asyncapi: '2.6.0'

info:
  title: EventZR Auth Service - Kafka Event API
  version: '2.0.0'
  description: |
    AsyncAPI specification for the **auth-svc** Kafka event channels.

    The auth-svc is the central authentication and identity service for the
    EventZR platform with **202 REST endpoints**. It produces events on every
    significant identity lifecycle change (27 produced topics) and consumes
    cross-service events to maintain data consistency (10 consumed topics).

    **Kafka Events Summary:**
    - **Produced (7 key events):** user.created.v1, login.success.v1, login.failed.v1, mfa.enrolled.v1, session.revoked.v1, password.changed.v1, social.connected.v1
    - **Consumed (10 events):** user.created.v1, user.updated.v1, user.deleted.v1, tenant.created.v1, tenant.updated.v1, social.connected.v1, web3.connected.v1, session.created.v1, eventzr.user.deleted.v1, eventzr.tenant.suspended.v1

    **Event Format:** All produced events follow the [CloudEvents 1.0](https://cloudevents.io/)
    specification with JSON encoding.

    **Partitioning:** Every Kafka topic is partitioned by `tenant_id` (tenantId)
    to guarantee per-tenant ordering and to align with the platform's
    multi-tenant isolation model.

    **Topic Naming Convention:** `eventzr.auth.<entity>.<action>.v<N>`

    **Base URL:** `https://535ubezkse.execute-api.us-east-1.amazonaws.com/auth/v1`

    **Service metadata:**
    - Compute: AWS Lambda (ap-south-1)
    - Framework: NestJS 11.1.7
    - Database: Aurora PostgreSQL Serverless v2 (TypeORM)
    - Cache: ElastiCache Redis 7
  contact:
    name: EventZR Platform Team
    email: platform@eventzr.com
    url: https://eventzr.com
  license:
    name: Proprietary
    url: https://eventzr.com/legal/license

servers:
  kafka-staging:
    url: boot-gpm4u49z.c2.kafka-serverless.us-east-1.amazonaws.com:9098
    protocol: kafka-secure
    protocolVersion: '3.6.0'
    description: |
      Amazon MSK Serverless cluster (staging environment).
      Authentication uses AWS MSK IAM (SASL OAUTHBEARER with aws-msk-iam-sasl-signer-js).
      All traffic is TLS-encrypted.
    security:
      - saslAwsMskIam: []
    bindings:
      kafka:
        schemaRegistryUrl: ''
        schemaRegistryVendor: ''

defaultContentType: application/json

tags:
  - name: user-lifecycle
    description: User creation, update, verification, and deletion events
  - name: authentication
    description: Login success, login failure, and session lifecycle events
  - name: security
    description: MFA enrollment/verification, device trust, and suspicious activity events
  - name: compliance
    description: GDPR/CCPA data export, account deletion, and consent management events
  - name: admin
    description: Role changes, token revocation, tenant configuration events
  - name: integration
    description: Social OAuth, Web3 wallet, SSO, and biometric connection events
  - name: consumed
    description: Events consumed from other services for cross-service consistency

# ---------------------------------------------------------------------------
# CHANNELS
# ---------------------------------------------------------------------------
channels:
  # ==========================================================================
  # USER LIFECYCLE (produced)
  # ==========================================================================

  eventzr.auth.user.created.v1:
    description: |
      Emitted when a new user account is created via any registration method
      (email/password, passwordless, social OAuth, Web3 wallet, SSO, or
      admin bulk import). Downstream consumers include user-svc, wallet-svc,
      notify-svc, and the Neptune KG sync pipeline.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishUserCreated
      summary: User account created
      tags:
        - name: user-lifecycle
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
              - user-svc-consumer
              - wallet-svc-consumer
              - notify-svc-consumer
          clientId:
            type: string
            enum:
              - auth-svc
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/UserCreated'

  eventzr.auth.user.updated.v1:
    description: |
      Emitted when user profile fields are modified (display name, locale,
      timezone, avatar, phone, roles, status, etc.). The KG sync consumer
      re-syncs the user vertex on receipt.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishUserUpdated
      summary: User profile updated
      tags:
        - name: user-lifecycle
      message:
        $ref: '#/components/messages/UserUpdated'

  eventzr.auth.user.verified.v1:
    description: |
      Emitted when a user completes email or phone verification. Triggers
      status transition from `pending_verification` to `active`.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishUserVerified
      summary: User email or phone verified
      tags:
        - name: user-lifecycle
      message:
        $ref: '#/components/messages/UserVerified'

  eventzr.auth.user.deleted.v1:
    description: |
      Emitted when a user account is permanently deleted (after grace period
      expiration or immediate admin action). All dependent data (sessions,
      MFA factors, social connections, devices) is cascade-deleted.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishUserDeleted
      summary: User account deleted
      tags:
        - name: user-lifecycle
      message:
        $ref: '#/components/messages/AuthUserDeleted'

  eventzr.auth.user.roles-changed.v1:
    description: |
      Emitted when a user's roles array is modified by an admin. Used by
      downstream services to update authorization caches.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishUserRolesChanged
      summary: User roles changed
      tags:
        - name: admin
      message:
        $ref: '#/components/messages/UserRolesChanged'

  # ==========================================================================
  # AUTHENTICATION (produced)
  # ==========================================================================

  eventzr.auth.login.success.v1:
    description: |
      Emitted on every successful authentication. Includes the session JTI
      for correlation. Consumed by analytics-svc for login metrics and by
      the KG sync pipeline to create Session nodes.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishLoginSuccess
      summary: Login succeeded
      tags:
        - name: authentication
      message:
        $ref: '#/components/messages/LoginSuccess'

  eventzr.auth.login.failed.v1:
    description: |
      Emitted on every failed authentication attempt. Includes the failure
      reason (invalid_credentials, account_locked, mfa_required, etc.).
      Consumed by security monitoring and analytics pipelines.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishLoginFailed
      summary: Login failed
      tags:
        - name: authentication
      message:
        $ref: '#/components/messages/LoginFailed'

  eventzr.auth.session.created.v1:
    description: |
      Emitted when a new session (refresh token) is issued. The KG sync
      consumer creates a Session node and a User-to-Session relationship.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishSessionCreated
      summary: Session created
      tags:
        - name: authentication
      message:
        $ref: '#/components/messages/SessionCreated'

  eventzr.auth.session.revoked.v1:
    description: |
      Emitted when a session is revoked (explicit logout, token rotation,
      admin action, or tenant suspension cascade). Token blacklist is
      updated in Redis before this event is published.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishSessionRevoked
      summary: Session revoked
      tags:
        - name: authentication
      message:
        $ref: '#/components/messages/SessionRevoked'

  eventzr.auth.token.revoked.v1:
    description: |
      Emitted when a specific access or refresh token is revoked by an admin
      or automated security rule. Distinct from session revocation: a single
      session may have multiple tokens.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishTokenRevoked
      summary: Token revoked
      tags:
        - name: admin
      message:
        $ref: '#/components/messages/TokenRevoked'

  # ==========================================================================
  # SECURITY (produced)
  # ==========================================================================

  eventzr.auth.password.changed.v1:
    description: |
      Emitted when a user changes or resets their password. All existing
      sessions except the current one are revoked. Consumed by notify-svc
      to send a security notification email.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishPasswordChanged
      summary: Password changed
      tags:
        - name: security
      message:
        $ref: '#/components/messages/PasswordChanged'

  eventzr.auth.mfa.enrolled.v1:
    description: |
      Emitted when a user enrolls a new MFA factor (TOTP, SMS, WhatsApp,
      or WebAuthn). The factor may not yet be verified at this point.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishMfaEnrolled
      summary: MFA factor enrolled
      tags:
        - name: security
      message:
        $ref: '#/components/messages/MfaEnrolled'

  eventzr.auth.mfa.verified.v1:
    description: |
      Emitted when a user successfully verifies an MFA factor for the first
      time (confirming enrollment) or passes an MFA challenge during login.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishMfaVerified
      summary: MFA factor verified
      tags:
        - name: security
      message:
        $ref: '#/components/messages/MfaVerified'

  eventzr.auth.device.trusted.v1:
    description: |
      Emitted when a device is marked as trusted for a user (e.g., after
      successful MFA on that device or explicit admin/user action).
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishDeviceTrusted
      summary: Device trusted
      tags:
        - name: security
      message:
        $ref: '#/components/messages/DeviceTrusted'

  eventzr.auth.device.untrusted.v1:
    description: |
      Emitted when a previously trusted device is revoked (user action,
      admin action, or automatic revocation due to suspicious activity).
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishDeviceUntrusted
      summary: Device untrusted
      tags:
        - name: security
      message:
        $ref: '#/components/messages/DeviceUntrusted'

  eventzr.auth.security.event.detected.v1:
    description: |
      Emitted when suspicious activity is detected (brute-force attempt,
      impossible travel, credential stuffing, anomalous IP, etc.). Severity
      levels: low, medium, high, critical.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishSecurityEventDetected
      summary: Security event detected
      tags:
        - name: security
      message:
        $ref: '#/components/messages/SecurityEventDetected'

  eventzr.auth.biometric.enrolled.v1:
    description: |
      Emitted when a biometric or WebAuthn/passkey credential is enrolled
      for a user.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishBiometricEnrolled
      summary: Biometric credential enrolled
      tags:
        - name: security
      message:
        $ref: '#/components/messages/BiometricEnrolled'

  # ==========================================================================
  # INTEGRATION (produced)
  # ==========================================================================

  eventzr.auth.social.connected.v1:
    description: |
      Emitted when a social OAuth provider (Google, Facebook, Apple, GitHub,
      etc.) is linked to a user account. The KG sync consumer creates a
      User-to-SocialAccount relationship.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishSocialConnected
      summary: Social provider connected
      tags:
        - name: integration
      message:
        $ref: '#/components/messages/SocialConnected'

  eventzr.auth.web3.connected.v1:
    description: |
      Emitted when a Web3 wallet is connected to a user account via
      SIWE (Sign-In with Ethereum) or equivalent. The KG sync consumer
      creates a User-to-Web3Wallet relationship.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishWeb3Connected
      summary: Web3 wallet connected
      tags:
        - name: integration
      message:
        $ref: '#/components/messages/Web3Connected'

  eventzr.auth.sso.connected.v1:
    description: |
      Emitted when an enterprise SSO provider (SAML 2.0 or OIDC) is
      connected for a tenant/user.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishSsoConnected
      summary: SSO provider connected
      tags:
        - name: integration
      message:
        $ref: '#/components/messages/SsoConnected'

  # ==========================================================================
  # COMPLIANCE (produced)
  # ==========================================================================

  eventzr.auth.data-export.requested.v1:
    description: |
      Emitted when a user or admin requests a data export (GDPR Article 20
      right to data portability, or CCPA equivalent). The export job runs
      asynchronously and emits a completion event when done.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishDataExportRequested
      summary: Data export requested
      tags:
        - name: compliance
      message:
        $ref: '#/components/messages/DataExportRequested'

  eventzr.auth.account-deletion.requested.v1:
    description: |
      Emitted when a user requests account deletion (GDPR Article 17 right
      to erasure). A grace period (default 30 days) applies before permanent
      deletion. The user may cancel during the grace period.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishAccountDeletionRequested
      summary: Account deletion requested
      tags:
        - name: compliance
      message:
        $ref: '#/components/messages/AccountDeletionRequested'

  eventzr.auth.consent.updated.v1:
    description: |
      Emitted when a user updates their consent preferences (marketing,
      analytics, profiling, processing, cookies, email). Consent changes
      are audited and timestamped.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishConsentUpdated
      summary: Consent preferences updated
      tags:
        - name: compliance
      message:
        $ref: '#/components/messages/ConsentUpdated'

  # ==========================================================================
  # ADMIN (produced)
  # ==========================================================================

  eventzr.auth.tenant.config-updated.v1:
    description: |
      Emitted when a tenant's authentication configuration is updated
      (password policy, MFA requirements, allowed auth methods, session
      lifetime, IP whitelist, etc.).
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishTenantConfigUpdated
      summary: Tenant auth config updated
      tags:
        - name: admin
      message:
        $ref: '#/components/messages/TenantConfigUpdated'

  eventzr.auth.tenant.created.v1:
    description: |
      Emitted when a new tenant is provisioned. The KG sync consumer
      creates a Tenant vertex in Neptune.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishTenantCreated
      summary: Tenant created
      tags:
        - name: admin
      message:
        $ref: '#/components/messages/TenantCreated'

  eventzr.auth.tenant.updated.v1:
    description: |
      Emitted when tenant metadata (name, slug, domain, active status)
      is modified. The KG sync consumer re-syncs the Tenant vertex.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishTenantUpdated
      summary: Tenant updated
      tags:
        - name: admin
      message:
        $ref: '#/components/messages/TenantUpdated'

  eventzr.auth.bulk.operation.completed.v1:
    description: |
      Emitted when a bulk user operation (create, update, delete, activate,
      deactivate, or password reset) completes. Includes success/failure
      counts for monitoring.
    bindings:
      kafka:
        partitions: 12
        replicas: 3
        topicConfiguration:
          retention.ms: 604800000
          cleanup.policy:
            - delete
    publish:
      operationId: publishBulkOperationCompleted
      summary: Bulk operation completed
      tags:
        - name: admin
      message:
        $ref: '#/components/messages/BulkOperationCompleted'

  # ==========================================================================
  # CONSUMED CHANNELS (subscribed by auth-svc)
  # ==========================================================================

  # --------------------------------------------------------------------------
  # KG Sync consumed channels (auth-svc consumes its own produced events
  # via the KG sync consumer group to sync vertices/edges to Neptune)
  # --------------------------------------------------------------------------

  eventzr.auth.user.created.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a user is created,
      the KG sync consumer creates a User vertex in Neptune with all
      profile attributes and a User-to-Tenant relationship.
    subscribe:
      operationId: consumeUserCreatedKgSync
      summary: KG sync - create User vertex on user creation
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/UserCreated'

  eventzr.auth.user.updated.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a user profile is
      updated, the KG sync consumer re-syncs the User vertex properties
      in Neptune.
    subscribe:
      operationId: consumeUserUpdatedKgSync
      summary: KG sync - update User vertex on profile change
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/UserUpdated'

  eventzr.auth.user.deleted.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a user is deleted,
      the KG sync consumer removes the User vertex and all associated
      edges from Neptune.
    subscribe:
      operationId: consumeUserDeletedKgSync
      summary: KG sync - remove User vertex on deletion
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/AuthUserDeleted'

  eventzr.auth.tenant.created.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a tenant is created,
      the KG sync consumer creates a Tenant vertex in Neptune.
    subscribe:
      operationId: consumeTenantCreatedKgSync
      summary: KG sync - create Tenant vertex
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/TenantCreated'

  eventzr.auth.tenant.updated.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When tenant metadata is
      updated, the KG sync consumer re-syncs the Tenant vertex in Neptune.
    subscribe:
      operationId: consumeTenantUpdatedKgSync
      summary: KG sync - update Tenant vertex
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/TenantUpdated'

  eventzr.auth.social.connected.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a social provider is
      connected, the KG sync consumer creates a User-to-SocialAccount
      relationship in Neptune.
    subscribe:
      operationId: consumeSocialConnectedKgSync
      summary: KG sync - create social account relationship
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/SocialConnected'

  eventzr.auth.web3.connected.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a Web3 wallet is
      connected, the KG sync consumer creates a User-to-Web3Wallet
      relationship in Neptune.
    subscribe:
      operationId: consumeWeb3ConnectedKgSync
      summary: KG sync - create Web3 wallet relationship
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/Web3Connected'

  eventzr.auth.session.created.v1.kg-sync:
    description: |
      Consumed by the auth-svc KG sync pipeline. When a session is created,
      the KG sync consumer creates a Session node and a User-to-Session
      relationship in Neptune.
    subscribe:
      operationId: consumeSessionCreatedKgSync
      summary: KG sync - create Session node
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-kg-sync
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/SessionCreated'

  # --------------------------------------------------------------------------
  # Cross-service consumed channels
  # --------------------------------------------------------------------------

  eventzr.user.deleted.v1:
    description: |
      Consumed from user-svc. When a user is deleted in the user service,
      auth-svc cascade-deletes the corresponding auth user record and all
      related sessions, MFA factors, social connections, and devices.
    subscribe:
      operationId: consumeUserDeleted
      summary: Handle user deletion from user-svc
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-consumer
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/ExternalUserDeleted'

  eventzr.tenant.suspended.v1:
    description: |
      Consumed from tenant management. When a tenant is suspended, auth-svc
      revokes all active sessions for that tenant by setting `revokedAt`
      on every AuthSession record.
    subscribe:
      operationId: consumeTenantSuspended
      summary: Handle tenant suspension
      tags:
        - name: consumed
      bindings:
        kafka:
          groupId:
            type: string
            enum:
              - auth-svc-consumer
          bindingVersion: '0.5.0'
      message:
        $ref: '#/components/messages/ExternalTenantSuspended'

# ---------------------------------------------------------------------------
# COMPONENTS
# ---------------------------------------------------------------------------
components:
  securitySchemes:
    saslAwsMskIam:
      type: scramSha512
      description: |
        AWS MSK IAM authentication via SASL OAUTHBEARER mechanism.
        The auth-svc Lambda uses aws-msk-iam-sasl-signer-js to generate
        short-lived tokens from the execution role's IAM credentials.

  messageTraits:
    CloudEventEnvelope:
      headers:
        type: object
        required:
          - ce_specversion
          - ce_type
          - ce_source
          - ce_id
          - ce_time
          - ce_tenantid
        properties:
          ce_specversion:
            type: string
            const: '1.0'
            description: CloudEvents specification version
          ce_type:
            type: string
            description: 'CloudEvents type (e.g., com.eventzr.auth.user.created)'
          ce_source:
            type: string
            const: 'https://eventzr.com/auth-svc'
            description: CloudEvents source URI
          ce_id:
            type: string
            format: uuid
            description: Unique event identifier
          ce_time:
            type: string
            format: date-time
            description: Event timestamp (ISO 8601)
          ce_subject:
            type: string
            description: 'CloudEvents subject (e.g., user/<userId>)'
          ce_datacontenttype:
            type: string
            const: application/json
          ce_tenantid:
            type: string
            format: uuid
            description: Tenant identifier (also used as Kafka partition key)
          ce_actor:
            type: string
            description: ID of the user or system that triggered the event
      bindings:
        kafka:
          key:
            type: string
            format: uuid
            description: Kafka message key is always the tenant_id
          bindingVersion: '0.5.0'

  schemas:
    # ---- Reusable CloudEvents envelope ----

    CloudEventBase:
      type: object
      description: CloudEvents 1.0 base envelope
      required:
        - specversion
        - type
        - source
        - subject
        - id
        - time
        - datacontenttype
        - tenantid
        - data
      properties:
        specversion:
          type: string
          const: '1.0'
          description: CloudEvents specification version
        type:
          type: string
          description: 'Event type in reverse-DNS notation (e.g., com.eventzr.auth.user.created)'
        source:
          type: string
          const: 'https://eventzr.com/auth-svc'
          description: Identifies the context in which the event happened
        subject:
          type: string
          description: 'Subject of the event (e.g., user/<userId>, session/<sessionId>)'
        id:
          type: string
          format: uuid
          description: Unique event identifier (UUID v4)
        time:
          type: string
          format: date-time
          description: Timestamp of when the event occurred (ISO 8601)
        datacontenttype:
          type: string
          const: application/json
          description: Content type of the data attribute
        tenantid:
          type: string
          format: uuid
          description: Tenant identifier for multi-tenant isolation
        actor:
          type: string
          description: ID of the user or system that triggered the event
        data:
          type: object
          description: Event-specific payload

    # ---- User lifecycle payloads ----

    UserCreatedData:
      type: object
      description: Payload for user.created event
      required:
        - userId
        - email
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: Unique user identifier
        email:
          type: string
          format: email
          nullable: true
          description: User email address (null for phone-only or Web3 registrations)
        tenantId:
          type: string
          format: uuid
          description: Tenant the user belongs to

    UserUpdatedData:
      type: object
      description: Payload for user.updated event
      required:
        - userId
        - tenantId
        - changedFields
      properties:
        userId:
          type: string
          format: uuid
          description: Unique user identifier
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        changedFields:
          type: array
          items:
            type: string
          description: List of fields that were modified
          example:
            - displayName
            - locale
            - avatarUrl

    UserVerifiedData:
      type: object
      description: Payload for user.verified event
      required:
        - userId
        - tenantId
        - verificationType
      properties:
        userId:
          type: string
          format: uuid
          description: Unique user identifier
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        verificationType:
          type: string
          enum:
            - email
            - phone
          description: Type of verification completed

    AuthUserDeletedData:
      type: object
      description: Payload for auth user.deleted event
      required:
        - userId
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: Unique user identifier
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        reason:
          type: string
          description: Reason for deletion (account_deletion_request, admin_action, etc.)

    UserRolesChangedData:
      type: object
      description: Payload for user.roles-changed event
      required:
        - userId
        - tenantId
        - previousRoles
        - newRoles
        - changedBy
      properties:
        userId:
          type: string
          format: uuid
          description: User whose roles were changed
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        previousRoles:
          type: array
          items:
            type: string
          description: Previous role set
          example:
            - user
        newRoles:
          type: array
          items:
            type: string
          description: New role set after the change
          example:
            - user
            - organizer
        changedBy:
          type: string
          format: uuid
          description: Admin user who made the change

    # ---- Authentication payloads ----

    LoginSuccessData:
      type: object
      description: Payload for login.success event
      required:
        - userId
        - sessionId
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: Authenticated user identifier
        sessionId:
          type: string
          format: uuid
          description: Session JTI (refresh token identifier)
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    LoginFailedData:
      type: object
      description: Payload for login.failed event
      required:
        - email
        - reason
        - tenantId
      properties:
        email:
          type: string
          format: email
          description: Email address used in the failed attempt
        reason:
          type: string
          description: Failure reason code
          example: invalid_credentials
          enum:
            - invalid_credentials
            - account_locked
            - account_suspended
            - mfa_required
            - mfa_failed
            - ip_blocked
            - rate_limited
            - tenant_suspended
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    SessionCreatedData:
      type: object
      description: Payload for session.created event
      required:
        - sessionId
        - userId
        - tenantId
      properties:
        sessionId:
          type: string
          format: uuid
          description: Session JTI (refresh token identifier)
        userId:
          type: string
          format: uuid
          description: User who owns the session
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        deviceInfo:
          type: object
          description: Device/browser information
        ipAddress:
          type: string
          description: Client IP address
        expiresAt:
          type: string
          format: date-time
          description: Session expiration timestamp

    SessionRevokedData:
      type: object
      description: Payload for session.revoked event
      required:
        - sessionId
        - userId
        - tenantId
      properties:
        sessionId:
          type: string
          format: uuid
          description: Revoked session JTI
        userId:
          type: string
          format: uuid
          description: User who owned the session
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    TokenRevokedData:
      type: object
      description: Payload for token.revoked event
      required:
        - tokenId
        - userId
        - tenantId
        - revokedBy
      properties:
        tokenId:
          type: string
          description: Token JTI that was revoked
        userId:
          type: string
          format: uuid
          description: User whose token was revoked
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        revokedBy:
          type: string
          description: Admin or system identifier that performed the revocation
        reason:
          type: string
          description: Reason for revocation
          example: admin_action

    # ---- Security payloads ----

    PasswordChangedData:
      type: object
      description: Payload for password.changed event
      required:
        - userId
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who changed their password
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    MfaEnrolledData:
      type: object
      description: Payload for mfa.enrolled event
      required:
        - userId
        - type
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who enrolled MFA
        type:
          type: string
          enum:
            - totp
            - sms
            - whatsapp
            - webauthn
          description: MFA factor type
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    MfaVerifiedData:
      type: object
      description: Payload for mfa.verified event
      required:
        - userId
        - type
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who verified MFA
        type:
          type: string
          enum:
            - totp
            - sms
            - whatsapp
            - webauthn
          description: MFA factor type that was verified
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        isInitialVerification:
          type: boolean
          description: True if this is the first-time verification (enrollment confirmation)

    DeviceTrustedData:
      type: object
      description: Payload for device.trusted event
      required:
        - userId
        - deviceId
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who owns the device
        deviceId:
          type: string
          description: Unique device identifier
        deviceName:
          type: string
          nullable: true
          description: Human-readable device name
          example: Chrome on Windows
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    DeviceUntrustedData:
      type: object
      description: Payload for device.untrusted event
      required:
        - userId
        - deviceId
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who owned the device
        deviceId:
          type: string
          description: Unique device identifier
        deviceName:
          type: string
          nullable: true
          description: Human-readable device name
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        reason:
          type: string
          description: Reason the device was untrusted
          example: user_action
          enum:
            - user_action
            - admin_action
            - suspicious_activity
            - inactivity

    SecurityEventDetectedData:
      type: object
      description: Payload for security.event.detected event
      required:
        - eventType
        - severity
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          nullable: true
          description: Affected user (null for tenant-level events)
        eventType:
          type: string
          description: Type of security event detected
          example: brute_force_attempt
          enum:
            - brute_force_attempt
            - impossible_travel
            - credential_stuffing
            - anomalous_ip
            - suspicious_device
            - account_takeover_attempt
            - rate_limit_exceeded
        severity:
          type: string
          enum:
            - low
            - medium
            - high
            - critical
          description: Severity level
        ipAddress:
          type: string
          nullable: true
          description: Source IP address
        metadata:
          type: object
          description: Additional context (geolocation, device info, etc.)
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    BiometricEnrolledData:
      type: object
      description: Payload for biometric.enrolled event
      required:
        - userId
        - credentialType
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who enrolled the credential
        credentialType:
          type: string
          enum:
            - webauthn
            - passkey
          description: Type of biometric credential
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    # ---- Integration payloads ----

    SocialConnectedData:
      type: object
      description: Payload for social.connected event
      required:
        - userId
        - provider
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who connected the social account
        provider:
          type: string
          description: Social OAuth provider name
          example: google
          enum:
            - google
            - facebook
            - apple
            - github
            - twitter
            - linkedin
            - microsoft
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    Web3ConnectedData:
      type: object
      description: Payload for web3.connected event
      required:
        - userId
        - walletAddress
        - chain
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who connected the wallet
        walletAddress:
          type: string
          description: Blockchain wallet address
          example: '0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18'
        chain:
          type: string
          description: Blockchain network identifier
          example: eth
          enum:
            - eth
            - polygon
            - bsc
            - solana
            - avalanche
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    SsoConnectedData:
      type: object
      description: Payload for sso.connected event
      required:
        - userId
        - provider
        - protocol
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User who connected the SSO provider
        provider:
          type: string
          description: SSO identity provider name
          example: okta
        protocol:
          type: string
          enum:
            - saml
            - oidc
          description: SSO protocol used
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    # ---- Compliance payloads ----

    DataExportRequestedData:
      type: object
      description: Payload for data-export.requested event
      required:
        - userId
        - format
        - requestedBy
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: User whose data is being exported
        format:
          type: string
          enum:
            - json
            - csv
            - pdf
          description: Requested export format
        requestedBy:
          type: string
          format: uuid
          description: User or admin who initiated the request
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    AccountDeletionRequestedData:
      type: object
      description: Payload for account-deletion.requested event
      required:
        - userId
        - tenantId
        - scheduledDeletionAt
        - gracePeriodDays
      properties:
        userId:
          type: string
          format: uuid
          description: User requesting account deletion
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        reason:
          type: string
          nullable: true
          description: User-provided reason for deletion
        scheduledDeletionAt:
          type: string
          format: date-time
          description: Timestamp when permanent deletion will occur
        gracePeriodDays:
          type: integer
          description: Number of days in the grace period before permanent deletion
          example: 30

    ConsentUpdatedData:
      type: object
      description: Payload for consent.updated event
      required:
        - userId
        - tenantId
        - consentType
        - granted
        - source
      properties:
        userId:
          type: string
          format: uuid
          description: User who updated their consent
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier
        consentType:
          type: string
          enum:
            - marketing
            - analytics
            - profiling
            - processing
            - cookies
            - email
          description: Type of consent that was changed
        granted:
          type: boolean
          description: Whether the consent was granted (true) or revoked (false)
        source:
          type: string
          description: Where the consent change originated
          example: user_settings
          enum:
            - user_settings
            - signup
            - api
            - admin

    # ---- Admin payloads ----

    TenantConfigUpdatedData:
      type: object
      description: Payload for tenant.config-updated event
      required:
        - tenantId
        - updatedBy
        - changes
      properties:
        tenantId:
          type: string
          format: uuid
          description: Tenant whose configuration was updated
        updatedBy:
          type: string
          format: uuid
          description: Admin user who made the changes
        changes:
          type: object
          description: Map of changed configuration keys and their new values

    TenantCreatedData:
      type: object
      description: Payload for tenant.created event
      required:
        - tenantId
        - name
        - slug
      properties:
        tenantId:
          type: string
          format: uuid
          description: New tenant identifier
        name:
          type: string
          description: Tenant display name
          example: Acme Corporation
        slug:
          type: string
          description: URL-safe tenant slug
          example: acme-corp
        domain:
          type: string
          nullable: true
          description: Primary domain for the tenant

    TenantUpdatedData:
      type: object
      description: Payload for tenant.updated event
      required:
        - tenantId
      properties:
        tenantId:
          type: string
          format: uuid
          description: Updated tenant identifier
        changedFields:
          type: array
          items:
            type: string
          description: List of fields that were modified

    BulkOperationCompletedData:
      type: object
      description: Payload for bulk.operation.completed event
      required:
        - operation
        - totalUsers
        - successCount
        - failureCount
        - tenantId
      properties:
        operation:
          type: string
          enum:
            - create
            - update
            - delete
            - activate
            - deactivate
            - reset_password
          description: Type of bulk operation that completed
        totalUsers:
          type: integer
          description: Total number of users targeted
        successCount:
          type: integer
          description: Number of successful operations
        failureCount:
          type: integer
          description: Number of failed operations
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    # ---- External consumed event payloads ----

    ExternalUserDeletedData:
      type: object
      description: Payload for user.deleted event consumed from user-svc
      required:
        - userId
        - tenantId
      properties:
        userId:
          type: string
          format: uuid
          description: Deleted user identifier
        tenantId:
          type: string
          format: uuid
          description: Tenant identifier

    ExternalTenantSuspendedData:
      type: object
      description: Payload for tenant.suspended event consumed from tenant management
      required:
        - tenantId
      properties:
        tenantId:
          type: string
          format: uuid
          description: Suspended tenant identifier

  # --------------------------------------------------------------------------
  # MESSAGES
  # --------------------------------------------------------------------------
  messages:
    # ---- User lifecycle messages ----

    UserCreated:
      name: UserCreated
      title: User Created
      summary: A new user account was created
      description: |
        Published when a user registers via email/password, passwordless link,
        social OAuth, Web3 wallet, SSO, or admin bulk import.
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.user.created
              data:
                $ref: '#/components/schemas/UserCreatedData'

    UserUpdated:
      name: UserUpdated
      title: User Updated
      summary: A user's profile was modified
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.user.updated
              data:
                $ref: '#/components/schemas/UserUpdatedData'

    UserVerified:
      name: UserVerified
      title: User Verified
      summary: A user completed email or phone verification
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.user.verified
              data:
                $ref: '#/components/schemas/UserVerifiedData'

    AuthUserDeleted:
      name: AuthUserDeleted
      title: Auth User Deleted
      summary: A user account was permanently deleted from auth-svc
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.user.deleted
              data:
                $ref: '#/components/schemas/AuthUserDeletedData'

    UserRolesChanged:
      name: UserRolesChanged
      title: User Roles Changed
      summary: A user's roles were modified by an admin
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.user.roles-changed
              data:
                $ref: '#/components/schemas/UserRolesChangedData'

    # ---- Authentication messages ----

    LoginSuccess:
      name: LoginSuccess
      title: Login Succeeded
      summary: A user authenticated successfully
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.login.success
              data:
                $ref: '#/components/schemas/LoginSuccessData'

    LoginFailed:
      name: LoginFailed
      title: Login Failed
      summary: An authentication attempt failed
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.login.failed
              data:
                $ref: '#/components/schemas/LoginFailedData'

    SessionCreated:
      name: SessionCreated
      title: Session Created
      summary: A new session (refresh token) was issued
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.session.created
              data:
                $ref: '#/components/schemas/SessionCreatedData'

    SessionRevoked:
      name: SessionRevoked
      title: Session Revoked
      summary: A session was revoked (logout, rotation, or admin action)
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.session.revoked
              data:
                $ref: '#/components/schemas/SessionRevokedData'

    TokenRevoked:
      name: TokenRevoked
      title: Token Revoked
      summary: A specific token was revoked by an admin or security rule
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.token.revoked
              data:
                $ref: '#/components/schemas/TokenRevokedData'

    # ---- Security messages ----

    PasswordChanged:
      name: PasswordChanged
      title: Password Changed
      summary: A user changed or reset their password
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.password.changed
              data:
                $ref: '#/components/schemas/PasswordChangedData'

    MfaEnrolled:
      name: MfaEnrolled
      title: MFA Enrolled
      summary: A user enrolled a new MFA factor
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.mfa.enrolled
              data:
                $ref: '#/components/schemas/MfaEnrolledData'

    MfaVerified:
      name: MfaVerified
      title: MFA Verified
      summary: A user verified an MFA factor
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.mfa.verified
              data:
                $ref: '#/components/schemas/MfaVerifiedData'

    DeviceTrusted:
      name: DeviceTrusted
      title: Device Trusted
      summary: A device was marked as trusted
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.device.trusted
              data:
                $ref: '#/components/schemas/DeviceTrustedData'

    DeviceUntrusted:
      name: DeviceUntrusted
      title: Device Untrusted
      summary: A previously trusted device was revoked
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.device.untrusted
              data:
                $ref: '#/components/schemas/DeviceUntrustedData'

    SecurityEventDetected:
      name: SecurityEventDetected
      title: Security Event Detected
      summary: Suspicious activity was detected
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.security.event.detected
              data:
                $ref: '#/components/schemas/SecurityEventDetectedData'

    BiometricEnrolled:
      name: BiometricEnrolled
      title: Biometric Enrolled
      summary: A biometric/WebAuthn credential was enrolled
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.biometric.enrolled
              data:
                $ref: '#/components/schemas/BiometricEnrolledData'

    # ---- Integration messages ----

    SocialConnected:
      name: SocialConnected
      title: Social Provider Connected
      summary: A social OAuth provider was linked to a user account
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.social.connected
              data:
                $ref: '#/components/schemas/SocialConnectedData'

    Web3Connected:
      name: Web3Connected
      title: Web3 Wallet Connected
      summary: A blockchain wallet was linked to a user account
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.web3.connected
              data:
                $ref: '#/components/schemas/Web3ConnectedData'

    SsoConnected:
      name: SsoConnected
      title: SSO Provider Connected
      summary: An enterprise SSO provider was connected
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.sso.connected
              data:
                $ref: '#/components/schemas/SsoConnectedData'

    # ---- Compliance messages ----

    DataExportRequested:
      name: DataExportRequested
      title: Data Export Requested
      summary: A GDPR/CCPA data export was requested
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.data-export.requested
              data:
                $ref: '#/components/schemas/DataExportRequestedData'

    AccountDeletionRequested:
      name: AccountDeletionRequested
      title: Account Deletion Requested
      summary: A user requested account deletion with grace period
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.account-deletion.requested
              data:
                $ref: '#/components/schemas/AccountDeletionRequestedData'

    ConsentUpdated:
      name: ConsentUpdated
      title: Consent Updated
      summary: A user updated their consent preferences
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.consent.updated
              data:
                $ref: '#/components/schemas/ConsentUpdatedData'

    # ---- Admin messages ----

    TenantConfigUpdated:
      name: TenantConfigUpdated
      title: Tenant Config Updated
      summary: Tenant authentication configuration was updated
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.tenant.config-updated
              data:
                $ref: '#/components/schemas/TenantConfigUpdatedData'

    TenantCreated:
      name: TenantCreated
      title: Tenant Created
      summary: A new tenant was provisioned
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.tenant.created
              data:
                $ref: '#/components/schemas/TenantCreatedData'

    TenantUpdated:
      name: TenantUpdated
      title: Tenant Updated
      summary: Tenant metadata was modified
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.tenant.updated
              data:
                $ref: '#/components/schemas/TenantUpdatedData'

    BulkOperationCompleted:
      name: BulkOperationCompleted
      title: Bulk Operation Completed
      summary: A bulk user operation completed
      contentType: application/json
      traits:
        - $ref: '#/components/messageTraits/CloudEventEnvelope'
      payload:
        allOf:
          - $ref: '#/components/schemas/CloudEventBase'
          - type: object
            properties:
              type:
                const: com.eventzr.auth.bulk.operation.completed
              data:
                $ref: '#/components/schemas/BulkOperationCompletedData'

    # ---- Consumed (external) messages ----

    ExternalUserDeleted:
      name: ExternalUserDeleted
      title: User Deleted (from user-svc)
      summary: Consumed from user-svc to cascade-delete auth records
      contentType: application/json
      payload:
        type: object
        required:
          - data
        properties:
          data:
            $ref: '#/components/schemas/ExternalUserDeletedData'

    ExternalTenantSuspended:
      name: ExternalTenantSuspended
      title: Tenant Suspended (external)
      summary: Consumed to revoke all sessions for a suspended tenant
      contentType: application/json
      payload:
        type: object
        required:
          - data
        properties:
          data:
            $ref: '#/components/schemas/ExternalTenantSuspendedData'
