From c9b595118a0e6c97337e4e3046fd3e090e0ccd85 Mon Sep 17 00:00:00 2001
From: toanhoang <toanhoang@appsrv01.toanhoang.local>
Date: Sun, 2 Aug 2026 20:48:09 -0400
Subject: [PATCH] feat: add AssetModel API routes

---
 src/app/api/asset-models/route.ts | 52 +++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 src/app/api/asset-models/route.ts

diff --git a/src/app/api/asset-models/route.ts b/src/app/api/asset-models/route.ts
new file mode 100644
index 0000000..38a5380
--- /dev/null
+++ b/src/app/api/asset-models/route.ts
@@ -0,0 +1,52 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/auth";
+import {
+  createAssetModel,
+  listAssetModels,
+  validateCreateAssetModelInput,
+} from "@/lib/asset-models";
+
+// Mirrors src/app/api/asset-category-attribute-defs/route.ts's pattern —
+// middleware.ts excludes /api from route protection, so this checks the
+// session itself. Flat permission model (CLAUDE.md): only "logged in or
+// not", no role check.
+export async function POST(request: Request): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
+  }
+
+  if (typeof body !== "object" || body === null) {
+    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
+  }
+
+  const { categoryId, manufacturer, name, specs } = body as Record<string, unknown>;
+  const validation = validateCreateAssetModelInput({ categoryId, manufacturer, name, specs });
+
+  if (!validation.ok) {
+    return NextResponse.json({ error: validation.error }, { status: 400 });
+  }
+
+  const created = await createAssetModel(validation.value);
+  if (!created.ok) {
+    return NextResponse.json({ error: created.error }, { status: 400 });
+  }
+  return NextResponse.json(created.value, { status: 201 });
+}
+
+export async function GET(): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const assetModels = await listAssetModels();
+  return NextResponse.json(assetModels, { status: 200 });
+}