syntax = "proto3";
package auth;

option go_package = "github.com/siderolabs/go-api-signature/api/auth";

import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

message PublicKey {
  message Plain {
    string key_pem = 1;
    google.protobuf.Timestamp not_before = 2;
    google.protobuf.Timestamp not_after = 3;
  }

  bytes pgp_data = 1;
  bytes webauthn_data = 2;
  Plain plain_key = 3;
}

message Identity {
  string email = 1;
}

message RegisterPublicKeyRequest {
  PublicKey public_key = 1;
  Identity identity = 2;
  reserved 3;
  reserved 4;
  // The role of the public key. When skip_user_role is true, this field is ignored.
  string role = 5;
  // If true, the role field will be used to determine the role of the public key.
  bool skip_user_role = 6;
}

message RegisterPublicKeyResponse {
  string login_url = 1;
  string public_key_id = 2;
}

message AwaitPublicKeyConfirmationRequest {
  string public_key_id = 1;
}

message ConfirmPublicKeyRequest {
  string public_key_id = 1;
}

message RevokePublicKeyRequest {
  string public_key_id = 1;
}

service AuthService {
  rpc RegisterPublicKey(RegisterPublicKeyRequest) returns (RegisterPublicKeyResponse);
  rpc AwaitPublicKeyConfirmation(AwaitPublicKeyConfirmationRequest) returns (google.protobuf.Empty);
  rpc ConfirmPublicKey(ConfirmPublicKeyRequest) returns (google.protobuf.Empty);
  rpc RevokePublicKey(RevokePublicKeyRequest) returns (google.protobuf.Empty);
}
