syntax = "proto3";

package security;

service SecurityService {
  rpc ListActiveDevices (UserSecurityRequest) returns (ListDevicesResponse);
  rpc ListActiveSessions (UserSecurityRequest) returns (ListSessionsResponse);
  rpc ListSignInHistory (UserSecurityRequest) returns (ListSignInHistoryResponse);
  rpc LockSession (SessionActionRequest) returns (Session);
  rpc RevokeSession (SessionActionRequest) returns (Session);
  rpc RevokeDevice (DeviceActionRequest) returns (RevokeSessionsResponse);
  rpc RevokeAllSessions (UserSecurityRequest) returns (RevokeSessionsResponse);
  rpc SetupPin (PinRequest) returns (PinStatusResponse);
  rpc UpdatePin (PinRequest) returns (PinStatusResponse);
  rpc RequestPinDeletion (PinRequest) returns (PinDeletionScheduleResponse);
  rpc CancelPinDeletion (UserSecurityRequest) returns (PinDeletionCancelResponse);
  rpc VerifyPinCode (VerifyPinCodeRequest) returns (PinVerificationResponse);
  rpc ConnectLinkedAccount (ConnectLinkedAccountRequest) returns (LinkedAccount);
  rpc DisconnectLinkedAccount (DisconnectLinkedAccountRequest) returns (MutationCountResponse);
  rpc ListLinkedAccounts (UserSecurityRequest) returns (ListLinkedAccountsResponse);
  rpc GetTotpStatus (UserSecurityRequest) returns (TotpStatusResponse);
  rpc SetupTotp (UserSecurityRequest) returns (TotpSetupResponse);
  rpc EnableTotp (TotpCodeRequest) returns (TotpStatusResponse);
  rpc DisableTotp (TotpCodeRequest) returns (TotpStatusResponse);
}

service SettingsService {
  rpc ListSettings (Empty) returns (ListSettingsResponse);
  rpc ListPublicSettings (Empty) returns (ListPublicSettingsResponse);
  rpc GetSetting (SettingKeyRequest) returns (SystemSetting);
  rpc UpsertSetting (UpsertSettingRequest) returns (SystemSetting);
  rpc DeleteSetting (SettingKeyRequest) returns (MutationCountResponse);
  rpc ListSocialProviders (Empty) returns (ListSocialProvidersResponse);
  rpc UpsertSocialProvider (UpsertSocialProviderRequest) returns (SocialProvider);
  rpc DeleteSocialProvider (ProviderNameRequest) returns (MutationCountResponse);
  rpc TestMessagingDelivery (TestMessagingDeliveryRequest) returns (TestMessagingDeliveryResponse);
}

message Empty {}

message UserSecurityRequest {
  string userId = 1;
  optional string exceptSessionId = 2;
}

message Device {
  string id = 1;
  string name = 2;
  string type = 3;
  optional string lastIp = 4;
  string lastSeenAt = 5;
  bool trusted = 6;
}

message SignInEvent {
  string id = 1;
  bool success = 2;
  optional string reason = 3;
  optional string ipAddress = 4;
  optional string userAgent = 5;
  string createdAt = 6;
}

message Session {
  string id = 1;
  string userId = 2;
  optional string deviceId = 3;
  bool pinVerified = 4;
  string status = 5;
  optional string ipAddress = 6;
  optional string userAgent = 7;
  string expiresAt = 8;
  string createdAt = 9;
  string updatedAt = 10;
}

message SessionActionRequest {
  string userId = 1;
  string sessionId = 2;
}

message DeviceActionRequest {
  string userId = 1;
  string deviceId = 2;
}

message PinRequest {
  string userId = 1;
  string pin = 2;
}

message VerifyPinCodeRequest {
  string sessionId = 1;
  string pin = 2;
}

message PinStatusResponse {
  string userId = 1;
  bool isEnabled = 2;
}

message PinVerificationResponse {
  string accessToken = 1;
  bool pinVerified = 2;
}

message SystemSetting {
  string id = 1;
  string key = 2;
  string value = 3;
  optional string description = 4;
  bool isSecret = 5;
}

message UpsertSettingRequest {
  string key = 1;
  string value = 2;
  optional string description = 3;
  optional bool isSecret = 4;
}

message SettingKeyRequest {
  string key = 1;
}

message LinkedAccount {
  string id = 1;
  string userId = 2;
  string providerName = 3;
  string providerId = 4;
  optional string email = 5;
  optional string displayName = 6;
  optional string avatarUrl = 7;
  string createdAt = 8;
  string updatedAt = 9;
}

message ConnectLinkedAccountRequest {
  string userId = 1;
  string providerName = 2;
  string providerId = 3;
  optional string email = 4;
  optional string displayName = 5;
  optional string avatarUrl = 6;
}

message DisconnectLinkedAccountRequest {
  string userId = 1;
  string providerName = 2;
}

message SocialProvider {
  string id = 1;
  string providerName = 2;
  string clientId = 3;
  optional string clientSecret = 4;
  bool isEnabled = 5;
  string createdAt = 6;
  string updatedAt = 7;
}

message UpsertSocialProviderRequest {
  string providerName = 1;
  string clientId = 2;
  optional string clientSecret = 3;
  bool isEnabled = 4;
}

message ProviderNameRequest {
  string providerName = 1;
}

message ListDevicesResponse {
  repeated Device devices = 1;
}

message ListSignInHistoryResponse {
  repeated SignInEvent events = 1;
}

message ListSessionsResponse {
  repeated Session sessions = 1;
}

message RevokeSessionsResponse {
  int32 count = 1;
}

message ListSettingsResponse {
  repeated SystemSetting settings = 1;
}

message ListLinkedAccountsResponse {
  repeated LinkedAccount accounts = 1;
}

message ListSocialProvidersResponse {
  repeated SocialProvider providers = 1;
}

message PinDeletionScheduleResponse {
  string userId = 1;
  string deletionRequestedAt = 2;
  string effectiveAt = 3;
  int32 graceMinutes = 4;
}

message PinDeletionCancelResponse {
  string userId = 1;
  bool cancelled = 2;
}

message PublicSetting {
  string key = 1;
  string value = 2;
}

message ListPublicSettingsResponse {
  repeated PublicSetting settings = 1;
}

message MutationCountResponse {
  int32 count = 1;
}

message TestMessagingDeliveryRequest {
  string channel = 1;
  string target = 2;
}

message TestMessagingDeliveryResponse {
  bool sent = 1;
  string channel = 2;
  string target = 3;
  optional string message = 4;
}

message TotpStatusResponse {
  bool isEnabled = 1;
}

message TotpSetupResponse {
  string secret = 1;
  string otpauthUrl = 2;
}

message TotpCodeRequest {
  string userId = 1;
  string code = 2;
}