@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/types/resolvers/types/PersonTypeResolver.d.ts

@@ -1,9 +1,23 @@
 import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js';
 import { PersonIdentityProviderManager } from '../../model/index.js';
 import { TenantResolverContext } from '../TenantResolverContext.js';
-export declare class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders'> {
+export declare class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders' | 'passwordlessAvailable' | 'passwordlessSelfManaged'> {
     private readonly personIdentityProviderManager;
+    /**
+     * One configuration read per request rather than per person: `person$$` selects every scalar, so
+     * listing N people would otherwise issue N identical config queries. Keyed on the resolver context,
+     * which is built once per operation and collected with it.
+     */
+    private readonly configurationByRequest;
     constructor(personIdentityProviderManager: PersonIdentityProviderManager);
+    /**
+     * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a
+     * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,
+     * which an ordinary person does not have).
+     */
+    passwordlessAvailable(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean>;
+    passwordlessSelfManaged(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean>;
+    private configuration;
     identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]>;
 }
 //# sourceMappingURL=PersonTypeResolver.d.ts.map

package/dist/types/resolvers/types/PersonTypeResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTypeResolver.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/types/PersonTypeResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvF,OAAO,EAAoC,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAEnE,qBAAa,kBAAmB,YAAW,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAEnF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;gBAA7B,6BAA6B,EAAE,6BAA6B;IAIxE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;CA2BzH"}
+{"version":3,"file":"PersonTypeResolver.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/types/PersonTypeResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvF,OAAO,EAAqE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAEvI,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAEnE,qBAAa,kBAAmB,YAAW,IAAI,CAAC,eAAe,EAAE,mBAAmB,GAAG,uBAAuB,GAAG,yBAAyB,CAAC;IASzI,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAR/C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAwD;IAE/F,YACkB,6BAA6B,EAAE,6BAA6B,EAE7E;IAED;;;;OAIG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3G;IAEK,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG7G;IAED,OAAO,CAAC,aAAa;IAUf,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA0BxH;CACD"}

package/dist/types/resolvers/types/ProjectTypeResolver.d.ts

@@ -1,4 +1,4 @@
-import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js';
+import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectPermissions, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js';
 import { TenantResolverContext } from '../TenantResolverContext.js';
 import { Project, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js';
 import { Acl } from '@contember/schema';
@@ -10,23 +10,32 @@ export declare class ProjectTypeResolver implements ProjectResolvers {
     apiKeys(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]>;
     secrets(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext): Promise<readonly ProjectSecretInfo[]>;
     members(parent: Omit<Project, 'config'>, args: ProjectMembersArgs, context: TenantResolverContext): Promise<readonly ProjectIdentityRelation[]>;
+    /**
+     * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is
+     * checked again where it is used, so answering `true` here grants nothing.
+     *
+     * The membership-parameterized actions are asked with an empty membership list, the same coarse
+     * "do you hold this at all" question `apiKeys` and `members` already ask — which roles may
+     * actually be granted is still decided per membership when the mutation runs.
+     */
+    permissions(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext): Promise<ProjectPermissions>;
     roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext): Promise<{
         name: string;
         variables: ({
-            __typename: "RoleEntityVariableDefinition";
+            __typename: 'RoleEntityVariableDefinition';
             name: string;
             entityName: string;
             value?: undefined;
         } | {
-            __typename: "RolePredefinedVariableDefinition";
+            entityName?: undefined;
+            __typename: 'RolePredefinedVariableDefinition';
             name: string;
             value: Acl.PredefinedVariableValue;
-            entityName?: undefined;
         } | {
-            __typename: "RoleConditionVariableDefinition";
-            name: string;
             entityName?: undefined;
             value?: undefined;
+            __typename: 'RoleConditionVariableDefinition';
+            name: string;
         })[];
     }[]>;
 }

package/dist/types/resolvers/types/ProjectTypeResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/types/ProjectTypeResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAChI,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAqB,OAAO,EAAuB,oBAAoB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAEnJ,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,qBAAa,mBAAoB,YAAW,gBAAgB;IAE1D,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAFd,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc;IAG1C,OAAO,CACZ,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IASvB,OAAO,CACZ,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IASlC,OAAO,CACZ,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC;IA4BxC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB;;;;;;;;;;;;;;;;;;;CAmB1F"}
+{"version":3,"file":"ProjectTypeResolver.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/types/ProjectTypeResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEpJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAqB,OAAO,EAAuB,oBAAoB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAEnJ,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,qBAAa,mBAAoB,YAAW,gBAAgB;IAE1D,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAHhC,YACkB,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc,EAC5C;IAEE,OAAO,CACZ,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO5B;IAEK,OAAO,CACZ,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAOvC;IAEK,OAAO,CACZ,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CA0B7C;IAED;;;;;;;OAOG;IACG,WAAW,CAChB,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAiB7B;IAEK,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB;;;wBAUhE,8BAA8B;;;;;;wBAE9B,kCAAkC;;;;;;wBAElC,iCAAiC;;;SAI1D;CACD"}

package/dist/types/schema/index.d.ts

@@ -303,6 +303,7 @@ export type Config = {
     readonly captcha: ConfigCaptcha;
     readonly emailChange: ConfigEmailChange;
     readonly login: ConfigLogin;
+    readonly panel: ConfigPanel;
     readonly password: ConfigPassword;
     readonly passwordless: ConfigPasswordless;
     readonly rateLimits: ConfigRateLimits;
@@ -364,6 +365,7 @@ export type ConfigInput = {
     readonly captcha?: InputMaybe<ConfigCaptchaInput>;
     readonly emailChange?: InputMaybe<ConfigEmailChangeInput>;
     readonly login?: InputMaybe<ConfigLoginInput>;
+    readonly panel?: InputMaybe<ConfigPanelInput>;
     readonly password?: InputMaybe<ConfigPasswordInput>;
     readonly passwordless?: InputMaybe<ConfigPasswordlessInput>;
     readonly rateLimits?: InputMaybe<ConfigRateLimitsInput>;
@@ -424,6 +426,29 @@ export type ConfigLoginInput = {
     readonly revealLoginMethod?: InputMaybe<Scalars['Boolean']['input']>;
     readonly revealUserExists?: InputMaybe<Scalars['Boolean']['input']>;
 };
+/**
+ * Who may enter the management panel. This is an entry gate for the console
+ * only, not an authorization system: everything done inside the panel still
+ * goes through the tenant ACL, so being allowed in grants no extra rights.
+ * An identity may enter when its global roles intersect globalRoles, or when
+ * it holds a membership with one of projectRoles in at least one project.
+ * Both lists empty means nobody can enter.
+ */
+export type ConfigPanel = {
+    readonly __typename?: 'ConfigPanel';
+    /** Global roles (identity.roles) that may use the management panel. */
+    readonly globalRoles: ReadonlyArray<Scalars['String']['output']>;
+    /** Project membership roles that may use the management panel, in any project. */
+    readonly projectRoles: ReadonlyArray<Scalars['String']['output']>;
+};
+/**
+ * Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+ * list closes the panel for that dimension.
+ */
+export type ConfigPanelInput = {
+    readonly globalRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>;
+    readonly projectRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>;
+};
 export type ConfigPassword = {
     readonly __typename?: 'ConfigPassword';
     readonly checkBlacklist: Scalars['Boolean']['output'];
@@ -750,8 +775,13 @@ export type DisconnectIdpError = {
     readonly developerMessage: Scalars['String']['output'];
 };
 export type DisconnectIdpErrorCode = 
+/**
+ * The provider has `disableLocalAuthentication`, so this connection is the only way
+ * the person may sign in and cannot be removed by them — not even while the provider is disabled.
+ */
+'IDP_REQUIRED'
 /**  The person is not allowed to disconnect their last remaining sign-in method.  */
-'LAST_AUTH_METHOD'
+ | 'LAST_AUTH_METHOD'
 /**  The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect.  */
  | 'NOT_A_PERSON'
 /**  The authenticated person has no IdP connection with the given id.  */
@@ -776,6 +806,17 @@ export type EnableIdpResponse = {
     readonly error?: Maybe<EnableIdpError>;
     readonly ok: Scalars['Boolean']['output'];
 };
+export type EnablePersonError = {
+    readonly __typename?: 'EnablePersonError';
+    readonly code: EnablePersonErrorCode;
+    readonly developerMessage: Scalars['String']['output'];
+};
+export type EnablePersonErrorCode = 'PERSON_ALREADY_ENABLED' | 'PERSON_NOT_FOUND';
+export type EnablePersonResponse = {
+    readonly __typename?: 'EnablePersonResponse';
+    readonly error?: Maybe<EnablePersonError>;
+    readonly ok: Scalars['Boolean']['output'];
+};
 export type ForceSignOutPersonError = {
     readonly __typename?: 'ForceSignOutPersonError';
     readonly code: ForceSignOutPersonErrorCode;
@@ -790,6 +831,7 @@ export type ForceSignOutPersonResponse = {
 export type IdpOptions = {
     readonly assumeEmailVerified?: InputMaybe<Scalars['Boolean']['input']>;
     readonly autoSignUp?: InputMaybe<Scalars['Boolean']['input']>;
+    readonly disableLocalAuthentication?: InputMaybe<Scalars['Boolean']['input']>;
     readonly exclusive?: InputMaybe<Scalars['Boolean']['input']>;
     readonly initReturnsConfig?: InputMaybe<Scalars['Boolean']['input']>;
     readonly requireVerifiedEmail?: InputMaybe<Scalars['Boolean']['input']>;
@@ -803,6 +845,13 @@ export type IdpOptionsOutput = {
      */
     readonly assumeEmailVerified: Scalars['Boolean']['output'];
     readonly autoSignUp: Scalars['Boolean']['output'];
+    /**
+     * When true, a person linked to this provider may authenticate ONLY through it:
+     * password sign-in and passwordless sign-in are refused and no password-reset
+     * mail is sent. Disabling the provider lifts the restriction, which is the
+     * break-glass for an IdP outage. Defaults to false.
+     */
+    readonly disableLocalAuthentication: Scalars['Boolean']['output'];
     readonly exclusive: Scalars['Boolean']['output'];
     readonly initReturnsConfig: Scalars['Boolean']['output'];
     /**
@@ -835,10 +884,37 @@ export type Identity = {
      */
     readonly sessions: ReadonlyArray<SessionInfo>;
 };
+/**
+ * What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+ *
+ * This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+ * boundary, and answering `true` here grants nothing. Every operation is still checked when it is
+ * called. The distinction matters because permission failure is not uniform across this API: some
+ * queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+ * "nothing to show" from "not yours to see" by trying.
+ */
 export type IdentityGlobalPermissions = {
     readonly __typename?: 'IdentityGlobalPermissions';
+    readonly canCreateGlobalApiKey: Scalars['Boolean']['output'];
     readonly canCreateProject: Scalars['Boolean']['output'];
     readonly canDeployEntrypoint: Scalars['Boolean']['output'];
+    /**  Read `globalApiKeys`, which answers an empty list otherwise.  */
+    readonly canListGlobalApiKeys: Scalars['Boolean']['output'];
+    /**  Read `identityProviders`.  */
+    readonly canListIdentityProviders: Scalars['Boolean']['output'];
+    /**  Read `mailTemplates`.  */
+    readonly canListMailTemplates: Scalars['Boolean']['output'];
+    /**
+     * List every person in the tenant. Without it `persons` still answers, narrowed to the members
+     * of the projects the caller administers — so this marks a full listing, not access to one.
+     */
+    readonly canListPersons: Scalars['Boolean']['output'];
+    /** Write the tenant configuration (`configure`) and read `authPolicies`. The CLI is the usual write path. */
+    readonly canManageConfiguration: Scalars['Boolean']['output'];
+    /**  Read `authLog`, which throws otherwise.  */
+    readonly canViewAuthLog: Scalars['Boolean']['output'];
+    /**  Read `configuration`, which throws otherwise. The other configuration queries gate on their own actions.  */
+    readonly canViewConfiguration: Scalars['Boolean']['output'];
 };
 export type IdentityProjectRelation = {
     readonly __typename?: 'IdentityProjectRelation';
@@ -898,7 +974,12 @@ export type InitSignInPasswordlessError = {
     readonly code: InitSignInPasswordlessErrorCode;
     readonly developerMessage: Scalars['String']['output'];
 };
-export type InitSignInPasswordlessErrorCode = 'INVALID_CAPTCHA' | 'PASSWORDLESS_DISABLED' | 'PERSON_NOT_FOUND' | 'RATE_LIMIT_EXCEEDED';
+export type InitSignInPasswordlessErrorCode = 
+/**
+ * The person is linked to an identity provider with
+ * `disableLocalAuthentication`, so passwordless sign-in is not available to them.
+ */
+'IDP_REQUIRED' | 'INVALID_CAPTCHA' | 'PASSWORDLESS_DISABLED' | 'PERSON_NOT_FOUND' | 'RATE_LIMIT_EXCEEDED';
 export type InitSignInPasswordlessOptions = {
     readonly mailProject?: InputMaybe<Scalars['String']['input']>;
     readonly mailVariant?: InputMaybe<Scalars['String']['input']>;
@@ -1033,6 +1114,7 @@ export type Mutation = {
     readonly disconnectMyIdentityProvider?: Maybe<DisconnectIdpResponse>;
     readonly enableIDP?: Maybe<EnableIdpResponse>;
     readonly enableMyPasswordless?: Maybe<ToggleMyPasswordlessResponse>;
+    readonly enablePerson?: Maybe<EnablePersonResponse>;
     readonly forceSignOutPerson?: Maybe<ForceSignOutPersonResponse>;
     readonly initEmailOtp?: Maybe<InitEmailOtpResponse>;
     readonly initSignInIDP?: Maybe<InitSignInIdpResponse>;
@@ -1175,6 +1257,9 @@ export type MutationDisconnectMyIdentityProviderArgs = {
 export type MutationEnableIdpArgs = {
     identityProvider: Scalars['String']['input'];
 };
+export type MutationEnablePersonArgs = {
+    personId: Scalars['String']['input'];
+};
 export type MutationForceSignOutPersonArgs = {
     personId: Scalars['String']['input'];
     reason?: InputMaybe<Scalars['String']['input']>;
@@ -1306,6 +1391,11 @@ export type MutationVerifyEmailArgs = {
 export type PasswordlessValidationType = 'otp' | 'token';
 export type Person = {
     readonly __typename?: 'Person';
+    /**
+     * When the account was disabled (see `disablePerson`), null while the person
+     * is active. Read-only — flip it with `disablePerson` / `enablePerson`.
+     */
+    readonly disabledAt?: Maybe<Scalars['DateTime']['output']>;
     readonly email?: Maybe<Scalars['String']['output']>;
     /**
      * Whether e-mail based one-time-password 2FA is enabled for this person
@@ -1328,7 +1418,21 @@ export type Person = {
     readonly identityProviders: ReadonlyArray<PersonIdentityProvider>;
     readonly name?: Maybe<Scalars['String']['output']>;
     readonly otpEnabled: Scalars['Boolean']['output'];
+    /**
+     * Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+     * policy resolved against `passwordlessEnabled`, i.e. the very same decision `signIn` makes. A UI
+     * offering an enable/disable toggle must branch on this — under an `always` or `never` policy the
+     * raw opt-in flag says nothing about what will happen.
+     */
+    readonly passwordlessAvailable: Scalars['Boolean']['output'];
+    /**  The person's own opt-in flag; `null` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see `passwordlessAvailable`.  */
     readonly passwordlessEnabled?: Maybe<Scalars['Boolean']['output']>;
+    /**
+     * Whether `passwordlessEnabled` is what decides `passwordlessAvailable`. False under an `always`
+     * or `never` policy, where the person's own flag is ignored — a UI should then report the state
+     * rather than offer a toggle that changes nothing.
+     */
+    readonly passwordlessSelfManaged: Scalars['Boolean']['output'];
 };
 /**  A single external IdP connection of the currently authenticated person.  */
 export type PersonIdentityProvider = {
@@ -1368,6 +1472,8 @@ export type Project = {
     readonly id: Scalars['String']['output'];
     readonly members: ReadonlyArray<ProjectIdentityRelation>;
     readonly name: Scalars['String']['output'];
+    /**  What the calling identity may do here. Advisory — for building the UI, not for enforcing it.  */
+    readonly permissions: ProjectPermissions;
     readonly roles: ReadonlyArray<RoleDefinition>;
     /**
      * Names of the project's secrets (see `setProjectSecret`). Secret VALUES are
@@ -1398,6 +1504,28 @@ export type ProjectMembersInput = {
     readonly limit?: InputMaybe<Scalars['Int']['input']>;
     readonly offset?: InputMaybe<Scalars['Int']['input']>;
 };
+/**
+ * What the calling identity may do in this project. Same contract as
+ * `IdentityGlobalPermissions`: advisory, evaluated per caller, never a substitute for the checks in
+ * the resolvers.
+ */
+export type ProjectPermissions = {
+    readonly __typename?: 'ProjectPermissions';
+    /**  Invite or add a member (`invite`, `addProjectMember`). Which roles may be granted is checked per membership.  */
+    readonly canAddMember: Scalars['Boolean']['output'];
+    /**  Create an API key scoped to this project.  */
+    readonly canCreateApiKey: Scalars['Boolean']['output'];
+    readonly canRemoveMember: Scalars['Boolean']['output'];
+    /**  Write a project secret (`setProjectSecret`). Distinct from viewing: a project admin commonly has one and not the other.  */
+    readonly canSetSecret: Scalars['Boolean']['output'];
+    /**  Update the project itself (`updateProject`).  */
+    readonly canUpdate: Scalars['Boolean']['output'];
+    readonly canUpdateMember: Scalars['Boolean']['output'];
+    /**  Read `members` and `apiKeys`; both answer an empty list otherwise.  */
+    readonly canViewMembers: Scalars['Boolean']['output'];
+    /**  Read `secrets` (their names, never values); answers an empty list otherwise.  */
+    readonly canViewSecrets: Scalars['Boolean']['output'];
+};
 export type ProjectSecret = {
     readonly key: Scalars['String']['input'];
     readonly value: Scalars['String']['input'];
@@ -1654,7 +1782,12 @@ export type SignInError = {
     readonly mfaEnrollment?: Maybe<MfaEnrollment>;
     readonly retryAfter?: Maybe<Scalars['Int']['output']>;
 };
-export type SignInErrorCode = 'EMAIL_NOT_VERIFIED' | 'INVALID_CREDENTIALS' | 'INVALID_OTP_TOKEN' | 'INVALID_PASSWORD' | 'MFA_ENROLLMENT_REQUIRED' | 'NO_PASSWORD_SET' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'RATE_LIMIT_EXCEEDED' | 'UNKNOWN_EMAIL';
+export type SignInErrorCode = 'EMAIL_NOT_VERIFIED'
+/**
+ * The person is linked to an identity provider with
+ * `disableLocalAuthentication`, so password sign-in is not available to them.
+ */
+ | 'IDP_REQUIRED' | 'INVALID_CREDENTIALS' | 'INVALID_OTP_TOKEN' | 'INVALID_PASSWORD' | 'MFA_ENROLLMENT_REQUIRED' | 'NO_PASSWORD_SET' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'RATE_LIMIT_EXCEEDED' | 'UNKNOWN_EMAIL';
 export type SignInIdpError = {
     readonly __typename?: 'SignInIDPError';
     readonly code: SignInIdpErrorCode;
@@ -1697,7 +1830,12 @@ export type SignInPasswordlessError = {
     readonly code: SignInPasswordlessErrorCode;
     readonly developerMessage: Scalars['String']['output'];
 };
-export type SignInPasswordlessErrorCode = 'INVALID_OTP_TOKEN' | 'MFA_ENROLLMENT_REQUIRED' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'TOKEN_NOT_FOUND' | 'TOKEN_USED';
+export type SignInPasswordlessErrorCode = 
+/**
+ * The person became linked to an identity provider with
+ * `disableLocalAuthentication` after this magic link was issued.
+ */
+'IDP_REQUIRED' | 'INVALID_OTP_TOKEN' | 'MFA_ENROLLMENT_REQUIRED' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'TOKEN_NOT_FOUND' | 'TOKEN_USED';
 export type SignInPasswordlessResponse = {
     readonly __typename?: 'SignInPasswordlessResponse';
     readonly error?: Maybe<SignInPasswordlessError>;
@@ -1956,6 +2094,8 @@ export type ResolversTypes = {
     ConfigLoginAnomalyDetection: ResolverTypeWrapper<ConfigLoginAnomalyDetection>;
     ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput;
     ConfigLoginInput: ConfigLoginInput;
+    ConfigPanel: ResolverTypeWrapper<ConfigPanel>;
+    ConfigPanelInput: ConfigPanelInput;
     ConfigPassword: ResolverTypeWrapper<ConfigPassword>;
     ConfigPasswordInput: ConfigPasswordInput;
     ConfigPasswordless: ResolverTypeWrapper<ConfigPasswordless>;
@@ -2037,6 +2177,9 @@ export type ResolversTypes = {
     EnableIDPError: ResolverTypeWrapper<EnableIdpError>;
     EnableIDPErrorCode: EnableIdpErrorCode;
     EnableIDPResponse: ResolverTypeWrapper<EnableIdpResponse>;
+    EnablePersonError: ResolverTypeWrapper<EnablePersonError>;
+    EnablePersonErrorCode: EnablePersonErrorCode;
+    EnablePersonResponse: ResolverTypeWrapper<EnablePersonResponse>;
     Float: ResolverTypeWrapper<Scalars['Float']['output']>;
     ForceSignOutPersonError: ResolverTypeWrapper<ForceSignOutPersonError>;
     ForceSignOutPersonErrorCode: ForceSignOutPersonErrorCode;
@@ -2104,6 +2247,7 @@ export type ResolversTypes = {
     }>;
     ProjectMembersFilter: ProjectMembersFilter;
     ProjectMembersInput: ProjectMembersInput;
+    ProjectPermissions: ResolverTypeWrapper<ProjectPermissions>;
     ProjectSecret: ProjectSecret;
     ProjectSecretInfo: ResolverTypeWrapper<ProjectSecretInfo>;
     Query: ResolverTypeWrapper<Record<PropertyKey, never>>;
@@ -2244,6 +2388,8 @@ export type ResolversParentTypes = {
     ConfigLoginAnomalyDetection: ConfigLoginAnomalyDetection;
     ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput;
     ConfigLoginInput: ConfigLoginInput;
+    ConfigPanel: ConfigPanel;
+    ConfigPanelInput: ConfigPanelInput;
     ConfigPassword: ConfigPassword;
     ConfigPasswordInput: ConfigPasswordInput;
     ConfigPasswordless: ConfigPasswordless;
@@ -2307,6 +2453,8 @@ export type ResolversParentTypes = {
     EmailVerificationOptions: EmailVerificationOptions;
     EnableIDPError: EnableIdpError;
     EnableIDPResponse: EnableIdpResponse;
+    EnablePersonError: EnablePersonError;
+    EnablePersonResponse: EnablePersonResponse;
     Float: Scalars['Float']['output'];
     ForceSignOutPersonError: ForceSignOutPersonError;
     ForceSignOutPersonResponse: ForceSignOutPersonResponse;
@@ -2364,6 +2512,7 @@ export type ResolversParentTypes = {
     };
     ProjectMembersFilter: ProjectMembersFilter;
     ProjectMembersInput: ProjectMembersInput;
+    ProjectPermissions: ProjectPermissions;
     ProjectSecret: ProjectSecret;
     ProjectSecretInfo: ProjectSecretInfo;
     Query: Record<PropertyKey, never>;
@@ -2573,6 +2722,7 @@ export type ConfigResolvers<ContextType = any, ParentType extends ResolversParen
     captcha?: Resolver<ResolversTypes['ConfigCaptcha'], ParentType, ContextType>;
     emailChange?: Resolver<ResolversTypes['ConfigEmailChange'], ParentType, ContextType>;
     login?: Resolver<ResolversTypes['ConfigLogin'], ParentType, ContextType>;
+    panel?: Resolver<ResolversTypes['ConfigPanel'], ParentType, ContextType>;
     password?: Resolver<ResolversTypes['ConfigPassword'], ParentType, ContextType>;
     passwordless?: Resolver<ResolversTypes['ConfigPasswordless'], ParentType, ContextType>;
     rateLimits?: Resolver<ResolversTypes['ConfigRateLimits'], ParentType, ContextType>;
@@ -2609,6 +2759,10 @@ export type ConfigLoginAnomalyDetectionResolvers<ContextType = any, ParentType e
     historySize?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
     stepUpThreshold?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
 };
+export type ConfigPanelResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPanel'] = ResolversParentTypes['ConfigPanel']> = {
+    globalRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>;
+    projectRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>;
+};
 export type ConfigPasswordResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPassword'] = ResolversParentTypes['ConfigPassword']> = {
     checkBlacklist?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     checkHibp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
@@ -2815,6 +2969,14 @@ export type EnableIdpResponseResolvers<ContextType = any, ParentType extends Res
     error?: Resolver<Maybe<ResolversTypes['EnableIDPError']>, ParentType, ContextType>;
     ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
+export type EnablePersonErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['EnablePersonError'] = ResolversParentTypes['EnablePersonError']> = {
+    code?: Resolver<ResolversTypes['EnablePersonErrorCode'], ParentType, ContextType>;
+    developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type EnablePersonResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['EnablePersonResponse'] = ResolversParentTypes['EnablePersonResponse']> = {
+    error?: Resolver<Maybe<ResolversTypes['EnablePersonError']>, ParentType, ContextType>;
+    ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type ForceSignOutPersonErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['ForceSignOutPersonError'] = ResolversParentTypes['ForceSignOutPersonError']> = {
     code?: Resolver<ResolversTypes['ForceSignOutPersonErrorCode'], ParentType, ContextType>;
     developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -2826,6 +2988,7 @@ export type ForceSignOutPersonResponseResolvers<ContextType = any, ParentType ex
 export type IdpOptionsOutputResolvers<ContextType = any, ParentType extends ResolversParentTypes['IDPOptionsOutput'] = ResolversParentTypes['IDPOptionsOutput']> = {
     assumeEmailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     autoSignUp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    disableLocalAuthentication?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     exclusive?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     initReturnsConfig?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     requireVerifiedEmail?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
@@ -2841,8 +3004,16 @@ export type IdentityResolvers<ContextType = any, ParentType extends ResolversPar
     sessions?: Resolver<ReadonlyArray<ResolversTypes['SessionInfo']>, ParentType, ContextType>;
 };
 export type IdentityGlobalPermissionsResolvers<ContextType = any, ParentType extends ResolversParentTypes['IdentityGlobalPermissions'] = ResolversParentTypes['IdentityGlobalPermissions']> = {
+    canCreateGlobalApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     canCreateProject?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     canDeployEntrypoint?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListGlobalApiKeys?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListIdentityProviders?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListMailTemplates?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListPersons?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canManageConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewAuthLog?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
 export type IdentityProjectRelationResolvers<ContextType = any, ParentType extends ResolversParentTypes['IdentityProjectRelation'] = ResolversParentTypes['IdentityProjectRelation']> = {
     memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>;
@@ -2972,6 +3143,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
     disconnectMyIdentityProvider?: Resolver<Maybe<ResolversTypes['DisconnectIDPResponse']>, ParentType, ContextType, RequireFields<MutationDisconnectMyIdentityProviderArgs, 'id'>>;
     enableIDP?: Resolver<Maybe<ResolversTypes['EnableIDPResponse']>, ParentType, ContextType, RequireFields<MutationEnableIdpArgs, 'identityProvider'>>;
     enableMyPasswordless?: Resolver<Maybe<ResolversTypes['ToggleMyPasswordlessResponse']>, ParentType, ContextType>;
+    enablePerson?: Resolver<Maybe<ResolversTypes['EnablePersonResponse']>, ParentType, ContextType, RequireFields<MutationEnablePersonArgs, 'personId'>>;
     forceSignOutPerson?: Resolver<Maybe<ResolversTypes['ForceSignOutPersonResponse']>, ParentType, ContextType, RequireFields<MutationForceSignOutPersonArgs, 'personId'>>;
     initEmailOtp?: Resolver<Maybe<ResolversTypes['InitEmailOtpResponse']>, ParentType, ContextType>;
     initSignInIDP?: Resolver<Maybe<ResolversTypes['InitSignInIDPResponse']>, ParentType, ContextType, RequireFields<MutationInitSignInIdpArgs, 'identityProvider'>>;
@@ -3001,6 +3173,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
     verifyEmail?: Resolver<Maybe<ResolversTypes['VerifyEmailResponse']>, ParentType, ContextType, RequireFields<MutationVerifyEmailArgs, 'token'>>;
 };
 export type PersonResolvers<ContextType = any, ParentType extends ResolversParentTypes['Person'] = ResolversParentTypes['Person']> = {
+    disabledAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>;
     email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
     emailOtpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     emailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
@@ -3009,7 +3182,9 @@ export type PersonResolvers<ContextType = any, ParentType extends ResolversParen
     identityProviders?: Resolver<ReadonlyArray<ResolversTypes['PersonIdentityProvider']>, ParentType, ContextType>;
     name?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
     otpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    passwordlessAvailable?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     passwordlessEnabled?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
+    passwordlessSelfManaged?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
 export type PersonIdentityProviderResolvers<ContextType = any, ParentType extends ResolversParentTypes['PersonIdentityProvider'] = ResolversParentTypes['PersonIdentityProvider']> = {
     createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
@@ -3031,6 +3206,7 @@ export type ProjectResolvers<ContextType = any, ParentType extends ResolversPare
     id?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
     members?: Resolver<ReadonlyArray<ResolversTypes['ProjectIdentityRelation']>, ParentType, ContextType, Partial<ProjectMembersArgs>>;
     name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+    permissions?: Resolver<ResolversTypes['ProjectPermissions'], ParentType, ContextType>;
     roles?: Resolver<ReadonlyArray<ResolversTypes['RoleDefinition']>, ParentType, ContextType>;
     secrets?: Resolver<ReadonlyArray<ResolversTypes['ProjectSecretInfo']>, ParentType, ContextType>;
     slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -3039,6 +3215,16 @@ export type ProjectIdentityRelationResolvers<ContextType = any, ParentType exten
     identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>;
     memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>;
 };
+export type ProjectPermissionsResolvers<ContextType = any, ParentType extends ResolversParentTypes['ProjectPermissions'] = ResolversParentTypes['ProjectPermissions']> = {
+    canAddMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canCreateApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canRemoveMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canSetSecret?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canUpdate?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canUpdateMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewMembers?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewSecrets?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type ProjectSecretInfoResolvers<ContextType = any, ParentType extends ResolversParentTypes['ProjectSecretInfo'] = ResolversParentTypes['ProjectSecretInfo']> = {
     createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
     key?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -3344,6 +3530,7 @@ export type Resolvers<ContextType = any> = {
     ConfigEmailChange?: ConfigEmailChangeResolvers<ContextType>;
     ConfigLogin?: ConfigLoginResolvers<ContextType>;
     ConfigLoginAnomalyDetection?: ConfigLoginAnomalyDetectionResolvers<ContextType>;
+    ConfigPanel?: ConfigPanelResolvers<ContextType>;
     ConfigPassword?: ConfigPasswordResolvers<ContextType>;
     ConfigPasswordless?: ConfigPasswordlessResolvers<ContextType>;
     ConfigRateLimitWindow?: ConfigRateLimitWindowResolvers<ContextType>;
@@ -3390,6 +3577,8 @@ export type Resolvers<ContextType = any> = {
     DisconnectIDPResponse?: DisconnectIdpResponseResolvers<ContextType>;
     EnableIDPError?: EnableIdpErrorResolvers<ContextType>;
     EnableIDPResponse?: EnableIdpResponseResolvers<ContextType>;
+    EnablePersonError?: EnablePersonErrorResolvers<ContextType>;
+    EnablePersonResponse?: EnablePersonResponseResolvers<ContextType>;
     ForceSignOutPersonError?: ForceSignOutPersonErrorResolvers<ContextType>;
     ForceSignOutPersonResponse?: ForceSignOutPersonResponseResolvers<ContextType>;
     IDPOptionsOutput?: IdpOptionsOutputResolvers<ContextType>;
@@ -3422,6 +3611,7 @@ export type Resolvers<ContextType = any> = {
     PrepareOtpResult?: PrepareOtpResultResolvers<ContextType>;
     Project?: ProjectResolvers<ContextType>;
     ProjectIdentityRelation?: ProjectIdentityRelationResolvers<ContextType>;
+    ProjectPermissions?: ProjectPermissionsResolvers<ContextType>;
     ProjectSecretInfo?: ProjectSecretInfoResolvers<ContextType>;
     Query?: QueryResolvers<ContextType>;
     RegenerateBackupCodesError?: RegenerateBackupCodesErrorResolvers<ContextType>;