From 1ccf30979df7558ae5a47783f10e9c99fce5c18e Mon Sep 17 00:00:00 2001
From: Sidney Gomes <sidney.gomes1989@gmail.com>
Date: Tue, 21 Jul 2026 17:51:48 -0300
Subject: [PATCH] fix: create GET /api/settings endpoint for student components
 to prevent 403 Forbidden crash

---
 server.ts                            | 11 +++++++++++
 src/components/CourseUnlockModal.tsx |  4 ++--
 src/components/SubscriptionView.tsx  |  2 +-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/server.ts b/server.ts
index d10f5ca..440f7ea 100644
--- a/server.ts
+++ b/server.ts
@@ -659,6 +659,17 @@ app.post('/api/admin/students/:id/status', authenticateToken, requireAdmin, (req
   res.json({ success: true, status: student.subscriptionStatus });
 });
 
+// Student / Public System Settings
+app.get('/api/settings', authenticateToken, (req: AuthenticatedRequest, res: Response) => {
+  const db = loadDb();
+  const settings = db.settings || {};
+  res.json({
+    trialDurationDays: settings.trialDurationDays || 7,
+    helpText: settings.helpText || '',
+    enableBoleto: settings.enableBoleto !== false
+  });
+});
+
 // Admin System Settings
 app.get('/api/admin/settings', authenticateToken, requireAdmin, (req: AuthenticatedRequest, res: Response) => {
   const db = loadDb();
diff --git a/src/components/CourseUnlockModal.tsx b/src/components/CourseUnlockModal.tsx
index d418b10..e841b71 100644
--- a/src/components/CourseUnlockModal.tsx
+++ b/src/components/CourseUnlockModal.tsx
@@ -1,4 +1,4 @@
-import React, { useState } from 'react';
+import React, { useState, useEffect } from 'react';
 import { X, Check, CreditCard, QrCode, FileText, Sparkles, Loader2, Play } from 'lucide-react';
 import { Course } from '../types';
 
@@ -46,7 +46,7 @@ export default function CourseUnlockModal({ course, onClose, onSuccess, token }:
 
   useEffect(() => {
     if (token) {
-      fetch('/api/admin/settings', {
+      fetch('/api/settings', {
         headers: { 'Authorization': `Bearer ${token}` }
       })
         .then(res => res.json())
diff --git a/src/components/SubscriptionView.tsx b/src/components/SubscriptionView.tsx
index e107d88..e8bec87 100644
--- a/src/components/SubscriptionView.tsx
+++ b/src/components/SubscriptionView.tsx
@@ -36,7 +36,7 @@ export default function SubscriptionView({ user, token, onStatusUpdate }: Subscr
   useEffect(() => {
     fetchSubscriptionDetails();
     if (token) {
-      fetch('/api/admin/settings', {
+      fetch('/api/settings', {
         headers: { 'Authorization': `Bearer ${token}` }
       })
         .then(res => res.json())