/**
 * @aurora-catalyst-generated
 * @source cliter/o-auth/client.aurora.yaml
 */
import { OAuthClientGrantTypeEnum } from '@api/graphql';
import { ApiProperty } from '@nestjs/swagger';

export class OAuthCreateClientDto {
  @ApiProperty({
    type: String,
    description:
      'Unique identifier for the client. UUID v4 format, generated automatically on creation.',
  })
  id: string;

  @ApiProperty({
    enum: OAuthClientGrantTypeEnum,
    description:
      'OAuth 2.0 grant type for this client. AUTHORIZATION_CODE: Web apps with server backend. CLIENT_CREDENTIALS: Machine-to-machine authentication. PASSWORD: Legacy username/password flow. REFRESH_TOKEN: Used to obtain new access tokens.',
  })
  grantType: OAuthClientGrantTypeEnum;

  @ApiProperty({
    type: [String],
    description:
      'Many-to-many relationship with OAuth applications. A client can belong to multiple applications, allowing shared client configurations across different services.',
  })
  applicationIds?: string[];

  @ApiProperty({
    type: Array,
    description:
      'Array of available scope codes for this client. Defines which permissions can be requested. Example: ["read:users", "write:posts"]. NULL means all scopes available.',
  })
  scopeOptions?: string[];

  @ApiProperty({
    type: String,
    description:
      'Human-readable name for the client. Displayed in authorization prompts and admin interfaces. Example: "Web Application", "Mobile App - iOS".',
  })
  name: string;

  @ApiProperty({
    type: Boolean,
    description:
      'Indicates whether this is a master client with elevated privileges. Master clients typically have access to all scopes and bypass certain restrictions.',
  })
  isMaster: boolean;

  @ApiProperty({
    type: String,
    description:
      'Client secret used for authentication. SECURITY: Must be stored securely, hashed, and only shared with confidential clients. Not used for public clients (e.g., mobile apps).',
  })
  secret: string;

  @ApiProperty({
    type: String,
    description:
      "Authorization URL for the OAuth flow. Used in authorization_code grant to redirect users for authentication. NULL for grant types that don't require user authorization.",
  })
  authUrl?: string;

  @ApiProperty({
    type: String,
    description:
      'Redirect URI where the authorization server sends the user after authorization. Must match exactly for security. Multiple URIs can be stored as JSON array in production systems.',
  })
  redirect?: string;

  @ApiProperty({
    type: Number,
    description:
      'Lifetime of access tokens in seconds. Determines how long access tokens remain valid after creation. Typical values: 3600 (1 hour) to 86400 (24 hours). NULL uses system default.',
  })
  accessTokenLifetimeSeconds?: number;

  @ApiProperty({
    type: Number,
    description:
      'Lifetime of refresh tokens in seconds. Determines how long refresh tokens remain valid. Typically much longer than access tokens: 2592000 (30 days) to 31536000 (1 year). NULL uses system default.',
  })
  refreshTokenLifetimeSeconds?: number;

  @ApiProperty({
    type: Boolean,
    description:
      'Indicates whether the client is currently active and can be used for authentication. Inactive clients are rejected in OAuth flows. Use to temporarily disable clients.',
    example: true,
  })
  isActive: boolean;
}
