@aepstore-dev/contracts 1.99.0 → 1.101.0

package/gen/auth.d.ts

@@ -38,6 +38,7 @@ export interface CreateCodeRequest {
 /**
  * type ∈ { twofa, twofa_activate, twofa_deactivate, reset, totp, totp_activate,
  *          totp_deactivate, backup, regenerate_backup, confirm }
+ * regenerate_backup expects a current TOTP code, not an existing backup code.
  * new_password is only used by the 'reset' flow.
  */
 export interface VerifyCodeRequest {
@@ -72,6 +73,42 @@ export interface Get2faStatusRequest {
 export interface GetProfileRequest {
     userId: string;
 }
+export interface ResetUserTwoFactorRequest {
+    targetUserId: string;
+    adminId: string;
+    reason: string;
+}
+export interface GeneratePasskeyRegistrationOptionsRequest {
+    userId: string;
+}
+export interface VerifyPasskeyRegistrationRequest {
+    userId: string;
+    challengeId: string;
+    /** Raw JSON returned by @simplewebauthn/browser startRegistration(). */
+    responseJson: string;
+    name: string;
+}
+export interface ListPasskeysRequest {
+    userId: string;
+}
+export interface DeletePasskeyRequest {
+    userId: string;
+    passkeyId: string;
+}
+export interface GeneratePasskeyAuthenticationOptionsRequest {
+    /**
+     * Username or email. V1 requires an existing account identifier and does
+     * not implement passkey-first/account-discovery registration.
+     */
+    credentials: string;
+}
+export interface VerifyPasskeyAuthenticationRequest {
+    challengeId: string;
+    /** Raw JSON returned by @simplewebauthn/browser startAuthentication(). */
+    responseJson: string;
+    userAgent: string;
+    ip: string;
+}
 export interface AuthUser {
     id: string;
     username: string;
@@ -139,6 +176,35 @@ export interface LogoutResponse {
     /** number of refresh-token rows deleted */
     removed: number;
 }
+export interface ResetUserTwoFactorResponse {
+    ok: boolean;
+    previousType: TwoFactorType;
+    revokedSessions: number;
+}
+export interface PasskeyOptionsResponse {
+    /** PublicKeyCredentialCreationOptionsJSON or PublicKeyCredentialRequestOptionsJSON. */
+    optionsJson: string;
+    challengeId: string;
+}
+export interface PasskeyInfo {
+    id: string;
+    name: string;
+    createdAt: string;
+    lastUsedAt: string;
+    deviceType: string;
+    backedUp: boolean;
+    transports: string[];
+}
+export interface PasskeyRegistrationResponse {
+    ok: boolean;
+    passkey: PasskeyInfo | undefined;
+}
+export interface ListPasskeysResponse {
+    items: PasskeyInfo[];
+}
+export interface DeletePasskeyResponse {
+    ok: boolean;
+}
 export interface RestoreLoginRequest {
     /** email or username */
     credentials: string;
@@ -186,6 +252,13 @@ export interface AuthServiceClient {
     get2FaStatus(request: Get2faStatusRequest): Observable<TwoFactorStatusResponse>;
     getProfile(request: GetProfileRequest): Observable<AuthUser>;
     cleanupExpiredTotpSetups(request: Empty): Observable<Empty>;
+    resetUserTwoFactor(request: ResetUserTwoFactorRequest): Observable<ResetUserTwoFactorResponse>;
+    generatePasskeyRegistrationOptions(request: GeneratePasskeyRegistrationOptionsRequest): Observable<PasskeyOptionsResponse>;
+    verifyPasskeyRegistration(request: VerifyPasskeyRegistrationRequest): Observable<PasskeyRegistrationResponse>;
+    listPasskeys(request: ListPasskeysRequest): Observable<ListPasskeysResponse>;
+    deletePasskey(request: DeletePasskeyRequest): Observable<DeletePasskeyResponse>;
+    generatePasskeyAuthenticationOptions(request: GeneratePasskeyAuthenticationOptionsRequest): Observable<PasskeyOptionsResponse>;
+    verifyPasskeyAuthentication(request: VerifyPasskeyAuthenticationRequest): Observable<AuthResult>;
     /**
      * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
      * HMAC matches; LogoutAll wipes every row for the user.
@@ -222,6 +295,13 @@ export interface AuthServiceController {
     get2FaStatus(request: Get2faStatusRequest): Promise<TwoFactorStatusResponse> | Observable<TwoFactorStatusResponse> | TwoFactorStatusResponse;
     getProfile(request: GetProfileRequest): Promise<AuthUser> | Observable<AuthUser> | AuthUser;
     cleanupExpiredTotpSetups(request: Empty): Promise<Empty> | Observable<Empty> | Empty;
+    resetUserTwoFactor(request: ResetUserTwoFactorRequest): Promise<ResetUserTwoFactorResponse> | Observable<ResetUserTwoFactorResponse> | ResetUserTwoFactorResponse;
+    generatePasskeyRegistrationOptions(request: GeneratePasskeyRegistrationOptionsRequest): Promise<PasskeyOptionsResponse> | Observable<PasskeyOptionsResponse> | PasskeyOptionsResponse;
+    verifyPasskeyRegistration(request: VerifyPasskeyRegistrationRequest): Promise<PasskeyRegistrationResponse> | Observable<PasskeyRegistrationResponse> | PasskeyRegistrationResponse;
+    listPasskeys(request: ListPasskeysRequest): Promise<ListPasskeysResponse> | Observable<ListPasskeysResponse> | ListPasskeysResponse;
+    deletePasskey(request: DeletePasskeyRequest): Promise<DeletePasskeyResponse> | Observable<DeletePasskeyResponse> | DeletePasskeyResponse;
+    generatePasskeyAuthenticationOptions(request: GeneratePasskeyAuthenticationOptionsRequest): Promise<PasskeyOptionsResponse> | Observable<PasskeyOptionsResponse> | PasskeyOptionsResponse;
+    verifyPasskeyAuthentication(request: VerifyPasskeyAuthenticationRequest): Promise<AuthResult> | Observable<AuthResult> | AuthResult;
     /**
      * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
      * HMAC matches; LogoutAll wipes every row for the user.

package/gen/auth.js

@@ -30,6 +30,13 @@ function AuthServiceControllerMethods() {
             "get2FaStatus",
             "getProfile",
             "cleanupExpiredTotpSetups",
+            "resetUserTwoFactor",
+            "generatePasskeyRegistrationOptions",
+            "verifyPasskeyRegistration",
+            "listPasskeys",
+            "deletePasskey",
+            "generatePasskeyAuthenticationOptions",
+            "verifyPasskeyAuthentication",
             "logoutCurrent",
             "logoutAll",
             "restoreLogin",

package/gen/auth.ts

@@ -52,6 +52,7 @@ export interface CreateCodeRequest {
 /**
  * type ∈ { twofa, twofa_activate, twofa_deactivate, reset, totp, totp_activate,
  *          totp_deactivate, backup, regenerate_backup, confirm }
+ * regenerate_backup expects a current TOTP code, not an existing backup code.
  * new_password is only used by the 'reset' flow.
  */
 export interface VerifyCodeRequest {
@@ -91,6 +92,49 @@ export interface GetProfileRequest {
   userId: string;
 }
 
+export interface ResetUserTwoFactorRequest {
+  targetUserId: string;
+  adminId: string;
+  reason: string;
+}
+
+export interface GeneratePasskeyRegistrationOptionsRequest {
+  userId: string;
+}
+
+export interface VerifyPasskeyRegistrationRequest {
+  userId: string;
+  challengeId: string;
+  /** Raw JSON returned by @simplewebauthn/browser startRegistration(). */
+  responseJson: string;
+  name: string;
+}
+
+export interface ListPasskeysRequest {
+  userId: string;
+}
+
+export interface DeletePasskeyRequest {
+  userId: string;
+  passkeyId: string;
+}
+
+export interface GeneratePasskeyAuthenticationOptionsRequest {
+  /**
+   * Username or email. V1 requires an existing account identifier and does
+   * not implement passkey-first/account-discovery registration.
+   */
+  credentials: string;
+}
+
+export interface VerifyPasskeyAuthenticationRequest {
+  challengeId: string;
+  /** Raw JSON returned by @simplewebauthn/browser startAuthentication(). */
+  responseJson: string;
+  userAgent: string;
+  ip: string;
+}
+
 export interface AuthUser {
   id: string;
   username: string;
@@ -165,6 +209,41 @@ export interface LogoutResponse {
   removed: number;
 }
 
+export interface ResetUserTwoFactorResponse {
+  ok: boolean;
+  previousType: TwoFactorType;
+  revokedSessions: number;
+}
+
+export interface PasskeyOptionsResponse {
+  /** PublicKeyCredentialCreationOptionsJSON or PublicKeyCredentialRequestOptionsJSON. */
+  optionsJson: string;
+  challengeId: string;
+}
+
+export interface PasskeyInfo {
+  id: string;
+  name: string;
+  createdAt: string;
+  lastUsedAt: string;
+  deviceType: string;
+  backedUp: boolean;
+  transports: string[];
+}
+
+export interface PasskeyRegistrationResponse {
+  ok: boolean;
+  passkey: PasskeyInfo | undefined;
+}
+
+export interface ListPasskeysResponse {
+  items: PasskeyInfo[];
+}
+
+export interface DeletePasskeyResponse {
+  ok: boolean;
+}
+
 export interface RestoreLoginRequest {
   /** email or username */
   credentials: string;
@@ -227,6 +306,24 @@ export interface AuthServiceClient {
 
   cleanupExpiredTotpSetups(request: Empty): Observable<Empty>;
 
+  resetUserTwoFactor(request: ResetUserTwoFactorRequest): Observable<ResetUserTwoFactorResponse>;
+
+  generatePasskeyRegistrationOptions(
+    request: GeneratePasskeyRegistrationOptionsRequest,
+  ): Observable<PasskeyOptionsResponse>;
+
+  verifyPasskeyRegistration(request: VerifyPasskeyRegistrationRequest): Observable<PasskeyRegistrationResponse>;
+
+  listPasskeys(request: ListPasskeysRequest): Observable<ListPasskeysResponse>;
+
+  deletePasskey(request: DeletePasskeyRequest): Observable<DeletePasskeyResponse>;
+
+  generatePasskeyAuthenticationOptions(
+    request: GeneratePasskeyAuthenticationOptionsRequest,
+  ): Observable<PasskeyOptionsResponse>;
+
+  verifyPasskeyAuthentication(request: VerifyPasskeyAuthenticationRequest): Observable<AuthResult>;
+
   /**
    * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
    * HMAC matches; LogoutAll wipes every row for the user.
@@ -282,6 +379,34 @@ export interface AuthServiceController {
 
   cleanupExpiredTotpSetups(request: Empty): Promise<Empty> | Observable<Empty> | Empty;
 
+  resetUserTwoFactor(
+    request: ResetUserTwoFactorRequest,
+  ): Promise<ResetUserTwoFactorResponse> | Observable<ResetUserTwoFactorResponse> | ResetUserTwoFactorResponse;
+
+  generatePasskeyRegistrationOptions(
+    request: GeneratePasskeyRegistrationOptionsRequest,
+  ): Promise<PasskeyOptionsResponse> | Observable<PasskeyOptionsResponse> | PasskeyOptionsResponse;
+
+  verifyPasskeyRegistration(
+    request: VerifyPasskeyRegistrationRequest,
+  ): Promise<PasskeyRegistrationResponse> | Observable<PasskeyRegistrationResponse> | PasskeyRegistrationResponse;
+
+  listPasskeys(
+    request: ListPasskeysRequest,
+  ): Promise<ListPasskeysResponse> | Observable<ListPasskeysResponse> | ListPasskeysResponse;
+
+  deletePasskey(
+    request: DeletePasskeyRequest,
+  ): Promise<DeletePasskeyResponse> | Observable<DeletePasskeyResponse> | DeletePasskeyResponse;
+
+  generatePasskeyAuthenticationOptions(
+    request: GeneratePasskeyAuthenticationOptionsRequest,
+  ): Promise<PasskeyOptionsResponse> | Observable<PasskeyOptionsResponse> | PasskeyOptionsResponse;
+
+  verifyPasskeyAuthentication(
+    request: VerifyPasskeyAuthenticationRequest,
+  ): Promise<AuthResult> | Observable<AuthResult> | AuthResult;
+
   /**
    * Logout — kill refresh tokens. LogoutCurrent kills only the one whose
    * HMAC matches; LogoutAll wipes every row for the user.
@@ -321,6 +446,13 @@ export function AuthServiceControllerMethods() {
       "get2FaStatus",
       "getProfile",
       "cleanupExpiredTotpSetups",
+      "resetUserTwoFactor",
+      "generatePasskeyRegistrationOptions",
+      "verifyPasskeyRegistration",
+      "listPasskeys",
+      "deletePasskey",
+      "generatePasskeyAuthenticationOptions",
+      "verifyPasskeyAuthentication",
       "logoutCurrent",
       "logoutAll",
       "restoreLogin",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aepstore-dev/contracts",
-  "version": "1.99.0",
+  "version": "1.101.0",
   "description": "Protobuf definitions for aepstore microservices",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/proto/auth.proto

@@ -15,9 +15,16 @@ service AuthService {
     rpc VerifyCode(VerifyCodeRequest) returns (AuthResult);
     rpc CheckToken(CheckTokenRequest) returns (AuthUser);
     rpc RefreshToken(RefreshTokenRequest) returns (AuthResult);
-    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
-    rpc GetProfile(GetProfileRequest) returns (AuthUser);
-    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
+    rpc Get2faStatus(Get2faStatusRequest) returns (TwoFactorStatusResponse);
+    rpc GetProfile(GetProfileRequest) returns (AuthUser);
+    rpc CleanupExpiredTotpSetups(Empty) returns (Empty);
+    rpc ResetUserTwoFactor(ResetUserTwoFactorRequest) returns (ResetUserTwoFactorResponse);
+    rpc GeneratePasskeyRegistrationOptions(GeneratePasskeyRegistrationOptionsRequest) returns (PasskeyOptionsResponse);
+    rpc VerifyPasskeyRegistration(VerifyPasskeyRegistrationRequest) returns (PasskeyRegistrationResponse);
+    rpc ListPasskeys(ListPasskeysRequest) returns (ListPasskeysResponse);
+    rpc DeletePasskey(DeletePasskeyRequest) returns (DeletePasskeyResponse);
+    rpc GeneratePasskeyAuthenticationOptions(GeneratePasskeyAuthenticationOptionsRequest) returns (PasskeyOptionsResponse);
+    rpc VerifyPasskeyAuthentication(VerifyPasskeyAuthenticationRequest) returns (AuthResult);
 
     // Logout — kill refresh tokens. LogoutCurrent kills only the one whose
     // HMAC matches; LogoutAll wipes every row for the user.
@@ -73,6 +80,7 @@ message CreateCodeRequest {
 
 // type ∈ { twofa, twofa_activate, twofa_deactivate, reset, totp, totp_activate,
 //          totp_deactivate, backup, regenerate_backup, confirm }
+// regenerate_backup expects a current TOTP code, not an existing backup code.
 // new_password is only used by the 'reset' flow.
 message VerifyCodeRequest {
     string email = 1;
@@ -102,9 +110,50 @@ message Get2faStatusRequest {
     string username = 1;
 }
 
-message GetProfileRequest {
-    string user_id = 1;
-}
+message GetProfileRequest {
+    string user_id = 1;
+}
+
+message ResetUserTwoFactorRequest {
+    string target_user_id = 1;
+    string admin_id = 2;
+    string reason = 3;
+}
+
+message GeneratePasskeyRegistrationOptionsRequest {
+    string user_id = 1;
+}
+
+message VerifyPasskeyRegistrationRequest {
+    string user_id = 1;
+    string challenge_id = 2;
+    // Raw JSON returned by @simplewebauthn/browser startRegistration().
+    string response_json = 3;
+    string name = 4;
+}
+
+message ListPasskeysRequest {
+    string user_id = 1;
+}
+
+message DeletePasskeyRequest {
+    string user_id = 1;
+    string passkey_id = 2;
+}
+
+message GeneratePasskeyAuthenticationOptionsRequest {
+    // Username or email. V1 requires an existing account identifier and does
+    // not implement passkey-first/account-discovery registration.
+    string credentials = 1;
+}
+
+message VerifyPasskeyAuthenticationRequest {
+    string challenge_id = 1;
+    // Raw JSON returned by @simplewebauthn/browser startAuthentication().
+    string response_json = 2;
+    string user_agent = 3;
+    string ip = 4;
+}
 
 // ---------------------------------------------------------------------------
 // Responses
@@ -177,10 +226,45 @@ message LogoutAllRequest {
     string refresh_token = 2;
 }
 
-message LogoutResponse {
-    bool ok = 1;
-    int32 removed = 2; // number of refresh-token rows deleted
-}
+message LogoutResponse {
+    bool ok = 1;
+    int32 removed = 2; // number of refresh-token rows deleted
+}
+
+message ResetUserTwoFactorResponse {
+    bool ok = 1;
+    TwoFactorType previous_type = 2;
+    int32 revoked_sessions = 3;
+}
+
+message PasskeyOptionsResponse {
+    // PublicKeyCredentialCreationOptionsJSON or PublicKeyCredentialRequestOptionsJSON.
+    string options_json = 1;
+    string challenge_id = 2;
+}
+
+message PasskeyInfo {
+    string id = 1;
+    string name = 2;
+    string created_at = 3;
+    string last_used_at = 4;
+    string device_type = 5;
+    bool backed_up = 6;
+    repeated string transports = 7;
+}
+
+message PasskeyRegistrationResponse {
+    bool ok = 1;
+    PasskeyInfo passkey = 2;
+}
+
+message ListPasskeysResponse {
+    repeated PasskeyInfo items = 1;
+}
+
+message DeletePasskeyResponse {
+    bool ok = 1;
+}
 
 message RestoreLoginRequest {
     string credentials = 1; // email or username