From 6ea3553445c7589d59b4fd7bedb231eff17874f1 Mon Sep 17 00:00:00 2001
From: Lambdius <Lambdius@yandex.ru>
Date: Fri, 30 Oct 2026 18:32:40 +0000
Subject: [PATCH] feat: add method-specific reauthentication proofs

---
 package.json                           |  2 +-
 src/enums.ts                           |  8 ++++++++
 src/kafka/reauthentication.schema.json | 23 ++++++++++++++++++++++-
 src/types.ts                           |  6 ++++++
 4 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 75ac469..655a674 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "description": "Shared Kafka/gRPC contracts and common enums between MonadIAM services",
   "author": "Daniil Egorov (https://github.com/Lambdius)",
   "license": "UNLICENSED",
-  "version": "3.1.6",
+  "version": "3.2.0",
   "types": "dist/index.d.ts",
   "main": "dist/index.js",
   "exports": {
diff --git a/src/enums.ts b/src/enums.ts
index 20e8a94..352b0a3 100644
--- a/src/enums.ts
+++ b/src/enums.ts
@@ -218,6 +218,14 @@ export enum ReauthenticationTopicAction {
     GRANT = "GRANT",
 }
 
+export enum ReauthenticationMethod {
+    /* eslint-disable prettier/prettier */
+    PASSWORD = "password",
+    OTP      = "otp",
+    TOTP     = "totp",
+    /* eslint-enable prettier/prettier */
+}
+
 export enum BlacklistTopicAction {
     ADD = "ADD",
 }
diff --git a/src/kafka/reauthentication.schema.json b/src/kafka/reauthentication.schema.json
index 59e71b3..8b46d30 100644
--- a/src/kafka/reauthentication.schema.json
+++ b/src/kafka/reauthentication.schema.json
@@ -16,7 +16,28 @@
       "required": ["expiresAt", "session"],
       "properties": {
         "expiresAt": { "type": "number" },
-        "session": { "type": "string" }
+        "session": { "type": "string" },
+        "proof": {
+          "oneOf": [
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["method"],
+              "properties": {
+                "method": { "enum": ["password", "otp"] }
+              }
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["method", "factor"],
+              "properties": {
+                "method": { "const": "totp" },
+                "factor": { "type": "string", "format": "uuid" }
+              }
+            }
+          ]
+        }
       }
     }
   }
diff --git a/src/types.ts b/src/types.ts
index 40d765e..61ac6ec 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -5,6 +5,7 @@ import {
     NotificationContentKind,
     NotificationTopicAction,
     AccessCacheTopicAction,
+    ReauthenticationMethod,
     PositionReferenceType,
     MessageDispatchAction,
     NotificationCategory,
@@ -571,11 +572,16 @@ declare global {
         }
 
         namespace Reauthentication {
+            type Proof =
+                | { method: ReauthenticationMethod.PASSWORD | ReauthenticationMethod.OTP }
+                | { method: ReauthenticationMethod.TOTP; factor: string };
+
             type Message = {
                 actionType: ReauthenticationTopicAction;
                 payload: {
                     expiresAt: number;
                     session: string;
+                    proof?: Proof;
                 };
             };
         }