openapi: 3.1.0
info:
  title: Comunidesk API — Asignaciones de rol
  version: 1.0.0
  description: "RBAC por edificio: rol, permisos extra y exclusiones."
servers:
  - url: "https://gateway.comunidesk.com"
    description: Gateway producción
tags:
  - name: asignaciones-rol
    description: "Asignaciones de rol — RBAC por edificio: rol, permisos extra y exclusiones."
paths:
  /v1/rest/RoleAssignments:
    get:
      tags:
        - asignaciones-rol
      operationId: listRoleAssignment
      summary: Listar Asignaciones de rol
      description: "RBAC por edificio: rol, permisos extra y exclusiones."
      security:
        - OAuth2App: []
          ComunideskUser: []
      parameters:
        - name: edificioId
          in: query
          required: false
          schema:
            type: string
          description: Contexto de edificio (requerido en la mayoría de módulos).
        - name: $filter
          in: query
          required: false
          schema:
            type: string
          description: "Filtro OData, p.ej. edificioId eq 'abc'"
        - name: $top
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 200
        - name: $skip
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/RoleAssignment"
                  count:
                    type: integer
        401:
          description: Token inválido
        403:
          description: Sin permiso
    post:
      tags:
        - asignaciones-rol
      operationId: createRoleAssignment
      summary: Crear Asignaciones de rol
      security:
        - OAuth2App: []
          ComunideskUser: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RoleAssignment"
      responses:
        200:
          description: Creado
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RoleAssignment"
        403:
          description: Sin permiso
        422:
          description: Contrato inválido
  /v1/rest/RoleAssignments/{id}:
    get:
      tags:
        - asignaciones-rol
      operationId: getRoleAssignment
      summary: Obtener Asignaciones de rol
      security:
        - OAuth2App: []
          ComunideskUser: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
        - name: edificioId
          in: query
          required: false
          schema:
            type: string
          description: Contexto de edificio (requerido en la mayoría de módulos).
        - name: $filter
          in: query
          required: false
          schema:
            type: string
          description: "Filtro OData, p.ej. edificioId eq 'abc'"
        - name: $top
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 200
        - name: $skip
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/RoleAssignment"
        404:
          description: No encontrado
    patch:
      tags:
        - asignaciones-rol
      operationId: updateRoleAssignment
      summary: Actualizar Asignaciones de rol
      security:
        - OAuth2App: []
          ComunideskUser: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RoleAssignment"
      responses:
        200:
          description: Actualizado
        403:
          description: Sin permiso
        422:
          description: Contrato inválido
    delete:
      tags:
        - asignaciones-rol
      operationId: deleteRoleAssignment
      summary: Eliminar Asignaciones de rol
      security:
        - OAuth2App: []
          ComunideskUser: []
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
        - name: edificioId
          in: query
          required: false
          schema:
            type: string
      responses:
        200:
          description: Eliminado
        403:
          description: Sin permiso
        404:
          description: No encontrado
components:
  securitySchemes:
    OAuth2App:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token OAuth2 de tu aplicación.
    ComunideskUser:
      type: apiKey
      in: header
      name: x-comunidesk-user-authorization
      description: "Bearer <JWT de la cuenta Comunidesk del usuario>."
  schemas:
    RoleAssignment:
      type: object
      description: "RBAC por edificio: rol, permisos extra y exclusiones."
      properties:
        _id:
          type: string
        _rev:
          type: string
        type:
          type: string
          const: role_assignment
        edificioId:
          type: string
        userEmail:
          type: string
        userName:
          type: string
        rol:
          type: string
        permissions:
          type: array
          items: {}
        excludedPermissions:
          type: array
          items: {}
        permissionGroups:
          type: array
          items: {}
        temporary:
          type: boolean
        expiresAt:
          type: string
        reason:
          type: string
        activo:
          type: boolean
        createdAt:
          type: string
          readOnly: true
        updatedAt:
          type: string
          readOnly: true
        assignedBy:
          type: string
          readOnly: true
        assignedByName:
          type: string
          readOnly: true
        assignedAt:
          type: string
          readOnly: true
      required:
        - edificioId
        - userEmail
        - rol
    OAuthScopes:
      type: string
      enum:
        - "comunidesk:read"
        - "comunidesk:write"
        - "files:pdf"
        - "files:excel"
        - "ai:models"
        - "ai:chat"
        - "ai:extract"
        - "ai:web"
        - "flex-pro:manage"
        - "flex-pro:runtime"
        - "flex-pro:marketplace"
      description: Scopes OAuth soportados por el gateway.
security:
  - OAuth2App: []
    ComunideskUser: []