add v2 API routes for admin and bug report management with rate limiting

internal/routes/routes.go

@@ -1,6 +1,7 @@
 package routes
 
 import (
+	v2 "emly-api-go/internal/routes/v2"
 	"net/http"
 
 	v1 "emly-api-go/internal/routes/v1"
@@ -22,4 +23,5 @@ func RegisterAll(r chi.Router, db *sqlx.DB) {
 	})
 
 	r.Mount("/v1", v1.NewRouter(db))
+	r.Mount("/v2", v2.NewRouter(db))
 }

internal/routes/v1/admin.go

@@ -13,17 +13,24 @@ import (
 
 func registerAdmin(r chi.Router, db *sqlx.DB) {
 	r.Route("/admin", func(r chi.Router) {
-		r.Use(httprate.LimitByIP(30, time.Minute))
 
-		// Auth — public, handles its own credential checks
+		// Auth — public, handles its own credential checks.
+		// Only /login is rate-limited: it is the only endpoint vulnerable to
+		// brute-force. /validate and /logout require a 256-bit session token
+		// and are called frequently by authenticated clients, so no limit is
+		// applied there.
 		r.Route("/auth", func(r chi.Router) {
-			r.Post("/login", handlers.LoginUser(db))
+			r.Group(func(r chi.Router) {
+				r.Use(httprate.LimitByIP(30, time.Minute))
+				r.Post("/login", handlers.LoginUser(db))
+			})
 			r.Get("/validate", handlers.ValidateSession(db))
 			r.Post("/logout", handlers.LogoutSession(db))
 		})
 
 		// User management — protected via Admin Key
 		r.Route("/users", func(r chi.Router) {
+			r.Use(httprate.LimitByIP(30, time.Minute))
 			r.Use(apimw.AdminKeyAuth(db))
 
 			r.Get("/", handlers.ListUsers(db))
@@ -34,4 +41,4 @@ func registerAdmin(r chi.Router, db *sqlx.DB) {
 			r.Delete("/{id}", handlers.DeleteUser(db))
 		})
 	})
-}
+}

internal/routes/v1/v1.go

@@ -1,7 +1,9 @@
 package v1
 
 import (
+	emlyMiddleware "emly-api-go/internal/middleware"
 	"net/http"
+	"time"
 
 	"emly-api-go/internal/handlers"
 
@@ -15,6 +17,15 @@ import (
 func NewRouter(db *sqlx.DB) http.Handler {
 	r := chi.NewRouter()
 
+	rl := emlyMiddleware.NewRateLimiter(
+		5,              // 5 req/sec per IP
+		10,             // burst fino a 10
+		20,             // ban dopo 20 violazioni
+		15*time.Minute, // ban di 15 minuti
+	)
+
+	r.Use(rl.Handler)
+
 	r.Use(func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("X-Server", "emly-api-go")

internal/routes/v2/admin.go

@@ -0,0 +1,37 @@
+package v2
+
+import (
+	apimw "emly-api-go/internal/middleware"
+	"time"
+
+	"emly-api-go/internal/handlers"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/httprate"
+	"github.com/jmoiron/sqlx"
+)
+
+func registerAdmin(r chi.Router, db *sqlx.DB) {
+	r.Route("/admin", func(r chi.Router) {
+		r.Use(httprate.LimitByIP(30, time.Minute))
+
+		// Auth — public, handles its own credential checks
+		r.Route("/auth", func(r chi.Router) {
+			r.Post("/login", handlers.LoginUser(db))
+			r.Get("/validate", handlers.ValidateSession(db))
+			r.Post("/logout", handlers.LogoutSession(db))
+		})
+
+		// User management — protected via Admin Key
+		r.Route("/users", func(r chi.Router) {
+			r.Use(apimw.AdminKeyAuth(db))
+
+			r.Get("/", handlers.ListUsers(db))
+			r.Post("/", handlers.CreateUser(db))
+			r.Get("/{id}", handlers.GetUserByID(db))
+			r.Patch("/{id}", handlers.UpdateUser(db))
+			r.Post("/{id}/reset-password", handlers.ResetPassword(db))
+			r.Delete("/{id}", handlers.DeleteUser(db))
+		})
+	})
+}

internal/routes/v2/bug_reports.go

@@ -0,0 +1,41 @@
+package v2
+
+import (
+	apimw "emly-api-go/internal/middleware"
+	"time"
+
+	"emly-api-go/internal/handlers"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/httprate"
+	"github.com/jmoiron/sqlx"
+)
+
+func registerBugReports(r chi.Router, db *sqlx.DB) {
+	r.Route("/bug-report", func(r chi.Router) {
+		// API key only: submit a report and check count
+		r.Group(func(r chi.Router) {
+			r.Use(apimw.APIKeyAuth(db))
+			r.Use(httprate.LimitByIP(30, time.Minute))
+
+			r.Get("/count", handlers.GetReportsCount(db))
+			r.Post("/", handlers.CreateBugReport(db))
+		})
+
+		// API key + admin key: full read/write access
+		r.Group(func(r chi.Router) {
+			r.Use(apimw.APIKeyAuth(db))
+			r.Use(apimw.AdminKeyAuth(db))
+			r.Use(httprate.LimitByIP(30, time.Minute))
+
+			r.Get("/", handlers.GetAllBugReports(db))
+			r.Get("/{id}", handlers.GetBugReportByID(db))
+			r.Get("/{id}/status", handlers.GetReportStatusByID(db))
+			r.Get("/{id}/files", handlers.GetReportFilesByReportID(db))
+			r.Get("/{id}/files/{file_id}", handlers.GetReportFileByFileID(db))
+			r.Get("/{id}/download", handlers.GetBugReportZipById(db))
+			r.Patch("/{id}/status", handlers.PatchBugReportStatus(db))
+			r.Delete("/{id}", handlers.DeleteBugReportByID(db))
+		})
+	})
+}

internal/routes/v2/v2.go

@@ -0,0 +1,45 @@
+package v2
+
+import (
+	emlyMiddleware "emly-api-go/internal/middleware"
+	"net/http"
+	"time"
+
+	"emly-api-go/internal/handlers"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/jmoiron/sqlx"
+)
+
+// NewRouter returns a chi.Router with all /v1 routes mounted.
+// Add new API versions by creating an analogous package (e.g. v2) and
+// mounting it alongside this one in internal/routes/routes.go.
+func NewRouter(db *sqlx.DB) http.Handler {
+	r := chi.NewRouter()
+
+	rl := emlyMiddleware.NewRateLimiter(
+		5,              // 5 req/sec per IP
+		10,             // burst fino a 10
+		20,             // ban dopo 20 violazioni
+		15*time.Minute, // ban di 15 minuti
+	)
+
+	r.Use(rl.Handler)
+
+	r.Use(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("X-Server", "emly-api-go")
+			w.Header().Set("X-Powered-By", "Rexouium in a suit")
+			next.ServeHTTP(w, r)
+		})
+	})
+
+	r.Get("/health", handlers.Health(db))
+
+	r.Route("/api", func(r chi.Router) {
+		registerAdmin(r, db)
+		registerBugReports(r, db)
+	})
+
+	return r
+}