@grantjs/schema 1.15.0 → 1.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grantjs/schema",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/generated/graphql.ts

@@ -1465,6 +1465,10 @@ export type ProjectSyncJobQuery = {
       usersCreated: number;
       userRolesAssigned: number;
       projectUserApiKeysCreated: number;
+      passwordsImported: number;
+      passwordsUpdated: number;
+      passwordsUnchanged: number;
+      passwordsSkippedExisting: number;
       warnings: Array<string>;
     } | null;
   };
@@ -8017,6 +8021,10 @@ export const ProjectSyncJobDocument = {
                       { kind: 'Field', name: { kind: 'Name', value: 'usersCreated' } },
                       { kind: 'Field', name: { kind: 'Name', value: 'userRolesAssigned' } },
                       { kind: 'Field', name: { kind: 'Name', value: 'projectUserApiKeysCreated' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'passwordsImported' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'passwordsUpdated' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'passwordsUnchanged' } },
+                      { kind: 'Field', name: { kind: 'Name', value: 'passwordsSkippedExisting' } },
                       { kind: 'Field', name: { kind: 'Name', value: 'warnings' } },
                     ],
                   },

package/src/generated/resolvers.ts

@@ -237,6 +237,8 @@ export type ResolversTypes = ResolversObject<{
   CdmModeInput: Types.CdmModeInput;
   CdmModeStrategy: Types.CdmModeStrategy;
   CdmOnConflict: Types.CdmOnConflict;
+  CdmPasswordAlgorithm: Types.CdmPasswordAlgorithm;
+  CdmPasswordInput: Types.CdmPasswordInput;
   ChangeMyPasswordInput: Types.ChangeMyPasswordInput;
   ChangeMyPasswordResult: ResolverTypeWrapper<Types.ChangeMyPasswordResult>;
   ClearProjectAppPictureInput: Types.ClearProjectAppPictureInput;
@@ -646,6 +648,7 @@ export type ResolversParentTypes = ResolversObject<{
   Boolean: Types.Scalars['Boolean']['output'];
   CdmKeyResolverInput: Types.CdmKeyResolverInput;
   CdmModeInput: Types.CdmModeInput;
+  CdmPasswordInput: Types.CdmPasswordInput;
   ChangeMyPasswordInput: Types.ChangeMyPasswordInput;
   ChangeMyPasswordResult: Types.ChangeMyPasswordResult;
   ClearProjectAppPictureInput: Types.ClearProjectAppPictureInput;
@@ -3288,6 +3291,10 @@ export type SyncProjectResultResolvers<
   groupTagsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   groupsCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   importId?: Resolver<Types.Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  passwordsImported?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  passwordsSkippedExisting?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  passwordsUnchanged?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  passwordsUpdated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   permissionsCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   projectGroupsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   projectId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;

package/src/generated/schema-types.ts

@@ -448,8 +448,9 @@ export enum CdmIfMissing {
 export type CdmKeyResolverInput = {
   /**
    * `id` references an existing Grant user id. `email` resolves or creates a
-   * global passwordless email authentication method. Other values are treated as
-   * CDM-local external keys for project import/export.
+   * global email authentication method, passwordless unless the user carries a
+   * `password`. Other values are treated as CDM-local external keys for project
+   * import/export.
    */
   findBy?: InputMaybe<CdmFindBy>;
   ifMissing?: InputMaybe<CdmIfMissing>;
@@ -479,6 +480,31 @@ export enum CdmOnConflict {
   Update = 'update',
 }
 
+/**
+ * Password hash algorithms a CDM import can carry. Only `bcrypt` is accepted; the
+ * enum leaves room for further algorithms without changing the input shape.
+ */
+export enum CdmPasswordAlgorithm {
+  Bcrypt = 'bcrypt',
+}
+
+/**
+ * A password hash the importer already holds, to be stored as the user's email
+ * password credential (ADR 0010). Never the plaintext password.
+ */
+export type CdmPasswordInput = {
+  algorithm: CdmPasswordAlgorithm;
+  /**
+   * A bcrypt hash in the modular-crypt form `$2a$`, `$2b$` or `$2y$`, a two-digit
+   * cost and 53 salt-and-hash characters (60 in all), such as the output of Go's
+   * `bcrypt.GenerateFromPassword`. The cost must be within the range the deployment
+   * accepts (4 to 15). It is written only to the credential store: it is not kept in
+   * metadata, searchable tokens, audit values, events or the stored job payload once
+   * the job finishes, and an invalid hash is refused without being echoed.
+   */
+  hash: Scalars['String']['input'];
+};
+
 export type ChangeMyPasswordInput = {
   confirmPassword: Scalars['String']['input'];
   /** Required when a password already exists; omit when setting the first password. */
@@ -3586,6 +3612,22 @@ export type SyncProjectResult = {
   groupTagsLinked: Scalars['Int']['output'];
   groupsCreated: Scalars['Int']['output'];
   importId?: Maybe<Scalars['String']['output']>;
+  /** Users whose `password` hash was stored as their email credential for the first time. */
+  passwordsImported: Scalars['Int']['output'];
+  /**
+   * Users whose `password` hash was not stored because the credential or the identity is
+   * not the import's to write: a password set in Grant, an address the owner has verified,
+   * or an identity that already existed and was not created by an earlier import of this
+   * project.
+   */
+  passwordsSkippedExisting: Scalars['Int']['output'];
+  /** Users whose imported credential already equalled the hash in the document. */
+  passwordsUnchanged: Scalars['Int']['output'];
+  /**
+   * Users whose imported credential was replaced because the document carried a different
+   * hash for it.
+   */
+  passwordsUpdated: Scalars['Int']['output'];
   permissionsCreated: Scalars['Int']['output'];
   projectGroupsLinked: Scalars['Int']['output'];
   projectId: Scalars['ID']['output'];
@@ -4089,6 +4131,22 @@ export type UserCdmInput = {
   key: CdmKeyResolverInput;
   metadata?: InputMaybe<Scalars['JSON']['input']>;
   name: Scalars['String']['input'];
+  /**
+   * Existing password credential to import for this user. Only valid with
+   * `key.findBy: email`, because the credential lives on the email authentication
+   * method; any other resolver is a validation error.
+   *
+   * Ownership is forward-only. An imported credential is marked as imported and stays
+   * owned by the importing system while the email is unverified: a later import of this
+   * project with a different hash replaces it, an identical one changes nothing. Once the
+   * owner verifies the address, or the password is set, changed or reset in Grant, Grant owns
+   * it and imports never touch it again. A credential is written only for an identity the
+   * import creates, or one an earlier import of this project created whose email is still
+   * unverified; any other existing identity, including one found through GitHub or Google,
+   * is left untouched. An absent `password` never removes a
+   * stored credential. See `SyncProjectResult` for the counters.
+   */
+  password?: InputMaybe<CdmPasswordInput>;
   /** Direct user → permission grants (document keys or catalog `resourceSlug:action` refs). */
   permissions?: InputMaybe<Array<Scalars['String']['input']>>;
   primaryTag?: InputMaybe<Scalars['String']['input']>;

package/src/operations/projects/project-sync-job.graphql

@@ -22,6 +22,10 @@ query ProjectSyncJob($id: ID!, $scope: Scope!, $jobId: ID!) {
       usersCreated
       userRolesAssigned
       projectUserApiKeysCreated
+      passwordsImported
+      passwordsUpdated
+      passwordsUnchanged
+      passwordsSkippedExisting
       warnings
     }
     warnings

package/src/schema/projects/inputs/sync-project-cdm.graphql

@@ -23,6 +23,14 @@ enum CdmIfMissing {
   createNew
 }
 
+"""
+Password hash algorithms a CDM import can carry. Only `bcrypt` is accepted; the
+enum leaves room for further algorithms without changing the input shape.
+"""
+enum CdmPasswordAlgorithm {
+  bcrypt
+}
+
 input CdmModeInput {
   strategy: CdmModeStrategy!
   onConflict: CdmOnConflict
@@ -39,8 +47,9 @@ input CdmKeyResolverInput {
   value: String!
   """
   `id` references an existing Grant user id. `email` resolves or creates a
-  global passwordless email authentication method. Other values are treated as
-  CDM-local external keys for project import/export.
+  global email authentication method, passwordless unless the user carries a
+  `password`. Other values are treated as CDM-local external keys for project
+  import/export.
   """
   findBy: CdmFindBy
   ifMissing: CdmIfMissing
@@ -128,6 +137,23 @@ input UserApiKeyCdmInput {
   metadata: JSON
 }
 
+"""
+A password hash the importer already holds, to be stored as the user's email
+password credential (ADR 0010). Never the plaintext password.
+"""
+input CdmPasswordInput {
+  algorithm: CdmPasswordAlgorithm!
+  """
+  A bcrypt hash in the modular-crypt form `$2a$`, `$2b$` or `$2y$`, a two-digit
+  cost and 53 salt-and-hash characters (60 in all), such as the output of Go's
+  `bcrypt.GenerateFromPassword`. The cost must be within the range the deployment
+  accepts (4 to 15). It is written only to the credential store: it is not kept in
+  metadata, searchable tokens, audit values, events or the stored job payload once
+  the job finishes, and an invalid hash is refused without being echoed.
+  """
+  hash: String!
+}
+
 input UserCdmInput {
   key: CdmKeyResolverInput!
   name: String!
@@ -147,6 +173,22 @@ input UserCdmInput {
   primaryTag: String
   apiKeys: [UserApiKeyCdmInput!]
   """
+  Existing password credential to import for this user. Only valid with
+  `key.findBy: email`, because the credential lives on the email authentication
+  method; any other resolver is a validation error.
+
+  Ownership is forward-only. An imported credential is marked as imported and stays
+  owned by the importing system while the email is unverified: a later import of this
+  project with a different hash replaces it, an identical one changes nothing. Once the
+  owner verifies the address, or the password is set, changed or reset in Grant, Grant owns
+  it and imports never touch it again. A credential is written only for an identity the
+  import creates, or one an earlier import of this project created whose email is still
+  unverified; any other existing identity, including one found through GitHub or Google,
+  is left untouched. An absent `password` never removes a
+  stored credential. See `SyncProjectResult` for the counters.
+  """
+  password: CdmPasswordInput
+  """
   Denormalized search tokens for project-scoped user list views.
   """
   searchable: JSON

package/src/schema/projects/types/sync-project-result.graphql

@@ -16,6 +16,26 @@ type SyncProjectResult {
   usersCreated: Int!
   userRolesAssigned: Int!
   projectUserApiKeysCreated: Int!
+  """
+  Users whose `password` hash was stored as their email credential for the first time.
+  """
+  passwordsImported: Int!
+  """
+  Users whose imported credential was replaced because the document carried a different
+  hash for it.
+  """
+  passwordsUpdated: Int!
+  """
+  Users whose imported credential already equalled the hash in the document.
+  """
+  passwordsUnchanged: Int!
+  """
+  Users whose `password` hash was not stored because the credential or the identity is
+  not the import's to write: a password set in Grant, an address the owner has verified,
+  or an identity that already existed and was not created by an earlier import of this
+  project.
+  """
+  passwordsSkippedExisting: Int!
   resourcesCreated: Int!
   permissionsCreated: Int!
   tagsCreated: Int!