first commit

shared/proto/auth.proto

@@ -0,0 +1,171 @@
+syntax = "proto3";
+
+package auth;
+
+service AuthService {
+  rpc Register (RegisterRequest) returns (PublicUser);
+  rpc Login (LoginRequest) returns (AuthTokens);
+  rpc Identify (IdentifyRequest) returns (IdentifyResponse);
+  rpc SendOtp (PasswordlessOtpRequest) returns (PasswordlessOtpResponse);
+  rpc VerifyOtp (PasswordlessVerifyRequest) returns (PasswordlessAuthResponse);
+  rpc LoginWithPassword (PasswordLoginRequest) returns (AuthTokens);
+  rpc LoginWithLdap (LdapLoginRequest) returns (AuthTokens);
+  rpc VerifyPin (VerifyPinRequest) returns (PinVerificationResponse);
+  rpc GetMe (GetMeRequest) returns (PublicUser);
+  rpc RefreshSession (RefreshSessionRequest) returns (RefreshSessionResponse);
+  rpc ValidateSession (ValidateSessionRequest) returns (ValidateSessionResponse);
+}
+
+message RegisterRequest {
+  optional string email = 1;
+  optional string phone = 2;
+  string password = 3;
+  string displayName = 4;
+  optional string username = 5;
+}
+
+message LoginRequest {
+  string login = 1;
+  string password = 2;
+  optional string deviceName = 3;
+  optional string deviceType = 4;
+  string fingerprint = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+}
+
+message IdentifyRequest {
+  string login = 1;
+}
+
+message IdentifyResponse {
+  bool exists = 1;
+  bool hasPassword = 2;
+  bool isPinEnabled = 3;
+  repeated LoginMethod methods = 4;
+}
+
+message LoginMethod {
+  string kind = 1;
+  string channel = 2;
+  string masked = 3;
+}
+
+message PasswordlessOtpRequest {
+  string recipient = 1;
+  optional string channel = 2;
+}
+
+message PasswordlessOtpResponse {
+  bool sent = 1;
+  string expiresAt = 2;
+  string maskedTarget = 3;
+}
+
+message PasswordlessVerifyRequest {
+  string recipient = 1;
+  string code = 2;
+  string fingerprint = 3;
+  optional string deviceName = 4;
+  optional string deviceType = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+}
+
+message PasswordlessAuthResponse {
+  bool requiresPassword = 1;
+  optional string tempAuthToken = 2;
+  optional AuthTokens auth = 3;
+}
+
+message PasswordLoginRequest {
+  optional string tempAuthToken = 1;
+  string password = 2;
+  string fingerprint = 3;
+  optional string deviceName = 4;
+  optional string deviceType = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+  optional string login = 8;
+}
+
+message LdapLoginRequest {
+  string username = 1;
+  string password = 2;
+  string fingerprint = 3;
+  optional string deviceName = 4;
+  optional string deviceType = 5;
+  optional string ipAddress = 6;
+  optional string userAgent = 7;
+}
+
+message VerifyPinRequest {
+  string sessionId = 1;
+  string pin = 2;
+}
+
+message GetMeRequest {
+  string userId = 1;
+}
+
+message RefreshSessionRequest {
+  string refreshToken = 1;
+  optional string sessionId = 2;
+}
+
+message RefreshSessionResponse {
+  bool requiresPin = 1;
+  optional string accessToken = 2;
+  optional string sessionId = 3;
+  bool pinVerified = 4;
+  optional PublicUser user = 5;
+}
+
+message ValidateSessionRequest {
+  string userId = 1;
+  string sessionId = 2;
+  bool touchActivity = 3;
+}
+
+message ValidateSessionResponse {
+  bool requiresPin = 1;
+  string sessionId = 2;
+  bool pinVerified = 3;
+}
+
+message PublicUser {
+  string id = 1;
+  optional string email = 2;
+  optional string phone = 3;
+  optional string backupEmail = 4;
+  optional string backupPhone = 5;
+  string displayName = 6;
+  optional string username = 7;
+  optional string avatarUrl = 8;
+  optional bool hasAvatar = 11;
+  bool isSuperAdmin = 9;
+  string status = 10;
+  repeated string roles = 12;
+  repeated string permissions = 13;
+  bool canAccessAdmin = 14;
+  bool canManageRoles = 15;
+  bool canManageOAuth = 16;
+  bool canManageUsers = 17;
+  bool canManageSettings = 18;
+  bool canViewUsers = 19;
+  bool canViewUserDocuments = 20;
+}
+
+message AuthTokens {
+  string accessToken = 1;
+  string refreshToken = 2;
+  string expiresAt = 3;
+  bool pinVerified = 4;
+  PublicUser user = 5;
+  string sessionId = 6;
+}
+
+message PinVerificationResponse {
+  string accessToken = 1;
+  bool pinVerified = 2;
+}