# @aurora-catalyst-generated
# @source cliter/o-auth/scope.aurora.yaml

type OAuthScope {
  """
  Unique identifier for the scope. UUID v4 format, generated automatically on creation.
  """
  id: ID!
  """
  Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID.
  """
  rowId: GraphQLInt!
  """
  Unique code identifier for the scope. Used in OAuth flows to request specific permissions. Convention: Uppercase, underscore-separated (e.g., READ_USERS, EDIT_POSTS).
  """
  code: GraphQLString!
  """
  Human-readable name for the scope. Displayed in authorization prompts and admin interfaces.
  """
  name: GraphQLString!
  """
  Array of role IDs that have access to this scope. Links scopes to the IAM role system for permission management. NULL means no role restrictions.
  """
  roleIds: [ID]
  """
  Timestamp when the scope was created. Automatically set on creation.
  """
  createdAt: GraphQLTimestamp
  """
  Timestamp when the scope was last updated. Automatically updated on modification.
  """
  updatedAt: GraphQLTimestamp
  """
  Soft delete timestamp. NULL means active scope. When set, scope is excluded from normal queries but preserved for audit trail.
  """
  deletedAt: GraphQLTimestamp
}

input OAuthCreateScopeInput {
  id: ID!
  code: GraphQLString!
  name: GraphQLString!
  roleIds: [ID]
}

input OAuthUpdateScopeByIdInput {
  id: ID!
  code: GraphQLString
  name: GraphQLString
  roleIds: [ID]
}

input OAuthUpdateScopesInput {
  id: ID
  code: GraphQLString
  name: GraphQLString
  roleIds: [ID]
}
type Query {
  oAuthFindScope(query: QueryStatement, constraint: QueryStatement): OAuthScope

  oAuthFindScopeById(id: ID, constraint: QueryStatement): OAuthScope

  oAuthGetScopes(query: QueryStatement, constraint: QueryStatement): [OAuthScope]!

  oAuthPaginateScopes(query: QueryStatement, constraint: QueryStatement): Pagination!
}

type Mutation {
  oAuthCreateScope(payload: OAuthCreateScopeInput!): OAuthScope

  oAuthUpdateScopeById(payload: OAuthUpdateScopeByIdInput!, constraint: QueryStatement): OAuthScope

  oAuthDeleteScopeById(id: ID!, constraint: QueryStatement): OAuthScope
}
