service IdentityService {
  rpc GetUserByUsername(GetUserByUsernameRequest) returns (GetUserResponse);
  rpc GetUser(GetUserRequest) returns (GetUserResponse);
}

message User {
  string id = 1;                  // UUID
  string username = 2;
  UserStatus status = 3;          // ACTIVE, DISABLED, DELETED
  google.protobuf.Timestamp created_at = 4;
  google.protobuf.Timestamp disabled_at = 6;
}

enum UserStatus {
  USER_STATUS_ACTIVE = 1;
  USER_STATUS_DISABLED = 2;
  USER_STATUS_DELETED = 3;
}

service CredentialService {
  rpc VerifyPassword(VerifyPasswordRequest) returns (VerifyPasswordResponse);
  rpc SetPassword(SetPasswordRequest) returns (SetPasswordResponse);
  rpc ChangePassword(ChangePasswordRequest) returns (ChangePasswordResponse);
}

message VerifyPasswordRequest {
  string user_id = 1;
  string password = 2;
}

message VerifyPasswordResponse {
  bool is_valid = 1;  // Constant-time response
}

class PasswordDomainService:
    def __init__(self, hasher: argon2.PasswordHasher | None = None):
        self._hasher = hasher or argon2.PasswordHasher()

    async def hash_password(self, password: str) -> str:
        """CPU-bound операция в отдельном потоке"""
        async with self._hash_semaphore:
            return await asyncio.to_thread(self._hasher.hash, password)

    async def verify_password_hash(self, password: str, password_hash: str) -> bool:
        """Constant-time верификация"""
        try:
            is_valid = await asyncio.to_thread(
                self._hasher.verify, password_hash, password
            )
        except argon2.exceptions.VerifyMismatchError:
            return False
        return is_valid

class Session:
    id: UUID                    # Session identifier
    user_id: UUID              # Associated user
    refresh_token_hash: str    # Hashed refresh token
    created_at: datetime
    expires_at: datetime
    last_used_at: datetime
    user_agent: str | None
    ip_address: str | None

class AuthService:
    async def create_session(
        self,
        user_id: UUID,
        user_agent: str | None = None,
        ip_address: str | None = None
    ) -> Session:
        """Создает новую сессию и возвращает refresh token"""

    async def refresh_tokens(
        self,
        refresh_token: str
    ) -> tuple[str, str]:
        """Обновляет access и refresh токены"""

    async def revoke_session(self, session_id: UUID) -> None:
        """Отзывает сессию (logout)"""

{
  "sub": "550e8400-e29b-41d4-a716-446655440000",
  "username": "john_doe",
  "session_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "type": "access",
  "iat": 1678886400,
  "exp": 1678887300
}

{
  "sub": "550e8400-e29b-41d4-a716-446655440000",
  "session_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "type": "refresh",
  "iat": 1678886400,
  "exp": 1681478400
}

# Envoy JWT Filter
jwt_authn:
  providers:
    aiops_jwt:
      issuer: "https://api.aiops.io"
      audiences:
        - "aiops-api"
      remote_jwks:
        http_uri:
          uri: "http://session-token-service:8080/jwks"
          cluster: token_service
        cache_duration:
          seconds: 300
      forward_payload_header: "x-jwt-payload"

async def verify_password(self, user_id: UUID, password: str) -> bool:
    """Всегда выполняет хеширование, даже если пользователя нет"""
    credential = await self._repo.get_by_user_id(user_id)

    if credential is None:
        # Фиктивная верификация против несуществующего хеша
        dummy_hash = "$argon2id$v=19$m=65536,t=3,p=4$..."
        await self._domain_service.verify_password_hash(password, dummy_hash)
        return False

    return await self._domain_service.verify_password_hash(
        password, credential.password_hash
    )

class PasswordDomainService:
    def validate_password_strength(self, password: str) -> None:
        """Валидация сложности пароля"""
        if len(password) < 8:
            raise PasswordTooWeakError("Min 8 characters")

        if not any(c.isupper() for c in password):
            raise PasswordMissingUppercaseError()

        if not any(c.islower() for c in password):
            raise PasswordMissingLowercaseError()

        if not any(c.isdigit() for c in password):
            raise PasswordMissingDigitError()

        if not any(not c.isalnum() for c in password):
            raise PasswordMissingSpecialCharError()

        # Entropy check via zxcvbn
        result = zxcvbn.zxcvbn(password)
        if result["score"] < 3:
            raise PasswordTooWeakError(result["feedback"]["warning"])