syntax = "proto3";

package tars.auth.v1;

import "google/api/annotations.proto";

service AuthService {
  // JWKS endpoint.
  // Public endpoint - no authentication required.
  // Returns JSON Web Key Set for verifying JWT tokens.
  rpc GetJWKS(GetJWKSRequest) returns (GetJWKSResponse) {
    option (google.api.http) = {get: "/.well-known/jwks.json"};
    option idempotency_level = NO_SIDE_EFFECTS;
  }
}

message GetJWKSRequest {}

// JWKS response containing public keys for JWT verification.
message GetJWKSResponse {
  // Set of public JWKs available for verifying JWT signatures.
  repeated JWK keys = 1;
}

// JSON Web Key (JWK) representation for ECDSA keys.
message JWK {
  // Key ID: fingerprint of the public key.
  string kid = 1;

  // Key type: always "EC" (Elliptic Curve).
  string kty = 2;

  // Algorithm: "ES256", "ES384", or "ES512".
  string alg = 3;

  // Public key use: "sig" (signature).
  string use = 4;

  // EC curve name: "P-256", "P-384", or "P-521".
  string crv = 5;

  // EC public key x coordinate (base64url-encoded).
  string x = 6;

  // EC public key y coordinate (base64url-encoded).
  string y = 7;
}
