syntax = "proto3";

package auth;

service AuthService {
  rpc Register (RegisterRequest) returns (PublicUser);
  rpc Login (LoginRequest) returns (AuthTokens);
  rpc Identify (IdentifyRequest) returns (IdentifyResponse);
  rpc SendOtp (PasswordlessOtpRequest) returns (PasswordlessOtpResponse);
  rpc VerifyOtp (PasswordlessVerifyRequest) returns (PasswordlessAuthResponse);
  rpc LoginWithPassword (PasswordLoginRequest) returns (AuthTokens);
  rpc LoginWithLdap (LdapLoginRequest) returns (AuthTokens);
  rpc VerifyTotpLogin (VerifyTotpLoginRequest) returns (AuthTokens);
  rpc BeginTotpLogin (BeginTotpLoginRequest) returns (BeginTotpLoginResponse);
  rpc VerifyPin (VerifyPinRequest) returns (PinVerificationResponse);
  rpc GetMe (GetMeRequest) returns (PublicUser);
  rpc RefreshSession (RefreshSessionRequest) returns (RefreshSessionResponse);
  rpc ValidateSession (ValidateSessionRequest) returns (ValidateSessionResponse);
}

message RegisterRequest {
  optional string email = 1;
  optional string phone = 2;
  string password = 3;
  string displayName = 4;
  optional string username = 5;
}

message LoginRequest {
  string login = 1;
  string password = 2;
  optional string deviceName = 3;
  optional string deviceType = 4;
  string fingerprint = 5;
  optional string ipAddress = 6;
  optional string userAgent = 7;
}

message IdentifyRequest {
  string login = 1;
}

message IdentifyResponse {
  bool exists = 1;
  bool hasPassword = 2;
  bool isPinEnabled = 3;
  repeated LoginMethod methods = 4;
  bool isTotpEnabled = 5;
  repeated OtpChannel otpChannels = 6;
  repeated OtpChannel otpBackupChannels = 7;
}

message OtpChannel {
  string channel = 1;
  string masked = 2;
}

message LoginMethod {
  string kind = 1;
  string channel = 2;
  string masked = 3;
}

message PasswordlessOtpRequest {
  string recipient = 1;
  optional string channel = 2;
  optional string ipAddress = 3;
}

message PasswordlessOtpResponse {
  bool sent = 1;
  string expiresAt = 2;
  string maskedTarget = 3;
  string resendAvailableAt = 4;
}

message PasswordlessVerifyRequest {
  string recipient = 1;
  string code = 2;
  string fingerprint = 3;
  optional string deviceName = 4;
  optional string deviceType = 5;
  optional string ipAddress = 6;
  optional string userAgent = 7;
}

message PasswordlessAuthResponse {
  bool requiresPassword = 1;
  optional string tempAuthToken = 2;
  optional AuthTokens auth = 3;
  bool requiresTotp = 4;
  optional string totpChallengeToken = 5;
}

message PasswordLoginRequest {
  optional string tempAuthToken = 1;
  string password = 2;
  string fingerprint = 3;
  optional string deviceName = 4;
  optional string deviceType = 5;
  optional string ipAddress = 6;
  optional string userAgent = 7;
  optional string login = 8;
}

message LdapLoginRequest {
  string username = 1;
  string password = 2;
  string fingerprint = 3;
  optional string deviceName = 4;
  optional string deviceType = 5;
  optional string ipAddress = 6;
  optional string userAgent = 7;
}

message VerifyTotpLoginRequest {
  string totpChallengeToken = 1;
  string code = 2;
}

message BeginTotpLoginRequest {
  string recipient = 1;
  string fingerprint = 2;
  optional string deviceName = 3;
  optional string deviceType = 4;
  optional string ipAddress = 5;
  optional string userAgent = 6;
}

message BeginTotpLoginResponse {
  string totpChallengeToken = 1;
}

message VerifyPinRequest {
  string sessionId = 1;
  string pin = 2;
}

message GetMeRequest {
  string userId = 1;
}

message RefreshSessionRequest {
  string refreshToken = 1;
  optional string sessionId = 2;
}

message RefreshSessionResponse {
  bool requiresPin = 1;
  optional string accessToken = 2;
  optional string sessionId = 3;
  bool pinVerified = 4;
  optional PublicUser user = 5;
}

message ValidateSessionRequest {
  string userId = 1;
  string sessionId = 2;
  bool touchActivity = 3;
}

message ValidateSessionResponse {
  bool requiresPin = 1;
  string sessionId = 2;
  bool pinVerified = 3;
}

message PublicUser {
  string id = 1;
  optional string email = 2;
  optional string phone = 3;
  optional string backupEmail = 4;
  optional string backupPhone = 5;
  string displayName = 6;
  optional string username = 7;
  optional string avatarUrl = 8;
  optional bool hasAvatar = 11;
  bool isSuperAdmin = 9;
  string status = 10;
  repeated string roles = 12;
  repeated string permissions = 13;
  bool canAccessAdmin = 14;
  bool canManageRoles = 15;
  bool canManageOAuth = 16;
  bool canManageUsers = 17;
  bool canManageSettings = 18;
  bool canViewUsers = 19;
  bool canViewUserDocuments = 20;
  bool hasPassword = 21;
  bool canViewOAuth = 22;
  bool canManageAllOAuth = 23;
  bool canManageAllUsers = 24;
  bool isVerified = 25;
  optional string verificationIcon = 26;
  bool canVerifyUsers = 27;
}

message AuthTokens {
  string accessToken = 1;
  string refreshToken = 2;
  string expiresAt = 3;
  bool pinVerified = 4;
  PublicUser user = 5;
  string sessionId = 6;
  bool requiresTotp = 7;
  optional string totpChallengeToken = 8;
}

message PinVerificationResponse {
  string accessToken = 1;
  bool pinVerified = 2;
}