@aepstore-dev/contracts 1.34.0 → 1.35.0

package/gen/auth.ts

@@ -133,6 +133,38 @@ export interface LogoutResponse {
   removed: number;
 }
 
+export interface RestoreLoginRequest {
+  /** email or username */
+  credentials: string;
+  password: string;
+  userAgent: string;
+  ip: string;
+}
+
+export interface ListLoginHistoryRequest {
+  userId: string;
+  page: number;
+  limit: number;
+}
+
+export interface LoginEventRow {
+  id: string;
+  /** LOGIN | LOGOUT | REFRESH | TWO_FA_FAIL | PASSWORD_FAIL | BLOCKED | RESTORE */
+  type: string;
+  success: boolean;
+  reason: string;
+  ip: string;
+  userAgent: string;
+  createdAt: string;
+}
+
+export interface ListLoginHistoryResponse {
+  items: LoginEventRow[];
+  total: number;
+  page: number;
+  limit: number;
+}
+
 export const AUTH_V1_PACKAGE_NAME = "auth.v1";
 
 /**
@@ -171,6 +203,21 @@ export interface AuthServiceClient {
   logoutCurrent(request: LogoutCurrentRequest): Observable<LogoutResponse>;
 
   logoutAll(request: LogoutAllRequest): Observable<LogoutResponse>;
+
+  /**
+   * Self-service restore. Verifies credentials + password against a
+   * soft-deleted user, clears deletedAt/scheduledForHardDelete, and issues
+   * fresh tokens — the one auth path that DOES read deletedAt accounts.
+   */
+
+  restoreLogin(request: RestoreLoginRequest): Observable<AuthResult>;
+
+  /**
+   * Login history. Read-only audit feed for the settings page; rows come
+   * from LoginEvent. Internal alternative: tasks-service GC.
+   */
+
+  listLoginHistory(request: ListLoginHistoryRequest): Observable<ListLoginHistoryResponse>;
 }
 
 /**
@@ -211,6 +258,23 @@ export interface AuthServiceController {
   logoutCurrent(request: LogoutCurrentRequest): Promise<LogoutResponse> | Observable<LogoutResponse> | LogoutResponse;
 
   logoutAll(request: LogoutAllRequest): Promise<LogoutResponse> | Observable<LogoutResponse> | LogoutResponse;
+
+  /**
+   * Self-service restore. Verifies credentials + password against a
+   * soft-deleted user, clears deletedAt/scheduledForHardDelete, and issues
+   * fresh tokens — the one auth path that DOES read deletedAt accounts.
+   */
+
+  restoreLogin(request: RestoreLoginRequest): Promise<AuthResult> | Observable<AuthResult> | AuthResult;
+
+  /**
+   * Login history. Read-only audit feed for the settings page; rows come
+   * from LoginEvent. Internal alternative: tasks-service GC.
+   */
+
+  listLoginHistory(
+    request: ListLoginHistoryRequest,
+  ): Promise<ListLoginHistoryResponse> | Observable<ListLoginHistoryResponse> | ListLoginHistoryResponse;
 }
 
 export function AuthServiceControllerMethods() {
@@ -227,6 +291,8 @@ export function AuthServiceControllerMethods() {
       "cleanupExpiredTotpSetups",
       "logoutCurrent",
       "logoutAll",
+      "restoreLogin",
+      "listLoginHistory",
     ];
     for (const method of grpcMethods) {
       const descriptor: any = Reflect.getOwnPropertyDescriptor(constructor.prototype, method);

package/gen/mail.ts

@@ -39,6 +39,16 @@ export interface SendRegistrationConfirmRequest {
   username: string;
 }
 
+export interface SendDataExportReadyRequest {
+  email: string;
+  username: string;
+  /** signed S3 URL */
+  fileUrl: string;
+  /** for the message body */
+  urlTtlHours: number;
+  fileSize: number;
+}
+
 export const MAIL_V1_PACKAGE_NAME = "mail.v1";
 
 /**
@@ -55,6 +65,13 @@ export interface MailServiceClient {
   sendPasswordReset(request: SendPasswordResetRequest): Observable<MailAck>;
 
   sendRegistrationConfirm(request: SendRegistrationConfirmRequest): Observable<MailAck>;
+
+  /**
+   * GDPR data-export delivery — tasks-service fires after the JSON dump
+   * lands in S3; mail-service sends the signed URL with a sensible TTL note.
+   */
+
+  sendDataExportReady(request: SendDataExportReadyRequest): Observable<MailAck>;
 }
 
 /**
@@ -71,11 +88,24 @@ export interface MailServiceController {
   sendPasswordReset(request: SendPasswordResetRequest): Promise<MailAck> | Observable<MailAck> | MailAck;
 
   sendRegistrationConfirm(request: SendRegistrationConfirmRequest): Promise<MailAck> | Observable<MailAck> | MailAck;
+
+  /**
+   * GDPR data-export delivery — tasks-service fires after the JSON dump
+   * lands in S3; mail-service sends the signed URL with a sensible TTL note.
+   */
+
+  sendDataExportReady(request: SendDataExportReadyRequest): Promise<MailAck> | Observable<MailAck> | MailAck;
 }
 
 export function MailServiceControllerMethods() {
   return function (constructor: Function) {
-    const grpcMethods: string[] = ["sendReg", "send2Fa", "sendPasswordReset", "sendRegistrationConfirm"];
+    const grpcMethods: string[] = [
+      "sendReg",
+      "send2Fa",
+      "sendPasswordReset",
+      "sendRegistrationConfirm",
+      "sendDataExportReady",
+    ];
     for (const method of grpcMethods) {
       const descriptor: any = Reflect.getOwnPropertyDescriptor(constructor.prototype, method);
       GrpcMethod("MailService", method)(constructor.prototype[method], method, descriptor);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aepstore-dev/contracts",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "Protobuf definitions for aepstore microservices",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/proto/auth.proto

@@ -23,6 +23,15 @@ service AuthService {
     // HMAC matches; LogoutAll wipes every row for the user.
     rpc LogoutCurrent(LogoutCurrentRequest) returns (LogoutResponse);
     rpc LogoutAll(LogoutAllRequest) returns (LogoutResponse);
+
+    // Self-service restore. Verifies credentials + password against a
+    // soft-deleted user, clears deletedAt/scheduledForHardDelete, and issues
+    // fresh tokens — the one auth path that DOES read deletedAt accounts.
+    rpc RestoreLogin(RestoreLoginRequest) returns (AuthResult);
+
+    // Login history. Read-only audit feed for the settings page; rows come
+    // from LoginEvent. Internal alternative: tasks-service GC.
+    rpc ListLoginHistory(ListLoginHistoryRequest) returns (ListLoginHistoryResponse);
 }
 
 enum TwoFactorType {
@@ -142,3 +151,33 @@ message LogoutResponse {
     bool ok = 1;
     int32 removed = 2; // number of refresh-token rows deleted
 }
+
+message RestoreLoginRequest {
+    string credentials = 1; // email or username
+    string password = 2;
+    string user_agent = 3;
+    string ip = 4;
+}
+
+message ListLoginHistoryRequest {
+    string user_id = 1;
+    int32 page = 2;
+    int32 limit = 3;
+}
+
+message LoginEventRow {
+    string id = 1;
+    string type = 2;       // LOGIN | LOGOUT | REFRESH | TWO_FA_FAIL | PASSWORD_FAIL | BLOCKED | RESTORE
+    bool success = 3;
+    string reason = 4;
+    string ip = 5;
+    string user_agent = 6;
+    string created_at = 7;
+}
+
+message ListLoginHistoryResponse {
+    repeated LoginEventRow items = 1;
+    int32 total = 2;
+    int32 page = 3;
+    int32 limit = 4;
+}

package/proto/mail.proto

@@ -10,6 +10,10 @@ service MailService {
     rpc Send2fa(Send2faRequest) returns (MailAck);
     rpc SendPasswordReset(SendPasswordResetRequest) returns (MailAck);
     rpc SendRegistrationConfirm(SendRegistrationConfirmRequest) returns (MailAck);
+
+    // GDPR data-export delivery — tasks-service fires after the JSON dump
+    // lands in S3; mail-service sends the signed URL with a sensible TTL note.
+    rpc SendDataExportReady(SendDataExportReadyRequest) returns (MailAck);
 }
 
 message MailAck {
@@ -40,3 +44,11 @@ message SendRegistrationConfirmRequest {
     string code = 2;
     string username = 3;
 }
+
+message SendDataExportReadyRequest {
+    string email = 1;
+    string username = 2;
+    string file_url = 3;     // signed S3 URL
+    int32 url_ttl_hours = 4; // for the message body
+    int32 file_size = 5;
+}