first

backend/internal/modules/orders/routes.go

@@ -0,0 +1,17 @@
+package orders
+
+import "github.com/gin-gonic/gin"
+
+// RegisterPublicRoutes exposes order creation to any visitor, connected or
+// not (spec section 17-18). rateLimit throttles it to blunt spam/abuse
+// since no authentication gates this endpoint.
+func RegisterPublicRoutes(rg *gin.RouterGroup, h *Handler, rateLimit gin.HandlerFunc) {
+	rg.POST("/orders", rateLimit, h.Create)
+}
+
+func RegisterAdminRoutes(rg *gin.RouterGroup, h *Handler, requireAdmin gin.HandlerFunc) {
+	group := rg.Group("/admin/orders", requireAdmin)
+	group.GET("", h.ListAdmin)
+	group.GET("/:id", h.GetAdmin)
+	group.PATCH("/:id/status", h.UpdateStatus)
+}