// Copyright (c) Abstract Machines
// SPDX-License-Identifier: Apache-2.0

syntax = "proto3";

package auth.v1;
option go_package = "github.com/absmach/supermq/api/grpc/auth/v1";

// AuthService is a service that provides authentication
// and authorization functionalities for SuperMQ services.
service AuthService {
  rpc Authorize(AuthZReq) returns (AuthZRes) {}
  rpc AuthorizePAT(AuthZPatReq) returns (AuthZRes) {}
  rpc Authenticate(AuthNReq) returns (AuthNRes) {}
  rpc AuthenticatePAT(AuthNReq) returns (AuthNRes) {}
}


message AuthNReq {
  string token = 1;
}

message AuthNRes {
  string id    = 1;     // token id
  string user_id = 2;   // user id
  uint32 user_role = 3; // user role
  bool verified = 4; // verified user
}

message AuthZReq {
  string domain = 1;           // Domain
  string subject_type = 2;     // Client or User
  string subject_kind = 3;     // ID or Token
  string subject_relation = 4; // Subject relation
  string subject = 5;          // Subject value (id or token, depending on kind)
  string relation = 6;         // Relation to filter
  string permission = 7;       // Action
  string object = 8;           // Object ID
  string object_type = 9;      // Client, User, Group
}

message AuthZPatReq {
  string user_id = 1;             // User id
  string pat_id = 2;              // Pat id
  uint32 entity_type = 3;         // Entity type
  string optional_domain_id = 4;  // Optional domain id
  uint32 operation = 6;           // Operation
  string entity_id = 7;           // EntityID
}

message AuthZRes {
  bool authorized = 1;
  string id = 2;
}
