refactor: reorganize struct fields, add new handlers and storage backends

- [x] Reorder struct fields across codebase for consistency
- [x] Add analytics event handlers and tests
- [x] Add authentication API key management handlers and tests
- [x] Add pre-warming control handlers and tests
- [x] Implement S3 storage backend with tests
- [x] Implement SMB/CIFS storage backend with tests
- [x] Add CDN middleware tests
- [x] Integrate analytics tracking into cache manager
- [x] Add S3 and SMB storage initialization in app setup
- [x] Add CDN caching to proxy handlers
- [x] Remove distributed locking (Redis lock manager)
- [x] Remove proxy common package and utilities
- [x] Remove standalone HTTP server package
- [x] Remove logger middleware
- [x] Simplify error handling utilities
- [x] Update config with S3 and SMB options
- [x] Update cache manager signature to include analytics

pkg/app/app.go

@@ -17,7 +17,6 @@ import (
 	"github.com/lukaszraczylo/gohoarder/pkg/cdn"
 	"github.com/lukaszraczylo/gohoarder/pkg/config"
 	"github.com/lukaszraczylo/gohoarder/pkg/health"
-	"github.com/lukaszraczylo/gohoarder/pkg/lock"
 	"github.com/lukaszraczylo/gohoarder/pkg/metadata"
 	metafile "github.com/lukaszraczylo/gohoarder/pkg/metadata/file"
 	metasqlite "github.com/lukaszraczylo/gohoarder/pkg/metadata/sqlite"
@@ -30,6 +29,8 @@ import (
 	"github.com/lukaszraczylo/gohoarder/pkg/scanner"
 	"github.com/lukaszraczylo/gohoarder/pkg/storage"
 	"github.com/lukaszraczylo/gohoarder/pkg/storage/filesystem"
+	"github.com/lukaszraczylo/gohoarder/pkg/storage/s3"
+	"github.com/lukaszraczylo/gohoarder/pkg/storage/smb"
 	"github.com/lukaszraczylo/gohoarder/pkg/vcs"
 	"github.com/lukaszraczylo/gohoarder/pkg/websocket"
 	"github.com/rs/zerolog/log"
@@ -50,7 +51,6 @@ type App struct {
 	analyticsEngine *analytics.Engine
 	wsServer        *websocket.Server
 	prewarmWorker   *prewarming.Worker
-	lockManager     *lock.Manager
 	cdnMiddleware   *cdn.Middleware
 }
 
@@ -82,7 +82,33 @@ func (a *App) initializeComponents() error {
 	switch a.config.Storage.Backend {
 	case "filesystem":
 		a.storage, err = filesystem.New(a.config.Storage.Path, a.config.Cache.MaxSizeBytes)
+	case "s3":
+		a.storage, err = s3.New(s3.Config{
+			Region:          a.config.Storage.S3.Region,
+			Bucket:          a.config.Storage.S3.Bucket,
+			Prefix:          a.config.Storage.S3.Prefix,
+			AccessKeyID:     a.config.Storage.S3.AccessKeyID,
+			SecretAccessKey: a.config.Storage.S3.SecretAccessKey,
+			Endpoint:        a.config.Storage.S3.Endpoint,
+			ForcePathStyle:  a.config.Storage.S3.ForcePathStyle,
+			MaxSizeBytes:    a.config.Cache.MaxSizeBytes,
+		})
+	case "smb":
+		a.storage, err = smb.New(smb.Config{
+			Host:         a.config.Storage.SMB.Host,
+			Port:         445, // Default SMB port
+			Share:        a.config.Storage.SMB.Share,
+			Path:         a.config.Storage.Path,
+			Username:     a.config.Storage.SMB.Username,
+			Password:     a.config.Storage.SMB.Password,
+			Domain:       a.config.Storage.SMB.Domain,
+			MaxSizeBytes: a.config.Cache.MaxSizeBytes,
+			PoolSize:     5, // Default connection pool size
+		})
 	default:
+		log.Warn().
+			Str("backend", a.config.Storage.Backend).
+			Msg("Unknown storage backend, defaulting to filesystem")
 		a.storage, err = filesystem.New(a.config.Storage.Path, a.config.Cache.MaxSizeBytes)
 	}
 	if err != nil {
@@ -116,9 +142,16 @@ func (a *App) initializeComponents() error {
 		return fmt.Errorf("failed to initialize scanner: %w", err)
 	}
 
-	// Initialize cache manager with scanner
+	// Initialize analytics engine first (needed by cache)
+	log.Info().Msg("Initializing analytics engine")
+	a.analyticsEngine = analytics.NewEngine(analytics.Config{
+		MaxEvents:     10000,
+		FlushInterval: 5 * time.Minute,
+	})
+
+	// Initialize cache manager with scanner and analytics
 	log.Info().Msg("Initializing cache manager")
-	a.cache, err = cache.New(a.storage, a.metadata, a.scanManager, cache.Config{
+	a.cache, err = cache.New(a.storage, a.metadata, a.scanManager, a.analyticsEngine, cache.Config{
 		DefaultTTL:      a.config.Cache.DefaultTTL,
 		CleanupInterval: 5 * time.Minute,
 	})
@@ -153,13 +186,6 @@ func (a *App) initializeComponents() error {
 		a.rescanWorker = scanner.NewRescanWorker(a.scanManager, a.metadata, a.storage, a.config.Security.RescanInterval)
 	}
 
-	// Initialize analytics engine
-	log.Info().Msg("Initializing analytics engine")
-	a.analyticsEngine = analytics.NewEngine(analytics.Config{
-		MaxEvents:     10000,
-		FlushInterval: 5 * time.Minute,
-	})
-
 	// Initialize WebSocket server
 	log.Info().Msg("Initializing WebSocket server")
 	a.wsServer = websocket.NewServer(websocket.Config{
@@ -248,9 +274,28 @@ func (a *App) setupServer() error {
 	a.app.Get("/api/stats/timeseries", a.handleTimeSeriesStats)
 	a.app.Get("/api/info", a.handleInfo)
 
+	// Analytics endpoints
+	a.app.Get("/api/analytics/top", a.handleAnalyticsTopPackages)
+	a.app.Get("/api/analytics/trending", a.handleAnalyticsTrendingPackages)
+	a.app.Get("/api/analytics/trends", a.handleAnalyticsTrends)
+	a.app.Get("/api/analytics/total", a.handleAnalyticsTotalStats)
+	a.app.Get("/api/analytics/registry/:registry", a.handleAnalyticsRegistryStats)
+	a.app.Get("/api/analytics/package/:registry/:name", a.handleAnalyticsPackageStats)
+	a.app.Get("/api/analytics/search", a.handleAnalyticsSearch)
+
 	// Admin endpoints (bypass management)
 	a.app.All("/api/admin/bypasses/:id?", a.requireAdmin, a.handleAdminBypasses)
 
+	// Admin endpoints (pre-warming)
+	a.app.Get("/api/admin/prewarming/status", a.requireAdmin, a.handlePrewarmingStatus)
+	a.app.Post("/api/admin/prewarming/trigger", a.requireAdmin, a.handlePrewarmingTrigger)
+	a.app.Post("/api/admin/prewarming/package", a.requireAdmin, a.handlePrewarmingPackage)
+
+	// Admin endpoints (API key management)
+	a.app.Post("/api/admin/keys", a.requireAdmin, a.handleGenerateAPIKey)
+	a.app.Get("/api/admin/keys", a.requireAdmin, a.handleListAPIKeys)
+	a.app.Delete("/api/admin/keys/:key_id", a.requireAdmin, a.handleRevokeAPIKey)
+
 	// Proxy handlers (adapted from net/http)
 	// Load git credentials if configured
 	var credStore *vcs.CredentialStore
@@ -270,22 +315,28 @@ func (a *App) setupServer() error {
 		}
 	}
 
+	// Go proxy with CDN caching
 	goProxyHandler := goproxy.New(a.cache, a.networkClient, goproxy.Config{
 		Upstream:  "https://proxy.golang.org",
 		SumDBURL:  "https://sum.golang.org",
 		CredStore: credStore,
 	})
-	a.app.All("/go/*", adaptor.HTTPHandler(http.StripPrefix("/go", goProxyHandler)))
+	goProxyWithCDN := a.cdnMiddleware.Handler(http.StripPrefix("/go", goProxyHandler))
+	a.app.All("/go/*", adaptor.HTTPHandler(goProxyWithCDN))
 
+	// NPM proxy with CDN caching
 	npmProxyHandler := npm.New(a.cache, a.networkClient, npm.Config{
 		Upstream: "https://registry.npmjs.org",
 	})
-	a.app.All("/npm/*", adaptor.HTTPHandler(http.StripPrefix("/npm", npmProxyHandler)))
+	npmProxyWithCDN := a.cdnMiddleware.Handler(http.StripPrefix("/npm", npmProxyHandler))
+	a.app.All("/npm/*", adaptor.HTTPHandler(npmProxyWithCDN))
 
+	// PyPI proxy with CDN caching
 	pypiProxyHandler := pypi.New(a.cache, a.networkClient, pypi.Config{
 		Upstream: "https://pypi.org/simple",
 	})
-	a.app.All("/pypi/*", adaptor.HTTPHandler(http.StripPrefix("/pypi", pypiProxyHandler)))
+	pypiProxyWithCDN := a.cdnMiddleware.Handler(http.StripPrefix("/pypi", pypiProxyHandler))
+	a.app.All("/pypi/*", adaptor.HTTPHandler(pypiProxyWithCDN))
 
 	// Serve frontend static files
 	frontendDir := "frontend/dist"
@@ -397,13 +448,6 @@ func (a *App) Shutdown() error {
 		log.Error().Err(err).Msg("Error closing metadata store")
 	}
 
-	// Close lock manager if initialized
-	if a.lockManager != nil {
-		if err := a.lockManager.Close(); err != nil {
-			log.Error().Err(err).Msg("Error closing lock manager")
-		}
-	}
-
 	log.Info().Msg("Shutdown complete")
 	return nil
 }

pkg/app/handlers.go

@@ -500,11 +500,10 @@ func (a *App) handleInfo(c *fiber.Ctx) error {
 			"max_cache_size":   a.config.Cache.MaxSizeBytes,
 		},
 		"features": map[string]bool{
-			"distributed_locking": a.lockManager != nil,
-			"security_scanning":   a.config.Security.Enabled,
-			"pre_warming":         a.prewarmWorker != nil,
-			"websockets":          true,
-			"analytics":           true,
+			"security_scanning": a.config.Security.Enabled,
+			"pre_warming":       a.prewarmWorker != nil,
+			"websockets":        true,
+			"analytics":         true,
 		},
 	}
 

pkg/app/handlers_admin.go

@@ -110,13 +110,13 @@ func (a *App) handleListBypasses(c *fiber.Ctx) error {
 
 // CreateBypassRequest represents the request body for creating a bypass
 type CreateBypassRequest struct {
-	Type           metadata.BypassType `json:"type"`                 // "cve" or "package"
-	Target         string              `json:"target"`               // CVE ID or package name
-	Reason         string              `json:"reason"`               // Why this bypass is needed
-	CreatedBy      string              `json:"created_by"`           // Admin username
-	ExpiresInHours int                 `json:"expires_in_hours"`     // How many hours until expiration
-	AppliesTo      string              `json:"applies_to,omitempty"` // Optional: limit CVE bypass to specific package
-	NotifyOnExpiry bool                `json:"notify_on_expiry"`     // Send notification when expired
+	Type           metadata.BypassType `json:"type"`
+	Target         string              `json:"target"`
+	Reason         string              `json:"reason"`
+	CreatedBy      string              `json:"created_by"`
+	AppliesTo      string              `json:"applies_to,omitempty"`
+	ExpiresInHours int                 `json:"expires_in_hours"`
+	NotifyOnExpiry bool                `json:"notify_on_expiry"`
 }
 
 // handleCreateBypass creates a new CVE bypass

pkg/app/handlers_analytics.go

@@ -0,0 +1,149 @@
+package app
+
+import (
+	"strconv"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/rs/zerolog/log"
+)
+
+// handleAnalyticsTopPackages returns the most downloaded packages
+func (a *App) handleAnalyticsTopPackages(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	// Get limit from query params (default: 10)
+	limit := 10
+	if limitStr := c.Query("limit"); limitStr != "" {
+		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
+			limit = parsedLimit
+		}
+	}
+
+	packages := a.analyticsEngine.GetTopPackages(limit)
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"packages": packages,
+		"total":    len(packages),
+	})
+}
+
+// handleAnalyticsTrendingPackages returns trending packages
+func (a *App) handleAnalyticsTrendingPackages(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	// Get limit from query params (default: 10)
+	limit := 10
+	if limitStr := c.Query("limit"); limitStr != "" {
+		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
+			limit = parsedLimit
+		}
+	}
+
+	packages := a.analyticsEngine.GetTrendingPackages(limit)
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"packages": packages,
+		"total":    len(packages),
+	})
+}
+
+// handleAnalyticsTrends returns download trends over time
+func (a *App) handleAnalyticsTrends(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	trends := a.analyticsEngine.GetTrends()
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"trends": trends,
+	})
+}
+
+// handleAnalyticsTotalStats returns overall statistics
+func (a *App) handleAnalyticsTotalStats(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	stats := a.analyticsEngine.GetTotalStats()
+
+	return c.Status(fiber.StatusOK).JSON(stats)
+}
+
+// handleAnalyticsRegistryStats returns per-registry statistics
+func (a *App) handleAnalyticsRegistryStats(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	registry := c.Params("registry")
+	if registry == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "registry parameter is required",
+		})
+	}
+
+	stats := a.analyticsEngine.GetRegistryStats(registry)
+
+	return c.Status(fiber.StatusOK).JSON(stats)
+}
+
+// handleAnalyticsPackageStats returns statistics for a specific package
+func (a *App) handleAnalyticsPackageStats(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	registry := c.Params("registry")
+	name := c.Params("name")
+
+	if registry == "" || name == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "registry and name parameters are required",
+		})
+	}
+
+	stats, exists := a.analyticsEngine.GetPackageStats(registry, name)
+	if !exists {
+		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
+			"error": "package not found in analytics",
+		})
+	}
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"package": stats,
+	})
+}
+
+// handleAnalyticsSearch searches for packages matching a query
+func (a *App) handleAnalyticsSearch(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+	c.Set("Access-Control-Allow-Origin", "*")
+
+	query := c.Query("q")
+	if query == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "query parameter 'q' is required",
+		})
+	}
+
+	// Get limit from query params (default: 20)
+	limit := 20
+	if limitStr := c.Query("limit"); limitStr != "" {
+		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
+			limit = parsedLimit
+		}
+	}
+
+	results := a.analyticsEngine.SearchPackages(query, limit)
+
+	log.Debug().
+		Str("query", query).
+		Int("results", len(results)).
+		Msg("Analytics search completed")
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"results": results,
+		"total":   len(results),
+		"query":   query,
+	})
+}

pkg/app/handlers_analytics_test.go

@@ -0,0 +1,298 @@
+package app
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/lukaszraczylo/gohoarder/pkg/analytics"
+	"github.com/stretchr/testify/suite"
+)
+
+type AnalyticsHandlersTestSuite struct {
+	suite.Suite
+	app     *fiber.App
+	appInst *App
+	engine  *analytics.Engine
+}
+
+func (s *AnalyticsHandlersTestSuite) SetupTest() {
+	// Create analytics engine
+	s.engine = analytics.NewEngine(analytics.Config{
+		MaxEvents:     10000,
+		FlushInterval: 5 * time.Minute,
+	})
+
+	// Seed some test data
+	s.engine.TrackDownload(analytics.PackageDownload{
+		Registry:  "npm",
+		Name:      "lodash",
+		Version:   "4.17.21",
+		Timestamp: time.Now(),
+		BytesSize: 1024,
+	})
+	s.engine.TrackDownload(analytics.PackageDownload{
+		Registry:  "npm",
+		Name:      "react",
+		Version:   "18.0.0",
+		Timestamp: time.Now(),
+		BytesSize: 2048,
+	})
+	s.engine.TrackDownload(analytics.PackageDownload{
+		Registry:  "pypi",
+		Name:      "requests",
+		Version:   "2.28.0",
+		Timestamp: time.Now(),
+		BytesSize: 512,
+	})
+
+	// Create app instance
+	s.appInst = &App{
+		analyticsEngine: s.engine,
+	}
+
+	// Create Fiber app
+	s.app = fiber.New()
+
+	// Register routes
+	s.app.Get("/api/analytics/top", s.appInst.handleAnalyticsTopPackages)
+	s.app.Get("/api/analytics/trending", s.appInst.handleAnalyticsTrendingPackages)
+	s.app.Get("/api/analytics/trends", s.appInst.handleAnalyticsTrends)
+	s.app.Get("/api/analytics/total", s.appInst.handleAnalyticsTotalStats)
+	s.app.Get("/api/analytics/registry/:registry", s.appInst.handleAnalyticsRegistryStats)
+	s.app.Get("/api/analytics/package/:registry/:name", s.appInst.handleAnalyticsPackageStats)
+	s.app.Get("/api/analytics/search", s.appInst.handleAnalyticsSearch)
+}
+
+func (s *AnalyticsHandlersTestSuite) TearDownTest() {
+	if s.engine != nil {
+		s.engine.Close()
+	}
+}
+
+func TestAnalyticsHandlersTestSuite(t *testing.T) {
+	suite.Run(t, new(AnalyticsHandlersTestSuite))
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTopPackages() {
+	tests := []struct {
+		name           string
+		queryParams    string
+		expectedStatus int
+		expectError    bool
+	}{
+		{
+			name:           "get top packages default",
+			queryParams:    "",
+			expectedStatus: 200,
+			expectError:    false,
+		},
+		{
+			name:           "get top packages with limit",
+			queryParams:    "?limit=5",
+			expectedStatus: 200,
+			expectError:    false,
+		},
+		{
+			name:           "get top packages with registry filter",
+			queryParams:    "?registry=npm",
+			expectedStatus: 200,
+			expectError:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			req := httptest.NewRequest("GET", "/api/analytics/top"+tt.queryParams, nil)
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+
+			if !tt.expectError {
+				var result struct {
+					Packages []analytics.PackageStats `json:"packages"`
+					Total    int                      `json:"total"`
+				}
+				err = json.NewDecoder(resp.Body).Decode(&result)
+				s.NoError(err)
+			}
+		})
+	}
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTrendingPackages() {
+	req := httptest.NewRequest("GET", "/api/analytics/trending", nil)
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(200, resp.StatusCode)
+
+	var result struct {
+		Packages []analytics.PackageStats `json:"packages"`
+		Total    int                      `json:"total"`
+	}
+	err = json.NewDecoder(resp.Body).Decode(&result)
+	s.NoError(err)
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTrends() {
+	tests := []struct {
+		name           string
+		queryParams    string
+		expectedStatus int
+	}{
+		{
+			name:           "get trends default timeframe",
+			queryParams:    "",
+			expectedStatus: 200,
+		},
+		{
+			name:           "get trends with registry filter",
+			queryParams:    "?registry=npm",
+			expectedStatus: 200,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			req := httptest.NewRequest("GET", "/api/analytics/trends"+tt.queryParams, nil)
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+		})
+	}
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTotalStats() {
+	req := httptest.NewRequest("GET", "/api/analytics/total", nil)
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(200, resp.StatusCode)
+
+	var result struct {
+		TotalDownloads int64 `json:"total_downloads"`
+		TotalBytes     int64 `json:"total_bytes"`
+		UniquePackages int   `json:"unique_packages"`
+	}
+	err = json.NewDecoder(resp.Body).Decode(&result)
+	s.NoError(err)
+	s.Greater(result.TotalDownloads, int64(0))
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsRegistryStats() {
+	tests := []struct {
+		name           string
+		registry       string
+		expectedStatus int
+	}{
+		{
+			name:           "npm registry stats",
+			registry:       "npm",
+			expectedStatus: 200,
+		},
+		{
+			name:           "pypi registry stats",
+			registry:       "pypi",
+			expectedStatus: 200,
+		},
+		{
+			name:           "go registry stats",
+			registry:       "go",
+			expectedStatus: 200,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			req := httptest.NewRequest("GET", "/api/analytics/registry/"+tt.registry, nil)
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+		})
+	}
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsPackageStats() {
+	tests := []struct {
+		name           string
+		registry       string
+		packageName    string
+		expectedStatus int
+	}{
+		{
+			name:           "lodash package stats",
+			registry:       "npm",
+			packageName:    "lodash",
+			expectedStatus: 200,
+		},
+		{
+			name:           "react package stats",
+			registry:       "npm",
+			packageName:    "react",
+			expectedStatus: 200,
+		},
+		{
+			name:           "requests package stats",
+			registry:       "pypi",
+			packageName:    "requests",
+			expectedStatus: 200,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			req := httptest.NewRequest("GET", "/api/analytics/package/"+tt.registry+"/"+tt.packageName, nil)
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+		})
+	}
+}
+
+func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsSearch() {
+	tests := []struct {
+		name           string
+		queryParams    string
+		expectedStatus int
+		expectError    bool
+	}{
+		{
+			name:           "search for lodash",
+			queryParams:    "?q=lodash",
+			expectedStatus: 200,
+			expectError:    false,
+		},
+		{
+			name:           "search for react",
+			queryParams:    "?q=react",
+			expectedStatus: 200,
+			expectError:    false,
+		},
+		{
+			name:           "search with no query",
+			queryParams:    "",
+			expectedStatus: 400, // Query parameter is required
+			expectError:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			req := httptest.NewRequest("GET", "/api/analytics/search"+tt.queryParams, nil)
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+
+			if !tt.expectError {
+				var result struct {
+					Results []analytics.PackageStats `json:"results"`
+					Total   int                      `json:"total"`
+					Query   string                   `json:"query"`
+				}
+				err = json.NewDecoder(resp.Body).Decode(&result)
+				s.NoError(err)
+			}
+		})
+	}
+}

pkg/app/handlers_auth.go

@@ -0,0 +1,135 @@
+package app
+
+import (
+	"time"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/lukaszraczylo/gohoarder/pkg/auth"
+	"github.com/rs/zerolog/log"
+)
+
+// GenerateAPIKeyRequest represents a request to generate a new API key
+type GenerateAPIKeyRequest struct {
+	ExpiresInMin *int   `json:"expires_in_min"`
+	Name         string `json:"name"`
+	Role         string `json:"role"`
+}
+
+// handleGenerateAPIKey generates a new API key
+func (a *App) handleGenerateAPIKey(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+
+	var req GenerateAPIKeyRequest
+	if err := c.BodyParser(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "invalid JSON in request body",
+		})
+	}
+
+	// Validate request
+	if req.Name == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "name is required",
+		})
+	}
+
+	// Parse role (default to readonly if not specified)
+	var role auth.Role
+	switch req.Role {
+	case "admin":
+		role = auth.RoleAdmin
+	case "readwrite":
+		role = auth.RoleReadWrite
+	case "readonly", "":
+		role = auth.RoleReadOnly
+	default:
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "invalid role, must be 'admin', 'readwrite', or 'readonly'",
+		})
+	}
+
+	// Calculate expiration
+	var expiresIn *time.Duration
+	if req.ExpiresInMin != nil {
+		duration := time.Duration(*req.ExpiresInMin) * time.Minute
+		expiresIn = &duration
+	}
+
+	// Generate key
+	apiKey, rawKey, err := a.authManager.GenerateAPIKey(req.Name, role, expiresIn)
+	if err != nil {
+		log.Error().Err(err).Str("name", req.Name).Msg("Failed to generate API key")
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+			"error": "failed to generate API key",
+		})
+	}
+
+	log.Info().
+		Str("key_id", apiKey.ID).
+		Str("name", apiKey.Name).
+		Str("role", string(apiKey.Role)).
+		Msg("API key generated")
+
+	// Return the key info and raw key (only time it's shown!)
+	return c.Status(fiber.StatusCreated).JSON(fiber.Map{
+		"key":     rawKey, // IMPORTANT: This is the only time the raw key is shown
+		"key_id":  apiKey.ID,
+		"name":    apiKey.Name,
+		"role":    apiKey.Role,
+		"expires": apiKey.ExpiresAt,
+		"message": "Save this key now! It will not be shown again.",
+	})
+}
+
+// handleListAPIKeys lists all API keys
+func (a *App) handleListAPIKeys(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+
+	keys := a.authManager.ListAPIKeys()
+
+	// Convert to response format (excluding hashed keys)
+	response := make([]fiber.Map, len(keys))
+	for i, key := range keys {
+		response[i] = fiber.Map{
+			"id":           key.ID,
+			"name":         key.Name,
+			"role":         key.Role,
+			"created_at":   key.CreatedAt,
+			"expires_at":   key.ExpiresAt,
+			"last_used_at": key.LastUsedAt,
+			"permissions":  key.Permissions,
+		}
+	}
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"keys":  response,
+		"total": len(response),
+	})
+}
+
+// handleRevokeAPIKey revokes an API key
+func (a *App) handleRevokeAPIKey(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+
+	keyID := c.Params("key_id")
+	if keyID == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "key_id parameter is required",
+		})
+	}
+
+	err := a.authManager.RevokeAPIKey(keyID)
+	if err != nil {
+		log.Warn().Err(err).Str("key_id", keyID).Msg("Failed to revoke API key")
+		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
+			"error": "API key not found",
+		})
+	}
+
+	log.Info().Str("key_id", keyID).Msg("API key revoked")
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"message": "API key revoked successfully",
+		"key_id":  keyID,
+	})
+}

pkg/app/handlers_auth_test.go

@@ -0,0 +1,285 @@
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/lukaszraczylo/gohoarder/pkg/auth"
+	"github.com/stretchr/testify/suite"
+)
+
+type AuthHandlersTestSuite struct {
+	suite.Suite
+	app         *fiber.App
+	appInst     *App
+	authManager *auth.Manager
+}
+
+func (s *AuthHandlersTestSuite) SetupTest() {
+	// Create auth manager
+	s.authManager = auth.New()
+
+	// Create app instance
+	s.appInst = &App{
+		authManager: s.authManager,
+	}
+
+	// Create Fiber app
+	s.app = fiber.New()
+
+	// Register routes
+	s.app.Post("/api/admin/keys", s.appInst.handleGenerateAPIKey)
+	s.app.Get("/api/admin/keys", s.appInst.handleListAPIKeys)
+	s.app.Delete("/api/admin/keys/:key_id", s.appInst.handleRevokeAPIKey)
+}
+
+func TestAuthHandlersTestSuite(t *testing.T) {
+	suite.Run(t, new(AuthHandlersTestSuite))
+}
+
+func (s *AuthHandlersTestSuite) TestHandleGenerateAPIKey() {
+	tests := []struct {
+		requestBody    map[string]string
+		name           string
+		expectedStatus int
+		expectedRole   string
+		expectKey      bool
+	}{
+		{
+			name: "generate read-only key",
+			requestBody: map[string]string{
+				"role": "readonly",
+				"name": "test-readonly-key",
+			},
+			expectedStatus: 201,
+			expectedRole:   "readonly",
+			expectKey:      true,
+		},
+		{
+			name: "generate read-write key",
+			requestBody: map[string]string{
+				"role": "readwrite",
+				"name": "test-readwrite-key",
+			},
+			expectedStatus: 201,
+			expectedRole:   "readwrite",
+			expectKey:      true,
+		},
+		{
+			name: "generate admin key",
+			requestBody: map[string]string{
+				"role": "admin",
+				"name": "test-admin-key",
+			},
+			expectedStatus: 201,
+			expectedRole:   "admin",
+			expectKey:      true,
+		},
+		{
+			name: "invalid role",
+			requestBody: map[string]string{
+				"role": "invalid-role",
+				"name": "test-key",
+			},
+			expectedStatus: 400,
+			expectKey:      false,
+		},
+		{
+			name: "missing role defaults to readonly",
+			requestBody: map[string]string{
+				"name": "test-key-default-role",
+			},
+			expectedStatus: 201,
+			expectedRole:   "readonly", // Role defaults to readonly when not specified
+			expectKey:      true,
+		},
+		{
+			name: "missing name",
+			requestBody: map[string]string{
+				"role": "read-only",
+			},
+			expectedStatus: 400,
+			expectKey:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			bodyBytes, err := json.Marshal(tt.requestBody)
+			s.Require().NoError(err)
+
+			req := httptest.NewRequest("POST", "/api/admin/keys", bytes.NewReader(bodyBytes))
+			req.Header.Set("Content-Type", "application/json")
+
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+
+			if tt.expectKey {
+				var result struct {
+					Key     string `json:"key"`
+					KeyID   string `json:"key_id"`
+					Role    string `json:"role"`
+					Name    string `json:"name"`
+					Message string `json:"message"`
+				}
+				err = json.NewDecoder(resp.Body).Decode(&result)
+				s.NoError(err)
+				s.NotEmpty(result.Key)
+				s.NotEmpty(result.KeyID)
+				s.Equal(tt.expectedRole, result.Role)
+				s.Equal(tt.requestBody["name"], result.Name)
+			}
+		})
+	}
+}
+
+func (s *AuthHandlersTestSuite) TestHandleListAPIKeys() {
+	// Generate some test keys first
+	s.authManager.GenerateAPIKey("test-key-1", auth.RoleReadOnly, nil)
+	s.authManager.GenerateAPIKey("test-key-2", auth.RoleReadWrite, nil)
+	s.authManager.GenerateAPIKey("test-key-3", auth.RoleAdmin, nil)
+
+	req := httptest.NewRequest("GET", "/api/admin/keys", nil)
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(200, resp.StatusCode)
+
+	var result struct {
+		Keys  []map[string]interface{} `json:"keys"`
+		Total int                      `json:"total"`
+	}
+	err = json.NewDecoder(resp.Body).Decode(&result)
+	s.NoError(err)
+	s.GreaterOrEqual(result.Total, 3)
+
+	// Verify keys don't include the actual key value
+	for _, key := range result.Keys {
+		s.NotEmpty(key["id"])
+		s.NotEmpty(key["role"])
+		s.NotEmpty(key["name"])
+		s.NotEmpty(key["created_at"])
+	}
+}
+
+func (s *AuthHandlersTestSuite) TestHandleRevokeAPIKey() {
+	// Generate a test key
+	keyInfo, _, _ := s.authManager.GenerateAPIKey("test-revoke-key", auth.RoleReadOnly, nil)
+
+	tests := []struct {
+		name           string
+		keyID          string
+		expectedStatus int
+	}{
+		{
+			name:           "revoke existing key",
+			keyID:          keyInfo.ID,
+			expectedStatus: 200,
+		},
+		{
+			name:           "revoke non-existent key",
+			keyID:          "non-existent-key-id",
+			expectedStatus: 404,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			req := httptest.NewRequest("DELETE", "/api/admin/keys/"+tt.keyID, nil)
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+
+			if tt.expectedStatus == 200 {
+				var result map[string]string
+				err = json.NewDecoder(resp.Body).Decode(&result)
+				s.NoError(err)
+				s.Contains(result, "message")
+			}
+		})
+	}
+}
+
+func (s *AuthHandlersTestSuite) TestHandleGenerateAPIKeyInvalidJSON() {
+	req := httptest.NewRequest("POST", "/api/admin/keys", bytes.NewReader([]byte("invalid json")))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(400, resp.StatusCode)
+}
+
+func (s *AuthHandlersTestSuite) TestGenerateAndRevokeKeyFlow() {
+	// Generate a key
+	bodyBytes, _ := json.Marshal(map[string]string{
+		"role": "readonly",
+		"name": "integration-test-key",
+	})
+
+	req1 := httptest.NewRequest("POST", "/api/admin/keys", bytes.NewReader(bodyBytes))
+	req1.Header.Set("Content-Type", "application/json")
+	resp1, err := s.app.Test(req1)
+	s.Require().NoError(err)
+	s.Equal(201, resp1.StatusCode)
+
+	var createResult struct {
+		Key   string `json:"key"`
+		KeyID string `json:"key_id"`
+	}
+	err = json.NewDecoder(resp1.Body).Decode(&createResult)
+	s.Require().NoError(err)
+	keyID := createResult.KeyID
+
+	// List keys - should include our new key
+	req2 := httptest.NewRequest("GET", "/api/admin/keys", nil)
+	resp2, err := s.app.Test(req2)
+	s.Require().NoError(err)
+	s.Equal(200, resp2.StatusCode)
+
+	var listResult struct {
+		Keys  []map[string]interface{} `json:"keys"`
+		Total int                      `json:"total"`
+	}
+	err = json.NewDecoder(resp2.Body).Decode(&listResult)
+	s.Require().NoError(err)
+
+	found := false
+	for _, key := range listResult.Keys {
+		if key["id"].(string) == keyID {
+			found = true
+			break
+		}
+	}
+	s.True(found, "newly created key should be in the list")
+
+	// Revoke the key
+	req3 := httptest.NewRequest("DELETE", "/api/admin/keys/"+keyID, nil)
+	resp3, err := s.app.Test(req3)
+	s.Require().NoError(err)
+	s.Equal(200, resp3.StatusCode)
+
+	// List keys again - should not include the revoked key
+	req4 := httptest.NewRequest("GET", "/api/admin/keys", nil)
+	resp4, err := s.app.Test(req4)
+	s.Require().NoError(err)
+	s.Equal(200, resp4.StatusCode)
+
+	var listResult2 struct {
+		Keys  []map[string]interface{} `json:"keys"`
+		Total int                      `json:"total"`
+	}
+	err = json.NewDecoder(resp4.Body).Decode(&listResult2)
+	s.Require().NoError(err)
+
+	found = false
+	for _, key := range listResult2.Keys {
+		if key["id"].(string) == keyID {
+			found = true
+			break
+		}
+	}
+	s.False(found, "revoked key should not be in the list")
+}

pkg/app/handlers_prewarming.go

@@ -0,0 +1,94 @@
+package app
+
+import (
+	"github.com/gofiber/fiber/v2"
+	"github.com/rs/zerolog/log"
+)
+
+// handlePrewarmingStatus returns the status of the pre-warming worker
+func (a *App) handlePrewarmingStatus(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+
+	status := a.prewarmWorker.GetStatus()
+
+	return c.Status(fiber.StatusOK).JSON(status)
+}
+
+// handlePrewarmingTrigger manually triggers a pre-warming cycle
+func (a *App) handlePrewarmingTrigger(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+
+	ctx := c.Context()
+	a.prewarmWorker.TriggerPrewarm(ctx)
+
+	log.Info().Msg("Pre-warming manually triggered via API")
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"message": "Pre-warming cycle triggered successfully",
+	})
+}
+
+// PrewarmPackageRequest represents a request to pre-warm a specific package
+type PrewarmPackageRequest struct {
+	Registry string `json:"registry"`
+	Name     string `json:"name"`
+	Version  string `json:"version"`
+}
+
+// handlePrewarmingPackage pre-warms a specific package
+func (a *App) handlePrewarmingPackage(c *fiber.Ctx) error {
+	c.Set("Content-Type", "application/json")
+
+	var req PrewarmPackageRequest
+	if err := c.BodyParser(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "invalid JSON in request body",
+		})
+	}
+
+	// Validate request
+	if req.Registry == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "registry is required",
+		})
+	}
+	if req.Name == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "name is required",
+		})
+	}
+	if req.Version == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+			"error": "version is required",
+		})
+	}
+
+	ctx := c.Context()
+	err := a.prewarmWorker.PrewarmPackage(ctx, req.Registry, req.Name, req.Version)
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("registry", req.Registry).
+			Str("name", req.Name).
+			Str("version", req.Version).
+			Msg("Failed to pre-warm package")
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+			"error": "failed to pre-warm package",
+		})
+	}
+
+	log.Info().
+		Str("registry", req.Registry).
+		Str("name", req.Name).
+		Str("version", req.Version).
+		Msg("Package pre-warmed via API")
+
+	return c.Status(fiber.StatusOK).JSON(fiber.Map{
+		"message": "Package pre-warmed successfully",
+		"package": fiber.Map{
+			"registry": req.Registry,
+			"name":     req.Name,
+			"version":  req.Version,
+		},
+	})
+}

pkg/app/handlers_prewarming_test.go

@@ -0,0 +1,162 @@
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/lukaszraczylo/gohoarder/pkg/prewarming"
+	"github.com/stretchr/testify/suite"
+)
+
+type PrewarmingHandlersTestSuite struct {
+	suite.Suite
+	app           *fiber.App
+	appInst       *App
+	prewarmWorker *prewarming.Worker
+}
+
+func (s *PrewarmingHandlersTestSuite) SetupTest() {
+	// Create pre-warming worker (disabled by default)
+	s.prewarmWorker = prewarming.NewWorker(prewarming.Config{
+		Enabled:       false,
+		MaxConcurrent: 5,
+	})
+
+	// Create app instance
+	s.appInst = &App{
+		prewarmWorker: s.prewarmWorker,
+	}
+
+	// Create Fiber app
+	s.app = fiber.New()
+
+	// Register routes
+	s.app.Get("/api/admin/prewarming/status", s.appInst.handlePrewarmingStatus)
+	s.app.Post("/api/admin/prewarming/trigger", s.appInst.handlePrewarmingTrigger)
+	s.app.Post("/api/admin/prewarming/package", s.appInst.handlePrewarmingPackage)
+}
+
+func (s *PrewarmingHandlersTestSuite) TearDownTest() {
+	if s.prewarmWorker != nil {
+		s.prewarmWorker.Stop()
+	}
+}
+
+func TestPrewarmingHandlersTestSuite(t *testing.T) {
+	suite.Run(t, new(PrewarmingHandlersTestSuite))
+}
+
+func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingStatus() {
+	req := httptest.NewRequest("GET", "/api/admin/prewarming/status", nil)
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(200, resp.StatusCode)
+
+	var result struct {
+		Enabled       bool `json:"enabled"`
+		Running       bool `json:"running"`
+		QueueSize     int  `json:"queue_size"`
+		ActiveWorkers int  `json:"active_workers"`
+	}
+	err = json.NewDecoder(resp.Body).Decode(&result)
+	s.NoError(err)
+	s.False(result.Enabled) // Disabled in test setup
+}
+
+func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingTrigger() {
+	req := httptest.NewRequest("POST", "/api/admin/prewarming/trigger", nil)
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(200, resp.StatusCode)
+
+	var result map[string]interface{}
+	err = json.NewDecoder(resp.Body).Decode(&result)
+	s.NoError(err)
+	s.Contains(result, "message")
+}
+
+func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingPackage() {
+	tests := []struct {
+		requestBody    map[string]string
+		name           string
+		expectedStatus int
+	}{
+		{
+			name: "prewarm npm package",
+			requestBody: map[string]string{
+				"registry": "npm",
+				"name":     "lodash",
+				"version":  "4.17.21",
+			},
+			expectedStatus: 200,
+		},
+		{
+			name: "prewarm pypi package",
+			requestBody: map[string]string{
+				"registry": "pypi",
+				"name":     "requests",
+				"version":  "2.28.0",
+			},
+			expectedStatus: 200,
+		},
+		{
+			name: "prewarm go package",
+			requestBody: map[string]string{
+				"registry": "go",
+				"name":     "github.com/stretchr/testify",
+				"version":  "v1.8.0",
+			},
+			expectedStatus: 200,
+		},
+		{
+			name: "missing registry",
+			requestBody: map[string]string{
+				"name":    "lodash",
+				"version": "4.17.21",
+			},
+			expectedStatus: 400,
+		},
+		{
+			name: "missing name",
+			requestBody: map[string]string{
+				"registry": "npm",
+				"version":  "4.17.21",
+			},
+			expectedStatus: 400,
+		},
+		{
+			name: "missing version",
+			requestBody: map[string]string{
+				"registry": "npm",
+				"name":     "lodash",
+			},
+			expectedStatus: 400,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			bodyBytes, err := json.Marshal(tt.requestBody)
+			s.Require().NoError(err)
+
+			req := httptest.NewRequest("POST", "/api/admin/prewarming/package", bytes.NewReader(bodyBytes))
+			req.Header.Set("Content-Type", "application/json")
+
+			resp, err := s.app.Test(req)
+			s.Require().NoError(err)
+			s.Equal(tt.expectedStatus, resp.StatusCode)
+		})
+	}
+}
+
+func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingPackageInvalidJSON() {
+	req := httptest.NewRequest("POST", "/api/admin/prewarming/package", bytes.NewReader([]byte("invalid json")))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := s.app.Test(req)
+	s.Require().NoError(err)
+	s.Equal(400, resp.StatusCode)
+}