feat: Auth 핵심 계약 인터페이스 확장

Author: SOIV

TODO.md

@@ -5,10 +5,10 @@ Source: `docs/v2_FINANCIAL-LEDGER/roadmap/01-development-plan.md`
 ## 1.2 Core Layer
 
 - [x] Auth: email/password login contract
-- [ ] Auth: JWT session manager contract
-- [ ] Auth: whitelist flow
-- [ ] Auth: admin PIN flow
-- [ ] Auth: password recovery flow (self-service + admin-assisted)
+- [x] Auth: JWT session manager contract
+- [x] Auth: whitelist flow
+- [x] Auth: admin PIN flow
+- [x] Auth: password recovery flow (self-service + admin-assisted)
 - [x] DB: provider interface
 - [ ] DB: postgres provider scaffold
 - [ ] DB: sqlite provider scaffold

packages/core/src/auth/index.ts

@@ -8,6 +8,59 @@ export interface SessionToken {
   refreshToken: string;
 }
 
+export interface JwtSessionPayload {
+  userId: string;
+  sessionId: string;
+}
+
+export interface JwtSessionManager {
+  issueTokens(payload: JwtSessionPayload): Promise<SessionToken>;
+  verifyAccessToken(token: string): Promise<JwtSessionPayload>;
+  rotateRefreshToken(refreshToken: string): Promise<SessionToken>;
+  revokeSession(sessionId: string): Promise<void>;
+}
+
+export interface WhitelistRule {
+  id: string;
+  type: "email" | "domain";
+  value: string;
+  enabled: boolean;
+}
+
+export interface WhitelistService {
+  listRules(): Promise<WhitelistRule[]>;
+  addRule(rule: Omit<WhitelistRule, "id">): Promise<WhitelistRule>;
+  removeRule(ruleId: string): Promise<void>;
+  isAllowed(email: string): Promise<boolean>;
+}
+
+export interface AdminPinService {
+  setPin(rawPin: string): Promise<void>;
+  verifyPin(rawPin: string): Promise<boolean>;
+  rotatePin(currentPin: string, nextPin: string): Promise<void>;
+}
+
+export interface PasswordRecoveryRequest {
+  email: string;
+}
+
+export interface PasswordResetConfirm {
+  token: string;
+  newPassword: string;
+}
+
+export interface AdminAssistedResetRequest {
+  adminPin: string;
+  userId: string;
+  temporaryPassword: string;
+}
+
+export interface PasswordRecoveryService {
+  requestSelfServiceReset(payload: PasswordRecoveryRequest): Promise<void>;
+  confirmSelfServiceReset(payload: PasswordResetConfirm): Promise<void>;
+  adminAssistedReset(payload: AdminAssistedResetRequest): Promise<void>;
+}
+
 export interface AuthService {
   login(payload: LoginRequest): Promise<SessionToken>;
 }