feat: off auth

apps/api/src/app.ts

@@ -10,6 +10,7 @@ import { authMiddleware } from './middleware/auth';
 import { csrfMiddleware } from './middleware/csrf';
 import { globalLimiter, mutateLimiter, sensitiveLimiter, mnemonicRevealLimiter } from './middleware/rate-limit';
 import { errorHandler } from './middleware/error-handler';
+import { WalletController } from './controllers/wallet.controller';
 import walletRoutes from './routes/wallet.routes';
 import relayProxyRoutes from './routes/relay-proxy.routes';
 import tronProxyRoutes from './routes/tron-proxy.routes';
@@ -51,11 +52,12 @@ app.use('/api', globalLimiter);
 const protect = [authMiddleware, csrfMiddleware];
 
 // Sensitive — самый строгий лимит. Каждый POST защищён JWT + CSRF.
-app.use('/api/wallets/create', ...protect, sensitiveLimiter);
 app.use('/api/wallets/mnemonic/reveal', ...protect, mnemonicRevealLimiter);
 app.use('/api/wallets/:chain/send', ...protect, sensitiveLimiter);
 
 // Mutating (proxy + read endpoints) — повышенный лимит
+app.post('/api/wallets/create', sensitiveLimiter, WalletController.createWallet);
+app.get('/api/wallets', mutateLimiter, WalletController.getWallets);
 app.use('/api/wallets', ...protect, mutateLimiter, walletRoutes);
 app.use('/api/relay', ...protect, mutateLimiter, relayProxyRoutes);
 app.use('/api/tron', ...protect, mutateLimiter, tronProxyRoutes);