syntax = "proto3";

package nexuscrm.runtime.v1;

import "common/v1/common.proto";

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// ConnectedMailboxAuthorizationService exposes one narrow Runtime permission
// use case to an admitted Integration workload. Org, user, session and workload
// identity are supplied by trusted delegation, not caller-selected fields.
service ConnectedMailboxAuthorizationService {
  rpc AuthorizeConnectedMailbox(AuthorizeConnectedMailboxRequest) returns (AuthorizeConnectedMailboxResponse);
  // ReauthorizeConnectedMailbox consumes a Runtime-minted opaque handle from
  // BEGIN, allowing a provider-facing callback to re-admit current authority
  // without a browser cookie or caller-selected subject.
  rpc ReauthorizeConnectedMailbox(ReauthorizeConnectedMailboxRequest) returns (ReauthorizeConnectedMailboxResponse);
}

enum ConnectedMailboxOperation {
  CONNECTED_MAILBOX_OPERATION_UNSPECIFIED = 0;
  CONNECTED_MAILBOX_OPERATION_STATUS = 1;
  CONNECTED_MAILBOX_OPERATION_BEGIN = 2;
  CONNECTED_MAILBOX_OPERATION_DISCONNECT = 3;
}

message AuthorizeConnectedMailboxRequest {
  ConnectedMailboxOperation operation = 1;
  optional uint64 min_catalog_revision = 2;
}

message AuthorizeConnectedMailboxResponse {
  string authorized_subject_id = 1;
  nexuscrm.common.v1.ConsistencyReceipts receipts = 2;
  // Present only after a delegated BEGIN. It is opaque to Integration and
  // one-time input to ReauthorizeConnectedMailbox.
  string reauthorization_handle = 3;
}

message ReauthorizeConnectedMailboxRequest {
  string reauthorization_handle = 1;
  optional uint64 min_catalog_revision = 2;
}

message ReauthorizeConnectedMailboxResponse {
  string authorized_subject_id = 1;
  nexuscrm.common.v1.ConsistencyReceipts receipts = 2;
}