import { gql } from 'graphql-modules';
export default gql `
  " Authentication directive: requires user to be authenticated "
  directive @requiresAuth on FIELD_DEFINITION
  " Role-based authorization: requires user to have specific role "
  directive @requiresRole(role: String!) on FIELD_DEFINITION
  " Role-based authorization: requires user to have any of the specified roles "
  directive @requiresAnyRole(roles: [String!]!) on FIELD_DEFINITION

  extend type Query {
    listApiKeys: [ApiKey!]! @requiresRole(role: "business_owner")
    listBusinessUsers: [BusinessUser!]! @requiresRole(role: "business_owner")
    listInvitations: [Invitation!]! @requiresRole(role: "business_owner")
  }

  extend type Mutation {
    createInvitation(email: String!, roleId: String!): InvitationPayload!
      @requiresRole(role: "business_owner")
    acceptInvitation(token: String!): AcceptInvitationPayload!
    generateApiKey(name: String!, roleId: String!): GenerateApiKeyPayload!
      @requiresRole(role: "business_owner")
    revokeApiKey(id: ID!): Boolean! @requiresRole(role: "business_owner")
    removeBusinessUser(userId: ID!): Boolean! @requiresRole(role: "business_owner")
    revokeInvitation(id: ID!): Boolean! @requiresRole(role: "business_owner")
  }

  " Invitation payload returned after creating an invitation (includes the one-time token) "
  type InvitationPayload {
    id: ID!
    email: String!
    roleId: String!
    expiresAt: DateTime!
    token: String!
  }

  " Stored invitation state, as listed for management (never exposes the one-time token) "
  type Invitation {
    id: ID!
    email: String!
    roleId: String!
    expiresAt: DateTime!
  }

  " Result payload returned after accepting an invitation "
  type AcceptInvitationPayload {
    success: Boolean!
    businessId: ID!
    roleId: String!
  }

  " API key payload returned after generating a new API key "
  type GenerateApiKeyPayload {
    apiKey: String!
    record: ApiKey!
  }

  " API key metadata (plaintext key is never stored) "
  type ApiKey {
    id: ID!
    name: String!
    roleId: String!
    lastUsedAt: DateTime
    createdAt: DateTime!
  }

  " Business user member of a tenant "
  type BusinessUser {
    id: ID!
    email: String!
    name: String
    roleId: String!
    createdAt: DateTime!
  }
`;
//# sourceMappingURL=auth.graphql.js.map