syntax = "proto3";

package appks.im.v1;

// Internal service-to-service authentication.
// appks issues API keys (stored in Redis), remote services
// carry the key in gRPC metadata "x-api-key", and call
// Authenticate to verify identity.

message AuthenticateRequest {
  string api_key = 1;
}

message AuthenticateResponse {
  bool authenticated = 1;
  string service_name = 2;
  string service_id = 3;
  repeated string scopes = 4;
  int64 expires_at = 5;
}

service InternalAuthService {
  // Verify an API key and return the associated service identity.
  // Called by remote services to authenticate themselves.
  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
}