{
  "openapi": "3.0.3",
  "info": {
    "title": "Tidy — Thread-safe TODO REST API",
    "description": "A thread-safe, in-memory TODO list for Go developers. Mutex-protected, admin-authenticated write endpoints.",
    "version": "1.0.0"
  },
  "servers": [
    { "url": "/" }
  ],
  "paths": {
    "/api/v1/todos": {
      "get": {
        "summary": "List all todos",
        "description": "Returns an array of all todo items.",
        "operationId": "listTodos",
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": { "$ref": "#/components/schemas/Todo" }
                }
              }
            }
          }
        }
      },
      "post": {
        "summary": "Create a new todo",
        "description": "Creates a new todo. Send JSON: {\"text\": \"Buy milk\"}. Admin authentication required.",
        "operationId": "createTodo",
        "security": [{ "cookieAuth": [] }],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": ["text"],
                "properties": {
                  "text": { "type": "string", "description": "The todo text", "example": "Buy milk" }
                }
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Created",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/Todo" }
              }
            }
          },
          "400": { "description": "Bad Request — missing text" },
          "401": { "description": "Unauthorized — login required" }
        }
      }
    },
    "/api/v1/todos/{id}": {
      "delete": {
        "summary": "Delete a todo",
        "description": "Deletes the todo with the given ID. Returns 204 No Content. Admin authentication required.",
        "operationId": "deleteTodo",
        "security": [{ "cookieAuth": [] }],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": { "type": "integer" },
            "description": "The todo ID"
          }
        ],
        "responses": {
          "204": { "description": "No Content — deleted" },
          "401": { "description": "Unauthorized — login required" },
          "404": { "description": "Not Found — no todo with this id" }
        }
      }
    },
    "/login": {
      "post": {
        "summary": "Authenticate",
        "description": "Submit ADMIN_USER/ADMIN_PASSWORD credentials. Sets an HttpOnly session cookie on success.",
        "operationId": "login",
        "requestBody": {
          "required": true,
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "required": ["username", "password"],
                "properties": {
                  "username": { "type": "string" },
                  "password": { "type": "string", "format": "password" }
                }
              }
            }
          }
        },
        "responses": {
          "200": { "description": "Authenticated — session cookie set" },
          "401": { "description": "Invalid credentials" }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Todo": {
        "type": "object",
        "required": ["id", "text"],
        "properties": {
          "id": { "type": "integer", "description": "Unique identifier" },
          "text": { "type": "string", "description": "The todo task", "example": "Buy groceries" }
        }
      }
    },
    "securitySchemes": {
      "cookieAuth": {
        "type": "apiKey",
        "in": "cookie",
        "name": "tidy_session",
        "description": "Session cookie obtained via POST /login"
      }
    }
  }
}