Unauthenticated API routes:

rl getTrackPlays

Authenticated API routes:

st checkoutSessionFunction
st portalSessionFunction

ok handleFileSharingUpload - note: user can replace track audio after initial upload
ok setSharingUsername - note: two users can have the same share_name
ok getConductorLimits - note: extra auth check and unnecessary getUserById?
ok socketMessageHandler - TODO verify socket.request.user is securely populated, check how socketio handles overlong messages (DoS)
ok conductorMessageHandler - note: unnecessary getUserById?
rl composerMessageHandler - all rate limiting is currently client-side
ok getSemanticRank - note: anything that calls semanticRank should probably have a per-user rate limit so openai does not ban us

Webhooks:

ok typeformWebhook - note: we do not verify the request comes from typeform

---

Notes:

ok: These routes are fine

rl: Should be rate limited to prevent denial of service

st: Stripe routes
https://stripe.com/docs/security/guide
- Minimize external javascript

nc: No access checks on these routes - any authenticated user can access the resource