syntax = "proto3";

package xyz.aspens.arborter_auth.v1;

option optimize_for = SPEED;

// The Authentication service definition
// This service does NOT require JWT authentication (it's used to obtain JWT tokens).
//
// Both EVM (secp256k1 / EIP-712) and Solana (Ed25519) admin identities
// are supported. The server dispatches on address format:
//   - 0x-prefixed hex  → EVM, signature verified as EIP-712
//   - base58           → Solana, signature verified as raw Ed25519
//
// Consumers should not need to know which curve was used — the same
// JWT is minted either way and carries the address as an opaque string.
service AuthService {
  // Initialize the first admin (only works when no admin exists).
  // Accepts either an EVM (0x...) or a Solana (base58) address.
  // Returns a JWT token for the newly created admin.
  rpc InitializeAdmin(InitializeAdminRequest) returns (InitializeAdminResponse) {}

  // Authenticate with a signature to obtain a JWT token. The signature
  // scheme is chosen by the address format (see service docstring).
  // Only works if the address is already an admin.
  rpc AuthenticateWithSignature(AuthRequest) returns (AuthResponse) {}
}

message AuthRequest {
  // The admin address requesting authentication.
  // EVM addresses are 0x-prefixed hex (20 bytes); Solana addresses are
  // base58-encoded Ed25519 public keys (32 bytes).
  string address = 1;
  // Unix timestamp when the message was created (in seconds)
  uint64 timestamp = 2;
  // Random nonce to prevent replay attacks
  string nonce = 3;
  // Hex-encoded signature over the canonical auth message (with or
  // without 0x prefix). For EVM addresses this is a 65-byte EIP-712
  // signature; for Solana addresses this is a 64-byte raw Ed25519
  // signature.
  string signature = 4;
}

message AuthResponse {
  // JWT token for authenticated requests
  string jwt_token = 1;
  // Unix timestamp when the token expires (in seconds)
  uint64 expires_at = 2;
  // The address that was authenticated
  string address = 3;
}

message InitializeAdminRequest {
  // The address to set as the initial admin.
  // EVM addresses are 0x-prefixed hex; Solana addresses are base58.
  string address = 1;
}

message InitializeAdminResponse {
  // JWT token for authenticated requests
  string jwt_token = 1;
  // Unix timestamp when the token expires (in seconds)
  uint64 expires_at = 2;
  // The address that was set as admin
  string address = 3;
  // Success message
  string message = 4;
}
