feat(frontier): add FlowIntent and the consent document RPC

[rohanchkrabrty]

Part of RFC 0002: Explicit consent at signup. Frontier pulls this through PROTON_COMMIT; nothing here is frontier logic.

Adds one enum, two fields and one read-only RPC to FrontierService:

enum FlowIntent {
  FLOW_INTENT_UNSPECIFIED = 0;
  FLOW_INTENT_LOGIN = 1;
  FLOW_INTENT_SIGNUP = 2;
}

message AuthenticateRequest {
  // ...
  FlowIntent flow_intent = 6;
  repeated string accepted_document_ids = 7;
}

rpc ListConsentDocuments(ListConsentDocumentsRequest) returns (ListConsentDocumentsResponse) {}

Why the intent. Frontier cannot tell a signup from a login today. AuthenticateRequest carries no intent and every strategy ends at getOrCreateUser, so a login with an unknown address creates the account — through a view that never showed the documents. flow_intent separates the two: a login never creates an account, a signup never logs an existing user in. It is also what lets a consent check run before the browser leaves for the identity provider, where the email is not yet known but the intent is.

Why the documents. A deployment lists the documents it requires in server config with an id, title, version and URL. ListConsentDocuments serves that list and the client sends back the ids it accepted in accepted_document_ids. Ids rather than one boolean, because the list the client rendered can still differ from config, and ids expose the mismatch instead of stamping a record that says the user accepted something they never saw.

Deliberate choices, so they do not read as oversights:

• An enum, not a string. The set is closed, and its zero value gives backward compatibility for free: a client that does not set flow_intent keeps today's create-or-get behaviour.
• Flat fields, not a oneof over LoginIntent / SignupIntent arms with the ids on the signup arm. A oneof would make a signup-only field unrepresentable on a login rather than merely rejected, but AuthenticateRequest.email is already a field only some strategies use and is checked at runtime, so the flat field is the shape this message has. RFC alternative 8 records the tradeoff; moving later means deprecating field 6 and carrying both for a window.
• One PR for both fields, so neither can claim the other's number.
• AuthCallback gains nothing. Both values ride on the flow row, which is written before the redirect and read after it returns, so neither passes through the browser.
• ListConsentDocuments is separate from ListAuthStrategies. Consent is not a strategy, and AuthStrategy carries name and params and nothing else, so the documents would go in a params map every client has to parse.
• Unauthenticated, like ListAuthStrategies. The document URLs are meant to be read by anyone considering an account, and the ids are an input to an unauthenticated Authenticate — requiring a session to learn what to accept before the account exists is a cycle.

buf lint, buf build and buf breaking --against '.git#branch=main' are all clean. Additive only; no existing field or RPC changes.

🤖 Generated with Claude Code

---

Supersedes #501, which GitHub auto-closed when its head branch was renamed. Same commit, same content.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ed08d80-a359-4a11-bd01-4abe4c4615f2

📥 Commits

Reviewing files that changed from the base of the PR and between 092b26e and b4a0f2f.

📒 Files selected for processing (1)

• raystack/frontier/v1beta1/frontier.proto

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Frontier API adds an unauthenticated ListConsentDocuments RPC and messages for consent-document metadata. It adds the FlowIntent enum with login and signup values. AuthenticateRequest now accepts flow_intent and repeated accepted_document_ids fields. Unspecified intent preserves the existing create-or-get behavior. Consent documents are returned in ID order, and an empty response indicates that no consent is required.

Suggested reviewers: whoabhisheksah, rohilsurana, amangit07

Merge Risk: ⚪ Minimal · up to b4a0f

This adds consent-document listing and explicit authentication-flow fields without changing existing fields or RPCs; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main changes: adding FlowIntent and the consent document RPC.
Description check	✅ Passed	The description directly explains the FlowIntent fields, consent document fields, new RPC, rationale, compatibility behavior, and validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Warning

Some tools did not complete. Review the errors below.

🔧 Buf (1.72.0)

raystack/frontier/v1beta1/frontier.proto

fatal: unable to access 'https://github.com/raystack/proton.git/': Failed to connect to github.com port 443 via 127.0.0.1 after 0 ms: Could not connect to server
fatal: could not fetch d8aca710a9e04a25121796ef0681c1074d94a243 from promisor remote

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Validate / validate (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	✅ passed	✅ passed	Aug 30, 2026, 6:56 PM