ci(stage): add build-proto shared action (buf lint + buf build)

Signed-off-by: nfel <nfilsaraee@gmail.com>

.gitea/actions/build-proto/action.yml

@@ -0,0 +1,27 @@
+name: Build Proto
+description: Install buf CLI, run buf lint and buf build
+inputs:
+  buf_ref:
+    description: Git ref of actions/buf-bin to checkout
+    required: false
+    default: "main"
+runs:
+  using: composite
+  steps:
+    - name: Checkout Buf CLI
+      uses: https://git.darano.ir/actions/checkout@v5
+      with:
+        repository: actions/buf-bin
+        ref: ${{ inputs.buf_ref }}
+        path: buf-bin
+    - name: Setup Buf CLI
+      shell: bash
+      run: |
+        cp buf-bin/buf /usr/local/bin/buf
+        chmod +x /usr/local/bin/buf
+    - name: Lint
+      shell: bash
+      run: buf lint
+    - name: Build
+      shell: bash
+      run: buf build

.gitea/actions/setup-mirrors/action.yml

@@ -0,0 +1,151 @@
+name: Setup package mirrors
+description: Benchmark package mirrors and export the fastest reachable registry for each ecosystem
+inputs:
+  npm_mirrors:
+    description: Newline-separated npm-compatible registries
+    required: false
+    default: |
+      https://npm.reg.darano.ir/
+  pypi_mirrors:
+    required: false
+    default: |
+      https://package-mirror.liara.ir/repository/pypi/simple
+      https://pypi.reg.darano.ir
+      https://pypi-iran.ir/simple/
+      https://pypi.org/simple/
+  go_mirrors:
+    description: Newline-separated Go module proxies
+    required: false
+    default: |
+      https://go.devneeds.ir/
+      https://package-mirror.liara.ir/repository/go/
+      https://go.reg.darano.ir/
+      https://proxy.golang.org/
+  debian_mirrors:
+    description: Newline-separated Debian package repository base URLs
+    required: false
+    default: |
+      http://repo.iut.ac.ir/debian/
+      http://deb.debian.org/debian/
+  connect_timeout:
+    description: curl connection timeout in seconds
+    required: false
+    default: "3"
+  max_time:
+    description: curl request timeout in seconds
+    required: false
+    default: "10"
+outputs:
+  npm_registry:
+    description: Fastest reachable npm registry
+    value: ${{ steps.select.outputs.npm_registry }}
+  pypi_index:
+    description: Fastest reachable Python package index
+    value: ${{ steps.select.outputs.pypi_index }}
+  go_proxy:
+    description: Fastest reachable Go module proxy
+    value: ${{ steps.select.outputs.go_proxy }}
+  debian_mirror:
+    description: Fastest reachable Debian package repository
+    value: ${{ steps.select.outputs.debian_mirror }}
+runs:
+  using: composite
+  steps:
+    - name: Rate mirrors and export package environments
+      id: select
+      shell: bash
+      env:
+        NPM_MIRRORS: ${{ inputs.npm_mirrors }}
+        PYPI_MIRRORS: ${{ inputs.pypi_mirrors }}
+        GO_MIRRORS: ${{ inputs.go_mirrors }}
+        DEBIAN_MIRRORS: ${{ inputs.debian_mirrors }}
+        CONNECT_TIMEOUT: ${{ inputs.connect_timeout }}
+        MAX_TIME: ${{ inputs.max_time }}
+      run: |
+        set -euo pipefail
+
+        if [[ ! "$CONNECT_TIMEOUT" =~ ^[0-9]+([.][0-9]+)?$ ]] ||
+           [[ ! "$MAX_TIME" =~ ^[0-9]+([.][0-9]+)?$ ]]; then
+          echo "Mirror timeouts must be positive numbers" >&2
+          exit 1
+        fi
+
+        select_fastest() {
+          local ecosystem="$1"
+          local mirrors="$2"
+          local scores mirror result status duration fallback
+          scores="$(mktemp)"
+          fallback=""
+
+          while IFS= read -r mirror; do
+            mirror="$(printf '%s' "$mirror" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+            [[ -z "$mirror" || "$mirror" == \#* ]] && continue
+
+            if [[ ! "$mirror" =~ ^https?:// ]]; then
+              echo "[$ecosystem] skipped invalid URL: $mirror" >&2
+              continue
+            fi
+            [[ -z "$fallback" ]] && fallback="$mirror"
+
+            if result="$(curl \
+              --location \
+              --silent \
+              --show-error \
+              --output /dev/null \
+              --connect-timeout "$CONNECT_TIMEOUT" \
+              --max-time "$MAX_TIME" \
+              --write-out '%{http_code} %{time_total}' \
+              "$mirror" 2>/dev/null)"; then
+              read -r status duration <<< "$result"
+              if [[ "$status" =~ ^[0-9]{3}$ ]] &&
+                 (((10#$status >= 200 && 10#$status < 400) || 10#$status == 404)) &&
+                 [[ "$duration" =~ ^[0-9]+([.][0-9]+)?$ ]]; then
+                printf '%s\t%s\t%s\n' "$duration" "$status" "$mirror" >> "$scores"
+                continue
+              fi
+            fi
+
+            echo "[$ecosystem] unavailable: $mirror" >&2
+          done <<< "$mirrors"
+
+          if [[ ! -s "$scores" ]]; then
+            rm -f "$scores"
+            if [[ -z "$fallback" ]]; then
+              echo "No valid $ecosystem mirror was configured" >&2
+              return 1
+            fi
+            echo "[$ecosystem] no mirror responded; falling back to $fallback" >&2
+            printf '%s\n' "$fallback"
+            return 0
+          fi
+
+          echo "[$ecosystem] mirror ranking (seconds, HTTP status, URL):" >&2
+          sort -n -k1,1 "$scores" >&2
+          sort -n -k1,1 "$scores" | head -n 1 | cut -f3-
+          rm -f "$scores"
+        }
+
+        npm_registry="$(select_fastest npm "$NPM_MIRRORS")"
+        pypi_index="$(select_fastest pypi "$PYPI_MIRRORS")"
+        go_proxy="$(select_fastest go "$GO_MIRRORS")"
+        debian_mirror="$(select_fastest debian "$DEBIAN_MIRRORS")"
+
+        {
+          echo "NPM_CONFIG_REGISTRY=$npm_registry"
+          echo "npm_config_registry=$npm_registry"
+          echo "COREPACK_NPM_REGISTRY=$npm_registry"
+          echo "YARN_REGISTRY=$npm_registry"
+          echo "PNPM_CONFIG_REGISTRY=$npm_registry"
+          echo "BUN_CONFIG_REGISTRY=$npm_registry"
+          echo "PIP_INDEX_URL=$pypi_index"
+          echo "UV_DEFAULT_INDEX=$pypi_index"
+          echo "GOPROXY=$go_proxy"
+          echo "DEBIAN_MIRROR=$debian_mirror"
+        } >> "$GITHUB_ENV"
+
+        {
+          echo "npm_registry=$npm_registry"
+          echo "pypi_index=$pypi_index"
+          echo "go_proxy=$go_proxy"
+          echo "debian_mirror=$debian_mirror"
+        } >> "$GITHUB_OUTPUT"

.gitea/workflows/ci-stage.yaml

@@ -0,0 +1,41 @@
+---
+name: CI/CD Stage
+on:
+  push:
+    branches:
+      - stage
+jobs:
+  stage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Git
+        uses: https://git.darano.ir/actions/checkout@v5
+        with:
+          token: ${{ gitea.token }}
+          path: ./
+          submodules: recursive
+      - name: Checkout Buf CLI
+        uses: https://git.darano.ir/actions/checkout@v5
+        with:
+          repository: actions/buf-bin
+          ref: main
+          path: buf-bin
+      - name: Setup package mirrors
+        uses: ./.gitea/actions/setup-mirrors
+      - name: Setup Buf CLI
+        run: |
+          cp buf-bin/buf /usr/local/bin/buf
+          chmod +x /usr/local/bin/buf
+      - name: Lint
+        run: buf lint
+      - name: Build
+        run: buf build
+      - name: Notify Telegram
+        if: always()
+        uses: ./.gitea/actions/notify-telegram
+        with:
+          bot_token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          chat_id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          status: ${{ job.status }}
+          repository: ${{ gitea.repository }}
+          sha: ${{ gitea.sha }}

authorization.proto

@@ -2,8 +2,8 @@ syntax = "proto3";
 
 package authorization;
 
-import "base_message.proto";
 import "authorization_message.proto";
+import "base_message.proto";
 
 service AuthorizationService {
   rpc InternalAuthorizationDeleteCache(base.Empty) returns (base.StatusRes);
@@ -14,15 +14,25 @@ service AuthorizationService {
 
   rpc UserLoginSendOTP(UserSendOtpReq) returns (UserSendOtpRes) {}
   rpc UserLoginWithOTP(UserLoginReq) returns (UserAccessTokenRes) {}
-  rpc UserGetAccessTokenByRefreshToken(UserRefreshTokenReq) returns (UserAccessTokenRes){}
+  rpc UserGetAccessTokenByRefreshToken(UserRefreshTokenReq)
+      returns (UserAccessTokenRes) {}
 
   rpc UserGetUserPermission(InternalIAM) returns (PermissionList) {}
 
   rpc UserGetIdentity(InternalIAM) returns (Identity) {}
   rpc UserUpdateIdentity(UserUpdateIdentityReq) returns (base.StatusRes) {}
 
-  rpc UserGetBankInfoList(InternalIAM) returns (BankInfoList){}
+  rpc UserGetBankInfoList(ReqWithIAMAndParams) returns (BankInfoList) {}
   rpc UserUpdateBankInfo(UserUpdateBankInfoReq) returns (base.StatusRes) {}
+  rpc UserRemoveBankInfo(IdReqWithIAM) returns (base.StatusRes) {}
 
   rpc GetUser(GetUserReq) returns (User) {}
+
+  // Two Factor Authentication
+  // For now it's only SMS-OTP - later will be Email-OTP or other methods can be
+  // added For HMAC-OTP there won't be a need to call this api
+  rpc SendTFAReq(TFAReq) returns (base.StatusRes) {}
+  // For HMAC-OTP an initialization step must be added to exchange keys
+  rpc InitTFAReq(InternalIAM) returns (TFAExRes) {}
+  rpc CheckTFACode(CheckTFAReq) returns (base.StatusRes) {}
 }

authorization_message.proto

@@ -75,6 +75,15 @@ message CheckIAMReq{
 message InternalIAM {
   User user = 1;
   IdentityBasic identity = 2;
+  repeated Company company = 3;
+}
+message IdReqWithIAM {
+  int64 id = 1;
+  InternalIAM iam = 2;
+}
+message ReqWithIAMAndParams {
+  InternalIAM iam = 1;
+  optional bool accepted = 2;
 }
 
 /*
@@ -93,6 +102,14 @@ message User {
   repeated int64 roles = 5;
 }
 
+message Company {
+  int64 id = 1;
+  string name = 2;
+  string name_fa = 3;
+  string location = 4;
+  bool can_provide_bnpl = 5;
+}
+
 message Identity {
   string national_id = 1;
   string national_serial_id = 2;
@@ -114,7 +131,9 @@ message Identity {
   string updated_at = 18;
   string created_at = 19;
   string email = 20;
-
+  string  mobile = 21;
+  optional Company company = 22;
+  optional string employee_info = 23;
 }
 
 message IdentityBasic {
@@ -148,12 +167,44 @@ message BankInfoList {
   repeated BankInfo list = 1;
 }
 
+// Status 0: Fail Verify, 1: Verified, 2: Does not Match user's credential
+enum BankInfoStatusEnum {
+  FAIL_VERIFY = 0;
+  VERIFIED = 1;
+  DOES_NOT_MATCH = 2;
+}
 message BankInfo {
   int64 id = 1;
   string deposit_number = 2;
   string iban_number = 3;
   string card_number = 4;
-  int32 status = 5;
+  BankInfoStatusEnum status = 5;
   string updated_at = 6;
   string created_at = 7;
 }
+
+/* Two Factor Authentication */
+message IdReqWithIAMAndTFA {
+  int64 id = 1;
+  InternalIAM iam = 2;
+  string tfa_code = 3;
+}
+message TFAReq {
+  InternalIAM iam = 1;
+  optional string mobile = 2;
+  optional string email = 3;
+  optional string reason = 4; // issued jwt reason -> can be login, redeem, withdrawal
+}
+
+// Two Factor Authentication Exchange Response
+message TFAExRes {
+  InternalIAM iam = 1;
+  string secret = 2;
+  string qrcode_base64 = 3;
+}
+message CheckTFAReq {
+  InternalIAM iam = 1;
+  string code = 2;
+  optional string algorithm = 3;
+  optional string reason = 4; // Can be later used as a lookup
+}

base_message.proto

@@ -7,7 +7,6 @@ message Empty {}
 message StatusRes {
   bool success = 1;
 }
-
 message IdRes {
   int64 id = 1;
 }

buf.yaml

@@ -0,0 +1,12 @@
+---
+version: v1
+lint:
+  use:
+    - DEFAULT
+# disallow_comment_ignores: false
+# # The default behavior of this key has changed from v1
+# enum_zero_value_suffix: _UNSPECIFIED
+# rpc_allow_same_request_response: true
+# rpc_allow_google_protobuf_empty_requests: false
+# rpc_allow_google_protobuf_empty_responses: false
+# service_suffix: Service

wallet.proto

@@ -2,8 +2,8 @@ syntax = "proto3";
 
 package wallet;
 
-import "base_message.proto";
 import "authorization_message.proto";
+import "base_message.proto";
 import "wallet_message.proto";
 
 service WalletService {
@@ -26,4 +26,17 @@ service WalletService {
   rpc SaleGetToken(SaleGetTokenReq) returns (SaleGetTokenRes);
   rpc SaleConfirm(SaleConfirmReq) returns (SaleConfirmRes);
   rpc AdminManualSaleDeposit(SaleManualReq) returns (base.StatusRes);
+
+  // BNPL
+  rpc GetBNPLList(base.Empty) returns (BNPLList);
+  rpc GetBNPLInfo(base.IdReq) returns (BNPLInfo);
+  rpc GetUserBNPLInfo(GetUserBNPLInfoReq) returns (UserBNPLResp);
+  rpc SubmitBNPLForm(UserBNPLReq) returns (base.StatusRes);
+  rpc UpdateBNPL(UserBNPLReq) returns (base.StatusRes);
+  rpc CancleBNPL(authorization.IdReqWithIAM) returns (base.StatusRes);
+
+  // Redeem Token
+  rpc CalculateRedeemToken(RedeemTokenReq) returns (CalculateRedeemTokenRes);
+  rpc RedeemToken(RedeemTokenReq) returns (base.StatusRes);
+  rpc RedeemTokenList(authorization.ReqWithIAMAndParams) returns (RedeemTokenResList);
 }

wallet_message.proto

@@ -3,6 +3,7 @@ syntax = "proto3";
 package wallet;
 
 import "authorization_message.proto";
+import "base_message.proto";
 
 /*
    INTERNAL DATA
@@ -41,7 +42,6 @@ message AssetList {
   repeated Asset list = 1;
 }
 
-
 message Asset {
   int64 id = 1;
   string name = 2;
@@ -100,6 +100,90 @@ message PropertyMeta {
   string user_agreement_url = 11;
 }
 
+/*
+   BNPL - not really but close name
+*/
+
+// enum BNPLPgState {
+//
+// }
+
+message GetUserBNPLInfoReq {
+  authorization.InternalIAM iam = 1;
+  base.IdReq id = 2;
+}
+
+enum BNPLPaymentsStatus {
+  PENDING = 0;
+  PAYED = 1;
+  OVER_DUE = 2;
+  NOT_STARTED = 3;
+  NOT_YET_DUE = 4;
+  CANCLED = 5;
+}
+message BNPLPayments {
+  uint64 id = 1;
+  double amount = 2;
+  double amount_irr = 7;
+  bool is_paied = 3;
+  string due_date = 4;
+  string settlement_date = 5;
+  BNPLPaymentsStatus status = 6;
+}
+
+message UserBNPLResp {
+  uint64 id = 1;
+  BNPLInfo bnpl = 2;
+  int32 current_step = 3;
+  optional float amount = 4;
+  optional PaymentPeriodInfo payment_period = 5;
+  optional bool accepted_terms = 6;
+  repeated BNPLPayments payments = 7;
+  optional string employee_id = 8;
+  optional authorization.Company company = 10;
+  authorization.InternalIAM iam = 11;
+  optional string updated_at = 12;
+  optional string created_at = 13;
+  Asset selected_asset = 14;
+}
+
+message UserBNPLReq {
+  uint64 id = 1;
+  int64 bnpl_id = 2;
+  authorization.InternalIAM iam = 6;
+  optional string created_at = 3;
+  optional string employee_id = 4;
+  optional int64 company_id = 5;
+  optional float amount = 7;
+  optional PaymentPeriodInfo payment_period = 8;
+  optional bool has_agreed_contract = 9;
+  optional int32 current_step = 10; //Can be useful for admin to change the current step
+  optional int64 asset_id = 11;
+}
+
+message PaymentPeriodInfo {
+  uint64 id = 1;
+  uint64 period = 2;
+  bool enabled = 3;
+}
+message BNPLInfo {
+  uint64 id = 1;
+  string description = 3;
+  repeated Asset supported_assets = 2;
+  optional bool enabled = 4;
+  float amount_start = 5;
+  float amount_end = 6;
+  float amount_steps = 7;
+  repeated PaymentPeriodInfo payment_period = 8;
+  repeated authorization.Company possible_companies = 11;
+  string updated_at = 12;
+  string created_at = 13;
+  string expires_at = 14;
+}
+message BNPLList {
+  repeated BNPLInfo list = 1;
+}
+
 /*
    Wallet
 */
@@ -135,10 +219,26 @@ message TransactionList {
   int64 total_count = 2;
 }
 
+enum TransactionType {
+  Unknown = 0;
+  Buy = 1;
+  Sell = 2;
+  Transfer = 3;
+  Redeem = 4;
+}
+enum TransactionStatus {
+  Undetermined = 0;
+  Failed = -10;
+  Suspended = -9;
+  Created = -1;
+  Pending = 1;
+  Successful = 2;
+}
+
 message Transaction {
   int64 id = 1;
   int64 asset_id = 2;
-  Asset asset_info = 3;
+  // Asset asset_info = 3; //Causing network overloading
   optional int64 from_user_id = 4;
   optional authorization.UserIdentityBasic from_user_info = 5;
   optional int64 from_federation_id = 6;
@@ -148,8 +248,8 @@ message Transaction {
   optional int64 to_federation_id = 10;
   optional Federation to_federation_info = 11;
   double amount = 12;
-  int32 status = 13;
+  TransactionStatus status = 13;
-  int32 type = 14;
+  TransactionType type = 14;
   string updated_at = 15;
   string created_at = 16;
   string tracking_code = 17;
@@ -167,8 +267,8 @@ message UserGetTransactionListReq {
   optional int64 to_federation_id = 9;
   optional double amount_from = 10;
   optional double amount_to = 11;
-  optional int32 status = 12;
+  optional TransactionStatus status = 12;
-  optional int32 type = 13;
+  optional TransactionType type = 13;
   optional string tracking_code = 14;
 }
 /*
@@ -241,4 +341,39 @@ message SaleManualReq {
   string national_id = 6;
 }
 
-
+/*
+   Redeem Token
+*/
+message RedeemTokenReq {
+  authorization.InternalIAM iam = 1;
+  int64 asset_id = 2;
+  uint64 bank_info_id = 3;
+  double amount = 4;
+  optional string tfa_code = 5;
+}
+message CalculateRedeemTokenRes {
+  Asset asset = 1;
+  double free_balance = 2;
+  double total_balance = 3;
+  double request_amount = 4;
+  double profit_capital = 5;
+  double user_capital = 6;
+  optional authorization.BankInfo bank_info = 7;
+}
+message RedeemTokenRes {
+  uint64 id = 1;
+  int64 user_id = 2;
+  Asset asset = 3;
+  double free_balance = 4;
+  double total_balance = 5;
+  double request_amount = 6;
+  string created_at = 7;
+  bool is_paied = 8;
+  // receipt.Receipt receipt = 8;
+  double calculated_profit = 9;
+  optional authorization.BankInfo bank_info = 10;
+  optional string receipt = 11;
+}
+message RedeemTokenResList {
+  repeated RedeemTokenRes list = 1;
+}