# ===============================================
# AUTHENTICATION
# ===============================================

extend type Query {
  authentication: AuthenticationQuery
}

extend type Mutation {
  authentication: AuthenticationMutation
}

# -----------------------------------------------
# QUERIES
# -----------------------------------------------

type AuthenticationQuery {
  strategies(
    isEnabled: Boolean
  ): [AuthenticationStrategy]
}

# -----------------------------------------------
# MUTATIONS
# -----------------------------------------------

type AuthenticationMutation {
  login(
    username: String!
    password: String!
    strategy: String!
  ): AuthenticationLoginResponse @rateLimit(limit: 5, duration: 60)

  loginTFA(
    continuationToken: String!
    securityCode: String!
  ): AuthenticationLoginResponse @rateLimit(limit: 5, duration: 60)

  loginChangePassword(
    continuationToken: String!
    newPassword: String!
  ): AuthenticationLoginResponse @rateLimit(limit: 5, duration: 60)

  register(
    email: String!
    password: String!
    name: String!
  ): AuthenticationRegisterResponse

  updateStrategies(
    strategies: [AuthenticationStrategyInput]!
    config: AuthenticationConfigInput
  ): DefaultResponse @auth(requires: ["manage:system"])

  regenerateCertificates: DefaultResponse @auth(requires: ["manage:system"])
  resetGuestUser: DefaultResponse @auth(requires: ["manage:system"])
}

# -----------------------------------------------
# TYPES
# -----------------------------------------------

type AuthenticationStrategy {
  isEnabled: Boolean!
  key: String!
  props: [String]
  title: String!
  description: String
  isAvailable: Boolean
  useForm: Boolean!
  logo: String
  color: String
  website: String
  icon: String
  config: [KeyValuePair] @auth(requires: ["manage:system"])
  selfRegistration: Boolean!
  domainWhitelist: [String]! @auth(requires: ["manage:system"])
  autoEnrollGroups: [Int]! @auth(requires: ["manage:system"])
}

type AuthenticationLoginResponse {
  responseResult: ResponseStatus
  jwt: String
  mustChangePwd: Boolean
  mustProvideTFA: Boolean
  continuationToken: String
}

type AuthenticationRegisterResponse {
  responseResult: ResponseStatus
  jwt: String
}

input AuthenticationStrategyInput {
  isEnabled: Boolean!
  key: String!
  config: [KeyValuePairInput]
  selfRegistration: Boolean!
  domainWhitelist: [String]!
  autoEnrollGroups: [Int]!
}

input AuthenticationConfigInput {
  audience: String!
  tokenExpiration: String!
  tokenRenewal: String!
}