Auth API

Source: daemon/proto/hostcraft/v1/auth.proto

AuthService

AuthService exposes the parts of /api/v1/auth that make sense without a browser session. Login, challenges, passkeys, TOTP, passwords, sessions and API token self-service need an interactive session and stay REST only; API token principals may call GetMe alone (same rule as REST).

Method	REST route	Permission	Streaming
GetMe	GET /api/v1/auth/me	any authenticated caller	unary
GetMFAPolicy	GET /api/v1/auth/mfa/policy	SystemAdmin	unary
SetMFAPolicy	PUT /api/v1/auth/mfa/policy	SystemAdmin	unary

GetMe

GetMe returns the calling principal. The local root principal is reported as user_id "root", role super_admin.

/hostcraft.v1.AuthService/GetMe

• Request: GetMeRequest
• Response: GetMeResponse

GetMFAPolicy

/hostcraft.v1.AuthService/GetMFAPolicy

• Request: GetMFAPolicyRequest
• Response: MFAPolicy

SetMFAPolicy

/hostcraft.v1.AuthService/SetMFAPolicy

• Request: SetMFAPolicyRequest
• Response: MFAPolicy

Messages

GetMFAPolicyRequest

No fields.

GetMeRequest

No fields.

GetMeResponse

Field	Type	Number	Description
principal	Principal	1	-
mfa	MFAStatus	2	-

MFAPolicy

Field	Type	Number	Description
required_roles	repeated string	1	-
grace_hours	int64	2	-
effective_since	google.protobuf.Timestamp	3	-
updated_at	google.protobuf.Timestamp	4	-

MFAStatus

Field	Type	Number	Description
required	bool	1	-
enrolled	bool	2	-
deadline	google.protobuf.Timestamp	3	-
enforced	bool	4	-

Principal

Field	Type	Number	Description
user_id	string	1	-
email	string	2	-
display_name	string	3	-
role	string	4	super_admin | server_admin | reseller | account_owner | sub_user | mailbox_user
account_id	string	5	-
mailbox_id	string	6	-
totp_enrolled	optional bool	7	-
reseller_id	string	8	reseller principals only
sub_user_preset	string	9	sub users only
permissions	repeated string	10	effective permission set

SetMFAPolicyRequest

Field	Type	Number	Description
required_roles	repeated string	1	-
grace_hours	optional int64	2	-