@contember/engine-tenant-api 1.2.1 → 1.3.0-alpha.2

package/src/model/service/idp/IDPManager.ts

@@ -75,8 +75,12 @@ export class IDPManager {
 				return new ResponseError(UpdateIdpErrorCode.NotFound, `IDP ${slug} not found`)
 			}
 			try {
-				const providerService = this.idpRegistry.getHandler(existing.type)
-				providerService.validateConfiguration(data.configuration)
+				const type = data.type ?? existing.type
+				const configuration = data.configuration ?? existing.configuration
+				const providerService = this.idpRegistry.getHandler(type)
+				if (data.configuration !== undefined || type !== existing.type) {
+					providerService.validateConfiguration(configuration)
+				}
 			} catch (e) {
 				if (e instanceof InvalidIDPConfigurationError) {
 					return new ResponseError(UpdateIdpErrorCode.InvalidConfiguration, `Invalid IDP configuration: ${e.message}`)

package/src/model/service/idp/IdentityProviderHandler.ts

@@ -1,10 +1,6 @@
-export interface InitIDPAuthResult<SessionData extends {}> {
+export interface InitIDPAuthResult {
 	authUrl: string
-	sessionData: SessionData
-}
-
-export interface IDPResponse {
-	url: string
+	sessionData: unknown
 }
 
 export interface IDPClaim {
@@ -13,15 +9,11 @@ export interface IDPClaim {
 	name?: string
 }
 
-export interface IdentityProviderHandler<SessionData extends {}, Configuration extends {}> {
-	initAuth(configuration: Configuration, redirectUrl: string): Promise<InitIDPAuthResult<SessionData>>
+export interface IdentityProviderHandler<Configuration extends {}> {
+
+	initAuth: (configuration: Configuration, data: unknown) => Promise<InitIDPAuthResult>
 
-	processResponse(
-		configuration: Configuration,
-		redirectUrl: string,
-		idpResponse: IDPResponse,
-		sessionData: SessionData,
-	): Promise<IDPClaim>
+	processResponse: (configuration: Configuration, responseData: unknown) =>  Promise<IDPClaim>
 
-	validateConfiguration(config: unknown): Configuration
+	validateConfiguration: (config: unknown) => Configuration
 }

package/src/model/service/idp/index.ts

@@ -4,4 +4,6 @@ export * from './IDPHandlerRegistry'
 export * from './IDPResponseError'
 export * from './IDPValidationError'
 export * from './InvalidIDPConfigurationError'
-export * from './OIDCProvider'
+export * from './providers/AppleProvider'
+export * from './providers/OIDCProvider'
+export * from './providers/FacebookProvider'

package/src/model/service/idp/providers/AppleProvider.ts

@@ -0,0 +1,65 @@
+import * as Typesafe from '@contember/typesafe'
+import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'
+import { catchTypesafe } from './helpers'
+import { IDPValidationError } from '../IDPValidationError'
+import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
+import { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'
+import { Client, Issuer } from 'openid-client'
+import { importPKCS8, SignJWT } from 'jose'
+
+export const AppleConfiguration = Typesafe.intersection(
+	Typesafe.object({
+		keyId: Typesafe.string,
+		teamId: Typesafe.string,
+		clientId: Typesafe.string,
+		privateKey: Typesafe.string,
+	}),
+	OIDCConfigurationOptions,
+)
+
+type AppleConfiguration = ReturnType<typeof AppleConfiguration>
+
+const APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'
+
+export class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {
+	private issuer: Issuer<Client> | undefined
+
+	validateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)
+
+	public async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {
+		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
+		const client = await this.createOIDCClient(configuration)
+		return await initOIDCAuth(client, {
+			claims: configuration.claims,
+			...initData,
+		})
+	}
+
+	public async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPClaim> {
+		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
+		const client = await this.createOIDCClient(configuration)
+		return await handleOIDCResponse(client, responseData)
+	}
+
+
+	private async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {
+		this.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)
+		const privateKey = await importPKCS8(configuration.privateKey, 'ES256')
+
+		const jwt = await new SignJWT({})
+			.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })
+			.setIssuedAt()
+			.setIssuer(configuration.teamId)
+			.setAudience('https://appleid.apple.com')
+			.setSubject(configuration.clientId)
+			.setExpirationTime('10m')
+			.sign(privateKey)
+
+		return new this.issuer.Client({
+			client_id: configuration.clientId,
+			client_secret: jwt,
+			response_types: [configuration.responseType || 'code'],
+		})
+	}
+}

package/src/model/service/idp/providers/FacebookProvider.ts

@@ -0,0 +1,125 @@
+import * as Typesafe from '@contember/typesafe'
+import { Client, Issuer } from 'openid-client'
+import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { IDPValidationError } from '../IDPValidationError'
+import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
+import { catchTypesafe } from './helpers'
+import { BaseOIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'
+import { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'
+import { createHmac } from 'node:crypto'
+import { IDPResponseError } from '../IDPResponseError'
+
+
+
+const FacebookConfiguration = BaseOIDCConfiguration
+type FacebookConfiguration = ReturnType<typeof FacebookConfiguration>
+
+const FacebookResponseData = Typesafe.union(
+	OIDCResponseData,
+	Typesafe.object({
+		authResponse: Typesafe.object({
+			accessToken: Typesafe.string,
+			signedRequest: Typesafe.string,
+		}),
+	}),
+)
+const FacebookResponsePayload = Typesafe.object({
+	user_id: Typesafe.string,
+	code: Typesafe.string,
+})
+
+type FacebookResponseData = ReturnType<typeof FacebookResponseData>
+
+
+export class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {
+	// based on https://www.facebook.com/.well-known/openid-configuration/
+	// facebook .well-known endpoint does have "token_endpoint" field
+	private facebookIssuer = new Issuer({
+		issuer: 'https://www.facebook.com',
+		authorization_endpoint: 'https://facebook.com/dialog/oauth/',
+		jwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',
+		response_types_supported: [
+			'id_token',
+			'token id_token',
+		],
+		subject_types_supported: [
+			'pairwise',
+		],
+		id_token_signing_alg_values_supported: [
+			'RS256',
+		],
+		claims_supported: [
+			'iss',
+			'aud',
+			'sub',
+			'iat',
+			'exp',
+			'jti',
+			'nonce',
+			'at_hash',
+			'name',
+			'given_name',
+			'middle_name',
+			'family_name',
+			'email',
+			'picture',
+			'user_friends',
+			'user_birthday',
+			'user_age_range',
+			'user_link',
+			'user_hometown',
+			'user_location',
+			'user_gender',
+		],
+		token_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',
+	})
+
+	validateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)
+
+	public async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {
+		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
+		const client = await this.createOIDCClient(configuration)
+		return await initOIDCAuth(client, {
+			claims: configuration.claims,
+			...initData,
+		})
+	}
+
+	public async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPClaim> {
+		const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)
+
+		if (!('authResponse' in responseData)) {
+			const client = await this.createOIDCClient(configuration)
+			return await handleOIDCResponse(client, responseData)
+		} else {
+			const [sig, payload] = responseData.authResponse.signedRequest.split('.')
+			const data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))
+			const hmac = createHmac('sha256', configuration.clientSecret)
+			const signature = hmac.update(payload).digest()
+			const isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0
+			if (!isSignatureValid) {
+				throw new IDPValidationError('Invalid signature')
+			}
+			const url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`
+			const response = await fetch(url)
+			if (!response.ok) {
+				throw new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)
+			}
+			const apiData = await response.json()
+
+			return {
+				externalIdentifier: data.user_id,
+				name: apiData.name,
+				email: apiData.email,
+			}
+		}
+	}
+
+	private async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {
+		return new this.facebookIssuer.Client({
+			client_id: configuration.clientId,
+			client_secret: configuration.clientSecret,
+			response_types: [configuration.responseType || 'code'],
+		})
+	}
+}

package/src/model/service/idp/providers/OIDCHelpers.ts

@@ -0,0 +1,54 @@
+import { Client, custom, errors, generators } from 'openid-client'
+import { OIDCResponseData } from './OIDCTypes'
+import { IDPValidationError } from '../IDPValidationError'
+import { IDPResponseError } from '../IDPResponseError'
+import { IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+
+custom.setHttpOptionsDefaults({
+	timeout: 5000,
+})
+
+export const initOIDCAuth = async (client: Client, { redirectUrl, claims, responseMode }: { redirectUrl: string; claims?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {
+	const nonce = generators.nonce()
+	const state = generators.state()
+	const url = client.authorizationUrl({
+		redirect_uri: redirectUrl,
+		response_mode: responseMode,
+		scope: claims ?? 'openid email',
+		nonce,
+		state,
+	})
+
+	return {
+		authUrl: url,
+		sessionData: { nonce, state },
+	}
+}
+
+export const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPClaim> => {
+	const params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)
+	if (params.state && !sessionData?.state) {
+		throw new IDPValidationError(`state is present in parameters, but missing in session data`)
+	}
+	try {
+		const result = await client.callback(redirectUrl, params, sessionData)
+		const claims = result.claims()
+		return {
+			externalIdentifier: claims.sub,
+			email: claims.email,
+			name: claims.name,
+		}
+	} catch (e: any) {
+		if (e instanceof errors.RPError) {
+			throw new IDPValidationError(e.message)
+		}
+		if (e instanceof errors.OPError) {
+			const body = e.response?.body as any
+			if (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {
+				throw new IDPResponseError(body.error.message)
+			}
+			throw new IDPResponseError(e.message)
+		}
+		throw e
+	}
+}

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -0,0 +1,40 @@
+import { Client, Issuer } from 'openid-client'
+import { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'
+import { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'
+import { catchTypesafe } from './helpers'
+import { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'
+import { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'
+import { IDPValidationError } from '../IDPValidationError'
+
+
+export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {
+	private issuerCache: Record<string, Issuer<Client>> = {}
+
+	validateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)
+
+	public async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {
+		const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)
+		const client = await this.createOIDCClient(configuration)
+		return await initOIDCAuth(client, {
+			claims: configuration.claims,
+			...initData,
+		})
+	}
+
+	public async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {
+		const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)
+		const client = await this.createOIDCClient(configuration)
+		return await handleOIDCResponse(client, responseData)
+	}
+
+
+	private async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {
+		this.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)
+
+		return new this.issuerCache[configuration.url].Client({
+			client_id: configuration.clientId,
+			client_secret: configuration.clientSecret,
+			response_types: [configuration.responseType || 'code'],
+		})
+	}
+}

package/src/model/service/idp/providers/OIDCTypes.ts

@@ -0,0 +1,61 @@
+import * as Typesafe from '@contember/typesafe'
+import { ResponseType } from 'openid-client'
+
+export interface OIDCSessionData {
+	nonce: string
+	state: string
+}
+
+export const OIDCConfigurationOptions = Typesafe.partial({
+	responseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),
+	claims: Typesafe.string,
+})
+export const BaseOIDCConfiguration = Typesafe.intersection(
+	Typesafe.object({
+		url: Typesafe.string,
+		clientId: Typesafe.string,
+		clientSecret: Typesafe.string,
+	}),
+	OIDCConfigurationOptions,
+)
+
+export const OIDCConfiguration = Typesafe.intersection(
+	BaseOIDCConfiguration,
+	Typesafe.object({
+		url: Typesafe.string,
+	}),
+)
+
+export type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>
+
+export const OIDCResponseData = Typesafe.intersection(
+	Typesafe.union(
+		Typesafe.object({
+			url: Typesafe.string,
+		}),
+		Typesafe.object({
+			parameters: Typesafe.record(Typesafe.string, Typesafe.string),
+		}),
+	),
+	Typesafe.partial({
+		redirectUrl: Typesafe.string,
+		sessionData: Typesafe.partial({
+			nonce: Typesafe.string,
+			state: Typesafe.string,
+		}),
+
+	}),
+)
+
+export type OIDCResponseData = ReturnType<typeof OIDCResponseData>
+
+export const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(
+	Typesafe.object({
+		redirectUrl: Typesafe.string,
+	}),
+	Typesafe.partial({
+		responseMode: Typesafe.string,
+	}),
+))
+
+export type OIDCInitData = ReturnType<typeof OIDCInitData>

package/src/model/service/idp/providers/helpers.ts

@@ -0,0 +1,12 @@
+import * as Typesafe from '@contember/typesafe'
+
+export const catchTypesafe = <T extends Typesafe.Json>(type: Typesafe.Type<T>, errorConstructor: { new(message: string): Error }) => (value: unknown): T => {
+	try {
+		return type(value)
+	} catch (e) {
+		if (e instanceof Typesafe.ParseError) {
+			throw new errorConstructor(e.message)
+		}
+		throw e
+	}
+}

package/src/model/utils/DatabaseContext.ts

@@ -27,6 +27,12 @@ export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection
 		})
 	}
 
+	public async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {
+		return await this.client.scope(async db => {
+			return await cb(new DatabaseContext(db, this.providers))
+		})
+	}
+
 	public batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {
 		const existing = this.loaders.get(loaderArgs)
 		if (existing) {

package/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts

@@ -15,6 +15,7 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 		})
 		const result = await this.idpManager.updateIDP(context.db, args.identityProvider, {
 			configuration: args.configuration,
+			type: args.type ?? undefined,
 			options: {
 				autoSignUp: args.options?.autoSignUp ?? undefined,
 				exclusive: args.options?.exclusive ?? undefined,

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -6,9 +6,7 @@ import {
 	SignInIdpResponse,
 } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { IDPSignInManager, PermissionActions, PermissionContextFactory } from '../../../model'
-import { createResolverContext } from '../../TenantResolverContextFactory'
-import { IdentityTypeResolver } from '../../types'
+import { IDPSignInManager, PermissionActions } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
 
@@ -27,7 +25,9 @@ export class IDPMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_CREATE_IDP_URL,
 			message: 'You are not allowed to create a redirect URL for IDP',
 		})
-		const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.redirectUrl)
+		const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {
+			redirectUrl: args.redirectUrl,
+		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
@@ -42,9 +42,11 @@ export class IDPMutationResolver implements MutationResolvers {
 		const signIn = await this.idpSignInManager.signInIDP(
 			context.db,
 			args.identityProvider,
-			args.redirectUrl,
-			args.idpResponse,
-			args.sessionData,
+			args.data ?? {
+				sessionData: args.sessionData,
+				url: args.idpResponse?.url,
+				redirectUrl: args.redirectUrl,
+			},
 			args.expiration ?? undefined,
 		)
 		if (!signIn.ok) {

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -1,8 +1,9 @@
-import { ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'
+import { MemberType, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers } from '../../schema'
 import { TenantResolverContext } from '../TenantResolverContext'
 import { PermissionActions, Project, ProjectMemberManager, ProjectSchemaResolver } from '../../model'
 import { getRoleVariables } from '@contember/schema-utils'
 import { Acl } from '@contember/schema'
+import { UserInputError } from '@contember/graphql-utils'
 
 export class ProjectTypeResolver implements ProjectResolvers {
 	constructor(
@@ -20,8 +21,14 @@ export class ProjectTypeResolver implements ProjectResolvers {
 		if (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {
 			return []
 		}
+		if (args.input?.filter?.email && args.input.filter.memberType === MemberType.ApiKey) {
+			throw new UserInputError(`Cannot use email filter for ApiKey member type.`)
+		}
+		if (args.memberType && args.input) {
+			throw new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)
+		}
 
-		const members = await this.projectMemberManager.getProjectMembers(context.db, parent.id, verifier, args.memberType ?? undefined)
+		const members = await this.projectMemberManager.getProjectMembers(context.db, parent.id, verifier, args.input ?? { filter: { memberType: args.memberType } })
 		return members.map(it => ({
 			...it,
 			identity: { ...it.identity, projects: [] },

package/src/schema/index.ts

@@ -413,6 +413,7 @@ export type InitSignInIdpError = {
 }
 
 export enum InitSignInIdpErrorCode {
+	IdpValidationFailed = 'IDP_VALIDATION_FAILED',
 	ProviderNotFound = 'PROVIDER_NOT_FOUND'
 }
 
@@ -533,7 +534,7 @@ export type Mutation = {
 	readonly __typename?: 'Mutation'
 	readonly addIDP?: Maybe<AddIdpResponse>
 	readonly addMailTemplate?: Maybe<AddMailTemplateResponse>
-	/** @deprecated use addMailtemplate */
+	/** @deprecated use addMailTemplate */
 	readonly addProjectMailTemplate?: Maybe<AddMailTemplateResponse>
 	readonly addProjectMember?: Maybe<AddProjectMemberResponse>
 	readonly changeMyPassword?: Maybe<ChangeMyPasswordResponse>
@@ -552,7 +553,7 @@ export type Mutation = {
 	readonly invite?: Maybe<InviteResponse>
 	readonly prepareOtp?: Maybe<PrepareOtpResponse>
 	readonly removeMailTemplate?: Maybe<RemoveMailTemplateResponse>
-	/** @deprecated use removeMailtemplate */
+	/** @deprecated use removeMailTemplate */
 	readonly removeProjectMailTemplate?: Maybe<RemoveMailTemplateResponse>
 	readonly removeProjectMember?: Maybe<RemoveProjectMemberResponse>
 	readonly resetPassword?: Maybe<ResetPasswordResponse>
@@ -664,8 +665,9 @@ export type MutationEnableIdpArgs = {
 
 
 export type MutationInitSignInIdpArgs = {
+	data?: InputMaybe<Scalars['Json']>
 	identityProvider: Scalars['String']
-	redirectUrl: Scalars['String']
+	redirectUrl?: InputMaybe<Scalars['String']>
 }
 
 
@@ -721,11 +723,12 @@ export type MutationSignInArgs = {
 
 
 export type MutationSignInIdpArgs = {
+	data?: InputMaybe<Scalars['Json']>
 	expiration?: InputMaybe<Scalars['Int']>
 	identityProvider: Scalars['String']
-	idpResponse: IdpResponseInput
-	redirectUrl: Scalars['String']
-	sessionData: Scalars['Json']
+	idpResponse?: InputMaybe<IdpResponseInput>
+	redirectUrl?: InputMaybe<Scalars['String']>
+	sessionData?: InputMaybe<Scalars['Json']>
 }
 
 
@@ -757,6 +760,7 @@ export type MutationUpdateIdpArgs = {
 	configuration?: InputMaybe<Scalars['Json']>
 	identityProvider: Scalars['String']
 	options?: InputMaybe<IdpOptions>
+	type?: InputMaybe<Scalars['String']>
 }
 
 
@@ -807,6 +811,7 @@ export type Project = {
 
 
 export type ProjectMembersArgs = {
+	input?: InputMaybe<ProjectMembersInput>
 	memberType?: InputMaybe<MemberType>
 }
 
@@ -816,6 +821,17 @@ export type ProjectIdentityRelation = {
 	readonly memberships: ReadonlyArray<Membership>
 }
 
+export type ProjectMembersFilter = {
+	readonly email?: InputMaybe<Scalars['String']>
+	readonly memberType?: InputMaybe<MemberType>
+}
+
+export type ProjectMembersInput = {
+	readonly filter?: InputMaybe<ProjectMembersFilter>
+	readonly limit?: InputMaybe<Scalars['Int']>
+	readonly offset?: InputMaybe<Scalars['Int']>
+}
+
 export type ProjectSecret = {
 	readonly key: Scalars['String']
 	readonly value: Scalars['String']
@@ -1274,6 +1290,8 @@ export type ResolversTypes = {
 	PrepareOtpResult: ResolverTypeWrapper<PrepareOtpResult>
 	Project: ResolverTypeWrapper<Project>
 	ProjectIdentityRelation: ResolverTypeWrapper<ProjectIdentityRelation>
+	ProjectMembersFilter: ProjectMembersFilter
+	ProjectMembersInput: ProjectMembersInput
 	ProjectSecret: ProjectSecret
 	Query: ResolverTypeWrapper<{}>
 	RemoveMailTemplateError: ResolverTypeWrapper<RemoveMailTemplateError>
@@ -1387,6 +1405,8 @@ export type ResolversParentTypes = {
 	PrepareOtpResult: PrepareOtpResult
 	Project: Project
 	ProjectIdentityRelation: ProjectIdentityRelation
+	ProjectMembersFilter: ProjectMembersFilter
+	ProjectMembersInput: ProjectMembersInput
 	ProjectSecret: ProjectSecret
 	Query: {}
 	RemoveMailTemplateError: RemoveMailTemplateError
@@ -1770,7 +1790,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 	disableIDP?: Resolver<Maybe<ResolversTypes['DisableIDPResponse']>, ParentType, ContextType, RequireFields<MutationDisableIdpArgs, 'identityProvider'>>
 	disableOtp?: Resolver<Maybe<ResolversTypes['DisableOtpResponse']>, ParentType, ContextType>
 	enableIDP?: Resolver<Maybe<ResolversTypes['EnableIDPResponse']>, ParentType, ContextType, RequireFields<MutationEnableIdpArgs, 'identityProvider'>>
-	initSignInIDP?: Resolver<Maybe<ResolversTypes['InitSignInIDPResponse']>, ParentType, ContextType, RequireFields<MutationInitSignInIdpArgs, 'identityProvider' | 'redirectUrl'>>
+	initSignInIDP?: Resolver<Maybe<ResolversTypes['InitSignInIDPResponse']>, ParentType, ContextType, RequireFields<MutationInitSignInIdpArgs, 'identityProvider'>>
 	invite?: Resolver<Maybe<ResolversTypes['InviteResponse']>, ParentType, ContextType, RequireFields<MutationInviteArgs, 'email' | 'memberships' | 'projectSlug'>>
 	prepareOtp?: Resolver<Maybe<ResolversTypes['PrepareOtpResponse']>, ParentType, ContextType, Partial<MutationPrepareOtpArgs>>
 	removeMailTemplate?: Resolver<Maybe<ResolversTypes['RemoveMailTemplateResponse']>, ParentType, ContextType, RequireFields<MutationRemoveMailTemplateArgs, 'templateIdentifier'>>
@@ -1779,7 +1799,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 	resetPassword?: Resolver<Maybe<ResolversTypes['ResetPasswordResponse']>, ParentType, ContextType, RequireFields<MutationResetPasswordArgs, 'password' | 'token'>>
 	setProjectSecret?: Resolver<Maybe<ResolversTypes['SetProjectSecretResponse']>, ParentType, ContextType, RequireFields<MutationSetProjectSecretArgs, 'key' | 'projectSlug' | 'value'>>
 	signIn?: Resolver<Maybe<ResolversTypes['SignInResponse']>, ParentType, ContextType, RequireFields<MutationSignInArgs, 'email' | 'password'>>
-	signInIDP?: Resolver<Maybe<ResolversTypes['SignInIDPResponse']>, ParentType, ContextType, RequireFields<MutationSignInIdpArgs, 'identityProvider' | 'idpResponse' | 'redirectUrl' | 'sessionData'>>
+	signInIDP?: Resolver<Maybe<ResolversTypes['SignInIDPResponse']>, ParentType, ContextType, RequireFields<MutationSignInIdpArgs, 'identityProvider'>>
 	signOut?: Resolver<Maybe<ResolversTypes['SignOutResponse']>, ParentType, ContextType, Partial<MutationSignOutArgs>>
 	signUp?: Resolver<Maybe<ResolversTypes['SignUpResponse']>, ParentType, ContextType, RequireFields<MutationSignUpArgs, 'email'>>
 	unmanagedInvite?: Resolver<Maybe<ResolversTypes['InviteResponse']>, ParentType, ContextType, RequireFields<MutationUnmanagedInviteArgs, 'email' | 'memberships' | 'projectSlug'>>