89 lines
2.5 KiB
Protocol Buffer
89 lines
2.5 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package auth;
|
|
|
|
option go_package = "ai_service/proto/l-ai-core-proto;proto";
|
|
|
|
// AuthService handles OAuth authentication and JWT token management.
|
|
// It is the single auth authority for all services in the platform.
|
|
service AuthService {
|
|
// Telegram Login Widget — verify widget callback data and return JWT tokens
|
|
rpc AuthWithTelegram(TelegramAuthRequest) returns (AuthResponse);
|
|
|
|
// Discord OAuth — generate redirect URL (state stored server-side)
|
|
rpc GetDiscordOAuthURL(GetDiscordOAuthURLRequest) returns (OAuthURLResponse);
|
|
|
|
// Discord OAuth — exchange authorization code for JWT tokens
|
|
rpc ExchangeDiscordCode(DiscordExchangeRequest) returns (AuthResponse);
|
|
|
|
// Issue new token pair from a valid refresh token
|
|
rpc RefreshToken(RefreshTokenRequest) returns (AuthResponse);
|
|
|
|
// Revoke a token (add to blacklist)
|
|
rpc RevokeToken(RevokeTokenRequest) returns (RevokeTokenResponse);
|
|
|
|
// Validate a token and return its claims (optional — services can validate locally)
|
|
rpc ValidateToken(ValidateTokenRequest) returns (ValidateTokenResponse);
|
|
}
|
|
|
|
// TelegramAuthRequest contains the data sent by the Telegram Login Widget
|
|
message TelegramAuthRequest {
|
|
int64 id = 1;
|
|
string first_name = 2;
|
|
string last_name = 3;
|
|
string username = 4;
|
|
string photo_url = 5;
|
|
int64 auth_date = 6;
|
|
string hash = 7;
|
|
}
|
|
|
|
// GetDiscordOAuthURLRequest — caller provides the redirect_uri for their service
|
|
message GetDiscordOAuthURLRequest {
|
|
string redirect_uri = 1;
|
|
}
|
|
|
|
// OAuthURLResponse returns the full OAuth redirect URL including state
|
|
message OAuthURLResponse {
|
|
string url = 1;
|
|
string state = 2;
|
|
}
|
|
|
|
// DiscordExchangeRequest — exchange code received in Discord callback
|
|
message DiscordExchangeRequest {
|
|
string code = 1;
|
|
string state = 2;
|
|
string redirect_uri = 3;
|
|
}
|
|
|
|
// AuthResponse is returned after successful authentication
|
|
message AuthResponse {
|
|
string access_token = 1;
|
|
string refresh_token = 2;
|
|
int64 global_user_id = 3;
|
|
string display_name = 4;
|
|
int64 expires_at = 5; // unix timestamp of access token expiry
|
|
}
|
|
|
|
message RefreshTokenRequest {
|
|
string refresh_token = 1;
|
|
}
|
|
|
|
message RevokeTokenRequest {
|
|
string token = 1;
|
|
}
|
|
|
|
message RevokeTokenResponse {
|
|
bool success = 1;
|
|
}
|
|
|
|
message ValidateTokenRequest {
|
|
string token = 1;
|
|
}
|
|
|
|
message ValidateTokenResponse {
|
|
bool valid = 1;
|
|
int64 global_user_id = 2;
|
|
string display_name = 3;
|
|
repeated string linked_platforms = 4;
|
|
}
|