ecoportal-api-graphql 1.3.16 → 2.2.0

data/lib/ecoportal/api/graphql/fragment/activity_log.rb

@@ -0,0 +1,75 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        # System Access Log entry — `currentOrganization.activityLogs` returns an
+        # `ActivityLogUnion` (a UNION), so fields cannot be selected on the union
+        # directly (only `__typename`): every field must live in an inline fragment
+        # per member. The 9 members share a common field set; the Dashboard* members
+        # additionally expose `parentResource*` + `resource { isVisible }`.
+        #
+        # To avoid repeating the shared selection 9 times we spread two helper
+        # fragments (:ActivityLogCommon on each member, :ActivityLogResource for the
+        # Dashboard members). Model::ActivityLog maps every member uniformly via its
+        # `__typename` passthrough, so an unmodelled/new member still resolves.
+        fragment :ActivityLog, <<~GRAPHQL
+          fragment ActivityLog on ActivityLogUnion {
+            __typename
+            ... on DashboardAccess { ...ActivityLogCommon ...ActivityLogResource }
+            ... on DashboardCreate { ...ActivityLogCommon ...ActivityLogResource }
+            ... on DashboardDelete { ...ActivityLogCommon ...ActivityLogResource }
+            ... on DashboardUpdate { ...ActivityLogCommon ...ActivityLogResource }
+            ... on DeniedDashboardAccess { ...ActivityLogCommon ...ActivityLogResource }
+            ... on DeniedPageAccess { ...ActivityLogCommon }
+            ... on PageAccess { ...ActivityLogCommon }
+            ... on FileDownload { ...ActivityLogCommon }
+            ... on ScimIntegrationAccess { ...ActivityLogCommon }
+          }
+        GRAPHQL
+
+        # Fields common to ALL ActivityLogUnion members. Spread inside each member's
+        # inline fragment. `__fragment_type` is intentionally omitted; the union-level
+        # `__typename` is selected in :ActivityLog above.
+        fragment :ActivityLogCommon, <<~GRAPHQL
+          fragment ActivityLogCommon on BaseActivityLogInterface {
+            id
+            activityType
+            source
+            userType
+            accountStatus
+            becomingEmail
+            content
+            resourceId
+            resourceName
+            resourceType
+            createdAt {
+              dateTime
+              timeZone
+            }
+            user {
+              id
+              email
+              name
+            }
+          }
+        GRAPHQL
+
+        # Dashboard-member-only fields (parent + visibility of the dashboard resource).
+        fragment :ActivityLogResource, <<~GRAPHQL
+          fragment ActivityLogResource on BaseDashboardActivityLogInterface {
+            parentResourceId
+            parentResourceName
+            parentResourceType
+            resource {
+              __typename
+              isVisible {
+                value
+                message
+              }
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/auth_log.rb

@@ -0,0 +1,29 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :AuthLog, <<~GRAPHQL
+          fragment AuthLog on AuthLog {
+            id
+            event
+            source
+            loginMethod
+            host
+            ipAddress
+            referrer
+            userAgent
+            createdAt {
+              dateTime
+              timeZone
+            }
+            targetUser {
+              id
+              email
+              name
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/authorization_result.rb

@@ -0,0 +1,14 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :AuthorizationResult, <<~GRAPHQL
+          fragment AuthorizationResult on AuthorizationResult {
+            value
+            message
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/contractor_entity.rb

@@ -1,20 +1,20 @@
-module Ecoportal
-  module API
-    class GraphQL
-      class Fragment
-        fragment :ContractorEntity, <<~GRAPHQL
-          fragment ContractorEntity on ContractorEntity {
-            id
-            externalId
-            name
-            schemaId
-            active
-            approved
-            associatedPeopleIds
-            leadContractorIds
-          }
-        GRAPHQL
-      end
-    end
-  end
-end
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :ContractorEntity, <<~GRAPHQL
+          fragment ContractorEntity on ContractorEntity {
+            id
+            externalId
+            name
+            schemaId
+            active
+            approved
+            associatedPeopleIds
+            leadContractorIds
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/location_node.rb

@@ -17,6 +17,7 @@ module Ecoportal
               active
               id
               name
+              aiGenerated
             }
           }
         GRAPHQL

data/lib/ecoportal/api/graphql/fragment/locations_error.rb

@@ -1,19 +1,19 @@
-module Ecoportal
-  module API
-    class GraphQL
-      class Fragment
-        fragment :LocationsError, <<~GRAPHQL
-          fragment LocationsError on LocationsError {
-            message
-            conflictingIds
-            validationErrors {
-              property
-              error
-              message
-            }
-          }
-        GRAPHQL
-      end
-    end
-  end
-end
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :LocationsError, <<~GRAPHQL
+          fragment LocationsError on LocationsError {
+            message
+            conflictingIds
+            validationErrors {
+              property
+              error
+              message
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/minimal_dashboard.rb

@@ -0,0 +1,31 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :MinimalDashboard, <<~GRAPHQL
+          fragment MinimalDashboard on MinimalDashboard {
+            id
+            name
+            global
+            weight
+            parentResource
+            parentResourceId
+            parentResourceType
+            permissionType
+            owner {
+              id
+              email
+              name
+            }
+            register {
+              id
+              name
+              iconName
+              filterTags
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/page.rb

@@ -18,6 +18,7 @@ module Ecoportal
             draft
             externalId
             timeZone
+            baseTags
             otherTags
             taskPriority
             sourceTemplateId

data/lib/ecoportal/api/graphql/fragment/pages/common_page_union.rb

@@ -61,6 +61,7 @@ module Ecoportal
             fragment stageAttrs on Stage {
               id @skip(if: $only_content)
               name
+              tags
               ...sectionsFragment
               active
               started
@@ -85,6 +86,7 @@ module Ecoportal
               name
               uid
               locations { ...locationNode }
+              baseTags  @include(if: $content)
               otherTags @include(if: $content)
               timeZone
               updatedAt { dateTime        }
@@ -92,6 +94,16 @@ module Ecoportal
               creator   { name email      }
               state
               archived
+              # Cross-version template identity. `template` is non-null only on template pages
+              # (`BasePageInterface.template: Template`), so this stays nil for records.
+              # `templateContainerUid` is the SERIES key: many versions may carry the same uid,
+              # but only one may be published (`active: true`) per organization at a time —
+              # publishing another with the same uid unpublishes the incumbent. See
+              # `.ai-assistance/code/ecoPortal_architecture/02_data_model.md`.
+              template @skip(if: $only_content) {
+                templateContainerUid
+                active
+              }
             }
 
             fragment sectionsFragment on Stage {
@@ -119,6 +131,16 @@ module Ecoportal
               __typename
               id                @skip(if: $only_content)
               label
+              # Field-configuration `description` (the hidden per-field note). Read-only from
+              # here — the ONLY writer is the `editFieldConfiguration` workflow command
+              # (`WorkflowEditFieldConfigurationInput.description`); `DataFieldInput` and its
+              # per-type members carry no description, so `updatePage` cannot set it.
+              #
+              # Integrations use it as a pseudo external-id on fields (we do so on templates;
+              # M&S do so on page instances — confirmed working on instances with a
+              # non-superuser service account, 2026-07-31). Fetched by default so those
+              # integrations can read it back.
+              description       @skip(if: $only_content)
               genomeSignature   @skip(if: $only_content)
               deindex           @include(if: $content)
               linkedFieldConfig @skip(if: $only_content) {
@@ -232,6 +254,7 @@ module Ecoportal
             fragment fileField on File {
               required @skip(if: $only_content)
               items    @include(if: $content) {
+                id
                 fileContainer { ...fileContainerAttrs }
               }
             }

data/lib/ecoportal/api/graphql/fragment/pages.rb

@@ -1,15 +1,15 @@
-module Ecoportal
-  module API
-    class GraphQL
-      class Fragment
-        class Pages
-          include Ecoportal::API::GraphQL::Concerns::FragmentDefinitions
-        end
-
-        register_namespace Pages
-      end
-    end
-  end
-end
-
-require_relative 'pages/common_page_union'
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        class Pages
+          include Ecoportal::API::GraphQL::Concerns::FragmentDefinitions
+        end
+
+        register_namespace Pages
+      end
+    end
+  end
+end
+
+require_relative 'pages/common_page_union'

data/lib/ecoportal/api/graphql/fragment/pagination.rb

@@ -1,17 +1,17 @@
-module Ecoportal
-  module API
-    class GraphQL
-      class Fragment
-        fragment :Pagination, <<~GRAPHQL
-          fragment Pagination on ActionConnection {
-            totalCount
-            pageInfo {
-              endCursor
-              hasNextPage
-            }
-          }
-        GRAPHQL
-      end
-    end
-  end
-end
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :Pagination, <<~GRAPHQL
+          fragment Pagination on ActionConnection {
+            totalCount
+            pageInfo {
+              endCursor
+              hasNextPage
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/permissions.rb

@@ -0,0 +1,98 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        # Selects every canXXX permission on the Permissions type, spreading :AuthorizationResult
+        # ({ value message }) for each. Requires the :AuthorizationResult fragment to be assembled
+        # alongside (Fragment.assemble(:Permissions, :AuthorizationResult)).
+        fragment :Permissions, <<~GRAPHQL
+          fragment Permissions on Permissions {
+            actionCanCreateStandalone { ...AuthorizationResult }
+            actionCanIndex { ...AuthorizationResult }
+            alertNotificationCanAccessBroadcastNotifications { ...AuthorizationResult }
+            alertNotificationCanCreate { ...AuthorizationResult }
+            alertNotificationCanIndex { ...AuthorizationResult }
+            canAccessAdminTools { ...AuthorizationResult }
+            canAccessPeopleManager { ...AuthorizationResult }
+            canDeleteActionCategories { ...AuthorizationResult }
+            canIndex { ...AuthorizationResult }
+            canListAttachablePersonMembers { ...AuthorizationResult }
+            canManageActionCategories { ...AuthorizationResult }
+            canManageStandaloneActionsPermissions { ...AuthorizationResult }
+            canResetActionsCounter { ...AuthorizationResult }
+            canUpload { ...AuthorizationResult }
+            contractorEntityCanAccessContractorManager { ...AuthorizationResult }
+            contractorEntityCanAttach { ...AuthorizationResult }
+            contractorEntityCanCreate { ...AuthorizationResult }
+            contractorEntityCanDestroy { ...AuthorizationResult }
+            contractorEntityCanEdit { ...AuthorizationResult }
+            contractorEntityCanEditLinkedUsers { ...AuthorizationResult }
+            contractorEntityCanIndex { ...AuthorizationResult }
+            contractorEntityCanManageParentContractors { ...AuthorizationResult }
+            contractorEntityCanManageSubcontractors { ...AuthorizationResult }
+            crossReferenceReportsCanIndex { ...AuthorizationResult }
+            dashboardCanManage { ...AuthorizationResult }
+            dataSetsCanIndex { ...AuthorizationResult }
+            dataSpaceCanShow { ...AuthorizationResult }
+            dataViewsCanIndex { ...AuthorizationResult }
+            emailReportCanConfigureSmartReport { ...AuthorizationResult }
+            filesCanIndex { ...AuthorizationResult }
+            filesCanUpload { ...AuthorizationResult }
+            generatedPageFilterCanCreate { ...AuthorizationResult }
+            generatedPageFilterCanUseSmartQuery { ...AuthorizationResult }
+            hasFileAbilityToDownload { ...AuthorizationResult }
+            locationClassificationsCanCreate { ...AuthorizationResult }
+            locationClassificationsCanUpdate { ...AuthorizationResult }
+            locationStructuresCanAccess { ...AuthorizationResult }
+            locationStructuresCanAdministrate { ...AuthorizationResult }
+            locationStructuresCanAiGenerateStructure { ...AuthorizationResult }
+            locationStructuresCanCreate { ...AuthorizationResult }
+            locationStructuresCanManage { ...AuthorizationResult }
+            locationStructuresCanManageSftpIntegration { ...AuthorizationResult }
+            locationStructuresCanPublish { ...AuthorizationResult }
+            locationStructuresCanRead { ...AuthorizationResult }
+            locationStructuresCanScheduleUpdate { ...AuthorizationResult }
+            locationStructuresCanUpdate { ...AuthorizationResult }
+            organizationCanViewSettings { ...AuthorizationResult }
+            pageAiSummaryCanAccess { ...AuthorizationResult }
+            pageCanListDrafts { ...AuthorizationResult }
+            pageCanRestore { ...AuthorizationResult }
+            pageCanUseDrafts { ...AuthorizationResult }
+            pageSmartAssistantCanChat { ...AuthorizationResult }
+            personSchemaCanAccessManager { ...AuthorizationResult }
+            publicTemplatesCanCopyLink { ...AuthorizationResult }
+            publicTemplatesCanIndex { ...AuthorizationResult }
+            publicTemplatesCanListEntries { ...AuthorizationResult }
+            publicTemplatesCanManage { ...AuthorizationResult }
+            registerAssistantCanChat { ...AuthorizationResult }
+            registerCanAccessRegisterTools { ...AuthorizationResult }
+            registerCanCreate { ...AuthorizationResult }
+            registerCanLimitTemplates { ...AuthorizationResult }
+            scimIntegrationCanAddCodeHooks { ...AuthorizationResult }
+            scimIntegrationCanCreate { ...AuthorizationResult }
+            scimIntegrationCanDestroy { ...AuthorizationResult }
+            scimIntegrationCanGenerateApiKey { ...AuthorizationResult }
+            scimIntegrationCanIndex { ...AuthorizationResult }
+            scimIntegrationCanShow { ...AuthorizationResult }
+            scimIntegrationCanShowLogs { ...AuthorizationResult }
+            scimIntegrationCanUpdate { ...AuthorizationResult }
+            spatialCanUpdateLocationNodeGeojson { ...AuthorizationResult }
+            structuresCanIndex { ...AuthorizationResult }
+            templateCanRestore { ...AuthorizationResult }
+            userAccessLogsCanShow { ...AuthorizationResult }
+            userCanAccessAdminArea { ...AuthorizationResult }
+            userCanAccessPageCreationTools { ...AuthorizationResult }
+            visitorLogCanAdminCheckIn { ...AuthorizationResult }
+            visitorLogCanEdit { ...AuthorizationResult }
+            visitorLogCanManage { ...AuthorizationResult }
+            visitorLogCanShow { ...AuthorizationResult }
+            visitorManagementCanAccessVisitorManager { ...AuthorizationResult }
+            visitorManagementCanIndex { ...AuthorizationResult }
+            webhooksCanManageSubscriptions { ...AuthorizationResult }
+            webhooksCanViewSubscriptions { ...AuthorizationResult }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/person_member_changelog.rb

@@ -0,0 +1,33 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        fragment :PersonMemberChangelog, <<~GRAPHQL
+          fragment PersonMemberChangelog on PersonMemberChangelog {
+            id
+            operation
+            accountOperation
+            personMemberId
+            apiKeyPrefix
+            changedByApi
+            humanReadableDifferences
+            createdAt {
+              dateTime
+              timeZone
+            }
+            personMember {
+              id
+              name
+              email
+            }
+            user {
+              id
+              email
+              name
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment/template_change_log.rb

@@ -0,0 +1,102 @@
+module Ecoportal
+  module API
+    class GraphQL
+      class Fragment
+        # Node selection for a TEMPLATE change-log entry — `template { commands { nodes } }`.
+        #
+        # The type condition is the INTERFACE `PagesWorkflowCommandInterface`
+        # (`app/graphql/types/pages/interfaces/workflow_command_interface.rb`, graphql_name set
+        # explicitly there). Spreading a fragment on an interface at an interface-typed location
+        # is legal; selecting a CONCRETE type's field (e.g. `changes`, `changeMessages`) is not,
+        # unless wrapped in an inline fragment. Everything below is therefore an interface field,
+        # plus `__typename` so callers can branch on the concrete command class.
+        #
+        # Deliberately NOT selected, and why:
+        # - `stage: StageType` and `task: TaskInterface` — object subtrees; `stageId`/`stageName`
+        #   and `taskId`/`taskType` already answer "which stage / which task" as scalars, and
+        #   both resolvers do an extra RecordLoader/EmbeddedObjectLoader round trip. Select them
+        #   explicitly with a custom connection block if you need the full objects.
+        # - the concrete-type extras (`changes { field from to }`, `changeMessages`) — see
+        #   `Fragment :PagesWorkflowCommandFields` in `fragment/pages_workflow.rb`, which already
+        #   models them for the workflow-builder side of the same interface.
+        #
+        # See `Base::Template::ChangeLogEntry` for the two access caveats (nil-when-unpermitted,
+        # TEMPLATE_BUILDER-only) and the forces watermark blind spot.
+        fragment :TemplateChangeLogEntry, <<~GRAPHQL
+          fragment TemplateChangeLogEntry on PagesWorkflowCommandInterface {
+            __typename
+            id
+            commandAction
+            patchVer
+            createdAt {
+              dateTime
+              timeZone
+            }
+            updatedAt {
+              dateTime
+              timeZone
+            }
+            ownerId
+            owner {
+              id
+              name
+              email
+            }
+            stageId
+            stageName
+            taskId
+            taskType
+            targetedResourceId
+            targetedResourceName
+            targetedResourceType
+          }
+        GRAPHQL
+
+        # DETAIL selection — the same entry PLUS what actually changed.
+        #
+        # Opt in to this only when you need it: it costs three inline fragments and their
+        # sub-selections on every node. `Query::TemplateChangeLog.detail_block` and
+        # `api.template.change_log(detail: true)` both use it; the light
+        # `:TemplateChangeLogEntry` above stays the default so "who changed this, and when"
+        # does not pay for per-type detail.
+        #
+        # ★ The three concrete types report changes DIFFERENTLY, verified against the backend
+        # (2026-08-20) — this is why one flat shape cannot describe them:
+        # - `PagesWorkflowCommandChange.changes: [ChangeType!]!` — `ChangeType` is
+        #   `{ field: String!, from: String, to: String }` (`app/graphql/types/change_type.rb`),
+        #   i.e. before/after as STRINGS. This is the common case.
+        # - `PagesWorkflowCommandChangeMessage.changeMessages` — pre-rendered human strings, no
+        #   field/from/to at all.
+        # - `PagesWorkflowCommandEsChange.changes: [StoredEsFilterChangeType!]!` where `from`/`to`
+        #   are `StoredEsFilterType` OBJECTS, not strings
+        #   (`app/graphql/types/stored_es_filter_change_type.rb`). Only `field` is selected here,
+        #   deliberately: naming which filter changed is useful, and `StoredEsFilterType`'s own
+        #   shape has not been verified, so selecting into it would be a guess. An ES-change entry
+        #   therefore tells you WHICH filter moved, not its before/after.
+        #   (Reached via `WorkflowCallbacks::EditTrigger` — see the interface's `resolve_type`.)
+        #
+        # So branch on `__typename` (or ask `entry.detail_kind`) before reading `changes`.
+        fragment :TemplateChangeLogEntryDetail, <<~GRAPHQL
+          fragment TemplateChangeLogEntryDetail on PagesWorkflowCommandInterface {
+            ...TemplateChangeLogEntry
+            ... on PagesWorkflowCommandChange {
+              changes {
+                field
+                from
+                to
+              }
+            }
+            ... on PagesWorkflowCommandChangeMessage {
+              changeMessages
+            }
+            ... on PagesWorkflowCommandEsChange {
+              changes {
+                field
+              }
+            }
+          }
+        GRAPHQL
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/fragment.rb

@@ -35,6 +35,14 @@ require_relative 'fragment/page'
 require_relative 'fragment/pages'
 require_relative 'fragment/force'
 require_relative 'fragment/pages_workflow'
+require_relative 'fragment/authorization_result'
+require_relative 'fragment/permissions'
+require_relative 'fragment/activity'
+require_relative 'fragment/activity_log'
+require_relative 'fragment/auth_log'
+require_relative 'fragment/person_member_changelog'
+require_relative 'fragment/minimal_dashboard'
 require_relative 'fragment/field_configuration'
 require_relative 'fragment/page_task'
 require_relative 'fragment/template'
+require_relative 'fragment/template_change_log'