syntax = "proto3";

package nexuscrm.runtime.v1;

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// AuthorizationLifecycle exposes one coarse, app-blind authorization journey
// on the existing private Runtime endpoint. OAuth HTTP semantics remain owned
// by L1. Access and refresh tokens and presented exchange credentials are
// transport-only and deliberately absent from these messages. Machine-
// principal identity is resolved by Runtime from registered-client authority;
// no caller-selected Run As User enters this contract.
service AuthorizationLifecycleService {
  rpc BeginAuthorization(BeginAuthorizationRequest) returns (BeginAuthorizationResponse);
  rpc CompleteAuthorization(CompleteAuthorizationRequest) returns (CompleteAuthorizationResponse);
  rpc ExchangeAuthorizationToken(ExchangeAuthorizationTokenRequest) returns (ExchangeAuthorizationTokenResponse);
}

message AuthorizationProtocolError {
  string code = 1;
  string safe_description = 2;
  reserved 3;
  string trusted_redirect_uri = 4;
  string state = 5;
}

message BeginAuthorizationRequest {
  string app_installation_id = 1;
  string client_id = 2;
  string redirect_uri = 3;
  string response_type = 4;
  string scope = 5;
  string state = 6;
  string code_challenge = 7;
  string code_challenge_method = 8;
  string issuer = 9;
  string resource = 10;
  bool resource_present = 11;
}

message BeginAuthorizationResponse {
  string request_handle = 1;
  int64 expires_at_unix_second = 2;
  AuthorizationProtocolError protocol_error = 3;
}

message CompleteAuthorizationRequest {
  string app_installation_id = 1;
  string request_handle = 2;
}

message CompleteAuthorizationResponse {
  reserved 1;
  string redirect_uri = 2;
  string state = 3;
  AuthorizationProtocolError protocol_error = 4;
  bool authorization_code_issued = 5;
}

enum AuthorizationGrantType {
  AUTHORIZATION_GRANT_TYPE_UNSPECIFIED = 0;
  AUTHORIZATION_GRANT_TYPE_AUTHORIZATION_CODE = 1;
  AUTHORIZATION_GRANT_TYPE_REFRESH_TOKEN = 2;
  AUTHORIZATION_GRANT_TYPE_CLIENT_CREDENTIALS = 3;
}

message ExchangeAuthorizationTokenRequest {
  string app_installation_id = 1;
  AuthorizationGrantType grant_type = 2;
  string client_id = 3;
  string redirect_uri = 4;
  string requested_scope = 5;
  string issuer = 6;
  string resource = 7;
  bool resource_present = 8;
}

message AuthorizationTokenView {
  string token_type = 1;
  int64 expires_in_second = 2;
  reserved 3, 4, 5, 6;
  string scope = 7;
  bool access_token_issued = 8;
  bool refresh_token_issued = 9;
}

message ExchangeAuthorizationTokenResponse {
  AuthorizationTokenView token = 1;
  AuthorizationProtocolError protocol_error = 2;
}