more fix and update

shared/proto/auth.proto

@@ -10,6 +10,8 @@ service AuthService {
   rpc VerifyOtp (PasswordlessVerifyRequest) returns (PasswordlessAuthResponse);
   rpc LoginWithPassword (PasswordLoginRequest) returns (AuthTokens);
   rpc LoginWithLdap (LdapLoginRequest) returns (AuthTokens);
+  rpc VerifyTotpLogin (VerifyTotpLoginRequest) returns (AuthTokens);
+  rpc BeginTotpLogin (BeginTotpLoginRequest) returns (BeginTotpLoginResponse);
   rpc VerifyPin (VerifyPinRequest) returns (PinVerificationResponse);
   rpc GetMe (GetMeRequest) returns (PublicUser);
   rpc RefreshSession (RefreshSessionRequest) returns (RefreshSessionResponse);
@@ -43,6 +45,13 @@ message IdentifyResponse {
   bool hasPassword = 2;
   bool isPinEnabled = 3;
   repeated LoginMethod methods = 4;
+  bool isTotpEnabled = 5;
+  repeated OtpChannel otpChannels = 6;
+}
+
+message OtpChannel {
+  string channel = 1;
+  string masked = 2;
 }
 
 message LoginMethod {
@@ -54,6 +63,7 @@ message LoginMethod {
 message PasswordlessOtpRequest {
   string recipient = 1;
   optional string channel = 2;
+  optional string ipAddress = 3;
 }
 
 message PasswordlessOtpResponse {
@@ -76,6 +86,8 @@ message PasswordlessAuthResponse {
   bool requiresPassword = 1;
   optional string tempAuthToken = 2;
   optional AuthTokens auth = 3;
+  bool requiresTotp = 4;
+  optional string totpChallengeToken = 5;
 }
 
 message PasswordLoginRequest {
@@ -99,6 +111,24 @@ message LdapLoginRequest {
   optional string userAgent = 7;
 }
 
+message VerifyTotpLoginRequest {
+  string totpChallengeToken = 1;
+  string code = 2;
+}
+
+message BeginTotpLoginRequest {
+  string recipient = 1;
+  string fingerprint = 2;
+  optional string deviceName = 3;
+  optional string deviceType = 4;
+  optional string ipAddress = 5;
+  optional string userAgent = 6;
+}
+
+message BeginTotpLoginResponse {
+  string totpChallengeToken = 1;
+}
+
 message VerifyPinRequest {
   string sessionId = 1;
   string pin = 2;
@@ -163,6 +193,8 @@ message AuthTokens {
   bool pinVerified = 4;
   PublicUser user = 5;
   string sessionId = 6;
+  bool requiresTotp = 7;
+  optional string totpChallengeToken = 8;
 }
 
 message PinVerificationResponse {

shared/proto/identity.proto

@@ -18,6 +18,7 @@ service AdvancedAuthService {
   rpc CreateWebAuthnLoginChallenge (WebAuthnRequest) returns (ChallengeResponse);
   rpc CreateQrSession (QrSessionRequest) returns (QrSessionResponse);
   rpc PollQrSession (QrPollRequest) returns (QrSessionResponse);
+  rpc ApproveQrSession (ApproveQrSessionRequest) returns (QrSessionResponse);
 }
 
 service FamilyService {
@@ -29,6 +30,7 @@ service FamilyService {
   rpc AddFamilyMember (FamilyMemberRequest) returns (FamilyMemberResponse);
   rpc RemoveFamilyMember (RemoveFamilyMemberRequest) returns (MutationResponse);
   rpc SendFamilyInvite (SendFamilyInviteRequest) returns (FamilyInviteResponse);
+  rpc SearchFamilyInviteUsers (SearchFamilyInviteUsersRequest) returns (SearchFamilyInviteUsersResponse);
   rpc RespondFamilyInvite (RespondFamilyInviteRequest) returns (FamilyInviteResponse);
   rpc ListFamilyInvites (ListFamilyInvitesRequest) returns (ListFamilyInvitesResponse);
 }
@@ -81,6 +83,7 @@ message SendOtpRequest {
   string channel = 2;
   string purpose = 3;
   optional string userId = 4;
+  optional string ipAddress = 5;
 }
 
 message VerifyOtpRequest {
@@ -110,6 +113,10 @@ message ChallengeResponse {
 
 message QrSessionRequest {
   string deviceName = 1;
+  optional string fingerprint = 2;
+  optional string deviceType = 3;
+  optional string ipAddress = 4;
+  optional string userAgent = 5;
 }
 
 message QrPollRequest {
@@ -120,6 +127,21 @@ message QrSessionResponse {
   string sessionId = 1;
   string status = 2;
   string expiresAt = 3;
+  optional string qrPayload = 4;
+  optional QrAuthPayload auth = 5;
+}
+
+message ApproveQrSessionRequest {
+  string sessionId = 1;
+  string userId = 2;
+}
+
+message QrAuthPayload {
+  string accessToken = 1;
+  string refreshToken = 2;
+  string sessionId = 3;
+  bool pinVerified = 4;
+  string expiresAt = 5;
 }
 
 message UserIdRequest {
@@ -155,7 +177,27 @@ message RemoveFamilyMemberRequest {
 message SendFamilyInviteRequest {
   string requesterId = 1;
   string groupId = 2;
-  string target = 3;
+  optional string target = 3;
+  optional string inviteeUserId = 4;
+}
+
+message SearchFamilyInviteUsersRequest {
+  string requesterId = 1;
+  string groupId = 2;
+  string query = 3;
+}
+
+message FamilyInviteUserCandidate {
+  string id = 1;
+  string displayName = 2;
+  optional string email = 3;
+  optional string phone = 4;
+  optional string username = 5;
+  bool hasAvatar = 6;
+}
+
+message SearchFamilyInviteUsersResponse {
+  repeated FamilyInviteUserCandidate users = 1;
 }
 
 message RespondFamilyInviteRequest {

shared/proto/media.proto

@@ -47,6 +47,7 @@ message PresignedUploadResponse {
   string uploadUrl = 1;
   string storageKey = 2;
   string expiresAt = 3;
+  optional string uploadToken = 4;
 }
 
 message AvatarResponse {

shared/proto/profile.proto

@@ -37,6 +37,7 @@ message UpdateProfileRequest {
   optional string bio = 4;
   optional int32 age = 5;
   optional string gender = 6;
+  optional string birthDate = 7;
 }
 
 message UpdateContactsRequest {
@@ -62,6 +63,7 @@ message ProfileResponse {
   optional string phone = 11;
   optional string backupEmail = 12;
   optional string backupPhone = 13;
+  optional string birthDate = 15;
 }
 
 message SoftDeleteProfileResponse {

shared/proto/security.proto

@@ -18,6 +18,10 @@ service SecurityService {
   rpc ConnectLinkedAccount (ConnectLinkedAccountRequest) returns (LinkedAccount);
   rpc DisconnectLinkedAccount (DisconnectLinkedAccountRequest) returns (MutationCountResponse);
   rpc ListLinkedAccounts (UserSecurityRequest) returns (ListLinkedAccountsResponse);
+  rpc GetTotpStatus (UserSecurityRequest) returns (TotpStatusResponse);
+  rpc SetupTotp (UserSecurityRequest) returns (TotpSetupResponse);
+  rpc EnableTotp (TotpCodeRequest) returns (TotpStatusResponse);
+  rpc DisableTotp (TotpCodeRequest) returns (TotpStatusResponse);
 }
 
 service SettingsService {
@@ -36,6 +40,7 @@ message Empty {}
 
 message UserSecurityRequest {
   string userId = 1;
+  optional string exceptSessionId = 2;
 }
 
 message Device {
@@ -229,3 +234,17 @@ message TestMessagingDeliveryResponse {
   string target = 3;
   optional string message = 4;
 }
+
+message TotpStatusResponse {
+  bool isEnabled = 1;
+}
+
+message TotpSetupResponse {
+  string secret = 1;
+  string otpauthUrl = 2;
+}
+
+message TotpCodeRequest {
+  string userId = 1;
+  string code = 2;
+}