166 lines
3.5 KiB
Protocol Buffer
166 lines
3.5 KiB
Protocol Buffer
syntax = "proto3";
|
||
|
||
package next_edu_cloud.iam.v1;
|
||
|
||
// IamService 定义身份与访问管理契约
|
||
// 双入口策略（president §2.16）：REST 供 gateway 透传 + admin-portal 直连，
|
||
// gRPC 供 BFF 聚合调用。同一 Application Service 同时被两种 Controller 调用。
|
||
// gRPC 端口 50052，P2 即启用（I1 裁决）。
|
||
service IamService {
|
||
// 认证类
|
||
rpc Register(RegisterRequest) returns (AuthResponse);
|
||
rpc Login(LoginRequest) returns (AuthResponse);
|
||
rpc RefreshToken(RefreshTokenRequest) returns (TokenPair);
|
||
rpc Logout(LogoutRequest) returns (LogoutResponse);
|
||
|
||
// 用户信息类
|
||
rpc GetUserInfo(GetUserInfoRequest) returns (UserInfo);
|
||
// GetEffectiveDataScope 解析用户可见数据范围（DataScope 6 级）.
|
||
// data-ana gRPC 调用此 RPC 解析查询过滤范围（coord-cross-review §2 #3 裁决 P4 补全）.
|
||
rpc GetEffectiveDataScope(GetEffectiveDataScopeRequest) returns (EffectiveDataScope);
|
||
}
|
||
|
||
// ========== 认证类 ==========
|
||
|
||
message RegisterRequest {
|
||
string email = 1;
|
||
string password = 2;
|
||
string name = 3;
|
||
}
|
||
|
||
message LoginRequest {
|
||
string email = 1;
|
||
string password = 2;
|
||
}
|
||
|
||
message RefreshTokenRequest {
|
||
string refresh_token = 1;
|
||
}
|
||
|
||
message LogoutRequest {
|
||
string refresh_token = 1;
|
||
string user_id = 2;
|
||
}
|
||
|
||
message LogoutResponse {
|
||
bool success = 1;
|
||
}
|
||
|
||
message AuthResponse {
|
||
UserInfo user = 1;
|
||
TokenPair tokens = 2;
|
||
}
|
||
|
||
message TokenPair {
|
||
string access_token = 1;
|
||
string refresh_token = 2;
|
||
int32 expires_in = 3;
|
||
}
|
||
|
||
// ========== 用户信息类 ==========
|
||
|
||
message GetUserInfoRequest {
|
||
string user_id = 1;
|
||
}
|
||
|
||
message BatchGetUsersRequest {
|
||
repeated string user_ids = 1;
|
||
}
|
||
|
||
message BatchGetUsersResponse {
|
||
repeated UserInfo users = 1;
|
||
}
|
||
|
||
message UserInfo {
|
||
string id = 1;
|
||
string email = 2;
|
||
string name = 3;
|
||
repeated string roles = 4;
|
||
repeated string permissions = 5;
|
||
string data_scope = 6;
|
||
string status = 7;
|
||
}
|
||
|
||
// ========== 权限与视口类 ==========
|
||
|
||
message GetEffectivePermissionsRequest {
|
||
string user_id = 1;
|
||
}
|
||
|
||
message EffectivePermissionsResponse {
|
||
repeated string permissions = 1;
|
||
}
|
||
|
||
message GetEffectiveAccessRequest {
|
||
string user_id = 1;
|
||
string permission = 2;
|
||
}
|
||
|
||
message EffectiveAccessResponse {
|
||
bool allowed = 1;
|
||
string data_scope = 2;
|
||
}
|
||
|
||
message GetEffectiveDataScopeRequest {
|
||
string user_id = 1;
|
||
}
|
||
|
||
message DataScopeResponse {
|
||
string data_scope = 1;
|
||
}
|
||
|
||
message GetViewportsRequest {
|
||
string user_id = 1;
|
||
}
|
||
|
||
message ViewportsResponse {
|
||
repeated ViewportItem viewports = 1;
|
||
}
|
||
|
||
message ViewportItem {
|
||
string key = 1;
|
||
string label = 2;
|
||
string route = 3;
|
||
string icon = 4;
|
||
string sort_order = 5;
|
||
string required_permission = 6;
|
||
}
|
||
|
||
// ========== 密钥与关系类 ==========
|
||
|
||
message GetPublicKeyRequest {}
|
||
|
||
message PublicKeyResponse {
|
||
string kid = 1;
|
||
string alg = 2;
|
||
string public_key_pem = 3;
|
||
}
|
||
|
||
message GetChildrenByParentRequest {
|
||
string parent_id = 1;
|
||
}
|
||
|
||
message ChildrenResponse {
|
||
repeated ChildInfo children = 1;
|
||
}
|
||
|
||
message ChildInfo {
|
||
string student_id = 1;
|
||
string name = 2;
|
||
string relation = 3;
|
||
}
|
||
|
||
message GetEffectiveDataScopeRequest {
|
||
string user_id = 1;
|
||
}
|
||
|
||
// EffectiveDataScope 用户可见数据范围（6 级）.
|
||
// level: SELF / CLASS / GRADE / SCHOOL / DISTRICT / ALL
|
||
// scope_ids: 具体可见的 class_id / grade_id 列表（SELF/ALL 时为空）
|
||
message EffectiveDataScope {
|
||
string user_id = 1;
|
||
string level = 2; // SELF / CLASS / GRADE / SCHOOL / DISTRICT / ALL
|
||
repeated string scope_ids = 3; // class_id 列表（CLASS 级）/ grade_id 列表（GRADE 级）
|
||
string school_id = 4; // SCHOOL 级时的学校 ID
|
||
}
|