syntax = "proto3";

package auth;

option go_package = "ai_service/proto/l-ai-core-proto;proto";

// AuthService handles OAuth authentication and JWT token management.
// It is the single auth authority for all services in the platform.
service AuthService {
  // Telegram Login Widget — verify widget callback data and return JWT tokens
  rpc AuthWithTelegram(TelegramAuthRequest) returns (AuthResponse);

  // Telegram new Login (id_token JWT) — verify JWT and return platform tokens
  rpc AuthWithTelegramToken(TelegramTokenRequest) returns (AuthResponse);

  // Discord OAuth — generate redirect URL (state stored server-side)
  rpc GetDiscordOAuthURL(GetDiscordOAuthURLRequest) returns (OAuthURLResponse);

  // Discord OAuth — exchange authorization code for JWT tokens
  rpc ExchangeDiscordCode(DiscordExchangeRequest) returns (AuthResponse);

  // Steam OpenID 2.0 — generate redirect URL (state stored server-side)
  rpc GetSteamAuthURL(GetSteamAuthURLRequest) returns (OAuthURLResponse);

  // Steam OpenID 2.0 — verify OpenID assertion and return JWT tokens
  rpc ExchangeSteamLogin(SteamExchangeRequest) returns (AuthResponse);

  // VK OAuth — generate redirect URL (state stored server-side)
  rpc GetVKOAuthURL(GetVKOAuthURLRequest) returns (OAuthURLResponse);

  // VK OAuth — exchange authorization code for JWT tokens
  rpc ExchangeVKCode(VKExchangeRequest) returns (AuthResponse);

  // Issue new token pair from a valid refresh token
  rpc RefreshToken(RefreshTokenRequest) returns (AuthResponse);

  // Revoke a token (add to blacklist)
  rpc RevokeToken(RevokeTokenRequest) returns (RevokeTokenResponse);

  // Validate a token and return its claims (optional — services can validate locally)
  rpc ValidateToken(ValidateTokenRequest) returns (ValidateTokenResponse);
}

// TelegramTokenRequest contains the id_token JWT from the new Telegram Login
message TelegramTokenRequest {
  string id_token = 1;
}

// TelegramAuthRequest contains the data sent by the Telegram Login Widget
message TelegramAuthRequest {
  int64  id         = 1;
  string first_name = 2;
  string last_name  = 3;
  string username   = 4;
  string photo_url  = 5;
  int64  auth_date  = 6;
  string hash       = 7;
}

// GetDiscordOAuthURLRequest — caller provides the redirect_uri for their service
message GetDiscordOAuthURLRequest {
  string redirect_uri = 1;
}

// OAuthURLResponse returns the full OAuth redirect URL including state
message OAuthURLResponse {
  string url   = 1;
  string state = 2;
}

// DiscordExchangeRequest — exchange code received in Discord callback
message DiscordExchangeRequest {
  string code         = 1;
  string state        = 2;
  string redirect_uri = 3;
}

// GetSteamAuthURLRequest — caller provides the redirect_uri for their service
message GetSteamAuthURLRequest {
  string redirect_uri = 1;
}

// SteamExchangeRequest — all OpenID 2.0 params received in the Steam callback
message SteamExchangeRequest {
  string              state        = 1;
  map<string, string> openid_params = 2;
}

// GetVKOAuthURLRequest — caller provides the redirect_uri for their service
message GetVKOAuthURLRequest {
  string redirect_uri = 1;
}

// VKExchangeRequest — exchange code received in VK callback
message VKExchangeRequest {
  string code         = 1;
  string state        = 2;
  string redirect_uri = 3;
}

// AuthResponse is returned after successful authentication
message AuthResponse {
  string access_token   = 1;
  string refresh_token  = 2;
  int64  global_user_id = 3;
  string display_name   = 4;
  int64  expires_at     = 5; // unix timestamp of access token expiry
}

message RefreshTokenRequest {
  string refresh_token = 1;
}

message RevokeTokenRequest {
  string token = 1;
}

message RevokeTokenResponse {
  bool success = 1;
}

message ValidateTokenRequest {
  string token = 1;
}

message ValidateTokenResponse {
  bool            valid             = 1;
  int64           global_user_id    = 2;
  string          display_name      = 3;
  repeated string linked_platforms  = 4;
}