syntax = "proto3";

package coda.admin.v1;

option java_package = "coda.admin.v1";
option java_outer_classname = "SessionProto";

import "google/protobuf/timestamp.proto";
import "coda/admin/v1/access_types.proto";
import "coda/admin/v1/types.proto";
import "coda/common/v1/types.proto";

service SessionService {
  // List active sessions for a user.
  rpc ListSessions(ListSessionsRequest) returns (ListSessionsResponse);

  // Revoke one or all sessions for a user.
  rpc RevokeSessions(RevokeSessionsRequest) returns (RevokeSessionsResponse);

  // Create a step-up authentication challenge.
  rpc CreateStepUpChallenge(CreateStepUpChallengeRequest) returns (CreateStepUpChallengeResponse);

  // Verify a step-up authentication challenge response.
  rpc VerifyStepUpChallenge(VerifyStepUpChallengeRequest) returns (VerifyStepUpChallengeResponse);
}

// ─── Sessions ────────────────────────────────────────────────────────

message SessionInfo {
  string id = 1;
  string user_id = 2;
  string tenant_id = 3;
  string ip_address = 4;
  string user_agent = 5;
  google.protobuf.Timestamp created_at = 6;
  google.protobuf.Timestamp last_active_at = 7;
  google.protobuf.Timestamp expires_at = 8;
}

message ListSessionsRequest {
  string tenant_id = 1;
  string user_id = 2;
  coda.common.v1.PageRequest page = 3;
}

message ListSessionsResponse {
  repeated SessionInfo sessions = 1;
  coda.common.v1.PageInfo page = 2;
}

message RevokeSessionsRequest {
  string tenant_id = 1;
  string user_id = 2;
  // If empty, revokes all sessions for the user
  string session_id = 3;
}

message RevokeSessionsResponse {
  int32 revoked_count = 1;
}

// ─── Step-up authentication ──────────────────────────────────────────

message CreateStepUpChallengeRequest {
  string tenant_id = 1;
  string user_id = 2;
  string permission = 3;
  string resource_type = 4;
  string resource_id = 5;
}

message CreateStepUpChallengeResponse {
  string challenge_id = 1;
  string challenge_type = 2;
  google.protobuf.Timestamp expires_at = 3;
}

message VerifyStepUpChallengeRequest {
  string challenge_id = 1;
  string response = 2;
}

message VerifyStepUpChallengeResponse {
  Outcome outcome = 1;
  // Opaque token valid for the elevated permission window
  string step_up_token = 2;
  google.protobuf.Timestamp expires_at = 3;
}