error.message : "Erro ao verificar cobrança",
|
|
},
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|