syntax = "proto3";

package tars.test.v1;

import "google/api/annotations.proto";
import "google/protobuf/timestamp.proto";
import "tars/auth/v1/auth_options.proto";

// TestService provides endpoints for testing authentication and authorization.
service TestService {
  // Ping endpoint to test service account JWT authentication.
  // Returns authenticated service account information if token is valid.
  rpc Ping(PingRequest) returns (PingResponse) {
    option (google.api.http) = {get: "/test/v1/ping"};
    option idempotency_level = NO_SIDE_EFFECTS;
    option (tars.auth.v1.auth) = {
      auth_types: [AUTH_TYPE_SERVICE_ACCOUNT]
      scopes: ["read"]
    };
  }
}

message PingRequest {}

message PingResponse {
  // Indicates if the authentication was successful
  bool authenticated = 1;

  // The authenticated client email from the JWT
  string client_email = 2;

  // The issuer (iss) claim from the JWT
  string issuer = 3;

  // The audience (aud) claim from the JWT
  string audience = 4;

  // The subject (sub) claim from the JWT
  string subject = 5;

  // Scopes/permissions from the JWT
  repeated string scopes = 6;

  // Token expiration time
  google.protobuf.Timestamp expires_at = 7;

  // Token issued at time
  google.protobuf.Timestamp issued_at = 8;

  // Server timestamp
  google.protobuf.Timestamp server_time = 9;

  // Additional claims from the JWT (optional custom claims)
  map<string, string> custom_claims = 10;
}
