TesseraCore IAM API

openapi: 3.1.0
info:
  title: TesseraCore IAM API
  version: 0.1.0
  description: >
    Identity, organizations, and sessions. Spec-first per plan §4a — this
    file is the source of truth; internal/iam/http implements exactly what's
    documented here. Not Casdoor's full API surface, only what TesseraCore's
    own UI (and, later, other modules' service-to-service calls) needs.
servers:
  - url: /api/iam
paths:
  /sessions:
    post:
      operationId: createSession
      summary: Log in and create a session
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '201':
          description: Session created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '401':
          description: Invalid credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /me:
    get:
      operationId: getCurrentUser
      summary: Get the currently authenticated user
      security:
        - sessionCookie: []
      responses:
        '200':
          description: Current user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '401':
          description: Not authenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: tsc_session
  schemas:
    LoginRequest:
      type: object
      required: [email, password]
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          format: password
    LoginResponse:
      type: object
      required: [token]
      properties:
        token:
          type: string
    User:
      type: object
      required: [id, org_id, email, display_name]
      properties:
        id:
          type: string
          format: uuid
        org_id:
          type: string
          format: uuid
        email:
          type: string
          format: email
        display_name:
          type: string
    Error:
      type: object
      required: [error]
      properties:
        error:
          type: string