syntax = "proto3";

package hyapp.user.v1;

import "proto/user/v1/user.proto";

option go_package = "hyapp.local/api/proto/user/v1;userv1";

// LoginPasswordRequest 使用当前 display_user_id 和已设置密码登录。
message LoginPasswordRequest {
  RequestMeta meta = 1;
  string display_user_id = 2;
  string password = 3;
}

// LoginThirdPartyRequest 使用三方凭证登录或注册。
message LoginThirdPartyRequest {
  RequestMeta meta = 1;
  string provider = 2;
  string credential = 3;
  string username = 4;
  string gender = 5;
  string country = 6;
  string invite_code = 7;
  string device_id = 8;
  string device = 9;
  string avatar = 10;
  string birth = 11;
  string app_version = 12;
  string source = 13;
  string platform = 14;
  string language = 15;
  string os_version = 16;
  string build_number = 17;
  string timezone = 18;
  string install_channel = 19;
  string campaign = 20;
}

// RegisterThirdPartyRequest 是资料页完成时使用的三方注册入口。
// 它不会先返回 profile_required 登录态，而是在服务端一次性校验 credential、写用户资料并签发完整 session。
message RegisterThirdPartyRequest {
  RequestMeta meta = 1;
  string provider = 2;
  string credential = 3;
  string device_id = 4;
  string username = 5;
  string avatar = 6;
  string gender = 7;
  string country = 8;
  string invite_code = 9;
  string device = 10;
  string os_version = 11;
  string birth = 12;
  string app_version = 13;
  string build_number = 14;
  string source = 15;
  string install_channel = 16;
  string campaign = 17;
  string platform = 18;
  string language = 19;
  string timezone = 20;
}

// CheckThirdPartyRegisteredRequest 只校验三方凭证并判断是否已有完整注册用户。
message CheckThirdPartyRegisteredRequest {
  RequestMeta meta = 1;
  string provider = 2;
  string credential = 3;
}

message CheckThirdPartyRegisteredResponse {
  bool registered = 1;
}

// AuthResponse 返回标准认证令牌。
message AuthResponse {
  AuthToken token = 1;
  bool is_new_user = 2;
  bool profile_completed = 3;
  string onboarding_status = 4;
}

// SetPasswordRequest 为已经三方登录的用户首次设置密码。
message SetPasswordRequest {
  RequestMeta meta = 1;
  int64 user_id = 2;
  string password = 3;
}

// SetPasswordResponse 返回密码是否已经成功设置。
message SetPasswordResponse {
  bool password_set = 1;
}

// QuickCreateAccountRequest 为后台快速创建完整资料账号；source=game_robot 时账号不可登录。
message QuickCreateAccountRequest {
  RequestMeta meta = 1;
  string password = 2;
  string username = 3;
  string avatar = 4;
  string gender = 5;
  string country = 6;
  string invite_code = 7;
  string device_id = 8;
  string device = 9;
  string os_version = 10;
  string birth = 11;
  string app_version = 12;
  string build_number = 13;
  string source = 14;
  string install_channel = 15;
  string campaign = 16;
  string platform = 17;
  string language = 18;
  string timezone = 19;
}

// QuickCreateAccountResponse 返回新账号身份；普通账号含登录态，source=game_robot 时 token 只含 user_id/display_user_id。
message QuickCreateAccountResponse {
  AuthToken token = 1;
  bool password_set = 2;
}

// RefreshTokenRequest 使用 refresh token 换取新 token。
message RefreshTokenRequest {
  RequestMeta meta = 1;
  string refresh_token = 2;
}

// RefreshTokenResponse 返回轮换后的令牌。
message RefreshTokenResponse {
  AuthToken token = 1;
}

// LogoutRequest 失效指定会话或 refresh token。
message LogoutRequest {
  RequestMeta meta = 1;
  string session_id = 2;
  string refresh_token = 3;
}

// LogoutResponse 返回会话是否被失效。
message LogoutResponse {
  bool revoked = 1;
}

// RecordLoginBlockedRequest 记录 gateway 入口快拦拒绝的登录审计。
message RecordLoginBlockedRequest {
  RequestMeta meta = 1;
  string channel = 2;
  string platform = 3;
  string language = 4;
  string timezone = 5;
  string block_reason = 6;
}

// RecordLoginBlockedResponse 返回审计写入是否成功。
message RecordLoginBlockedResponse {
  bool recorded = 1;
}

// CheckLoginRiskIPWhitelistRequest 查询入口 IP 是否命中后台白名单。
message CheckLoginRiskIPWhitelistRequest {
  RequestMeta meta = 1;
  string client_ip = 2;
}

// CheckLoginRiskIPWhitelistResponse 返回入口 IP 是否跳过登录地区屏蔽。
message CheckLoginRiskIPWhitelistResponse {
  bool whitelisted = 1;
}

// RefreshLoginRiskWhitelistCacheRequest 要求 user-service 从 MySQL 重建登录风控白名单缓存。
message RefreshLoginRiskWhitelistCacheRequest {
  RequestMeta meta = 1;
}

// RefreshLoginRiskWhitelistCacheResponse 返回本次刷新后的白名单规模，便于后台保存后确认缓存已更新。
message RefreshLoginRiskWhitelistCacheResponse {
  bool refreshed = 1;
  int32 ip_whitelist_count = 2;
  int32 user_whitelist_count = 3;
  int64 user_cache_expires_at_ms = 4;
}

// RegisterRiskConfig 是注册链路读取的风控配置。
message RegisterRiskConfig {
  string app_code = 1;
  int32 max_accounts_per_device = 2;
  int64 updated_at_ms = 3;
  int64 updated_by_admin_id = 4;
}

// GetRegisterRiskConfigRequest 查询当前 App 的注册风控配置。
message GetRegisterRiskConfigRequest {
  RequestMeta meta = 1;
}

message GetRegisterRiskConfigResponse {
  RegisterRiskConfig config = 1;
}

// UpdateRegisterRiskConfigRequest 由后台保存当前 App 的注册风控配置。
message UpdateRegisterRiskConfigRequest {
  RequestMeta meta = 1;
  int32 max_accounts_per_device = 2;
  int64 operator_admin_id = 3;
}

message UpdateRegisterRiskConfigResponse {
  RegisterRiskConfig config = 1;
}

// AppHeartbeatRequest 刷新当前登录会话的 App 在线心跳。
message AppHeartbeatRequest {
  RequestMeta meta = 1;
  int64 user_id = 2;
  string session_id = 3;
}

// AppHeartbeatResponse 返回本次会话心跳写入时间，并在当前会话仍有效时顺手重签 access token。
message AppHeartbeatResponse {
  bool accepted = 1;
  int64 heartbeat_at_ms = 2;
  int64 server_time_ms = 3;
  AuthToken token = 4;
}

// AuthService 承载登录注册和 token 生命周期能力。
service AuthService {
  rpc LoginPassword(LoginPasswordRequest) returns (AuthResponse);
  rpc LoginThirdParty(LoginThirdPartyRequest) returns (AuthResponse);
  rpc RegisterThirdParty(RegisterThirdPartyRequest) returns (AuthResponse);
  rpc CheckThirdPartyRegistered(CheckThirdPartyRegisteredRequest) returns (CheckThirdPartyRegisteredResponse);
  rpc SetPassword(SetPasswordRequest) returns (SetPasswordResponse);
  rpc QuickCreateAccount(QuickCreateAccountRequest) returns (QuickCreateAccountResponse);
  rpc RefreshToken(RefreshTokenRequest) returns (RefreshTokenResponse);
  rpc Logout(LogoutRequest) returns (LogoutResponse);
  rpc RecordLoginBlocked(RecordLoginBlockedRequest) returns (RecordLoginBlockedResponse);
  rpc CheckLoginRiskIPWhitelist(CheckLoginRiskIPWhitelistRequest) returns (CheckLoginRiskIPWhitelistResponse);
  rpc RefreshLoginRiskWhitelistCache(RefreshLoginRiskWhitelistCacheRequest) returns (RefreshLoginRiskWhitelistCacheResponse);
  rpc GetRegisterRiskConfig(GetRegisterRiskConfigRequest) returns (GetRegisterRiskConfigResponse);
  rpc UpdateRegisterRiskConfig(UpdateRegisterRiskConfigRequest) returns (UpdateRegisterRiskConfigResponse);
  rpc AppHeartbeat(AppHeartbeatRequest) returns (AppHeartbeatResponse);
}