LearnSpace: full-stack educational whiteboard platform

Node.js/Express backend + vanilla JS frontend.
Features: real-time collaborative whiteboard (SSE), multi-page support,
LaTeX formulas, shapes/connectors, coordinate systems, number lines,
compass, zoom/pan, Catmull-Rom pencil smoothing, ruler/protractor with
rotation & resize controls, minimap navigation overlay, auto-measurements,
multi-page thumbnails sidebar, PNG export, page templates.
Student/teacher workflows: classes, assignments, library, dashboard.
Mobile responsive. SQLite (better-sqlite3).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/shop.js

@@ -0,0 +1,39 @@
+const router = require('express').Router();
+const { authMiddleware, requireRole, requirePermission } = require('../middleware/auth');
+const rateLimit = require('../middleware/rateLimit');
+const validate  = require('../middleware/validate');
+const {
+  getItems, purchaseItem, getPurchases, getCoins, getMyActive, activateItem,
+  adminGetItems, adminCreateItem, adminUpdateItem, adminDeleteItem, adminAwardCoins, adminShopStats
+} = require('../controllers/shopController');
+
+const purchaseLimiter = rateLimit({ windowMs: 60_000, max: 10, message: 'Слишком много покупок, подождите минуту' });
+const activateSchema  = { body: { type: { type: 'string', oneOf: ['frame', 'title', 'effect'] } } };
+const adminItemSchema = { body: {
+  name:  { type: 'string', required: true, minLen: 1, maxLen: 200 },
+  type:  { type: 'string', required: true, oneOf: ['frame', 'title', 'effect'] },
+  price: { type: 'number', required: true, min: 0 },
+}};
+const awardCoinsSchema = { body: {
+  userId: { type: 'number', required: true, min: 1, integer: true },
+  amount: { type: 'number', required: true, min: 1, integer: true },
+}};
+
+router.use(authMiddleware);
+
+router.get('/items', getItems);
+router.post('/items/:id/purchase', requirePermission('shop.purchase'), purchaseLimiter, purchaseItem);
+router.get('/purchases', getPurchases);
+router.get('/coins', getCoins);
+router.get('/my-active', getMyActive);
+router.post('/activate', validate(activateSchema), activateItem);
+
+/* Admin routes */
+router.get('/admin/items',       requireRole('admin', 'teacher'), adminGetItems);
+router.post('/admin/items',      requireRole('admin'), validate(adminItemSchema), adminCreateItem);
+router.put('/admin/items/:id',   requireRole('admin'),            adminUpdateItem);
+router.delete('/admin/items/:id',requireRole('admin'),            adminDeleteItem);
+router.post('/admin/award-coins',requireRole('admin', 'teacher'), validate(awardCoinsSchema), adminAwardCoins);
+router.get('/admin/stats',       requireRole('admin', 'teacher'), adminShopStats);
+
+module.exports = router;