syntax = "proto3";

package nexuscrm.runtime.v1;

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// FederatedLoginTransaction exposes the app-blind, pre-session transaction
// used to bind a browser federated-login redirect to one expiring state.
// Provider exchange and public HTTP request/response shapes remain L1-owned.
service FederatedLoginTransactionService {
  rpc BeginFederatedLogin(BeginFederatedLoginRequest) returns (BeginFederatedLoginResponse);
  rpc ConsumeFederatedLogin(ConsumeFederatedLoginRequest) returns (ConsumeFederatedLoginResponse);
}

message BeginFederatedLoginRequest {
  string app_installation_id = 1;
  string redirect_uri = 2;
}

message BeginFederatedLoginResponse {
  string state = 1;
  int64 expires_at_unix_second = 2;
}

message ConsumeFederatedLoginRequest {
  string app_installation_id = 1;
  string state = 2;
  string redirect_uri = 3;
}

message ConsumeFederatedLoginResponse {}