first commit

shared/proto/addresses.proto

@@ -0,0 +1,56 @@
+syntax = "proto3";
+
+package addresses;
+
+service AddressesService {
+  rpc ListAddresses (ListAddressesRequest) returns (ListAddressesResponse);
+  rpc UpsertAddress (UpsertAddressRequest) returns (UserAddress);
+  rpc DeleteAddress (AddressIdRequest) returns (MutationResponse);
+}
+
+message ListAddressesRequest {
+  string userId = 1;
+}
+
+message AddressIdRequest {
+  string addressId = 1;
+  string userId = 2;
+}
+
+message UpsertAddressRequest {
+  string userId = 1;
+  optional string addressId = 2;
+  string label = 3;
+  string city = 4;
+  string street = 5;
+  string house = 6;
+  optional string apartment = 7;
+  optional string comment = 8;
+  optional double latitude = 9;
+  optional double longitude = 10;
+  optional string fullAddress = 11;
+}
+
+message UserAddress {
+  string id = 1;
+  string userId = 2;
+  string label = 3;
+  string city = 4;
+  string street = 5;
+  string house = 6;
+  optional string apartment = 7;
+  optional string comment = 8;
+  optional double latitude = 9;
+  optional double longitude = 10;
+  optional string fullAddress = 11;
+  string createdAt = 12;
+  string updatedAt = 13;
+}
+
+message ListAddressesResponse {
+  repeated UserAddress addresses = 1;
+}
+
+message MutationResponse {
+  int32 count = 1;
+}

shared/proto/admin.proto

@@ -0,0 +1,58 @@
+syntax = "proto3";
+
+package admin;
+
+service AdminService {
+  rpc ListUsers (ListUsersRequest) returns (ListUsersResponse);
+  rpc UpdateUserProfile (UpdateUserRequest) returns (AdminUser);
+  rpc ResetPassword (ResetPasswordRequest) returns (AdminUser);
+  rpc SuspendUser (UserIdRequest) returns (AdminUser);
+  rpc SetSuperAdmin (SetSuperAdminRequest) returns (AdminUser);
+}
+
+message ListUsersRequest {
+  optional string search = 1;
+}
+
+message UserIdRequest {
+  string userId = 1;
+}
+
+message UpdateUserRequest {
+  string userId = 1;
+  optional string displayName = 2;
+  optional string email = 3;
+  optional string phone = 4;
+  optional string backupEmail = 5;
+  optional string backupPhone = 6;
+  optional string status = 7;
+}
+
+message ResetPasswordRequest {
+  string userId = 1;
+  string newPassword = 2;
+}
+
+message SetSuperAdminRequest {
+  string actorUserId = 1;
+  string userId = 2;
+  bool isSuperAdmin = 3;
+}
+
+message AdminUser {
+  string id = 1;
+  optional string email = 2;
+  optional string phone = 3;
+  optional string backupEmail = 4;
+  optional string backupPhone = 5;
+  string displayName = 6;
+  optional string username = 7;
+  bool isSuperAdmin = 8;
+  string status = 9;
+  string createdAt = 10;
+  repeated string roles = 11;
+}
+
+message ListUsersResponse {
+  repeated AdminUser users = 1;
+}

shared/proto/auth.proto

@@ -0,0 +1,171 @@
+syntax = "proto3";
+
+package auth;
+
+service AuthService {
+  rpc Register (RegisterRequest) returns (PublicUser);
+  rpc Login (LoginRequest) returns (AuthTokens);
+  rpc Identify (IdentifyRequest) returns (IdentifyResponse);
+  rpc SendOtp (PasswordlessOtpRequest) returns (PasswordlessOtpResponse);
+  rpc VerifyOtp (PasswordlessVerifyRequest) returns (PasswordlessAuthResponse);
+  rpc LoginWithPassword (PasswordLoginRequest) returns (AuthTokens);
+  rpc LoginWithLdap (LdapLoginRequest) returns (AuthTokens);
+  rpc VerifyPin (VerifyPinRequest) returns (PinVerificationResponse);
+  rpc GetMe (GetMeRequest) returns (PublicUser);
+  rpc RefreshSession (RefreshSessionRequest) returns (RefreshSessionResponse);
+  rpc ValidateSession (ValidateSessionRequest) returns (ValidateSessionResponse);
+}
+
+message RegisterRequest {
+  optional string email = 1;
+  optional string phone = 2;
+  string password = 3;
+  string displayName = 4;
+  optional string username = 5;
+}
+
+message LoginRequest {
+  string login = 1;
+  string password = 2;
+  optional string deviceName = 3;
+  optional string deviceType = 4;
+  string fingerprint = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+}
+
+message IdentifyRequest {
+  string login = 1;
+}
+
+message IdentifyResponse {
+  bool exists = 1;
+  bool hasPassword = 2;
+  bool isPinEnabled = 3;
+  repeated LoginMethod methods = 4;
+}
+
+message LoginMethod {
+  string kind = 1;
+  string channel = 2;
+  string masked = 3;
+}
+
+message PasswordlessOtpRequest {
+  string recipient = 1;
+  optional string channel = 2;
+}
+
+message PasswordlessOtpResponse {
+  bool sent = 1;
+  string expiresAt = 2;
+  string maskedTarget = 3;
+}
+
+message PasswordlessVerifyRequest {
+  string recipient = 1;
+  string code = 2;
+  string fingerprint = 3;
+  optional string deviceName = 4;
+  optional string deviceType = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+}
+
+message PasswordlessAuthResponse {
+  bool requiresPassword = 1;
+  optional string tempAuthToken = 2;
+  optional AuthTokens auth = 3;
+}
+
+message PasswordLoginRequest {
+  optional string tempAuthToken = 1;
+  string password = 2;
+  string fingerprint = 3;
+  optional string deviceName = 4;
+  optional string deviceType = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+  optional string login = 8;
+}
+
+message LdapLoginRequest {
+  string username = 1;
+  string password = 2;
+  string fingerprint = 3;
+  optional string deviceName = 4;
+  optional string deviceType = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+}
+
+message VerifyPinRequest {
+  string sessionId = 1;
+  string pin = 2;
+}
+
+message GetMeRequest {
+  string userId = 1;
+}
+
+message RefreshSessionRequest {
+  string refreshToken = 1;
+  optional string sessionId = 2;
+}
+
+message RefreshSessionResponse {
+  bool requiresPin = 1;
+  optional string accessToken = 2;
+  optional string sessionId = 3;
+  bool pinVerified = 4;
+  optional PublicUser user = 5;
+}
+
+message ValidateSessionRequest {
+  string userId = 1;
+  string sessionId = 2;
+  bool touchActivity = 3;
+}
+
+message ValidateSessionResponse {
+  bool requiresPin = 1;
+  string sessionId = 2;
+  bool pinVerified = 3;
+}
+
+message PublicUser {
+  string id = 1;
+  optional string email = 2;
+  optional string phone = 3;
+  optional string backupEmail = 4;
+  optional string backupPhone = 5;
+  string displayName = 6;
+  optional string username = 7;
+  optional string avatarUrl = 8;
+  optional bool hasAvatar = 11;
+  bool isSuperAdmin = 9;
+  string status = 10;
+  repeated string roles = 12;
+  repeated string permissions = 13;
+  bool canAccessAdmin = 14;
+  bool canManageRoles = 15;
+  bool canManageOAuth = 16;
+  bool canManageUsers = 17;
+  bool canManageSettings = 18;
+  bool canViewUsers = 19;
+  bool canViewUserDocuments = 20;
+}
+
+message AuthTokens {
+  string accessToken = 1;
+  string refreshToken = 2;
+  string expiresAt = 3;
+  bool pinVerified = 4;
+  PublicUser user = 5;
+  string sessionId = 6;
+}
+
+message PinVerificationResponse {
+  string accessToken = 1;
+  bool pinVerified = 2;
+}

shared/proto/chat.proto

@@ -0,0 +1,133 @@
+syntax = "proto3";
+
+package chat;
+
+service ChatService {
+  rpc ListRooms (ListRoomsRequest) returns (ListRoomsResponse);
+  rpc CreateRoom (CreateRoomRequest) returns (ChatRoomResponse);
+  rpc UpdateRoomSettings (UpdateRoomSettingsRequest) returns (ChatRoomResponse);
+  rpc ListMessages (ListMessagesRequest) returns (ListMessagesResponse);
+  rpc SendMessage (SendMessageRequest) returns (ChatMessageResponse);
+  rpc VotePoll (VotePollRequest) returns (ChatMessageResponse);
+  rpc SetRoomNotificationsMuted (SetRoomNotificationsMutedRequest) returns (MutationResponse);
+}
+
+message ListRoomsRequest {
+  string userId = 1;
+  string groupId = 2;
+}
+
+message CreateRoomRequest {
+  string userId = 1;
+  string groupId = 2;
+  string name = 3;
+  repeated string memberUserIds = 4;
+}
+
+message UpdateRoomSettingsRequest {
+  string userId = 1;
+  string roomId = 2;
+  optional string name = 3;
+  optional bool notificationsMuted = 4;
+}
+
+message ListMessagesRequest {
+  string userId = 1;
+  string roomId = 2;
+  optional string beforeMessageId = 3;
+  int32 limit = 4;
+}
+
+message SendMessageRequest {
+  string userId = 1;
+  string roomId = 2;
+  string type = 3;
+  optional string content = 4;
+  optional string replyToId = 5;
+  optional string storageKey = 6;
+  optional string mimeType = 7;
+  optional string metadataJson = 8;
+  optional PollPayload poll = 9;
+}
+
+message PollPayload {
+  string question = 1;
+  repeated string options = 2;
+  bool allowsMultiple = 3;
+  bool isAnonymous = 4;
+}
+
+message VotePollRequest {
+  string userId = 1;
+  string messageId = 2;
+  repeated string optionIds = 3;
+}
+
+message SetRoomNotificationsMutedRequest {
+  string userId = 1;
+  string roomId = 2;
+  bool muted = 3;
+}
+
+message ChatRoomMemberResponse {
+  string id = 1;
+  string userId = 2;
+  string displayName = 3;
+  bool hasAvatar = 4;
+  bool notificationsMuted = 5;
+}
+
+message ChatRoomResponse {
+  string id = 1;
+  string groupId = 2;
+  string type = 3;
+  string name = 4;
+  bool hasAvatar = 5;
+  string updatedAt = 6;
+  repeated ChatRoomMemberResponse members = 7;
+  optional ChatMessageResponse lastMessage = 8;
+}
+
+message PollOptionResponse {
+  string id = 1;
+  string text = 2;
+  int32 voteCount = 3;
+  bool votedByMe = 4;
+}
+
+message PollResponse {
+  string id = 1;
+  string question = 2;
+  bool allowsMultiple = 3;
+  bool isAnonymous = 4;
+  optional string closedAt = 5;
+  repeated PollOptionResponse options = 6;
+}
+
+message ChatMessageResponse {
+  string id = 1;
+  string roomId = 2;
+  string senderId = 3;
+  string senderName = 4;
+  bool senderHasAvatar = 5;
+  string type = 6;
+  optional string content = 7;
+  optional string replyToId = 8;
+  optional string storageKey = 9;
+  optional string mimeType = 10;
+  optional string metadataJson = 11;
+  string createdAt = 12;
+  optional PollResponse poll = 13;
+}
+
+message ListRoomsResponse {
+  repeated ChatRoomResponse rooms = 1;
+}
+
+message ListMessagesResponse {
+  repeated ChatMessageResponse messages = 1;
+}
+
+message MutationResponse {
+  int32 count = 1;
+}

shared/proto/documents.proto

@@ -0,0 +1,58 @@
+syntax = "proto3";
+
+package documents;
+
+service DocumentsService {
+  rpc CreateDocument (CreateDocumentRequest) returns (UserDocument);
+  rpc ListDocuments (ListDocumentsRequest) returns (ListDocumentsResponse);
+  rpc GetDocument (DocumentIdRequest) returns (UserDocument);
+  rpc UpdateDocument (UpdateDocumentRequest) returns (UserDocument);
+  rpc DeleteDocument (DocumentIdRequest) returns (MutationResponse);
+}
+
+message CreateDocumentRequest {
+  string userId = 1;
+  string type = 2;
+  string number = 3;
+  optional string issuedAt = 4;
+  optional string expiresAt = 5;
+  optional string metadataJson = 6;
+}
+
+message UpdateDocumentRequest {
+  string documentId = 1;
+  string userId = 2;
+  optional string number = 3;
+  optional string issuedAt = 4;
+  optional string expiresAt = 5;
+  optional string metadataJson = 6;
+}
+
+message ListDocumentsRequest {
+  string userId = 1;
+}
+
+message DocumentIdRequest {
+  string documentId = 1;
+  string userId = 2;
+}
+
+message UserDocument {
+  string id = 1;
+  string userId = 2;
+  string type = 3;
+  string number = 4;
+  optional string issuedAt = 5;
+  optional string expiresAt = 6;
+  optional string metadataJson = 7;
+  string createdAt = 8;
+  string updatedAt = 9;
+}
+
+message ListDocumentsResponse {
+  repeated UserDocument documents = 1;
+}
+
+message MutationResponse {
+  int32 count = 1;
+}

shared/proto/identity.proto

@@ -0,0 +1,230 @@
+syntax = "proto3";
+
+package identity;
+
+service OAuthCoreService {
+  rpc Authorize (AuthorizeRequest) returns (AuthorizeResponse);
+  rpc Token (TokenRequest) returns (TokenResponse);
+  rpc UserInfo (UserInfoRequest) returns (UserInfoResponse);
+}
+
+service OtpService {
+  rpc SendOtp (SendOtpRequest) returns (OtpResponse);
+  rpc VerifyOtp (VerifyOtpRequest) returns (OtpVerifyResponse);
+}
+
+service AdvancedAuthService {
+  rpc CreateWebAuthnRegistrationChallenge (WebAuthnRequest) returns (ChallengeResponse);
+  rpc CreateWebAuthnLoginChallenge (WebAuthnRequest) returns (ChallengeResponse);
+  rpc CreateQrSession (QrSessionRequest) returns (QrSessionResponse);
+  rpc PollQrSession (QrPollRequest) returns (QrSessionResponse);
+}
+
+service FamilyService {
+  rpc CreateFamilyGroup (CreateFamilyGroupRequest) returns (FamilyGroupResponse);
+  rpc ListFamilyGroups (UserIdRequest) returns (ListFamilyGroupsResponse);
+  rpc GetFamilyGroup (GetFamilyGroupRequest) returns (FamilyGroupResponse);
+  rpc UpdateFamilyGroup (UpdateFamilyGroupRequest) returns (FamilyGroupResponse);
+  rpc DeleteFamilyGroup (DeleteFamilyGroupRequest) returns (MutationResponse);
+  rpc AddFamilyMember (FamilyMemberRequest) returns (FamilyMemberResponse);
+  rpc RemoveFamilyMember (RemoveFamilyMemberRequest) returns (MutationResponse);
+  rpc SendFamilyInvite (SendFamilyInviteRequest) returns (FamilyInviteResponse);
+  rpc RespondFamilyInvite (RespondFamilyInviteRequest) returns (FamilyInviteResponse);
+  rpc ListFamilyInvites (ListFamilyInvitesRequest) returns (ListFamilyInvitesResponse);
+}
+
+message AuthorizeRequest {
+  string userId = 1;
+  string clientId = 2;
+  string redirectUri = 3;
+  string scope = 4;
+  optional string state = 5;
+}
+
+message AuthorizeResponse {
+  string redirectUrl = 1;
+  string code = 2;
+  optional string state = 3;
+}
+
+message TokenRequest {
+  string grantType = 1;
+  optional string code = 2;
+  optional string refreshToken = 3;
+  string clientId = 4;
+  optional string clientSecret = 5;
+  optional string redirectUri = 6;
+}
+
+message TokenResponse {
+  string accessToken = 1;
+  string tokenType = 2;
+  int32 expiresIn = 3;
+  string refreshToken = 4;
+  string idToken = 5;
+}
+
+message UserInfoRequest {
+  string accessToken = 1;
+}
+
+message UserInfoResponse {
+  string sub = 1;
+  optional string email = 2;
+  optional string phone = 3;
+  string name = 4;
+  optional string picture = 5;
+}
+
+message SendOtpRequest {
+  string target = 1;
+  string channel = 2;
+  string purpose = 3;
+  optional string userId = 4;
+}
+
+message VerifyOtpRequest {
+  string target = 1;
+  string code = 2;
+  string purpose = 3;
+}
+
+message OtpResponse {
+  bool sent = 1;
+  string expiresAt = 2;
+}
+
+message OtpVerifyResponse {
+  bool verified = 1;
+}
+
+message WebAuthnRequest {
+  string userId = 1;
+}
+
+message ChallengeResponse {
+  string challengeId = 1;
+  string challenge = 2;
+  string expiresAt = 3;
+}
+
+message QrSessionRequest {
+  string deviceName = 1;
+}
+
+message QrPollRequest {
+  string sessionId = 1;
+}
+
+message QrSessionResponse {
+  string sessionId = 1;
+  string status = 2;
+  string expiresAt = 3;
+}
+
+message UserIdRequest {
+  string userId = 1;
+}
+
+message CreateFamilyGroupRequest {
+  string ownerId = 1;
+  string name = 2;
+}
+
+message UpdateFamilyGroupRequest {
+  string requesterId = 1;
+  string groupId = 2;
+  string name = 3;
+}
+
+message DeleteFamilyGroupRequest {
+  string requesterId = 1;
+  string groupId = 2;
+}
+
+message GetFamilyGroupRequest {
+  string requesterId = 1;
+  string groupId = 2;
+}
+
+message RemoveFamilyMemberRequest {
+  string requesterId = 1;
+  string memberId = 2;
+}
+
+message SendFamilyInviteRequest {
+  string requesterId = 1;
+  string groupId = 2;
+  string target = 3;
+}
+
+message RespondFamilyInviteRequest {
+  string userId = 1;
+  string inviteId = 2;
+  bool accept = 3;
+}
+
+message ListFamilyInvitesRequest {
+  string userId = 1;
+  optional string groupId = 2;
+}
+
+message FamilyInviteResponse {
+  string id = 1;
+  string groupId = 2;
+  string groupName = 3;
+  string inviterId = 4;
+  string inviterName = 5;
+  optional string inviteeUserId = 6;
+  optional string targetEmail = 7;
+  optional string targetPhone = 8;
+  string status = 9;
+  string expiresAt = 10;
+  string createdAt = 11;
+}
+
+message ListFamilyInvitesResponse {
+  repeated FamilyInviteResponse invites = 1;
+}
+
+message FamilyGroupIdRequest {
+  string groupId = 1;
+}
+
+message FamilyMemberRequest {
+  string groupId = 1;
+  string userId = 2;
+  string role = 3;
+}
+
+message FamilyMemberIdRequest {
+  string memberId = 1;
+}
+
+message FamilyMemberResponse {
+  string id = 1;
+  string groupId = 2;
+  string userId = 3;
+  string role = 4;
+  string displayName = 5;
+  bool hasAvatar = 6;
+  string createdAt = 7;
+}
+
+message FamilyGroupResponse {
+  string id = 1;
+  string ownerId = 2;
+  string name = 3;
+  bool hasAvatar = 4;
+  string createdAt = 5;
+  string updatedAt = 6;
+  repeated FamilyMemberResponse members = 7;
+}
+
+message ListFamilyGroupsResponse {
+  repeated FamilyGroupResponse groups = 1;
+}
+
+message MutationResponse {
+  int32 count = 1;
+}

shared/proto/media.proto

@@ -0,0 +1,106 @@
+syntax = "proto3";
+
+package media;
+
+service MediaService {
+  rpc CreateAvatarUploadUrl (AvatarUploadRequest) returns (PresignedUploadResponse);
+  rpc ConfirmAvatar (ConfirmAvatarRequest) returns (AvatarResponse);
+  rpc GetAvatarAccessUrl (AvatarAccessRequest) returns (MediaAccessResponse);
+  rpc CreateDocumentPhotoUploadUrl (DocumentPhotoUploadRequest) returns (PresignedUploadResponse);
+  rpc GetDocumentPhotoAccessUrl (DocumentPhotoAccessRequest) returns (MediaAccessResponse);
+  rpc ResolveStreamToken (StreamTokenRequest) returns (StreamTokenResponse);
+  rpc CreateFamilyAvatarUploadUrl (FamilyAvatarUploadRequest) returns (PresignedUploadResponse);
+  rpc ConfirmFamilyAvatar (ConfirmFamilyAvatarRequest) returns (FamilyAvatarResponse);
+  rpc GetFamilyAvatarAccessUrl (FamilyAvatarAccessRequest) returns (MediaAccessResponse);
+  rpc CreateChatMediaUploadUrl (ChatMediaUploadRequest) returns (PresignedUploadResponse);
+  rpc GetChatMediaAccessUrl (ChatMediaAccessRequest) returns (MediaAccessResponse);
+}
+
+message AvatarUploadRequest {
+  string userId = 1;
+  string contentType = 2;
+}
+
+message ConfirmAvatarRequest {
+  string userId = 1;
+  string storageKey = 2;
+}
+
+message AvatarAccessRequest {
+  string requesterId = 1;
+  string targetUserId = 2;
+}
+
+message DocumentPhotoUploadRequest {
+  string userId = 1;
+  string documentId = 2;
+  string contentType = 3;
+}
+
+message DocumentPhotoAccessRequest {
+  string requesterId = 1;
+  string targetUserId = 2;
+  string storageKey = 3;
+}
+
+message PresignedUploadResponse {
+  string uploadUrl = 1;
+  string storageKey = 2;
+  string expiresAt = 3;
+}
+
+message AvatarResponse {
+  string userId = 1;
+  bool hasAvatar = 2;
+}
+
+message MediaAccessResponse {
+  string accessUrl = 1;
+  string expiresAt = 2;
+}
+
+message StreamTokenRequest {
+  string token = 1;
+  optional string requesterId = 2;
+}
+
+message StreamTokenResponse {
+  string storageKey = 1;
+  string contentType = 2;
+  optional string fileName = 3;
+}
+
+message FamilyAvatarUploadRequest {
+  string requesterId = 1;
+  string groupId = 2;
+  string contentType = 3;
+}
+
+message ConfirmFamilyAvatarRequest {
+  string requesterId = 1;
+  string groupId = 2;
+  string storageKey = 3;
+}
+
+message FamilyAvatarAccessRequest {
+  string requesterId = 1;
+  string groupId = 2;
+}
+
+message FamilyAvatarResponse {
+  string groupId = 1;
+  bool hasAvatar = 2;
+}
+
+message ChatMediaUploadRequest {
+  string requesterId = 1;
+  string roomId = 2;
+  string contentType = 3;
+}
+
+message ChatMediaAccessRequest {
+  string requesterId = 1;
+  string roomId = 2;
+  string storageKey = 3;
+  optional string fileName = 4;
+}

shared/proto/notifications.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+package notifications;
+
+service NotificationsService {
+  rpc ListNotifications (ListNotificationsRequest) returns (ListNotificationsResponse);
+  rpc GetUnreadCount (UserIdRequest) returns (UnreadCountResponse);
+  rpc DeleteNotification (MarkNotificationReadRequest) returns (MutationResponse);
+  rpc DeleteAllNotifications (UserIdRequest) returns (MutationResponse);
+  rpc MarkNotificationRead (MarkNotificationReadRequest) returns (MutationResponse);
+  rpc MarkAllNotificationsRead (UserIdRequest) returns (MutationResponse);
+}
+
+message UserIdRequest {
+  string userId = 1;
+}
+
+message ListNotificationsRequest {
+  string userId = 1;
+  int32 limit = 2;
+  optional bool unreadOnly = 3;
+}
+
+message NotificationResponse {
+  string id = 1;
+  string userId = 2;
+  string type = 3;
+  string title = 4;
+  string message = 5;
+  string payloadJson = 6;
+  bool isRead = 7;
+  string createdAt = 8;
+}
+
+message ListNotificationsResponse {
+  repeated NotificationResponse notifications = 1;
+}
+
+message UnreadCountResponse {
+  int32 count = 1;
+}
+
+message MarkNotificationReadRequest {
+  string userId = 1;
+  string notificationId = 2;
+}
+
+message MutationResponse {
+  int32 count = 1;
+}

shared/proto/profile.proto

@@ -0,0 +1,69 @@
+syntax = "proto3";
+
+package profile;
+
+service ProfileService {
+  rpc GetProfile (UserProfileRequest) returns (ProfileResponse);
+  rpc UpdateAvatar (UpdateAvatarRequest) returns (ProfileResponse);
+  rpc UpdateProfile (UpdateProfileRequest) returns (ProfileResponse);
+  rpc UpdateContacts (UpdateContactsRequest) returns (ProfileResponse);
+  rpc SetPassword (SetPasswordRequest) returns (SetPasswordResponse);
+  rpc SoftDeleteProfile (UserProfileRequest) returns (SoftDeleteProfileResponse);
+}
+
+message SetPasswordRequest {
+  string userId = 1;
+  string password = 2;
+}
+
+message SetPasswordResponse {
+  bool hasPassword = 1;
+}
+
+message UserProfileRequest {
+  string userId = 1;
+}
+
+message UpdateAvatarRequest {
+  string userId = 1;
+  optional string avatarUrl = 2;
+  optional string avatarStorageKey = 3;
+}
+
+message UpdateProfileRequest {
+  string userId = 1;
+  optional string firstName = 2;
+  optional string lastName = 3;
+  optional string bio = 4;
+  optional int32 age = 5;
+  optional string gender = 6;
+}
+
+message UpdateContactsRequest {
+  string userId = 1;
+  optional string email = 2;
+  optional string phone = 3;
+  optional string backupEmail = 4;
+  optional string backupPhone = 5;
+}
+
+message ProfileResponse {
+  string id = 1;
+  string userId = 2;
+  string displayName = 3;
+  optional string avatarUrl = 4;
+  optional bool hasAvatar = 14;
+  optional string firstName = 5;
+  optional string lastName = 6;
+  optional string bio = 7;
+  optional int32 age = 8;
+  optional string gender = 9;
+  optional string email = 10;
+  optional string phone = 11;
+  optional string backupEmail = 12;
+  optional string backupPhone = 13;
+}
+
+message SoftDeleteProfileResponse {
+  bool success = 1;
+}

shared/proto/rbac.proto

@@ -0,0 +1,129 @@
+syntax = "proto3";
+
+package rbac;
+
+service RbacService {
+  rpc ListRoles (Empty) returns (ListRolesResponse);
+  rpc ListPermissions (Empty) returns (ListPermissionsResponse);
+  rpc ListOAuthScopes (Empty) returns (ListOAuthScopesResponse);
+  rpc ListOAuthClients (Empty) returns (ListOAuthClientsResponse);
+  rpc CreateRole (CreateRoleRequest) returns (Role);
+  rpc AssignUserRole (AssignUserRoleRequest) returns (AssignUserRoleResponse);
+  rpc RemoveUserRole (RemoveUserRoleRequest) returns (Empty);
+  rpc CreateOAuthClient (CreateOAuthClientRequest) returns (OAuthClientDetail);
+  rpc UpdateOAuthClient (UpdateOAuthClientRequest) returns (OAuthClientDetail);
+  rpc RotateOAuthSecret (RotateOAuthSecretRequest) returns (RotateOAuthSecretResponse);
+}
+
+message Empty {}
+
+message Permission {
+  string id = 1;
+  string slug = 2;
+  string name = 3;
+  optional string description = 4;
+}
+
+message Role {
+  string id = 1;
+  string slug = 2;
+  string name = 3;
+  optional string description = 4;
+  repeated Permission permissions = 5;
+}
+
+message OAuthScope {
+  string id = 1;
+  string slug = 2;
+  string name = 3;
+  optional string description = 4;
+}
+
+message OAuthClient {
+  string id = 1;
+  string name = 2;
+  string clientId = 3;
+  repeated string redirectUris = 4;
+  repeated string scopes = 5;
+  bool isActive = 6;
+  string type = 7;
+}
+
+message OAuthClientDetail {
+  string id = 1;
+  string name = 2;
+  string clientId = 3;
+  repeated string redirectUris = 4;
+  repeated string scopes = 5;
+  bool isActive = 6;
+  string type = 7;
+  optional string clientSecret = 8;
+}
+
+message ListRolesResponse {
+  repeated Role roles = 1;
+}
+
+message ListPermissionsResponse {
+  repeated Permission permissions = 1;
+}
+
+message ListOAuthScopesResponse {
+  repeated OAuthScope scopes = 1;
+}
+
+message ListOAuthClientsResponse {
+  repeated OAuthClient clients = 1;
+}
+
+message CreateRoleRequest {
+  string actorUserId = 1;
+  string slug = 2;
+  string name = 3;
+  optional string description = 4;
+  repeated string permissionSlugs = 5;
+}
+
+message AssignUserRoleRequest {
+  string actorUserId = 1;
+  string userId = 2;
+  string roleSlug = 3;
+}
+
+message AssignUserRoleResponse {
+  string userId = 1;
+  repeated string roles = 2;
+}
+
+message RemoveUserRoleRequest {
+  string actorUserId = 1;
+  string userId = 2;
+  string roleSlug = 3;
+}
+
+message CreateOAuthClientRequest {
+  string actorUserId = 1;
+  string name = 2;
+  repeated string redirectUris = 3;
+  repeated string scopes = 4;
+  optional string type = 5;
+}
+
+message UpdateOAuthClientRequest {
+  string actorUserId = 1;
+  string clientId = 2;
+  optional string name = 3;
+  repeated string redirectUris = 4;
+  repeated string scopes = 5;
+  optional bool isActive = 6;
+}
+
+message RotateOAuthSecretRequest {
+  string actorUserId = 1;
+  string clientId = 2;
+}
+
+message RotateOAuthSecretResponse {
+  string clientId = 1;
+  string clientSecret = 2;
+}

shared/proto/security.proto

@@ -0,0 +1,218 @@
+syntax = "proto3";
+
+package security;
+
+service SecurityService {
+  rpc ListActiveDevices (UserSecurityRequest) returns (ListDevicesResponse);
+  rpc ListActiveSessions (UserSecurityRequest) returns (ListSessionsResponse);
+  rpc ListSignInHistory (UserSecurityRequest) returns (ListSignInHistoryResponse);
+  rpc LockSession (SessionActionRequest) returns (Session);
+  rpc RevokeSession (SessionActionRequest) returns (Session);
+  rpc RevokeDevice (DeviceActionRequest) returns (RevokeSessionsResponse);
+  rpc RevokeAllSessions (UserSecurityRequest) returns (RevokeSessionsResponse);
+  rpc SetupPin (PinRequest) returns (PinStatusResponse);
+  rpc UpdatePin (PinRequest) returns (PinStatusResponse);
+  rpc RequestPinDeletion (PinRequest) returns (PinDeletionScheduleResponse);
+  rpc CancelPinDeletion (UserSecurityRequest) returns (PinDeletionCancelResponse);
+  rpc VerifyPinCode (VerifyPinCodeRequest) returns (PinVerificationResponse);
+  rpc ConnectLinkedAccount (ConnectLinkedAccountRequest) returns (LinkedAccount);
+  rpc DisconnectLinkedAccount (DisconnectLinkedAccountRequest) returns (MutationCountResponse);
+  rpc ListLinkedAccounts (UserSecurityRequest) returns (ListLinkedAccountsResponse);
+}
+
+service SettingsService {
+  rpc ListSettings (Empty) returns (ListSettingsResponse);
+  rpc ListPublicSettings (Empty) returns (ListPublicSettingsResponse);
+  rpc GetSetting (SettingKeyRequest) returns (SystemSetting);
+  rpc UpsertSetting (UpsertSettingRequest) returns (SystemSetting);
+  rpc DeleteSetting (SettingKeyRequest) returns (MutationCountResponse);
+  rpc ListSocialProviders (Empty) returns (ListSocialProvidersResponse);
+  rpc UpsertSocialProvider (UpsertSocialProviderRequest) returns (SocialProvider);
+  rpc DeleteSocialProvider (ProviderNameRequest) returns (MutationCountResponse);
+}
+
+message Empty {}
+
+message UserSecurityRequest {
+  string userId = 1;
+}
+
+message Device {
+  string id = 1;
+  string name = 2;
+  string type = 3;
+  optional string lastIp = 4;
+  string lastSeenAt = 5;
+  bool trusted = 6;
+}
+
+message SignInEvent {
+  string id = 1;
+  bool success = 2;
+  optional string reason = 3;
+  optional string ipAddress = 4;
+  optional string userAgent = 5;
+  string createdAt = 6;
+}
+
+message Session {
+  string id = 1;
+  string userId = 2;
+  optional string deviceId = 3;
+  bool pinVerified = 4;
+  string status = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+  string expiresAt = 8;
+  string createdAt = 9;
+  string updatedAt = 10;
+}
+
+message SessionActionRequest {
+  string userId = 1;
+  string sessionId = 2;
+}
+
+message DeviceActionRequest {
+  string userId = 1;
+  string deviceId = 2;
+}
+
+message PinRequest {
+  string userId = 1;
+  string pin = 2;
+}
+
+message VerifyPinCodeRequest {
+  string sessionId = 1;
+  string pin = 2;
+}
+
+message PinStatusResponse {
+  string userId = 1;
+  bool isEnabled = 2;
+}
+
+message PinVerificationResponse {
+  string accessToken = 1;
+  bool pinVerified = 2;
+}
+
+message SystemSetting {
+  string id = 1;
+  string key = 2;
+  string value = 3;
+  optional string description = 4;
+  bool isSecret = 5;
+}
+
+message UpsertSettingRequest {
+  string key = 1;
+  string value = 2;
+  optional string description = 3;
+  optional bool isSecret = 4;
+}
+
+message SettingKeyRequest {
+  string key = 1;
+}
+
+message LinkedAccount {
+  string id = 1;
+  string userId = 2;
+  string providerName = 3;
+  string providerId = 4;
+  optional string email = 5;
+  optional string displayName = 6;
+  optional string avatarUrl = 7;
+  string createdAt = 8;
+  string updatedAt = 9;
+}
+
+message ConnectLinkedAccountRequest {
+  string userId = 1;
+  string providerName = 2;
+  string providerId = 3;
+  optional string email = 4;
+  optional string displayName = 5;
+  optional string avatarUrl = 6;
+}
+
+message DisconnectLinkedAccountRequest {
+  string userId = 1;
+  string providerName = 2;
+}
+
+message SocialProvider {
+  string id = 1;
+  string providerName = 2;
+  string clientId = 3;
+  optional string clientSecret = 4;
+  bool isEnabled = 5;
+  string createdAt = 6;
+  string updatedAt = 7;
+}
+
+message UpsertSocialProviderRequest {
+  string providerName = 1;
+  string clientId = 2;
+  optional string clientSecret = 3;
+  bool isEnabled = 4;
+}
+
+message ProviderNameRequest {
+  string providerName = 1;
+}
+
+message ListDevicesResponse {
+  repeated Device devices = 1;
+}
+
+message ListSignInHistoryResponse {
+  repeated SignInEvent events = 1;
+}
+
+message ListSessionsResponse {
+  repeated Session sessions = 1;
+}
+
+message RevokeSessionsResponse {
+  int32 count = 1;
+}
+
+message ListSettingsResponse {
+  repeated SystemSetting settings = 1;
+}
+
+message ListLinkedAccountsResponse {
+  repeated LinkedAccount accounts = 1;
+}
+
+message ListSocialProvidersResponse {
+  repeated SocialProvider providers = 1;
+}
+
+message PinDeletionScheduleResponse {
+  string userId = 1;
+  string deletionRequestedAt = 2;
+  string effectiveAt = 3;
+  int32 graceMinutes = 4;
+}
+
+message PinDeletionCancelResponse {
+  string userId = 1;
+  bool cancelled = 2;
+}
+
+message PublicSetting {
+  string key = 1;
+  string value = 2;
+}
+
+message ListPublicSettingsResponse {
+  repeated PublicSetting settings = 1;
+}
+
+message MutationCountResponse {
+  int32 count = 1;
+}