syntax = "proto3";

package auth;

// Authentication service — token issuance and refresh.
// This service is exposed WITHOUT the auth interceptor (pre-authentication).
service AuthService {
  // Authenticate with username/password, receive JWT tokens.
  rpc Login(LoginRequest) returns (LoginResponse);

  // Exchange a refresh token for a new access token.
  rpc RefreshToken(RefreshTokenRequest) returns (RefreshTokenResponse);
}

message LoginRequest {
  string username = 1;
  string password = 2;
}

message LoginResponse {
  string access_token = 1;
  string refresh_token = 2;
  // Unix timestamp (seconds) when the access token expires.
  int64 expires_at = 3;
}

message RefreshTokenRequest {
  string refresh_token = 1;
}

message RefreshTokenResponse {
  string access_token = 1;
  string refresh_token = 2;
  int64 expires_at = 3;
}