# @aurora-catalyst-generated (initially) — now hand-maintained.
# @source cliter/o-auth/credential.aurora.yaml
enum OAuthCredentialGrantTypeEnum {
  PASSWORD
  REFRESH_TOKEN
  AUTHORIZATION_CODE
}

type OAuthCredential {
  """
  Unique identifier for the credential log entry. UUID v4 format, generated automatically on creation. Primary key.
  """
  id: ID!
  """
  Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. Useful for chronological audit queries (ORDER BY rowId DESC LIMIT N is faster than ORDER BY createdAt DESC).
  """
  rowId: GraphQLInt!
  """
  OAuth2 grant type used in this issuance. PASSWORD = Resource Owner Password Credentials Grant (RFC 6749 §4.3). REFRESH_TOKEN = Refresh Token Grant (RFC 6749 §6). AUTHORIZATION_CODE is reserved for future Authorization Code Grant support; not used in the current MVP. Indexed for filtering audit queries by grant type.
  """
  grantType: OAuthCredentialGrantTypeEnum!
  """
  Reference to the IamAccount whose credentials produced this issuance. Indexed for "all logins for this account" forensic queries. Many-to-one because a single account can have many issuance events over time.
  """
  accountId: ID!
  account: IamAccount
  """
  Foreign key to the OAuthAccessToken row created by this issuance. One-to-one because each issuance creates exactly one access token. Nullable for safety (in degraded paths where access token persistence might fail after credential is logged), though current flow always persists both.
  """
  accessTokenId: ID
  accessToken: OAuthAccessToken
  """
  Foreign key to the OAuthRefreshToken row created by this issuance. One-to-one. Nullable because future grant types may issue access tokens without refresh tokens (e.g., Client Credentials Grant), and to allow degraded paths.
  """
  refreshTokenId: ID
  refreshToken: OAuthRefreshToken
  """
  IP address of the client that sent the POST /api/oauth/token request. Stored as a string (not as inet) to keep cross-DB portability and to allow IPv6 representations. Maximum 45 characters covers IPv6 (max 39 chars) plus zone id suffix.
  """
  ipAddress: GraphQLString
  """
  User-Agent header sent with the token request. Truncated to 255 characters if longer. Nullable because some clients (curl, internal services) may not send it. Useful in forensics to identify the device or library origin of an issuance.
  """
  userAgent: GraphQLString
  """
  Timestamp when the credential row was created. Equivalent to the moment the token was issued. Indexed for time-range audit queries and for the retention purge job.
  """
  createdAt: GraphQLTimestamp
  """
  Timestamp when the credential row was last updated. Credential rows are typically write-once; this column is maintained by Aurora's standard timestamp lifecycle.
  """
  updatedAt: GraphQLTimestamp
  """
  Soft-delete timestamp. NULL means active row. The retention job uses hard DELETE (not soft) for storage efficiency, but the column exists to allow ad-hoc soft-deletes by operators if needed before the retention window.
  """
  deletedAt: GraphQLTimestamp
}

type Query {
  oAuthFindCredential(query: QueryStatement, constraint: QueryStatement): OAuthCredential

  oAuthFindCredentialById(id: ID, constraint: QueryStatement): OAuthCredential

  oAuthGetCredentials(query: QueryStatement, constraint: QueryStatement): [OAuthCredential]!

  oAuthPaginateCredentials(query: QueryStatement, constraint: QueryStatement): Pagination!
}
