chore: build

backend/internal/modules/orders/routes.go

@@ -2,16 +2,24 @@ package orders
 
 import "github.com/gin-gonic/gin"
 
-// RegisterPublicRoutes exposes order creation to any visitor, connected or
-// not (spec section 17-18). rateLimit throttles it to blunt spam/abuse
-// since no authentication gates this endpoint.
-func RegisterPublicRoutes(rg *gin.RouterGroup, h *Handler, rateLimit gin.HandlerFunc) {
-	rg.POST("/orders", rateLimit, h.Create)
+// RegisterPublicRoutes exposes order creation. rateLimit throttles it to
+// blunt spam/abuse. requireOrdersEnabled rejects every request with 403
+// while the site is in showcase-only mode; requireAccountsEnabled then
+// rejects every remaining request (guest or not) with 403 until the admin
+// turns on customer accounts (see gate.go); once on, requireCustomer
+// enforces a logged-in customer and requireVerified additionally requires
+// an approved identity verification if the admin also turned that on.
+func RegisterPublicRoutes(rg *gin.RouterGroup, h *Handler, rateLimit, requireOrdersEnabled, requireAccountsEnabled, requireCustomer, requireVerified gin.HandlerFunc) {
+	rg.POST("/orders", rateLimit, requireOrdersEnabled, requireAccountsEnabled, requireCustomer, requireVerified, h.Create)
+}
+
+// RegisterCustomerRoutes exposes a logged-in customer's own order history.
+func RegisterCustomerRoutes(rg *gin.RouterGroup, h *Handler, requireCustomer gin.HandlerFunc) {
+	rg.GET("/customer/orders", requireCustomer, h.ListMine)
 }
 
 func RegisterAdminRoutes(rg *gin.RouterGroup, h *Handler, requireAdmin gin.HandlerFunc) {
 	group := rg.Group("/admin/orders", requireAdmin)
 	group.GET("", h.ListAdmin)
 	group.GET("/:id", h.GetAdmin)
-	group.PATCH("/:id/status", h.UpdateStatus)
 }