Milestone 5 (media):
- POST /api/v1/media — multipart upload, attaches to feature/issue/project/
phase/layer, idempotent by uuid, authz member + 'upload media'. Added
uuid+client_updated_at to media.
- Bundle now includes a 'media' array (URLs) for the project's project/feature/
issue attachments (delta-aware).
Milestone 6 (hardening + docs):
- sync_logs table/model: every applied op is logged; /sync short-circuits on a
repeated op uuid -> 'duplicate' (true idempotency for updates too, not just
creates).
- Rate limiting on login (10/min), sync (60/min), media (120/min).
- docs/openapi.yaml: OpenAPI 3 contract for the mobile team.
Tests: 18 passing (added media upload idempotency + sync_logs idempotency).
The mobile API (Milestones 1-6) is now feature-complete on the webapp side.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Approved plan/protocol for connecting a mobile app to the webapp: offline-first
with device outbox, PULL (bundle/delta/versioned templates/tombstones), PUSH
(/api/v1/sync idempotent by client uuid), media via multipart, conflict policy,
schema additions, security, and phased webapp deliverables. Auth decided:
Laravel Sanctum API tokens. No implementation yet.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
javier