Vibecoding Quick Start

Add Filoxenos guest check-in and AADE compliance automation to this 
project. Filoxenos is a REST API for Greek short-term rental (STR) 
hosts that automates digital guest check-ins, police reporting, and 
AADE tax submissions.

API Base URL: https://www.filoxenos.gr/api/v1
API Key: [PASTE YOUR KEY FROM filoxenos.gr/dashboard/settings]
Auth: Bearer token in Authorization header

Core endpoints:

1. GET /properties
   Returns all properties linked to your account.
   Response: Array of { id, name, address, aade_property_id, 
   status, channel_connections }.

2. GET /bookings?property_id=...&from=...&to=...
   Returns guest reservations for a property in a date range.
   Response: Array of { id, property_id, guest_name, 
   arrival_date, departure_date, channel, checkin_status, 
   report_status }.

3. POST /bookings
   Creates a manual booking (for walk-ins or direct bookings).
   Body: { property_id, guest_name, arrival_date, departure_date, 
   guest_count, source }.

4. POST /checkins/resend
   Resends the digital check-in link to a guest.
   Body: { booking_id }.

5. GET /reports?period=2026-04
   Returns AADE compliance reports for a given month.
   Response: Array of { id, period, status, property_id, 
   download_url, submitted_at }.

6. GET /reports/download?report_id=...
   Returns a signed URL to download the report PDF/XML.

7. GET /sync/status
   Returns current channel manager sync state.
   Response: { last_sync_all, connections: [{ provider, 
   last_sync_success, status }] }.

8. POST /sync/trigger
   Triggers an immediate channel manager sync.
   Rate-limited to once per 5 minutes.

9. POST /webhooks
   Registers a new webhook endpoint.
   Body: { url, events: ["checkin.completed", "report.ready", ...] }.
   Response includes a one-time 'secret' for HMAC-SHA256 
   signature verification.

ACTUAL response structure for bookings (use for parsing):
{
  "data": [
    {
      "id": "book_abc123",
      "property_id": "prop_12345",
      "guest_name": "Konstantinos Theodorou",
      "arrival_date": "2026-04-15",
      "departure_date": "2026-04-18",
      "guest_count": 2,
      "channel": "Airbnb",
      "checkin_status": "COMPLETED",
      "report_status": "SUBMITTED"
    }
  ]
}

Error format:
{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded. Maximum 100 requests per minute."
  }
}

Webhook signature verification (IMPORTANT for security):
  Header: X-Filoxenos-Signature: sha256=...
  Header: X-Filoxenos-Timestamp: 1672531200
  Verify: HMAC-SHA256(request_body, webhook_secret)
  Reject if timestamp older than 5 minutes (replay protection)

Please:
1. Store the API key as environment variable FILOXENOS_API_KEY.
2. FIRST: Make a raw test call to GET /properties and log the full 
   JSON response. Verify the response shape before writing any 
   parsing logic.
3. Create these integration functions:
   a. listProperties() — fetches and displays all properties
   b. getUpcomingBookings(propertyId, days) — fetches bookings 
      for the next N days, highlights missing check-ins
   c. resendCheckin(bookingId) — resends a check-in link
   d. getComplianceStatus(month) — fetches AADE reports for a 
      month and shows submission status per property
   e. triggerSync() — triggers a channel manager sync
4. Add defensive parsing — check that response.data exists and is 
   an array before iterating. Log the raw response if the shape 
   is unexpected instead of crashing.
5. If this project has a UI, create a dashboard panel showing:
   - Properties overview with sync status indicators
   - Upcoming arrivals with check-in completion badges
   - Monthly compliance status with report download links
6. Set up a webhook handler at /api/webhooks/filoxenos that:
   - Verifies the HMAC-SHA256 signature
   - Handles checkin.completed and report.ready events
   - Logs or notifies on sync.error events