# @aurora-catalyst-generated
# @source cliter/o-auth/authorization-code.aurora.yaml

type OAuthAuthorizationCode {
  """
  Unique identifier for the authorization code record. UUID v4 format, generated automatically on creation.
  """
  id: ID!
  """
  Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID.
  """
  rowId: GraphQLInt!
  """
  Opaque authorization code string. Cryptographically random, URL-safe. Presented to the client application for exchange via the token endpoint. Must be unique and single-use.
  """
  code: GraphQLString!
  """
  ID of the OAuth client that requested this authorization code. Links the code to the application initiating the authorization flow.
  """
  clientId: ID!
  client: OAuthClient
  """
  ID of the authenticated account (user) who authorized this code. Used to associate the resulting tokens with the correct user identity.
  """
  accountId: ID!
  """
  The redirect URI provided by the client in the authorization request. Must match exactly during code exchange to prevent authorization code interception attacks (RFC 6749 Section 4.1.3).
  """
  redirectUri: GraphQLString!
  """
  JSON array of scope strings requested by the client during authorization. Defines the permissions granted for the resulting access token. NULL means default scopes.
  """
  scopes: JSON
  """
  PKCE code challenge value. Reserved for future PKCE implementation. Will contain the S256 hash of the code verifier sent by public clients (RFC 7636).
  """
  codeChallenge: GraphQLString
  """
  PKCE code challenge method. Reserved for future PKCE implementation. Expected values: 'S256' or 'plain' (RFC 7636). S256 is strongly recommended.
  """
  codeChallengeMethod: GraphQLString
  """
  Expiration timestamp for the authorization code. Codes are very short-lived (typically 60 seconds) to minimize the window for interception. After expiration, the code cannot be exchanged.
  """
  expiresAt: GraphQLTimestamp!
  """
  Indicates whether the authorization code has already been exchanged for tokens. Codes are single-use; if a used code is presented again, all tokens issued from it must be revoked (RFC 6749 Section 4.1.2).
  """
  isUsed: GraphQLBoolean!
  """
  Timestamp when the authorization code was created. Automatically set on creation.
  """
  createdAt: GraphQLTimestamp
  """
  Timestamp when the authorization code was last updated. Automatically updated on modification.
  """
  updatedAt: GraphQLTimestamp
  """
  Soft delete timestamp. NULL means active code. When set, code is excluded from normal queries but preserved for audit trail.
  """
  deletedAt: GraphQLTimestamp
}

input OAuthCreateAuthorizationCodeInput {
  id: ID!
  code: GraphQLString!
  clientId: ID!
  accountId: ID!
  redirectUri: GraphQLString!
  scopes: JSON
  codeChallenge: GraphQLString
  codeChallengeMethod: GraphQLString
  expiresAt: GraphQLTimestamp!
  isUsed: GraphQLBoolean!
}

input OAuthUpdateAuthorizationCodeByIdInput {
  id: ID!
  code: GraphQLString
  clientId: ID
  accountId: ID
  redirectUri: GraphQLString
  scopes: JSON
  codeChallenge: GraphQLString
  codeChallengeMethod: GraphQLString
  expiresAt: GraphQLTimestamp
  isUsed: GraphQLBoolean
}

input OAuthUpdateAuthorizationCodesInput {
  id: ID
  code: GraphQLString
  clientId: ID
  accountId: ID
  redirectUri: GraphQLString
  scopes: JSON
  codeChallenge: GraphQLString
  codeChallengeMethod: GraphQLString
  expiresAt: GraphQLTimestamp
  isUsed: GraphQLBoolean
}
type Query {
  oAuthFindAuthorizationCode(
    query: QueryStatement
    constraint: QueryStatement
  ): OAuthAuthorizationCode

  oAuthFindAuthorizationCodeById(id: ID, constraint: QueryStatement): OAuthAuthorizationCode

  oAuthGetAuthorizationCodes(
    query: QueryStatement
    constraint: QueryStatement
  ): [OAuthAuthorizationCode]!

  oAuthPaginateAuthorizationCodes(query: QueryStatement, constraint: QueryStatement): Pagination!
}

type Mutation {
  oAuthCreateAuthorizationCode(payload: OAuthCreateAuthorizationCodeInput!): OAuthAuthorizationCode

  oAuthUpdateAuthorizationCodeById(
    payload: OAuthUpdateAuthorizationCodeByIdInput!
    constraint: QueryStatement
  ): OAuthAuthorizationCode

  oAuthDeleteAuthorizationCodeById(id: ID!, constraint: QueryStatement): OAuthAuthorizationCode

  oAuthDeleteAuthorizationCodes(
    query: QueryStatement
    constraint: QueryStatement
  ): [OAuthAuthorizationCode]!
}
