construprogress/routes/api.php

<?php

use App\Http\Controllers\Api\V1\AuthController;
use App\Http\Controllers\Api\V1\MediaController;
use App\Http\Controllers\Api\V1\ProjectApiController;
use App\Http\Controllers\Api\V1\SyncController;
use Illuminate\Support\Facades\Route;

Route::prefix('v1')->group(function () {

    // Público
    Route::post('login', [AuthController::class, 'login'])->middleware('throttle:10,1');

    // Protegido: token Sanctum con ability 'mobile-sync'
    Route::middleware(['auth:sanctum', 'ability:mobile-sync'])->group(function () {
        Route::get('me', [AuthController::class, 'me']);
        Route::post('logout', [AuthController::class, 'logout']);

        // PULL - rate limit: 120 req/min
        Route::middleware('throttle:120,1')->group(function () {
            Route::get('projects', [ProjectApiController::class, 'index']);
            Route::get('projects/{project}/bundle', [ProjectApiController::class, 'bundle']);
            Route::get('templates', [ProjectApiController::class, 'templates']);
        });

        // PUSH - rate limit: 60 req/min
        Route::middleware('throttle:60,1')->group(function () {
            Route::post('sync', [SyncController::class, 'sync']);
        });

        // Media - rate limit: 120 req/min
        Route::middleware('throttle:120,1')->group(function () {
            Route::post('media', [MediaController::class, 'upload']);
        });
    });
});