@acequants/aegis-contracts 0.1.0 → 0.1.1

package/dist/src/gen/auth/v1/auth.d.ts

@@ -2,44 +2,100 @@ import type { handleUnaryCall, UntypedServiceImplementation } from "@grpc/grpc-j
 import _m0 from "protobufjs/minimal";
 import { Observable } from "rxjs";
 export declare const protobufPackage = "aegis.auth.v1";
-export interface LoginRequest {
-    username: string;
-    password: string;
+export interface AuthContext {
+    sessionId: string;
+    userId: string;
+    email: string;
+    /** string tenant_id = 4; */
+    roles: string[];
+    permissions: string[];
 }
-export interface LoginResponse {
+export interface ValidateAccessRequest {
     accessToken: string;
-    refreshToken: string;
+    ip: string;
+    userAgent: string;
+}
+export interface ValidateAccessResponse {
+    valid: boolean;
+    /** "expired", "revoked", etc. */
+    reason: string;
+    context?: AuthContext | undefined;
+}
+export interface AuthorizeRequest {
+    context?: AuthContext | undefined;
+    /** e.g. "order.read" */
+    policy: string;
+    /** resource/user attributes for ABAC */
+    attributes: {
+        [key: string]: string;
+    };
+}
+export interface AuthorizeRequest_AttributesEntry {
+    key: string;
+    value: string;
+}
+export interface AuthorizeResponse {
+    allowed: boolean;
+    reason: string;
 }
 export declare const AEGIS_AUTH_V1_PACKAGE_NAME = "aegis.auth.v1";
-export declare const LoginRequest: {
-    encode(message: LoginRequest, writer?: _m0.Writer): _m0.Writer;
-    decode(input: _m0.Reader | Uint8Array, length?: number): LoginRequest;
+export declare const AuthContext: {
+    encode(message: AuthContext, writer?: _m0.Writer): _m0.Writer;
+    decode(input: _m0.Reader | Uint8Array, length?: number): AuthContext;
+};
+export declare const ValidateAccessRequest: {
+    encode(message: ValidateAccessRequest, writer?: _m0.Writer): _m0.Writer;
+    decode(input: _m0.Reader | Uint8Array, length?: number): ValidateAccessRequest;
 };
-export declare const LoginResponse: {
-    encode(message: LoginResponse, writer?: _m0.Writer): _m0.Writer;
-    decode(input: _m0.Reader | Uint8Array, length?: number): LoginResponse;
+export declare const ValidateAccessResponse: {
+    encode(message: ValidateAccessResponse, writer?: _m0.Writer): _m0.Writer;
+    decode(input: _m0.Reader | Uint8Array, length?: number): ValidateAccessResponse;
+};
+export declare const AuthorizeRequest: {
+    encode(message: AuthorizeRequest, writer?: _m0.Writer): _m0.Writer;
+    decode(input: _m0.Reader | Uint8Array, length?: number): AuthorizeRequest;
+};
+export declare const AuthorizeRequest_AttributesEntry: {
+    encode(message: AuthorizeRequest_AttributesEntry, writer?: _m0.Writer): _m0.Writer;
+    decode(input: _m0.Reader | Uint8Array, length?: number): AuthorizeRequest_AttributesEntry;
+};
+export declare const AuthorizeResponse: {
+    encode(message: AuthorizeResponse, writer?: _m0.Writer): _m0.Writer;
+    decode(input: _m0.Reader | Uint8Array, length?: number): AuthorizeResponse;
 };
 export interface AuthServiceClient {
-    login(request: LoginRequest): Observable<LoginResponse>;
+    validateAccess(request: ValidateAccessRequest): Observable<ValidateAccessResponse>;
+    authorize(request: AuthorizeRequest): Observable<AuthorizeResponse>;
 }
 export interface AuthServiceController {
-    login(request: LoginRequest): Promise<LoginResponse> | Observable<LoginResponse> | LoginResponse;
+    validateAccess(request: ValidateAccessRequest): Promise<ValidateAccessResponse> | Observable<ValidateAccessResponse> | ValidateAccessResponse;
+    authorize(request: AuthorizeRequest): Promise<AuthorizeResponse> | Observable<AuthorizeResponse> | AuthorizeResponse;
 }
 export declare function AuthServiceControllerMethods(): (constructor: Function) => void;
 export declare const AUTH_SERVICE_NAME = "AuthService";
 export type AuthServiceService = typeof AuthServiceService;
 export declare const AuthServiceService: {
-    readonly login: {
-        readonly path: "/aegis.auth.v1.AuthService/Login";
+    readonly validateAccess: {
+        readonly path: "/aegis.auth.v1.AuthService/ValidateAccess";
+        readonly requestStream: false;
+        readonly responseStream: false;
+        readonly requestSerialize: (value: ValidateAccessRequest) => Buffer<ArrayBuffer>;
+        readonly requestDeserialize: (value: Buffer) => ValidateAccessRequest;
+        readonly responseSerialize: (value: ValidateAccessResponse) => Buffer<ArrayBuffer>;
+        readonly responseDeserialize: (value: Buffer) => ValidateAccessResponse;
+    };
+    readonly authorize: {
+        readonly path: "/aegis.auth.v1.AuthService/Authorize";
         readonly requestStream: false;
         readonly responseStream: false;
-        readonly requestSerialize: (value: LoginRequest) => Buffer<ArrayBuffer>;
-        readonly requestDeserialize: (value: Buffer) => LoginRequest;
-        readonly responseSerialize: (value: LoginResponse) => Buffer<ArrayBuffer>;
-        readonly responseDeserialize: (value: Buffer) => LoginResponse;
+        readonly requestSerialize: (value: AuthorizeRequest) => Buffer<ArrayBuffer>;
+        readonly requestDeserialize: (value: Buffer) => AuthorizeRequest;
+        readonly responseSerialize: (value: AuthorizeResponse) => Buffer<ArrayBuffer>;
+        readonly responseDeserialize: (value: Buffer) => AuthorizeResponse;
     };
 };
 export interface AuthServiceServer extends UntypedServiceImplementation {
-    login: handleUnaryCall<LoginRequest, LoginResponse>;
+    validateAccess: handleUnaryCall<ValidateAccessRequest, ValidateAccessResponse>;
+    authorize: handleUnaryCall<AuthorizeRequest, AuthorizeResponse>;
 }
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/gen/auth/v1/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../src/gen/auth/v1/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAM1D,eAAO,MAAM,YAAY;oBACP,YAAY,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAUrE,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,YAAY;CA6BtE,CAAC;AAMF,eAAO,MAAM,aAAa;oBACR,aAAa,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAUtE,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,aAAa;CA6BvE,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;CAClG;AAED,wBAAgB,4BAA4B,KACzB,aAAa,QAAQ,UAYvC;AAED,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC;AAC3D,eAAO,MAAM,kBAAkB;;;;;2CAKD,YAAY;6CACV,MAAM;4CACP,aAAa;8CACX,MAAM;;CAE7B,CAAC;AAEX,MAAM,WAAW,iBAAkB,SAAQ,4BAA4B;IACrE,KAAK,EAAE,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;CACrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../src/gen/auth/v1/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EACJ,WAAW,GACX,SAAS,CAAC;IACd,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,UAAU,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CACvC;AAED,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAM1D,eAAO,MAAM,WAAW;oBACN,WAAW,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAmBpE,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,WAAW;CAkDrE,CAAC;AAMF,eAAO,MAAM,qBAAqB;oBAChB,qBAAqB,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAa9E,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,qBAAqB;CAoC/E,CAAC;AAMF,eAAO,MAAM,sBAAsB;oBACjB,sBAAsB,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAa/E,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,sBAAsB;CAoChF,CAAC;AAMF,eAAO,MAAM,gBAAgB;oBACX,gBAAgB,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAazE,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,gBAAgB;CAuC1E,CAAC;AAMF,eAAO,MAAM,gCAAgC;oBAC3B,gCAAgC,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAUzF,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,gCAAgC;CA6B1F,CAAC;AAMF,eAAO,MAAM,iBAAiB;oBACZ,iBAAiB,WAAU,GAAG,CAAC,MAAM,GAAyB,GAAG,CAAC,MAAM;kBAU1E,GAAG,CAAC,MAAM,GAAG,UAAU,WAAW,MAAM,GAAG,iBAAiB;CA6B3E,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAEnF,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,CACZ,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,GAAG,UAAU,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;IAEjG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;CACtH;AAED,wBAAgB,4BAA4B,KACzB,aAAa,QAAQ,UAYvC;AAED,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC;AAC3D,eAAO,MAAM,kBAAkB;;;;;2CAKD,qBAAqB;6CACnB,MAAM;4CACP,sBAAsB;8CACpB,MAAM;;;;;;2CAMT,gBAAgB;6CACd,MAAM;4CACP,iBAAiB;8CACf,MAAM;;CAE7B,CAAC;AAEX,MAAM,WAAW,iBAAkB,SAAQ,4BAA4B;IACrE,cAAc,EAAE,eAAe,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC;IAC/E,SAAS,EAAE,eAAe,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;CACjE"}

package/dist/src/gen/auth/v1/auth.js

@@ -7,23 +7,32 @@ import { GrpcMethod, GrpcStreamMethod } from "@nestjs/microservices";
 import _m0 from "protobufjs/minimal";
 export const protobufPackage = "aegis.auth.v1";
 export const AEGIS_AUTH_V1_PACKAGE_NAME = "aegis.auth.v1";
-function createBaseLoginRequest() {
-    return { username: "", password: "" };
+function createBaseAuthContext() {
+    return { sessionId: "", userId: "", email: "", roles: [], permissions: [] };
 }
-export const LoginRequest = {
+export const AuthContext = {
     encode(message, writer = _m0.Writer.create()) {
-        if (message.username !== "") {
-            writer.uint32(10).string(message.username);
+        if (message.sessionId !== "") {
+            writer.uint32(10).string(message.sessionId);
         }
-        if (message.password !== "") {
-            writer.uint32(18).string(message.password);
+        if (message.userId !== "") {
+            writer.uint32(18).string(message.userId);
+        }
+        if (message.email !== "") {
+            writer.uint32(26).string(message.email);
+        }
+        for (const v of message.roles) {
+            writer.uint32(34).string(v);
+        }
+        for (const v of message.permissions) {
+            writer.uint32(42).string(v);
         }
         return writer;
     },
     decode(input, length) {
         const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
         let end = length === undefined ? reader.len : reader.pos + length;
-        const message = createBaseLoginRequest();
+        const message = createBaseAuthContext();
         while (reader.pos < end) {
             const tag = reader.uint32();
             switch (tag >>> 3) {
@@ -31,13 +40,31 @@ export const LoginRequest = {
                     if (tag !== 10) {
                         break;
                     }
-                    message.username = reader.string();
+                    message.sessionId = reader.string();
                     continue;
                 case 2:
                     if (tag !== 18) {
                         break;
                     }
-                    message.password = reader.string();
+                    message.userId = reader.string();
+                    continue;
+                case 3:
+                    if (tag !== 26) {
+                        break;
+                    }
+                    message.email = reader.string();
+                    continue;
+                case 4:
+                    if (tag !== 34) {
+                        break;
+                    }
+                    message.roles.push(reader.string());
+                    continue;
+                case 5:
+                    if (tag !== 42) {
+                        break;
+                    }
+                    message.permissions.push(reader.string());
                     continue;
             }
             if ((tag & 7) === 4 || tag === 0) {
@@ -48,23 +75,26 @@ export const LoginRequest = {
         return message;
     },
 };
-function createBaseLoginResponse() {
-    return { accessToken: "", refreshToken: "" };
+function createBaseValidateAccessRequest() {
+    return { accessToken: "", ip: "", userAgent: "" };
 }
-export const LoginResponse = {
+export const ValidateAccessRequest = {
     encode(message, writer = _m0.Writer.create()) {
         if (message.accessToken !== "") {
             writer.uint32(10).string(message.accessToken);
         }
-        if (message.refreshToken !== "") {
-            writer.uint32(18).string(message.refreshToken);
+        if (message.ip !== "") {
+            writer.uint32(18).string(message.ip);
+        }
+        if (message.userAgent !== "") {
+            writer.uint32(26).string(message.userAgent);
         }
         return writer;
     },
     decode(input, length) {
         const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
         let end = length === undefined ? reader.len : reader.pos + length;
-        const message = createBaseLoginResponse();
+        const message = createBaseValidateAccessRequest();
         while (reader.pos < end) {
             const tag = reader.uint32();
             switch (tag >>> 3) {
@@ -78,7 +108,198 @@ export const LoginResponse = {
                     if (tag !== 18) {
                         break;
                     }
-                    message.refreshToken = reader.string();
+                    message.ip = reader.string();
+                    continue;
+                case 3:
+                    if (tag !== 26) {
+                        break;
+                    }
+                    message.userAgent = reader.string();
+                    continue;
+            }
+            if ((tag & 7) === 4 || tag === 0) {
+                break;
+            }
+            reader.skipType(tag & 7);
+        }
+        return message;
+    },
+};
+function createBaseValidateAccessResponse() {
+    return { valid: false, reason: "" };
+}
+export const ValidateAccessResponse = {
+    encode(message, writer = _m0.Writer.create()) {
+        if (message.valid !== false) {
+            writer.uint32(8).bool(message.valid);
+        }
+        if (message.reason !== "") {
+            writer.uint32(18).string(message.reason);
+        }
+        if (message.context !== undefined) {
+            AuthContext.encode(message.context, writer.uint32(26).fork()).ldelim();
+        }
+        return writer;
+    },
+    decode(input, length) {
+        const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
+        let end = length === undefined ? reader.len : reader.pos + length;
+        const message = createBaseValidateAccessResponse();
+        while (reader.pos < end) {
+            const tag = reader.uint32();
+            switch (tag >>> 3) {
+                case 1:
+                    if (tag !== 8) {
+                        break;
+                    }
+                    message.valid = reader.bool();
+                    continue;
+                case 2:
+                    if (tag !== 18) {
+                        break;
+                    }
+                    message.reason = reader.string();
+                    continue;
+                case 3:
+                    if (tag !== 26) {
+                        break;
+                    }
+                    message.context = AuthContext.decode(reader, reader.uint32());
+                    continue;
+            }
+            if ((tag & 7) === 4 || tag === 0) {
+                break;
+            }
+            reader.skipType(tag & 7);
+        }
+        return message;
+    },
+};
+function createBaseAuthorizeRequest() {
+    return { policy: "", attributes: {} };
+}
+export const AuthorizeRequest = {
+    encode(message, writer = _m0.Writer.create()) {
+        if (message.context !== undefined) {
+            AuthContext.encode(message.context, writer.uint32(10).fork()).ldelim();
+        }
+        if (message.policy !== "") {
+            writer.uint32(18).string(message.policy);
+        }
+        Object.entries(message.attributes).forEach(([key, value]) => {
+            AuthorizeRequest_AttributesEntry.encode({ key: key, value }, writer.uint32(26).fork()).ldelim();
+        });
+        return writer;
+    },
+    decode(input, length) {
+        const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
+        let end = length === undefined ? reader.len : reader.pos + length;
+        const message = createBaseAuthorizeRequest();
+        while (reader.pos < end) {
+            const tag = reader.uint32();
+            switch (tag >>> 3) {
+                case 1:
+                    if (tag !== 10) {
+                        break;
+                    }
+                    message.context = AuthContext.decode(reader, reader.uint32());
+                    continue;
+                case 2:
+                    if (tag !== 18) {
+                        break;
+                    }
+                    message.policy = reader.string();
+                    continue;
+                case 3:
+                    if (tag !== 26) {
+                        break;
+                    }
+                    const entry3 = AuthorizeRequest_AttributesEntry.decode(reader, reader.uint32());
+                    if (entry3.value !== undefined) {
+                        message.attributes[entry3.key] = entry3.value;
+                    }
+                    continue;
+            }
+            if ((tag & 7) === 4 || tag === 0) {
+                break;
+            }
+            reader.skipType(tag & 7);
+        }
+        return message;
+    },
+};
+function createBaseAuthorizeRequest_AttributesEntry() {
+    return { key: "", value: "" };
+}
+export const AuthorizeRequest_AttributesEntry = {
+    encode(message, writer = _m0.Writer.create()) {
+        if (message.key !== "") {
+            writer.uint32(10).string(message.key);
+        }
+        if (message.value !== "") {
+            writer.uint32(18).string(message.value);
+        }
+        return writer;
+    },
+    decode(input, length) {
+        const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
+        let end = length === undefined ? reader.len : reader.pos + length;
+        const message = createBaseAuthorizeRequest_AttributesEntry();
+        while (reader.pos < end) {
+            const tag = reader.uint32();
+            switch (tag >>> 3) {
+                case 1:
+                    if (tag !== 10) {
+                        break;
+                    }
+                    message.key = reader.string();
+                    continue;
+                case 2:
+                    if (tag !== 18) {
+                        break;
+                    }
+                    message.value = reader.string();
+                    continue;
+            }
+            if ((tag & 7) === 4 || tag === 0) {
+                break;
+            }
+            reader.skipType(tag & 7);
+        }
+        return message;
+    },
+};
+function createBaseAuthorizeResponse() {
+    return { allowed: false, reason: "" };
+}
+export const AuthorizeResponse = {
+    encode(message, writer = _m0.Writer.create()) {
+        if (message.allowed !== false) {
+            writer.uint32(8).bool(message.allowed);
+        }
+        if (message.reason !== "") {
+            writer.uint32(18).string(message.reason);
+        }
+        return writer;
+    },
+    decode(input, length) {
+        const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
+        let end = length === undefined ? reader.len : reader.pos + length;
+        const message = createBaseAuthorizeResponse();
+        while (reader.pos < end) {
+            const tag = reader.uint32();
+            switch (tag >>> 3) {
+                case 1:
+                    if (tag !== 8) {
+                        break;
+                    }
+                    message.allowed = reader.bool();
+                    continue;
+                case 2:
+                    if (tag !== 18) {
+                        break;
+                    }
+                    message.reason = reader.string();
                     continue;
             }
             if ((tag & 7) === 4 || tag === 0) {
@@ -91,7 +312,7 @@ export const LoginResponse = {
 };
 export function AuthServiceControllerMethods() {
     return function (constructor) {
-        const grpcMethods = ["login"];
+        const grpcMethods = ["validateAccess", "authorize"];
         for (const method of grpcMethods) {
             const descriptor = Reflect.getOwnPropertyDescriptor(constructor.prototype, method);
             GrpcMethod("AuthService", method)(constructor.prototype[method], method, descriptor);
@@ -105,13 +326,22 @@ export function AuthServiceControllerMethods() {
 }
 export const AUTH_SERVICE_NAME = "AuthService";
 export const AuthServiceService = {
-    login: {
-        path: "/aegis.auth.v1.AuthService/Login",
+    validateAccess: {
+        path: "/aegis.auth.v1.AuthService/ValidateAccess",
+        requestStream: false,
+        responseStream: false,
+        requestSerialize: (value) => Buffer.from(ValidateAccessRequest.encode(value).finish()),
+        requestDeserialize: (value) => ValidateAccessRequest.decode(value),
+        responseSerialize: (value) => Buffer.from(ValidateAccessResponse.encode(value).finish()),
+        responseDeserialize: (value) => ValidateAccessResponse.decode(value),
+    },
+    authorize: {
+        path: "/aegis.auth.v1.AuthService/Authorize",
         requestStream: false,
         responseStream: false,
-        requestSerialize: (value) => Buffer.from(LoginRequest.encode(value).finish()),
-        requestDeserialize: (value) => LoginRequest.decode(value),
-        responseSerialize: (value) => Buffer.from(LoginResponse.encode(value).finish()),
-        responseDeserialize: (value) => LoginResponse.decode(value),
+        requestSerialize: (value) => Buffer.from(AuthorizeRequest.encode(value).finish()),
+        requestDeserialize: (value) => AuthorizeRequest.decode(value),
+        responseSerialize: (value) => Buffer.from(AuthorizeResponse.encode(value).finish()),
+        responseDeserialize: (value) => AuthorizeResponse.decode(value),
     },
 };

package/dist/src/index.js

@@ -8,8 +8,6 @@ npm i
 npm run gen
 npm build
 
-# login and publish (scoped public package)
-
 npm login
 npm publish --access public
 
@@ -24,37 +22,3 @@ npm i @acequants/aegis-contracts @grpc/grpc-js protobufjs
 //registry.npmjs.org/:_authToken=${NPM_TOKEN}
 
 */
-/*
-
-    Usage
-
-Generate TS stubs:
-
-pnpm gen
-
-
-Build:
-
-pnpm build
-
-
-Publish privately (npm org must be private):
-
-npm publish --access restricted
-
-
-Consumers install:
-
-npm install @acequants/contracts
-
-
-Import in services:
-
-import { userV1 } from "@acequants/contracts";
-
-const client = new userV1.UserServiceClient(
-  "localhost:50051",
-  credentials.createInsecure()
-);
-
-*/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acequants/aegis-contracts",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
   "license": "MIT",
   "type": "module",

package/proto/auth/v1/auth.proto

@@ -4,18 +4,39 @@ package aegis.auth.v1;
 
 option java_multiple_files = true;
 
-// ---- Messages ----
-message LoginRequest {
-  string username = 1;
-  string password = 2;
+service AuthService {
+  rpc ValidateAccess (ValidateAccessRequest) returns (ValidateAccessResponse);
+  rpc Authorize (AuthorizeRequest) returns (AuthorizeResponse);
 }
 
-message LoginResponse {
-  string accessToken = 1;
-  string refreshToken = 2;
+message AuthContext {
+  string session_id = 1;
+  string user_id = 2;
+  string email = 3;
+  // string tenant_id = 4;
+  repeated string roles = 4;
+  repeated string permissions = 5;
 }
 
-// ---- Service ----
-service AuthService {
-  rpc Login (LoginRequest) returns (LoginResponse);
+message ValidateAccessRequest {
+  string access_token = 1;
+  string ip = 2;
+  string user_agent = 3;
+}
+
+message ValidateAccessResponse {
+  bool valid = 1;
+  string reason = 2;       // "expired", "revoked", etc.
+  AuthContext context = 3;
 }
+
+message AuthorizeRequest {
+  AuthContext context = 1;
+  string policy = 2;                  // e.g. "order.read"
+  map<string, string> attributes = 3; // resource/user attributes for ABAC
+}
+
+message AuthorizeResponse {
+  bool allowed = 1;
+  string reason = 2;
+}