@aepstore-dev/contracts 1.59.0 → 1.61.0

package/proto/auth.proto

@@ -1,198 +1,198 @@
-syntax = "proto3";
-
-package auth.v1;
-
-// Ported from legacy auth-service (@MessagePattern → @GrpcMethod).
-// Tokens are HMAC primitives from @aepstore-dev/passport:
-//   - access token: short TTL, carries userId; the gateway validates it
-//     locally via PassportAuthGuard (no round-trip here).
-//   - refresh token: long TTL HMAC + a RefreshToken DB row (device list +
-//     revocation). Refresh verifies the HMAC AND that the row still exists.
-service AuthService {
-    rpc Login(LoginRequest) returns (AuthResult);
-    rpc Register(RegisterRequest) returns (AuthResult);
-    rpc CreateCode(CreateCodeRequest) returns (AuthResult);
-    rpc VerifyCode(VerifyCodeRequest) returns (AuthResult);
-    rpc CheckToken(CheckTokenRequest) returns (AuthUser);
-    rpc RefreshToken(RefreshTokenRequest) returns (AuthResult);
-    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
-    rpc GetProfile(GetProfileRequest) returns (AuthUser);
-    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
-
-    // Logout — kill refresh tokens. LogoutCurrent kills only the one whose
-    // HMAC matches; LogoutAll wipes every row for the user.
-    rpc LogoutCurrent(LogoutCurrentRequest) returns (LogoutResponse);
-    rpc LogoutAll(LogoutAllRequest) returns (LogoutResponse);
-
-    // Self-service restore. Verifies credentials + password against a
-    // soft-deleted user, clears deletedAt/scheduledForHardDelete, and issues
-    // fresh tokens — the one auth path that DOES read deletedAt accounts.
-    rpc RestoreLogin(RestoreLoginRequest) returns (AuthResult);
-
-    // Login history. Read-only audit feed for the settings page; rows come
-    // from LoginEvent. Internal alternative: tasks-service GC.
-    rpc ListLoginHistory(ListLoginHistoryRequest) returns (ListLoginHistoryResponse);
-}
-
-enum TwoFactorType {
-    NONE = 0;
-    APP = 1;
-    EMAIL = 2;
-}
-
-// ---------------------------------------------------------------------------
-// Requests
-// ---------------------------------------------------------------------------
-
-// Login by username OR email (one of the two must be set).
-message LoginRequest {
-    string password = 1;
-    string credentials = 2; // username OR email — resolved by the service
-    // Gateway-supplied audit context. LoginEvent rows for LOGIN /
-    // PASSWORD_FAIL get the same ip/user-agent that REFRESH and RESTORE
-    // already carry; the gRPC layer has no transport-level access to
-    // either, so the gateway extracts them from the HTTP request.
-    string user_agent = 3;
-    string ip = 4;
-}
-
-message RegisterRequest {
-    string email = 1;
-    string username = 2;
-    string password = 3;
-    string ip = 4; // optional, attached by gateway from req
-}
-
-// type ∈ { twofa, reset, totp_generate, totp_activate, confirm } (legacy strings)
-message CreateCodeRequest {
-    string email = 1;
-    string type = 2;
-}
-
-// type ∈ { twofa, twofa_deactivate, reset, totp, totp_deactivate, backup, confirm }
-// new_password is only used by the 'reset' flow.
-message VerifyCodeRequest {
-    string email = 1;
-    string code = 2;
-    string type = 3;
-    string new_password = 4; // optional
-}
-
-message CheckTokenRequest {
-    string token = 1;
-}
-
-message RefreshTokenRequest {
-    string refresh_token = 1;
-    string user_agent = 2; // optional
-    string ip = 3;         // optional
-}
-
-message Get2faStatusRequest {
-    string username = 1;
-}
-
-message GetProfileRequest {
-    string user_id = 1;
-}
-
-// ---------------------------------------------------------------------------
-// Responses
-// ---------------------------------------------------------------------------
-
-message AuthUser {
-    string id = 1;
-    string username = 2;
-    string email = 3;
-    string avatar_url = 4;
-    string banner_url = 5;
-    repeated string roles = 6;
-    // Reserved: 7=role, 8=is_verified, 9=two_factor_type, 10=two_factor_enabled,
-    // 11=balance. Dropped in contracts 1.51.0 — clients read 2FA flags from
-    // AuthResult / /account/settings, balance from /payments/wallet.
-    reserved 7, 8, 9, 10, 11;
-    reserved "role", "is_verified", "two_factor_type", "two_factor_enabled", "balance";
-}
-
-// Unified result for login/register/createCode/verifyCode/refresh. Which fields
-// are populated depends on the flow:
-//   - fully authenticated → access_token + refresh_token + expires_in + user
-//   - 2FA required / pending confirm → message + two_factor_required + two_factor_type + user (no tokens)
-//   - totp_generate → secret + otpauth + qr (+ user)
-//   - totp_activate → backup_codes (+ tokens/user)
-message AuthResult {
-    string access_token = 1;
-    string refresh_token = 2;
-    int32 expires_in = 3;
-    AuthUser user = 4;
-
-    string message = 5;
-    // Renamed from `requires_2fa` in 1.52.0: the digit-after-underscore broke
-    // the grpc proto-loader's camelCase pass (`_2` isn't `_<letter>`), so the
-    // wire key stayed snake_case and never matched the camelCase handler output
-    // → always serialised false. `two_factor_required` camelCases cleanly to
-    // `twoFactorRequired` on every layer. Field number 6 is unchanged (wire-
-    // compatible).
-    bool two_factor_required = 6;
-    TwoFactorType two_factor_type = 7;
-
-    // TOTP setup extras
-    string secret = 8;
-    string otpauth = 9;
-    string qr = 10; // data URL (PNG)
-    repeated string backup_codes = 11;
-}
-
-message TwoFactorStatusResponse {
-    TwoFactorType two_factor_type = 1;
-    bool has_2fa = 2;
-    bool is_verified = 3;
-}
-
-message Empty {}
-
-message LogoutCurrentRequest {
-    string refresh_token = 1;
-}
-
-message LogoutAllRequest {
-    string user_id = 1;
-    // Current session's refresh token — excluded from the wipe so "log out
-    // everywhere" keeps THIS device signed in. Empty = revoke every session.
-    string refresh_token = 2;
-}
-
-message LogoutResponse {
-    bool ok = 1;
-    int32 removed = 2; // number of refresh-token rows deleted
-}
-
-message RestoreLoginRequest {
-    string credentials = 1; // email or username
-    string password = 2;
-    string user_agent = 3;
-    string ip = 4;
-}
-
-message ListLoginHistoryRequest {
-    string user_id = 1;
-    int32 page = 2;
-    int32 limit = 3;
-}
-
-message LoginEventRow {
-    string id = 1;
-    string type = 2;       // LOGIN | LOGOUT | REFRESH | TWO_FA_FAIL | PASSWORD_FAIL | BLOCKED | RESTORE
-    bool success = 3;
-    string reason = 4;
-    string ip = 5;
-    string user_agent = 6;
-    string created_at = 7;
-}
-
-message ListLoginHistoryResponse {
-    repeated LoginEventRow items = 1;
-    int32 total = 2;
-    int32 page = 3;
-    int32 limit = 4;
-}
+syntax = "proto3";
+
+package auth.v1;
+
+// Ported from legacy auth-service (@MessagePattern → @GrpcMethod).
+// Tokens are HMAC primitives from @aepstore-dev/passport:
+//   - access token: short TTL, carries userId; the gateway validates it
+//     locally via PassportAuthGuard (no round-trip here).
+//   - refresh token: long TTL HMAC + a RefreshToken DB row (device list +
+//     revocation). Refresh verifies the HMAC AND that the row still exists.
+service AuthService {
+    rpc Login(LoginRequest) returns (AuthResult);
+    rpc Register(RegisterRequest) returns (AuthResult);
+    rpc CreateCode(CreateCodeRequest) returns (AuthResult);
+    rpc VerifyCode(VerifyCodeRequest) returns (AuthResult);
+    rpc CheckToken(CheckTokenRequest) returns (AuthUser);
+    rpc RefreshToken(RefreshTokenRequest) returns (AuthResult);
+    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
+    rpc GetProfile(GetProfileRequest) returns (AuthUser);
+    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
+
+    // Logout — kill refresh tokens. LogoutCurrent kills only the one whose
+    // HMAC matches; LogoutAll wipes every row for the user.
+    rpc LogoutCurrent(LogoutCurrentRequest) returns (LogoutResponse);
+    rpc LogoutAll(LogoutAllRequest) returns (LogoutResponse);
+
+    // Self-service restore. Verifies credentials + password against a
+    // soft-deleted user, clears deletedAt/scheduledForHardDelete, and issues
+    // fresh tokens — the one auth path that DOES read deletedAt accounts.
+    rpc RestoreLogin(RestoreLoginRequest) returns (AuthResult);
+
+    // Login history. Read-only audit feed for the settings page; rows come
+    // from LoginEvent. Internal alternative: tasks-service GC.
+    rpc ListLoginHistory(ListLoginHistoryRequest) returns (ListLoginHistoryResponse);
+}
+
+enum TwoFactorType {
+    NONE = 0;
+    APP = 1;
+    EMAIL = 2;
+}
+
+// ---------------------------------------------------------------------------
+// Requests
+// ---------------------------------------------------------------------------
+
+// Login by username OR email (one of the two must be set).
+message LoginRequest {
+    string password = 1;
+    string credentials = 2; // username OR email — resolved by the service
+    // Gateway-supplied audit context. LoginEvent rows for LOGIN /
+    // PASSWORD_FAIL get the same ip/user-agent that REFRESH and RESTORE
+    // already carry; the gRPC layer has no transport-level access to
+    // either, so the gateway extracts them from the HTTP request.
+    string user_agent = 3;
+    string ip = 4;
+}
+
+message RegisterRequest {
+    string email = 1;
+    string username = 2;
+    string password = 3;
+    string ip = 4; // optional, attached by gateway from req
+}
+
+// type ∈ { twofa, reset, totp_generate, totp_activate, confirm } (legacy strings)
+message CreateCodeRequest {
+    string email = 1;
+    string type = 2;
+}
+
+// type ∈ { twofa, twofa_deactivate, reset, totp, totp_deactivate, backup, confirm }
+// new_password is only used by the 'reset' flow.
+message VerifyCodeRequest {
+    string email = 1;
+    string code = 2;
+    string type = 3;
+    string new_password = 4; // optional
+}
+
+message CheckTokenRequest {
+    string token = 1;
+}
+
+message RefreshTokenRequest {
+    string refresh_token = 1;
+    string user_agent = 2; // optional
+    string ip = 3;         // optional
+}
+
+message Get2faStatusRequest {
+    string username = 1;
+}
+
+message GetProfileRequest {
+    string user_id = 1;
+}
+
+// ---------------------------------------------------------------------------
+// Responses
+// ---------------------------------------------------------------------------
+
+message AuthUser {
+    string id = 1;
+    string username = 2;
+    string email = 3;
+    string avatar_url = 4;
+    string banner_url = 5;
+    repeated string roles = 6;
+    // Reserved: 7=role, 8=is_verified, 9=two_factor_type, 10=two_factor_enabled,
+    // 11=balance. Dropped in contracts 1.51.0 — clients read 2FA flags from
+    // AuthResult / /account/settings, balance from /payments/wallet.
+    reserved 7, 8, 9, 10, 11;
+    reserved "role", "is_verified", "two_factor_type", "two_factor_enabled", "balance";
+}
+
+// Unified result for login/register/createCode/verifyCode/refresh. Which fields
+// are populated depends on the flow:
+//   - fully authenticated → access_token + refresh_token + expires_in + user
+//   - 2FA required / pending confirm → message + two_factor_required + two_factor_type + user (no tokens)
+//   - totp_generate → secret + otpauth + qr (+ user)
+//   - totp_activate → backup_codes (+ tokens/user)
+message AuthResult {
+    string access_token = 1;
+    string refresh_token = 2;
+    int32 expires_in = 3;
+    AuthUser user = 4;
+
+    string message = 5;
+    // Renamed from `requires_2fa` in 1.52.0: the digit-after-underscore broke
+    // the grpc proto-loader's camelCase pass (`_2` isn't `_<letter>`), so the
+    // wire key stayed snake_case and never matched the camelCase handler output
+    // → always serialised false. `two_factor_required` camelCases cleanly to
+    // `twoFactorRequired` on every layer. Field number 6 is unchanged (wire-
+    // compatible).
+    bool two_factor_required = 6;
+    TwoFactorType two_factor_type = 7;
+
+    // TOTP setup extras
+    string secret = 8;
+    string otpauth = 9;
+    string qr = 10; // data URL (PNG)
+    repeated string backup_codes = 11;
+}
+
+message TwoFactorStatusResponse {
+    TwoFactorType two_factor_type = 1;
+    bool has_2fa = 2;
+    bool is_verified = 3;
+}
+
+message Empty {}
+
+message LogoutCurrentRequest {
+    string refresh_token = 1;
+}
+
+message LogoutAllRequest {
+    string user_id = 1;
+    // Current session's refresh token — excluded from the wipe so "log out
+    // everywhere" keeps THIS device signed in. Empty = revoke every session.
+    string refresh_token = 2;
+}
+
+message LogoutResponse {
+    bool ok = 1;
+    int32 removed = 2; // number of refresh-token rows deleted
+}
+
+message RestoreLoginRequest {
+    string credentials = 1; // email or username
+    string password = 2;
+    string user_agent = 3;
+    string ip = 4;
+}
+
+message ListLoginHistoryRequest {
+    string user_id = 1;
+    int32 page = 2;
+    int32 limit = 3;
+}
+
+message LoginEventRow {
+    string id = 1;
+    string type = 2;       // LOGIN | LOGOUT | REFRESH | TWO_FA_FAIL | PASSWORD_FAIL | BLOCKED | RESTORE
+    bool success = 3;
+    string reason = 4;
+    string ip = 5;
+    string user_agent = 6;
+    string created_at = 7;
+}
+
+message ListLoginHistoryResponse {
+    repeated LoginEventRow items = 1;
+    int32 total = 2;
+    int32 page = 3;
+    int32 limit = 4;
+}

package/proto/mail.proto

@@ -1,54 +1,54 @@
-syntax = "proto3";
-
-package mail.v1;
-
-// Legacy mail-service used @EventPattern (fire-and-forget). In the new gRPC
-// stack each becomes a unary RPC that returns an Ack. Callers ignore the
-// response if they don't care about delivery.
-service MailService {
-    rpc SendReg(SendRegRequest) returns (MailAck);
-    rpc Send2fa(Send2faRequest) returns (MailAck);
-    rpc SendPasswordReset(SendPasswordResetRequest) returns (MailAck);
-    rpc SendRegistrationConfirm(SendRegistrationConfirmRequest) returns (MailAck);
-
-    // GDPR data-export delivery — tasks-service fires after the JSON dump
-    // lands in S3; mail-service sends the signed URL with a sensible TTL note.
-    rpc SendDataExportReady(SendDataExportReadyRequest) returns (MailAck);
-}
-
-message MailAck {
-    bool queued = 1;
-}
-
-message SendRegRequest {
-    string user_id = 1;
-    string email = 2;
-    string username = 3;
-    string full_name = 4;
-}
-
-message Send2faRequest {
-    string email = 1;
-    string code = 2;
-    string username = 3;
-}
-
-message SendPasswordResetRequest {
-    string email = 1;
-    string code = 2;
-    string username = 3;
-}
-
-message SendRegistrationConfirmRequest {
-    string email = 1;
-    string code = 2;
-    string username = 3;
-}
-
-message SendDataExportReadyRequest {
-    string email = 1;
-    string username = 2;
-    string file_url = 3;     // signed S3 URL
-    int32 url_ttl_hours = 4; // for the message body
-    int32 file_size = 5;
-}
+syntax = "proto3";
+
+package mail.v1;
+
+// Legacy mail-service used @EventPattern (fire-and-forget). In the new gRPC
+// stack each becomes a unary RPC that returns an Ack. Callers ignore the
+// response if they don't care about delivery.
+service MailService {
+    rpc SendReg(SendRegRequest) returns (MailAck);
+    rpc Send2fa(Send2faRequest) returns (MailAck);
+    rpc SendPasswordReset(SendPasswordResetRequest) returns (MailAck);
+    rpc SendRegistrationConfirm(SendRegistrationConfirmRequest) returns (MailAck);
+
+    // GDPR data-export delivery — tasks-service fires after the JSON dump
+    // lands in S3; mail-service sends the signed URL with a sensible TTL note.
+    rpc SendDataExportReady(SendDataExportReadyRequest) returns (MailAck);
+}
+
+message MailAck {
+    bool queued = 1;
+}
+
+message SendRegRequest {
+    string user_id = 1;
+    string email = 2;
+    string username = 3;
+    string full_name = 4;
+}
+
+message Send2faRequest {
+    string email = 1;
+    string code = 2;
+    string username = 3;
+}
+
+message SendPasswordResetRequest {
+    string email = 1;
+    string code = 2;
+    string username = 3;
+}
+
+message SendRegistrationConfirmRequest {
+    string email = 1;
+    string code = 2;
+    string username = 3;
+}
+
+message SendDataExportReadyRequest {
+    string email = 1;
+    string username = 2;
+    string file_url = 3;     // signed S3 URL
+    int32 url_ttl_hours = 4; // for the message body
+    int32 file_size = 5;
+}