@grantjs/schema 1.0.0 → 1.1.0

package/src/index.ts

@@ -1,12 +1,5 @@
+export * from './cdm/cdm-export-sections';
 export * from './generated/graphql';
-export type {
-  ProjectAppPublicInfo,
-  ProjectAppScopeInfo,
-  ProjectConsentInfo,
-  ProjectConsentInfoUser,
-  ProjectConsentRedirectResult,
-} from './project-oauth.types';
-
 export type {
   AccountResolvers,
   GroupResolvers,
@@ -14,17 +7,25 @@ export type {
   OrganizationInvitationResolvers,
   OrganizationResolvers,
   PermissionResolvers,
-  ProjectResolvers,
   ProjectAppResolvers,
+  ProjectResolvers,
   QueryResolvers,
   RequireFields,
   Resolver,
-  ResolverTypeWrapper,
   Resolvers,
   ResolversObject,
   ResolversParentTypes,
   ResolversTypes,
+  ResolverTypeWrapper,
+  ResourceResolvers,
   RoleResolvers,
   TagResolvers,
   UserResolvers,
 } from './generated/resolvers';
+export type {
+  ProjectAppPublicInfo,
+  ProjectAppScopeInfo,
+  ProjectConsentInfo,
+  ProjectConsentInfoUser,
+  ProjectConsentRedirectResult,
+} from './project-oauth.types';

package/src/operations/auth/login.graphql

@@ -2,6 +2,8 @@ mutation Login($input: LoginInput!) {
   login(input: $input) {
     accessToken
     refreshToken
+    mfaVerified
+    requiresMfaStepUp
     requiresEmailVerification
     verificationExpiry
     email

package/src/operations/auth/setupMfa.graphql

@@ -0,0 +1,7 @@
+mutation SetupMfa {
+  setupMfa {
+    factorId
+    secret
+    otpAuthUrl
+  }
+}

package/src/operations/auth/verifyMfa.graphql

@@ -0,0 +1,7 @@
+mutation VerifyMfa($input: VerifyMfaInput!) {
+  verifyMfa(input: $input) {
+    accessToken
+    refreshToken
+    mfaVerified
+  }
+}

package/src/operations/auth/verifyMfaRecoveryCode.graphql

@@ -0,0 +1,7 @@
+mutation VerifyMfaRecoveryCode($input: VerifyMfaRecoveryCodeInput!) {
+  verifyMfaRecoveryCode(input: $input) {
+    accessToken
+    refreshToken
+    mfaVerified
+  }
+}

package/src/operations/me/createMyMfaEnrollment.graphql

@@ -0,0 +1,7 @@
+mutation CreateMyMfaEnrollment {
+  createMyMfaEnrollment {
+    factorId
+    secret
+    otpAuthUrl
+  }
+}

package/src/operations/me/generateMyMfaRecoveryCodes.graphql

@@ -0,0 +1,3 @@
+mutation GenerateMyMfaRecoveryCodes($input: GenerateMyMfaRecoveryCodesInput) {
+  generateMyMfaRecoveryCodes(input: $input)
+}

package/src/operations/me/me.graphql

@@ -15,6 +15,7 @@ query Me {
         updatedAt
       }
     }
+    mfaVerified
     requiresEmailVerification
     verificationExpiry
     email

package/src/operations/me/myMfaDevices.graphql

@@ -0,0 +1,10 @@
+query MyMfaDevices {
+  myMfaDevices {
+    id
+    name
+    isPrimary
+    isEnabled
+    createdAt
+    lastUsedAt
+  }
+}

package/src/operations/me/myMfaRecoveryCodeStatus.graphql

@@ -0,0 +1,6 @@
+query MyMfaRecoveryCodeStatus {
+  myMfaRecoveryCodeStatus {
+    activeCount
+    lastGeneratedAt
+  }
+}

package/src/operations/me/removeMyMfaDevice.graphql

@@ -0,0 +1,5 @@
+mutation RemoveMyMfaDevice($input: RemoveMyMfaDeviceInput!) {
+  removeMyMfaDevice(input: $input) {
+    success
+  }
+}

package/src/operations/me/setMyPrimaryMfaDevice.graphql

@@ -0,0 +1,6 @@
+mutation SetMyPrimaryMfaDevice($input: SetMyPrimaryMfaDeviceInput!) {
+  setMyPrimaryMfaDevice(input: $input) {
+    id
+    isPrimary
+  }
+}

package/src/operations/me/verifyMyMfaEnrollment.graphql

@@ -0,0 +1,5 @@
+mutation VerifyMyMfaEnrollment($input: VerifyMyMfaEnrollmentInput!) {
+  verifyMyMfaEnrollment(input: $input) {
+    success
+  }
+}

package/src/operations/organizations/getOrganizations.graphql

@@ -18,6 +18,7 @@ query GetOrganizations(
       id
       name
       slug
+      requireMfaForSensitiveActions
       createdAt
       updatedAt
       tags {

package/src/operations/organizations/updateOrganization.graphql

@@ -3,6 +3,7 @@ mutation UpdateOrganization($id: ID!, $input: UpdateOrganizationInput!) {
     id
     name
     slug
+    requireMfaForSensitiveActions
     createdAt
     updatedAt
   }

package/src/operations/projects/cancel-project-sync.graphql

@@ -0,0 +1,17 @@
+mutation CancelProjectSync($id: ID!, $scope: Scope!, $jobId: ID!) {
+  cancelProjectSync(id: $id, scope: $scope, jobId: $jobId) {
+    id
+    projectId
+    status
+    cdmVersion
+    jobName
+    operation
+    modeStrategy
+    warnings
+    errorMessage
+    enqueuedAt
+    startedAt
+    completedAt
+    cancelledAt
+  }
+}

package/src/operations/projects/project-sync-job.graphql

@@ -0,0 +1,37 @@
+query ProjectSyncJob($id: ID!, $scope: Scope!, $jobId: ID!) {
+  projectSyncJob(id: $id, scope: $scope, jobId: $jobId) {
+    id
+    projectId
+    status
+    cdmVersion
+    jobName
+    operation
+    modeStrategy
+    result {
+      projectId
+      importId
+      rolesCreated
+      groupsCreated
+      roleGroupsLinked
+      groupPermissionsLinked
+      projectRolesLinked
+      projectGroupsLinked
+      projectPermissionsLinked
+      projectResourcesLinked
+      projectUsersEnsured
+      usersCreated
+      userRolesAssigned
+      projectUserApiKeysCreated
+      warnings
+    }
+    warnings
+    errorMessage
+    enqueuedAt
+    startedAt
+    completedAt
+    cancelledAt
+    hasSnapshot
+    snapshotTakenAt
+    snapshotSizeBytes
+  }
+}

package/src/operations/projects/project-sync-jobs.graphql

@@ -0,0 +1,40 @@
+query ProjectSyncJobs(
+  $id: ID!
+  $scope: Scope!
+  $page: Int
+  $limit: Int
+  $search: String
+  $sort: ProjectSyncJobSortInput
+  $status: ProjectSyncJobStatus
+) {
+  projectSyncJobs(
+    id: $id
+    scope: $scope
+    page: $page
+    limit: $limit
+    search: $search
+    sort: $sort
+    status: $status
+  ) {
+    jobs {
+      id
+      projectId
+      status
+      cdmVersion
+      jobName
+      operation
+      modeStrategy
+      warnings
+      errorMessage
+      enqueuedAt
+      startedAt
+      completedAt
+      cancelledAt
+      hasSnapshot
+      snapshotTakenAt
+      snapshotSizeBytes
+    }
+    totalCount
+    hasNextPage
+  }
+}

package/src/operations/projects/start-project-export.graphql

@@ -0,0 +1,20 @@
+mutation StartProjectExport($id: ID!, $scope: Scope!, $input: StartProjectExportInput!) {
+  startProjectExport(id: $id, scope: $scope, input: $input) {
+    id
+    projectId
+    status
+    cdmVersion
+    jobName
+    operation
+    modeStrategy
+    warnings
+    errorMessage
+    enqueuedAt
+    startedAt
+    completedAt
+    cancelledAt
+    hasSnapshot
+    snapshotTakenAt
+    snapshotSizeBytes
+  }
+}

package/src/operations/projects/start-project-sync.graphql

@@ -0,0 +1,17 @@
+mutation StartProjectSync($id: ID!, $scope: Scope!, $input: SyncProjectInput!) {
+  startProjectSync(id: $id, scope: $scope, input: $input) {
+    id
+    projectId
+    status
+    cdmVersion
+    jobName
+    operation
+    modeStrategy
+    warnings
+    errorMessage
+    enqueuedAt
+    startedAt
+    completedAt
+    cancelledAt
+  }
+}

package/src/operations/resources/createResource.graphql

@@ -8,5 +8,11 @@ mutation CreateResource($input: CreateResourceInput!) {
     isActive
     createdAt
     updatedAt
+    permissions {
+      id
+      name
+      action
+      resourceId
+    }
   }
 }

package/src/schema/auth/inputs/verify-mfa-recovery-code.graphql

@@ -0,0 +1,3 @@
+input VerifyMfaRecoveryCodeInput {
+  code: String!
+}

package/src/schema/auth/inputs/verify-mfa.graphql

@@ -0,0 +1,3 @@
+input VerifyMfaInput {
+  code: String!
+}

package/src/schema/auth/mutations/setup-mfa.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  setupMfa: MfaSetupResponse!
+}

package/src/schema/auth/mutations/verify-mfa-recovery-code.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  verifyMfaRecoveryCode(input: VerifyMfaRecoveryCodeInput!): MfaVerifyResponse!
+}

package/src/schema/auth/mutations/verify-mfa.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  verifyMfa(input: VerifyMfaInput!): MfaVerifyResponse!
+}

package/src/schema/auth/types/login-response.graphql

@@ -2,6 +2,11 @@ type LoginResponse {
   accounts: [Account!]!
   accessToken: String!
   refreshToken: String!
+  mfaVerified: Boolean
+  """
+  When true, the client should complete MFA before expecting full API access (see AUTH_MIN_AAL_AT_LOGIN).
+  """
+  requiresMfaStepUp: Boolean
   requiresEmailVerification: Boolean
   verificationExpiry: Date
   email: String

package/src/schema/auth/types/mfa-setup-response.graphql

@@ -0,0 +1,5 @@
+type MfaSetupResponse {
+  factorId: ID!
+  secret: String!
+  otpAuthUrl: String!
+}

package/src/schema/auth/types/mfa-verify-response.graphql

@@ -0,0 +1,5 @@
+type MfaVerifyResponse {
+  accessToken: String!
+  refreshToken: String!
+  mfaVerified: Boolean!
+}

package/src/schema/me/inputs/generate-my-mfa-recovery-codes.graphql

@@ -0,0 +1,3 @@
+input GenerateMyMfaRecoveryCodesInput {
+  factorId: ID
+}

package/src/schema/me/inputs/remove-my-mfa-device.graphql

@@ -0,0 +1,3 @@
+input RemoveMyMfaDeviceInput {
+  factorId: ID!
+}

package/src/schema/me/inputs/set-my-primary-mfa-device.graphql

@@ -0,0 +1,3 @@
+input SetMyPrimaryMfaDeviceInput {
+  factorId: ID!
+}

package/src/schema/me/inputs/verify-my-mfa-enrollment.graphql

@@ -0,0 +1,3 @@
+input VerifyMyMfaEnrollmentInput {
+  code: String!
+}

package/src/schema/me/mutations/create-my-mfa-enrollment.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  createMyMfaEnrollment: MfaEnrollment!
+}

package/src/schema/me/mutations/generate-my-mfa-recovery-codes.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  generateMyMfaRecoveryCodes(input: GenerateMyMfaRecoveryCodesInput): [String!]!
+}

package/src/schema/me/mutations/remove-my-mfa-device.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  removeMyMfaDevice(input: RemoveMyMfaDeviceInput!): MfaVerifyResult!
+}

package/src/schema/me/mutations/set-my-primary-mfa-device.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  setMyPrimaryMfaDevice(input: SetMyPrimaryMfaDeviceInput!): MfaDevice!
+}

package/src/schema/me/mutations/verify-my-mfa-enrollment.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  verifyMyMfaEnrollment(input: VerifyMyMfaEnrollmentInput!): MfaVerifyResult!
+}

package/src/schema/me/queries/my-mfa-devices.graphql

@@ -0,0 +1,3 @@
+extend type Query {
+  myMfaDevices: [MfaDevice!]!
+}

package/src/schema/me/queries/my-mfa-recovery-code-status.graphql

@@ -0,0 +1,3 @@
+extend type Query {
+  myMfaRecoveryCodeStatus: MfaRecoveryCodeStatus!
+}

package/src/schema/me/types/me-response.graphql

@@ -1,5 +1,6 @@
 type MeResponse {
   accounts: [Account!]!
+  mfaVerified: Boolean
   requiresEmailVerification: Boolean
   verificationExpiry: Date
   email: String

package/src/schema/me/types/mfa-device.graphql

@@ -0,0 +1,8 @@
+type MfaDevice {
+  id: ID!
+  name: String!
+  isPrimary: Boolean!
+  isEnabled: Boolean!
+  createdAt: Date!
+  lastUsedAt: Date
+}

package/src/schema/me/types/mfa-enrollment.graphql

@@ -0,0 +1,5 @@
+type MfaEnrollment {
+  factorId: ID!
+  secret: String!
+  otpAuthUrl: String!
+}

package/src/schema/me/types/mfa-recovery-code-status.graphql

@@ -0,0 +1,4 @@
+type MfaRecoveryCodeStatus {
+  activeCount: Int!
+  lastGeneratedAt: Date
+}

package/src/schema/me/types/mfa-verify-result.graphql

@@ -0,0 +1,3 @@
+type MfaVerifyResult {
+  success: Boolean!
+}

package/src/schema/organization-users/inputs/add-organization-user.graphql

@@ -1,4 +1,5 @@
 input AddOrganizationUserInput {
   organizationId: ID!
   userId: ID!
+  roleId: ID!
 }

package/src/schema/organization-users/types/organization-user.graphql

@@ -2,6 +2,7 @@ type OrganizationUser implements Auditable {
   id: ID!
   organizationId: ID!
   userId: ID!
+  roleId: ID!
   organization: Organization
   user: User
   createdAt: Date!

package/src/schema/organizations/inputs/update-organization.graphql

@@ -1,4 +1,5 @@
 input UpdateOrganizationInput {
   scope: Scope!
   name: String
+  requireMfaForSensitiveActions: Boolean
 }

package/src/schema/organizations/types/organization.graphql

@@ -2,6 +2,7 @@ type Organization implements Auditable {
   id: ID!
   name: String!
   slug: String!
+  requireMfaForSensitiveActions: Boolean!
   projects: [Project!]
   roles: [Role!]
   groups: [Group!]

package/src/schema/permissions/inputs/create-permission.graphql

@@ -7,4 +7,5 @@ input CreatePermissionInput {
   tagIds: [ID!]
   scope: Scope!
   primaryTagId: ID
+  metadata: JSON
 }

package/src/schema/permissions/inputs/update-permission.graphql

@@ -7,4 +7,5 @@ input UpdatePermissionInput {
   condition: JSON
   tagIds: [ID!]
   primaryTagId: ID
+  metadata: JSON
 }

package/src/schema/permissions/types/permission.graphql

@@ -6,6 +6,7 @@ type Permission implements Auditable {
   resourceId: ID
   resource: Resource
   condition: JSON
+  metadata: JSON!
   tags: [Tag!]
   createdAt: Date!
   updatedAt: Date!

package/src/schema/project-user-api-keys/inputs/add-project-user-api-key.graphql

@@ -2,4 +2,8 @@ input AddProjectUserApiKeyInput {
   projectId: ID!
   userId: ID!
   apiKeyId: ID!
+  """
+  Optional pivot metadata (e.g. CDM `cdmImport` / `cdmSource`); omit for normal API creates.
+  """
+  metadata: JSON
 }

package/src/schema/project-users/inputs/add-project-user.graphql

@@ -1,4 +1,5 @@
 input AddProjectUserInput {
   projectId: ID!
   userId: ID!
+  metadata: JSON
 }

package/src/schema/project-users/types/project-user.graphql

@@ -2,6 +2,9 @@ type ProjectUser implements Auditable {
   id: ID!
   projectId: ID!
   userId: ID!
+  metadata: JSON!
+  displayName: String
+  pictureUrl: String
   project(organizationId: ID!): Project
   user: User
   createdAt: Date!

package/src/schema/projects/inputs/project-sync-job-sort.graphql

@@ -0,0 +1,4 @@
+input ProjectSyncJobSortInput {
+  field: ProjectSyncJobSortableField!
+  order: SortOrder!
+}

package/src/schema/projects/inputs/start-project-export.graphql

@@ -0,0 +1,31 @@
+"""
+Parameters for enqueueing an asynchronous CDM **export** job. The worker
+materialises a `SyncProjectInput` document and stores it in the job `snapshot`
+column; this input is persisted as the job `payload` (export options only).
+"""
+input StartProjectExportInput {
+  """
+  CDM document version (only `1` is supported).
+  """
+  version: Int!
+  """
+  Optional stable idempotency / display name (same column as import `SyncProjectInput.id`).
+  When set, an active job for the same `(project, operation=EXPORT, jobName)` is returned
+  instead of creating a new one.
+  """
+  jobName: String
+  """
+  Subset of CDM slices to export; omit or empty for a full project export.
+  """
+  sections: [String!]
+  """
+  When `users` are exported, whether to emit CDM-managed project user API key rows
+  (identity only). Omit = default true (full export behaviour).
+  """
+  includeUserApiKeys: Boolean
+  """
+  Embedded in the exported CDM document `mode` block for re-import.
+  Does not change export execution (snapshot is always read-only).
+  """
+  mode: CdmModeInput
+}