working ish wihotu cookies

src/app/api/room/create/route.ts

@@ -1,7 +1,37 @@
 import { NextResponse } from 'next/server';
 import { createRoom } from '@/lib/rooms';
+import { rateLimit, getClientIdentifier } from '@/lib/rate-limit';
+import { createRoomSchema } from '@/lib/validation';
 
-export async function POST() {
-  const { code, moderatorId } = createRoom();
-  return NextResponse.json({ code, moderatorId });
+export async function POST(req: Request) {
+  try {
+    // Rate limit: max 5 rooms per IP per hour
+    const clientId = getClientIdentifier(req);
+    const rateLimitResult = rateLimit(`create:${clientId}`, 5, 3600000);
+    
+    if (!rateLimitResult.success) {
+      return NextResponse.json(
+        { error: 'Too many rooms created. Try again later.' },
+        { status: 429 }
+      );
+    }
+
+    // Validate request (empty body is fine for create)
+    const body = await req.json().catch(() => ({}));
+    createRoomSchema.parse(body);
+
+    const { code, moderatorId } = createRoom();
+    
+    return NextResponse.json({ 
+      code, 
+      moderatorId,
+      remaining: rateLimitResult.remaining 
+    });
+  } catch (error: unknown) {
+    console.error('Create room error:', error);
+    return NextResponse.json(
+      { error: 'Failed to create room' },
+      { status: 400 }
+    );
+  }
 }