# @aurora-catalyst-generated
# @source cliter/iam/role.aurora.yaml

type IamRole {
  """
  Unique identifier for the role. UUID v4 format, generated automatically on creation. Used as primary key for referencing this role across the system.
  """
  id: ID!
  """
  Auto-incrementing sequential identifier for the role. Used for internal ordering and optimized queries. Unlike the UUID 'id', this provides a human-readable sequential number for database operations.
  """
  rowId: GraphQLInt!
  """
  Human-readable name for the role (e.g., "Administrator", "Content Editor"). Must be unique across all roles. Used in UI displays and audit logs. Should clearly indicate the role's purpose and permissions scope. Cannot be empty and must be meaningful for access control documentation.
  """
  name: GraphQLString!
  """
  Optional unique identifier code for the role, typically used for short references, URL slugs, or integration identifiers. Must be unique across all roles when provided. Common formats: uppercase acronyms (e.g., "ADMIN"), lowercase slugs (e.g., "content-editor"), or external system IDs. NULL indicates no code assigned. Useful for API integrations, subdomain generation, or customer-facing role identification without exposing UUIDs. Maximum 64 characters for flexibility with various coding schemes.
  """
  code: GraphQLString
  """
  Default landing page URL after successful authentication. Users with this role will be redirected to this path after login. Must be a valid relative or absolute URL (max 2046 characters per RFC 3986 recommendations). NULL indicates system default redirection will be used. Used to create role-specific workflows and user experiences. Example values: /dashboard, /reports/overview, https://external-app.com/portal.
  """
  defaultRedirection: GraphQLString
  """
  Controls visibility of the vertical navigation menu in the UI for users with this role. When true, the left sidebar navigation is hidden, creating a simplified interface. Useful for restricted roles that should only access specific pages via direct links or custom dashboards (e.g., kiosk mode, limited-access users). Defaults to false (navigation visible). NULL treated as false.
  """
  hasHiddenVerticalNavigation: GraphQLBoolean
  """
  Indicates if the role is created by default and cannot be deleted. Master roles are system-defined, typically created during application bootstrap (e.g., "SuperAdmin", "SystemAdmin"). They are protected from deletion to ensure system integrity and prevent lockout scenarios. Custom roles have isMaster=false and can be deleted if not in use. Required field, defaults to false.
  """
  isMaster: GraphQLBoolean!
  """
  Many-to-many relationship defining the permissions granted to this role. Each role can have zero or more permissions representing specific capabilities (e.g., "Iam.CreateUser", "Sales.ViewReports"). Users assigned this role inherit all associated permissions for authorization checks. Managed through the iam_permissions_roles pivot table. Changes to role permissions automatically trigger updates to denormalized permission data in all associated accounts. NULL or empty indicates a role with no permissions (no access granted).
  """
  permissions: [IamPermission]
  """
  Many-to-many relationship with accounts that have been assigned this role. An account can have multiple roles, and a role can be assigned to multiple accounts. This enables flexible RBAC where users inherit permissions from all their assigned roles. Managed through the iam_roles_accounts pivot table. When this relationship changes, the affected accounts' denormalized permission structures (denormalizedPermissions, denormalizedApplicationCodes) are automatically recalculated for fast authorization. NULL or empty indicates a role not yet assigned to any accounts.
  """
  accounts: [IamAccount]
  """
  Timestamp when the role was created. Automatically set on record creation. Part of the audit trail for tracking role lifecycle and compliance requirements. Used for reporting on role creation patterns and security audits.
  """
  createdAt: GraphQLTimestamp
  """
  Timestamp of the last modification to this role. Automatically updated on any field change. Used for tracking role evolution, cache invalidation, and audit compliance. Particularly important for security audits to track when role permissions or settings were modified. Critical for compliance with access control change tracking requirements.
  """
  updatedAt: GraphQLTimestamp
  """
  Soft delete timestamp. NULL indicates an active role. When set, the role is hidden from normal queries but preserved for audit purposes and historical data integrity. Deleted roles cannot be assigned to new accounts, but existing assignments remain in the database for audit trails. Master roles (isMaster=true) are protected and cannot be deleted. Used for compliance with data retention policies while maintaining referential integrity.
  """
  deletedAt: GraphQLTimestamp
}

input IamCreateRoleInput {
  id: ID!
  name: GraphQLString!
  code: GraphQLString
  defaultRedirection: GraphQLString
  hasHiddenVerticalNavigation: GraphQLBoolean
  isMaster: GraphQLBoolean!
  permissionIds: [ID]
  accountIds: [ID]
}

input IamUpdateRoleByIdInput {
  id: ID!
  name: GraphQLString
  code: GraphQLString
  defaultRedirection: GraphQLString
  hasHiddenVerticalNavigation: GraphQLBoolean
  isMaster: GraphQLBoolean
  permissionIds: [ID]
  accountIds: [ID]
}

input IamUpdateRolesInput {
  id: ID
  name: GraphQLString
  code: GraphQLString
  defaultRedirection: GraphQLString
  hasHiddenVerticalNavigation: GraphQLBoolean
  isMaster: GraphQLBoolean
  permissionIds: [ID]
  accountIds: [ID]
}
type Query {
  iamFindRole(query: QueryStatement, constraint: QueryStatement): IamRole

  iamFindRoleById(id: ID, constraint: QueryStatement): IamRole

  iamGetRoles(query: QueryStatement, constraint: QueryStatement): [IamRole]!

  iamPaginateRoles(query: QueryStatement, constraint: QueryStatement): Pagination!
}

type Mutation {
  iamCreateRole(payload: IamCreateRoleInput!): IamRole

  iamCreateRoles(payload: [IamCreateRoleInput]!): Boolean!

  iamUpdateRoleById(payload: IamUpdateRoleByIdInput!, constraint: QueryStatement): IamRole

  iamUpdateRoles(
    payload: IamUpdateRolesInput!
    query: QueryStatement
    constraint: QueryStatement
  ): [IamRole]!

  iamDeleteRoleById(id: ID!, constraint: QueryStatement): IamRole

  iamDeleteRoles(query: QueryStatement, constraint: QueryStatement): [IamRole]!

  # additionalApis
  iamInheritPermissionsRoleRole(
    payload: IamUpdateRoleByIdInput!
    constraint: QueryStatement
  ): Boolean!
}
