@cmscraft/schema 0.3.6 → 0.3.17

package/schema.gql

@@ -2,6 +2,11 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED (DO NOT MODIFY)
 # ------------------------------------------------------
 
+input AddCustomerEmailInput {
+  """The address to add or change to; it gets a 6-digit code"""
+  email: String!
+}
+
 enum AdoptionRequestStatus {
   APPROVED
   CANCELLED
@@ -223,6 +228,78 @@ type CategoryTreeNode {
   slug: String!
 }
 
+type ClientZoneAttributeDefinition {
+  description: [LocalizedText!]
+
+  """True: the Customer edits it (updateMyAttributes); false: shown only"""
+  editable: Boolean!
+
+  """
+  The one long free-text field: show the "no health, ID or bank details" warning with it
+  """
+  isNote: Boolean!
+  key: String!
+  label: [LocalizedText!]!
+  namespace: String!
+  options: CustomerAttributeOptions!
+  position: Int!
+
+  """A form prefill only, never stored as a value"""
+  prefill: JSON
+
+  """
+  A profile save (updateMyAttributes) must fill it when the Customer may write it
+  """
+  required: Boolean!
+  type: CustomerAttributeType!
+}
+
+"""
+A record type the signed-in Customer may read: how to render its values (no personal data)
+"""
+type ClientZoneRecordType {
+  audience: CustomerRecordAudience!
+  cardinality: CustomerRecordCardinality!
+  fields: [CustomerRecordField!]!
+  label: [LocalizedText!]!
+  namespace: String!
+  position: Int!
+
+  """
+  True: myRecords needs a second factor proved in the last 15 minutes (STEP_UP_REQUIRED)
+  """
+  sensitive: Boolean!
+  type: String!
+}
+
+"""
+How people sign in on this site, for rendering its sign-in page. No personal data; tier NONE when never set
+"""
+type ClientZoneSignIn {
+  """False: no e-mail sign-in links, show social sign-in only"""
+  emailSignIn: Boolean!
+  providers: [CustomerProvider!]!
+  signupMode: ClientZoneSignupMode!
+  tier: ClientZoneTier!
+}
+
+"""
+self = people create their own Customer; invite = staff invitation only
+"""
+enum ClientZoneSignupMode {
+  INVITE
+  SELF
+}
+
+"""
+What the site offers its Customers: none (no login), basic, or secure (sensitive-data D15)
+"""
+enum ClientZoneTier {
+  BASIC
+  NONE
+  SECURE
+}
+
 type Content {
   author: Author
   category: Category
@@ -369,6 +446,219 @@ type CurrencyType {
   updatedAt: DateTime
 }
 
+"""The signed-in client-zone Customer of this site (never an admin user)"""
+type Customer {
+  """
+  The Customer's attribute values they may read (customerAccess READ or READ_WRITE). Personal data: never cache it
+  """
+  attributes: [CustomerAttributeValue!]!
+  avatarUrl: String
+  createdAt: DateTime!
+  displayName: String!
+  email: String
+
+  """False until the Customer proves the address (magic link or code)"""
+  emailVerified: Boolean!
+  id: Int!
+  identities: [CustomerIdentity!]!
+  locale: String
+}
+
+"""Limits on the values; which apply depends on the type"""
+type CustomerAttributeOptions {
+  """SELECT / MULTI_SELECT: the allowed values (1..100)"""
+  choices: [String!]
+
+  """NUMBER: whole numbers only"""
+  integer: Boolean
+
+  """NUMBER: highest allowed"""
+  max: Float
+
+  """TEXT: at most this many characters (1..1000, default 1000)"""
+  maxLength: Int
+
+  """NUMBER: lowest allowed"""
+  min: Float
+
+  """
+  TEXT: a PostgreSQL regular expression the value must match; anchor it (^…$) to match the whole value. The server decides: a check in the browser (JavaScript) is a hint only, its syntax differs
+  """
+  pattern: String
+}
+
+"""More types may come: treat a type you do not know as read-only"""
+enum CustomerAttributeType {
+  BOOLEAN
+  DATE
+  JSON
+  MULTI_SELECT
+  NUMBER
+  SELECT
+  TEXT
+}
+
+type CustomerAttributeValue {
+  key: String!
+  namespace: String!
+  value: JSON!
+}
+
+input CustomerAttributeValueInput {
+  key: String!
+  namespace: String!
+
+  """null removes the value"""
+  value: JSON
+}
+
+"""
+Keep both tokens server-side (httpOnly cookies on the site domain); send the access token as Bearer
+"""
+type CustomerAuthPayload {
+  accessToken: String!
+  accessTokenExpiresAt: DateTime!
+
+  """
+  Secure tier, first sign-in only: the 10 single-use backup codes, shown this once. Null on every other sign-in
+  """
+  backupCodes: [String!]
+  customer: Customer!
+
+  """
+  Null only when a parallel refresh already rotated the token: keep the refresh token you have
+  """
+  refreshToken: String
+}
+
+"""A social login linked to the signed-in Customer"""
+type CustomerIdentity {
+  createdAt: DateTime!
+  lastUsedAt: DateTime
+  provider: CustomerProvider!
+}
+
+"""Basic tier: the session. Secure tier: the second-factor challenge"""
+union CustomerLoginStep = CustomerAuthPayload | SecondFactorChallenge
+
+enum CustomerProvider {
+  DISCORD
+  GOOGLE
+  STEAM
+  TWITCH
+}
+
+"""One of the signed-in Customer's records (or a shared one)"""
+type CustomerRecord {
+  """main for a ONE type"""
+  handle: String!
+  id: ID!
+  namespace: String!
+  position: Int!
+  type: String!
+  updatedAt: DateTime!
+
+  """
+  Keyed by field. Decimals are strings: parse them, never through a float for money
+  """
+  values: JSON!
+}
+
+enum CustomerRecordAudience {
+  CUSTOMER
+  SHARED
+}
+
+enum CustomerRecordCardinality {
+  MANY
+  ONE
+}
+
+type CustomerRecordChoice {
+  label: [LocalizedText!]!
+  value: String!
+}
+
+type CustomerRecordField {
+  description: [LocalizedText!]
+
+  """The key in a record's values (camelCase allowed); never renamed"""
+  key: String!
+  label: [LocalizedText!]!
+  options: CustomerRecordFieldOptions!
+  required: Boolean!
+
+  """What the field means to renderers and agents"""
+  role: CustomerRecordFieldRole
+  type: CustomerRecordFieldType!
+}
+
+"""Limits on the values; which apply depends on the field type"""
+type CustomerRecordFieldOptions {
+  """SELECT: the allowed values (1..100)"""
+  choices: [CustomerRecordChoice!]
+
+  """MONEY: the allowed ISO 4217 currencies (any when absent)"""
+  currencies: [String!]
+
+  """NUMBER / PERCENT: highest allowed, a decimal string"""
+  max: String
+
+  """TEXT: at most this many characters (1..1000; sensitive types 200)"""
+  maxLength: Int
+
+  """SERIES: at most this many points (1..5000, default 5000)"""
+  maxPoints: Int
+
+  """NUMBER / PERCENT: lowest allowed, a decimal string"""
+  min: String
+
+  """
+  TEXT: a PostgreSQL regular expression the value must match; anchor it (^…$). The server decides
+  """
+  pattern: String
+
+  """NUMBER: at most this many decimal places (0..6)"""
+  scale: Int
+
+  """SERIES: what the values are: MONEY:<ISO 4217>, PERCENT or NUMBER"""
+  unit: String
+}
+
+enum CustomerRecordFieldRole {
+  AMOUNT
+  AS_OF
+  HISTORY
+  LINK_KEY
+  RETURN
+  SHARE
+  TITLE
+}
+
+"""More types may come: treat a type you do not know as read-only"""
+enum CustomerRecordFieldType {
+  DATE
+  MONEY
+  NUMBER
+  PERCENT
+  SELECT
+  SERIES
+  TEXT
+}
+
+"""A device the Customer is signed in on"""
+type CustomerSession {
+  createdAt: DateTime!
+
+  """The session this request is made with"""
+  current: Boolean!
+  expiresAt: DateTime!
+  id: Int!
+  ip: String
+  lastSeenAt: DateTime
+  userAgent: String
+}
+
 """
 A date-time string at UTC, such as 2019-12-03T09:54:33Z, compliant with the date-time format.
 """
@@ -566,9 +856,15 @@ enum MainMailDtoTemplate {
   creator_shop_ready_for_pickup
   creator_shop_withdrawal_received
   creator_shop_withdrawal_request
+  customer_email_code
+  customer_inactivity_warning
+  customer_invite
+  customer_login_link
+  customer_second_factor_reset
   domain_ready
   email_verification
   newsletter
+  newsletter_confirm
   newsletter_welcome
   password_reset
   project_invitation
@@ -610,6 +906,7 @@ enum ModuleType {
   BLOG
   BOOKINGS
   CATEGORIES
+  CLIENT_ZONE
   CONNECTIONS
   CONTENT
   DONATIONS
@@ -622,23 +919,93 @@ enum ModuleType {
 }
 
 type Mutation {
+  """
+  Mail a 6-digit code (valid 15 min) to an address to add or change to. Needs a session signed in within the last 30 min (REAUTH_REQUIRED). 5 per hour (TOO_MANY_EMAIL_CODES); only the newest code works. Nothing changes until verifyCustomerEmail
+  """
+  addCustomerEmail(input: AddCustomerEmailInput!): Boolean!
   cancelRegistration(token: String!): Boolean!
 
+  """
+  The challenge's second factor → the session. Exactly one of code (6 digits from the authenticator app) and backupCode. The first good code enrols the Customer and returns backupCodes once. INVALID_SECOND_FACTOR_CODE (wrong or reused code), CHALLENGE_EXPIRED (unknown, used, older than 5 min, or its 5 tries spent), SECOND_FACTOR_LOCKED (10 wrong codes in an hour)
+  """
+  completeCustomerSecondFactor(backupCode: String, challengeToken: String!, code: String): CustomerAuthPayload!
+
   """Create a guest booking"""
   createPublicBooking(input: CreatePublicBookingInput!): PublicBookingResult!
 
   """Place a shop order; returns the order link token once"""
   createShopOrder(input: CreateShopOrderInput!): CreateShopOrderResult!
 
+  """Delete your account and everything linked to it, at once"""
+  deleteMe: Boolean!
+
+  """
+  Trade the sign-in link's token for a session (single use). Basic tier only: a secure site answers SECOND_FACTOR_REQUIRED, use startCustomerLogin
+  """
+  exchangeCustomerLoginToken(token: String!): CustomerAuthPayload!
+
+  """End the session this request is signed in with"""
+  logoutCustomer: Boolean!
+
+  """End every session of the signed-in Customer, this one included"""
+  logoutCustomerEverywhere: Boolean!
+
+  """
+  Trade the social callback's one-time code plus your verifier for a session (single use, 60 s)
+  """
+  redeemCustomerSocialCode(code: String!, verifier: String!): CustomerAuthPayload!
+
+  """New access token; the refresh token rotates"""
+  refreshCustomerSession(refreshToken: String!): CustomerAuthPayload!
+
+  """
+  Secure tier: a good authenticator code replaces all backup codes with 10 new ones, shown this once
+  """
+  regenerateCustomerBackupCodes(code: String!): [String!]!
+
+  """
+  Email a sign-in link. Always true: the answer never says whether the address has an account, nor whether the site sends e-mail links at all (clientZoneSignIn.emailSignIn)
+  """
+  requestCustomerLogin(input: RequestCustomerLoginInput!): Boolean!
+
   """
   Record the consumer's withdrawal request; by token, or by order number + e-mail
   """
   requestShopOrderWithdrawal(input: ShopWithdrawalInput!): Boolean!
+
+  """Sign out one of your own devices"""
+  revokeSession(id: Int!): Boolean!
   sendContactRequest(mailInput: MailInputType!): Boolean!
+
+  """
+  Trade the sign-in link's token (single use) for the next step: the session on a basic site, a SecondFactorChallenge on a secure one (then completeCustomerSecondFactor). Same refusals as exchangeCustomerLoginToken
+  """
+  startCustomerLogin(token: String!): CustomerLoginStep!
+
+  """
+  Start a social sign-in: returns the URL to send the browser to (valid 5 min). The code comes back to the client zone's callback path
+  """
+  startCustomerSocialLogin(input: StartCustomerSocialLoginInput!): String!
+
+  """
+  Secure tier: a good authenticator code marks this session's second factor fresh now (before sensitive downloads). Same wrong-code counting and lock as sign-in
+  """
+  stepUpCustomer(code: String!): Boolean!
   submitAdoptionRequest(input: PublicCreateAdoptionRequestInput!): PublicAdoptionRequestResult!
   submitRegistration(input: SubmitRegistrationInput!): RegistrationResult!
   subscribeNewsletter(input: SubscribeNewsletterInput!): PublicNewsletterSubscription!
   unsubscribeNewsletter(token: String!): Boolean!
+  updateMe(input: UpdateMeInput!): Customer!
+
+  """
+  Save the signed-in Customer's own attributes: only the keys given change, null removes one. Only READ_WRITE keys (ATTRIBUTE_NOT_WRITABLE; a key they cannot see is UNKNOWN_ATTRIBUTE). INVALID_ATTRIBUTE_VALUE and ATTRIBUTE_REQUIRED name the key in extensions; ATTRIBUTES_TOO_LARGE past 16 KB. A value the Customer writes is theirs to forge: anything the site computes belongs in a READ attribute
+  """
+  updateMyAttributes(input: UpdateMyAttributesInput!): Customer!
+
+  """
+  Prove the address with its code; it becomes the verified e-mail. INVALID_EMAIL_CODE (wrong, expired, or 5 wrong guesses), EMAIL_IN_USE (another Customer of this site has it). 10 wrong guesses at one address in 24 h lock it for that Customer, 100 from all Customers together lock it for everyone, until they age out
+  """
+  verifyCustomerEmail(input: VerifyCustomerEmailInput!): Customer!
 }
 
 type NewsletterType {
@@ -1158,7 +1525,13 @@ type PublicDeliveryMethod {
 
 type PublicNewsletterSubscription {
   email: String!
-  id: Int!
+
+  """Always 0"""
+  id: Int! @deprecated(reason: "Always 0: the answer must not tell whether the address was already on the list")
+
+  """
+  Always PENDING: the address gets a confirmation e-mail unless it is already subscribed, and the answer does not say which
+  """
   status: SubscriberStatus!
 }
 
@@ -1351,6 +1724,24 @@ enum QrFormat {
 type Query {
   """Get blog authors"""
   authors: [Author!]!
+
+  """
+  The Customer attributes a Customer may see on this site, for its profile form (no personal data). Cache it with the site's revalidation tag client-zone-attributes
+  """
+  clientZoneAttributeDefinitions: [ClientZoneAttributeDefinition!]!
+
+  """
+  The record types a Customer may read on this site, to render myRecords (no personal data). Cache it with the site's revalidation tag client-zone-record-types
+  """
+  clientZoneRecordTypes: [ClientZoneRecordType!]!
+
+  """
+  How people sign in on this site (tier, signup mode, e-mail links, social providers). No personal data
+  """
+  clientZoneSignIn: ClientZoneSignIn!
+
+  """Download my data: everything held about the signed-in Customer (JSON)"""
+  exportMe: JSON!
   getPublicContentById(contentId: Int!): Content!
   getPublicContentBySeoUrl(seoUrl: String!): Content!
   getPublicContentsByTags(getContentByTagsInput: GetContentByTagsInput!, pageOptionsDto: PageOptionsInput!): ContentsPage!
@@ -1369,6 +1760,17 @@ type Query {
   getPublicSchedule(from: DateTime, locale: String, slug: String!, to: DateTime): PublicSchedule
   isPetAvailableForAdoption(petId: Int!): Boolean!
 
+  """The signed-in Customer"""
+  me: Customer!
+
+  """
+  The signed-in Customer's records of one namespace (optionally some types), plus shared ones, in display order. A sensitive type needs a second factor proved in the last 15 minutes: STEP_UP_REQUIRED, then stepUpCustomer and ask again. Never cache the answer (fetch with no-store, never inside a shared cache)
+  """
+  myRecords(namespace: String!, types: [String!]): [CustomerRecord!]!
+
+  """The signed-in Customer's devices"""
+  mySessions: [CustomerSession!]!
+
   """Get post (blog) categories"""
   postCategories: [Category!]!
   projectContents(pageOptionInput: PageOptionsInput!): ContentsPage!
@@ -1486,6 +1888,19 @@ type RentalRate {
   updatedAt: DateTime
 }
 
+input RequestCustomerLoginInput {
+  """
+  The "I am 15 or older" box. Required to create an account: without it an unknown address gets no link
+  """
+  ageConfirmed: Boolean! = false
+  email: String!
+
+  """
+  The site's verify page; must be on one of the project's domains. The link adds ?token=
+  """
+  verifyUrl: String!
+}
+
 type SalePriceType {
   amount: Float!
   compareAt: Float
@@ -1498,6 +1913,29 @@ type SalePriceType {
   updatedAt: DateTime
 }
 
+"""
+Secure tier: the sign-in link was good, now the second factor. Send challengeToken with a code to completeCustomerSecondFactor within 5 minutes; 5 wrong codes end it
+"""
+type SecondFactorChallenge {
+  """Single use; keep it server-side"""
+  challengeToken: String!
+
+  """
+  False: the Customer sets up an authenticator app first (otpauthUri / manualKey / QR code)
+  """
+  enrolled: Boolean!
+  expiresAt: DateTime!
+
+  """The new secret (base32) to type in by hand; only when not enrolled"""
+  manualKey: String
+
+  """otpauth:// URI of the new secret; only when not enrolled"""
+  otpauthUri: String
+
+  """PNG data URL of the otpauth QR code; only when not enrolled"""
+  qrCodeDataUrl: String
+}
+
 type ShopAddress {
   city: String!
   country: String!
@@ -1666,6 +2104,24 @@ enum Species {
   SMALL_ANIMAL
 }
 
+input StartCustomerSocialLoginInput {
+  """The "I am 15 or older" box. Required to create an account"""
+  ageConfirmed: Boolean! = false
+
+  """
+  base64url(sha256(verifier)); the server keeps the verifier and redeems the code with it
+  """
+  challenge: String!
+
+  """TWITCH only for now"""
+  provider: CustomerProvider!
+
+  """
+  Where the one-time code comes back: the client zone's callback path on one of the site's domains
+  """
+  returnUrl: String!
+}
+
 enum StatisticsSection {
   AUDIENCE
   EVENTS
@@ -1715,12 +2171,29 @@ type Tag {
   updatedAt: DateTime
 }
 
+input UpdateMeInput {
+  displayName: String
+
+  """e.g. en, cs, en-GB"""
+  locale: String
+}
+
+input UpdateMyAttributesInput {
+  """Only these keys change; at most 50"""
+  values: [CustomerAttributeValueInput!]!
+}
+
 type VatLine {
   baseMinor: Int!
   rate: Int!
   vatMinor: Int!
 }
 
+input VerifyCustomerEmailInput {
+  """The 6-digit code from the e-mail"""
+  code: String!
+}
+
 """Supported SEO verification providers"""
 enum projectEntityEnum {
   Google