Add visitor phone lookup flow

server/internal/httpapi/server.go

@@ -27,14 +27,15 @@ const (
 )
 
 type Server struct {
-	db            *gorm.DB
-	config        config.Config
-	cipher        *security.Cipher
-	logger        *slog.Logger
-	hub           eventPublisher
-	loginLimiter  *loginLimiter
-	dummyPassword string
-	now           func() time.Time
+	db                 *gorm.DB
+	config             config.Config
+	cipher             *security.Cipher
+	logger             *slog.Logger
+	hub                eventPublisher
+	loginLimiter       *loginLimiter
+	publicQueryLimiter *queryLimiter
+	dummyPassword      string
+	now                func() time.Time
 }
 
 func New(db *gorm.DB, cfg config.Config, logger *slog.Logger) (*Server, error) {
@@ -55,14 +56,15 @@ func NewWithEventPublisher(db *gorm.DB, cfg config.Config, logger *slog.Logger,
 	}
 	now := func() time.Time { return time.Now().UTC() }
 	return &Server{
-		db:            db,
-		config:        cfg,
-		cipher:        fieldCipher,
-		logger:        logger,
-		hub:           publisher,
-		loginLimiter:  newLoginLimiter(now),
-		dummyPassword: dummy,
-		now:           now,
+		db:                 db,
+		config:             cfg,
+		cipher:             fieldCipher,
+		logger:             logger,
+		hub:                publisher,
+		loginLimiter:       newLoginLimiter(now),
+		publicQueryLimiter: newQueryLimiter(now, 120, time.Minute),
+		dummyPassword:      dummy,
+		now:                now,
 	}, nil
 }
 
@@ -81,6 +83,7 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/staff/projects/{id}/tickets", s.requireStaff(http.HandlerFunc(s.createTicket)))
 	mux.Handle("POST /api/staff/projects/{id}/call-next", s.requireStaff(http.HandlerFunc(s.callNext)))
 	mux.HandleFunc("GET /api/public/status/{token}", s.publicStatus)
+	mux.HandleFunc("POST /api/public/status/search", s.publicStatusByPhone)
 	mux.HandleFunc("GET /api/display/{token}/snapshot", s.displaySnapshot)
 	mux.Handle("GET /api/events", s.requireStaff(http.HandlerFunc(s.events)))
 	mux.Handle("GET /api/admin/overview", s.requireAdmin(http.HandlerFunc(s.adminOverview)))