Inna
66d056c04b
- /transfer-d-points: transferir PD a la cuenta dueña de un personaje (requiere token de seguridad; movimiento atómico con FOR UPDATE). - /trade-points: comercio PD<->oro mediante códigos de 1 solo uso (contraseña + token + Turnstile; oro al creador por SOAP; expira 1h; lock de 5s tras canjear; rollback total si falla la entrega). - /promo-code: canje de códigos por PD/PV (sensibles a mayúsculas/minúsculas, usos limitados, 1 canje por cuenta). - /admin/promo: panel para crear / editar / activar / desactivar / borrar códigos de promoción. - Tablas nuevas (sql/): home_tradecode, home_promocode, home_promoredemption. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
34 lines
1.1 KiB
TypeScript
34 lines
1.1 KiB
TypeScript
import { getSession } from '@/lib/session'
|
|
import { verifyTurnstile } from '@/lib/turnstile'
|
|
import { createTradeCode } from '@/lib/trade'
|
|
|
|
/** VENTA: crea un código de Comercio de PD. */
|
|
export async function POST(request: Request) {
|
|
const session = await getSession()
|
|
if (!session.accountId || !session.username) {
|
|
return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
|
|
}
|
|
|
|
let body: Record<string, unknown> = {}
|
|
try {
|
|
body = await request.json()
|
|
} catch {
|
|
return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
|
|
}
|
|
|
|
const ip = (request.headers.get('x-forwarded-for') || '').split(',')[0].trim() || undefined
|
|
const turnstileOk = await verifyTurnstile(String(body.turnstile ?? ''), ip)
|
|
|
|
const result = await createTradeCode({
|
|
creatorAccount: session.accountId,
|
|
creatorEmail: session.bnetEmail || '',
|
|
creatorCharacter: String(body.character ?? '').trim(),
|
|
points: Number(body.points),
|
|
gold: Number(body.gold),
|
|
password: String(body.password ?? ''),
|
|
token: String(body.token ?? '').trim(),
|
|
turnstileOk,
|
|
})
|
|
return Response.json(result)
|
|
}
|