@contember/engine-tenant-api 2.2.0-alpha.2 → 2.2.0-alpha.5

package/src/resolvers/query/ProjectQueryResolver.ts

@@ -1,13 +1,14 @@
 import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'
 import { TenantResolverContext } from '../TenantResolverContext.js'
 import { PermissionActions, ProjectManager } from '../../model/index.js'
+import { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'
 
 export class ProjectQueryResolver implements QueryResolvers {
 	constructor(private readonly projectManager: ProjectManager) {}
 
 	async projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {
 		return (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(
-			it => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] }),
+			ProjectResponseFactory.createProjectResponse,
 		)
 	}
 
@@ -27,6 +28,6 @@ export class ProjectQueryResolver implements QueryResolvers {
 			return null
 		}
 
-		return { ...project, members: [], roles: [], apiKeys: [], secrets: [] }
+		return ProjectResponseFactory.createProjectResponse(project)
 	}
 }

package/src/resolvers/responseHelpers/PersonResponseFactory.ts

@@ -14,6 +14,11 @@ export class PersonResponseFactory {
 			emailVerified: !!personRow.email_verified_at,
 			name: personRow.name,
 			passwordlessEnabled: personRow.passwordless_enabled,
+			// resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the
+			// non-nullable field types complete
+			passwordlessAvailable: false,
+			passwordlessSelfManaged: false,
+			disabledAt: personRow.disabled_at,
 			identity: {
 				id: personRow.identity_id,
 				projects,

package/src/resolvers/responseHelpers/ProjectResponseFactory.ts

@@ -0,0 +1,24 @@
+import { Project as ProjectDto } from '../../model/index.js'
+import { Project } from '../../schema/index.js'
+
+/** Placeholder for `Project.permissions`; `ProjectTypeResolver.permissions` always replaces it. */
+const unresolvedPermissions = {
+	canViewMembers: false,
+	canAddMember: false,
+	canUpdateMember: false,
+	canRemoveMember: false,
+	canViewSecrets: false,
+	canSetSecret: false,
+	canCreateApiKey: false,
+	canUpdate: false,
+}
+
+export class ProjectResponseFactory {
+	/**
+	 * The row plus placeholders for everything `ProjectTypeResolver` resolves per caller — members,
+	 * roles, api keys, secrets and permissions all need the project scope, which is not known here.
+	 */
+	public static createProjectResponse(project: ProjectDto): Project {
+		return { ...project, members: [], roles: [], apiKeys: [], secrets: [], permissions: unresolvedPermissions }
+	}
+}

package/src/resolvers/types/IdentityTypeResolver.ts

@@ -13,6 +13,7 @@ import { TenantResolverContext } from '../TenantResolverContext.js'
 import { notEmpty } from '../../utils/array.js'
 import { batchLoader } from '../../utils/batchQuery.js'
 import { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'
+import { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'
 
 export class IdentityTypeResolver implements IdentityResolvers {
 	private personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(
@@ -75,7 +76,7 @@ export class IdentityTypeResolver implements IdentityResolvers {
 						return null
 					}
 					return {
-						project: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },
+						project: ProjectResponseFactory.createProjectResponse(it),
 						memberships: memberships,
 					}
 				}),
@@ -128,9 +129,44 @@ export class IdentityTypeResolver implements IdentityResolvers {
 			return null
 		}
 
+		// Advisory only — every one of these is checked again where it is used. It exists so a UI can
+		// stop offering what it cannot deliver: the operations behind these flags fail in three
+		// different ways (empty list, thrown query, thrown mutation), so probing is not an option.
+		const [
+			canCreateProject,
+			canDeployEntrypoint,
+			canViewConfiguration,
+			canListIdentityProviders,
+			canListMailTemplates,
+			canManageConfiguration,
+			canViewAuthLog,
+			canListPersons,
+			canListGlobalApiKeys,
+			canCreateGlobalApiKey,
+		] = await Promise.all([
+			permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
+			permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
+			permissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),
+			permissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),
+			permissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),
+			permissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() }),
+		])
+
 		return {
-			canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
-			canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
+			canCreateProject,
+			canDeployEntrypoint,
+			canViewConfiguration,
+			canListIdentityProviders,
+			canListMailTemplates,
+			canManageConfiguration,
+			canViewAuthLog,
+			canListPersons,
+			canListGlobalApiKeys,
+			canCreateGlobalApiKey,
 		}
 	}
 

package/src/resolvers/types/PersonTypeResolver.ts

@@ -1,13 +1,46 @@
 import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js'
-import { IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'
+import { type Config, ConfigurationQuery, IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'
+import { isPasswordlessEnabled } from '../../model/service/helpers/isPasswordlessEnabled.js'
 import { TenantResolverContext } from '../TenantResolverContext.js'
 
-export class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders'> {
+export class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders' | 'passwordlessAvailable' | 'passwordlessSelfManaged'> {
+	/**
+	 * One configuration read per request rather than per person: `person$$` selects every scalar, so
+	 * listing N people would otherwise issue N identical config queries. Keyed on the resolver context,
+	 * which is built once per operation and collected with it.
+	 */
+	private readonly configurationByRequest = new WeakMap<TenantResolverContext, Promise<Config>>()
+
 	constructor(
 		private readonly personIdentityProviderManager: PersonIdentityProviderManager,
 	) {
 	}
 
+	/**
+	 * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a
+	 * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,
+	 * which an ordinary person does not have).
+	 */
+	async passwordlessAvailable(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {
+		const config = await this.configuration(context)
+		return isPasswordlessEnabled(config.passwordless.enabled, parent.passwordlessEnabled ?? null)
+	}
+
+	async passwordlessSelfManaged(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {
+		const config = await this.configuration(context)
+		return config.passwordless.enabled === 'optIn' || config.passwordless.enabled === 'optOut'
+	}
+
+	private configuration(context: TenantResolverContext): Promise<Config> {
+		const cached = this.configurationByRequest.get(context)
+		if (cached) {
+			return cached
+		}
+		const pending = context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))
+		this.configurationByRequest.set(context, pending)
+		return pending
+	}
+
 	async identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]> {
 		// Self: always allowed. Other persons: gated by PERSON_VIEW_IDP against the
 		// target's roles, so PROJECT_ADMIN can inspect members but not SUPER_ADMINs.

package/src/resolvers/types/ProjectTypeResolver.ts

@@ -1,4 +1,5 @@
-import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'
+import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectPermissions, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'
+import { Authorizator } from '@contember/authorization'
 import { TenantResolverContext } from '../TenantResolverContext.js'
 import { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'
 import { getRoleVariables } from '@contember/schema-utils'
@@ -71,6 +72,37 @@ export class ProjectTypeResolver implements ProjectResolvers {
 		}))
 	}
 
+	/**
+	 * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is
+	 * checked again where it is used, so answering `true` here grants nothing.
+	 *
+	 * The membership-parameterized actions are asked with an empty membership list, the same coarse
+	 * "do you hold this at all" question `apiKeys` and `members` already ask — which roles may
+	 * actually be granted is still decided per membership when the mutation runs.
+	 */
+	async permissions(
+		parent: Omit<Project, 'config'>,
+		args: unknown,
+		context: TenantResolverContext,
+	): Promise<ProjectPermissions> {
+		const scope = await context.permissionContext.createProjectScope(parent)
+		const isAllowed = (action: Authorizator.Action) => context.permissionContext.isAllowed({ scope, action })
+
+		const [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise
+			.all([
+				isAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),
+				isAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),
+				isAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),
+				isAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),
+				isAllowed(PermissionActions.PROJECT_VIEW_SECRETS),
+				isAllowed(PermissionActions.PROJECT_SET_SECRET),
+				isAllowed(PermissionActions.API_KEY_CREATE),
+				isAllowed(PermissionActions.PROJECT_UPDATE),
+			])
+
+		return { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate }
+	}
+
 	async roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {
 		const schema = await this.projectSchemaResolver.getSchema(parent.slug)
 		if (!schema) {

package/src/schema/index.ts

@@ -362,6 +362,7 @@ export type Config = {
 	readonly captcha: ConfigCaptcha
 	readonly emailChange: ConfigEmailChange
 	readonly login: ConfigLogin
+	readonly panel: ConfigPanel
 	readonly password: ConfigPassword
 	readonly passwordless: ConfigPasswordless
 	readonly rateLimits: ConfigRateLimits
@@ -430,6 +431,7 @@ export type ConfigInput = {
 	readonly captcha?: InputMaybe<ConfigCaptchaInput>
 	readonly emailChange?: InputMaybe<ConfigEmailChangeInput>
 	readonly login?: InputMaybe<ConfigLoginInput>
+	readonly panel?: InputMaybe<ConfigPanelInput>
 	readonly password?: InputMaybe<ConfigPasswordInput>
 	readonly passwordless?: InputMaybe<ConfigPasswordlessInput>
 	readonly rateLimits?: InputMaybe<ConfigRateLimitsInput>
@@ -495,6 +497,31 @@ export type ConfigLoginInput = {
 	readonly revealUserExists?: InputMaybe<Scalars['Boolean']['input']>
 }
 
+/**
+ * Who may enter the management panel. This is an entry gate for the console
+ * only, not an authorization system: everything done inside the panel still
+ * goes through the tenant ACL, so being allowed in grants no extra rights.
+ * An identity may enter when its global roles intersect globalRoles, or when
+ * it holds a membership with one of projectRoles in at least one project.
+ * Both lists empty means nobody can enter.
+ */
+export type ConfigPanel = {
+	readonly __typename?: 'ConfigPanel'
+	/** Global roles (identity.roles) that may use the management panel. */
+	readonly globalRoles: ReadonlyArray<Scalars['String']['output']>
+	/** Project membership roles that may use the management panel, in any project. */
+	readonly projectRoles: ReadonlyArray<Scalars['String']['output']>
+}
+
+/**
+ * Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+ * list closes the panel for that dimension.
+ */
+export type ConfigPanelInput = {
+	readonly globalRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+	readonly projectRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+}
+
 export type ConfigPassword = {
 	readonly __typename?: 'ConfigPassword'
 	readonly checkBlacklist: Scalars['Boolean']['output']
@@ -953,6 +980,22 @@ export type EnableIdpResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type EnablePersonError = {
+	readonly __typename?: 'EnablePersonError'
+	readonly code: EnablePersonErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type EnablePersonErrorCode =
+	| 'PERSON_ALREADY_ENABLED'
+	| 'PERSON_NOT_FOUND'
+
+export type EnablePersonResponse = {
+	readonly __typename?: 'EnablePersonResponse'
+	readonly error?: Maybe<EnablePersonError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type ForceSignOutPersonError = {
 	readonly __typename?: 'ForceSignOutPersonError'
 	readonly code: ForceSignOutPersonErrorCode
@@ -1019,10 +1062,37 @@ export type Identity = {
 	readonly sessions: ReadonlyArray<SessionInfo>
 }
 
+/**
+ * What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+ *
+ * This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+ * boundary, and answering `true` here grants nothing. Every operation is still checked when it is
+ * called. The distinction matters because permission failure is not uniform across this API: some
+ * queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+ * "nothing to show" from "not yours to see" by trying.
+ */
 export type IdentityGlobalPermissions = {
 	readonly __typename?: 'IdentityGlobalPermissions'
+	readonly canCreateGlobalApiKey: Scalars['Boolean']['output']
 	readonly canCreateProject: Scalars['Boolean']['output']
 	readonly canDeployEntrypoint: Scalars['Boolean']['output']
+	/**  Read `globalApiKeys`, which answers an empty list otherwise.  */
+	readonly canListGlobalApiKeys: Scalars['Boolean']['output']
+	/**  Read `identityProviders`.  */
+	readonly canListIdentityProviders: Scalars['Boolean']['output']
+	/**  Read `mailTemplates`.  */
+	readonly canListMailTemplates: Scalars['Boolean']['output']
+	/**
+	 * List every person in the tenant. Without it `persons` still answers, narrowed to the members
+	 * of the projects the caller administers — so this marks a full listing, not access to one.
+	 */
+	readonly canListPersons: Scalars['Boolean']['output']
+	/** Write the tenant configuration (`configure`) and read `authPolicies`. The CLI is the usual write path. */
+	readonly canManageConfiguration: Scalars['Boolean']['output']
+	/**  Read `authLog`, which throws otherwise.  */
+	readonly canViewAuthLog: Scalars['Boolean']['output']
+	/**  Read `configuration`, which throws otherwise. The other configuration queries gate on their own actions.  */
+	readonly canViewConfiguration: Scalars['Boolean']['output']
 }
 
 export type IdentityProjectRelation = {
@@ -1283,6 +1353,7 @@ export type Mutation = {
 	readonly disconnectMyIdentityProvider?: Maybe<DisconnectIdpResponse>
 	readonly enableIDP?: Maybe<EnableIdpResponse>
 	readonly enableMyPasswordless?: Maybe<ToggleMyPasswordlessResponse>
+	readonly enablePerson?: Maybe<EnablePersonResponse>
 	readonly forceSignOutPerson?: Maybe<ForceSignOutPersonResponse>
 	readonly initEmailOtp?: Maybe<InitEmailOtpResponse>
 	readonly initSignInIDP?: Maybe<InitSignInIdpResponse>
@@ -1452,6 +1523,10 @@ export type MutationEnableIdpArgs = {
 	identityProvider: Scalars['String']['input']
 }
 
+export type MutationEnablePersonArgs = {
+	personId: Scalars['String']['input']
+}
+
 export type MutationForceSignOutPersonArgs = {
 	personId: Scalars['String']['input']
 	reason?: InputMaybe<Scalars['String']['input']>
@@ -1611,6 +1686,11 @@ export type PasswordlessValidationType =
 
 export type Person = {
 	readonly __typename?: 'Person'
+	/**
+	 * When the account was disabled (see `disablePerson`), null while the person
+	 * is active. Read-only — flip it with `disablePerson` / `enablePerson`.
+	 */
+	readonly disabledAt?: Maybe<Scalars['DateTime']['output']>
 	readonly email?: Maybe<Scalars['String']['output']>
 	/**
 	 * Whether e-mail based one-time-password 2FA is enabled for this person
@@ -1633,7 +1713,21 @@ export type Person = {
 	readonly identityProviders: ReadonlyArray<PersonIdentityProvider>
 	readonly name?: Maybe<Scalars['String']['output']>
 	readonly otpEnabled: Scalars['Boolean']['output']
+	/**
+	 * Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+	 * policy resolved against `passwordlessEnabled`, i.e. the very same decision `signIn` makes. A UI
+	 * offering an enable/disable toggle must branch on this — under an `always` or `never` policy the
+	 * raw opt-in flag says nothing about what will happen.
+	 */
+	readonly passwordlessAvailable: Scalars['Boolean']['output']
+	/**  The person's own opt-in flag; `null` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see `passwordlessAvailable`.  */
 	readonly passwordlessEnabled?: Maybe<Scalars['Boolean']['output']>
+	/**
+	 * Whether `passwordlessEnabled` is what decides `passwordlessAvailable`. False under an `always`
+	 * or `never` policy, where the person's own flag is ignored — a UI should then report the state
+	 * rather than offer a toggle that changes nothing.
+	 */
+	readonly passwordlessSelfManaged: Scalars['Boolean']['output']
 }
 
 /**  A single external IdP connection of the currently authenticated person.  */
@@ -1678,6 +1772,8 @@ export type Project = {
 	readonly id: Scalars['String']['output']
 	readonly members: ReadonlyArray<ProjectIdentityRelation>
 	readonly name: Scalars['String']['output']
+	/**  What the calling identity may do here. Advisory — for building the UI, not for enforcing it.  */
+	readonly permissions: ProjectPermissions
 	readonly roles: ReadonlyArray<RoleDefinition>
 	/**
 	 * Names of the project's secrets (see `setProjectSecret`). Secret VALUES are
@@ -1713,6 +1809,29 @@ export type ProjectMembersInput = {
 	readonly offset?: InputMaybe<Scalars['Int']['input']>
 }
 
+/**
+ * What the calling identity may do in this project. Same contract as
+ * `IdentityGlobalPermissions`: advisory, evaluated per caller, never a substitute for the checks in
+ * the resolvers.
+ */
+export type ProjectPermissions = {
+	readonly __typename?: 'ProjectPermissions'
+	/**  Invite or add a member (`invite`, `addProjectMember`). Which roles may be granted is checked per membership.  */
+	readonly canAddMember: Scalars['Boolean']['output']
+	/**  Create an API key scoped to this project.  */
+	readonly canCreateApiKey: Scalars['Boolean']['output']
+	readonly canRemoveMember: Scalars['Boolean']['output']
+	/**  Write a project secret (`setProjectSecret`). Distinct from viewing: a project admin commonly has one and not the other.  */
+	readonly canSetSecret: Scalars['Boolean']['output']
+	/**  Update the project itself (`updateProject`).  */
+	readonly canUpdate: Scalars['Boolean']['output']
+	readonly canUpdateMember: Scalars['Boolean']['output']
+	/**  Read `members` and `apiKeys`; both answer an empty list otherwise.  */
+	readonly canViewMembers: Scalars['Boolean']['output']
+	/**  Read `secrets` (their names, never values); answers an empty list otherwise.  */
+	readonly canViewSecrets: Scalars['Boolean']['output']
+}
+
 export type ProjectSecret = {
 	readonly key: Scalars['String']['input']
 	readonly value: Scalars['String']['input']
@@ -2488,6 +2607,8 @@ export type ResolversTypes = {
 	ConfigLoginAnomalyDetection: ResolverTypeWrapper<ConfigLoginAnomalyDetection>
 	ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput
 	ConfigLoginInput: ConfigLoginInput
+	ConfigPanel: ResolverTypeWrapper<ConfigPanel>
+	ConfigPanelInput: ConfigPanelInput
 	ConfigPassword: ResolverTypeWrapper<ConfigPassword>
 	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ResolverTypeWrapper<ConfigPasswordless>
@@ -2561,6 +2682,9 @@ export type ResolversTypes = {
 	EnableIDPError: ResolverTypeWrapper<EnableIdpError>
 	EnableIDPErrorCode: EnableIdpErrorCode
 	EnableIDPResponse: ResolverTypeWrapper<EnableIdpResponse>
+	EnablePersonError: ResolverTypeWrapper<EnablePersonError>
+	EnablePersonErrorCode: EnablePersonErrorCode
+	EnablePersonResponse: ResolverTypeWrapper<EnablePersonResponse>
 	Float: ResolverTypeWrapper<Scalars['Float']['output']>
 	ForceSignOutPersonError: ResolverTypeWrapper<ForceSignOutPersonError>
 	ForceSignOutPersonErrorCode: ForceSignOutPersonErrorCode
@@ -2626,6 +2750,7 @@ export type ResolversTypes = {
 	ProjectIdentityRelation: ResolverTypeWrapper<Omit<ProjectIdentityRelation, 'identity'> & { identity: ResolversTypes['Identity'] }>
 	ProjectMembersFilter: ProjectMembersFilter
 	ProjectMembersInput: ProjectMembersInput
+	ProjectPermissions: ResolverTypeWrapper<ProjectPermissions>
 	ProjectSecret: ProjectSecret
 	ProjectSecretInfo: ResolverTypeWrapper<ProjectSecretInfo>
 	Query: ResolverTypeWrapper<Record<PropertyKey, never>>
@@ -2757,6 +2882,8 @@ export type ResolversParentTypes = {
 	ConfigLoginAnomalyDetection: ConfigLoginAnomalyDetection
 	ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput
 	ConfigLoginInput: ConfigLoginInput
+	ConfigPanel: ConfigPanel
+	ConfigPanelInput: ConfigPanelInput
 	ConfigPassword: ConfigPassword
 	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ConfigPasswordless
@@ -2812,6 +2939,8 @@ export type ResolversParentTypes = {
 	EmailVerificationOptions: EmailVerificationOptions
 	EnableIDPError: EnableIdpError
 	EnableIDPResponse: EnableIdpResponse
+	EnablePersonError: EnablePersonError
+	EnablePersonResponse: EnablePersonResponse
 	Float: Scalars['Float']['output']
 	ForceSignOutPersonError: ForceSignOutPersonError
 	ForceSignOutPersonResponse: ForceSignOutPersonResponse
@@ -2863,6 +2992,7 @@ export type ResolversParentTypes = {
 	ProjectIdentityRelation: Omit<ProjectIdentityRelation, 'identity'> & { identity: ResolversParentTypes['Identity'] }
 	ProjectMembersFilter: ProjectMembersFilter
 	ProjectMembersInput: ProjectMembersInput
+	ProjectPermissions: ProjectPermissions
 	ProjectSecret: ProjectSecret
 	ProjectSecretInfo: ProjectSecretInfo
 	Query: Record<PropertyKey, never>
@@ -3159,6 +3289,7 @@ export type ConfigResolvers<ContextType = any, ParentType extends ResolversParen
 	captcha?: Resolver<ResolversTypes['ConfigCaptcha'], ParentType, ContextType>
 	emailChange?: Resolver<ResolversTypes['ConfigEmailChange'], ParentType, ContextType>
 	login?: Resolver<ResolversTypes['ConfigLogin'], ParentType, ContextType>
+	panel?: Resolver<ResolversTypes['ConfigPanel'], ParentType, ContextType>
 	password?: Resolver<ResolversTypes['ConfigPassword'], ParentType, ContextType>
 	passwordless?: Resolver<ResolversTypes['ConfigPasswordless'], ParentType, ContextType>
 	rateLimits?: Resolver<ResolversTypes['ConfigRateLimits'], ParentType, ContextType>
@@ -3213,6 +3344,11 @@ export type ConfigLoginAnomalyDetectionResolvers<
 	stepUpThreshold?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
 }
 
+export type ConfigPanelResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPanel'] = ResolversParentTypes['ConfigPanel']> = {
+	globalRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+	projectRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+}
+
 export type ConfigPasswordResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ConfigPassword'] = ResolversParentTypes['ConfigPassword'],
@@ -3598,6 +3734,22 @@ export type EnableIdpResponseResolvers<
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
+export type EnablePersonErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['EnablePersonError'] = ResolversParentTypes['EnablePersonError'],
+> = {
+	code?: Resolver<ResolversTypes['EnablePersonErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type EnablePersonResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['EnablePersonResponse'] = ResolversParentTypes['EnablePersonResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['EnablePersonError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type ForceSignOutPersonErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ForceSignOutPersonError'] = ResolversParentTypes['ForceSignOutPersonError'],
@@ -3640,8 +3792,16 @@ export type IdentityGlobalPermissionsResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['IdentityGlobalPermissions'] = ResolversParentTypes['IdentityGlobalPermissions'],
 > = {
+	canCreateGlobalApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	canCreateProject?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	canDeployEntrypoint?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListGlobalApiKeys?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListIdentityProviders?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListMailTemplates?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListPersons?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canManageConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewAuthLog?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type IdentityProjectRelationResolvers<
@@ -3938,6 +4098,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 	>
 	enableIDP?: Resolver<Maybe<ResolversTypes['EnableIDPResponse']>, ParentType, ContextType, RequireFields<MutationEnableIdpArgs, 'identityProvider'>>
 	enableMyPasswordless?: Resolver<Maybe<ResolversTypes['ToggleMyPasswordlessResponse']>, ParentType, ContextType>
+	enablePerson?: Resolver<Maybe<ResolversTypes['EnablePersonResponse']>, ParentType, ContextType, RequireFields<MutationEnablePersonArgs, 'personId'>>
 	forceSignOutPerson?: Resolver<
 		Maybe<ResolversTypes['ForceSignOutPersonResponse']>,
 		ParentType,
@@ -4058,6 +4219,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 }
 
 export type PersonResolvers<ContextType = any, ParentType extends ResolversParentTypes['Person'] = ResolversParentTypes['Person']> = {
+	disabledAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
 	email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	emailOtpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	emailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
@@ -4066,7 +4228,9 @@ export type PersonResolvers<ContextType = any, ParentType extends ResolversParen
 	identityProviders?: Resolver<ReadonlyArray<ResolversTypes['PersonIdentityProvider']>, ParentType, ContextType>
 	name?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	otpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	passwordlessAvailable?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	passwordlessEnabled?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>
+	passwordlessSelfManaged?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type PersonIdentityProviderResolvers<
@@ -4101,6 +4265,7 @@ export type ProjectResolvers<ContextType = any, ParentType extends ResolversPare
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	members?: Resolver<ReadonlyArray<ResolversTypes['ProjectIdentityRelation']>, ParentType, ContextType, Partial<ProjectMembersArgs>>
 	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	permissions?: Resolver<ResolversTypes['ProjectPermissions'], ParentType, ContextType>
 	roles?: Resolver<ReadonlyArray<ResolversTypes['RoleDefinition']>, ParentType, ContextType>
 	secrets?: Resolver<ReadonlyArray<ResolversTypes['ProjectSecretInfo']>, ParentType, ContextType>
 	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
@@ -4114,6 +4279,20 @@ export type ProjectIdentityRelationResolvers<
 	memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>
 }
 
+export type ProjectPermissionsResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ProjectPermissions'] = ResolversParentTypes['ProjectPermissions'],
+> = {
+	canAddMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canCreateApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canRemoveMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canSetSecret?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canUpdate?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canUpdateMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewMembers?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewSecrets?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type ProjectSecretInfoResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ProjectSecretInfo'] = ResolversParentTypes['ProjectSecretInfo'],
@@ -4635,6 +4814,7 @@ export type Resolvers<ContextType = any> = {
 	ConfigEmailChange?: ConfigEmailChangeResolvers<ContextType>
 	ConfigLogin?: ConfigLoginResolvers<ContextType>
 	ConfigLoginAnomalyDetection?: ConfigLoginAnomalyDetectionResolvers<ContextType>
+	ConfigPanel?: ConfigPanelResolvers<ContextType>
 	ConfigPassword?: ConfigPasswordResolvers<ContextType>
 	ConfigPasswordless?: ConfigPasswordlessResolvers<ContextType>
 	ConfigRateLimitWindow?: ConfigRateLimitWindowResolvers<ContextType>
@@ -4681,6 +4861,8 @@ export type Resolvers<ContextType = any> = {
 	DisconnectIDPResponse?: DisconnectIdpResponseResolvers<ContextType>
 	EnableIDPError?: EnableIdpErrorResolvers<ContextType>
 	EnableIDPResponse?: EnableIdpResponseResolvers<ContextType>
+	EnablePersonError?: EnablePersonErrorResolvers<ContextType>
+	EnablePersonResponse?: EnablePersonResponseResolvers<ContextType>
 	ForceSignOutPersonError?: ForceSignOutPersonErrorResolvers<ContextType>
 	ForceSignOutPersonResponse?: ForceSignOutPersonResponseResolvers<ContextType>
 	IDPOptionsOutput?: IdpOptionsOutputResolvers<ContextType>
@@ -4713,6 +4895,7 @@ export type Resolvers<ContextType = any> = {
 	PrepareOtpResult?: PrepareOtpResultResolvers<ContextType>
 	Project?: ProjectResolvers<ContextType>
 	ProjectIdentityRelation?: ProjectIdentityRelationResolvers<ContextType>
+	ProjectPermissions?: ProjectPermissionsResolvers<ContextType>
 	ProjectSecretInfo?: ProjectSecretInfoResolvers<ContextType>
 	Query?: QueryResolvers<ContextType>
 	RegenerateBackupCodesError?: RegenerateBackupCodesErrorResolvers<ContextType>