syntax = "proto3";

package nexuscrm.runtime.v1;

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// SessionLifecycle is the Runtime-owned identity/session authority used by an
// authenticated L1 workload. Raw login credentials, access tokens, replacement
// tokens, and browser control proofs are transport credentials and are
// deliberately absent from these messages.
service SessionLifecycleService {
  rpc CreateSession(CreateSessionRequest) returns (CreateSessionResponse);
  rpc ReadSession(ReadSessionRequest) returns (ReadSessionResponse);
  rpc RevokeSession(RevokeSessionRequest) returns (RevokeSessionResponse);
}

enum SessionAuthenticationMethod {
  SESSION_AUTHENTICATION_METHOD_UNSPECIFIED = 0;
  SESSION_AUTHENTICATION_METHOD_PASSWORD = 1;
  SESSION_AUTHENTICATION_METHOD_FEDERATED_ID_TOKEN = 2;
}

message CreateSessionRequest {
  string app_installation_id = 1;
  SessionAuthenticationMethod method = 2;
  string application_client_id = 3;
  string requested_scope = 4;
  string federated_provider_id = 5;
  string source_address = 6;
  string user_agent = 7;
  bool issue_control_proof = 8;
}

message SessionPrincipal {
  string principal_id = 1;
  string display_name = 2;
  string email = 3;
  string profile_id = 4;
  string role_id = 5;
}

message SessionView {
  SessionPrincipal principal = 1;
  int64 expires_at_unix_second = 2;
}

message CreateSessionResponse {
  SessionView session = 1;
  bool access_token_issued = 2;
  bool control_proof_issued = 3;
}

message SessionDocumentLinkRoute {
  string link = 1;
  string method = 2;
  string path = 3;
}

message SessionDocumentPolicyRequest {
  string route_family_prefix = 1;
  repeated SessionDocumentLinkRoute link_routes = 2;
}

message SessionDocumentPolicy {
  bool restricted = 1;
  repeated string allowed_links = 2;
  int64 hourly_limit = 3;
  int64 daily_limit = 4;
}

message ReadSessionRequest {
  SessionDocumentPolicyRequest document_policy = 4;
  string app_installation_id = 1;
  bool allow_renewal = 2;
  bool use_control_proof = 3;
}

message ReadSessionResponse {
  SessionDocumentPolicy document_policy = 4;
  SessionView session = 1;
  bool replacement_access_token_issued = 2;
  int64 control_proof_expires_at_unix_second = 3;
}

message RevokeSessionRequest {
  string app_installation_id = 1;
  bool use_control_proof = 2;
}

message RevokeSessionResponse {}