@aepstore-dev/contracts 1.26.0 → 1.28.0

package/gen/taxonomy.ts

@@ -24,6 +24,8 @@ export interface Application {
   description: string;
   createdAt: string;
   updatedAt: string;
+  /** public S3 URL to brand SVG (admin-set), empty if none */
+  iconUrl: string;
 }
 
 export interface Tag {
@@ -67,12 +69,38 @@ export interface CategoryResponse {
 export interface CreateApplicationRequest {
   name: string;
   description: string;
+  iconUrl: string;
+}
+
+export interface UpdateApplicationRequest {
+  id: string;
+  /** optional — empty keeps current */
+  name: string;
+  /** optional */
+  description: string;
+  /** optional — empty keeps current */
+  iconUrl: string;
 }
 
 export interface ApplicationResponse {
   application: Application | undefined;
 }
 
+export interface CreateIconUploadUrlRequest {
+  fileName: string;
+  /** e.g. image/svg+xml */
+  mimeType: string;
+}
+
+export interface IconUploadUrlResponse {
+  /** presigned PUT URL — client uploads the SVG bytes here */
+  uploadUrl: string;
+  /** final public URL to store as Application.iconUrl */
+  iconUrl: string;
+  fileKey: string;
+  expiresIn: number;
+}
+
 export const TAXONOMY_V1_PACKAGE_NAME = "taxonomy.v1";
 
 export interface TaxonomyServiceClient {
@@ -85,6 +113,16 @@ export interface TaxonomyServiceClient {
   createCategory(request: CreateCategoryRequest): Observable<CategoryResponse>;
 
   createApplication(request: CreateApplicationRequest): Observable<ApplicationResponse>;
+
+  updateApplication(request: UpdateApplicationRequest): Observable<ApplicationResponse>;
+
+  /**
+   * Mint a presigned PUT URL for an application icon SVG (proxies upload-service,
+   * kind=ICON → public/icons/). Client PUTs the bytes to upload_url, then passes
+   * icon_url to Create/UpdateApplication.
+   */
+
+  createIconUploadUrl(request: CreateIconUploadUrlRequest): Observable<IconUploadUrlResponse>;
 }
 
 export interface TaxonomyServiceController {
@@ -105,6 +143,20 @@ export interface TaxonomyServiceController {
   createApplication(
     request: CreateApplicationRequest,
   ): Promise<ApplicationResponse> | Observable<ApplicationResponse> | ApplicationResponse;
+
+  updateApplication(
+    request: UpdateApplicationRequest,
+  ): Promise<ApplicationResponse> | Observable<ApplicationResponse> | ApplicationResponse;
+
+  /**
+   * Mint a presigned PUT URL for an application icon SVG (proxies upload-service,
+   * kind=ICON → public/icons/). Client PUTs the bytes to upload_url, then passes
+   * icon_url to Create/UpdateApplication.
+   */
+
+  createIconUploadUrl(
+    request: CreateIconUploadUrlRequest,
+  ): Promise<IconUploadUrlResponse> | Observable<IconUploadUrlResponse> | IconUploadUrlResponse;
 }
 
 export function TaxonomyServiceControllerMethods() {
@@ -115,6 +167,8 @@ export function TaxonomyServiceControllerMethods() {
       "findAllTags",
       "createCategory",
       "createApplication",
+      "updateApplication",
+      "createIconUploadUrl",
     ];
     for (const method of grpcMethods) {
       const descriptor: any = Reflect.getOwnPropertyDescriptor(constructor.prototype, method);

package/gen/upload.ts

@@ -21,6 +21,8 @@ export enum UploadKind {
   UPLOAD_KIND_MEDIA = 2,
   UPLOAD_KIND_AVATAR = 3,
   UPLOAD_KIND_BANNER = 4,
+  /** UPLOAD_KIND_ICON - taxonomy program/app brand icons → public/icons/ */
+  UPLOAD_KIND_ICON = 5,
   UNRECOGNIZED = -1,
 }
 
@@ -97,6 +99,8 @@ export interface CreateUploadUrlResponse {
   url: string;
   fileKey: string;
   expiresIn: number;
+  /** final object URL (only meaningful for public kinds) */
+  publicUrl: string;
 }
 
 export interface SignedUrlRequest {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aepstore-dev/contracts",
-  "version": "1.26.0",
+  "version": "1.28.0",
   "description": "Protobuf definitions for aepstore microservices",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/proto/auth.proto

@@ -1,126 +1,126 @@
-syntax = "proto3";
-
-package auth.v1;
-
-// Ported from legacy auth-service (@MessagePattern → @GrpcMethod).
-// Tokens are HMAC primitives from @aepstore-dev/passport:
-//   - access token: short TTL, carries userId; the gateway validates it
-//     locally via PassportAuthGuard (no round-trip here).
-//   - refresh token: long TTL HMAC + a RefreshToken DB row (device list +
-//     revocation). Refresh verifies the HMAC AND that the row still exists.
-service AuthService {
-    rpc Login(LoginRequest) returns (AuthResult);
-    rpc Register(RegisterRequest) returns (AuthResult);
-    rpc CreateCode(CreateCodeRequest) returns (AuthResult);
-    rpc VerifyCode(VerifyCodeRequest) returns (AuthResult);
-    rpc CheckToken(CheckTokenRequest) returns (AuthUser);
-    rpc RefreshToken(RefreshTokenRequest) returns (AuthResult);
-    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
-    rpc GetProfile(GetProfileRequest) returns (AuthUser);
-    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
-}
-
-enum TwoFactorType {
-    NONE = 0;
-    APP = 1;
-    EMAIL = 2;
-}
-
-// ---------------------------------------------------------------------------
-// Requests
-// ---------------------------------------------------------------------------
-
-// Login by username OR email (one of the two must be set).
-message LoginRequest {
-    string password = 1;
-    string credentials = 2; // username OR email — resolved by the service
-}
-
-message RegisterRequest {
-    string email = 1;
-    string username = 2;
-    string password = 3;
-    string ip = 4; // optional, attached by gateway from req
-}
-
-// type ∈ { twofa, reset, totp_generate, totp_activate, confirm } (legacy strings)
-message CreateCodeRequest {
-    string email = 1;
-    string type = 2;
-}
-
-// type ∈ { twofa, twofa_deactivate, reset, totp, totp_deactivate, backup, confirm }
-// new_password is only used by the 'reset' flow.
-message VerifyCodeRequest {
-    string email = 1;
-    string code = 2;
-    string type = 3;
-    string new_password = 4; // optional
-}
-
-message CheckTokenRequest {
-    string token = 1;
-}
-
-message RefreshTokenRequest {
-    string refresh_token = 1;
-    string user_agent = 2; // optional
-    string ip = 3;         // optional
-}
-
-message Get2faStatusRequest {
-    string username = 1;
-}
-
-message GetProfileRequest {
-    string user_id = 1;
-}
-
-// ---------------------------------------------------------------------------
-// Responses
-// ---------------------------------------------------------------------------
-
-message AuthUser {
-    string id = 1;
-    string username = 2;
-    string email = 3;
-    string avatar_url = 4;
-    string banner_url = 5;
-    repeated string roles = 6;
-    string role = 7; // primary role (roles[0])
-    bool is_verified = 8;
-    TwoFactorType two_factor_type = 9;
-    bool two_factor_enabled = 10;
-    string balance = 11; // Decimal as string (D7)
-}
-
-// Unified result for login/register/createCode/verifyCode/refresh. Which fields
-// are populated depends on the flow:
-//   - fully authenticated → access_token + refresh_token + expires_in + user
-//   - 2FA required / pending confirm → message + requires_2fa + two_factor_type + user (no tokens)
-//   - totp_generate → secret + otpauth + qr (+ user)
-//   - totp_activate → backup_codes (+ tokens/user)
-message AuthResult {
-    string access_token = 1;
-    string refresh_token = 2;
-    int32 expires_in = 3;
-    AuthUser user = 4;
-
-    string message = 5;
-    bool requires_2fa = 6;
-    TwoFactorType two_factor_type = 7;
-
-    // TOTP setup extras
-    string secret = 8;
-    string otpauth = 9;
-    string qr = 10; // data URL (PNG)
-    repeated string backup_codes = 11;
-}
-
-message TwoFactorStatusResponse {
-    TwoFactorType two_factor_type = 1;
-    bool has_2fa = 2;
-    bool is_verified = 3;
-}
-
-message Empty {}
+syntax = "proto3";
+
+package auth.v1;
+
+// Ported from legacy auth-service (@MessagePattern → @GrpcMethod).
+// Tokens are HMAC primitives from @aepstore-dev/passport:
+//   - access token: short TTL, carries userId; the gateway validates it
+//     locally via PassportAuthGuard (no round-trip here).
+//   - refresh token: long TTL HMAC + a RefreshToken DB row (device list +
+//     revocation). Refresh verifies the HMAC AND that the row still exists.
+service AuthService {
+    rpc Login(LoginRequest) returns (AuthResult);
+    rpc Register(RegisterRequest) returns (AuthResult);
+    rpc CreateCode(CreateCodeRequest) returns (AuthResult);
+    rpc VerifyCode(VerifyCodeRequest) returns (AuthResult);
+    rpc CheckToken(CheckTokenRequest) returns (AuthUser);
+    rpc RefreshToken(RefreshTokenRequest) returns (AuthResult);
+    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
+    rpc GetProfile(GetProfileRequest) returns (AuthUser);
+    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
+}
+
+enum TwoFactorType {
+    NONE = 0;
+    APP = 1;
+    EMAIL = 2;
+}
+
+// ---------------------------------------------------------------------------
+// Requests
+// ---------------------------------------------------------------------------
+
+// Login by username OR email (one of the two must be set).
+message LoginRequest {
+    string password = 1;
+    string credentials = 2; // username OR email — resolved by the service
+}
+
+message RegisterRequest {
+    string email = 1;
+    string username = 2;
+    string password = 3;
+    string ip = 4; // optional, attached by gateway from req
+}
+
+// type ∈ { twofa, reset, totp_generate, totp_activate, confirm } (legacy strings)
+message CreateCodeRequest {
+    string email = 1;
+    string type = 2;
+}
+
+// type ∈ { twofa, twofa_deactivate, reset, totp, totp_deactivate, backup, confirm }
+// new_password is only used by the 'reset' flow.
+message VerifyCodeRequest {
+    string email = 1;
+    string code = 2;
+    string type = 3;
+    string new_password = 4; // optional
+}
+
+message CheckTokenRequest {
+    string token = 1;
+}
+
+message RefreshTokenRequest {
+    string refresh_token = 1;
+    string user_agent = 2; // optional
+    string ip = 3;         // optional
+}
+
+message Get2faStatusRequest {
+    string username = 1;
+}
+
+message GetProfileRequest {
+    string user_id = 1;
+}
+
+// ---------------------------------------------------------------------------
+// Responses
+// ---------------------------------------------------------------------------
+
+message AuthUser {
+    string id = 1;
+    string username = 2;
+    string email = 3;
+    string avatar_url = 4;
+    string banner_url = 5;
+    repeated string roles = 6;
+    string role = 7; // primary role (roles[0])
+    bool is_verified = 8;
+    TwoFactorType two_factor_type = 9;
+    bool two_factor_enabled = 10;
+    string balance = 11; // Decimal as string (D7)
+}
+
+// Unified result for login/register/createCode/verifyCode/refresh. Which fields
+// are populated depends on the flow:
+//   - fully authenticated → access_token + refresh_token + expires_in + user
+//   - 2FA required / pending confirm → message + requires_2fa + two_factor_type + user (no tokens)
+//   - totp_generate → secret + otpauth + qr (+ user)
+//   - totp_activate → backup_codes (+ tokens/user)
+message AuthResult {
+    string access_token = 1;
+    string refresh_token = 2;
+    int32 expires_in = 3;
+    AuthUser user = 4;
+
+    string message = 5;
+    bool requires_2fa = 6;
+    TwoFactorType two_factor_type = 7;
+
+    // TOTP setup extras
+    string secret = 8;
+    string otpauth = 9;
+    string qr = 10; // data URL (PNG)
+    repeated string backup_codes = 11;
+}
+
+message TwoFactorStatusResponse {
+    TwoFactorType two_factor_type = 1;
+    bool has_2fa = 2;
+    bool is_verified = 3;
+}
+
+message Empty {}

package/proto/mail.proto

@@ -1,42 +1,42 @@
-syntax = "proto3";
-
-package mail.v1;
-
-// Legacy mail-service used @EventPattern (fire-and-forget). In the new gRPC
-// stack each becomes a unary RPC that returns an Ack. Callers ignore the
-// response if they don't care about delivery.
-service MailService {
-    rpc SendReg(SendRegRequest) returns (MailAck);
-    rpc Send2fa(Send2faRequest) returns (MailAck);
-    rpc SendPasswordReset(SendPasswordResetRequest) returns (MailAck);
-    rpc SendRegistrationConfirm(SendRegistrationConfirmRequest) returns (MailAck);
-}
-
-message MailAck {
-    bool queued = 1;
-}
-
-message SendRegRequest {
-    string user_id = 1;
-    string email = 2;
-    string username = 3;
-    string full_name = 4;
-}
-
-message Send2faRequest {
-    string email = 1;
-    string code = 2;
-    string username = 3;
-}
-
-message SendPasswordResetRequest {
-    string email = 1;
-    string code = 2;
-    string username = 3;
-}
-
-message SendRegistrationConfirmRequest {
-    string email = 1;
-    string code = 2;
-    string username = 3;
-}
+syntax = "proto3";
+
+package mail.v1;
+
+// Legacy mail-service used @EventPattern (fire-and-forget). In the new gRPC
+// stack each becomes a unary RPC that returns an Ack. Callers ignore the
+// response if they don't care about delivery.
+service MailService {
+    rpc SendReg(SendRegRequest) returns (MailAck);
+    rpc Send2fa(Send2faRequest) returns (MailAck);
+    rpc SendPasswordReset(SendPasswordResetRequest) returns (MailAck);
+    rpc SendRegistrationConfirm(SendRegistrationConfirmRequest) returns (MailAck);
+}
+
+message MailAck {
+    bool queued = 1;
+}
+
+message SendRegRequest {
+    string user_id = 1;
+    string email = 2;
+    string username = 3;
+    string full_name = 4;
+}
+
+message Send2faRequest {
+    string email = 1;
+    string code = 2;
+    string username = 3;
+}
+
+message SendPasswordResetRequest {
+    string email = 1;
+    string code = 2;
+    string username = 3;
+}
+
+message SendRegistrationConfirmRequest {
+    string email = 1;
+    string code = 2;
+    string username = 3;
+}