Edu/packages/shared-proto/proto/iam.proto

syntax = "proto3";

package next_edu_cloud.iam.v1;

// IamService 定义身份与访问管理契约
// 双入口策略（president §2.16）：REST 供 gateway 透传 + admin-portal 直连，
// gRPC 供 BFF 聚合调用。同一 Application Service 同时被两种 Controller 调用。
// gRPC 端口 50052，P2 即启用（I1 裁决）。
service IamService {
  // 认证类
  rpc Register(RegisterRequest) returns (AuthResponse);
  rpc Login(LoginRequest) returns (AuthResponse);
  rpc RefreshToken(RefreshTokenRequest) returns (TokenPair);
  rpc Logout(LogoutRequest) returns (LogoutResponse);

  // 用户信息类
  rpc GetUserInfo(GetUserInfoRequest) returns (UserInfo);
  // GetEffectiveDataScope 解析用户可见数据范围（DataScope 6 级）.
  // data-ana gRPC 调用此 RPC 解析查询过滤范围（coord-cross-review §2 #3 裁决 P4 补全）.
  rpc GetEffectiveDataScope(GetEffectiveDataScopeRequest) returns (EffectiveDataScope);
}

// ========== 认证类 ==========

message RegisterRequest {
  string email = 1;
  string password = 2;
  string name = 3;
}

message LoginRequest {
  string email = 1;
  string password = 2;
}

message RefreshTokenRequest {
  string refresh_token = 1;
}

message LogoutRequest {
  string refresh_token = 1;
  string user_id = 2;
}

message LogoutResponse {
  bool success = 1;
}

message AuthResponse {
  UserInfo user = 1;
  TokenPair tokens = 2;
}

message TokenPair {
  string access_token = 1;
  string refresh_token = 2;
  int32 expires_in = 3;
}

// ========== 用户信息类 ==========

message GetUserInfoRequest {
  string user_id = 1;
}

message BatchGetUsersRequest {
  repeated string user_ids = 1;
}

message BatchGetUsersResponse {
  repeated UserInfo users = 1;
}

message UserInfo {
  string id = 1;
  string email = 2;
  string name = 3;
  repeated string roles = 4;
  repeated string permissions = 5;
  string data_scope = 6;
  string status = 7;
}

// ========== 权限与视口类 ==========

message GetEffectivePermissionsRequest {
  string user_id = 1;
}

message EffectivePermissionsResponse {
  repeated string permissions = 1;
}

message GetEffectiveAccessRequest {
  string user_id = 1;
  string permission = 2;
}

message EffectiveAccessResponse {
  bool allowed = 1;
  string data_scope = 2;
}

message GetEffectiveDataScopeRequest {
  string user_id = 1;
}

message DataScopeResponse {
  string data_scope = 1;
}

message GetViewportsRequest {
  string user_id = 1;
}

message ViewportsResponse {
  repeated ViewportItem viewports = 1;
}

message ViewportItem {
  string key = 1;
  string label = 2;
  string route = 3;
  string icon = 4;
  string sort_order = 5;
  string required_permission = 6;
}

// ========== 密钥与关系类 ==========

message GetPublicKeyRequest {}

message PublicKeyResponse {
  string kid = 1;
  string alg = 2;
  string public_key_pem = 3;
}

message GetChildrenByParentRequest {
  string parent_id = 1;
}

message ChildrenResponse {
  repeated ChildInfo children = 1;
}

message ChildInfo {
  string student_id = 1;
  string name = 2;
  string relation = 3;
}

// EffectiveDataScope 用户可见数据范围（6 级）.
// level: SELF / CLASS / GRADE / SCHOOL / SUBJECT / ALL
// scope_ids: 具体可见的 class_id / grade_id 列表（SELF/ALL 时为空）
message EffectiveDataScope {
  string user_id = 1;
  string level = 2; // SELF / CLASS / GRADE / SCHOOL / SUBJECT / ALL
  repeated string scope_ids = 3; // class_id 列表（CLASS 级）/ grade_id 列表（GRADE 级）
  string school_id = 4; // SCHOOL 级时的学校 ID
}