first

backend/internal/modules/auth/admin_routes.go

@@ -0,0 +1,14 @@
+package auth
+
+import "github.com/gin-gonic/gin"
+
+// RegisterAdminRoutes mounts the admin-space auth endpoints. loginRateLimit
+// is applied only to /login to blunt credential-stuffing/brute-force
+// attempts without throttling normal authenticated traffic.
+func RegisterAdminRoutes(rg *gin.RouterGroup, h *AdminHandler, requireAdmin gin.HandlerFunc, loginRateLimit gin.HandlerFunc) {
+	group := rg.Group("/auth/admin")
+	group.POST("/login", loginRateLimit, h.Login)
+	group.POST("/refresh", h.Refresh)
+	group.POST("/logout", h.Logout)
+	group.GET("/me", requireAdmin, h.Me)
+}