🎉 Initial Commit

2024-07-14 20:25:30 +08:00
commit 466b240e95
41 changed files with 4312 additions and 0 deletions
--- a/pkg/hyper/auth.go
+++ b/pkg/hyper/auth.go
@@ -0,0 +1,65 @@
+package hyper
+
+import (
+	"context"
+	"fmt"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/directory"
+	"time"
+
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"google.golang.org/grpc"
+)
+
+func (v *HyperConn) DoAuthenticate(atk, rtk string) (acc *proto.UserInfo, accessTk string, refreshTk string, err error) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	var in *grpc.ClientConn
+	in, err = v.GetServiceGrpcConn(directory.ServiceTypeAuthProvider)
+	if err != nil {
+		return
+	}
+
+	var reply *proto.AuthReply
+	reply, err = proto.NewAuthClient(in).Authenticate(ctx, &proto.AuthRequest{
+		AccessToken:  atk,
+		RefreshToken: &rtk,
+	})
+	if err != nil {
+		return
+	}
+	if reply != nil {
+		acc = reply.GetInfo().GetInfo()
+		accessTk = reply.GetInfo().GetNewAccessToken()
+		refreshTk = reply.GetInfo().GetNewRefreshToken()
+		if !reply.IsValid {
+			err = fmt.Errorf("invalid authorization context")
+			return
+		}
+	}
+
+	return
+}
+
+func (v *HyperConn) CheckPermGranted(atk string, key string, val []byte) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	in, err := v.GetServiceGrpcConn(directory.ServiceTypeAuthProvider)
+	if err != nil {
+		return err
+	}
+
+	reply, err := proto.NewAuthClient(in).EnsurePermGranted(ctx, &proto.CheckPermRequest{
+		Token: atk,
+		Key:   key,
+		Value: val,
+	})
+	if err != nil {
+		return err
+	} else if !reply.GetIsValid() {
+		return fmt.Errorf("missing permission: %s", key)
+	}
+
+	return nil
+}
--- a/pkg/hyper/auth_adaptor.go
+++ b/pkg/hyper/auth_adaptor.go
@@ -0,0 +1,70 @@
+package hyper
+
+import (
+	"strings"
+	"time"
+
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"github.com/gofiber/fiber/v2"
+	jsoniter "github.com/json-iterator/go"
+)
+
+const CookieAtk = "__hydrogen_atk"
+const CookieRtk = "__hydrogen_rtk"
+
+func (v *HyperConn) AuthMiddleware(c *fiber.Ctx) error {
+	var atk string
+	if cookie := c.Cookies(CookieAtk); len(cookie) > 0 {
+		atk = cookie
+	}
+	if header := c.Get(fiber.HeaderAuthorization); len(header) > 0 {
+		tk := strings.Replace(header, "Bearer", "", 1)
+		atk = strings.TrimSpace(tk)
+	}
+	if tk := c.Query("tk"); len(tk) > 0 {
+		atk = strings.TrimSpace(tk)
+	}
+
+	c.Locals("p_token", atk)
+
+	rtk := c.Cookies(CookieRtk)
+	if user, newAtk, newRtk, err := v.DoAuthenticate(atk, rtk); err == nil {
+		if newAtk != atk {
+			c.Cookie(&fiber.Cookie{
+				Name:     CookieAtk,
+				Value:    newAtk,
+				SameSite: "Lax",
+				Expires:  time.Now().Add(60 * time.Minute),
+				Path:     "/",
+			})
+			c.Cookie(&fiber.Cookie{
+				Name:     CookieRtk,
+				Value:    newRtk,
+				SameSite: "Lax",
+				Expires:  time.Now().Add(24 * 30 * time.Hour),
+				Path:     "/",
+			})
+		}
+		c.Locals("p_user", user)
+	}
+
+	return c.Next()
+}
+
+func (v *HyperConn) EnsureAuthenticated(c *fiber.Ctx) error {
+	if _, ok := c.Locals("p_user").(*proto.UserInfo); !ok {
+		return fiber.NewError(fiber.StatusUnauthorized)
+	}
+	return nil
+}
+
+func (v *HyperConn) EnsureGrantedPerm(c *fiber.Ctx, key string, val any) error {
+	if err := v.EnsureAuthenticated(c); err != nil {
+		return err
+	}
+	encodedVal, _ := jsoniter.Marshal(val)
+	if err := v.CheckPermGranted(c.Locals("p_token").(string), key, encodedVal); err != nil {
+		return fiber.NewError(fiber.StatusForbidden, err.Error())
+	}
+	return nil
+}
--- a/pkg/hyper/conn.go
+++ b/pkg/hyper/conn.go
@@ -0,0 +1,90 @@
+package hyper
+
+import (
+	"context"
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	health "google.golang.org/grpc/health/grpc_health_v1"
+	"time"
+
+	_ "github.com/mbobakov/grpc-consul-resolver"
+)
+
+type HyperConn struct {
+	Addr string
+	Info *proto.ServiceInfo
+
+	dealerConn    *grpc.ClientConn
+	cacheGrpcConn map[string]*grpc.ClientConn
+}
+
+func NewHyperConn(addr string, info *proto.ServiceInfo) (*HyperConn, error) {
+	conn, err := grpc.NewClient(
+		addr,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return &HyperConn{
+		Addr: addr,
+		Info: info,
+
+		dealerConn:    conn,
+		cacheGrpcConn: make(map[string]*grpc.ClientConn),
+	}, nil
+}
+
+func (v *HyperConn) RegisterService() error {
+	dir := proto.NewServiceDirectoryClient(v.dealerConn)
+	_, err := dir.AddService(context.Background(), v.Info)
+	return err
+}
+
+func (v *HyperConn) KeepRegisterService() {
+	_ = v.RegisterService()
+
+	for {
+		time.Sleep(5 * time.Second)
+		client := health.NewHealthClient(v.dealerConn)
+		if _, err := client.Check(context.Background(), &health.HealthCheckRequest{}); err != nil {
+			v.KeepRegisterService()
+			return
+		}
+	}
+}
+
+func (v *HyperConn) GetServiceGrpcConn(t string) (*grpc.ClientConn, error) {
+	if val, ok := v.cacheGrpcConn[t]; ok {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+		defer cancel()
+		if _, err := health.NewHealthClient(val).Check(ctx, &health.HealthCheckRequest{
+			Service: t,
+		}); err == nil {
+			return val, nil
+		} else {
+			delete(v.cacheGrpcConn, t)
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	out, err := proto.NewServiceDirectoryClient(v.dealerConn).GetService(ctx, &proto.GetServiceRequest{
+		Type: &t,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	conn, err := grpc.NewClient(
+		out.GetData().GetGrpcAddr(),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	if err == nil {
+		v.cacheGrpcConn[t] = conn
+	}
+	return conn, err
+}
--- a/pkg/internal/directory/connect.go
+++ b/pkg/internal/directory/connect.go
@@ -0,0 +1,29 @@
+package directory
+
+import (
+	"context"
+	"fmt"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	health "google.golang.org/grpc/health/grpc_health_v1"
+	"time"
+)
+
+func ConnectService(in *ServiceInstance) (*grpc.ClientConn, error) {
+	conn, err := grpc.NewClient(
+		in.GrpcAddr,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create grpc connection: %v", err)
+	}
+
+	client := health.NewHealthClient(conn)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	if _, err = client.Check(ctx, &health.HealthCheckRequest{}); err != nil {
+		return conn, fmt.Errorf("grpc service is down: %v", err)
+	}
+
+	return conn, nil
+}
--- a/pkg/internal/directory/models.go
+++ b/pkg/internal/directory/models.go
@@ -0,0 +1,29 @@
+package directory
+
+import "google.golang.org/grpc"
+
+type ServiceInstance struct {
+	ID       string  `json:"id"`
+	Type     string  `json:"type"`
+	Label    string  `json:"label"`
+	GrpcAddr string  `json:"grpc_addr"`
+	HttpAddr *string `json:"http_addr"`
+
+	grpcConn   *grpc.ClientConn
+	retryCount int
+}
+
+func (v *ServiceInstance) GetGrpcConn() (*grpc.ClientConn, error) {
+	if v.grpcConn != nil {
+		return v.grpcConn, nil
+	}
+
+	var err error
+	v.grpcConn, err = ConnectService(v)
+	if err != nil {
+		RemoveServiceInstance(v.ID)
+		return nil, err
+	}
+
+	return v.grpcConn, nil
+}
--- a/pkg/internal/directory/services.go
+++ b/pkg/internal/directory/services.go
@@ -0,0 +1,61 @@
+package directory
+
+import (
+	"sync"
+)
+
+const (
+	ServiceTypeAuthProvider = "passport"
+	ServiceTypeFileProvider = "paperclip"
+)
+
+var serviceDirectory sync.Map
+
+func GetServiceInstance(id string) *ServiceInstance {
+	val, ok := serviceDirectory.Load(id)
+	if ok {
+		return val.(*ServiceInstance)
+	} else {
+		return nil
+	}
+}
+
+func GetServiceInstanceByType(t string) *ServiceInstance {
+	var result *ServiceInstance
+	serviceDirectory.Range(func(key, value any) bool {
+		if value.(*ServiceInstance).Type == t {
+			result = value.(*ServiceInstance)
+			return false
+		}
+		return true
+	})
+	return result
+}
+
+func ListServiceInstance() []*ServiceInstance {
+	var result []*ServiceInstance
+	serviceDirectory.Range(func(key, value interface{}) bool {
+		result = append(result, value.(*ServiceInstance))
+		return true
+	})
+	return result
+}
+
+func ListServiceInstanceByType(t string) []*ServiceInstance {
+	var result []*ServiceInstance
+	serviceDirectory.Range(func(key, value interface{}) bool {
+		if value.(*ServiceInstance).Type == t {
+			result = append(result, value.(*ServiceInstance))
+		}
+		return true
+	})
+	return result
+}
+
+func AddServiceInstance(in *ServiceInstance) {
+	serviceDirectory.Store(in.ID, in)
+}
+
+func RemoveServiceInstance(id string) {
+	serviceDirectory.Delete(id)
+}
--- a/pkg/internal/gap/client.go
+++ b/pkg/internal/gap/client.go
@@ -0,0 +1,15 @@
+package gap
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/hyper"
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"github.com/spf13/viper"
+)
+
+var H *hyper.HyperConn
+
+func NewHyperClient(info *proto.ServiceInfo) (err error) {
+	H, err = hyper.NewHyperConn(viper.GetString("dealer.addr"), info)
+	H.KeepRegisterService()
+	return
+}
--- a/pkg/internal/gap/net.go
+++ b/pkg/internal/gap/net.go
@@ -0,0 +1,15 @@
+package gap
+
+import "net"
+
+func GetOutboundIP() (net.IP, error) {
+	conn, err := net.Dial("udp", "1.1.1.1:80")
+	if err != nil {
+		return nil, err
+	} else {
+		defer conn.Close()
+	}
+
+	localAddr := conn.LocalAddr().(*net.UDPAddr)
+	return localAddr.IP, nil
+}
--- a/pkg/internal/grpc/auth.go
+++ b/pkg/internal/grpc/auth.go
@@ -0,0 +1,45 @@
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/directory"
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"time"
+)
+
+func (v *Server) Authenticate(ctx context.Context, request *proto.AuthRequest) (*proto.AuthReply, error) {
+	instance := directory.GetServiceInstanceByType(directory.ServiceTypeAuthProvider)
+	if instance == nil {
+		return &proto.AuthReply{}, fmt.Errorf("no available service %s found", directory.ServiceTypeAuthProvider)
+	}
+
+	conn, err := instance.GetGrpcConn()
+	if err != nil {
+		return nil, fmt.Errorf("service is down: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	out, err := proto.NewAuthClient(conn).Authenticate(ctx, request)
+	return out, err
+}
+
+func (v *Server) EnsurePermGranted(ctx context.Context, request *proto.CheckPermRequest) (*proto.CheckPermReply, error) {
+	instance := directory.GetServiceInstanceByType(directory.ServiceTypeAuthProvider)
+	if instance == nil {
+		return &proto.CheckPermReply{}, fmt.Errorf("no available service %s found", directory.ServiceTypeAuthProvider)
+	}
+
+	conn, err := instance.GetGrpcConn()
+	if err != nil {
+		return nil, fmt.Errorf("service is down: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	out, err := proto.NewAuthClient(conn).EnsurePermGranted(ctx, request)
+	return out, err
+}
--- a/pkg/internal/grpc/health.go
+++ b/pkg/internal/grpc/health.go
@@ -0,0 +1,26 @@
+package grpc
+
+import (
+	"context"
+	health "google.golang.org/grpc/health/grpc_health_v1"
+	"time"
+)
+
+func (v *Server) Check(ctx context.Context, request *health.HealthCheckRequest) (*health.HealthCheckResponse, error) {
+	return &health.HealthCheckResponse{
+		Status: health.HealthCheckResponse_SERVING,
+	}, nil
+}
+
+func (v *Server) Watch(request *health.HealthCheckRequest, server health.Health_WatchServer) error {
+	for {
+		if server.Send(&health.HealthCheckResponse{
+			Status: health.HealthCheckResponse_SERVING,
+		}) != nil {
+			break
+		}
+		time.Sleep(1000 * time.Millisecond)
+	}
+
+	return nil
+}
--- a/pkg/internal/grpc/server.go
+++ b/pkg/internal/grpc/server.go
@@ -0,0 +1,43 @@
+package grpc
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"net"
+
+	"google.golang.org/grpc/reflection"
+
+	"github.com/spf13/viper"
+	"google.golang.org/grpc"
+
+	health "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+type Server struct {
+	proto.UnimplementedServiceDirectoryServer
+	proto.UnimplementedAuthServer
+
+	srv *grpc.Server
+}
+
+func NewServer() *Server {
+	server := &Server{
+		srv: grpc.NewServer(),
+	}
+
+	proto.RegisterServiceDirectoryServer(server.srv, &Server{})
+	proto.RegisterAuthServer(server.srv, &Server{})
+	health.RegisterHealthServer(server.srv, &Server{})
+
+	reflection.Register(server.srv)
+
+	return server
+}
+
+func (v *Server) Listen() error {
+	listener, err := net.Listen("tcp", viper.GetString("grpc_bind"))
+	if err != nil {
+		return err
+	}
+
+	return v.srv.Serve(listener)
+}
--- a/pkg/internal/grpc/services.go
+++ b/pkg/internal/grpc/services.go
@@ -0,0 +1,70 @@
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/directory"
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"github.com/samber/lo"
+)
+
+func warpServiceInstanceToInfo(in *directory.ServiceInstance) *proto.ServiceInfo {
+	return &proto.ServiceInfo{
+		Id:       in.ID,
+		Type:     in.Type,
+		Label:    in.Label,
+		GrpcAddr: in.GrpcAddr,
+		HttpAddr: in.HttpAddr,
+	}
+}
+
+func (v *Server) GetService(ctx context.Context, request *proto.GetServiceRequest) (*proto.GetServiceResponse, error) {
+	if request.Id != nil {
+		out := directory.GetServiceInstance(request.GetId())
+		return &proto.GetServiceResponse{
+			Data: warpServiceInstanceToInfo(out),
+		}, nil
+	}
+	if request.Type != nil {
+		out := directory.GetServiceInstanceByType(request.GetType())
+		return &proto.GetServiceResponse{
+			Data: warpServiceInstanceToInfo(out),
+		}, nil
+	}
+	return nil, fmt.Errorf("no filter condition is provided")
+}
+
+func (v *Server) ListService(ctx context.Context, request *proto.ListServiceRequest) (*proto.ListServiceResponse, error) {
+	var out []*directory.ServiceInstance
+	if request.Type != nil {
+		out = directory.ListServiceInstanceByType(request.GetType())
+	} else {
+		out = directory.ListServiceInstance()
+	}
+	return &proto.ListServiceResponse{
+		Data: lo.Map(out, func(item *directory.ServiceInstance, index int) *proto.ServiceInfo {
+			return warpServiceInstanceToInfo(item)
+		}),
+	}, nil
+}
+
+func (v *Server) AddService(ctx context.Context, info *proto.ServiceInfo) (*proto.AddServiceResponse, error) {
+	in := &directory.ServiceInstance{
+		ID:       info.GetId(),
+		Type:     info.GetType(),
+		Label:    info.GetLabel(),
+		GrpcAddr: info.GetGrpcAddr(),
+		HttpAddr: info.HttpAddr,
+	}
+	directory.AddServiceInstance(in)
+	return &proto.AddServiceResponse{
+		IsSuccess: true,
+	}, nil
+}
+
+func (v *Server) RemoveService(ctx context.Context, request *proto.RemoveServiceRequest) (*proto.RemoveServiceResponse, error) {
+	directory.RemoveServiceInstance(request.GetId())
+	return &proto.RemoveServiceResponse{
+		IsSuccess: true,
+	}, nil
+}
--- a/pkg/internal/meta.go
+++ b/pkg/internal/meta.go
@@ -0,0 +1,5 @@
+package pkg
+
+const (
+	AppVersion = "1.0.0"
+)
--- a/pkg/internal/models/accounts.go
+++ b/pkg/internal/models/accounts.go
@@ -0,0 +1,63 @@
+package models
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/samber/lo"
+	"github.com/spf13/viper"
+	"gorm.io/datatypes"
+)
+
+type Account struct {
+	BaseModel
+
+	Name        string            `json:"name" gorm:"uniqueIndex"`
+	Nick        string            `json:"nick"`
+	Description string            `json:"description"`
+	Avatar      *uint             `json:"avatar"`
+	Banner      *uint             `json:"banner"`
+	ConfirmedAt *time.Time        `json:"confirmed_at"`
+	SuspendedAt *time.Time        `json:"suspended_at"`
+	PermNodes   datatypes.JSONMap `json:"perm_nodes"`
+
+	Contacts []AccountContact `json:"contacts"`
+}
+
+func (v Account) GetAvatar() *string {
+	if v.Avatar != nil {
+		return lo.ToPtr(fmt.Sprintf("%s/api/attachments/%d", viper.GetString("content_endpoint"), *v.Avatar))
+	}
+	return nil
+}
+
+func (v Account) GetBanner() *string {
+	if v.Banner != nil {
+		return lo.ToPtr(fmt.Sprintf("%s/api/attachments/%d", viper.GetString("content_endpoint"), *v.Banner))
+	}
+	return nil
+}
+
+func (v Account) GetPrimaryEmail() AccountContact {
+	val, _ := lo.Find(v.Contacts, func(item AccountContact) bool {
+		return item.Type == EmailAccountContact && item.IsPrimary
+	})
+	return val
+}
+
+type AccountContactType = int8
+
+const (
+	EmailAccountContact = AccountContactType(iota)
+)
+
+type AccountContact struct {
+	BaseModel
+
+	Type       int8       `json:"type"`
+	Content    string     `json:"content" gorm:"uniqueIndex"`
+	IsPublic   bool       `json:"is_public"`
+	IsPrimary  bool       `json:"is_primary"`
+	VerifiedAt *time.Time `json:"verified_at"`
+	AccountID  uint       `json:"account_id"`
+}
--- a/pkg/internal/models/base.go
+++ b/pkg/internal/models/base.go
@@ -0,0 +1,17 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/datatypes"
+	"gorm.io/gorm"
+)
+
+type JSONMap = datatypes.JSONType[map[string]any]
+
+type BaseModel struct {
+	ID        uint           `json:"id" gorm:"primaryKey"`
+	CreatedAt time.Time      `json:"created_at"`
+	UpdatedAt time.Time      `json:"updated_at"`
+	DeletedAt gorm.DeletedAt `json:"deleted_at" gorm:"index"`
+}
--- a/pkg/internal/server/api/directory.go
+++ b/pkg/internal/server/api/directory.go
@@ -0,0 +1,19 @@
+package api
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/directory"
+	"github.com/gofiber/fiber/v2"
+	"github.com/samber/lo"
+)
+
+func listExistsService(c *fiber.Ctx) error {
+	services := directory.ListServiceInstance()
+
+	return c.JSON(lo.Map(services, func(item *directory.ServiceInstance, index int) map[string]any {
+		return map[string]any{
+			"id":    item.ID,
+			"type":  item.Type,
+			"label": item.Label,
+		}
+	}))
+}
--- a/pkg/internal/server/api/index.go
+++ b/pkg/internal/server/api/index.go
@@ -0,0 +1,28 @@
+package api
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/server/exts"
+	"github.com/gofiber/contrib/websocket"
+	"github.com/gofiber/fiber/v2"
+)
+
+func MapAPIs(app *fiber.App) {
+	wellKnown := app.Group("/.well-known").Name("Well Known")
+	{
+		wellKnown.Get("/directory/services", listExistsService)
+	}
+
+	api := app.Group("/api").Name("API")
+	{
+		api.Use(func(c *fiber.Ctx) error {
+			if err := exts.EnsureAuthenticated(c); err != nil {
+				return err
+			}
+			return c.Next()
+		}).Get("/ws", websocket.New(listenWebsocket))
+
+		api.All("/*", func(c *fiber.Ctx) error {
+			return fiber.ErrNotFound
+		})
+	}
+}
--- a/pkg/internal/server/api/ws.go
+++ b/pkg/internal/server/api/ws.go
@@ -0,0 +1,29 @@
+package api
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/models"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/services"
+	"github.com/gofiber/contrib/websocket"
+	"github.com/rs/zerolog/log"
+)
+
+func listenWebsocket(c *websocket.Conn) {
+	user := c.Locals("user").(models.Account)
+
+	// Push connection
+	services.ClientRegister(user, c)
+	log.Debug().Uint("user", user.ID).Msg("New websocket connection established...")
+
+	// Event loop
+	var err error
+
+	for {
+		if _, _, err = c.ReadMessage(); err != nil {
+			break
+		}
+	}
+
+	// Pop connection
+	services.ClientUnregister(user, c)
+	log.Debug().Uint("user", user.ID).Msg("A websocket connection disconnected...")
+}
--- a/pkg/internal/server/exts/auth.go
+++ b/pkg/internal/server/exts/auth.go
@@ -0,0 +1,118 @@
+package exts
+
+import (
+	"context"
+	"fmt"
+	"git.solsynth.dev/hydrogen/dealer/pkg/hyper"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/directory"
+	"git.solsynth.dev/hydrogen/dealer/pkg/proto"
+	"github.com/gofiber/fiber/v2"
+	jsoniter "github.com/json-iterator/go"
+	"strings"
+	"time"
+)
+
+func AuthMiddleware(c *fiber.Ctx) error {
+	var atk string
+	if cookie := c.Cookies(hyper.CookieAtk); len(cookie) > 0 {
+		atk = cookie
+	}
+	if header := c.Get(fiber.HeaderAuthorization); len(header) > 0 {
+		tk := strings.Replace(header, "Bearer", "", 1)
+		atk = strings.TrimSpace(tk)
+	}
+	if tk := c.Query("tk"); len(tk) > 0 {
+		atk = strings.TrimSpace(tk)
+	}
+
+	c.Locals("p_token", atk)
+
+	rtk := c.Cookies(hyper.CookieRtk)
+	if acc, newAtk, newRtk, err := DoAuthenticate(atk, rtk); err == nil {
+		if newAtk != atk {
+			SetAuthCookies(c, newAtk, newRtk)
+		}
+		c.Locals("user", acc)
+	}
+
+	return c.Next()
+}
+
+func DoAuthenticate(atk, rtk string) (acc *proto.UserInfo, accessTk string, refreshTk string, err error) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	in := directory.GetServiceInstanceByType(directory.ServiceTypeAuthProvider)
+	if in == nil {
+		return
+	}
+	conn, err := in.GetGrpcConn()
+	if err != nil {
+		return
+	}
+
+	var reply *proto.AuthReply
+	reply, err = proto.NewAuthClient(conn).Authenticate(ctx, &proto.AuthRequest{
+		AccessToken:  atk,
+		RefreshToken: &rtk,
+	})
+	if err != nil {
+		return
+	}
+	if reply != nil {
+		acc = reply.GetInfo().GetInfo()
+		accessTk = reply.GetInfo().GetNewAccessToken()
+		refreshTk = reply.GetInfo().GetNewRefreshToken()
+		if !reply.IsValid {
+			err = fmt.Errorf("invalid authorization context")
+			return
+		}
+	}
+
+	return
+}
+
+func CheckPermGranted(atk string, key string, val []byte) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	in := directory.GetServiceInstanceByType(directory.ServiceTypeAuthProvider)
+	if in == nil {
+		return fmt.Errorf("no auth provider found")
+	}
+	conn, err := in.GetGrpcConn()
+	if err != nil {
+		return err
+	}
+
+	reply, err := proto.NewAuthClient(conn).EnsurePermGranted(ctx, &proto.CheckPermRequest{
+		Token: atk,
+		Key:   key,
+		Value: val,
+	})
+	if err != nil {
+		return err
+	} else if !reply.GetIsValid() {
+		return fmt.Errorf("missing permission: %s", key)
+	}
+
+	return nil
+}
+
+func EnsureAuthenticated(c *fiber.Ctx) error {
+	if _, ok := c.Locals("p_user").(*proto.UserInfo); !ok {
+		return fiber.NewError(fiber.StatusUnauthorized)
+	}
+	return nil
+}
+
+func EnsureGrantedPerm(c *fiber.Ctx, key string, val any) error {
+	if err := EnsureAuthenticated(c); err != nil {
+		return err
+	}
+	encodedVal, _ := jsoniter.Marshal(val)
+	if err := CheckPermGranted(c.Locals("p_token").(string), key, encodedVal); err != nil {
+		return fiber.NewError(fiber.StatusForbidden, err.Error())
+	}
+	return nil
+}
--- a/pkg/internal/server/exts/cookies.go
+++ b/pkg/internal/server/exts/cookies.go
@@ -0,0 +1,27 @@
+package exts
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/hyper"
+	"github.com/gofiber/fiber/v2"
+	"github.com/spf13/viper"
+	"time"
+)
+
+func SetAuthCookies(c *fiber.Ctx, atk, rtk string) {
+	c.Cookie(&fiber.Cookie{
+		Name:     hyper.CookieAtk,
+		Value:    atk,
+		Domain:   viper.GetString("security.cookie_domain"),
+		SameSite: viper.GetString("security.cookie_samesite"),
+		Expires:  time.Now().Add(60 * time.Minute),
+		Path:     "/",
+	})
+	c.Cookie(&fiber.Cookie{
+		Name:     hyper.CookieRtk,
+		Value:    rtk,
+		Domain:   viper.GetString("security.cookie_domain"),
+		SameSite: viper.GetString("security.cookie_samesite"),
+		Expires:  time.Now().Add(24 * 30 * time.Hour),
+		Path:     "/",
+	})
+}
--- a/pkg/internal/server/exts/request.go
+++ b/pkg/internal/server/exts/request.go
@@ -0,0 +1,18 @@
+package exts
+
+import (
+	"github.com/go-playground/validator/v10"
+	"github.com/gofiber/fiber/v2"
+)
+
+var validation = validator.New(validator.WithRequiredStructEnabled())
+
+func BindAndValidate(c *fiber.Ctx, out any) error {
+	if err := c.BodyParser(out); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, err.Error())
+	} else if err := validation.Struct(out); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, err.Error())
+	}
+
+	return nil
+}
--- a/pkg/internal/server/server.go
+++ b/pkg/internal/server/server.go
@@ -0,0 +1,66 @@
+package server
+
+import (
+	"strings"
+
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/server/api"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/server/exts"
+	"github.com/gofiber/fiber/v2"
+	"github.com/gofiber/fiber/v2/middleware/cors"
+	"github.com/gofiber/fiber/v2/middleware/idempotency"
+	"github.com/gofiber/fiber/v2/middleware/logger"
+	jsoniter "github.com/json-iterator/go"
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/viper"
+)
+
+type HTTPApp struct {
+	app *fiber.App
+}
+
+func NewServer() *HTTPApp {
+	app := fiber.New(fiber.Config{
+		DisableStartupMessage: true,
+		EnableIPValidation:    true,
+		ServerHeader:          "Hydrogen.Dealer",
+		AppName:               "Hydrogen.Dealer",
+		ProxyHeader:           fiber.HeaderXForwardedFor,
+		JSONEncoder:           jsoniter.ConfigCompatibleWithStandardLibrary.Marshal,
+		JSONDecoder:           jsoniter.ConfigCompatibleWithStandardLibrary.Unmarshal,
+		EnablePrintRoutes:     viper.GetBool("debug.print_routes"),
+	})
+
+	app.Use(idempotency.New())
+	app.Use(cors.New(cors.Config{
+		AllowCredentials: true,
+		AllowMethods: strings.Join([]string{
+			fiber.MethodGet,
+			fiber.MethodPost,
+			fiber.MethodHead,
+			fiber.MethodOptions,
+			fiber.MethodPut,
+			fiber.MethodDelete,
+			fiber.MethodPatch,
+		}, ","),
+		AllowOriginsFunc: func(origin string) bool {
+			return true
+		},
+	}))
+
+	app.Use(logger.New(logger.Config{
+		Format: "${status} | ${latency} | ${method} ${path}\n",
+		Output: log.Logger,
+	}))
+
+	app.Use(exts.AuthMiddleware)
+
+	api.MapAPIs(app)
+
+	return &HTTPApp{app}
+}
+
+func (v *HTTPApp) Listen() {
+	if err := v.app.Listen(viper.GetString("bind")); err != nil {
+		log.Fatal().Err(err).Msg("An error occurred when starting server...")
+	}
+}
--- a/pkg/internal/services/connections.go
+++ b/pkg/internal/services/connections.go
@@ -0,0 +1,30 @@
+package services
+
+import (
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/models"
+	"github.com/gofiber/contrib/websocket"
+	"sync"
+)
+
+var (
+	wsMutex sync.Mutex
+	wsConn  = make(map[uint]map[*websocket.Conn]bool)
+)
+
+func ClientRegister(user models.Account, conn *websocket.Conn) {
+	wsMutex.Lock()
+	if wsConn[user.ID] == nil {
+		wsConn[user.ID] = make(map[*websocket.Conn]bool)
+	}
+	wsConn[user.ID][conn] = true
+	wsMutex.Unlock()
+}
+
+func ClientUnregister(user models.Account, conn *websocket.Conn) {
+	wsMutex.Lock()
+	if wsConn[user.ID] == nil {
+		wsConn[user.ID] = make(map[*websocket.Conn]bool)
+	}
+	delete(wsConn[user.ID], conn)
+	wsMutex.Unlock()
+}
--- a/pkg/main.go
+++ b/pkg/main.go
@@ -0,0 +1,55 @@
+package main
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+
+	pkg "git.solsynth.dev/hydrogen/dealer/pkg/internal"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/grpc"
+	"git.solsynth.dev/hydrogen/dealer/pkg/internal/server"
+	"github.com/robfig/cron/v3"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/viper"
+)
+
+func init() {
+	zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
+	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stdout})
+}
+
+func main() {
+	// Configure settings
+	viper.AddConfigPath(".")
+	viper.AddConfigPath("..")
+	viper.SetConfigName("settings")
+	viper.SetConfigType("toml")
+
+	// Load settings
+	if err := viper.ReadInConfig(); err != nil {
+		log.Panic().Err(err).Msg("An error occurred when loading settings.")
+	}
+
+	// Server
+	go server.NewServer().Listen()
+
+	// Grpc Server
+	go grpc.NewServer().Listen()
+
+	// Configure timed tasks
+	quartz := cron.New(cron.WithLogger(cron.VerbosePrintfLogger(&log.Logger)))
+	quartz.Start()
+
+	// Messages
+	log.Info().Msgf("Dealer v%s is started...", pkg.AppVersion)
+
+	quit := make(chan os.Signal, 1)
+	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
+	<-quit
+
+	log.Info().Msgf("Passport v%s is quitting...", pkg.AppVersion)
+
+	quartz.Stop()
+}
--- a/pkg/proto/auth.pb.go
+++ b/pkg/proto/auth.pb.go
@@ -0,0 +1,618 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.1
+// source: auth.proto
+
+package proto
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type UserInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id          uint64  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name        string  `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Nick        string  `protobuf:"bytes,3,opt,name=nick,proto3" json:"nick,omitempty"`
+	Email       string  `protobuf:"bytes,4,opt,name=email,proto3" json:"email,omitempty"`
+	Avatar      string  `protobuf:"bytes,5,opt,name=avatar,proto3" json:"avatar,omitempty"`
+	Banner      string  `protobuf:"bytes,6,opt,name=banner,proto3" json:"banner,omitempty"`
+	Description *string `protobuf:"bytes,7,opt,name=description,proto3,oneof" json:"description,omitempty"`
+}
+
+func (x *UserInfo) Reset() {
+	*x = UserInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserInfo) ProtoMessage() {}
+
+func (x *UserInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserInfo.ProtoReflect.Descriptor instead.
+func (*UserInfo) Descriptor() ([]byte, []int) {
+	return file_auth_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *UserInfo) GetId() uint64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *UserInfo) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *UserInfo) GetNick() string {
+	if x != nil {
+		return x.Nick
+	}
+	return ""
+}
+
+func (x *UserInfo) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *UserInfo) GetAvatar() string {
+	if x != nil {
+		return x.Avatar
+	}
+	return ""
+}
+
+func (x *UserInfo) GetBanner() string {
+	if x != nil {
+		return x.Banner
+	}
+	return ""
+}
+
+func (x *UserInfo) GetDescription() string {
+	if x != nil && x.Description != nil {
+		return *x.Description
+	}
+	return ""
+}
+
+type AuthInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Info            *UserInfo `protobuf:"bytes,1,opt,name=info,proto3" json:"info,omitempty"`
+	Permissions     []byte    `protobuf:"bytes,2,opt,name=permissions,proto3" json:"permissions,omitempty"`
+	TicketId        uint64    `protobuf:"varint,3,opt,name=ticket_id,json=ticketId,proto3" json:"ticket_id,omitempty"`
+	NewAccessToken  *string   `protobuf:"bytes,4,opt,name=new_access_token,json=newAccessToken,proto3,oneof" json:"new_access_token,omitempty"`
+	NewRefreshToken *string   `protobuf:"bytes,5,opt,name=new_refresh_token,json=newRefreshToken,proto3,oneof" json:"new_refresh_token,omitempty"`
+}
+
+func (x *AuthInfo) Reset() {
+	*x = AuthInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthInfo) ProtoMessage() {}
+
+func (x *AuthInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthInfo.ProtoReflect.Descriptor instead.
+func (*AuthInfo) Descriptor() ([]byte, []int) {
+	return file_auth_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AuthInfo) GetInfo() *UserInfo {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+func (x *AuthInfo) GetPermissions() []byte {
+	if x != nil {
+		return x.Permissions
+	}
+	return nil
+}
+
+func (x *AuthInfo) GetTicketId() uint64 {
+	if x != nil {
+		return x.TicketId
+	}
+	return 0
+}
+
+func (x *AuthInfo) GetNewAccessToken() string {
+	if x != nil && x.NewAccessToken != nil {
+		return *x.NewAccessToken
+	}
+	return ""
+}
+
+func (x *AuthInfo) GetNewRefreshToken() string {
+	if x != nil && x.NewRefreshToken != nil {
+		return *x.NewRefreshToken
+	}
+	return ""
+}
+
+type AuthRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AccessToken  string  `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
+	RefreshToken *string `protobuf:"bytes,2,opt,name=refresh_token,json=refreshToken,proto3,oneof" json:"refresh_token,omitempty"`
+}
+
+func (x *AuthRequest) Reset() {
+	*x = AuthRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthRequest) ProtoMessage() {}
+
+func (x *AuthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthRequest.ProtoReflect.Descriptor instead.
+func (*AuthRequest) Descriptor() ([]byte, []int) {
+	return file_auth_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *AuthRequest) GetAccessToken() string {
+	if x != nil {
+		return x.AccessToken
+	}
+	return ""
+}
+
+func (x *AuthRequest) GetRefreshToken() string {
+	if x != nil && x.RefreshToken != nil {
+		return *x.RefreshToken
+	}
+	return ""
+}
+
+type AuthReply struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IsValid bool      `protobuf:"varint,1,opt,name=is_valid,json=isValid,proto3" json:"is_valid,omitempty"`
+	Info    *AuthInfo `protobuf:"bytes,2,opt,name=info,proto3,oneof" json:"info,omitempty"`
+}
+
+func (x *AuthReply) Reset() {
+	*x = AuthReply{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthReply) ProtoMessage() {}
+
+func (x *AuthReply) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthReply.ProtoReflect.Descriptor instead.
+func (*AuthReply) Descriptor() ([]byte, []int) {
+	return file_auth_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *AuthReply) GetIsValid() bool {
+	if x != nil {
+		return x.IsValid
+	}
+	return false
+}
+
+func (x *AuthReply) GetInfo() *AuthInfo {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+type CheckPermRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	Key   string `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
+	Value []byte `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *CheckPermRequest) Reset() {
+	*x = CheckPermRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPermRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPermRequest) ProtoMessage() {}
+
+func (x *CheckPermRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPermRequest.ProtoReflect.Descriptor instead.
+func (*CheckPermRequest) Descriptor() ([]byte, []int) {
+	return file_auth_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CheckPermRequest) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+func (x *CheckPermRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *CheckPermRequest) GetValue() []byte {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+type CheckPermReply struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IsValid bool `protobuf:"varint,1,opt,name=is_valid,json=isValid,proto3" json:"is_valid,omitempty"`
+}
+
+func (x *CheckPermReply) Reset() {
+	*x = CheckPermReply{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPermReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPermReply) ProtoMessage() {}
+
+func (x *CheckPermReply) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPermReply.ProtoReflect.Descriptor instead.
+func (*CheckPermReply) Descriptor() ([]byte, []int) {
+	return file_auth_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *CheckPermReply) GetIsValid() bool {
+	if x != nil {
+		return x.IsValid
+	}
+	return false
+}
+
+var File_auth_proto protoreflect.FileDescriptor
+
+var file_auth_proto_rawDesc = []byte{
+	0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0xbf, 0x01, 0x0a, 0x08, 0x55, 0x73, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x69, 0x63, 0x6b, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x6e, 0x69, 0x63, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69,
+	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x16,
+	0x0a, 0x06, 0x61, 0x76, 0x61, 0x74, 0x61, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x61, 0x76, 0x61, 0x74, 0x61, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x61, 0x6e, 0x6e, 0x65, 0x72,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x12, 0x25,
+	0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xf9, 0x01, 0x0a, 0x08, 0x41, 0x75, 0x74, 0x68, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x23, 0x0a, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x0f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49, 0x6e, 0x66,
+	0x6f, 0x52, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x70, 0x65,
+	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x69, 0x63,
+	0x6b, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x74, 0x69,
+	0x63, 0x6b, 0x65, 0x74, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x10, 0x6e, 0x65, 0x77, 0x5f, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x48, 0x00, 0x52, 0x0e, 0x6e, 0x65, 0x77, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x2f, 0x0a, 0x11, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x65, 0x66,
+	0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x48, 0x01, 0x52, 0x0f, 0x6e, 0x65, 0x77, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x14, 0x0a, 0x12, 0x5f,
+	0x6e, 0x65, 0x77, 0x5f, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x22, 0x6c, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x21, 0x0a, 0x0c, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x12, 0x28, 0x0a, 0x0d, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x72, 0x65,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a,
+	0x0e, 0x5f, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22,
+	0x59, 0x0a, 0x09, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x19, 0x0a, 0x08,
+	0x69, 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x69, 0x73, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x28, 0x0a, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x04, 0x69, 0x6e, 0x66, 0x6f, 0x88, 0x01,
+	0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0x50, 0x0a, 0x10, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x50, 0x65, 0x72, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14,
+	0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x2b, 0x0a, 0x0e,
+	0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x65, 0x72, 0x6d, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x19,
+	0x0a, 0x08, 0x69, 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x07, 0x69, 0x73, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x32, 0x85, 0x01, 0x0a, 0x04, 0x41, 0x75,
+	0x74, 0x68, 0x12, 0x36, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x12, 0x12, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x41,
+	0x75, 0x74, 0x68, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x11, 0x45, 0x6e,
+	0x73, 0x75, 0x72, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x47, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x64, 0x12,
+	0x17, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x65, 0x72,
+	0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x65, 0x72, 0x6d, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22,
+	0x00, 0x42, 0x09, 0x5a, 0x07, 0x2e, 0x3b, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_auth_proto_rawDescOnce sync.Once
+	file_auth_proto_rawDescData = file_auth_proto_rawDesc
+)
+
+func file_auth_proto_rawDescGZIP() []byte {
+	file_auth_proto_rawDescOnce.Do(func() {
+		file_auth_proto_rawDescData = protoimpl.X.CompressGZIP(file_auth_proto_rawDescData)
+	})
+	return file_auth_proto_rawDescData
+}
+
+var file_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_auth_proto_goTypes = []any{
+	(*UserInfo)(nil),         // 0: proto.UserInfo
+	(*AuthInfo)(nil),         // 1: proto.AuthInfo
+	(*AuthRequest)(nil),      // 2: proto.AuthRequest
+	(*AuthReply)(nil),        // 3: proto.AuthReply
+	(*CheckPermRequest)(nil), // 4: proto.CheckPermRequest
+	(*CheckPermReply)(nil),   // 5: proto.CheckPermReply
+}
+var file_auth_proto_depIdxs = []int32{
+	0, // 0: proto.AuthInfo.info:type_name -> proto.UserInfo
+	1, // 1: proto.AuthReply.info:type_name -> proto.AuthInfo
+	2, // 2: proto.Auth.Authenticate:input_type -> proto.AuthRequest
+	4, // 3: proto.Auth.CheckPermGranted:input_type -> proto.CheckPermRequest
+	3, // 4: proto.Auth.Authenticate:output_type -> proto.AuthReply
+	5, // 5: proto.Auth.CheckPermGranted:output_type -> proto.CheckPermReply
+	4, // [4:6] is the sub-list for method output_type
+	2, // [2:4] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_auth_proto_init() }
+func file_auth_proto_init() {
+	if File_auth_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_auth_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*UserInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*AuthInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*AuthRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*AuthReply); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_proto_msgTypes[4].Exporter = func(v any, i int) any {
+			switch v := v.(*CheckPermRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_proto_msgTypes[5].Exporter = func(v any, i int) any {
+			switch v := v.(*CheckPermReply); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_auth_proto_msgTypes[0].OneofWrappers = []any{}
+	file_auth_proto_msgTypes[1].OneofWrappers = []any{}
+	file_auth_proto_msgTypes[2].OneofWrappers = []any{}
+	file_auth_proto_msgTypes[3].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_auth_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_auth_proto_goTypes,
+		DependencyIndexes: file_auth_proto_depIdxs,
+		MessageInfos:      file_auth_proto_msgTypes,
+	}.Build()
+	File_auth_proto = out.File
+	file_auth_proto_rawDesc = nil
+	file_auth_proto_goTypes = nil
+	file_auth_proto_depIdxs = nil
+}
--- a/pkg/proto/auth.proto
+++ b/pkg/proto/auth.proto
@@ -0,0 +1,48 @@
+syntax = "proto3";
+
+option go_package = ".;proto";
+
+package proto;
+
+service Auth {
+  rpc Authenticate(AuthRequest) returns (AuthReply) {}
+  rpc EnsurePermGranted(CheckPermRequest) returns (CheckPermReply) {}
+}
+
+message UserInfo {
+  uint64 id = 1;
+  string name = 2;
+  string nick = 3;
+  string email = 4;
+  string avatar = 5;
+  string banner = 6;
+  optional string description = 7;
+}
+
+message AuthInfo {
+  UserInfo info = 1;
+  bytes permissions = 2;
+  uint64 ticket_id = 3;
+  optional string new_access_token = 4;
+  optional string new_refresh_token = 5;
+}
+
+message AuthRequest {
+  string access_token = 1;
+  optional string refresh_token = 2;
+}
+
+message AuthReply {
+  bool is_valid = 1;
+  optional AuthInfo info = 2;
+}
+
+message CheckPermRequest {
+  string token = 1;
+  string key = 2;
+  bytes value = 3;
+}
+
+message CheckPermReply {
+  bool is_valid = 1;
+}
--- a/pkg/proto/auth_grpc.pb.go
+++ b/pkg/proto/auth_grpc.pb.go
@@ -0,0 +1,148 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.4.0
+// - protoc             v5.27.1
+// source: auth.proto
+
+package proto
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
+
+const (
+	Auth_Authenticate_FullMethodName      = "/proto.Auth/Authenticate"
+	Auth_EnsurePermGranted_FullMethodName = "/proto.Auth/CheckPermGranted"
+)
+
+// AuthClient is the client API for Auth service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AuthClient interface {
+	Authenticate(ctx context.Context, in *AuthRequest, opts ...grpc.CallOption) (*AuthReply, error)
+	EnsurePermGranted(ctx context.Context, in *CheckPermRequest, opts ...grpc.CallOption) (*CheckPermReply, error)
+}
+
+type authClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAuthClient(cc grpc.ClientConnInterface) AuthClient {
+	return &authClient{cc}
+}
+
+func (c *authClient) Authenticate(ctx context.Context, in *AuthRequest, opts ...grpc.CallOption) (*AuthReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AuthReply)
+	err := c.cc.Invoke(ctx, Auth_Authenticate_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authClient) EnsurePermGranted(ctx context.Context, in *CheckPermRequest, opts ...grpc.CallOption) (*CheckPermReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CheckPermReply)
+	err := c.cc.Invoke(ctx, Auth_EnsurePermGranted_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AuthServer is the server API for Auth service.
+// All implementations must embed UnimplementedAuthServer
+// for forward compatibility
+type AuthServer interface {
+	Authenticate(context.Context, *AuthRequest) (*AuthReply, error)
+	EnsurePermGranted(context.Context, *CheckPermRequest) (*CheckPermReply, error)
+	mustEmbedUnimplementedAuthServer()
+}
+
+// UnimplementedAuthServer must be embedded to have forward compatible implementations.
+type UnimplementedAuthServer struct {
+}
+
+func (UnimplementedAuthServer) Authenticate(context.Context, *AuthRequest) (*AuthReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Authenticate not implemented")
+}
+func (UnimplementedAuthServer) EnsurePermGranted(context.Context, *CheckPermRequest) (*CheckPermReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckPermGranted not implemented")
+}
+func (UnimplementedAuthServer) mustEmbedUnimplementedAuthServer() {}
+
+// UnsafeAuthServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AuthServer will
+// result in compilation errors.
+type UnsafeAuthServer interface {
+	mustEmbedUnimplementedAuthServer()
+}
+
+func RegisterAuthServer(s grpc.ServiceRegistrar, srv AuthServer) {
+	s.RegisterService(&Auth_ServiceDesc, srv)
+}
+
+func _Auth_Authenticate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AuthRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServer).Authenticate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Auth_Authenticate_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServer).Authenticate(ctx, req.(*AuthRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Auth_EnsurePermGranted_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckPermRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServer).EnsurePermGranted(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Auth_EnsurePermGranted_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServer).EnsurePermGranted(ctx, req.(*CheckPermRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Auth_ServiceDesc is the grpc.ServiceDesc for Auth service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Auth_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "proto.Auth",
+	HandlerType: (*AuthServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Authenticate",
+			Handler:    _Auth_Authenticate_Handler,
+		},
+		{
+			MethodName: "CheckPermGranted",
+			Handler:    _Auth_EnsurePermGranted_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "auth.proto",
+}
--- a/pkg/proto/services.pb.go
+++ b/pkg/proto/services.pb.go
@@ -0,0 +1,666 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.1
+// source: services.proto
+
+package proto
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ServiceInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id       string  `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Type     string  `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Label    string  `protobuf:"bytes,3,opt,name=label,proto3" json:"label,omitempty"`
+	GrpcAddr string  `protobuf:"bytes,4,opt,name=grpc_addr,json=grpcAddr,proto3" json:"grpc_addr,omitempty"`
+	HttpAddr *string `protobuf:"bytes,5,opt,name=http_addr,json=httpAddr,proto3,oneof" json:"http_addr,omitempty"`
+}
+
+func (x *ServiceInfo) Reset() {
+	*x = ServiceInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceInfo) ProtoMessage() {}
+
+func (x *ServiceInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceInfo.ProtoReflect.Descriptor instead.
+func (*ServiceInfo) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ServiceInfo) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ServiceInfo) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *ServiceInfo) GetLabel() string {
+	if x != nil {
+		return x.Label
+	}
+	return ""
+}
+
+func (x *ServiceInfo) GetGrpcAddr() string {
+	if x != nil {
+		return x.GrpcAddr
+	}
+	return ""
+}
+
+func (x *ServiceInfo) GetHttpAddr() string {
+	if x != nil && x.HttpAddr != nil {
+		return *x.HttpAddr
+	}
+	return ""
+}
+
+type GetServiceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id   *string `protobuf:"bytes,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
+	Type *string `protobuf:"bytes,2,opt,name=type,proto3,oneof" json:"type,omitempty"`
+}
+
+func (x *GetServiceRequest) Reset() {
+	*x = GetServiceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetServiceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetServiceRequest) ProtoMessage() {}
+
+func (x *GetServiceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetServiceRequest.ProtoReflect.Descriptor instead.
+func (*GetServiceRequest) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetServiceRequest) GetId() string {
+	if x != nil && x.Id != nil {
+		return *x.Id
+	}
+	return ""
+}
+
+func (x *GetServiceRequest) GetType() string {
+	if x != nil && x.Type != nil {
+		return *x.Type
+	}
+	return ""
+}
+
+type GetServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data *ServiceInfo `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *GetServiceResponse) Reset() {
+	*x = GetServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetServiceResponse) ProtoMessage() {}
+
+func (x *GetServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetServiceResponse.ProtoReflect.Descriptor instead.
+func (*GetServiceResponse) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetServiceResponse) GetData() *ServiceInfo {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type ListServiceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type *string `protobuf:"bytes,1,opt,name=type,proto3,oneof" json:"type,omitempty"`
+}
+
+func (x *ListServiceRequest) Reset() {
+	*x = ListServiceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListServiceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListServiceRequest) ProtoMessage() {}
+
+func (x *ListServiceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListServiceRequest.ProtoReflect.Descriptor instead.
+func (*ListServiceRequest) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListServiceRequest) GetType() string {
+	if x != nil && x.Type != nil {
+		return *x.Type
+	}
+	return ""
+}
+
+type ListServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data []*ServiceInfo `protobuf:"bytes,1,rep,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *ListServiceResponse) Reset() {
+	*x = ListServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListServiceResponse) ProtoMessage() {}
+
+func (x *ListServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListServiceResponse.ProtoReflect.Descriptor instead.
+func (*ListServiceResponse) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListServiceResponse) GetData() []*ServiceInfo {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type AddServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IsSuccess bool `protobuf:"varint,1,opt,name=is_success,json=isSuccess,proto3" json:"is_success,omitempty"`
+}
+
+func (x *AddServiceResponse) Reset() {
+	*x = AddServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AddServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AddServiceResponse) ProtoMessage() {}
+
+func (x *AddServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AddServiceResponse.ProtoReflect.Descriptor instead.
+func (*AddServiceResponse) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *AddServiceResponse) GetIsSuccess() bool {
+	if x != nil {
+		return x.IsSuccess
+	}
+	return false
+}
+
+type RemoveServiceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *RemoveServiceRequest) Reset() {
+	*x = RemoveServiceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RemoveServiceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveServiceRequest) ProtoMessage() {}
+
+func (x *RemoveServiceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveServiceRequest.ProtoReflect.Descriptor instead.
+func (*RemoveServiceRequest) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RemoveServiceRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+type RemoveServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IsSuccess bool `protobuf:"varint,1,opt,name=is_success,json=isSuccess,proto3" json:"is_success,omitempty"`
+}
+
+func (x *RemoveServiceResponse) Reset() {
+	*x = RemoveServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_services_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RemoveServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveServiceResponse) ProtoMessage() {}
+
+func (x *RemoveServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_services_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveServiceResponse.ProtoReflect.Descriptor instead.
+func (*RemoveServiceResponse) Descriptor() ([]byte, []int) {
+	return file_services_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *RemoveServiceResponse) GetIsSuccess() bool {
+	if x != nil {
+		return x.IsSuccess
+	}
+	return false
+}
+
+var File_services_proto protoreflect.FileDescriptor
+
+var file_services_proto_rawDesc = []byte{
+	0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x05, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x94, 0x01, 0x0a, 0x0b, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6c,
+	0x61, 0x62, 0x65, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x61, 0x62, 0x65,
+	0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x70, 0x63, 0x41, 0x64, 0x64, 0x72, 0x12, 0x20,
+	0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x41, 0x64, 0x64, 0x72, 0x88, 0x01, 0x01,
+	0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x22, 0x51,
+	0x0a, 0x11, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x13, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x00, 0x52, 0x02, 0x69, 0x64, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x88, 0x01,
+	0x01, 0x42, 0x05, 0x0a, 0x03, 0x5f, 0x69, 0x64, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x74, 0x79, 0x70,
+	0x65, 0x22, 0x3c, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22,
+	0x36, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x88, 0x01, 0x01, 0x42, 0x07,
+	0x0a, 0x05, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3d, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
+	0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f,
+	0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x33, 0x0a, 0x12, 0x41, 0x64, 0x64, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x69, 0x73, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x69, 0x73, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x22, 0x26, 0x0a, 0x14, 0x52,
+	0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x22, 0x36, 0x0a, 0x15, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x69, 0x73, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x69, 0x73, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x32, 0xac, 0x02, 0x0a, 0x10,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79,
+	0x12, 0x43, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x18,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a,
+	0x0a, 0x41, 0x64, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x1a,
+	0x19, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x41, 0x64, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0d,
+	0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x1b, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x09, 0x5a, 0x07, 0x2e, 0x3b,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_services_proto_rawDescOnce sync.Once
+	file_services_proto_rawDescData = file_services_proto_rawDesc
+)
+
+func file_services_proto_rawDescGZIP() []byte {
+	file_services_proto_rawDescOnce.Do(func() {
+		file_services_proto_rawDescData = protoimpl.X.CompressGZIP(file_services_proto_rawDescData)
+	})
+	return file_services_proto_rawDescData
+}
+
+var file_services_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_services_proto_goTypes = []any{
+	(*ServiceInfo)(nil),           // 0: proto.ServiceInfo
+	(*GetServiceRequest)(nil),     // 1: proto.GetServiceRequest
+	(*GetServiceResponse)(nil),    // 2: proto.GetServiceResponse
+	(*ListServiceRequest)(nil),    // 3: proto.ListServiceRequest
+	(*ListServiceResponse)(nil),   // 4: proto.ListServiceResponse
+	(*AddServiceResponse)(nil),    // 5: proto.AddServiceResponse
+	(*RemoveServiceRequest)(nil),  // 6: proto.RemoveServiceRequest
+	(*RemoveServiceResponse)(nil), // 7: proto.RemoveServiceResponse
+}
+var file_services_proto_depIdxs = []int32{
+	0, // 0: proto.GetServiceResponse.data:type_name -> proto.ServiceInfo
+	0, // 1: proto.ListServiceResponse.data:type_name -> proto.ServiceInfo
+	1, // 2: proto.ServiceDirectory.GetService:input_type -> proto.GetServiceRequest
+	3, // 3: proto.ServiceDirectory.ListService:input_type -> proto.ListServiceRequest
+	0, // 4: proto.ServiceDirectory.AddService:input_type -> proto.ServiceInfo
+	6, // 5: proto.ServiceDirectory.RemoveService:input_type -> proto.RemoveServiceRequest
+	2, // 6: proto.ServiceDirectory.GetService:output_type -> proto.GetServiceResponse
+	4, // 7: proto.ServiceDirectory.ListService:output_type -> proto.ListServiceResponse
+	5, // 8: proto.ServiceDirectory.AddService:output_type -> proto.AddServiceResponse
+	7, // 9: proto.ServiceDirectory.RemoveService:output_type -> proto.RemoveServiceResponse
+	6, // [6:10] is the sub-list for method output_type
+	2, // [2:6] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_services_proto_init() }
+func file_services_proto_init() {
+	if File_services_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_services_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*ServiceInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*GetServiceRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*GetServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*ListServiceRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[4].Exporter = func(v any, i int) any {
+			switch v := v.(*ListServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[5].Exporter = func(v any, i int) any {
+			switch v := v.(*AddServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[6].Exporter = func(v any, i int) any {
+			switch v := v.(*RemoveServiceRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_services_proto_msgTypes[7].Exporter = func(v any, i int) any {
+			switch v := v.(*RemoveServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_services_proto_msgTypes[0].OneofWrappers = []any{}
+	file_services_proto_msgTypes[1].OneofWrappers = []any{}
+	file_services_proto_msgTypes[3].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_services_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_services_proto_goTypes,
+		DependencyIndexes: file_services_proto_depIdxs,
+		MessageInfos:      file_services_proto_msgTypes,
+	}.Build()
+	File_services_proto = out.File
+	file_services_proto_rawDesc = nil
+	file_services_proto_goTypes = nil
+	file_services_proto_depIdxs = nil
+}
--- a/pkg/proto/services.proto
+++ b/pkg/proto/services.proto
@@ -0,0 +1,49 @@
+syntax = "proto3";
+
+option go_package = ".;proto";
+
+package proto;
+
+service ServiceDirectory {
+  rpc GetService(GetServiceRequest) returns (GetServiceResponse) {}
+  rpc ListService(ListServiceRequest) returns (ListServiceResponse) {}
+  rpc AddService(ServiceInfo) returns (AddServiceResponse) {}
+  rpc RemoveService(RemoveServiceRequest) returns (RemoveServiceResponse) {}
+}
+
+message ServiceInfo {
+  string id = 1;
+  string type = 2;
+  string label = 3;
+  string grpc_addr = 4;
+  optional string http_addr = 5;
+}
+
+message GetServiceRequest {
+  optional string id = 1;
+  optional string type = 2;
+}
+
+message GetServiceResponse {
+  ServiceInfo data = 1;
+}
+
+message ListServiceRequest {
+  optional string type = 1;
+}
+
+message ListServiceResponse {
+  repeated ServiceInfo data = 1;
+}
+
+message AddServiceResponse {
+  bool is_success = 1;
+}
+
+message RemoveServiceRequest {
+  string id =1;
+}
+
+message RemoveServiceResponse {
+  bool is_success = 1;
+}
--- a/pkg/proto/services_grpc.pb.go
+++ b/pkg/proto/services_grpc.pb.go
@@ -0,0 +1,224 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.4.0
+// - protoc             v5.27.1
+// source: services.proto
+
+package proto
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
+
+const (
+	ServiceDirectory_GetService_FullMethodName    = "/proto.ServiceDirectory/GetService"
+	ServiceDirectory_ListService_FullMethodName   = "/proto.ServiceDirectory/ListService"
+	ServiceDirectory_AddService_FullMethodName    = "/proto.ServiceDirectory/AddService"
+	ServiceDirectory_RemoveService_FullMethodName = "/proto.ServiceDirectory/RemoveService"
+)
+
+// ServiceDirectoryClient is the client API for ServiceDirectory service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ServiceDirectoryClient interface {
+	GetService(ctx context.Context, in *GetServiceRequest, opts ...grpc.CallOption) (*GetServiceResponse, error)
+	ListService(ctx context.Context, in *ListServiceRequest, opts ...grpc.CallOption) (*ListServiceResponse, error)
+	AddService(ctx context.Context, in *ServiceInfo, opts ...grpc.CallOption) (*AddServiceResponse, error)
+	RemoveService(ctx context.Context, in *RemoveServiceRequest, opts ...grpc.CallOption) (*RemoveServiceResponse, error)
+}
+
+type serviceDirectoryClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewServiceDirectoryClient(cc grpc.ClientConnInterface) ServiceDirectoryClient {
+	return &serviceDirectoryClient{cc}
+}
+
+func (c *serviceDirectoryClient) GetService(ctx context.Context, in *GetServiceRequest, opts ...grpc.CallOption) (*GetServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetServiceResponse)
+	err := c.cc.Invoke(ctx, ServiceDirectory_GetService_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *serviceDirectoryClient) ListService(ctx context.Context, in *ListServiceRequest, opts ...grpc.CallOption) (*ListServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListServiceResponse)
+	err := c.cc.Invoke(ctx, ServiceDirectory_ListService_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *serviceDirectoryClient) AddService(ctx context.Context, in *ServiceInfo, opts ...grpc.CallOption) (*AddServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AddServiceResponse)
+	err := c.cc.Invoke(ctx, ServiceDirectory_AddService_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *serviceDirectoryClient) RemoveService(ctx context.Context, in *RemoveServiceRequest, opts ...grpc.CallOption) (*RemoveServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RemoveServiceResponse)
+	err := c.cc.Invoke(ctx, ServiceDirectory_RemoveService_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ServiceDirectoryServer is the server API for ServiceDirectory service.
+// All implementations must embed UnimplementedServiceDirectoryServer
+// for forward compatibility
+type ServiceDirectoryServer interface {
+	GetService(context.Context, *GetServiceRequest) (*GetServiceResponse, error)
+	ListService(context.Context, *ListServiceRequest) (*ListServiceResponse, error)
+	AddService(context.Context, *ServiceInfo) (*AddServiceResponse, error)
+	RemoveService(context.Context, *RemoveServiceRequest) (*RemoveServiceResponse, error)
+	mustEmbedUnimplementedServiceDirectoryServer()
+}
+
+// UnimplementedServiceDirectoryServer must be embedded to have forward compatible implementations.
+type UnimplementedServiceDirectoryServer struct {
+}
+
+func (UnimplementedServiceDirectoryServer) GetService(context.Context, *GetServiceRequest) (*GetServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetService not implemented")
+}
+func (UnimplementedServiceDirectoryServer) ListService(context.Context, *ListServiceRequest) (*ListServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListService not implemented")
+}
+func (UnimplementedServiceDirectoryServer) AddService(context.Context, *ServiceInfo) (*AddServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddService not implemented")
+}
+func (UnimplementedServiceDirectoryServer) RemoveService(context.Context, *RemoveServiceRequest) (*RemoveServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveService not implemented")
+}
+func (UnimplementedServiceDirectoryServer) mustEmbedUnimplementedServiceDirectoryServer() {}
+
+// UnsafeServiceDirectoryServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ServiceDirectoryServer will
+// result in compilation errors.
+type UnsafeServiceDirectoryServer interface {
+	mustEmbedUnimplementedServiceDirectoryServer()
+}
+
+func RegisterServiceDirectoryServer(s grpc.ServiceRegistrar, srv ServiceDirectoryServer) {
+	s.RegisterService(&ServiceDirectory_ServiceDesc, srv)
+}
+
+func _ServiceDirectory_GetService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ServiceDirectoryServer).GetService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ServiceDirectory_GetService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ServiceDirectoryServer).GetService(ctx, req.(*GetServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ServiceDirectory_ListService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ServiceDirectoryServer).ListService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ServiceDirectory_ListService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ServiceDirectoryServer).ListService(ctx, req.(*ListServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ServiceDirectory_AddService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ServiceInfo)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ServiceDirectoryServer).AddService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ServiceDirectory_AddService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ServiceDirectoryServer).AddService(ctx, req.(*ServiceInfo))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ServiceDirectory_RemoveService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ServiceDirectoryServer).RemoveService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ServiceDirectory_RemoveService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ServiceDirectoryServer).RemoveService(ctx, req.(*RemoveServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ServiceDirectory_ServiceDesc is the grpc.ServiceDesc for ServiceDirectory service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ServiceDirectory_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "proto.ServiceDirectory",
+	HandlerType: (*ServiceDirectoryServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetService",
+			Handler:    _ServiceDirectory_GetService_Handler,
+		},
+		{
+			MethodName: "ListService",
+			Handler:    _ServiceDirectory_ListService_Handler,
+		},
+		{
+			MethodName: "AddService",
+			Handler:    _ServiceDirectory_AddService_Handler,
+		},
+		{
+			MethodName: "RemoveService",
+			Handler:    _ServiceDirectory_RemoveService_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "services.proto",
+}