@grantjs/schema 1.0.0

package/src/operations/tags/updateTag.graphql

@@ -0,0 +1,9 @@
+mutation UpdateTag($id: ID!, $input: UpdateTagInput!) {
+  updateTag(id: $id, input: $input) {
+    id
+    name
+    color
+    createdAt
+    updatedAt
+  }
+}

package/src/operations/users/createUser.graphql

@@ -0,0 +1,9 @@
+mutation CreateUser($input: CreateUserInput!) {
+  createUser(input: $input) {
+    id
+    name
+    metadata
+    createdAt
+    updatedAt
+  }
+}

package/src/operations/users/deleteUser.graphql

@@ -0,0 +1,8 @@
+mutation DeleteUser($id: ID!, $scope: Scope!) {
+  deleteUser(id: $id, scope: $scope) {
+    id
+    name
+    createdAt
+    updatedAt
+  }
+}

package/src/operations/users/getUsers.graphql

@@ -0,0 +1,50 @@
+query GetUsers(
+  $scope: Scope!
+  $page: Int
+  $limit: Int
+  $sort: UserSortInput
+  $search: String
+  $ids: [ID!]
+  $tagIds: [ID!]
+) {
+  users(
+    scope: $scope
+    page: $page
+    limit: $limit
+    sort: $sort
+    search: $search
+    ids: $ids
+    tagIds: $tagIds
+  ) {
+    users {
+      id
+      name
+      pictureUrl
+      metadata
+      createdAt
+      updatedAt
+      roles {
+        id
+        name
+        tags {
+          id
+          name
+          color
+          isPrimary
+        }
+      }
+      tags {
+        id
+        name
+        color
+        isPrimary
+      }
+      authenticationMethods {
+        provider
+        providerId
+      }
+    }
+    totalCount
+    hasNextPage
+  }
+}

package/src/operations/users/updateUser.graphql

@@ -0,0 +1,9 @@
+mutation UpdateUser($id: ID!, $input: UpdateUserInput!) {
+  updateUser(id: $id, input: $input) {
+    id
+    name
+    metadata
+    createdAt
+    updatedAt
+  }
+}

package/src/operations/users/uploadUserPicture.graphql

@@ -0,0 +1,6 @@
+mutation UploadUserPicture($input: UploadUserPictureInput!) {
+  uploadUserPicture(input: $input) {
+    url
+    path
+  }
+}

package/src/project-oauth.types.ts

@@ -0,0 +1,37 @@
+/**
+ * Project OAuth (REST) response types.
+ * Used by project app-info and consent REST endpoints; shared by API and web client.
+ */
+
+/** Scope label returned by project app-info and consent-info endpoints. */
+export interface ProjectAppScopeInfo {
+  slug: string;
+  name: string;
+  description: string | null;
+}
+
+/** Response from GET /api/auth/project/app-info (public app metadata and scopes). */
+export interface ProjectAppPublicInfo {
+  name: string | null;
+  enabledProviders: string[] | null;
+  scopes: ProjectAppScopeInfo[];
+}
+
+/** User display info on the consent screen. */
+export interface ProjectConsentInfoUser {
+  displayName: string;
+  email: string | null;
+  pictureUrl: string | null;
+}
+
+/** Response from GET /api/auth/project/consent-info (app name, granted scopes, user). */
+export interface ProjectConsentInfo {
+  name: string | null;
+  scopes: ProjectAppScopeInfo[];
+  user: ProjectConsentInfoUser | null;
+}
+
+/** Response from POST /api/auth/project/consent/approve and /deny (redirect URL). */
+export interface ProjectConsentRedirectResult {
+  redirectUrl: string;
+}

package/src/schema/account-project-api-keys/inputs/add-account-project-api-key.graphql

@@ -0,0 +1,6 @@
+input AddAccountProjectApiKeyInput {
+  accountId: ID!
+  projectId: ID!
+  apiKeyId: ID!
+  accountRoleId: ID!
+}

package/src/schema/account-project-api-keys/inputs/query-account-project-api-keys.graphql

@@ -0,0 +1,5 @@
+input QueryAccountProjectApiKeysInput {
+  accountId: ID
+  projectId: ID
+  apiKeyId: ID
+}

package/src/schema/account-project-api-keys/inputs/remove-account-project-api-key.graphql

@@ -0,0 +1,5 @@
+input RemoveAccountProjectApiKeyInput {
+  accountId: ID!
+  projectId: ID!
+  apiKeyId: ID!
+}

package/src/schema/account-project-api-keys/types/account-project-api-key.graphql

@@ -0,0 +1,14 @@
+type AccountProjectApiKey implements Auditable {
+  id: ID!
+  accountId: ID!
+  projectId: ID!
+  apiKeyId: ID!
+  accountRoleId: ID!
+  account: Account
+  project: Project
+  apiKey: ApiKey
+  role: Role
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/account-project-tags/inputs/add-account-project-tag.graphql

@@ -0,0 +1,6 @@
+input AddAccountProjectTagInput {
+  accountId: ID!
+  projectId: ID!
+  tagId: ID!
+  isPrimary: Boolean
+}

package/src/schema/account-project-tags/inputs/query-account-project-tag.graphql

@@ -0,0 +1,5 @@
+input QueryAccountProjectTagInput {
+  accountId: ID!
+  projectId: ID!
+  tagId: ID
+}

package/src/schema/account-project-tags/inputs/remove-account-project-tag.graphql

@@ -0,0 +1,5 @@
+input RemoveAccountProjectTagInput {
+  accountId: ID!
+  projectId: ID!
+  tagId: ID!
+}

package/src/schema/account-project-tags/inputs/update-account-project-tag.graphql

@@ -0,0 +1,6 @@
+input UpdateAccountProjectTagInput {
+  accountId: ID!
+  projectId: ID!
+  tagId: ID!
+  isPrimary: Boolean!
+}

package/src/schema/account-project-tags/types/account-project-tag.graphql

@@ -0,0 +1,13 @@
+type AccountProjectTag implements Auditable {
+  id: ID!
+  accountId: ID!
+  projectId: ID!
+  tagId: ID!
+  isPrimary: Boolean!
+  account: Account
+  project: Project
+  tag: Tag
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/account-projects/inputs/add-account-project.graphql

@@ -0,0 +1,4 @@
+input AddAccountProjectInput {
+  accountId: ID!
+  projectId: ID!
+}

package/src/schema/account-projects/inputs/query-account-project.graphql

@@ -0,0 +1,3 @@
+input QueryAccountProjectInput {
+  projectId: ID!
+}

package/src/schema/account-projects/inputs/query-account-projects.graphql

@@ -0,0 +1,3 @@
+input QueryAccountProjectsInput {
+  accountId: ID!
+}

package/src/schema/account-projects/inputs/remove-account-project.graphql

@@ -0,0 +1,4 @@
+input RemoveAccountProjectInput {
+  accountId: ID!
+  projectId: ID!
+}

package/src/schema/account-projects/types/account-project.graphql

@@ -0,0 +1,10 @@
+type AccountProject implements Auditable {
+  id: ID!
+  accountId: ID!
+  projectId: ID!
+  account: Account
+  project: Project
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/account-roles/inputs/add-account-role.graphql

@@ -0,0 +1,4 @@
+input AddAccountRoleInput {
+  accountId: ID!
+  roleId: ID!
+}

package/src/schema/account-roles/inputs/query-account-roles.graphql

@@ -0,0 +1,3 @@
+input QueryAccountRolesInput {
+  accountId: ID!
+}

package/src/schema/account-roles/inputs/remove-account-role.graphql

@@ -0,0 +1,4 @@
+input RemoveAccountRoleInput {
+  accountId: ID!
+  roleId: ID!
+}

package/src/schema/account-roles/types/account-role.graphql

@@ -0,0 +1,10 @@
+type AccountRole implements Auditable {
+  id: ID!
+  accountId: ID!
+  roleId: ID!
+  account: Account
+  role: Role
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/account-tags/inputs/add-account-tag.graphql

@@ -0,0 +1,5 @@
+input AddAccountTagInput {
+  accountId: ID!
+  tagId: ID!
+  isPrimary: Boolean
+}

package/src/schema/account-tags/inputs/query-account-tags.graphql

@@ -0,0 +1,3 @@
+input QueryAccountTagsInput {
+  accountId: ID!
+}

package/src/schema/account-tags/inputs/remove-account-tag.graphql

@@ -0,0 +1,4 @@
+input RemoveAccountTagInput {
+  accountId: ID!
+  tagId: ID!
+}

package/src/schema/account-tags/inputs/update-account-tag.graphql

@@ -0,0 +1,5 @@
+input UpdateAccountTagInput {
+  accountId: ID!
+  tagId: ID!
+  isPrimary: Boolean!
+}

package/src/schema/account-tags/types/account-tag.graphql

@@ -0,0 +1,11 @@
+type AccountTag implements Auditable {
+  id: ID!
+  accountId: ID!
+  tagId: ID!
+  account: Account
+  tag: Tag
+  isPrimary: Boolean!
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/accounts/inputs/account-sort.graphql

@@ -0,0 +1,4 @@
+input AccountSortInput {
+  field: AccountSortableField!
+  order: SortOrder!
+}

package/src/schema/accounts/inputs/create-account.graphql

@@ -0,0 +1,7 @@
+input CreateAccountInput {
+  type: AccountType!
+  ownerId: String!
+  provider: UserAuthenticationMethodProvider!
+  providerId: String!
+  providerData: JSON!
+}

package/src/schema/accounts/inputs/query-accounts.graphql

@@ -0,0 +1,7 @@
+input QueryAccountsInput {
+  page: Int
+  limit: Int
+  search: String
+  sort: AccountSortInput
+  ids: [ID!]
+}

package/src/schema/accounts/types/account-page.graphql

@@ -0,0 +1,5 @@
+type AccountPage implements PaginatedResults {
+  accounts: [Account!]!
+  totalCount: Int!
+  hasNextPage: Boolean!
+}

package/src/schema/accounts/types/account-searchable-field.graphql

@@ -0,0 +1,3 @@
+enum AccountSearchableField {
+  type
+}

package/src/schema/accounts/types/account-sortable-field.graphql

@@ -0,0 +1,5 @@
+enum AccountSortableField {
+  type
+  createdAt
+  updatedAt
+}

package/src/schema/accounts/types/account-type.graphql

@@ -0,0 +1,4 @@
+enum AccountType {
+  personal
+  organization
+}

package/src/schema/accounts/types/account.graphql

@@ -0,0 +1,11 @@
+type Account implements Auditable {
+  id: ID!
+  type: AccountType!
+  ownerId: ID!
+  owner: User!
+  projects: [Project!]
+  tags: [Tag!]
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/accounts/types/create-account-result.graphql

@@ -0,0 +1,8 @@
+type CreateAccountResult {
+  account: Account!
+  accessToken: String!
+  refreshToken: String!
+  requiresEmailVerification: Boolean
+  verificationExpiry: Date
+  email: String
+}

package/src/schema/api-keys/inputs/api-key-sort.graphql

@@ -0,0 +1,4 @@
+input ApiKeySortInput {
+  field: ApiKeySortableField!
+  order: SortOrder!
+}

package/src/schema/api-keys/inputs/create-api-key.graphql

@@ -0,0 +1,10 @@
+input CreateApiKeyInput {
+  name: String
+  description: String
+  expiresAt: Date
+  scope: Scope!
+  """
+  Required when scope.tenant is accountProject or organizationProject: the parent-tenant role the key impersonates.
+  """
+  roleId: ID
+}

package/src/schema/api-keys/inputs/delete-api-key.graphql

@@ -0,0 +1,5 @@
+input DeleteApiKeyInput {
+  id: ID!
+  scope: Scope!
+  hardDelete: Boolean
+}

package/src/schema/api-keys/inputs/exchange-api-key.graphql

@@ -0,0 +1,5 @@
+input ExchangeApiKeyInput {
+  clientId: String!
+  clientSecret: String!
+  scope: Scope!
+}

package/src/schema/api-keys/inputs/revoke-api-key.graphql

@@ -0,0 +1,4 @@
+input RevokeApiKeyInput {
+  id: ID!
+  scope: Scope!
+}

package/src/schema/api-keys/mutations/create-api-key.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  createApiKey(input: CreateApiKeyInput!): CreateApiKeyResult!
+}

package/src/schema/api-keys/mutations/delete-api-key.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  deleteApiKey(input: DeleteApiKeyInput!): ApiKey!
+}

package/src/schema/api-keys/mutations/exchange-api-key.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  exchangeApiKey(input: ExchangeApiKeyInput!): ExchangeApiKeyResult!
+}

package/src/schema/api-keys/mutations/revoke-api-key.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  revokeApiKey(input: RevokeApiKeyInput!): ApiKey!
+}

package/src/schema/api-keys/queries/get-api-keys.graphql

@@ -0,0 +1,10 @@
+extend type Query {
+  apiKeys(
+    scope: Scope!
+    page: Int
+    limit: Int
+    search: String
+    sort: ApiKeySortInput
+    ids: [ID!]
+  ): ApiKeyPage!
+}

package/src/schema/api-keys/types/api-key-page.graphql

@@ -0,0 +1,5 @@
+type ApiKeyPage implements PaginatedResults {
+  apiKeys: [ApiKey!]!
+  totalCount: Int!
+  hasNextPage: Boolean!
+}

package/src/schema/api-keys/types/api-key-searchable-field.graphql

@@ -0,0 +1,5 @@
+enum ApiKeySearchableField {
+  clientId
+  name
+  description
+}

package/src/schema/api-keys/types/api-key-sortable-field.graphql

@@ -0,0 +1,6 @@
+enum ApiKeySortableField {
+  name
+  createdAt
+  lastUsedAt
+  expiresAt
+}

package/src/schema/api-keys/types/api-key.graphql

@@ -0,0 +1,21 @@
+type ApiKey implements Auditable {
+  id: ID!
+  clientId: String!
+  name: String
+  description: String
+  expiresAt: Date
+  lastUsedAt: Date
+  isRevoked: Boolean!
+  revokedAt: Date
+  revokedBy: ID
+  createdBy: ID!
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+  createdByUser: User
+  revokedByUser: User
+  """
+  Role bound to this API key (project-level keys only). Null for user-scoped keys.
+  """
+  role: Role
+}

package/src/schema/api-keys/types/create-api-key-result.graphql

@@ -0,0 +1,9 @@
+type CreateApiKeyResult {
+  id: ID!
+  clientId: String!
+  clientSecret: String!
+  name: String
+  description: String
+  expiresAt: Date
+  createdAt: Date!
+}

package/src/schema/api-keys/types/exchange-api-key-result.graphql

@@ -0,0 +1,4 @@
+type ExchangeApiKeyResult {
+  accessToken: String!
+  expiresIn: Int!
+}

package/src/schema/auth/inputs/is-authorized.graphql

@@ -0,0 +1,13 @@
+input IsAuthorizedInput {
+  permission: IsAuthorizedPermissionInput!
+  context: IsAuthorizedContextInput!
+}
+
+input IsAuthorizedPermissionInput {
+  resource: String!
+  action: String!
+}
+
+input IsAuthorizedContextInput {
+  resource: JSON
+}

package/src/schema/auth/inputs/login.graphql

@@ -0,0 +1,5 @@
+input LoginInput {
+  provider: UserAuthenticationMethodProvider!
+  providerId: String!
+  providerData: JSON!
+}

package/src/schema/auth/inputs/register.graphql

@@ -0,0 +1,6 @@
+input RegisterInput {
+  type: AccountType!
+  provider: UserAuthenticationMethodProvider!
+  providerId: String!
+  providerData: JSON!
+}

package/src/schema/auth/inputs/request-password-reset.graphql

@@ -0,0 +1,3 @@
+input RequestPasswordResetInput {
+  email: String!
+}

package/src/schema/auth/inputs/resend-verification.graphql

@@ -0,0 +1,3 @@
+input ResendVerificationInput {
+  email: String!
+}

package/src/schema/auth/inputs/reset-password.graphql

@@ -0,0 +1,4 @@
+input ResetPasswordInput {
+  token: String!
+  newPassword: String!
+}

package/src/schema/auth/inputs/verify-email.graphql

@@ -0,0 +1,3 @@
+input VerifyEmailInput {
+  token: String!
+}

package/src/schema/auth/mutations/login.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  login(input: LoginInput!): LoginResponse!
+}

package/src/schema/auth/mutations/refresh-session.graphql

@@ -0,0 +1,4 @@
+# Cookie-based refresh only (HttpOnly cookie). Aligns with REST POST /api/auth/refresh.
+extend type Mutation {
+  refreshSession: RefreshSessionResponse!
+}

package/src/schema/auth/mutations/register.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  register(input: RegisterInput!): CreateAccountResult!
+}

package/src/schema/auth/mutations/request-password-reset.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  requestPasswordReset(input: RequestPasswordResetInput!): RequestPasswordResetResponse!
+}

package/src/schema/auth/mutations/resend-verification.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  resendVerification(input: ResendVerificationInput!): ResendVerificationResponse!
+}

package/src/schema/auth/mutations/reset-password.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  resetPassword(input: ResetPasswordInput!): ResetPasswordResponse!
+}

package/src/schema/auth/mutations/verify-email.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  verifyEmail(input: VerifyEmailInput!): VerifyEmailResponse!
+}

package/src/schema/auth/queries/is-authorized.graphql

@@ -0,0 +1,3 @@
+extend type Query {
+  isAuthorized(input: IsAuthorizedInput!): AuthorizationResult!
+}

package/src/schema/auth/types/authorization-reason.graphql

@@ -0,0 +1,10 @@
+enum AuthorizationReason {
+  INVALID_SCOPE
+  NOT_AUTHENTICATED
+  INVALID_AUTHENTICATION_STATE
+  NO_MATCHING_PERMISSION_FOUND
+  PERMISSION_GRANTED_NO_CONDITION
+  PERMISSION_GRANTED_CONDITION_MET
+  PERMISSION_FOUND_CONDITION_NOT_MET
+  SCOPE_NOT_GRANTED
+}

package/src/schema/auth/types/authorization-result.graphql

@@ -0,0 +1,7 @@
+type AuthorizationResult {
+  authorized: Boolean!
+  reason: AuthorizationReason
+  matchedPermission: Permission
+  matchedCondition: JSON
+  evaluatedContext: JSON
+}

package/src/schema/auth/types/login-response.graphql

@@ -0,0 +1,8 @@
+type LoginResponse {
+  accounts: [Account!]!
+  accessToken: String!
+  refreshToken: String!
+  requiresEmailVerification: Boolean
+  verificationExpiry: Date
+  email: String
+}