api_session.yaml

swagger: "2.0"
info:
  version: 1.0.0
  title: Session API
  description: Collection of enpoints to interact with user session.
host: localhost
basePath: /api/v1
schemes:
  - https
paths:
  "/sessions/{fiscalcode}":
    get:
      operationId: getSession
      summary: Get available user info from session
      description: |-
        Use this operation if you want to known the state of user session
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
      responses:
        "200":
          description: Success.
          schema:
            $ref: "#/definitions/UserSessionInfo"
          examples:
            application/json:
              "active": true
        "400":
          description: Bad request
        "401":
          description: Token null or invalid.
        "404":
          description: User not found.
        "429":
          description: Throttling.
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
  "/sessions/{fiscalcode}/lock":
    post:
      operationId: lockUserSession
      summary: Lock a user session and delete session data
      description: |-
        Use this operation if you want to block a user to log in. The operation succeed if the user is already blocked
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
      responses:
        "200":
          description: Success.
          schema:
            $ref: "#/definitions/SuccessResponse"
          examples:
            application/json:
              "message": "ok"
        "400":
          description: Bad request
        "401":
          description: Token null or invalid.
        "404":
          description: User not found.
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
    delete:
      operationId: unlockUserSession
      summary: Remove a lock to a user session
      description: |-
        Use this operation if you want to unblock a user and re-allow to login. The operation succeed if the user wasn't blocked
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
      responses:
        "200":
          description: Success.
          schema:
            $ref: "#/definitions/SuccessResponse"
          examples:
            application/json:
              "message": "ok"
        "400":
          description: Bad request
        "401":
          description: Token null or invalid.
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
  "/sessions/{fiscalcode}/logout":
    post:
      operationId: deleteUserSession
      summary: Delete user session and invalidate lollipop data
      description: |-
        Use this operation to invalidate the user session and disable the lollipop params to prevent Fast Login token refresh
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
      responses:
        "200":
          description: Success.
          schema:
            $ref: "#/definitions/SuccessResponse"
          examples:
            application/json:
              "message": "ok"
        "400":
          description: Bad request
        "401":
          description: Token null or invalid.
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
  "/auth/{fiscalcode}/lock":
    post:
      operationId: authLock
      description: |-
        Locks the user for the IO app.
        This is intended to use with ioweb-profile lock functionality.
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
        - name: body
          in: body
          required: true
          schema:
            $ref: "#/definitions/AuthLockBody"
      responses:
        "204":
          description: Lock created.
        "400":
          description: Bad request
          schema:
            $ref: "#/definitions/ProblemJson"
        "401":
          description: Token null or invalid.
          schema:
            $ref: "#/definitions/ProblemJson"
        "409":
          description: The user lock has been already created.
          schema:
            $ref: "#/definitions/ProblemJson"
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
  "/auth/{fiscalcode}/release-lock":
    post:
      operationId: releaseAuthLock
      description: |-
        Release the user authentication lock for the IO app.
        This is intended to use with ioweb-profile unlock functionality.
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
        - name: body
          in: body
          required: true
          schema:
            $ref: "#/definitions/AuthUnlockBody"
      responses:
        "204":
          description: Lock successfully released.
        "403":
          description: Operation forbidden.
        "400":
          description: Bad request
          schema:
            $ref: "#/definitions/ProblemJson"
        "401":
          description: Token null or invalid.
          schema:
            $ref: "#/definitions/ProblemJson"
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
  "/sessions/{fiscalcode}/state":
    get:
      operationId: getUserSessionState
      summary: Get User Session State on IO App
      parameters:
        - $ref: "#/parameters/FiscalCode"
        - $ref: "#/parameters/Token"
      responses:
        "200":
          description: Success.
          schema:
            $ref: "#/definitions/SessionState"
          examples:
            application/json:
              "access_enabled": true
              "session_info":
                {
                  "active": true,
                  "expiration_date": "2011-10-05T14:48:00.000Z",
                  "type": "LV",
                }
        "400":
          description: Bad request
        "401":
          description: Unauthorized
        "500":
          description: There was an error
          schema:
            $ref: "#/definitions/ProblemJson"
parameters:
  FiscalCode:
    name: fiscalcode
    in: path
    type: string
    maxLength: 16
    minLength: 16
    required: true
    description: The fiscal code of the user, all upper case.
    x-example: SPNDNL80R13C555X
  Token:
    name: token
    in: query
    type: string
    required: true
    description: The API key used to access this webhooks.
definitions:
  FiscalCode:
    $ref: "https://raw.githubusercontent.com/pagopa/io-functions-commons/v21.5.3/openapi/definitions.yaml#/FiscalCode"
  ProblemJson:
    $ref: "https://raw.githubusercontent.com/pagopa/io-functions-commons/v21.5.3/openapi/definitions.yaml#/ProblemJson"
  UnlockCode:
    type: string
    pattern: ^\\d{9}$
  AuthLockBody:
    type: object
    properties:
      unlock_code:
        $ref: "#/definitions/UnlockCode"
    required:
      - unlock_code
  AuthUnlockBody:
    type: object
    properties:
      unlock_code:
        $ref: "#/definitions/UnlockCode"
  SuccessResponse:
    type: object
    properties:
      message:
        type: string
  UserSessionInfo:
    type: object
    properties:
      active:
        type: boolean
    required:
      - active
  SessionInfo:
    description: Info about an user session
    x-one-of: true
    allOf:
      - type: object
        description: Inactive session
        properties:
          active:
            type: boolean
            enum:
              - false
        required:
          - active
      - type: object
        description: Active session
        properties:
          active:
            type: boolean
            enum:
              - true
          expiration_date:
            type: string
            format: date
          type:
            type: string
            enum:
              - LV
              - LEGACY
        required:
          - active
          - expiration_date
          - type
  SessionState:
    description: The state of the user' session
    type: object
    properties:
      access_enabled:
        type: boolean
      session_info:
        $ref: "#/definitions/SessionInfo"
    required:
      - access_enabled
      - session_info
responses: {}
consumes:
  - application/json
produces:
  - application/json