The Adventure Continues

// BIG EDIT:
// I left out all my comments last time and
// then I just made some changes a few min ago
// that I think are important. History is in git
// but this is the better version.

syntax = "proto3";
package app;

service Application {
    rpc Signup(SignupParams) returns (Token) {}
    rpc Signin(SigninParams) returns (User) {}
    // decrypts user with a token that was snapped from the current device and used
    // to encrypt the user's data
    rpc GenerateToken(GenerateTokenParams) returns (Token) {}

    rpc UpdateSelf(UpdateSelfParams) returns (User) {}
    rpc DeactivateSelf(DeactivateSelfParams) returns (Empty) {}
    
    rpc GetPods(GetPodsParams) returns (Pods) {}
    rpc CreatePod(CreatePodParams) returns (Pod) {}
    rpc UpdatePod(UpdatePodParams) returns (Pod) {}
    rpc DeletePod(DeletePodParams) returns (Empty) {}

    rpc AdmitUserToPod(AdmitUserToPodParams) returns (User) {}
    rpc KickUserFromPod(KickUserFromPodParams) returns (User) {}
    rpc RequestPodAccess(RequestPodAccessParams) returns (Empty) {}

    rpc GetMessagesFromPod(GetMessagesFromPodParams) returns (Messages) {}
    rpc PutMessageToPods(PutMessageToPodsParams) returns (Message) {}
    rpc DeleteMessages(DeleteMessagesParams) returns (Messages) {}
}

message Empty {}

// AUTH

message Token {
    string token = 1;
}

message SignupParams {
    string username = 1; // username has to be signed
    string password = 2;

    bytes pub_signing_key = 3;

    // used for shared secret creation
    // and is cycled regularly to ensure
    // "batched" forward secrecy (if a user is
    // offline, then they aren't cycling their
    // key for a given device).
    
    // each device gets its own unique_pub_key.
    // this would also mean that each web browser
    // would get its own unique_pub_key
    bytes initial_pub_device_exchange_key = 4; // every pub key is 256 bits so split on 256 (which i think is 32 for a u8 arr?) 
}

// we get the user back from signing in but no token
// we do have the ability, however, to decrypt (with one of our public keys)
// the content in our user object that has been returned. from that user
// object, we get the pod_ids that we care about and then we send the
// `GenerateToken` request with those pod_ids.
message SigninParams {
    string username = 1; // signed
    string password = 2;

    bytes username_signature = 3;
}

// Uses pod_ids from the SigninParams user
message GenerateTokenParams {
    string username = 1; // signed
    string password = 2;

    repeated string pod_ids = 3; // signed

    bytes signatures = 4;

}

// USER

message Users {
    repeated User users = 1;
}

message User {
    string username = 1;
    bytes pub_signing_key = 2;
    bytes pub_exchange_keys = 3;

    bytes key_set = 4;
    bytes nonce = 5;
    bytes encrypted_content = 9;
}

message UpdateSelfParams {
    bytes pub_exchange_keys = 1;

    bytes key_sets = 2;
    bytes content_nonce = 3;
    bytes encrypted_content = 4;
}

message DeactivateSelfParams {
    string password = 2;
    // TODO: we need to start just including the OTP
    // TODO: people are going to learn how to handle
    // TODO: online secrecy once they understand just
    // TODO: how terrible the current system is for their
    // TODO: health and wellbeing.
}

// POD

message Pods {
    repeated Pod pods = 1;
}

// each pod has an "owner" and "admins" that was the OG creator
// and appointed helpers. the "owners" accounts are delegated the responsibility
// of admission, rejection, kicking, and publishing
// updates to the pod data and can delegate the responsibility
// of publishing to the admins by auto approving when the request
// hits the owner's device. this prevents duplicate writes from 
// multiple devices. 
message Pod {
    string id = 1;

    bytes nonce = 2;
    bytes key_set = 3;

    bytes encrypted_content = 4;
    repeated Message messages = 5; // latest (n) records
}

message GetPodsParams {
    repeated string ids = 1;
}

message CreatePodParams {
    bytes content_nonce = 1;
    bytes encrypted_content = 2;
}

message UpdatePodParams {
    string id = 1;

    bytes content_nonce = 2;
    bytes encrypted_content = 3;
    bytes content_consumer_pairs = 4;
}

message DeletePodParams {
    string id = 1;
}

// USER <-> POD

message AdmitUserToPodParams {
    string pod_id = 1; // compare against JWT pod ids
    string username = 2; // signed - compare against user sig in the db
}

message KickUserFromPodParams {
    string pod_id = 1; // compare against JWT pod ids
    string username = 2; // signed - compare against user sig in the db
}
// pod "slot" purchasing happens through stripe's system
// and ends up on our user record. it is updated in our system
// when stripe updates the number of subscriptions. the actual
// pods that they're in are unknown to us. 
message RequestPodAccessParams {
    string pod_id = 1; // signed
}


// MESSAGE

// your messages from old pods are always accessible to you
// until you delete them. you can always comb your groups
// to get your old messages. we could also encrypt them under
// their account and denormalize...

message Messages {
    repeated Message messages = 1;
}

message Message {
    string id = 1;
    bytes nonce = 2;
    bytes key_set = 3;
    bytes encrypted_content = 4;
}

message GetMessagesFromPodParams {
    string pod_id = 1;
    uint32 max_count = 2;
    
    // the `since` and `pub_exchange_keys` are correlated, in that
    // the `since` should also have been used to grab the range of
    // `pub_exchange_keys` held in the indexeddb table

    uint64 since = 3; // unix timestamp  
    repeated bytes pub_exchange_keys = 4; // for specifying range of public exchange keys
}

message PutMessageToPodsParams {
    repeated string pod_ids = 1; // signed and compared against JWT pod ids

    bytes key_sets = 2;
    bytes nonce = 3;
    bytes encrypted_content = 4;
}

message DeleteMessagesParams {
    repeated string ids = 1; // signed and compared against JWT
}