Skip to content

Commit a85bf86

Browse files
leogenius360leogenius360
committed
Add accounts package and authentication proto definitions
1 parent df0e050 commit a85bf86

File tree

9 files changed

+689
-42
lines changed

9 files changed

+689
-42
lines changed

‎Cargo.lock‎

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[workspace]
2-
members = ["shared", "storage-adapter"]
2+
members = [ "accounts","shared", "storage-adapter"]
33
resolver = "3"
44

55
[workspace.package]

‎accounts/Cargo.toml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[package]
2+
name = "accounts"
3+
version.workspace = true
4+
edition.workspace = true
5+
authors.workspace = true
6+
license.workspace = true
7+
repository.workspace = true
8+
9+
[dependencies]
10+
11+
[lints]
12+
workspace = true

‎accounts/protobuf/auth.proto‎

Lines changed: 312 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,312 @@
1+
syntax = "proto3";
2+
3+
package geniustechspace.accounts.auth.v1;
4+
5+
import "google/protobuf/timestamp.proto";
6+
import "geniustechspace/shared/protobuf/audit.proto";
7+
8+
// AuthCredential represents authentication credentials for a user
9+
// Supports multiple auth providers (local, OAuth, SAML, etc.)
10+
message AuthCredential {
11+
// Unique identifier for this auth credential (UUID format)
12+
string id = 1;
13+
14+
// Reference to the user this credential belongs to
15+
string user_id = 2;
16+
17+
// Authentication provider type
18+
AuthProvider provider = 3;
19+
20+
// Unique identifier from the provider's perspective
21+
// For local: email/phone/username
22+
// For OAuth: provider's user ID (e.g., Google sub, GitHub ID)
23+
string provider_user_id = 4;
24+
25+
// Password hash (only for local provider)
26+
// Should be empty for OAuth/social providers
27+
string password_hash = 5;
28+
29+
// Provider-specific metadata (tokens, otp, totp, etc.)
30+
map<string, string> provider_metadata = 6;
31+
32+
// Credential status
33+
AuthCredentialStatus status = 7;
34+
string status_reason = 8;
35+
36+
// Security tracking
37+
google.protobuf.Timestamp last_used_at = 9;
38+
string last_used_ip = 10;
39+
int32 failed_attempts = 11;
40+
google.protobuf.Timestamp locked_until = 12;
41+
42+
// Verification status
43+
bool verified = 13;
44+
google.protobuf.Timestamp verified_at = 14;
45+
46+
// Audit fields
47+
google.protobuf.Timestamp created_at = 15;
48+
google.protobuf.Timestamp updated_at = 16;
49+
google.protobuf.Timestamp deleted_at = 17;
50+
51+
// Version control
52+
int64 version = 18;
53+
}
54+
55+
// AuthProvider defines supported authentication providers
56+
enum AuthProvider {
57+
AUTH_PROVIDER_UNSPECIFIED = 0;
58+
AUTH_PROVIDER_LOCAL = 1; // Email/password or phone/password
59+
AUTH_PROVIDER_GOOGLE = 2; // Google OAuth
60+
AUTH_PROVIDER_APPLE = 3; // Apple Sign In
61+
AUTH_PROVIDER_GITHUB = 4; // GitHub OAuth
62+
AUTH_PROVIDER_FACEBOOK = 5; // Facebook OAuth
63+
AUTH_PROVIDER_MICROSOFT = 6; // Microsoft OAuth
64+
AUTH_PROVIDER_TWITTER = 7; // Twitter/X OAuth
65+
AUTH_PROVIDER_SAML = 8; // SAML SSO
66+
AUTH_PROVIDER_LDAP = 9; // LDAP/Active Directory
67+
AUTH_PROVIDER_MAGIC_LINK = 10; // Passwordless magic link
68+
AUTH_PROVIDER_WEBAUTHN = 11; // WebAuthn/FIDO2
69+
AUTH_PROVIDER_OTP = 12; // One-Time Password
70+
}
71+
72+
// AuthCredentialStatus defines the state of an auth credential
73+
enum AuthCredentialStatus {
74+
AUTH_CREDENTIAL_STATUS_UNSPECIFIED = 0;
75+
AUTH_CREDENTIAL_STATUS_ACTIVE = 1; // Credential is active and usable
76+
AUTH_CREDENTIAL_STATUS_INACTIVE = 2; // Temporarily disabled
77+
AUTH_CREDENTIAL_STATUS_LOCKED = 3; // Locked due to failed attempts
78+
AUTH_CREDENTIAL_STATUS_EXPIRED = 4; // Credential has expired
79+
AUTH_CREDENTIAL_STATUS_REVOKED = 5; // Explicitly revoked
80+
AUTH_CREDENTIAL_STATUS_PENDING = 6; // Awaiting verification
81+
}
82+
83+
// Session represents an authenticated user session
84+
message Session {
85+
// Unique session identifier (UUID format)
86+
string id = 1;
87+
88+
// User and credential references
89+
string user_id = 2;
90+
string auth_credential_id = 3;
91+
92+
// Session tokens
93+
string access_token = 4;
94+
string refresh_token = 5;
95+
96+
// Token expiry
97+
google.protobuf.Timestamp access_token_expires_at = 6;
98+
google.protobuf.Timestamp refresh_token_expires_at = 7;
99+
100+
// Session metadata
101+
string device_id = 8;
102+
string device_name = 9;
103+
string user_agent = 10;
104+
string ip_address = 11;
105+
string country_code = 12;
106+
string city = 13;
107+
108+
// Session status
109+
SessionStatus status = 14;
110+
111+
// Timestamps
112+
google.protobuf.Timestamp created_at = 15;
113+
google.protobuf.Timestamp last_activity_at = 16;
114+
google.protobuf.Timestamp expires_at = 17;
115+
google.protobuf.Timestamp revoked_at = 18;
116+
117+
// Additional context
118+
map<string, string> metadata = 19;
119+
}
120+
121+
// SessionStatus defines the state of a session
122+
enum SessionStatus {
123+
SESSION_STATUS_UNSPECIFIED = 0;
124+
SESSION_STATUS_ACTIVE = 1;
125+
SESSION_STATUS_EXPIRED = 2;
126+
SESSION_STATUS_REVOKED = 3;
127+
}
128+
129+
// RefreshToken represents a long-lived refresh token
130+
message RefreshToken {
131+
string id = 1;
132+
string user_id = 2;
133+
string token_hash = 3;
134+
string device_id = 4;
135+
136+
google.protobuf.Timestamp created_at = 5;
137+
google.protobuf.Timestamp expires_at = 6;
138+
google.protobuf.Timestamp last_used_at = 7;
139+
google.protobuf.Timestamp revoked_at = 8;
140+
141+
bool revoked = 9;
142+
string revoked_reason = 10;
143+
}
144+
145+
// PasswordResetToken for password recovery flows
146+
message PasswordResetToken {
147+
string id = 1;
148+
string user_id = 2;
149+
string token_hash = 3;
150+
151+
google.protobuf.Timestamp created_at = 4;
152+
google.protobuf.Timestamp expires_at = 5;
153+
google.protobuf.Timestamp used_at = 6;
154+
155+
bool used = 7;
156+
string ip_address = 8;
157+
}
158+
159+
// EmailVerificationToken for email verification flows
160+
message EmailVerificationToken {
161+
string id = 1;
162+
string user_id = 2;
163+
string email = 3;
164+
string token_hash = 4;
165+
166+
google.protobuf.Timestamp created_at = 5;
167+
google.protobuf.Timestamp expires_at = 6;
168+
google.protobuf.Timestamp verified_at = 7;
169+
170+
bool verified = 8;
171+
string ip_address = 9;
172+
}
173+
174+
// MFAMethod represents a multi-factor authentication method
175+
message MFAMethod {
176+
string id = 1;
177+
string user_id = 2;
178+
179+
MFAMethodType type = 3;
180+
181+
// Method-specific data
182+
string phone_number = 4; // For SMS
183+
string email = 5; // For email OTP
184+
string totp_secret = 6; // For TOTP apps
185+
bytes webauthn_credential = 7; // For WebAuthn
186+
187+
// Status
188+
bool enabled = 8;
189+
bool verified = 9;
190+
191+
// Backup codes
192+
repeated string backup_codes = 10;
193+
194+
// Metadata
195+
string device_name = 11;
196+
google.protobuf.Timestamp created_at = 12;
197+
google.protobuf.Timestamp last_used_at = 13;
198+
}
199+
200+
// MFAMethodType defines supported MFA methods
201+
enum MFAMethodType {
202+
MFA_METHOD_TYPE_UNSPECIFIED = 0;
203+
MFA_METHOD_TYPE_TOTP = 1; // Time-based OTP (Google Authenticator, etc.)
204+
MFA_METHOD_TYPE_SMS = 2; // SMS-based OTP
205+
MFA_METHOD_TYPE_EMAIL = 3; // Email-based OTP
206+
MFA_METHOD_TYPE_WEBAUTHN = 4; // Hardware keys (YubiKey, etc.)
207+
MFA_METHOD_TYPE_BACKUP_CODE = 5;// Backup recovery codes
208+
}
209+
210+
// AuthEvent represents authentication-related events for audit
211+
message AuthEvent {
212+
string id = 1;
213+
string user_id = 2;
214+
string auth_credential_id = 3;
215+
216+
AuthEventType event_type = 4;
217+
218+
// Event details
219+
bool success = 5;
220+
string failure_reason = 6;
221+
222+
// Context
223+
string ip_address = 7;
224+
string user_agent = 8;
225+
string country_code = 9;
226+
string city = 10;
227+
228+
// Timestamp
229+
google.protobuf.Timestamp occurred_at = 11;
230+
231+
// Additional context
232+
map<string, string> metadata = 12;
233+
}
234+
235+
// AuthEventType defines types of authentication events
236+
enum AuthEventType {
237+
AUTH_EVENT_TYPE_UNSPECIFIED = 0;
238+
AUTH_EVENT_TYPE_LOGIN_SUCCESS = 1;
239+
AUTH_EVENT_TYPE_LOGIN_FAILURE = 2;
240+
AUTH_EVENT_TYPE_LOGOUT = 3;
241+
AUTH_EVENT_TYPE_PASSWORD_CHANGE = 4;
242+
AUTH_EVENT_TYPE_PASSWORD_RESET_REQUEST = 5;
243+
AUTH_EVENT_TYPE_PASSWORD_RESET_COMPLETE = 6;
244+
AUTH_EVENT_TYPE_MFA_ENABLED = 7;
245+
AUTH_EVENT_TYPE_MFA_DISABLED = 8;
246+
AUTH_EVENT_TYPE_MFA_CHALLENGE_SUCCESS = 9;
247+
AUTH_EVENT_TYPE_MFA_CHALLENGE_FAILURE = 10;
248+
AUTH_EVENT_TYPE_TOKEN_REFRESH = 11;
249+
AUTH_EVENT_TYPE_SESSION_REVOKED = 12;
250+
AUTH_EVENT_TYPE_CREDENTIAL_ADDED = 13;
251+
AUTH_EVENT_TYPE_CREDENTIAL_REMOVED = 14;
252+
AUTH_EVENT_TYPE_ACCOUNT_LOCKED = 15;
253+
AUTH_EVENT_TYPE_ACCOUNT_UNLOCKED = 16;
254+
}
255+
256+
// Query messages for filtering and pagination
257+
258+
message AuthCredentialQuery {
259+
string user_id = 1;
260+
repeated AuthProvider providers = 2;
261+
repeated AuthCredentialStatus statuses = 3;
262+
bool verified_only = 4;
263+
264+
int32 page_size = 5;
265+
string page_token = 6;
266+
}
267+
268+
message SessionQuery {
269+
string user_id = 1;
270+
repeated SessionStatus statuses = 2;
271+
string device_id = 3;
272+
bool active_only = 4;
273+
274+
int32 page_size = 5;
275+
string page_token = 6;
276+
}
277+
278+
message AuthEventQuery {
279+
string user_id = 1;
280+
repeated AuthEventType event_types = 2;
281+
google.protobuf.Timestamp from_date = 3;
282+
google.protobuf.Timestamp to_date = 4;
283+
bool success_only = 5;
284+
285+
int32 page_size = 6;
286+
string page_token = 7;
287+
}
288+
289+
// List response messages
290+
291+
message AuthCredentialList {
292+
repeated AuthCredential credentials = 1;
293+
string next_page_token = 2;
294+
int32 total_count = 3;
295+
}
296+
297+
message SessionList {
298+
repeated Session sessions = 1;
299+
string next_page_token = 2;
300+
int32 total_count = 3;
301+
}
302+
303+
message AuthEventList {
304+
repeated AuthEvent events = 1;
305+
string next_page_token = 2;
306+
int32 total_count = 3;
307+
}
308+
309+
message MFAMethodList {
310+
repeated MFAMethod methods = 1;
311+
int32 total_count = 2;
312+
}

0 commit comments

Comments
 (0)