/**
 * @aurora-catalyst-generated
 * @source cliter/iam/role.aurora.yaml
 */
import { ApiProperty } from '@nestjs/swagger';

export class IamUpdateRoleByIdDto {
  @ApiProperty({
    type: String,
    description:
      'Unique identifier for the role. UUID v4 format, generated automatically on creation. Used as primary key for referencing this role across the system.',
  })
  id: string;

  @ApiProperty({
    type: String,
    description:
      'Human-readable name for the role (e.g., "Administrator", "Content Editor"). Must be unique across all roles. Used in UI displays and audit logs. Should clearly indicate the role\'s purpose and permissions scope. Cannot be empty and must be meaningful for access control documentation.',
  })
  name?: string;

  @ApiProperty({
    type: String,
    description:
      'Optional unique identifier code for the role, typically used for short references, URL slugs, or integration identifiers. Must be unique across all roles when provided. Common formats: uppercase acronyms (e.g., "ADMIN"), lowercase slugs (e.g., "content-editor"), or external system IDs. NULL indicates no code assigned. Useful for API integrations, subdomain generation, or customer-facing role identification without exposing UUIDs. Maximum 64 characters for flexibility with various coding schemes.',
  })
  code?: string;

  @ApiProperty({
    type: String,
    description:
      'Default landing page URL after successful authentication. Users with this role will be redirected to this path after login. Must be a valid relative or absolute URL (max 2046 characters per RFC 3986 recommendations). NULL indicates system default redirection will be used. Used to create role-specific workflows and user experiences. Example values: /dashboard, /reports/overview, https://external-app.com/portal.',
  })
  defaultRedirection?: string;

  @ApiProperty({
    type: Boolean,
    description:
      'Controls visibility of the vertical navigation menu in the UI for users with this role. When true, the left sidebar navigation is hidden, creating a simplified interface. Useful for restricted roles that should only access specific pages via direct links or custom dashboards (e.g., kiosk mode, limited-access users). Defaults to false (navigation visible). NULL treated as false.',
    example: true,
  })
  hasHiddenVerticalNavigation?: boolean;

  @ApiProperty({
    type: Boolean,
    description:
      'Indicates if the role is created by default and cannot be deleted. Master roles are system-defined, typically created during application bootstrap (e.g., "SuperAdmin", "SystemAdmin"). They are protected from deletion to ensure system integrity and prevent lockout scenarios. Custom roles have isMaster=false and can be deleted if not in use. Required field, defaults to false.',
  })
  isMaster?: boolean;

  @ApiProperty({
    type: [String],
    description:
      'Many-to-many relationship defining the permissions granted to this role. Each role can have zero or more permissions representing specific capabilities (e.g., "Iam.CreateUser", "Sales.ViewReports"). Users assigned this role inherit all associated permissions for authorization checks. Managed through the iam_permissions_roles pivot table. Changes to role permissions automatically trigger updates to denormalized permission data in all associated accounts. NULL or empty indicates a role with no permissions (no access granted).',
  })
  permissionIds?: string[];

  @ApiProperty({
    type: [String],
    description:
      "Many-to-many relationship with accounts that have been assigned this role. An account can have multiple roles, and a role can be assigned to multiple accounts. This enables flexible RBAC where users inherit permissions from all their assigned roles. Managed through the iam_roles_accounts pivot table. When this relationship changes, the affected accounts' denormalized permission structures (denormalizedPermissions, denormalizedApplicationCodes) are automatically recalculated for fast authorization. NULL or empty indicates a role not yet assigned to any accounts.",
  })
  accountIds?: string[];
}
