# @aurora-catalyst-generated
# @source cliter/iam/permission.aurora.yaml

type IamPermission {
  """
  Unique identifier for the permission. UUID v4 format, generated automatically on creation. Used as primary key for referencing this permission across the system.
  """
  id: ID!
  """
  Unique sequential identifier for internal database operations. Auto-incremented integer used for ordering and optimized queries. Not exposed in the API.
  """
  rowId: GraphQLInt!
  """
  Unique permission name used to evaluate authorization. Format follows convention: [BoundedContext].[Action][Resource] (e.g., 'Iam.CreateUser'). Used by the authorization system to check if a user can access specific resources or perform certain actions.
  """
  name: GraphQLString!
  """
  Foreign key reference to the bounded context this permission belongs to. Each permission is scoped to a specific bounded context, grouping all permissions related to a particular business domain. Used to organize permissions by functional areas of the application.
  """
  boundedContextId: ID!
  """
  Bounded context object relationship to permission
  """
  boundedContext: IamBoundedContext
  """
  Many-to-many relationship with roles. Represents all roles that have been granted this permission. Used to determine which roles can perform the actions covered by this permission.
  """
  roles: [IamRole]
  """
  Timestamp when the permission was created. Automatically set on record creation. Part of the audit trail for tracking permission lifecycle.
  """
  createdAt: GraphQLTimestamp
  """
  Timestamp of the last modification to this permission. Automatically updated on any change. Used for tracking permission evolution and cache invalidation.
  """
  updatedAt: GraphQLTimestamp
  """
  Soft delete timestamp. NULL indicates an active permission. When set, the permission is hidden from normal queries but preserved for audit purposes. Permissions with deletedAt set cannot be assigned to new roles.
  """
  deletedAt: GraphQLTimestamp
}

input IamCreatePermissionInput {
  id: ID!
  name: GraphQLString!
  boundedContextId: ID!
  roleIds: [ID]
}

input IamUpdatePermissionByIdInput {
  id: ID!
  name: GraphQLString
  boundedContextId: ID
  roleIds: [ID]
}

input IamUpdatePermissionsInput {
  id: ID
  name: GraphQLString
  boundedContextId: ID
  roleIds: [ID]
}
type Query {
  iamFindPermission(query: QueryStatement, constraint: QueryStatement): IamPermission

  iamFindPermissionById(id: ID, constraint: QueryStatement): IamPermission

  iamGetPermissions(query: QueryStatement, constraint: QueryStatement): [IamPermission]!

  iamPaginatePermissions(query: QueryStatement, constraint: QueryStatement): Pagination!
}

type Mutation {
  iamCreatePermission(payload: IamCreatePermissionInput!): IamPermission

  iamCreatePermissions(payload: [IamCreatePermissionInput]!): Boolean!

  iamUpdatePermissionById(
    payload: IamUpdatePermissionByIdInput!
    constraint: QueryStatement
  ): IamPermission

  iamUpdatePermissions(
    payload: IamUpdatePermissionsInput!
    query: QueryStatement
    constraint: QueryStatement
  ): [IamPermission]!

  iamDeletePermissionById(id: ID!, constraint: QueryStatement): IamPermission

  iamDeletePermissions(query: QueryStatement, constraint: QueryStatement): [IamPermission]!
}
