@grantjs/schema 1.1.7 → 1.2.0

package/src/operations/roles/getRoles.graphql

@@ -33,6 +33,18 @@ query GetRoles(
           isPrimary
         }
       }
+      rolePermissions {
+        id
+        permissionId
+        permission(scope: $scope) {
+          id
+          name
+          action
+          resource {
+            slug
+          }
+        }
+      }
       tags {
         id
         name

package/src/operations/roles/getRolesList.graphql

@@ -0,0 +1,38 @@
+query GetRolesList(
+  $scope: Scope!
+  $page: Int
+  $limit: Int
+  $sort: RoleSortInput
+  $search: String
+  $ids: [ID!]
+  $tagIds: [ID!]
+) {
+  roles(
+    scope: $scope
+    page: $page
+    limit: $limit
+    sort: $sort
+    search: $search
+    ids: $ids
+    tagIds: $tagIds
+  ) {
+    roles {
+      id
+      name
+      description
+      metadata
+      createdAt
+      updatedAt
+      primaryTag {
+        id
+        name
+        color
+        isPrimary
+      }
+      groupCount
+      tagCount
+    }
+    totalCount
+    hasNextPage
+  }
+}

package/src/operations/roles/updateRole.graphql

@@ -6,5 +6,11 @@ mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
     metadata
     createdAt
     updatedAt
+    tags {
+      id
+      name
+      color
+      isPrimary
+    }
   }
 }

package/src/operations/user-permissions/user-permissions.graphql

@@ -0,0 +1,39 @@
+mutation AssignUserPermission($input: AssignUserPermissionInput!) {
+  assignUserPermission(input: $input) {
+    id
+    userId
+    permissionId
+    createdAt
+    updatedAt
+  }
+}
+
+mutation RevokeUserPermission($input: RevokeUserPermissionInput!) {
+  revokeUserPermission(input: $input) {
+    id
+    userId
+    permissionId
+    deletedAt
+  }
+}
+
+query GetUserDirectPermissions($scope: Scope!, $userId: ID!) {
+  users(scope: $scope, ids: [$userId], limit: 1) {
+    users {
+      id
+      permissionCount
+      userPermissions {
+        id
+        permissionId
+        permission(scope: $scope) {
+          id
+          name
+          action
+          resource {
+            slug
+          }
+        }
+      }
+    }
+  }
+}

package/src/operations/users/getUsers.graphql

@@ -33,6 +33,32 @@ query GetUsers(
           isPrimary
         }
       }
+      userGroups {
+        id
+        groupId
+        group(scope: $scope) {
+          id
+          name
+          tags {
+            id
+            name
+            color
+            isPrimary
+          }
+        }
+      }
+      userPermissions {
+        id
+        permissionId
+        permission(scope: $scope) {
+          id
+          name
+          action
+          resource {
+            slug
+          }
+        }
+      }
       tags {
         id
         name

package/src/operations/users/getUsersList.graphql

@@ -0,0 +1,43 @@
+query GetUsersList(
+  $scope: Scope!
+  $page: Int
+  $limit: Int
+  $sort: UserSortInput
+  $search: String
+  $ids: [ID!]
+  $tagIds: [ID!]
+) {
+  users(
+    scope: $scope
+    page: $page
+    limit: $limit
+    sort: $sort
+    search: $search
+    ids: $ids
+    tagIds: $tagIds
+  ) {
+    users {
+      id
+      name
+      pictureUrl
+      metadata
+      createdAt
+      updatedAt
+      primaryTag {
+        id
+        name
+        color
+        isPrimary
+      }
+      roleCount
+      projectUserApiKeyCount
+      tagCount
+      authenticationMethods {
+        provider
+        providerId
+      }
+    }
+    totalCount
+    hasNextPage
+  }
+}

package/src/operations/users/updateUser.graphql

@@ -5,5 +5,11 @@ mutation UpdateUser($id: ID!, $input: UpdateUserInput!) {
     metadata
     createdAt
     updatedAt
+    tags {
+      id
+      name
+      color
+      isPrimary
+    }
   }
 }

package/src/schema/auth/inputs/is-authorized.graphql

@@ -1,3 +1,10 @@
+"""
+Check whether the authenticated principal may perform an action on a resource.
+
+Unions Role → Group → Permission, User → Group → Permission, Role → Permission,
+and User → Permission before matching the requested resource and action.
+Conditional permissions are evaluated against role/group/user execution context.
+"""
 input IsAuthorizedInput {
   permission: IsAuthorizedPermissionInput!
   context: IsAuthorizedContextInput!

package/src/schema/auth/queries/is-authorized.graphql

@@ -1,3 +1,6 @@
 extend type Query {
+  """
+  Evaluate authorization for the current session or API key token.
+  """
   isAuthorized(input: IsAuthorizedInput!): AuthorizationResult!
 }

package/src/schema/groups/types/group.graphql

@@ -5,6 +5,9 @@ type Group implements Auditable {
   metadata: JSON!
   permissions: [Permission!]
   tags: [Tag!]
+  primaryTag: Tag
+  permissionCount: Int!
+  tagCount: Int!
   createdAt: Date!
   updatedAt: Date!
   deletedAt: Date

package/src/schema/permissions/types/permission.graphql

@@ -8,6 +8,8 @@ type Permission implements Auditable {
   condition: JSON
   metadata: JSON!
   tags: [Tag!]
+  primaryTag: Tag
+  tagCount: Int!
   createdAt: Date!
   updatedAt: Date!
   deletedAt: Date

package/src/schema/project-role-permissions/types/project-role-permission.graphql

@@ -0,0 +1,27 @@
+type ProjectRolePermission implements Auditable {
+  id: ID!
+  projectId: ID!
+  roleId: ID!
+  permissionId: ID!
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}
+
+input AddProjectRolePermissionInput {
+  projectId: ID!
+  roleId: ID!
+  permissionId: ID!
+}
+
+input RemoveProjectRolePermissionInput {
+  projectId: ID!
+  roleId: ID!
+  permissionId: ID!
+}
+
+input QueryProjectRolePermissionsInput {
+  projectId: ID
+  roleId: ID
+  permissionId: ID
+}

package/src/schema/project-user-groups/types/project-user-group.graphql

@@ -0,0 +1,27 @@
+type ProjectUserGroup implements Auditable {
+  id: ID!
+  projectId: ID!
+  userId: ID!
+  groupId: ID!
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}
+
+input AddProjectUserGroupInput {
+  projectId: ID!
+  userId: ID!
+  groupId: ID!
+}
+
+input RemoveProjectUserGroupInput {
+  projectId: ID!
+  userId: ID!
+  groupId: ID!
+}
+
+input QueryProjectUserGroupsInput {
+  projectId: ID
+  userId: ID
+  groupId: ID
+}

package/src/schema/project-user-permissions/types/project-user-permission.graphql

@@ -0,0 +1,27 @@
+type ProjectUserPermission implements Auditable {
+  id: ID!
+  projectId: ID!
+  userId: ID!
+  permissionId: ID!
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}
+
+input AddProjectUserPermissionInput {
+  projectId: ID!
+  userId: ID!
+  permissionId: ID!
+}
+
+input RemoveProjectUserPermissionInput {
+  projectId: ID!
+  userId: ID!
+  permissionId: ID!
+}
+
+input QueryProjectUserPermissionsInput {
+  projectId: ID
+  userId: ID
+  permissionId: ID
+}

package/src/schema/projects/inputs/sync-project-cdm.graphql

@@ -86,7 +86,15 @@ input RoleCdmInput {
   key: String!
   name: String!
   description: String
+  """
+  Group keys from the `groups` section. When set, permissions are linked via
+  Role → Group → Permission. Omit to use direct `permissions` on the role.
+  """
   groups: [String!]
+  """
+  Permission document keys or catalog refs (`resourceSlug:action`). Used for
+  direct Role → Permission when `groups` is empty.
+  """
   permissions: [String!]
   tags: [String!]
   primaryTag: String
@@ -106,8 +114,17 @@ input UserApiKeyCdmInput {
 input UserCdmInput {
   key: CdmKeyResolverInput!
   name: String!
+  """
+  Role template keys from the `roles` section.
+  """
   roles: [String!]
+  """
+  Direct group assignment. Each key must appear in the document `groups` section.
+  """
   groups: [String!]
+  """
+  Direct user → permission grants (document keys or catalog `resourceSlug:action` refs).
+  """
   permissions: [String!]
   tags: [String!]
   primaryTag: String

package/src/schema/role-permissions/inputs/assign-role-permission.graphql

@@ -0,0 +1,5 @@
+input AssignRolePermissionInput {
+  roleId: ID!
+  permissionId: ID!
+  scope: Scope!
+}

package/src/schema/role-permissions/inputs/query-role-permissions.graphql

@@ -0,0 +1,4 @@
+input QueryRolePermissionsInput {
+  roleId: ID
+  permissionId: ID
+}

package/src/schema/role-permissions/inputs/revoke-role-permission.graphql

@@ -0,0 +1,6 @@
+input RevokeRolePermissionInput {
+  roleId: ID!
+  permissionId: ID!
+  scope: Scope!
+  hardDelete: Boolean
+}

package/src/schema/role-permissions/mutations/assign-role-permission.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  assignRolePermission(input: AssignRolePermissionInput!): RolePermission!
+}

package/src/schema/role-permissions/mutations/revoke-role-permission.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  revokeRolePermission(input: RevokeRolePermissionInput!): RolePermission!
+}

package/src/schema/role-permissions/types/role-permission.graphql

@@ -0,0 +1,10 @@
+type RolePermission implements Auditable {
+  id: ID!
+  roleId: ID!
+  permissionId: ID!
+  role(scope: Scope!): Role
+  permission(scope: Scope!): Permission
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/roles/inputs/create-role.graphql

@@ -4,6 +4,7 @@ input CreateRoleInput {
   metadata: JSON
   tagIds: [ID!]
   groupIds: [ID!]
+  permissionIds: [ID!]
   scope: Scope!
   primaryTagId: ID
 }

package/src/schema/roles/types/role.graphql

@@ -4,7 +4,12 @@ type Role implements Auditable {
   description: String
   metadata: JSON!
   groups: [Group!]
+  rolePermissions: [RolePermission!]
   tags: [Tag!]
+  primaryTag: Tag
+  groupCount: Int!
+  permissionCount: Int!
+  tagCount: Int!
   createdAt: Date!
   updatedAt: Date!
   deletedAt: Date

package/src/schema/user-groups/inputs/add-user-group.graphql

@@ -0,0 +1,4 @@
+input AddUserGroupInput {
+  userId: ID!
+  groupId: ID!
+}

package/src/schema/user-groups/inputs/query-user-groups.graphql

@@ -0,0 +1,4 @@
+input QueryUserGroupsInput {
+  userId: ID
+  groupId: ID
+}

package/src/schema/user-groups/inputs/remove-user-group.graphql

@@ -0,0 +1,4 @@
+input RemoveUserGroupInput {
+  userId: ID!
+  groupId: ID!
+}

package/src/schema/user-groups/types/user-group.graphql

@@ -0,0 +1,10 @@
+type UserGroup implements Auditable {
+  id: ID!
+  userId: ID!
+  groupId: ID!
+  user(scope: Scope!): User
+  group(scope: Scope!): Group
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/user-permissions/inputs/assign-user-permission.graphql

@@ -0,0 +1,5 @@
+input AssignUserPermissionInput {
+  userId: ID!
+  permissionId: ID!
+  scope: Scope!
+}

package/src/schema/user-permissions/inputs/query-user-permissions.graphql

@@ -0,0 +1,4 @@
+input QueryUserPermissionsInput {
+  userId: ID
+  permissionId: ID
+}

package/src/schema/user-permissions/inputs/revoke-user-permission.graphql

@@ -0,0 +1,6 @@
+input RevokeUserPermissionInput {
+  userId: ID!
+  permissionId: ID!
+  scope: Scope!
+  hardDelete: Boolean
+}

package/src/schema/user-permissions/mutations/assign-user-permission.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  assignUserPermission(input: AssignUserPermissionInput!): UserPermission!
+}

package/src/schema/user-permissions/mutations/revoke-user-permission.graphql

@@ -0,0 +1,3 @@
+extend type Mutation {
+  revokeUserPermission(input: RevokeUserPermissionInput!): UserPermission!
+}

package/src/schema/user-permissions/types/user-permission.graphql

@@ -0,0 +1,10 @@
+type UserPermission implements Auditable {
+  id: ID!
+  userId: ID!
+  permissionId: ID!
+  user(scope: Scope!): User
+  permission(scope: Scope!): Permission
+  createdAt: Date!
+  updatedAt: Date!
+  deletedAt: Date
+}

package/src/schema/users/inputs/create-user.graphql

@@ -4,6 +4,8 @@ input CreateUserInput {
   metadata: JSON
   tagIds: [ID!]
   roleIds: [ID!]
+  groupIds: [ID!]
+  permissionIds: [ID!]
   scope: Scope!
   primaryTagId: ID
 }

package/src/schema/users/inputs/update-user.graphql

@@ -5,5 +5,6 @@ input UpdateUserInput {
   metadata: JSON
   tagIds: [ID!]
   roleIds: [ID!]
+  groupIds: [ID!]
   primaryTagId: ID
 }

package/src/schema/users/types/user.graphql

@@ -4,7 +4,14 @@ type User implements Auditable {
   pictureUrl: String
   metadata: JSON!
   roles: [Role!]
+  userGroups: [UserGroup!]
+  userPermissions: [UserPermission!]
   tags: [Tag!]
+  primaryTag: Tag
+  roleCount: Int!
+  permissionCount: Int!
+  projectUserApiKeyCount: Int!
+  tagCount: Int!
   authenticationMethods: [UserAuthenticationMethod!]
   accounts: [Account!]
   createdAt: Date!