photoplaces/backend/cmd/api/main.go

package main

import (
	"context"
	"log"
	"net/http"

	"github.com/go-chi/chi/v5"
	chimiddleware "github.com/go-chi/chi/v5/middleware"
	"github.com/go-chi/cors"
	"github.com/redis/go-redis/v9"

	"github.com/photoplaces/backend/internal/config"
	"github.com/photoplaces/backend/internal/handlers"
	"github.com/photoplaces/backend/internal/middleware"
	"github.com/photoplaces/backend/internal/repository"
	"github.com/photoplaces/backend/internal/services"
)

func main() {
	cfg := config.Load()
	ctx := context.Background()

	pool, err := repository.NewPool(ctx, cfg.DatabaseURL)
	if err != nil {
		log.Fatalf("database connection: %v", err)
	}
	defer pool.Close()

	userRepo := repository.NewUserRepo(pool)
	refreshTokenRepo := repository.NewRefreshTokenRepo(pool)
	placeRepo := repository.NewPlaceRepo(pool)
	serviceRepo := repository.NewServiceRepo(pool)
	reviewRepo := repository.NewReviewRepo(pool)
	bookingRepo := repository.NewBookingRepo(pool)
	tagRepo := repository.NewTagRepo(pool)
	featureRepo := repository.NewFeatureRepo(pool)

	authSvc := services.NewAuthService(userRepo, refreshTokenRepo, cfg.JWTSecret, cfg.JWTRefreshSecret)
	placeSvc := services.NewPlaceService(placeRepo)

	authHandler := handlers.NewAuthHandler(authSvc, cfg.AppEnv)
	userHandler := handlers.NewUserHandler(userRepo)
	placeHandler := handlers.NewPlaceHandler(placeSvc)
	serviceHandler := handlers.NewServiceHandler(serviceRepo, tagRepo)
	reviewHandler := handlers.NewReviewHandler(reviewRepo)
	bookingHandler := handlers.NewBookingHandler(bookingRepo, placeRepo)
	tagHandler := handlers.NewTagHandler(tagRepo, featureRepo)
	wsHub := handlers.NewWSHub()
	uploadHandler, err := handlers.NewUploadHandler(cfg.S3Endpoint, cfg.S3PublicEndpoint, cfg.S3AccessKey, cfg.S3SecretKey, cfg.S3Bucket, false)
	if err != nil {
		log.Fatalf("upload handler: %v", err)
	}

	redisOpts, err := redis.ParseURL(cfg.RedisURL)
	if err != nil {
		log.Fatalf("parse redis url: %v", err)
	}
	redisClient := redis.NewClient(redisOpts)
	defer redisClient.Close()

	if err := redisClient.Ping(ctx).Err(); err != nil {
		log.Printf("Warning: Redis connection failed, rate limiting disabled: %v", err)
	}

	authLimiter, _ := middleware.RateLimitAuthEndpoints(redisClient)
	apiReadLimiter, _ := middleware.RateLimitAPIRead(redisClient)
	apiWriteLimiter, _ := middleware.RateLimitAPIWrite(redisClient)
	adminLimiter, _ := middleware.RateLimitAdmin(redisClient)

	r := chi.NewRouter()

	r.Use(chimiddleware.Logger)
	r.Use(chimiddleware.Recoverer)
	r.Use(chimiddleware.RequestID)
	r.Use(cors.Handler(cors.Options{
		AllowedOrigins:   cfg.AllowedOrigins,
		AllowedMethods:   []string{"GET", "POST", "PATCH", "DELETE", "OPTIONS"},
		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type"},
		AllowCredentials: true,
		MaxAge:           300,
	}))

	r.Route("/api/v1", func(r chi.Router) {
		r.Get("/health", func(w http.ResponseWriter, r *http.Request) {
			w.Write([]byte(`{"status":"ok"}`))
		})

		// Public auth - strict rate limiting
		r.Group(func(r chi.Router) {
			if authLimiter != nil {
				r.Use(authLimiter.Middleware())
			}
			r.Post("/auth/register", authHandler.Register)
			r.Post("/auth/login", authHandler.Login)
			r.Post("/auth/refresh", authHandler.Refresh)
		})

		// Public read endpoints - moderate rate limiting
		r.Group(func(r chi.Router) {
			if apiReadLimiter != nil {
				r.Use(apiReadLimiter.Middleware())
			}
			r.Get("/reviews", reviewHandler.List)
			r.Get("/tags", tagHandler.ListTags)
			r.Get("/features", tagHandler.ListFeatures)
			r.Get("/services", serviceHandler.List)
			r.Get("/services/{id}", serviceHandler.GetByID)
			r.Get("/places", placeHandler.List)
			r.Get("/places/{id}", placeHandler.GetByID)
			r.Get("/users/{id}", userHandler.GetProfile)
		})

		// WebSocket visitor dots
		r.Get("/ws/visitors", wsHub.HandleWS)

		// Authenticated write endpoints - stricter rate limiting
		r.Group(func(r chi.Router) {
			r.Use(middleware.AuthMiddleware(authSvc))
			if apiWriteLimiter != nil {
				r.Use(apiWriteLimiter.Middleware())
			}
			r.Get("/auth/me", authHandler.Me)
			r.Post("/auth/logout", authHandler.Logout)

			// Users
			r.Patch("/users/me", userHandler.UpdateMe)

			// Upload
			r.Post("/upload/presigned-url", uploadHandler.PresignedURL)

			// Bookings
			r.Post("/bookings", bookingHandler.Create)
			r.Get("/bookings/me", bookingHandler.ListMy)
			r.Patch("/bookings/{id}/cancel", bookingHandler.Cancel)

			// Reviews
			r.Post("/reviews", reviewHandler.Create)

			// Services
			r.Post("/services", serviceHandler.Create)
			r.Patch("/services/{id}", serviceHandler.Update)
			r.Delete("/services/{id}", serviceHandler.Delete)

			// Place creation
			r.Post("/places", placeHandler.Create)
			r.Patch("/places/{id}", placeHandler.Update)
			r.Delete("/places/{id}", placeHandler.Delete)
		})

		// Moderator / Admin - higher limits
		r.Group(func(r chi.Router) {
			r.Use(middleware.AuthMiddleware(authSvc))
			r.Use(middleware.RoleMiddleware("moderator", "superadmin"))
			if adminLimiter != nil {
				r.Use(adminLimiter.Middleware())
			}
			r.Post("/places/{id}/moderate", placeHandler.Moderate)
			r.Get("/admin/users", userHandler.AdminListUsers)
			r.Patch("/admin/users/{id}", userHandler.AdminUpdateUser)
			r.Patch("/admin/bookings/{id}/confirm", bookingHandler.Confirm)
			r.Post("/admin/tags", tagHandler.CreateTag)
			r.Delete("/admin/tags", tagHandler.DeleteTag)
			r.Post("/admin/features", tagHandler.CreateFeature)
			r.Delete("/admin/features", tagHandler.DeleteFeature)
		})
	})

	port := cfg.ServerPort
	log.Printf("Starting server on :%s", port)
	if err := http.ListenAndServe(":"+port, r); err != nil {
		log.Fatal(err)
	}
}