# Mkizughuno CI4 API

## Setup
1. Apache/MySQL running in XAMPP
2. Database `mkizughuno` already imported (from your SQL dump)
3. Copy of `.env` is configured for local XAMPP

## Admin login
- Email: `admin@mkizughuno.local`
- Password: `Admin@123`

## Base URL
`http://localhost/mkizughuno/public/api`

## Auth
```bash
# Login
curl -X POST http://localhost/mkizughuno/public/api/auth/login \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"admin@mkizughuno.local\",\"password\":\"Admin@123\"}"

# Authenticated request
curl http://localhost/mkizughuno/public/api/auth/me \
  -H "Authorization: Bearer ACCESS_TOKEN"

# Refresh
curl -X POST http://localhost/mkizughuno/public/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d "{\"refresh_token\":\"REFRESH_TOKEN\"}"

# Logout
curl -X POST http://localhost/mkizughuno/public/api/auth/logout \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"refresh_token\":\"REFRESH_TOKEN\"}"
```

## Protected resources (JWT required)
| Method | Endpoint |
|--------|----------|
| CRUD | `/clients`, `/agents`, `/services`, `/users`, `/roles` |
| CRUD | `/tenders`, `/invoices`, `/payments`, `/certificates` |
| CRUD | `/control-numbers`, `/service-jobs`, `/reminders`, `/commissions` |
| CRUD | `/payment-modes`, `/permissions` |
| GET/PUT | `/company` |
| POST | `/tenders/{id}/workflow` `{ "status": "INVOICED" }` |