# Hand-maintained — GraphQL surface for the OAuth2 protocol flows that live in
# `@api/o-auth/flows/` (alongside the REST controller `OAuthCreateTokenController`).
#
# This file declares the GraphQL twin of `POST /api/o-auth/token`. Same business flow,
# delegated to the same application handlers (`OAuthCreateTokenPasswordService`,
# `OAuthCreateTokenRefreshService`, `OAuthCreateTokenAuthorizationCodeService`).
# Supported grant types: PASSWORD, REFRESH_TOKEN, AUTHORIZATION_CODE (RFC 6749 §4.1.3 + RFC 7636).
# External integrations should prefer the REST endpoint
# with HTTP Basic auth as per RFC 6749 §2.3.1. The Aurora frontend uses this mutation
# (server-side known client; SPAs cannot safely hold client secrets).
#
# The `OAuthCredentialGrantTypeEnum` referenced below is declared in
# `o-auth-credential.graphql` and is reused here to avoid duplication.

input OAuthCreateTokenInput {
  """
  Grant type. PASSWORD requires `username` + `password`. REFRESH_TOKEN requires `refreshToken`.
  AUTHORIZATION_CODE requires `code`, `redirectUri`, `codeVerifier` (RFC 6749 §4.1.3 + RFC 7636).
  """
  grantType: OAuthCredentialGrantTypeEnum!
  """
  Username for PASSWORD grant. Required when grantType is PASSWORD.
  """
  username: String
  """
  Password for PASSWORD grant. Required when grantType is PASSWORD.
  """
  password: String
  """
  Refresh token for REFRESH_TOKEN grant. Required when grantType is REFRESH_TOKEN.
  """
  refreshToken: String
  """
  Authorization code for AUTHORIZATION_CODE grant (RFC 6749 §4.1.3). Required when grantType is AUTHORIZATION_CODE.
  """
  code: String
  """
  Redirect URI for AUTHORIZATION_CODE grant. Must exactly match the URI bound at /authorize time.
  """
  redirectUri: String
  """
  PKCE code verifier (RFC 7636). Required when grantType is AUTHORIZATION_CODE.
  """
  codeVerifier: String
}

"""
RFC 6749 §5.1 Successful Response payload, camelCase for GraphQL convention.
"""
type OAuthTokens {
  accessToken: String!
  refreshToken: String!
  tokenType: String!
  expiresIn: Int!
}

"""
RFC 7009 token revocation input. `token` is the credential to revoke (the refresh token for
this provider). `tokenTypeHint` is accepted but optional. Client credentials travel in the
HTTP Basic `Authorization` header (RFC 7009 §2.1), not in this payload.
"""
input OAuthRevokeTokenInput {
  token: String!
  tokenTypeHint: String
}

type Mutation {
  """
  GraphQL twin of `POST /api/o-auth/token`. Delegates to the same Phase 2 handlers
  (`OAuthCreateTokenPasswordService`, `OAuthCreateTokenRefreshService`,
  `OAuthCreateTokenAuthorizationCodeService`). Supports PASSWORD, REFRESH_TOKEN, and
  AUTHORIZATION_CODE grant types. External clients should prefer the REST endpoint with
  HTTP Basic auth.
  """
  oAuthCreateToken(payload: OAuthCreateTokenInput!): OAuthTokens!
  """
  GraphQL twin of `POST /api/o-auth/revoke` (RFC 7009 token revocation). Delegates to
  `OAuthRevokeTokenHandler`. Always returns `true` (idempotent, non-enumerable per RFC 7009
  §2.2); raises `invalid_client` for an unauthenticated client and `invalid_request` for a
  missing token. External clients should prefer the REST endpoint with HTTP Basic auth.
  """
  oAuthRevokeToken(payload: OAuthRevokeTokenInput!): Boolean!
}
