@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/src/schema/index.ts

@@ -362,6 +362,7 @@ export type Config = {
 	readonly captcha: ConfigCaptcha
 	readonly emailChange: ConfigEmailChange
 	readonly login: ConfigLogin
+	readonly panel: ConfigPanel
 	readonly password: ConfigPassword
 	readonly passwordless: ConfigPasswordless
 	readonly rateLimits: ConfigRateLimits
@@ -430,6 +431,7 @@ export type ConfigInput = {
 	readonly captcha?: InputMaybe<ConfigCaptchaInput>
 	readonly emailChange?: InputMaybe<ConfigEmailChangeInput>
 	readonly login?: InputMaybe<ConfigLoginInput>
+	readonly panel?: InputMaybe<ConfigPanelInput>
 	readonly password?: InputMaybe<ConfigPasswordInput>
 	readonly passwordless?: InputMaybe<ConfigPasswordlessInput>
 	readonly rateLimits?: InputMaybe<ConfigRateLimitsInput>
@@ -495,6 +497,31 @@ export type ConfigLoginInput = {
 	readonly revealUserExists?: InputMaybe<Scalars['Boolean']['input']>
 }
 
+/**
+ * Who may enter the management panel. This is an entry gate for the console
+ * only, not an authorization system: everything done inside the panel still
+ * goes through the tenant ACL, so being allowed in grants no extra rights.
+ * An identity may enter when its global roles intersect globalRoles, or when
+ * it holds a membership with one of projectRoles in at least one project.
+ * Both lists empty means nobody can enter.
+ */
+export type ConfigPanel = {
+	readonly __typename?: 'ConfigPanel'
+	/** Global roles (identity.roles) that may use the management panel. */
+	readonly globalRoles: ReadonlyArray<Scalars['String']['output']>
+	/** Project membership roles that may use the management panel, in any project. */
+	readonly projectRoles: ReadonlyArray<Scalars['String']['output']>
+}
+
+/**
+ * Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+ * list closes the panel for that dimension.
+ */
+export type ConfigPanelInput = {
+	readonly globalRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+	readonly projectRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+}
+
 export type ConfigPassword = {
 	readonly __typename?: 'ConfigPassword'
 	readonly checkBlacklist: Scalars['Boolean']['output']
@@ -686,6 +713,7 @@ export type CreateApiKeyError = {
 
 export type CreateApiKeyErrorCode =
 	| 'INVALID_MEMBERSHIP'
+	| 'INVALID_ROLE'
 	| 'PROJECT_NOT_FOUND'
 	| 'ROLE_NOT_FOUND'
 	| 'VARIABLE_EMPTY'
@@ -739,6 +767,26 @@ export type CreateAuthPolicyResult = {
 	readonly id: Scalars['String']['output']
 }
 
+export type CreateCustomRoleError = {
+	readonly __typename?: 'CreateCustomRoleError'
+	readonly code: CreateCustomRoleErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type CreateCustomRoleErrorCode =
+	| 'DUPLICATE_PERMISSION'
+	| 'INVALID_PERMISSION_CONFIGURATION'
+	| 'INVALID_SLUG'
+	| 'SLUG_ALREADY_ASSIGNED'
+	| 'SLUG_ALREADY_EXISTS'
+	| 'UNKNOWN_PERMISSION'
+
+export type CreateCustomRoleResponse = {
+	readonly __typename?: 'CreateCustomRoleResponse'
+	readonly error?: Maybe<CreateCustomRoleError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type CreatePasswordResetRequestError = {
 	readonly __typename?: 'CreatePasswordResetRequestError'
 	readonly code: CreatePasswordResetRequestErrorCode
@@ -816,6 +864,42 @@ export type CreateSessionTokenResult = CommonSignInResult & {
 	readonly token: Scalars['String']['output']
 }
 
+export type CustomRole = {
+	readonly __typename?: 'CustomRole'
+	readonly description?: Maybe<Scalars['String']['output']>
+	readonly grants: ReadonlyArray<CustomRoleGrant>
+	readonly slug: Scalars['String']['output']
+}
+
+export type CustomRoleConfigurationKind =
+	| 'CHANGE_PROFILE'
+	| 'CREATE_SESSION_TOKEN'
+	| 'GLOBAL_API_KEY'
+	| 'MAIL_TEMPLATE_SCOPE'
+	| 'NONE'
+	| 'ROLE_INPUT'
+	| 'ROLE_MUTATION'
+	| 'TARGET_IDENTITY'
+
+export type CustomRoleGrant = {
+	readonly __typename?: 'CustomRoleGrant'
+	readonly config?: Maybe<Scalars['Json']['output']>
+	readonly permission: Scalars['String']['output']
+}
+
+export type CustomRoleGrantInput = {
+	readonly config?: InputMaybe<Scalars['Json']['input']>
+	readonly permission: Scalars['String']['input']
+}
+
+export type CustomRolePermissionDefinition = {
+	readonly __typename?: 'CustomRolePermissionDefinition'
+	readonly configurationKind: CustomRoleConfigurationKind
+	readonly configurationRequired: Scalars['Boolean']['output']
+	readonly defaultConfig?: Maybe<Scalars['Json']['output']>
+	readonly name: Scalars['String']['output']
+}
+
 export type DeleteAuthPolicyError = {
 	readonly __typename?: 'DeleteAuthPolicyError'
 	readonly code: DeleteAuthPolicyErrorCode
@@ -830,6 +914,27 @@ export type DeleteAuthPolicyResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type DeleteCustomRoleError = {
+	readonly __typename?: 'DeleteCustomRoleError'
+	readonly code: DeleteCustomRoleErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type DeleteCustomRoleErrorCode =
+	| 'NOT_FOUND'
+	/**
+	 * Another custom role's grant configuration references this one. Remove the reference first —
+	 * deleting would leave that role un-resubmittable, and recreating this slug would silently
+	 * re-bind the reference to a different definition.
+	 */
+	| 'ROLE_IN_USE'
+
+export type DeleteCustomRoleResponse = {
+	readonly __typename?: 'DeleteCustomRoleResponse'
+	readonly error?: Maybe<DeleteCustomRoleError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type DisableApiKeyError = {
 	readonly __typename?: 'DisableApiKeyError'
 	readonly code: DisableApiKeyErrorCode
@@ -921,6 +1026,11 @@ export type DisconnectIdpError = {
 }
 
 export type DisconnectIdpErrorCode =
+	/**
+	 * The provider has `disableLocalAuthentication`, so this connection is the only way
+	 * the person may sign in and cannot be removed by them — not even while the provider is disabled.
+	 */
+	| 'IDP_REQUIRED'
 	/**  The person is not allowed to disconnect their last remaining sign-in method.  */
 	| 'LAST_AUTH_METHOD'
 	/**  The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect.  */
@@ -953,6 +1063,22 @@ export type EnableIdpResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type EnablePersonError = {
+	readonly __typename?: 'EnablePersonError'
+	readonly code: EnablePersonErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type EnablePersonErrorCode =
+	| 'PERSON_ALREADY_ENABLED'
+	| 'PERSON_NOT_FOUND'
+
+export type EnablePersonResponse = {
+	readonly __typename?: 'EnablePersonResponse'
+	readonly error?: Maybe<EnablePersonError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type ForceSignOutPersonError = {
 	readonly __typename?: 'ForceSignOutPersonError'
 	readonly code: ForceSignOutPersonErrorCode
@@ -970,6 +1096,7 @@ export type ForceSignOutPersonResponse = {
 export type IdpOptions = {
 	readonly assumeEmailVerified?: InputMaybe<Scalars['Boolean']['input']>
 	readonly autoSignUp?: InputMaybe<Scalars['Boolean']['input']>
+	readonly disableLocalAuthentication?: InputMaybe<Scalars['Boolean']['input']>
 	readonly exclusive?: InputMaybe<Scalars['Boolean']['input']>
 	readonly initReturnsConfig?: InputMaybe<Scalars['Boolean']['input']>
 	readonly requireVerifiedEmail?: InputMaybe<Scalars['Boolean']['input']>
@@ -984,6 +1111,13 @@ export type IdpOptionsOutput = {
 	 */
 	readonly assumeEmailVerified: Scalars['Boolean']['output']
 	readonly autoSignUp: Scalars['Boolean']['output']
+	/**
+	 * When true, a person linked to this provider may authenticate ONLY through it:
+	 * password sign-in and passwordless sign-in are refused and no password-reset
+	 * mail is sent. Disabling the provider lifts the restriction, which is the
+	 * break-glass for an IdP outage. Defaults to false.
+	 */
+	readonly disableLocalAuthentication: Scalars['Boolean']['output']
 	readonly exclusive: Scalars['Boolean']['output']
 	readonly initReturnsConfig: Scalars['Boolean']['output']
 	/**
@@ -1011,18 +1145,46 @@ export type Identity = {
 	 * Active SESSION-type api keys for this identity. Always visible for
 	 * the calling identity (e.g. via `me { sessions }`). For other identities,
 	 * visible to callers holding the `person:viewSessions` permission against
-	 * the target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees
-	 * members whose roles fall within their allowed-input-roles. Returns an
+	 * the target — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees everyone except
+	 * identities holding `super_admin` or `project_creator`; a custom role is
+	 * further bounded by its configured target constraints. Returns an
 	 * empty list rather than throwing when the viewer lacks visibility, so
 	 * batched identity queries do not abort on a single forbidden target.
 	 */
 	readonly sessions: ReadonlyArray<SessionInfo>
 }
 
+/**
+ * What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+ *
+ * This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+ * boundary, and answering `true` here grants nothing. Every operation is still checked when it is
+ * called. The distinction matters because permission failure is not uniform across this API: some
+ * queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+ * "nothing to show" from "not yours to see" by trying.
+ */
 export type IdentityGlobalPermissions = {
 	readonly __typename?: 'IdentityGlobalPermissions'
+	readonly canCreateGlobalApiKey: Scalars['Boolean']['output']
 	readonly canCreateProject: Scalars['Boolean']['output']
 	readonly canDeployEntrypoint: Scalars['Boolean']['output']
+	/**  Read `globalApiKeys`, which answers an empty list otherwise.  */
+	readonly canListGlobalApiKeys: Scalars['Boolean']['output']
+	/**  Read `identityProviders`.  */
+	readonly canListIdentityProviders: Scalars['Boolean']['output']
+	/**  Read `mailTemplates`.  */
+	readonly canListMailTemplates: Scalars['Boolean']['output']
+	/**
+	 * List every person in the tenant. Without it `persons` still answers, narrowed to the members
+	 * of the projects the caller administers — so this marks a full listing, not access to one.
+	 */
+	readonly canListPersons: Scalars['Boolean']['output']
+	/** Write the tenant configuration (`configure`) and read `authPolicies`. The CLI is the usual write path. */
+	readonly canManageConfiguration: Scalars['Boolean']['output']
+	/**  Read `authLog`, which throws otherwise.  */
+	readonly canViewAuthLog: Scalars['Boolean']['output']
+	/**  Read `configuration`, which throws otherwise. The other configuration queries gate on their own actions.  */
+	readonly canViewConfiguration: Scalars['Boolean']['output']
 }
 
 export type IdentityProjectRelation = {
@@ -1099,6 +1261,11 @@ export type InitSignInPasswordlessError = {
 }
 
 export type InitSignInPasswordlessErrorCode =
+	/**
+	 * The person is linked to an identity provider with
+	 * `disableLocalAuthentication`, so passwordless sign-in is not available to them.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_CAPTCHA'
 	| 'PASSWORDLESS_DISABLED'
 	| 'PERSON_NOT_FOUND'
@@ -1264,11 +1431,13 @@ export type Mutation = {
 	readonly confirmOtp?: Maybe<ConfirmOtpResponse>
 	readonly createApiKey?: Maybe<CreateApiKeyResponse>
 	readonly createAuthPolicy?: Maybe<CreateAuthPolicyResponse>
+	readonly createCustomRole?: Maybe<CreateCustomRoleResponse>
 	readonly createGlobalApiKey?: Maybe<CreateApiKeyResponse>
 	readonly createProject?: Maybe<CreateProjectResponse>
 	readonly createResetPasswordRequest?: Maybe<CreatePasswordResetRequestResponse>
 	readonly createSessionToken?: Maybe<CreateSessionTokenResponse>
 	readonly deleteAuthPolicy?: Maybe<DeleteAuthPolicyResponse>
+	readonly deleteCustomRole?: Maybe<DeleteCustomRoleResponse>
 	readonly disableApiKey?: Maybe<DisableApiKeyResponse>
 	readonly disableEmailOtp?: Maybe<DisableEmailOtpResponse>
 	readonly disableIDP?: Maybe<DisableIdpResponse>
@@ -1283,6 +1452,7 @@ export type Mutation = {
 	readonly disconnectMyIdentityProvider?: Maybe<DisconnectIdpResponse>
 	readonly enableIDP?: Maybe<EnableIdpResponse>
 	readonly enableMyPasswordless?: Maybe<ToggleMyPasswordlessResponse>
+	readonly enablePerson?: Maybe<EnablePersonResponse>
 	readonly forceSignOutPerson?: Maybe<ForceSignOutPersonResponse>
 	readonly initEmailOtp?: Maybe<InitEmailOtpResponse>
 	readonly initSignInIDP?: Maybe<InitSignInIdpResponse>
@@ -1312,6 +1482,7 @@ export type Mutation = {
 	readonly signUp?: Maybe<SignUpResponse>
 	readonly unmanagedInvite?: Maybe<InviteResponse>
 	readonly updateAuthPolicy?: Maybe<UpdateAuthPolicyResponse>
+	readonly updateCustomRole?: Maybe<UpdateCustomRoleResponse>
 	readonly updateIDP?: Maybe<UpdateIdpResponse>
 	readonly updateProject?: Maybe<UpdateProjectResponse>
 	readonly updateProjectMember?: Maybe<UpdateProjectMemberResponse>
@@ -1399,6 +1570,12 @@ export type MutationCreateAuthPolicyArgs = {
 	policy: AuthPolicyInput
 }
 
+export type MutationCreateCustomRoleArgs = {
+	description?: InputMaybe<Scalars['String']['input']>
+	grants: ReadonlyArray<CustomRoleGrantInput>
+	slug: Scalars['String']['input']
+}
+
 export type MutationCreateGlobalApiKeyArgs = {
 	description: Scalars['String']['input']
 	options?: InputMaybe<CreateApiKeyOptions>
@@ -1432,6 +1609,10 @@ export type MutationDeleteAuthPolicyArgs = {
 	id: Scalars['String']['input']
 }
 
+export type MutationDeleteCustomRoleArgs = {
+	slug: Scalars['String']['input']
+}
+
 export type MutationDisableApiKeyArgs = {
 	id: Scalars['String']['input']
 }
@@ -1452,6 +1633,10 @@ export type MutationEnableIdpArgs = {
 	identityProvider: Scalars['String']['input']
 }
 
+export type MutationEnablePersonArgs = {
+	personId: Scalars['String']['input']
+}
+
 export type MutationForceSignOutPersonArgs = {
 	personId: Scalars['String']['input']
 	reason?: InputMaybe<Scalars['String']['input']>
@@ -1580,6 +1765,12 @@ export type MutationUpdateAuthPolicyArgs = {
 	policy: AuthPolicyInput
 }
 
+export type MutationUpdateCustomRoleArgs = {
+	description?: InputMaybe<Scalars['String']['input']>
+	grants?: InputMaybe<ReadonlyArray<CustomRoleGrantInput>>
+	slug: Scalars['String']['input']
+}
+
 export type MutationUpdateIdpArgs = {
 	configuration?: InputMaybe<Scalars['Json']['input']>
 	identityProvider: Scalars['String']['input']
@@ -1611,6 +1802,11 @@ export type PasswordlessValidationType =
 
 export type Person = {
 	readonly __typename?: 'Person'
+	/**
+	 * When the account was disabled (see `disablePerson`), null while the person
+	 * is active. Read-only — flip it with `disablePerson` / `enablePerson`.
+	 */
+	readonly disabledAt?: Maybe<Scalars['DateTime']['output']>
 	readonly email?: Maybe<Scalars['String']['output']>
 	/**
 	 * Whether e-mail based one-time-password 2FA is enabled for this person
@@ -1626,14 +1822,29 @@ export type Person = {
 	 * External IdP connections of this person. Always visible for the calling
 	 * person (e.g. via `me { person { identityProviders } }`). For other
 	 * persons, visible to callers holding the `person:viewIdp` permission
-	 * against the target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN
-	 * sees members whose roles fall within their allowed-input-roles. Returns
-	 * an empty list rather than throwing when the viewer lacks visibility.
+	 * against the target — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees
+	 * everyone except identities holding `super_admin` or `project_creator`;
+	 * a custom role is further bounded by its configured target constraints.
+	 * Returns an empty list rather than throwing when the viewer lacks visibility.
 	 */
 	readonly identityProviders: ReadonlyArray<PersonIdentityProvider>
 	readonly name?: Maybe<Scalars['String']['output']>
 	readonly otpEnabled: Scalars['Boolean']['output']
+	/**
+	 * Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+	 * policy resolved against `passwordlessEnabled`, i.e. the very same decision `signIn` makes. A UI
+	 * offering an enable/disable toggle must branch on this — under an `always` or `never` policy the
+	 * raw opt-in flag says nothing about what will happen.
+	 */
+	readonly passwordlessAvailable: Scalars['Boolean']['output']
+	/**  The person's own opt-in flag; `null` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see `passwordlessAvailable`.  */
 	readonly passwordlessEnabled?: Maybe<Scalars['Boolean']['output']>
+	/**
+	 * Whether `passwordlessEnabled` is what decides `passwordlessAvailable`. False under an `always`
+	 * or `never` policy, where the person's own flag is ignored — a UI should then report the state
+	 * rather than offer a toggle that changes nothing.
+	 */
+	readonly passwordlessSelfManaged: Scalars['Boolean']['output']
 }
 
 /**  A single external IdP connection of the currently authenticated person.  */
@@ -1678,6 +1889,8 @@ export type Project = {
 	readonly id: Scalars['String']['output']
 	readonly members: ReadonlyArray<ProjectIdentityRelation>
 	readonly name: Scalars['String']['output']
+	/**  What the calling identity may do here. Advisory — for building the UI, not for enforcing it.  */
+	readonly permissions: ProjectPermissions
 	readonly roles: ReadonlyArray<RoleDefinition>
 	/**
 	 * Names of the project's secrets (see `setProjectSecret`). Secret VALUES are
@@ -1713,6 +1926,29 @@ export type ProjectMembersInput = {
 	readonly offset?: InputMaybe<Scalars['Int']['input']>
 }
 
+/**
+ * What the calling identity may do in this project. Same contract as
+ * `IdentityGlobalPermissions`: advisory, evaluated per caller, never a substitute for the checks in
+ * the resolvers.
+ */
+export type ProjectPermissions = {
+	readonly __typename?: 'ProjectPermissions'
+	/**  Invite or add a member (`invite`, `addProjectMember`). Which roles may be granted is checked per membership.  */
+	readonly canAddMember: Scalars['Boolean']['output']
+	/**  Create an API key scoped to this project.  */
+	readonly canCreateApiKey: Scalars['Boolean']['output']
+	readonly canRemoveMember: Scalars['Boolean']['output']
+	/**  Write a project secret (`setProjectSecret`). Distinct from viewing: a project admin commonly has one and not the other.  */
+	readonly canSetSecret: Scalars['Boolean']['output']
+	/**  Update the project itself (`updateProject`).  */
+	readonly canUpdate: Scalars['Boolean']['output']
+	readonly canUpdateMember: Scalars['Boolean']['output']
+	/**  Read `members` and `apiKeys`; both answer an empty list otherwise.  */
+	readonly canViewMembers: Scalars['Boolean']['output']
+	/**  Read `secrets` (their names, never values); answers an empty list otherwise.  */
+	readonly canViewSecrets: Scalars['Boolean']['output']
+}
+
 export type ProjectSecret = {
 	readonly key: Scalars['String']['input']
 	readonly value: Scalars['String']['input']
@@ -1730,8 +1966,8 @@ export type Query = {
 	readonly __typename?: 'Query'
 	/**
 	 * Read the tenant audit log (`person_auth_log`). Requires the
-	 * `system:viewAuthLog` permission — by default granted only to
-	 * SUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.
+	 * `system:viewAuthLog` permission — granted to SUPER_ADMIN and
+	 * PROJECT_ADMIN by default, and grantable to a custom role.
 	 * Ordered by created_at DESC. Page size is capped server-side
 	 * (default 100, max 500); `hasMore` indicates a further page exists.
 	 */
@@ -1745,11 +1981,23 @@ export type Query = {
 	readonly authPolicies: ReadonlyArray<AuthPolicy>
 	readonly checkResetPasswordToken: CheckResetPasswordTokenCode
 	readonly configuration: Config
+	/**
+	 * List exact permission definitions grantable to a custom role. Requires
+	 * the `customRole:view` permission.
+	 */
+	readonly customRolePermissions: ReadonlyArray<CustomRolePermissionDefinition>
+	/**
+	 * List custom roles (runtime-defined global roles carrying a bundle of tenant
+	 * permissions). Requires the `customRole:view` permission — granted to
+	 * SUPER_ADMIN and PROJECT_ADMIN by default, and itself grantable to a custom
+	 * role. Managing definitions needs `customRole:manage`, which is not grantable.
+	 */
+	readonly customRoles: ReadonlyArray<CustomRole>
 	/**
 	 * List global (project-independent) permanent API keys — those created via
 	 * `createGlobalApiKey`, whose identity carries global roles and no project
-	 * membership. Requires the `apiKey:list` permission — by default granted
-	 * only to SUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.
+	 * membership. Requires the `apiKey:list` permission — granted to SUPER_ADMIN
+	 * and PROJECT_ADMIN by default, and grantable to a custom role.
 	 * Returns an empty list when the caller may not list them. To list a
 	 * project's keys use `project.apiKeys`.
 	 */
@@ -1759,12 +2007,13 @@ export type Query = {
 	readonly me: Identity
 	readonly personById?: Maybe<Person>
 	/**
-	 * List persons across the tenant. SUPER_ADMIN sees every person; otherwise
-	 * the result is scoped to persons who are members of a project the caller may
-	 * view members of (i.e. the same persons reachable via `project.members`),
-	 * so a PROJECT_ADMIN sees only their projects' members. `filter` matches by
-	 * e-mail (case-insensitive), `personId`, or `identityId`; `limit`/`offset`
-	 * paginate. Returns an empty list when the caller may not list anyone.
+	 * List persons across the tenant. Requires the `person:list` permission —
+	 * held by SUPER_ADMIN and PROJECT_ADMIN, and grantable to a custom role — which
+	 * lists every person. Without it the result is scoped to persons who are members
+	 * of a project the caller may view members of (i.e. the same persons reachable
+	 * via `project.members`). `filter` matches by e-mail (case-insensitive),
+	 * `personId`, or `identityId`; `limit`/`offset` paginate. Returns an empty
+	 * list when the caller may not list anyone.
 	 */
 	readonly persons: ReadonlyArray<Person>
 	readonly projectBySlug?: Maybe<Project>
@@ -2031,6 +2280,11 @@ export type SignInError = {
 
 export type SignInErrorCode =
 	| 'EMAIL_NOT_VERIFIED'
+	/**
+	 * The person is linked to an identity provider with
+	 * `disableLocalAuthentication`, so password sign-in is not available to them.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_CREDENTIALS'
 	| 'INVALID_OTP_TOKEN'
 	| 'INVALID_PASSWORD'
@@ -2095,6 +2349,11 @@ export type SignInPasswordlessError = {
 }
 
 export type SignInPasswordlessErrorCode =
+	/**
+	 * The person became linked to an identity provider with
+	 * `disableLocalAuthentication` after this magic link was issued.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_OTP_TOKEN'
 	| 'MFA_ENROLLMENT_REQUIRED'
 	| 'OTP_REQUIRED'
@@ -2182,6 +2441,7 @@ export type SignUpErrorCode =
 	| 'EMAIL_ALREADY_EXISTS'
 	| 'INVALID_CAPTCHA'
 	| 'INVALID_EMAIL_FORMAT'
+	| 'INVALID_ROLE'
 	| 'RATE_LIMIT_EXCEEDED'
 	| 'TOO_WEAK'
 
@@ -2242,6 +2502,24 @@ export type UpdateAuthPolicyResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type UpdateCustomRoleError = {
+	readonly __typename?: 'UpdateCustomRoleError'
+	readonly code: UpdateCustomRoleErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type UpdateCustomRoleErrorCode =
+	| 'DUPLICATE_PERMISSION'
+	| 'INVALID_PERMISSION_CONFIGURATION'
+	| 'NOT_FOUND'
+	| 'UNKNOWN_PERMISSION'
+
+export type UpdateCustomRoleResponse = {
+	readonly __typename?: 'UpdateCustomRoleResponse'
+	readonly error?: Maybe<UpdateCustomRoleError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type UpdateIdpError = {
 	readonly __typename?: 'UpdateIDPError'
 	readonly code: UpdateIdpErrorCode
@@ -2488,6 +2766,8 @@ export type ResolversTypes = {
 	ConfigLoginAnomalyDetection: ResolverTypeWrapper<ConfigLoginAnomalyDetection>
 	ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput
 	ConfigLoginInput: ConfigLoginInput
+	ConfigPanel: ResolverTypeWrapper<ConfigPanel>
+	ConfigPanelInput: ConfigPanelInput
 	ConfigPassword: ResolverTypeWrapper<ConfigPassword>
 	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ResolverTypeWrapper<ConfigPasswordless>
@@ -2522,6 +2802,9 @@ export type ResolversTypes = {
 	CreateAuthPolicyErrorCode: CreateAuthPolicyErrorCode
 	CreateAuthPolicyResponse: ResolverTypeWrapper<CreateAuthPolicyResponse>
 	CreateAuthPolicyResult: ResolverTypeWrapper<CreateAuthPolicyResult>
+	CreateCustomRoleError: ResolverTypeWrapper<CreateCustomRoleError>
+	CreateCustomRoleErrorCode: CreateCustomRoleErrorCode
+	CreateCustomRoleResponse: ResolverTypeWrapper<CreateCustomRoleResponse>
 	CreatePasswordResetRequestError: ResolverTypeWrapper<CreatePasswordResetRequestError>
 	CreatePasswordResetRequestErrorCode: CreatePasswordResetRequestErrorCode
 	CreatePasswordResetRequestResponse: ResolverTypeWrapper<CreatePasswordResetRequestResponse>
@@ -2535,10 +2818,18 @@ export type ResolversTypes = {
 	CreateSessionTokenErrorCode: CreateSessionTokenErrorCode
 	CreateSessionTokenResponse: ResolverTypeWrapper<CreateSessionTokenResponse>
 	CreateSessionTokenResult: ResolverTypeWrapper<CreateSessionTokenResult>
+	CustomRole: ResolverTypeWrapper<CustomRole>
+	CustomRoleConfigurationKind: CustomRoleConfigurationKind
+	CustomRoleGrant: ResolverTypeWrapper<CustomRoleGrant>
+	CustomRoleGrantInput: CustomRoleGrantInput
+	CustomRolePermissionDefinition: ResolverTypeWrapper<CustomRolePermissionDefinition>
 	DateTime: ResolverTypeWrapper<Scalars['DateTime']['output']>
 	DeleteAuthPolicyError: ResolverTypeWrapper<DeleteAuthPolicyError>
 	DeleteAuthPolicyErrorCode: DeleteAuthPolicyErrorCode
 	DeleteAuthPolicyResponse: ResolverTypeWrapper<DeleteAuthPolicyResponse>
+	DeleteCustomRoleError: ResolverTypeWrapper<DeleteCustomRoleError>
+	DeleteCustomRoleErrorCode: DeleteCustomRoleErrorCode
+	DeleteCustomRoleResponse: ResolverTypeWrapper<DeleteCustomRoleResponse>
 	DisableApiKeyError: ResolverTypeWrapper<DisableApiKeyError>
 	DisableApiKeyErrorCode: DisableApiKeyErrorCode
 	DisableApiKeyResponse: ResolverTypeWrapper<DisableApiKeyResponse>
@@ -2561,6 +2852,9 @@ export type ResolversTypes = {
 	EnableIDPError: ResolverTypeWrapper<EnableIdpError>
 	EnableIDPErrorCode: EnableIdpErrorCode
 	EnableIDPResponse: ResolverTypeWrapper<EnableIdpResponse>
+	EnablePersonError: ResolverTypeWrapper<EnablePersonError>
+	EnablePersonErrorCode: EnablePersonErrorCode
+	EnablePersonResponse: ResolverTypeWrapper<EnablePersonResponse>
 	Float: ResolverTypeWrapper<Scalars['Float']['output']>
 	ForceSignOutPersonError: ResolverTypeWrapper<ForceSignOutPersonError>
 	ForceSignOutPersonErrorCode: ForceSignOutPersonErrorCode
@@ -2626,6 +2920,7 @@ export type ResolversTypes = {
 	ProjectIdentityRelation: ResolverTypeWrapper<Omit<ProjectIdentityRelation, 'identity'> & { identity: ResolversTypes['Identity'] }>
 	ProjectMembersFilter: ProjectMembersFilter
 	ProjectMembersInput: ProjectMembersInput
+	ProjectPermissions: ResolverTypeWrapper<ProjectPermissions>
 	ProjectSecret: ProjectSecret
 	ProjectSecretInfo: ResolverTypeWrapper<ProjectSecretInfo>
 	Query: ResolverTypeWrapper<Record<PropertyKey, never>>
@@ -2695,6 +2990,9 @@ export type ResolversTypes = {
 	UpdateAuthPolicyError: ResolverTypeWrapper<UpdateAuthPolicyError>
 	UpdateAuthPolicyErrorCode: UpdateAuthPolicyErrorCode
 	UpdateAuthPolicyResponse: ResolverTypeWrapper<UpdateAuthPolicyResponse>
+	UpdateCustomRoleError: ResolverTypeWrapper<UpdateCustomRoleError>
+	UpdateCustomRoleErrorCode: UpdateCustomRoleErrorCode
+	UpdateCustomRoleResponse: ResolverTypeWrapper<UpdateCustomRoleResponse>
 	UpdateIDPError: ResolverTypeWrapper<UpdateIdpError>
 	UpdateIDPErrorCode: UpdateIdpErrorCode
 	UpdateIDPResponse: ResolverTypeWrapper<UpdateIdpResponse>
@@ -2757,6 +3055,8 @@ export type ResolversParentTypes = {
 	ConfigLoginAnomalyDetection: ConfigLoginAnomalyDetection
 	ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput
 	ConfigLoginInput: ConfigLoginInput
+	ConfigPanel: ConfigPanel
+	ConfigPanelInput: ConfigPanelInput
 	ConfigPassword: ConfigPassword
 	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ConfigPasswordless
@@ -2784,6 +3084,8 @@ export type ResolversParentTypes = {
 	CreateAuthPolicyError: CreateAuthPolicyError
 	CreateAuthPolicyResponse: CreateAuthPolicyResponse
 	CreateAuthPolicyResult: CreateAuthPolicyResult
+	CreateCustomRoleError: CreateCustomRoleError
+	CreateCustomRoleResponse: CreateCustomRoleResponse
 	CreatePasswordResetRequestError: CreatePasswordResetRequestError
 	CreatePasswordResetRequestResponse: CreatePasswordResetRequestResponse
 	CreateProjectOptions: CreateProjectOptions
@@ -2794,9 +3096,15 @@ export type ResolversParentTypes = {
 	CreateSessionTokenError: CreateSessionTokenError
 	CreateSessionTokenResponse: CreateSessionTokenResponse
 	CreateSessionTokenResult: CreateSessionTokenResult
+	CustomRole: CustomRole
+	CustomRoleGrant: CustomRoleGrant
+	CustomRoleGrantInput: CustomRoleGrantInput
+	CustomRolePermissionDefinition: CustomRolePermissionDefinition
 	DateTime: Scalars['DateTime']['output']
 	DeleteAuthPolicyError: DeleteAuthPolicyError
 	DeleteAuthPolicyResponse: DeleteAuthPolicyResponse
+	DeleteCustomRoleError: DeleteCustomRoleError
+	DeleteCustomRoleResponse: DeleteCustomRoleResponse
 	DisableApiKeyError: DisableApiKeyError
 	DisableApiKeyResponse: DisableApiKeyResponse
 	DisableEmailOtpError: DisableEmailOtpError
@@ -2812,6 +3120,8 @@ export type ResolversParentTypes = {
 	EmailVerificationOptions: EmailVerificationOptions
 	EnableIDPError: EnableIdpError
 	EnableIDPResponse: EnableIdpResponse
+	EnablePersonError: EnablePersonError
+	EnablePersonResponse: EnablePersonResponse
 	Float: Scalars['Float']['output']
 	ForceSignOutPersonError: ForceSignOutPersonError
 	ForceSignOutPersonResponse: ForceSignOutPersonResponse
@@ -2863,6 +3173,7 @@ export type ResolversParentTypes = {
 	ProjectIdentityRelation: Omit<ProjectIdentityRelation, 'identity'> & { identity: ResolversParentTypes['Identity'] }
 	ProjectMembersFilter: ProjectMembersFilter
 	ProjectMembersInput: ProjectMembersInput
+	ProjectPermissions: ProjectPermissions
 	ProjectSecret: ProjectSecret
 	ProjectSecretInfo: ProjectSecretInfo
 	Query: Record<PropertyKey, never>
@@ -2915,6 +3226,8 @@ export type ResolversParentTypes = {
 	UnmanagedInviteOptions: UnmanagedInviteOptions
 	UpdateAuthPolicyError: UpdateAuthPolicyError
 	UpdateAuthPolicyResponse: UpdateAuthPolicyResponse
+	UpdateCustomRoleError: UpdateCustomRoleError
+	UpdateCustomRoleResponse: UpdateCustomRoleResponse
 	UpdateIDPError: UpdateIdpError
 	UpdateIDPResponse: UpdateIdpResponse
 	UpdateProjectError: UpdateProjectError
@@ -3159,6 +3472,7 @@ export type ConfigResolvers<ContextType = any, ParentType extends ResolversParen
 	captcha?: Resolver<ResolversTypes['ConfigCaptcha'], ParentType, ContextType>
 	emailChange?: Resolver<ResolversTypes['ConfigEmailChange'], ParentType, ContextType>
 	login?: Resolver<ResolversTypes['ConfigLogin'], ParentType, ContextType>
+	panel?: Resolver<ResolversTypes['ConfigPanel'], ParentType, ContextType>
 	password?: Resolver<ResolversTypes['ConfigPassword'], ParentType, ContextType>
 	passwordless?: Resolver<ResolversTypes['ConfigPasswordless'], ParentType, ContextType>
 	rateLimits?: Resolver<ResolversTypes['ConfigRateLimits'], ParentType, ContextType>
@@ -3213,6 +3527,11 @@ export type ConfigLoginAnomalyDetectionResolvers<
 	stepUpThreshold?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
 }
 
+export type ConfigPanelResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPanel'] = ResolversParentTypes['ConfigPanel']> = {
+	globalRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+	projectRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+}
+
 export type ConfigPasswordResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ConfigPassword'] = ResolversParentTypes['ConfigPassword'],
@@ -3394,6 +3713,22 @@ export type CreateAuthPolicyResultResolvers<
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 }
 
+export type CreateCustomRoleErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateCustomRoleError'] = ResolversParentTypes['CreateCustomRoleError'],
+> = {
+	code?: Resolver<ResolversTypes['CreateCustomRoleErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CreateCustomRoleResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateCustomRoleResponse'] = ResolversParentTypes['CreateCustomRoleResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['CreateCustomRoleError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type CreatePasswordResetRequestErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['CreatePasswordResetRequestError'] = ResolversParentTypes['CreatePasswordResetRequestError'],
@@ -3462,6 +3797,30 @@ export type CreateSessionTokenResultResolvers<
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
+export type CustomRoleResolvers<ContextType = any, ParentType extends ResolversParentTypes['CustomRole'] = ResolversParentTypes['CustomRole']> = {
+	description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	grants?: Resolver<ReadonlyArray<ResolversTypes['CustomRoleGrant']>, ParentType, ContextType>
+	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CustomRoleGrantResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CustomRoleGrant'] = ResolversParentTypes['CustomRoleGrant'],
+> = {
+	config?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
+	permission?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CustomRolePermissionDefinitionResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CustomRolePermissionDefinition'] = ResolversParentTypes['CustomRolePermissionDefinition'],
+> = {
+	configurationKind?: Resolver<ResolversTypes['CustomRoleConfigurationKind'], ParentType, ContextType>
+	configurationRequired?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	defaultConfig?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
+	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
 export interface DateTimeScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['DateTime'], any> {
 	name: 'DateTime'
 }
@@ -3482,6 +3841,22 @@ export type DeleteAuthPolicyResponseResolvers<
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
+export type DeleteCustomRoleErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DeleteCustomRoleError'] = ResolversParentTypes['DeleteCustomRoleError'],
+> = {
+	code?: Resolver<ResolversTypes['DeleteCustomRoleErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type DeleteCustomRoleResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DeleteCustomRoleResponse'] = ResolversParentTypes['DeleteCustomRoleResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['DeleteCustomRoleError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type DisableApiKeyErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['DisableApiKeyError'] = ResolversParentTypes['DisableApiKeyError'],
@@ -3598,6 +3973,22 @@ export type EnableIdpResponseResolvers<
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
+export type EnablePersonErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['EnablePersonError'] = ResolversParentTypes['EnablePersonError'],
+> = {
+	code?: Resolver<ResolversTypes['EnablePersonErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type EnablePersonResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['EnablePersonResponse'] = ResolversParentTypes['EnablePersonResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['EnablePersonError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type ForceSignOutPersonErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ForceSignOutPersonError'] = ResolversParentTypes['ForceSignOutPersonError'],
@@ -3620,6 +4011,7 @@ export type IdpOptionsOutputResolvers<
 > = {
 	assumeEmailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	autoSignUp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	disableLocalAuthentication?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	exclusive?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	initReturnsConfig?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	requireVerifiedEmail?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
@@ -3640,8 +4032,16 @@ export type IdentityGlobalPermissionsResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['IdentityGlobalPermissions'] = ResolversParentTypes['IdentityGlobalPermissions'],
 > = {
+	canCreateGlobalApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	canCreateProject?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	canDeployEntrypoint?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListGlobalApiKeys?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListIdentityProviders?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListMailTemplates?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListPersons?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canManageConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewAuthLog?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type IdentityProjectRelationResolvers<
@@ -3889,6 +4289,12 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationCreateAuthPolicyArgs, 'policy'>
 	>
+	createCustomRole?: Resolver<
+		Maybe<ResolversTypes['CreateCustomRoleResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationCreateCustomRoleArgs, 'grants' | 'slug'>
+	>
 	createGlobalApiKey?: Resolver<
 		Maybe<ResolversTypes['CreateApiKeyResponse']>,
 		ParentType,
@@ -3914,6 +4320,12 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationDeleteAuthPolicyArgs, 'id'>
 	>
+	deleteCustomRole?: Resolver<
+		Maybe<ResolversTypes['DeleteCustomRoleResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationDeleteCustomRoleArgs, 'slug'>
+	>
 	disableApiKey?: Resolver<Maybe<ResolversTypes['DisableApiKeyResponse']>, ParentType, ContextType, RequireFields<MutationDisableApiKeyArgs, 'id'>>
 	disableEmailOtp?: Resolver<Maybe<ResolversTypes['DisableEmailOtpResponse']>, ParentType, ContextType>
 	disableIDP?: Resolver<
@@ -3938,6 +4350,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 	>
 	enableIDP?: Resolver<Maybe<ResolversTypes['EnableIDPResponse']>, ParentType, ContextType, RequireFields<MutationEnableIdpArgs, 'identityProvider'>>
 	enableMyPasswordless?: Resolver<Maybe<ResolversTypes['ToggleMyPasswordlessResponse']>, ParentType, ContextType>
+	enablePerson?: Resolver<Maybe<ResolversTypes['EnablePersonResponse']>, ParentType, ContextType, RequireFields<MutationEnablePersonArgs, 'personId'>>
 	forceSignOutPerson?: Resolver<
 		Maybe<ResolversTypes['ForceSignOutPersonResponse']>,
 		ParentType,
@@ -4041,6 +4454,12 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationUpdateAuthPolicyArgs, 'id' | 'policy'>
 	>
+	updateCustomRole?: Resolver<
+		Maybe<ResolversTypes['UpdateCustomRoleResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationUpdateCustomRoleArgs, 'slug'>
+	>
 	updateIDP?: Resolver<Maybe<ResolversTypes['UpdateIDPResponse']>, ParentType, ContextType, RequireFields<MutationUpdateIdpArgs, 'identityProvider'>>
 	updateProject?: Resolver<
 		Maybe<ResolversTypes['UpdateProjectResponse']>,
@@ -4058,6 +4477,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 }
 
 export type PersonResolvers<ContextType = any, ParentType extends ResolversParentTypes['Person'] = ResolversParentTypes['Person']> = {
+	disabledAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
 	email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	emailOtpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	emailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
@@ -4066,7 +4486,9 @@ export type PersonResolvers<ContextType = any, ParentType extends ResolversParen
 	identityProviders?: Resolver<ReadonlyArray<ResolversTypes['PersonIdentityProvider']>, ParentType, ContextType>
 	name?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	otpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	passwordlessAvailable?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	passwordlessEnabled?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>
+	passwordlessSelfManaged?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type PersonIdentityProviderResolvers<
@@ -4101,6 +4523,7 @@ export type ProjectResolvers<ContextType = any, ParentType extends ResolversPare
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	members?: Resolver<ReadonlyArray<ResolversTypes['ProjectIdentityRelation']>, ParentType, ContextType, Partial<ProjectMembersArgs>>
 	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	permissions?: Resolver<ResolversTypes['ProjectPermissions'], ParentType, ContextType>
 	roles?: Resolver<ReadonlyArray<ResolversTypes['RoleDefinition']>, ParentType, ContextType>
 	secrets?: Resolver<ReadonlyArray<ResolversTypes['ProjectSecretInfo']>, ParentType, ContextType>
 	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
@@ -4114,6 +4537,20 @@ export type ProjectIdentityRelationResolvers<
 	memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>
 }
 
+export type ProjectPermissionsResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ProjectPermissions'] = ResolversParentTypes['ProjectPermissions'],
+> = {
+	canAddMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canCreateApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canRemoveMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canSetSecret?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canUpdate?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canUpdateMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewMembers?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewSecrets?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type ProjectSecretInfoResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ProjectSecretInfo'] = ResolversParentTypes['ProjectSecretInfo'],
@@ -4133,6 +4570,8 @@ export type QueryResolvers<ContextType = any, ParentType extends ResolversParent
 		RequireFields<QueryCheckResetPasswordTokenArgs, 'requestId' | 'token'>
 	>
 	configuration?: Resolver<ResolversTypes['Config'], ParentType, ContextType>
+	customRolePermissions?: Resolver<ReadonlyArray<ResolversTypes['CustomRolePermissionDefinition']>, ParentType, ContextType>
+	customRoles?: Resolver<ReadonlyArray<ResolversTypes['CustomRole']>, ParentType, ContextType>
 	globalApiKeys?: Resolver<ReadonlyArray<ResolversTypes['ApiKey']>, ParentType, ContextType>
 	identityProviders?: Resolver<ReadonlyArray<ResolversTypes['IdentityProvider']>, ParentType, ContextType>
 	mailTemplates?: Resolver<ReadonlyArray<ResolversTypes['MailTemplateData']>, ParentType, ContextType>
@@ -4527,6 +4966,22 @@ export type UpdateAuthPolicyResponseResolvers<
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
+export type UpdateCustomRoleErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['UpdateCustomRoleError'] = ResolversParentTypes['UpdateCustomRoleError'],
+> = {
+	code?: Resolver<ResolversTypes['UpdateCustomRoleErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type UpdateCustomRoleResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['UpdateCustomRoleResponse'] = ResolversParentTypes['UpdateCustomRoleResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['UpdateCustomRoleError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type UpdateIdpErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['UpdateIDPError'] = ResolversParentTypes['UpdateIDPError'],
@@ -4635,6 +5090,7 @@ export type Resolvers<ContextType = any> = {
 	ConfigEmailChange?: ConfigEmailChangeResolvers<ContextType>
 	ConfigLogin?: ConfigLoginResolvers<ContextType>
 	ConfigLoginAnomalyDetection?: ConfigLoginAnomalyDetectionResolvers<ContextType>
+	ConfigPanel?: ConfigPanelResolvers<ContextType>
 	ConfigPassword?: ConfigPasswordResolvers<ContextType>
 	ConfigPasswordless?: ConfigPasswordlessResolvers<ContextType>
 	ConfigRateLimitWindow?: ConfigRateLimitWindowResolvers<ContextType>
@@ -4656,6 +5112,8 @@ export type Resolvers<ContextType = any> = {
 	CreateAuthPolicyError?: CreateAuthPolicyErrorResolvers<ContextType>
 	CreateAuthPolicyResponse?: CreateAuthPolicyResponseResolvers<ContextType>
 	CreateAuthPolicyResult?: CreateAuthPolicyResultResolvers<ContextType>
+	CreateCustomRoleError?: CreateCustomRoleErrorResolvers<ContextType>
+	CreateCustomRoleResponse?: CreateCustomRoleResponseResolvers<ContextType>
 	CreatePasswordResetRequestError?: CreatePasswordResetRequestErrorResolvers<ContextType>
 	CreatePasswordResetRequestResponse?: CreatePasswordResetRequestResponseResolvers<ContextType>
 	CreateProjectResponse?: CreateProjectResponseResolvers<ContextType>
@@ -4664,9 +5122,14 @@ export type Resolvers<ContextType = any> = {
 	CreateSessionTokenError?: CreateSessionTokenErrorResolvers<ContextType>
 	CreateSessionTokenResponse?: CreateSessionTokenResponseResolvers<ContextType>
 	CreateSessionTokenResult?: CreateSessionTokenResultResolvers<ContextType>
+	CustomRole?: CustomRoleResolvers<ContextType>
+	CustomRoleGrant?: CustomRoleGrantResolvers<ContextType>
+	CustomRolePermissionDefinition?: CustomRolePermissionDefinitionResolvers<ContextType>
 	DateTime?: GraphQLScalarType
 	DeleteAuthPolicyError?: DeleteAuthPolicyErrorResolvers<ContextType>
 	DeleteAuthPolicyResponse?: DeleteAuthPolicyResponseResolvers<ContextType>
+	DeleteCustomRoleError?: DeleteCustomRoleErrorResolvers<ContextType>
+	DeleteCustomRoleResponse?: DeleteCustomRoleResponseResolvers<ContextType>
 	DisableApiKeyError?: DisableApiKeyErrorResolvers<ContextType>
 	DisableApiKeyResponse?: DisableApiKeyResponseResolvers<ContextType>
 	DisableEmailOtpError?: DisableEmailOtpErrorResolvers<ContextType>
@@ -4681,6 +5144,8 @@ export type Resolvers<ContextType = any> = {
 	DisconnectIDPResponse?: DisconnectIdpResponseResolvers<ContextType>
 	EnableIDPError?: EnableIdpErrorResolvers<ContextType>
 	EnableIDPResponse?: EnableIdpResponseResolvers<ContextType>
+	EnablePersonError?: EnablePersonErrorResolvers<ContextType>
+	EnablePersonResponse?: EnablePersonResponseResolvers<ContextType>
 	ForceSignOutPersonError?: ForceSignOutPersonErrorResolvers<ContextType>
 	ForceSignOutPersonResponse?: ForceSignOutPersonResponseResolvers<ContextType>
 	IDPOptionsOutput?: IdpOptionsOutputResolvers<ContextType>
@@ -4713,6 +5178,7 @@ export type Resolvers<ContextType = any> = {
 	PrepareOtpResult?: PrepareOtpResultResolvers<ContextType>
 	Project?: ProjectResolvers<ContextType>
 	ProjectIdentityRelation?: ProjectIdentityRelationResolvers<ContextType>
+	ProjectPermissions?: ProjectPermissionsResolvers<ContextType>
 	ProjectSecretInfo?: ProjectSecretInfoResolvers<ContextType>
 	Query?: QueryResolvers<ContextType>
 	RegenerateBackupCodesError?: RegenerateBackupCodesErrorResolvers<ContextType>
@@ -4759,6 +5225,8 @@ export type Resolvers<ContextType = any> = {
 	ToggleMyPasswordlessResponse?: ToggleMyPasswordlessResponseResolvers<ContextType>
 	UpdateAuthPolicyError?: UpdateAuthPolicyErrorResolvers<ContextType>
 	UpdateAuthPolicyResponse?: UpdateAuthPolicyResponseResolvers<ContextType>
+	UpdateCustomRoleError?: UpdateCustomRoleErrorResolvers<ContextType>
+	UpdateCustomRoleResponse?: UpdateCustomRoleResponseResolvers<ContextType>
 	UpdateIDPError?: UpdateIdpErrorResolvers<ContextType>
 	UpdateIDPResponse?: UpdateIdpResponseResolvers<ContextType>
 	UpdateProjectError?: UpdateProjectErrorResolvers<ContextType>