definitions:
  internal_auth.AuthResponse:
    properties:
      refresh_token:
        example: dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4=
        type: string
      token:
        example: eyJhbGciOiJIUzI1NiIs...
        type: string
      user:
        $ref: '#/definitions/internal_auth.UserPublic'
    type: object
  internal_auth.ErrorResponse:
    properties:
      error:
        example: invalid email or password
        type: string
    type: object
  internal_auth.LoginRequest:
    properties:
      email:
        example: john@example.com
        type: string
      password:
        example: secret123
        type: string
    required:
    - email
    - password
    type: object
  internal_auth.RefreshRequest:
    properties:
      refresh_token:
        example: dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4=
        type: string
    required:
    - refresh_token
    type: object
  internal_auth.RegisterRequest:
    properties:
      email:
        example: john@example.com
        type: string
      password:
        example: secret123
        minLength: 6
        type: string
      username:
        example: john
        maxLength: 30
        minLength: 3
        type: string
    required:
    - email
    - password
    - username
    type: object
  internal_auth.UserPublic:
    properties:
      created_at:
        type: string
      email:
        type: string
      id:
        type: string
      username:
        type: string
    type: object
  internal_auth.UserResponse:
    properties:
      user:
        $ref: '#/definitions/internal_auth.UserPublic'
    type: object
info:
  contact: {}
  description: API for AegisGuard control plane
  title: AegisGuard API
  version: "1.0"
paths:
  /api/auth/login:
    post:
      consumes:
      - application/json
      description: Authenticate user with email and password, returns JWT token
      parameters:
      - description: Login credentials
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/internal_auth.LoginRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/internal_auth.AuthResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
      summary: Epta login
      tags:
      - auth
  /api/auth/me:
    get:
      consumes:
      - application/json
      description: Get authenticated user's profile
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/internal_auth.UserResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
      security:
      - Bearer: []
      summary: Epta get current user
      tags:
      - auth
  /api/auth/refresh:
    post:
      consumes:
      - application/json
      description: Get a new access token using a refresh token
      parameters:
      - description: Refresh token
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/internal_auth.RefreshRequest'
      produces:
      - application/json
      responses:
        "200":
          description: OK
          schema:
            $ref: '#/definitions/internal_auth.AuthResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
      summary: Refresh epta token
      tags:
      - auth
  /api/auth/register:
    post:
      consumes:
      - application/json
      description: Create user account with username, email, password
      parameters:
      - description: Registration details
        in: body
        name: request
        required: true
        schema:
          $ref: '#/definitions/internal_auth.RegisterRequest'
      produces:
      - application/json
      responses:
        "201":
          description: Created
          schema:
            $ref: '#/definitions/internal_auth.UserResponse'
        "400":
          description: Bad Request
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
        "409":
          description: Conflict
          schema:
            $ref: '#/definitions/internal_auth.ErrorResponse'
      summary: Epta registration
      tags:
      - auth
schemes:
- http
securityDefinitions:
  Bearer:
    description: Type "Bearer" followed by a space and the JWT token.
    in: header
    name: Authorization
    type: apiKey
swagger: "2.0"