component extends="Controller" {

    function config() {
        provides("json");
        verifies(only="show,update,delete", params="key", paramsTypes="integer");
        filters(through="requireApiAuth");
    }

    function index() {
        resources = model("Resource").findAll(order="createdAt DESC");

        renderWith(
            data=resources,
            format="json",
            status=200
        );
    }

    function show() {
        resource = model("Resource").findByKey(key=params.key);

        if (!isObject(resource)) {
            renderWith(
                data={error="Resource not found"},
                format="json",
                status=404
            );
            return;
        }

        renderWith(
            data=resource,
            format="json",
            status=200
        );
    }

    function create() {
        resource = model("Resource").new(params.resource);

        if (resource.save()) {
            renderWith(
                data=resource,
                format="json",
                status=201,
                location=urlFor(action="show", key=resource.key())
            );
        } else {
            renderWith(
                data={errors=resource.allErrors()},
                format="json",
                status=422
            );
        }
    }

    function update() {
        resource = model("Resource").findByKey(key=params.key);

        if (!isObject(resource)) {
            renderWith(data={error="Not found"}, format="json", status=404);
            return;
        }

        if (resource.update(params.resource)) {
            renderWith(data=resource, format="json", status=200);
        } else {
            renderWith(data={errors=resource.allErrors()}, format="json", status=422);
        }
    }

    function delete() {
        resource = model("Resource").findByKey(key=params.key);

        if (!isObject(resource)) {
            renderWith(data={error="Not found"}, format="json", status=404);
            return;
        }

        resource.delete();
        renderWith(data={message="Deleted"}, format="json", status=204);
    }

    private function requireApiAuth() {
        var headers = getHTTPRequestData().headers;

        if (!structKeyExists(headers, "Authorization")) {
            renderWith(data={error="Unauthorized"}, format="json", status=401);
            abort;
        }

        // Validate API token
        var token = replace(headers.Authorization, "Bearer ", "");
        if (!isValidApiToken(token)) {
            renderWith(data={error="Invalid token"}, format="json", status=401);
            abort;
        }
    }

    private boolean function isValidApiToken(required string token) {
        // Token validation logic
        return true;
    }
}