syntax = "proto3";

package chatto.api.v1;

import "buf/validate/validate.proto";
import "chatto/api/v1/common.proto";

// Public metadata for a configured external login provider.
message ExternalIdentityProvider {
  reserved 1 to 4;
  reserved "id", "type", "label", "login_url";

  // URL that starts authenticated account linking for this provider. Clients
  // should use StartExternalIdentityLink instead of navigating here directly.
  string link_url = 5;
  // True when this provider is already linked to the authenticated user.
  bool linked = 6;
  // Linked identity subject hash for this provider, when linked.
  string linked_identity_subject_hash = 7;
  // Shared provider metadata.
  ProviderMetadata provider = 8;
}

// Linked provider identity metadata for the authenticated user's settings UI.
message LinkedExternalIdentity {
  // Provider ID recorded when the identity was linked.
  string provider_id = 1;
  // Provider type recorded when the identity was linked.
  string provider_type = 2;
  // Current or fallback provider label.
  string provider_label = 3;
  // Stable one-way subject hash, useful only as a UI/list key.
  string subject_hash = 4;
}

// Request to list configured and linked external identities for the current user.
message ListExternalIdentitiesRequest {}

// Finite snapshot of configured providers and linked external identities.
message ListExternalIdentitiesResponse {
  // Configured providers the user may link.
  repeated ExternalIdentityProvider providers = 1;
  // Provider identities already linked to the authenticated user.
  repeated LinkedExternalIdentity linked_identities = 2;
}

// Request to start linking a configured provider to the current user.
message StartExternalIdentityLinkRequest {
  // Provider ID to link.
  string provider_id = 1 [(buf.validate.field).string.min_len = 1];
  // Internal path to return to after confirmation.
  string redirect_path = 2;
  // Current password proof for accounts with a password when the active
  // runtime credential is no longer fresh.
  string current_password = 3;
}

// Result of preparing an external identity link flow.
message StartExternalIdentityLinkResponse {
  // Browser URL that starts provider authorization on the target server origin.
  string start_url = 1;
}

// Request to disconnect a linked provider identity from the authenticated user.
message DisconnectExternalIdentityRequest {
  // Stable one-way subject hash of the linked identity to disconnect.
  string subject_hash = 1 [(buf.validate.field).string.min_len = 1];
  // Current password proof for accounts with a password when the active
  // runtime credential is no longer fresh.
  string current_password = 2;
}

// Result of disconnecting a provider identity.
message DisconnectExternalIdentityResponse {
  // True when the identity was disconnected.
  bool disconnected = 1;
}