# 🛡️ Hotel Billing Admin API Documentation

This document provides the complete specification for the Admin Authentication and Profile management API.

## 🚀 Base URL
```
http://localhost:4000/api
```

---

## 🔑 Authentication
For protected routes, include the JWT token in the `Authorization` header:

**Header:** `Authorization: Bearer <your_jwt_token>`

---

## 📡 Endpoints

### 1. Admin Registration (Public)
Creates a new admin account with full validation.

- **URL:** `/admin/create`
- **Method:** `POST`
- **Auth Required:** No
- **Request Body:**
  ```json
  {
    "hotel_name": "Grand Plaza Hotel",
    "admin_name": "John Doe",
    "email": "admin@example.com",
    "phone": "9876543210",
    "password": "SecurePassword123",
    "admin_code": "admin_001",
    "pin": "1234"
  }
  ```
- **Validation Rules:**
  - `hotel_name`: String, min 3 chars.
  - `admin_name`: String, min 2 chars.
  - `email`: Must be a valid email format.
  - `password`: Min 8 chars, must contain at least one letter and one number.
  - `admin_code`: 3-20 alphanumeric characters/underscores (Unique).
  - `pin`: Exactly 4 digits (Numeric).
  - `phone`: Optional, 10-15 digits.
- **Success Response (201 Created):**
  ```json
  {
    "success": true,
    "message": "Admin account created successfully.",
    "data": {
      "id": 1,
      "hotel_name": "Grand Plaza Hotel",
      "admin_name": "John Doe",
      "email": "admin@example.com",
      "admin_code": "admin_001",
      "is_active": true
    }
  }
  ```
- **Error Responses:**
  - `400 Bad Request`: Validation failed (returns an array of errors).
  - `409 Conflict`: Email, Phone, or Admin Code already exists.

---

### 2. Admin Login (Public)
Supports two methods of authentication.

#### Method A: Standard Login
- **Request Body:**
  ```json
  {
    "email": "admin@example.com",
    "password": "SecurePassword123"
  }
  ```

#### Method B: Quick Access (Code & PIN)
- **Request Body:**
  ```json
  {
    "admin_code": "admin_001",
    "pin": "1234"
  }
  ```

- **URL:** `/login`
- **Method:** `POST`
- **Success Response (200 OK):**
  ```json
  {
    "success": true,
    "message": "Login successful via Email.",
    "data": {
      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "admin": {
        "id": 1,
        "hotel_name": "Grand Plaza Hotel",
        "admin_name": "John Doe",
        "email": "admin@example.com",
        "admin_code": "admin_001",
        "phone": "9876543210"
      }
    }
  }
  ```
- **Error Responses:**
  - `401 Unauthorized`: Invalid credentials.
  - `403 Forbidden`: Account is deactivated.

---

### 3. Get Admin Profile (Protected)
Retrieves profile info (including `admin_code`).

- **URL:** `/profile`
- **Method:** `GET`
- **Auth Required:** Yes (JWT)
- **Success Response (200 OK):**
  ```json
  {
    "success": true,
    "message": "Admin profile fetched successfully.",
    "data": {
      "id": 1,
      "hotel_name": "Grand Plaza Hotel",
      "admin_name": "John Doe",
      "email": "admin@example.com",
      "admin_code": "admin_001",
      "is_active": 1,
      "last_login": "2024-03-31T12:00:00.000Z"
    }
  }
  ```

---

### 4. Update Password (Protected)
Allows an admin to change their own password.

- **URL:** `/update-password`
- **Method:** `PUT`
- **Auth Required:** Yes (JWT)
- **Request Body:**
  ```json
  {
    "current_password": "SecurePassword123",
    "new_password": "NewStrongPassword789"
  }
  ```
- **Success Response (200 OK):**
  ```json
  {
    "success": true,
    "message": "Password updated successfully. Please log in again with your new password."
  }
  ```