@aepstore-dev/contracts 1.98.0 → 1.100.0

package/gen/auth.d.ts

@@ -27,6 +27,8 @@ export interface RegisterRequest {
     password: string;
     /** optional, attached by gateway from req */
     ip: string;
+    /** optional, attached by gateway from req */
+    userAgent: string;
 }
 /** type ∈ { twofa, reset, totp_generate, confirm } (legacy strings) */
 export interface CreateCodeRequest {
@@ -36,6 +38,7 @@ export interface CreateCodeRequest {
 /**
  * type ∈ { twofa, twofa_activate, twofa_deactivate, reset, totp, totp_activate,
  *          totp_deactivate, backup, regenerate_backup, confirm }
+ * regenerate_backup expects a current TOTP code, not an existing backup code.
  * new_password is only used by the 'reset' flow.
  */
 export interface VerifyCodeRequest {
@@ -70,6 +73,11 @@ export interface Get2faStatusRequest {
 export interface GetProfileRequest {
     userId: string;
 }
+export interface ResetUserTwoFactorRequest {
+    targetUserId: string;
+    adminId: string;
+    reason: string;
+}
 export interface AuthUser {
     id: string;
     username: string;
@@ -137,6 +145,11 @@ export interface LogoutResponse {
     /** number of refresh-token rows deleted */
     removed: number;
 }
+export interface ResetUserTwoFactorResponse {
+    ok: boolean;
+    previousType: TwoFactorType;
+    revokedSessions: number;
+}
 export interface RestoreLoginRequest {
     /** email or username */
     credentials: string;
@@ -184,6 +197,7 @@ export interface AuthServiceClient {
     get2FaStatus(request: Get2faStatusRequest): Observable<TwoFactorStatusResponse>;
     getProfile(request: GetProfileRequest): Observable<AuthUser>;
     cleanupExpiredTotpSetups(request: Empty): Observable<Empty>;
+    resetUserTwoFactor(request: ResetUserTwoFactorRequest): Observable<ResetUserTwoFactorResponse>;
     /**
      * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
      * HMAC matches; LogoutAll wipes every row for the user.
@@ -220,6 +234,7 @@ export interface AuthServiceController {
     get2FaStatus(request: Get2faStatusRequest): Promise<TwoFactorStatusResponse> | Observable<TwoFactorStatusResponse> | TwoFactorStatusResponse;
     getProfile(request: GetProfileRequest): Promise<AuthUser> | Observable<AuthUser> | AuthUser;
     cleanupExpiredTotpSetups(request: Empty): Promise<Empty> | Observable<Empty> | Empty;
+    resetUserTwoFactor(request: ResetUserTwoFactorRequest): Promise<ResetUserTwoFactorResponse> | Observable<ResetUserTwoFactorResponse> | ResetUserTwoFactorResponse;
     /**
      * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
      * HMAC matches; LogoutAll wipes every row for the user.

package/gen/auth.js

@@ -30,6 +30,7 @@ function AuthServiceControllerMethods() {
             "get2FaStatus",
             "getProfile",
             "cleanupExpiredTotpSetups",
+            "resetUserTwoFactor",
             "logoutCurrent",
             "logoutAll",
             "restoreLogin",

package/gen/auth.ts

@@ -39,6 +39,8 @@ export interface RegisterRequest {
   password: string;
   /** optional, attached by gateway from req */
   ip: string;
+  /** optional, attached by gateway from req */
+  userAgent: string;
 }
 
 /** type ∈ { twofa, reset, totp_generate, confirm } (legacy strings) */
@@ -50,6 +52,7 @@ export interface CreateCodeRequest {
 /**
  * type ∈ { twofa, twofa_activate, twofa_deactivate, reset, totp, totp_activate,
  *          totp_deactivate, backup, regenerate_backup, confirm }
+ * regenerate_backup expects a current TOTP code, not an existing backup code.
  * new_password is only used by the 'reset' flow.
  */
 export interface VerifyCodeRequest {
@@ -89,6 +92,12 @@ export interface GetProfileRequest {
   userId: string;
 }
 
+export interface ResetUserTwoFactorRequest {
+  targetUserId: string;
+  adminId: string;
+  reason: string;
+}
+
 export interface AuthUser {
   id: string;
   username: string;
@@ -163,6 +172,12 @@ export interface LogoutResponse {
   removed: number;
 }
 
+export interface ResetUserTwoFactorResponse {
+  ok: boolean;
+  previousType: TwoFactorType;
+  revokedSessions: number;
+}
+
 export interface RestoreLoginRequest {
   /** email or username */
   credentials: string;
@@ -225,6 +240,8 @@ export interface AuthServiceClient {
 
   cleanupExpiredTotpSetups(request: Empty): Observable<Empty>;
 
+  resetUserTwoFactor(request: ResetUserTwoFactorRequest): Observable<ResetUserTwoFactorResponse>;
+
   /**
    * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
    * HMAC matches; LogoutAll wipes every row for the user.
@@ -280,6 +297,10 @@ export interface AuthServiceController {
 
   cleanupExpiredTotpSetups(request: Empty): Promise<Empty> | Observable<Empty> | Empty;
 
+  resetUserTwoFactor(
+    request: ResetUserTwoFactorRequest,
+  ): Promise<ResetUserTwoFactorResponse> | Observable<ResetUserTwoFactorResponse> | ResetUserTwoFactorResponse;
+
   /**
    * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
    * HMAC matches; LogoutAll wipes every row for the user.
@@ -319,6 +340,7 @@ export function AuthServiceControllerMethods() {
       "get2FaStatus",
       "getProfile",
       "cleanupExpiredTotpSetups",
+      "resetUserTwoFactor",
       "logoutCurrent",
       "logoutAll",
       "restoreLogin",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aepstore-dev/contracts",
-  "version": "1.98.0",
+  "version": "1.100.0",
   "description": "Protobuf definitions for aepstore microservices",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/proto/auth.proto

@@ -15,9 +15,10 @@ service AuthService {
     rpc VerifyCode(VerifyCodeRequest) returns (AuthResult);
     rpc CheckToken(CheckTokenRequest) returns (AuthUser);
     rpc RefreshToken(RefreshTokenRequest) returns (AuthResult);
-    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
-    rpc GetProfile(GetProfileRequest) returns (AuthUser);
-    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
+    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
+    rpc GetProfile(GetProfileRequest) returns (AuthUser);
+    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
+    rpc ResetUserTwoFactor(ResetUserTwoFactorRequest) returns (ResetUserTwoFactorResponse);
 
     // Logout — kill refresh tokens. LogoutCurrent kills only the one whose
     // HMAC matches; LogoutAll wipes every row for the user.
@@ -57,12 +58,13 @@ message LoginRequest {
     string trusted_device_token = 5;
 }
 
-message RegisterRequest {
-    string email = 1;
-    string username = 2;
-    string password = 3;
-    string ip = 4; // optional, attached by gateway from req
-}
+message RegisterRequest {
+    string email = 1;
+    string username = 2;
+    string password = 3;
+    string ip = 4; // optional, attached by gateway from req
+    string user_agent = 5; // optional, attached by gateway from req
+}
 
 // type ∈ { twofa, reset, totp_generate, confirm } (legacy strings)
 message CreateCodeRequest {
@@ -72,6 +74,7 @@ message CreateCodeRequest {
 
 // type ∈ { twofa, twofa_activate, twofa_deactivate, reset, totp, totp_activate,
 //          totp_deactivate, backup, regenerate_backup, confirm }
+// regenerate_backup expects a current TOTP code, not an existing backup code.
 // new_password is only used by the 'reset' flow.
 message VerifyCodeRequest {
     string email = 1;
@@ -101,9 +104,15 @@ message Get2faStatusRequest {
     string username = 1;
 }
 
-message GetProfileRequest {
-    string user_id = 1;
-}
+message GetProfileRequest {
+    string user_id = 1;
+}
+
+message ResetUserTwoFactorRequest {
+    string target_user_id = 1;
+    string admin_id = 2;
+    string reason = 3;
+}
 
 // ---------------------------------------------------------------------------
 // Responses
@@ -176,10 +185,16 @@ message LogoutAllRequest {
     string refresh_token = 2;
 }
 
-message LogoutResponse {
-    bool ok = 1;
-    int32 removed = 2; // number of refresh-token rows deleted
-}
+message LogoutResponse {
+    bool ok = 1;
+    int32 removed = 2; // number of refresh-token rows deleted
+}
+
+message ResetUserTwoFactorResponse {
+    bool ok = 1;
+    TwoFactorType previous_type = 2;
+    int32 revoked_sessions = 3;
+}
 
 message RestoreLoginRequest {
     string credentials = 1; // email or username