// Reconstructed by API Evangelist from the published protoc-gen-go bindings in
// https://github.com/spirl/spirl-sdk-go (api/v1/sessionapi/api.proto).
//
// Defakto does not publish .proto sources. Message names, field names, field numbers,
// field types, doc comments, enum values and RPC signatures below are read verbatim
// out of those generated files, so they are accurate. This is a faithful
// RECONSTRUCTION, not a provider-published artifact, and it is lossy in known ways:
//   * oneof groups are NOT represented. protoc-gen-go emits them as Go interface
//     fields tagged protobuf_oneof rather than protobuf, so their member fields are
//     absent here. A message shown with no fields may be a genuinely empty message
//     (common for Delete*Response) OR a oneof-only message. Check the .pb.go.
//   * field options (protovalidate constraints, deprecation) are not carried.
//   * nested and map entry types are flattened to their leaf name.
// Do not treat this as a compilable contract; treat it as an accurate inventory of
// the service surface. Source of truth remains the SDK.
syntax = "proto3";

package com.spirl.api.v1.session;

message LoginRequest {
}

message LoginResponse {
}

message LogoutRequest {
}

message LogoutResponse {
}

message StartLoginRequest {
  // Optional. The org to log in to. Required if using enterprise SSO or if using a social login
  // that belongs to more than one org.
  string org_name = 4;
  // Optional. A hint about which user account to authenticate with. Not all IDPs support login
  // hints.
  string hint = 6;
  // Optional. Whether the client supports pairing code login. This field is used for temporary
  // backward compatibility with clients that do not support the pairing code login flow. In the
  // future, this field will be deprecated and pairing code login will be enforced.
  bool supports_pairing_code = 8;
}

message StartLoginResponse {
  // The URL to open in a browser to complete the login session with SPIRL Cloud.
  string login_url = 1;
  // The pairing code to use for pairing the CLI with the browser.
  string pairing_code = 2;
  // The token identifying the associated login session. Unused by the bidirectional streaming
  // flow because the stream itself identifies the session.
  string login_session_token = 3;
  // The login_session_secret to be used by FinishLogin. Required so an observer of login_url
  // alone cannot complete the login.
  string login_session_secret = 4;
}

message ChooseOrgRequest {
  string org_name = 1;
}

message ChooseOrgResponse {
  repeated string orgs = 1;
}

message FinishLoginRequest {
  // The token identifying the associated login session. Unused by the bidirectional streaming
  // flow because the stream itself identifies the session.
  string login_session_token = 2;
  // The login_session_secret returned by StartLogin. Required so an observer of login_url alone
  // cannot complete the login.
  string login_session_secret = 3;
}

message FinishLoginResponse {
  // The token for the caller to use to authenticate future requests.  Set by the bidirectional
  // streaming Login flow, which delivers the token directly here without going through the
  // `state` oneof below. The new unary flow delivers the token via state.completed.token
  // instead.
  string token = 3;
}

message WhoamiRequest {
}

message WhoamiResponse {
  // The org the identity belongs to.
  string org_name = 1;
  // The org role of the identity.
  OrgRole org_role = 4;
  // The org ID of the identity.
  string org_id = 5;
  // Feature flags relevant to the current org, so clients (e.g. the web console) can adjust what
  // they surface.
  FeatureFlags feature_flags = 7;
}

message FeatureFlags {
  // Whether the CI/CD Profiles feature is enabled for the org. Used by the web console to decide
  // whether to surface CI/CD Profiles.
  bool cicd_profiles_enabled = 1;
}

message User {
  // The user's name.
  string name = 1;
  // The user's email address.
  string email = 2;
  // User's ID.
  string id = 3;
  // SSO provider.
  string sso_provider = 4;
}

message ServiceAccount {
  // The service account's name.
  string name = 1;
  // The service account's description.
  string description = 2;
}

message ServiceAccountKey {
  // The ID of the service account key.
  string id = 1;
}

message EmployeeAdmin {
  // The employee admin's ID.
  string id = 1;
  // The employee admin's email address.
  string email = 2;
}

message AuthenticateServiceAccountRequest {
}

message ServiceAccountKeyLogin {
  // Required. The ID of the service account key the client wants to login with.
  string key_id = 1;
}

message ServiceAccountKeyAuthorization {
  // Required. The service account key proof.
  ServiceAccountKeyProof service_account_key_proof = 1;
}

message ServiceAccountKeyProof {
  // Required. The signature of the key proof hash using the service account private key.
  bytes signature = 1;
  // Required. The nonce incorporated into the key proof hash.
  bytes nonce = 2;
}

message AuthenticateServiceAccountResponse {
}

message ListOrgsRequest {
}

message ListOrgsResponse {
  repeated Org orgs = 1;
}

message SessionChallenge {
  // The server nonce to be incorporated into the key proof hash.
  bytes server_nonce = 1;
}

message SessionInfo {
  // The token for the caller to use to authenticate future requests.
  string token = 1;
}

message OrgRole {
  // The ID of the organization role.
  string id = 1;
  // The name of the organization role.
  string name = 2;
}

message Org {
  string id = 1;
  string name = 2;
}

message FinishLoginResponse_Pending {
}

message FinishLoginResponse_Completed {
  string token = 1;
}

service API {
  rpc StartLogin(StartLoginRequest) returns (StartLoginResponse);
  rpc FinishLogin(FinishLoginRequest) returns (FinishLoginResponse);
  rpc Whoami(WhoamiRequest) returns (WhoamiResponse);
  rpc ListOrgs(ListOrgsRequest) returns (ListOrgsResponse);
  rpc Logout(LogoutRequest) returns (LogoutResponse);
  // server-streaming
  rpc Login(LoginRequest) returns (stream LoginResponse);
  // server-streaming
  rpc AuthenticateServiceAccount(AuthenticateServiceAccountRequest) returns (stream AuthenticateServiceAccountResponse);
}