# @aurora-catalyst-generated
# @source cliter/o-auth/access-token.aurora.yaml

type OAuthAccessToken {
  """
  Unique identifier for the access token. UUID v4 format, generated automatically on creation.
  """
  id: ID!
  """
  Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID.
  """
  rowId: GraphQLInt!
  """
  ID of the OAuth client that owns this access token. Links the token to the application and grant type used for authorization.
  """
  clientId: ID!
  client: OAuthClient
  """
  ID of the account (user) associated with this token. NULL for client_credentials grants that don't represent a specific user. Used to link tokens to user identity.
  """
  accountId: ID
  """
  The access token string. JWT or opaque token value. SECURITY: Transmitted in Authorization headers for API authentication. Should be short-lived to minimize security risk.
  """
  token: GraphQLString!
  """
  Optional descriptive name for the access token. Useful for personal access tokens or long-lived tokens to identify their purpose (e.g., "Mobile App", "CI/CD Pipeline").
  """
  name: GraphQLString
  """
  Indicates whether the access token has been revoked. Revoked tokens are rejected for API authentication. Set to true on logout, security events, or manual revocation.
  """
  isRevoked: GraphQLBoolean!
  """
  Expiration timestamp for the access token. After this time, the token is invalid for API requests. Typically set to minutes or hours from creation for security.
  """
  expiresAt: GraphQLTimestamp
  """
  One-to-one relationship with a refresh token. When present, the refresh token can be used to obtain a new access token after this one expires.
  """
  refreshToken: OAuthRefreshToken
  """
  Timestamp when the access token was created. Automatically set on creation.
  """
  createdAt: GraphQLTimestamp
  """
  Timestamp when the access token was last updated. Automatically updated on modification.
  """
  updatedAt: GraphQLTimestamp
  """
  Soft delete timestamp. NULL means active token. When set, token is excluded from normal queries but preserved for audit trail.
  """
  deletedAt: GraphQLTimestamp
}

input OAuthCreateAccessTokenInput {
  id: ID!
  clientId: ID!
  accountId: ID
  token: GraphQLString!
  name: GraphQLString
  isRevoked: GraphQLBoolean!
  expiresAt: GraphQLTimestamp
  refreshToken: OAuthCreateRefreshTokenInput
}

input OAuthUpdateAccessTokenByIdInput {
  id: ID!
  clientId: ID
  accountId: ID
  token: GraphQLString
  name: GraphQLString
  isRevoked: GraphQLBoolean
  expiresAt: GraphQLTimestamp
  refreshToken: OAuthUpdateRefreshTokenByIdInput
}

input OAuthUpdateAccessTokensInput {
  id: ID
  clientId: ID
  accountId: ID
  token: GraphQLString
  name: GraphQLString
  isRevoked: GraphQLBoolean
  expiresAt: GraphQLTimestamp
  refreshToken: OAuthUpdateRefreshTokensInput
}
type Query {
  oAuthFindAccessToken(query: QueryStatement, constraint: QueryStatement): OAuthAccessToken

  oAuthFindAccessTokenById(id: ID, constraint: QueryStatement): OAuthAccessToken

  oAuthGetAccessTokens(query: QueryStatement, constraint: QueryStatement): [OAuthAccessToken]!

  oAuthPaginateAccessTokens(query: QueryStatement, constraint: QueryStatement): Pagination!
}

type Mutation {
  oAuthDeleteAccessTokenById(id: ID!, constraint: QueryStatement): OAuthAccessToken
}
