construprogress/routes/api.php

<?php

use App\Http\Controllers\Api\V1\AuthController;
use App\Http\Controllers\Api\V1\MediaController;
use App\Http\Controllers\Api\V1\ProjectApiController;
use App\Http\Controllers\Api\V1\SyncController;
use Illuminate\Support\Facades\Route;

Route::prefix('v1')->group(function () {

    // Público
    Route::post('login', [AuthController::class, 'login'])->middleware('throttle:10,1');

    // Protegido: token Sanctum con ability 'mobile-sync'
    Route::middleware(['auth:sanctum', 'ability:mobile-sync'])->group(function () {
        Route::get('me', [AuthController::class, 'me']);
        Route::post('logout', [AuthController::class, 'logout']);

        // PULL
        Route::get('projects', [ProjectApiController::class, 'index']);
        Route::get('projects/{project}/bundle', [ProjectApiController::class, 'bundle']);
        Route::get('templates', [ProjectApiController::class, 'templates']);

        // PUSH
        Route::post('sync', [SyncController::class, 'sync'])->middleware('throttle:60,1');
        Route::post('media', [MediaController::class, 'upload'])->middleware('throttle:120,1');
    });
});