@fmsim/fmsim 3.0.0-beta.1 → 3.0.0-beta.3

package/schema.graphql

@@ -99,6 +99,11 @@ type AccessRequest {
   """Where the request stands."""
   state: AccessRequestStatus!
 
+  """
+  The task the requester asked for - one that holds the refused privilege (`<module>.<work>`).
+  """
+  taskId: String
+
   """When it last changed."""
   updatedAt: DateTimeISO!
 }
@@ -125,6 +130,11 @@ enum AccessRequestStatus {
 
 """A role this domain can assign that grants the asked privilege."""
 type AccessRoleCandidate {
+  """
+  Whether the role holds every privilege of the task asked for. False when no task was asked.
+  """
+  holdsTask: Boolean!
+
   """The role id."""
   id: String!
 
@@ -137,6 +147,22 @@ type AccessRoleCandidate {
   privilegeCount: Int!
 }
 
+"""
+A task that holds a refused privilege - what a person refused may ask for. Words are task.<id>.name and .description.
+"""
+type AccessTaskChoice {
+  """The module or application that declares the task."""
+  module: String!
+
+  """
+  How many privileges the task holds - fewer is closer to what was refused.
+  """
+  privilegeCount: Int!
+
+  """The task id, `<module>.<work>`."""
+  taskId: String!
+}
+
 """Represents a pair of access and refresh tokens."""
 type AccessToken {
   """The access token for API authentication."""
@@ -647,6 +673,230 @@ input AttributeSetPatch {
   items: [AttributeSetItemPatch!]
 }
 
+"""One thing done, as the audit keeps it."""
+type AuditAction {
+  """
+  Who did it. Empty when nobody is known - a sign-in to an account that does not exist.
+  """
+  actor: User
+
+  """
+  Why: role, domain-owner, superuser when granted; role, address, license, ownership, unknown when denied.
+  """
+  basis: String
+
+  """A fixed code for an error or a refusal. Never a message."""
+  code: String
+
+  """
+  How many times this happened in the request - equal checks are kept as one row.
+  """
+  count: Int!
+
+  """When it was written."""
+  createdAt: DateTimeISO!
+
+  """granted or denied - for a door check."""
+  decision: String
+
+  """Further facts, only the keys the kind registered."""
+  detail: Object
+
+  """The domain it was done in."""
+  domain: Domain
+
+  """
+  The door, as category:privilege, or owner / super for a door that asks ownership only.
+  """
+  door: String
+
+  """Unique identifier."""
+  id: ID!
+
+  """
+  What kind of action: door.check, door.result, role.grant, auth.signin, ...
+  """
+  kind: String!
+
+  """Id or name of the second object."""
+  objectId: String
+
+  """Kind of the second object - the Role granted, the Privilege added."""
+  objectKind: String
+
+  """ok or error - what was done after the door, or how an event ended."""
+  outcome: String
+  request: AuditRequest
+
+  """The request this was done in. Empty for work outside any request."""
+  requestId: String
+
+  """How many items a list returned, summed over the request."""
+  returned: Int
+
+  """Target ids, up to 100."""
+  targetIds: [String!]
+
+  """Kind of the target - User, Role, ..."""
+  targetKind: String
+
+  """requested - named by the caller; handled - confirmed by the service."""
+  targetRole: String
+
+  """Whether more targets than were kept."""
+  truncated: Boolean!
+}
+
+"""One door's audit summary over a period."""
+type AuditDoor {
+  """The category, when the door names a privilege."""
+  category: String
+
+  """Checks refused in the period."""
+  denied: Int!
+
+  """The door, as category:privilege - or owner / super."""
+  door: String!
+
+  """Checks passed in the period."""
+  granted: Int!
+
+  """People who passed or were refused here in the period."""
+  people: Int!
+
+  """The privilege, when the door names one."""
+  privilege: String
+}
+
+"""
+Audit writes this server process failed, counted apart from the audit store.
+"""
+type AuditHealth {
+  """Writes that failed since then. Writes never attempted are not counted."""
+  failures: Int!
+
+  """The first failure."""
+  firstFailedAt: DateTimeISO
+
+  """The last failure."""
+  lastFailedAt: DateTimeISO
+
+  """When this process started counting."""
+  since: DateTimeISO!
+}
+
+"""One member's audit summary over a period."""
+type AuditPerson {
+  """Check-ins in the period."""
+  checkins: Int!
+
+  """Door checks refused in the period."""
+  denied: Int!
+
+  """Failed sign-ins in the period."""
+  failedSignins: Int!
+
+  """Door checks passed in the period, audit reads left out."""
+  granted: Int!
+
+  """The last check-in to this domain, at any time."""
+  lastCheckinAt: DateTimeISO
+
+  """Names of the roles held in this domain."""
+  roles: [String!]!
+
+  """The member."""
+  user: User!
+}
+
+"""A request with what was done in it."""
+type AuditRecord {
+  """Its actions in this domain."""
+  actions: [AuditAction!]!
+
+  """The request."""
+  request: AuditRequest!
+}
+
+"""What to narrow the audit records to."""
+input AuditRecordFilter {
+  """Only requests by this user."""
+  actorId: String
+
+  """Only requests that passed through this door (category:privilege)."""
+  door: String
+
+  """From this moment."""
+  from: DateTimeISO!
+
+  """Only requests with an action of this kind."""
+  kind: String
+
+  """Rows per page, up to 200."""
+  limit: Int
+
+  """denied, error or failed - only requests where that happened."""
+  outcome: String
+
+  """Page, from 1."""
+  page: Int
+
+  """Up to this moment."""
+  to: DateTimeISO!
+}
+
+"""A page of audit records."""
+type AuditRecordList {
+  """The records on this page."""
+  items: [AuditRecord!]!
+
+  """How many requests match."""
+  total: Int!
+}
+
+"""A request that reached the server, as the audit keeps it."""
+type AuditRequest {
+  """Who made the request. Empty when nobody was signed in."""
+  actor: User
+
+  """graphql, or http for any other request."""
+  channel: String!
+
+  """When the server finished the request."""
+  createdAt: DateTimeISO!
+
+  """The domain the request was made in."""
+  domain: Domain
+
+  """Milliseconds the server spent on the request."""
+  durationMs: Int
+
+  """
+  The root fields a GraphQL request asked, by their schema names - never an argument.
+  """
+  fields: String
+
+  """Request id, shared by the actions of this request."""
+  id: ID!
+
+  """Address the request came from."""
+  ip: String
+
+  """
+  The operation name the client gave. For reference only - the client chooses it.
+  """
+  operationName: String
+
+  """query, mutation or subscription - for a GraphQL request."""
+  operationType: String
+
+  """The route pattern of a request outside GraphQL. Never the path itself."""
+  route: String
+
+  """User-Agent header, cut at 256 characters."""
+  userAgent: String
+}
+
 """
 Represents a configured instance of an authentication provider for a specific domain.
 """
@@ -1640,7 +1890,7 @@ type Counterparty {
   aliases: String
 
   """How many accounts it is paid into are registered"""
-  bankAccountCount: Int!
+  bankAccountCount: Int
 
   """Address bills are sent to, when not the address"""
   billingAddress: String
@@ -1696,13 +1946,30 @@ type Counterparty {
   updater: User
 
   """Whether its sales to it are zero-rated for VAT"""
-  zeroRated: Boolean!
+  zeroRated: Boolean
+}
+
+"""
+An account a counterparty is paid into, as one picks it: the bank and the number's last four digits
+"""
+type CounterpartyAccountChoice {
+  """The account number's last four digits"""
+  accountTail: String
+
+  """The bank"""
+  bankName: String
+  id: ID!
 }
 
 """An account a counterparty is paid into"""
 type CounterpartyBankAccount {
   """The account number, its digits - one counterparty's in the domain"""
-  accountNumber: String!
+  accountNumber: String
+
+  """
+  The account number's last four digits - what one sees without the keeper's privilege
+  """
+  accountTail: String
 
   """The bank"""
   bankName: String
@@ -1767,6 +2034,27 @@ input CounterpartyBankAccountPatch {
   notes: String
 }
 
+"""A counterparty as one picks it: which one, and nothing about it"""
+type CounterpartyChoice {
+  """
+  Business registration number - tells apart two counterparties of one name (ADR-0132)
+  """
+  businessNumber: String
+  id: ID!
+
+  """A company or a person"""
+  kind: CounterpartyKind!
+
+  """The name the business knows it by"""
+  name: String!
+}
+
+"""A page of counterparties to pick from"""
+type CounterpartyChoiceList {
+  items: [CounterpartyChoice!]!
+  total: Int!
+}
+
 """Whether a counterparty is a company or a person"""
 enum CounterpartyKind {
   COMPANY
@@ -2792,6 +3080,17 @@ type FigureTypeMapEntry {
   updater: User
 }
 
+"""
+The limits the server enforces on an upload, so a file picker can refuse before uploading.
+"""
+type FileUploadLimits {
+  """Largest file taken, in bytes."""
+  maxFileSize: Float!
+
+  """Most files taken in one request."""
+  maxFiles: Int!
+}
+
 """Input type for specifying a filter condition in a list query."""
 input Filter {
   """The field name to apply the filter on."""
@@ -2906,62 +3205,6 @@ enum InheritedValueType {
   Only
 }
 
-"""
-Represents an invitation for a user to join a system or a specific resource.
-"""
-type Invitation {
-  """When the invitation was accepted."""
-  acceptedAt: DateTimeISO
-
-  """The timestamp when the invitation was created."""
-  createdAt: DateTimeISO
-
-  """The user who created the invitation."""
-  creator: User
-
-  """The domain the user is invited to join."""
-  domain: Domain!
-
-  """The email address to which the invitation is sent."""
-  email: EmailAddress!
-
-  """When this invitation stops being acceptable."""
-  expiresAt: DateTimeISO
-
-  """Unique identifier for the invitation."""
-  id: ID!
-
-  """Deprecated. The domain the invitation is to is `domain`."""
-  reference: String
-
-  """Roles to grant when the invitation is accepted."""
-  roles: [Role!]
-
-  """pending, accepted, cancelled or expired — read as of now."""
-  state: String
-
-  """pending, accepted, cancelled or expired."""
-  status: String!
-
-  """Deprecated. See `reference`."""
-  type: String
-
-  """The timestamp when the invitation was last updated."""
-  updatedAt: DateTimeISO
-
-  """The user who last updated the invitation."""
-  updater: User
-}
-
-"""A paginated list of invitations."""
-type InvitationList {
-  """The list of invitation items."""
-  items: [Invitation!]
-
-  """The total number of invitations."""
-  total: Int
-}
-
 """
 The `JSON` scalar type represents JSON values as specified by [ECMA-404](http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf).
 """
@@ -2989,33 +3232,6 @@ type Log {
   timestamp: String!
 }
 
-"""Records user login attempts."""
-type LoginHistory {
-  """The domain the user logged into."""
-  accessDomain: Domain!
-
-  """The user who logged in."""
-  accessUser: User!
-
-  """The timestamp of the login attempt."""
-  accessedAt: DateTimeISO
-
-  """The IP address from which the login attempt was made."""
-  accessorIp: String
-
-  """Unique identifier for the login history record."""
-  id: ID!
-}
-
-"""A paginated list of login history records."""
-type LoginHistoryList {
-  """The list of login history items."""
-  items: [LoginHistory!]!
-
-  """The total number of login history records."""
-  total: Int!
-}
-
 """Entity for Menu"""
 type Menu {
   buttons: [MenuButton!]!
@@ -3425,9 +3641,6 @@ type Mutation {
   """
   backfillAttachmentThumbnails(limit: Int = 20): ThumbnailBackfillResult!
 
-  """To withdraw a pending invitation"""
-  cancelInvitation(id: String!): Boolean!
-
   """Chooses the imported release a full figure name draws with."""
   chooseFigureRelease(
     """Full figure name {namespace}/{type}."""
@@ -3697,9 +3910,7 @@ type Mutation {
   """To delete multiple Contacts"""
   deleteContacts(ids: [String!]!): Boolean!
 
-  """
-  To delete counterparties - the rows that name them keep the name and lose the link
-  """
+  """To delete counterparties - refused while another row still names one"""
   deleteCounterparties(ids: [String!]!): Boolean!
 
   """To delete Department"""
@@ -3823,6 +4034,9 @@ type Mutation {
   """To delete my preference"""
   deleteMyUserPreference(element: String!, key: String!): Boolean!
 
+  """To remove one of the caller's own passkeys. It can no longer sign in."""
+  deleteMyWebAuthCredential(id: String!): Boolean!
+
   """To delete Notification"""
   deleteNotification(id: String!): Boolean!
 
@@ -4041,6 +4255,17 @@ type Mutation {
     username: String!
   ): Boolean!
 
+  """
+  Puts the user waiting for a password they set themselves and issues the one-time link to it. The current password stops working and open sessions end. Mailed, or returned once for the administrator to hand over.
+  """
+  issuePasswordSetupLink(
+    """True mails the link to the user's address; false returns it once."""
+    mail: Boolean!
+
+    """The username or email of the user."""
+    username: String!
+  ): PasswordSetupLink!
+
   """Assigns one or more boards to a group."""
   joinGroup(boardIds: [String!]!, id: String!): Group!
 
@@ -4100,17 +4325,6 @@ type Mutation {
   """
   requestAccess(request: NewAccessRequest!): AccessRequest!
 
-  """To send a pending invitation again"""
-  resendInvitation(id: String!): Boolean!
-
-  """
-  Resets a user's password to the default value. Use this mutation to restore access to a user who has forgotten their password.
-  """
-  resetPasswordToDefault(
-    """The username or email of the user whose password to reset."""
-    username: String!
-  ): Boolean!
-
   """Reverts a board to a specific historical version."""
   revertBoardVersion(id: String!, version: Float!): Board!
 
@@ -4136,9 +4350,6 @@ type Mutation {
     scenarioName: String!
     variables: Object
   ): ScenarioInstanceRunResult!
-
-  """To invite someone into this domain by email"""
-  sendInvitation(email: String!, roleIds: [String!]): Invitation!
   singleUpload(file: Upload!): Attachment!
 
   """Starts a new scenario instance, which will run in the background."""
@@ -4250,6 +4461,11 @@ type Mutation {
   """
   updateEmployee(id: String!, patch: EmployeePatch!): Employee!
 
+  """
+  Sets an employee's pay account - the bank and the account number their pay goes to
+  """
+  updateEmployeePayAccount(bankAccount: String, bankName: String, id: String!): Employee!
+
   """To modify Entity' information"""
   updateEntity(id: String!, patch: EntityPatch!): Entity!
 
@@ -4379,14 +4595,6 @@ type Mutation {
   Updates multiple themes at once. Can create or update themes based on the cuFlag.
   """
   updateMultipleTheme(patches: [ThemePatch!]!): [Theme!]!
-
-  """
-  Updates or creates multiple users in a single operation. Use this mutation for batch processing of user records.
-  """
-  updateMultipleUser(
-    """An array of patch objects for batch update or creation."""
-    patches: [UserPatch!]!
-  ): [User!]!
   updateMultipleWorker(patches: [WorkerPatch!]!): [Worker!]!
 
   """To modify ApprovalLine information for current user"""
@@ -4398,6 +4606,12 @@ type Mutation {
   """To create or update my preference"""
   updateMyUserPreference(key: String!, preference: Object!): UserPreference!
 
+  """To rename one of the caller's own passkeys."""
+  updateMyWebAuthCredential(id: String!, name: String!): WebAuthCredential!
+
+  """To change the notice channels of this domain."""
+  updateNoticeChannelSetting(patch: NoticeChannelSettingPatch!): NoticeChannelSetting!
+
   """To modify Notification information"""
   updateNotification(id: String!, patch: NotificationPatch!): Notification!
 
@@ -4498,6 +4712,11 @@ input NewAccessRequest {
 
   """The requester's reason."""
   reason: String
+
+  """
+  The task asked for - one of the tasks that hold the refused privilege (tasksGranting).
+  """
+  taskId: String
 }
 
 """Input for creating a new appliance."""
@@ -5289,9 +5508,6 @@ input NewUser {
   """Full name of the user."""
   name: String!
 
-  """Password for the user account."""
-  password: String
-
   """Roles assigned to the user."""
   roles: [ObjectRef!]
 
@@ -5340,6 +5556,41 @@ input NewWorker {
   type: String!
 }
 
+"""
+The channels notices take beyond the app and web push in this domain (ADR-0164).
+"""
+type NoticeChannelSetting {
+  """Whether notices also go by mail."""
+  email: Boolean!
+
+  """
+  The Teams channel webhook - where a notice to everyone in the domain is posted.
+  """
+  teamsChannel: NoticeSecretState!
+}
+
+"""
+A change to the notice channels. A field left out stays as it is; an empty webhook clears it.
+"""
+input NoticeChannelSettingPatch {
+  """Whether notices also go by mail."""
+  email: Boolean
+
+  """The Teams channel webhook address (https), or empty to clear it."""
+  teamsChannelWebhook: String
+}
+
+"""
+Whether a secret is set, and the host it points at - never the secret itself.
+"""
+type NoticeSecretState {
+  """The host of the address, to tell which flow it is."""
+  host: String
+
+  """Whether it is set for this domain."""
+  set: Boolean!
+}
+
 """Entity for Notification"""
 type Notification {
   body: String
@@ -5727,6 +5978,22 @@ type PasswordRule {
   useTightPattern: Boolean
 }
 
+"""
+The password setup link just issued: mailed, or returned once to be handed over.
+"""
+type PasswordSetupLink {
+  """When the link stops working."""
+  expiresAt: DateTimeISO!
+
+  """
+  The link, when it was not mailed. It is not kept and cannot be read again.
+  """
+  link: String
+
+  """The address the link was mailed to, when it was mailed."""
+  mailedTo: String
+}
+
 """Logs the request and response payloads for API interactions."""
 type PayloadLog {
   """The timestamp when the log entry was created."""
@@ -6209,6 +6476,20 @@ type Query {
     sortings: [Sorting!]
   ): AttributeSetList!
 
+  """
+  Each door over a period, in this domain - every declared privilege, a door with no record in the period too.
+  """
+  auditDoors(from: DateTimeISO!, to: DateTimeISO!): [AuditDoor!]!
+
+  """Audit writes this server process failed to store."""
+  auditHealth: AuditHealth!
+
+  """Each member's audit summary over a period, in this domain."""
+  auditPeople(from: DateTimeISO!, to: DateTimeISO!): [AuditPerson!]!
+
+  """This domain's audit records - requests and what was done in them."""
+  auditRecords(filter: AuditRecordFilter!): AuditRecordList!
+
   """To fetch a AuthProvider"""
   authProvider(id: String!): AuthProvider
 
@@ -6427,16 +6708,6 @@ type Query {
   """Carrier 위치 이력 조회 (목업). 영구추적 fallback 용."""
   carrierLocationHistory(carrierName: String!, endTime: String!, startTime: String!): CarrierLocationHistoryResponse!
 
-  """
-  Checks if the system is configured to provide a default password for new users.
-  """
-  checkDefaultPassword: Boolean!
-
-  """
-  Determines whether the system provides a default password when creating a new user.
-  """
-  checkResettablePasswordToDefault: Boolean!
-
   """
   Checks if the current authenticated user belongs to the current domain.
   """
@@ -6615,8 +6886,35 @@ type Query {
   """To fetch a counterparty of the domain"""
   counterparty(id: String!): Counterparty
 
+  """
+  The accounts a counterparty is paid into, to pick one - the bank and the number's last four digits
+  """
+  counterpartyAccountChoices(counterpartyId: String!): [CounterpartyAccountChoice!]!
+
   """The accounts a counterparty of the domain is paid into"""
   counterpartyBankAccounts(counterpartyId: String!): [CounterpartyBankAccount!]!
+
+  """
+  Counterparties to pick from - which one, nothing about it; a capped page at a time
+  """
+  counterpartyChoices(
+    """An array of filter conditions to apply to the list query."""
+    filters: [Filter!]
+
+    """Inherited value type for the list query."""
+    inherited: InheritedValueType
+
+    """Pagination options for the list query."""
+    pagination: Pagination
+
+    """
+    A single free-text term matched across the fields the resolver declares as searchable (OR). Additive to filters: both are applied together. Prefer this over hand-assembling one search filter per field.
+    """
+    search: String
+
+    """Sorting options for the list query."""
+    sortings: [Sorting!]
+  ): CounterpartyChoiceList!
   customerBizplaces: [Bizplace!]!
   customers: [Domain!]!
 
@@ -6750,7 +7048,7 @@ type Query {
   employee(id: String!): Employee
 
   """
-  Fetches a list of employees based on provided query parameters. Supports searching by name, control number, and alias.
+  Fetches a list of employees based on provided query parameters. Supports searching by name, control number, alias, position, responsibility and department name.
   """
   employees(
     """An array of filter conditions to apply to the list query."""
@@ -6964,6 +7262,9 @@ type Query {
   """
   figureTypeMap: [FigureTypeMapEntry!]!
 
+  """The upload limits the server enforces."""
+  fileUploadLimits: FileUploadLimits!
+
   """To fetch a Font"""
   font(id: String!): Font!
 
@@ -7018,57 +7319,22 @@ type Query {
   """To fetch integration Analyses"""
   integrationAnalysis: Object!
 
-  """To fetch an invitation of this domain"""
-  invitation(id: String!): Invitation
-
-  """To fetch this domain's invitations"""
-  invitations(
-    """An array of filter conditions to apply to the list query."""
-    filters: [Filter!]
-
-    """Inherited value type for the list query."""
-    inherited: InheritedValueType
-
-    """Pagination options for the list query."""
-    pagination: Pagination
-
-    """
-    A single free-text term matched across the fields the resolver declares as searchable (OR). Additive to filters: both are applied together. Prefer this over hand-assembling one search filter per field.
-    """
-    search: String
-
-    """Sorting options for the list query."""
-    sortings: [Sorting!]
-  ): InvitationList!
-
   """Check if a user is an owner of the current domain."""
   isDomainOwner(username: String!): Boolean!
 
-  """To fetch multiple LoginHistories"""
-  loginHistories(
-    """An array of filter conditions to apply to the list query."""
-    filters: [Filter!]
-
-    """Inherited value type for the list query."""
-    inherited: InheritedValueType
-
-    """Pagination options for the list query."""
-    pagination: Pagination
-
-    """
-    A single free-text term matched across the fields the resolver declares as searchable (OR). Additive to filters: both are applied together. Prefer this over hand-assembling one search filter per field.
-    """
-    search: String
-
-    """Sorting options for the list query."""
-    sortings: [Sorting!]
-  ): LoginHistoryList!
-
   """
   Whether the caller may give or take the parent domain's roles from this domain.
   """
   mayChangeParentRoles: Boolean!
 
+  """
+  Whether this domain may issue the user a password setup link: the user works in no other domain, owns no domain and is not an administrator.
+  """
+  mayIssuePasswordSetupLink(
+    """The id of the user who would be issued the link."""
+    id: String!
+  ): Boolean!
+
   """To fetch a Menu"""
   menu(id: String!): Menu!
 
@@ -7235,6 +7501,9 @@ type Query {
     sortings: [Sorting!]
   ): ApprovalLineList!
 
+  """What I did - in this domain, and my sign-ins."""
+  myAuditActions(kind: String, limit: Int): [AuditAction!]!
+
   """
   Fetches the caller's own employee records in this domain. Empty when the caller is not an employee.
   """
@@ -7242,7 +7511,6 @@ type Query {
 
   """To fetch current user's Favorites"""
   myFavorites: [Favorite!]!
-  myLoginHistories(limit: Float!): [LoginHistory!]!
 
   """To fetch my own Menus"""
   myMenus(
@@ -7336,6 +7604,14 @@ type Query {
     sortings: [Sorting!]
   ): UserPreferenceList!
 
+  """To list the caller's own passkeys, newest first."""
+  myWebAuthCredentials: [WebAuthCredential!]!
+
+  """
+  The notice channels of this domain - set or not, never the webhook addresses.
+  """
+  noticeChannelSetting: NoticeChannelSetting!
+
   """To fetch a Notification"""
   notification(id: String!): Notification
 
@@ -7597,7 +7873,13 @@ type Query {
   """
   To list the roles this domain can assign that grant a privilege, fewest privileges first.
   """
-  rolesGranting(category: String!, privilege: String!): [AccessRoleCandidate!]!
+  rolesGranting(
+    category: String!
+    privilege: String!
+
+    """The task asked for - roles holding all of it come first."""
+    taskId: String
+  ): [AccessRoleCandidate!]!
 
   """Fetches a single scenario by its ID."""
   scenario(id: String!): Scenario!
@@ -7769,6 +8051,11 @@ type Query {
   """
   taskTypesByConnection(connectionName: String!): TaskTypeList!
 
+  """
+  To list the tasks that hold a privilege, fewest privileges first - what a person refused may ask for.
+  """
+  tasksGranting(category: String!, privilege: String!): [AccessTaskChoice!]!
+
   """To fetch multiple Terminologies"""
   terminologies(
     """An array of filter conditions to apply to the list query."""
@@ -7904,10 +8191,20 @@ type Role {
   privileges: [Privilege!]
 
   """
-  What the template of this role's name grants here that the role does not hold. Null when no template carries the name.
+  The role's privileges laid against every registered task, and those no task names.
+  """
+  taskCoverage: RoleTaskCoverageListView!
+
+  """
+  What the role's base template grants here that the role does not hold, and what the role holds beyond it. Null when the role has no base template, or its base is not declared in this installation.
   """
   templateGap: RoleTemplateGapView
 
+  """
+  The id of the role template this role is based on; null when it is based on none.
+  """
+  templateId: String
+
   """The timestamp when the role was last updated."""
   updatedAt: DateTimeISO
 
@@ -7958,6 +8255,11 @@ input RolePatch {
   """Stand this role even though the domain inherits one of the same name."""
   separately: Boolean
 
+  """
+  The id of the role template this role is based on; null to base it on none.
+  """
+  templateId: String
+
   """A new list of users to be assigned to the role."""
   users: [ObjectRef!]
 }
@@ -7985,6 +8287,42 @@ type RolePrivilege {
   name: String
 }
 
+"""A role's privileges laid against every registered task."""
+type RoleTaskCoverageListView {
+  """Every registered task, with what the role holds of it."""
+  tasks: [RoleTaskCoverageView!]!
+
+  """Declared privileges the role holds that no task names."""
+  unclassified: [RoleTemplateGapGrant!]!
+}
+
+"""One task laid against a role's privileges."""
+type RoleTaskCoverageView {
+  """The task's privileges the role holds."""
+  held: [RoleTemplateGapGrant!]!
+
+  """The task's declared privileges the role does not hold."""
+  missing: [RoleTemplateGapGrant!]!
+
+  """
+  The module or application that declares the task - the first part of its id.
+  """
+  module: String!
+
+  """
+  all, some, none or broken. Says which of the task's privileges the role holds - not whether the work can be done. broken: the task names a privilege this installation does not declare.
+  """
+  status: String!
+
+  """
+  The task id, `<module>.<work>`. Its words are the translation keys task.<id>.name and task.<id>.description.
+  """
+  taskId: String!
+
+  """Privileges the task names that this installation does not declare."""
+  undeclared: [RoleTemplateGapGrant!]!
+}
+
 """Privileges on one category that a role lacks against its template."""
 type RoleTemplateGapGrant {
   """The axes the template grants here and the role does not hold."""
@@ -7998,6 +8336,14 @@ type RoleTemplateGapGrant {
 What the template of a role's name grants in this installation that the role does not hold.
 """
 type RoleTemplateGapView {
+  """
+  Declared privileges the role holds that the template does not grant, by category.
+  """
+  extra: [RoleTemplateGapGrant!]!
+
+  """How many privileges the role holds beyond the template."""
+  extraCount: Int!
+
   """The privileges missing from the role, by category."""
   missing: [RoleTemplateGapGrant!]!
 
@@ -8032,6 +8378,11 @@ type RoleTemplateView {
   """
   defaultNameTaken: Boolean!
 
+  """
+  Definition errors that refuse this template when applied: unregistered tasks, or tasks naming undeclared privileges.
+  """
+  definitionErrors: [String!]!
+
   """A description of the seat this template creates."""
   description: String
 
@@ -8056,6 +8407,11 @@ type RoleTemplateView {
 
   """How many privileges this template would actually grant here."""
   privilegeCount: Int!
+
+  """
+  The tasks this template is built from, by id - each a piece of work a module or application names.
+  """
+  tasks: [String!]!
 }
 
 """Represents a sequence of steps designed to automate a task or process."""
@@ -9002,9 +9358,6 @@ input UserPatch {
   """Full name of the user."""
   name: String
 
-  """Password for the user account."""
-  password: String
-
   """Roles assigned to the user."""
   roles: [ObjectRef!]
 
@@ -9084,6 +9437,48 @@ type UsersAuthProviders {
   user: User
 }
 
+"""Represents a WebAuthn credential for passwordless authentication."""
+type WebAuthCredential {
+  """The signature counter, used to prevent replay attacks."""
+  counter: Float
+
+  """The timestamp when the credential was created."""
+  createdAt: DateTimeISO
+
+  """The user who created the credential."""
+  creator: User
+
+  """The unique ID for this credential, provided by the authenticator."""
+  credentialId: String
+
+  """When the credential was removed."""
+  deletedAt: DateTimeISO
+
+  """Unique identifier for the credential."""
+  id: ID!
+
+  """When this passkey was last used to sign in."""
+  lastUsedAt: DateTimeISO
+
+  """The owner's label for this passkey, such as the device it was made on."""
+  name: String
+
+  """The public key of the credential."""
+  publicKey: String
+
+  """How the authenticator can be reached: usb, nfc, ble, hybrid, internal."""
+  transports: [String!]
+
+  """The timestamp when the credential was last updated."""
+  updatedAt: DateTimeISO
+
+  """The user who last updated the credential."""
+  updater: User
+
+  """The user associated with this credential."""
+  user: User
+}
+
 type Worker {
   bizplace: Bizplace!
   createdAt: DateTimeISO