openapi: 3.0.3
info:
  title: Asset Tracker API
  version: 0.2.0
servers:
  - url: http://127.0.0.1:9530
paths:
  /api/v1/auth/login:
    post:
      summary: Login
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [username, password]
              properties:
                username: { type: string }
                password: { type: string }
      responses:
        '200':
          description: OK
          headers:
            X-Request-Id:
              schema: { type: string }
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token: { type: string }
                  token_type: { type: string }
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'

  /api/v1/auth/refresh:
    post:
      summary: Refresh access token
      description: Prefer refresh_token from HttpOnly cookie. Body/header is backward-compatible.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                refresh_token: { type: string }
      responses:
        '200':
          description: OK
          headers:
            X-Request-Id:
              schema: { type: string }
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token: { type: string }
                  token_type: { type: string }
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'

  /api/v1/categories:
    get:
      summary: List categories
      security:
        - bearerAuth: []
      responses:
        '200': { description: OK }
    post:
      summary: Create category
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [name, type]
              properties:
                name: { type: string }
                type: { type: string, enum: [real, digital] }
                color: { type: string }
      responses:
        '201': { description: Created }

  /api/v1/assets:
    get:
      summary: List assets
      security:
        - bearerAuth: []
      parameters:
        - in: query
          name: category_id
          schema: { type: integer }
        - in: query
          name: status
          schema: { type: string, enum: [active, inactive] }
        - in: query
          name: page
          schema: { type: integer, default: 1 }
        - in: query
          name: page_size
          schema: { type: integer, default: 20, maximum: 100 }
      responses:
        '200': { description: OK }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
    post:
      summary: Create asset
      security:
        - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [name, category_id, quantity, unit_price, currency]
              properties:
                name: { type: string }
                category_id: { type: integer }
                quantity: { type: number }
                unit_price: { type: number }
                currency: { type: string, example: USD }
                expiry_date: { type: string, format: date-time }
                note: { type: string }
                status: { type: string, enum: [active, inactive] }
      responses:
        '201': { description: Created }

  /api/v1/assets/{id}:
    put:
      summary: Update asset
      security:
        - bearerAuth: []
      parameters:
        - in: path
          name: id
          required: true
          schema: { type: integer }
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name: { type: string }
                category_id: { type: integer }
                quantity: { type: number }
                unit_price: { type: number }
                currency: { type: string }
                expiry_date: { type: string, format: date-time }
                note: { type: string }
                status: { type: string, enum: [active, inactive] }
      responses:
        '200': { description: OK }
    delete:
      summary: Delete asset
      security:
        - bearerAuth: []
      parameters:
        - in: path
          name: id
          required: true
          schema: { type: integer }
      responses:
        '200': { description: OK }

  /api/v1/dashboard/summary:
    get:
      summary: Dashboard summary
      security:
        - bearerAuth: []
      responses:
        '200': { description: OK }

  /api/v1/reminders:
    get:
      summary: List reminders
      security:
        - bearerAuth: []
      parameters:
        - in: query
          name: status
          schema: { type: string, enum: [pending, sending, sent, failed] }
        - in: query
          name: page
          schema: { type: integer, default: 1 }
        - in: query
          name: page_size
          schema: { type: integer, default: 20, maximum: 100 }
      responses:
        '200': { description: OK }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'

components:
  schemas:
    ErrorBody:
      type: object
      properties:
        code: { type: string }
        message: { type: string }
        details: {}
        request_id: { type: string }
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT