festbench-web/routes/api.php

<?php

use App\Http\Controllers\Api\CliDeviceController;
use App\Http\Controllers\Api\GpuCatalogController;
use App\Http\Controllers\Api\MeController;
use Illuminate\Support\Facades\Route;

Route::get('/me', MeController::class)->middleware('auth:sanctum');

Route::middleware('auth:sanctum')->group(function () {
    Route::get('/gpus', [GpuCatalogController::class, 'index'])->middleware('ability:gpus:read');
});

Route::middleware('throttle:10,1')->post('/cli/device', [CliDeviceController::class, 'request']);

// The CLI polls every 3 seconds while waiting for browser confirmation
// (~200 polls over the full 10-minute window) — the limiter must allow
// that rhythm or the login appears to time out while granted.
Route::middleware('throttle:120,1')->post('/cli/poll', [CliDeviceController::class, 'poll']);