curl -X POST https://api.personalizedpool.com/quiz/{quizId} \
     -H "Authorization: Bearer <ADMIN_JWT>" \
     -H "Content-Type: application/json" \
     --data-binary @schema.json

curl -X PATCH https://api.personalizedpool.com/quiz/{quizId} \
     -H "Authorization: Bearer <ADMIN_JWT>" \
     -H "Content-Type: application/json" \
     --data-binary @schema.json

curl -H "Authorization: Bearer <USER_JWT>" \
     https://api.personalizedpool.com/quiz/{quizId}

curl -X GET https://api.personalizedpool.com/quizList \
     -H "Authorization: Bearer <USER_JWT>"

curl -X POST https://api.personalizedpool.com/answers/{quizId} \
     -H "Authorization: Bearer <USER_JWT>" \
     -H "Content-Type: application/json" \
     --data-binary @answers.json

curl -X GET https://api.personalizedpool.com/answers/{quizId} \
     -H "Authorization: Bearer <USER_JWT>"

curl -X POST http://api.personalizedpool.com/register \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "yourPassword123"}'

{ "token": "JWT_TOKEN" }

curl -X POST http://api.personalizedpool.com/sendEmailConfirmationCode \
  -H "Authorization: Bearer JWT_TOKEN"

curl -X POST http://api.personalizedpool.com/confirmEmail \
  -H "Authorization: Bearer JWT_TOKEN" \
  -H "Content-Type: text/plain" \
  -d "123456"

curl -X GET http://api.personalizedpool.com/me \
  -H "Authorization: Bearer JWT_TOKEN"

{
  "email": "user@example.com",
  "isEmailVerified": true
}

curl -X POST http://api.personalizedpool.com/sendEmailConfirmationCodeForPassword \
  -H "Content-Type: text/plain" \
  -d "user@example.com"

curl -X POST http://api.personalizedpool.com/checkEmailConfirmationCodeForPassword/user@example.com \
  -H "Content-Type: text/plain" \
  -d "123456"

{
  "message": "Code is valid. You can proceed with password change."
}

curl -X POST http://api.personalizedpool.com/changePassword \
  -H "Content-Type: application/json" \
  -d '{
        "code": "123456",
        "newPassword": "NewPass123!",
        "email": "user@example.com"
      }'

curl -X POST http://api.personalizedpool.com/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "NewPass123!"}'

curl -X POST http://api.personalizedpool.com/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "yourPassword123"}'

curl -X POST http://api.personalizedpool.com/logout \
  -H "Authorization: Bearer JWT_TOKEN"

curl -X GET http://api.personalizedpool.com/me \
  -H "Authorization: Bearer JWT_TOKEN"

curl -X POST http://api.personalizedpool.com/login/google \
  -H "Content-Type: text/plain" \
  -d "SOCIAL_ACCESS_TOKEN"

{
  "root": "Alice",
  "poolVolume": "45000l",
  "seasonLength": "My pool is seasonal",
  "seasonalPool": "1/1-6/1",
  "isYourPoolGetClosed": true,
  "primarySanitizer": "Chlorine",
  "chlorineType": ["Liquid chlorine"],
  "typeOfPool": "Vinyl Liner",
  "inGroundOrAboveGround": "In-ground",
  "automaticCover": true,
  "hasHotSystem": false,
  "genericQuizPassed": "continue",
  "hasSecondarySanitizer": "Yes",
  "secondarySanitizer": ["UV", "Ozone"],
  "typeOfFilter": "Sand/crushed glass",
  "filterBrand": { "value": "Other", "other": "BlueWaterPro" },
  "typeOfPump": "Variable-speed",
  "pumpBrand": { "value": "Pentair", "other": null },
  "circulateHours": "16 or more hours",
  "automation": "Yes",
  "automationType": ["Full automation (phone app)"],
  "automationBrand": { "value": "Intellicenter® (Pentair)", "other": null },
  "dogsInPool": false,
  "email": "alice@example.com"
}

curl -X GET https://api.personalizedpool.com/kit/matrix \
     -H "Authorization: Bearer <ADMIN_JWT>"

curl -X POST https://api.personalizedpool.com/kit/matrix \
     -H "Authorization: Bearer <ADMIN_JWT>" \
     -H "Content-Type: text/plain" \
     --data-binary @matrix.csv

// Node.js (built-in 'crypto')
const crypto = require("crypto");

/**
 * Create x-admin-key by encrypting the current Unix timestamp in ms
 * with AES/CBC/PKCS5Padding using the provided secret and IV.
 *
 * @param {string} ivUtf8 - IV received from GET /iv (must be 16 bytes when UTF-8 encoded)
 * @param {string|Buffer} secret - Shared secret (16 or 32 bytes)
 * @returns {{ adminKey: string, timestamp: string }}
 */
function makeAdminKey(ivUtf8, secret) {
  const timestamp = String(Date.now()); // Unix ms as string
  const iv = Buffer.from(ivUtf8, "utf8");

  // Allow 16-byte (AES-128) or 32-byte (AES-256) secrets
  const key = Buffer.isBuffer(secret) ? secret : Buffer.from(secret, "utf8");
  const algo = key.length === 16 ? "aes-128-cbc"
             : key.length === 32 ? "aes-256-cbc"
             : (() => { throw new Error("Secret must be 16 or 32 bytes"); })();

  const cipher = crypto.createCipheriv(algo, key, iv);
  cipher.setAutoPadding(true);

  const encrypted = Buffer.concat([
    cipher.update(Buffer.from(timestamp, "utf8")),
    cipher.final(),
  ]);

  return {
    adminKey: encrypted.toString("base64"),
    timestamp, // optional: useful for logging/debug
  };
}

// Example usage:
// 1) Fetch iv from GET /iv
// 2) Call makeAdminKey(iv, SECRET)
// 3) Send { x-admin-iv: iv, x-admin-key: adminKey } as headers

# 1) Get IV (valid for 10s)
IV=$(curl -s https://api.personalizedpool.com/iv | jq -r .iv)

# 2) Generate x-admin-key with your app using IV + SECRET (done in JS above)
# Suppose your app prints just the base64 key:
ADMIN_KEY=$(node genAdminKey.js "$IV")  # your script wraps makeAdminKey

# 3) Submit answers anonymously
curl -X POST https://api.personalizedpool.com/answers/{quizId} \
     -H "x-admin-iv: $IV" \
     -H "x-admin-key: $ADMIN_KEY" \
     -H "Content-Type: application/json" \
     --data-binary @answers.json